Construction and development loans consist of loans to commercial customers for the construction of their business facilities.  They also include construction loans to builders and developers for the construction of one- to four-family residences and the development of one- to four-family lots, residential subdivisions, condominium developments and other commercial developments.  This portfolio may be particularly adversely affected by job losses, declines in real estate values, declines in home sale volumes, and declines in new home building. Declining real estate values may result in sharp increases in losses, particularly in the land development and construction loan portfolios to residential developers.  This type of lending is generally considered to have more complex credit risks than traditional single-family residential lending because the principal is concentrated in a limited number of loans with repayment dependent on the successful completion and sales of the related real estate project.  Consequently, these loans are often more sensitive to adverse conditions in the real estate market or the general economy than other real estate loans.  These loans are generally less predictable and more difficult to evaluate and monitor and collateral may be difficult to dispose of in a market decline. Additionally, we may experience significant construction loan losses if independent appraisers or project engineers inaccurately estimate the cost and value of construction loan projects.

A substantial portion of our loan portfolio consists of commercial and residential real estate-related loans, including real estate development, construction and residential and commercial mortgage loans.  As of December 31, 2022,2023, we had approximately $537.6$585.1 million of commercial real estate loans outstanding, which represented approximately 45.7%43.7% of our total loan portfolio.  As of that same date, we had approximately $139.1$189.8 million in residential real estate loans outstanding, or approximately 11.8%14.2% of our total loan portfolio. Consequently, real estate-related credit risks are a significant concern for us. The adverse consequences from real estate-related credit risks tend to be cyclical and are often driven by national economic developments that are not controllable or entirely foreseeable by us or our borrowers.

Our commercial loan portfolio, including commercial mortgages, was approximately $979.3 million$1.092 billion at December 31, 2022,2023, comprising approximately 83.2%81.6% of our total loan portfolio. Commercial loans generally carry larger loan balances and can involve a greater degree of financial and credit risk than other loans. Any significant failure to pay on time by our customers would hurt our earnings. The increased financial and credit risk associated with these types of loans are a result of several factors, including the concentration of principal in a limited number of loans and borrowers, the size of loan balances, the effects of general economic conditions on income-producing properties and the increased difficulty of evaluating and monitoring these types of loans. In addition, when underwriting a commercial or industrial loan, we may take a security interest in commercial real estate, and, in some instances upon a default by the borrower, we may foreclose on and take title to the property, which may lead to potential financial risks for us under applicable environmental laws. If hazardous substances were discovered on any of these properties, we may be liable to governmental agencies or third parties for the costs of remediation of the hazard, as well as for personal injury and property damage. Many environmental laws can impose liability regardless of whether we knew of, or were responsible for, the contamination.

Loans to residential developers involved in the development or sale of 1-4 family residential properties were approximately $19.2 million, $21.4 million $16.1 million and $21.4$16.1 million at December 31, 2023, 2022 2021 and 2020,2021, respectively. As we continue our on-going portfolio monitoring, we will make credit and reserve decisions based on the current conditions of the borrower or project combined with our expectations for the future. If the housing market deteriorates, we could experience higher charge-offs and delinquencies in this portfolio.

The banking industry is heavily regulated under both federal and state law.  These regulations are primarily intended to protect customers and the Deposit Insurance Fund, not our creditors or shareholders.  We are subject to extensive regulation by the Federal Reserve, the FDIC and the DIFS, in addition to other regulatory and self-regulatory organizations.  Future regulatory changes or accounting pronouncements may increase our regulatory capital requirements or adversely affect our regulatory capital levels.  Regulations affecting banks and financial services companies undergo continuous change, and we cannot predict the ultimate effect of such changes, which could have a material adverse effect on our profitability or financial condition.

The Company's ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services institutions are interrelated as a result of credit, trading, clearing, counterparty or other relationships between financial institutions. The Company has exposure to multiple counterparties, and the Company routinely executes transactions with counterparties in the financial industry. As a result, defaults by, or even rumors or questions about, one or more financial services institutions, or the financial services industry generally, could lead to market-wide liquidity problems and losses or defaults by the Company or by other institutions. This is sometimes referred to as "systemic risk" and may adversely affect financial intermediaries, such as clearing agencies, clearing houses, banks, securities firms and exchanges, with which the Company interacts on a daily basis, and therefore could adversely affect the Company.

We are and will continue to be dependent upon the services of our management team and other key personnel. LosingDuring 2023, we experienced a transition in the chief executive officer and chief financial officer positions.  Challenges with these transitions could adversely affect our operations. Additionally, losing the services of one or more key members of our management team could adversely affect our operations.

Management regularly reviews and updates our internal controls, disclosure controls and procedures, and corporate governance policies and procedures. Any system of controls, however well designed and operated, is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met.  If we fail to identify and remediate control deficiencies, it is possible that a material misstatement of interim or annual financial statements will not be prevented or detected on a timely basis.  In addition, any failure or circumvention of our other controls and procedures or failure to comply with regulations related to controls and procedures could have a material adverse effect on our business, results of operations and financial condition.

Cybersecurity threats and incidents can range from uncoordinated individual attempts to gain unauthorized access to information technology (IT) systems to sophisticated and targeted measures known as advanced persistent threats, directed at the Company and/or its third party service providers. While we have experienced, and expect to continue to experience, these types of threats and incidents, none of them to date have been material to the Company. Although we employ comprehensive measures to prevent, detect, address and mitigate these threats (including access controls, employee training, data encryption, vulnerability assessments, continuous monitoring of our IT networks and systems and maintenance of backup and protective systems), cybersecurity incidents, depending on their nature and scope, could potentially result in the misappropriation, destruction, corruption or unavailability of critical data and confidential or proprietary information (our own or that of third parties) and the disruption of business operations. The potential consequences of a material cybersecurity incident include reputational damage, litigation with third parties and increased cybersecurity protection and remediation costs, which in turn could materially adversely affect our results of operations.

The banking industry is undergoing rapid technological changes with frequent introductions of new technology-driven products and services.  In addition to better serving customers, the effective use of technology increases efficiency and enables financial institutions to reduce costs.  Our future success will depend, in part, on our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands for convenience as well as to create additional efficiencies in our operations.  Many of our competitors have substantially greater resources to invest in technological improvements.  There can be no assurance that we will be able to effectively implement new technology-driven products and services or be successful in marketing such products and services to our customers.

At December 31, 2022,2023, our gross deferred tax asset was $11.9$10.0 million. Our ability to use our deferred tax assets to offset future taxable income will be limited if we experience an "ownership change" as defined in Section 382 of the Internal Revenue Code. In general, an ownership change will occur if there is a cumulative increase in our ownership by "5-percent shareholders" (as defined in the Code) that exceeds 50 percentage points over a rolling three-year period. A corporation that experiences an ownership change will generally be subject to an annual limitation on the use of its pre-ownership change deferred tax assets equal to the equity value of the corporation immediately before the ownership change, multiplied by the long-term tax-exempt rate.

If an "ownership change" occurs, we could lose certain built-in losses that have not been recognized for tax purposes. The amount of the permanent loss would depend on the size of the annual limitation (which is in part a function of our market capitalization at the time of an "ownership change") and the remaining carry forward period (U.S. federal net operating losses generally may be carried forward for a period of 20 years).

Our customers rely on us to deliver superior, personalized financial services with the highest standards of ethics, performance, professionalism and compliance. Damage to our reputation could undermine the confidence of our current customers and our ability to attract potential customers. Such damage could also impair the confidence of our contractual counterparties and vendors and ultimately affect our ability to effect transactions. Maintenance of our reputation depends not only on our success in maintaining our service-focused culture and controlling and mitigating the various risks described herein, but also on our success in identifying and appropriately addressing issues that may arise in areas such as potential conflicts of interest, anti-money laundering, client personal information and privacy issues, employee, customer and other third party fraud, record-keeping, regulatory investigations and any litigation that may arise from the failure or perceived failure of us to comply with legal and regulatory requirements.

We are vulnerable to reputational harm because we operate in an industry in which integrity and the confidence of our customers are of critical importance. Our employees could engage in misconduct that adversely affects our customers, other employees, and/or our business. For example, if an employee were to engage in fraudulent, illegal, wrongful or suspicious activities, and/or activities resulting in consumer harm, we could be subject to litigation, regulatory sanctions or penalties, and suffer serious harm to our reputation (as a consequence of the negative perception resulting from such activities), financial position, customer relationships and ability to attract new customers. Our business often requires that we deal with confidential information. If our employees were to improperly use or disclose this information, even if inadvertently, we could suffer serious harm to our reputation, financial position and current and future business relationships. It is not always possible to deter employee misconduct, and the precautions we take to detect and prevent this activity may not always be effective. Misconduct or harassment by our employees, or even unsubstantiated allegations of misconduct or harassment, or improper use or disclosure of confidential information by our employees, even inadvertently, could result in a material adverse effect on our business, financial condition or results of operations.

We depend to a significant extent on relationships with third party service providers. Specifically, we utilize third party core banking services and receive credit card and debit card services, branch capture services, Internet banking services and services complementary to our banking products from various third party service providers. If these third party service providers experience difficulties or terminate their services and we are unable to replace them with other service providers, our operations could be interrupted. It may be difficult for us to replace some of our third party vendors, particularly vendors providing our core banking, credit card and debit card services, in a timely manner if they were unwilling or unable to provide us with these services in the future for any reason. If an interruption were to continue for a significant period of time, it could have a material adverse effect on our business, financial condition or results of operations. Even if we are able to replace them, it may be at higher cost to us, which could have a material adverse effect on our business, financial condition or results of operations.

Stock price volatility may make it more difficult for a shareholder to resell our common stock when a shareholder wants to and at prices a shareholder finds attractive or at all.  Our stock price can fluctuate significantly in response to a variety of factors, regardless of operating results.  These factors include, among other things:

The Company's articles of incorporation authorize its Board of Directors, without shareholder approval, to, among other things, issue additional shares of common or preferred stock. The issuance of any additional shares of common or preferred stock could be dilutive to a shareholder's ownership of Company common stock.

To the extent that the Company issues options or warrants to purchase common stock in the future and the options or warrants are exercised, the Company's shareholders may experience further dilution. Holders of shares of Company common stock have no preemptive rights that entitle holders to purchase their pro rata share of any offering of shares of any class or series and, therefore, shareholders may not be permitted to invest in future issuances of Company common or preferred stock.

Although our common stock is listed for trading on The Nasdaq Global Select Market, our common stock has substantially less liquidity than the average liquidity for companies listed on The Nasdaq Global Select Market.  A public trading market having the desired characteristics of depth, liquidity and orderliness depends on the presence in the marketplace of willing buyers and sellers of our common stock at any given time. This marketplace depends on the individual decisions of investors and general economic and market conditions over which we have no control. This limited market may affect a shareholder’s ability to sell their shares on short notice, and the sale of a large number of shares at one time could temporarily depress the market price of our common stock. For these reasons, our common stock should not be viewed as a short-term investment.

Our common stock is not a deposit account or other obligation of any bank and is not insured by the FDIC or any other governmental entity.  Investment in Company common stock is subject to risk, including possible loss.

The Company has in the past and may in the future increase its capital by entering into debt or debt-like financing or issuing debt or equity securities, which could include issuances of senior notes, subordinated notes, preferred stock or common stock. In the event of the Company's liquidation, its lenders and holders of its debt securities would receive a distribution of the Company's available assets before distributions to the holders of Company common stock. The Company's decision to incur debt and issue securities in future offerings will depend on market conditions and other factors beyond its control. The Company cannot predict or estimate the amount, timing or nature of its future offerings and debt financings. Future offerings could reduce the value of shares of Company common stock and dilute a shareholder's interest in the Company.

Our articles of incorporation and bylaws, and the laws of Michigan, include provisions which are designed to provide our Board of Directors with time to consider whether a hostile takeover offer is in our best interest and the best interests of our shareholders. These provisions could discourage potential acquisition proposals and could delay or prevent a change in control. The provisions also could diminish the opportunities for a holder of our common stock to participate in tender offers, including tender offers at a price above the then-current price for our common stock. These provisions could also prevent transactions in which our shareholders might otherwise receive a premium for their shares over then current market prices, and may limit the ability of our shareholders to approve transactions that they may deem to be in their best interests.

The Michigan Business Corporation Act contains provisions intended to protect shareholders and prohibit or discourage certain types of hostile takeover activities. In addition to these provisions and the provisions of our articles of incorporation and bylaws, federal law requires the Federal Reserve Board's approval prior to acquisition of "control" of a bank holding company. All of these provisions may have the effect of delaying or preventing a change in control of the Company without action by our shareholders, and therefore, could adversely affect the price of our common stock.

Cybersecurity Risk Management and Strategy

The Company is exposed to cybersecurity threats and incidents that can range from uncoordinated individual attempts to gain unauthorized access to information systems to sophisticated and targeted measures known as advanced persistent threats, directed at the Company or its third party service providers. While we have experienced, and expect to continue to experience, cybersecurity threats, we have not experienced a material cybersecurity incident in the three year period ended December 31, 2023.  Management considers various factors in assessing the materiality of a cybersecurity incident, including the potential for misappropriation, destruction, corruption or unavailability of critical data and confidential or proprietary information (our own or that of third parties) and the business operation disruption.  The potential consequences of a material cybersecurity incident could include reputational damage, litigation with third parties, regulatory criticism or proceedings and increased cybersecurity protection and remediation costs, which in turn could materially adversely affect our results of operations.  We evaluate the risks of data theft (including theft of sensitive, proprietary and other data categories, in addition to personal data), and harm to customer or third party relationships or the possibility of litigation or regulatory investigation or actions that could materially adversely affect our results of operations and our reputation. 

The Company maintains a number of processes to identify and respond to cybersecurity threats and incidents.  The Company’s information security and third party risk management programs evaluate cybersecurity threats posed by internal and external factors and support daily operational functions that prevent unauthorized access or compromise. 

The information security and third party risk management programs report functionally to the Company’s overall risk management function, led by the Chief Risk Officer.  The information security function, led by the Information Security Officer and the Chief Technology Officer, evaluates internal and external cybersecurity threat factors according to a written policy statement approved by the Board periodically.  The Company maintains processes to evaluate third parties whose information systems support critical Company operations.

Risk management evaluates cybersecurity risks and information systems of third parties at onboarding and on an ongoing basis.  Processes include evaluating reports or performing assessments of a third party’s information systems leveraging cybersecurity frameworks such as International Organization for Standardization (ISO) ISO 27001, Cybersecurity Framework (CSF) published by the US National Institute of Standards and Technology, as well as evaluating reports issued by a third party’s auditors developed under the attestation standards issued by the American Institute of Certified Public Accountants (AICPA).  The Company integrates risk mitigation into additional onboarding requirements to address identified risk factors, such as developing service level agreements and minimum required information security performance expectations to enable cybersecurity threats and incidents to be managed within applicable industry or regulatory standards.  The Company requires contracts of third parties to incorporate industry and regulatory standard clauses requiring reporting to the Company of the occurrence and mitigation of cyber security threats and incidents as well as to maintain adequate levels of cybersecurity insurance coverage. 

The information security function performs periodic risk assessments of the Company’s information systems and cybersecurity threats using industry standard methodologies based on NIST CSF and MITRE Att&ck® methodologies, as well as regulatory guidance issued by the Federal Financial Institutions Examination Council (FFIEC) and state and federal regulators, including the Federal Deposit Insurance Corporation and the Michigan Department of Insurance and Financial Services.  Based on risk, the Company’s information security function performs internal engagements to provide assurance to senior management and the Board that the company’s information systems are able to identify, escalate and mitigate cybersecurity threats on a routine basis.  The Company also engages external independent parties to perform independent audit engagements, as well as other assessments of the Company’s information security and third party risk management program and information systems. 

Cybersecurity Governance

On a periodic basis, typically monthly, management’s technology steering committee receives reporting summarizing cybersecurity threat and incident monitoring activity, along with details of remediation to address threats and incidents.  The summary considers both internal as well as external threat events and outlines management’s approach to enable the timely identification and notice of a material incident, should one occur, without unreasonable delay.  The results of internal and external assessments of the Company’s cybersecurity threat monitoring capabilities are provided to the committee.  Meeting minutes of the committee are maintained and made available to the Board of Directors. 

The Board of Directors receives periodic training related to cyber security and is responsible for approval and oversight of management’s policies governing information system security and cybersecurity threats and incidents, as well as oversight of management’s approach to secure the Company’s information systems.  The Board of Directors delegates the oversight of risk management to the Audit Committee of the Board.

The Audit Committee receives and reviews reports on the Company’s risk management processes, which include assessments of management’s cybersecurity threats and incident management functions.  The committee receives periodic reporting of certain cybersecurity risks from the information security officer, including reports related to social engineering, effectiveness of cyber security training, as well as vulnerability and penetration assessments performed on management’s information systems by internal and by external parties and audit reports of information systems and cybersecurity threat and incident monitoring. 

Any event that could become a cybersecurity incident is reviewed by risk management and information security and the technology steering committee.  The evaluation of reported events by the committee includes reporting of any mitigation or remediation determined necessary to address the threat posed by the reported event.  If any event rose to the level of a material incident, management maintains a response plan to mitigate the impact, maintain business continuity and provide for internal and external communication, including required communication. 

PARTII

- 21 -

Issuer Purchases of Equity Securities

The following table provides information regarding the Company’s purchase of its own common stock during the fourth quarter of 2022.2023.  All employee transactions are under stock compensation plans.  These include shares of Macatawa Bank Corporation common stock surrendered for cancellation to satisfy tax withholding obligations that occur upon the vesting of restricted shares.  The value of the shares withheld is determined based on the closing price of Macatawa Bank Corporation common stock at the date of vesting.  The Company has no publicly announced repurchase plans or programs.