As of December 31, 2017,2023, our nonperforming loans, (which consist ofwhich includes nonaccrual loans and loans past due 90 days or more and still accruing interest, and loans modified under troubled debt restructurings, and excluded purchased credit impaired loans) totaled $23.9$26.4 million, or 1.04%0.64% of our loan portfolio, and ourportfolio. Our nonperforming assets, (whichwhich include nonperforming loans plus other real estate owned)foreclosed assets, net, totaled $25.9$30.3 million, or 1.13%0.47% of loans. In addition, we had $8.4 million in accruing loans (not included in the nonperforming loan totals) that were 31-89 days delinquent as of December 31, 2017.total assets.

Our nonperforming assets adversely affect our net income in various ways. We do not record interest income on nonaccrual loans or other real estate owned,foreclosed assets, thereby adversely affecting our net income and returns on assets and equity, increasing our loan administration costs and adversely affecting our efficiency ratio. When we take collateral in foreclosure and similar proceedings, we are required to mark the collateral to its then-fairfair market value, which may result in a loss. These nonperforming loans and other real estate ownedforeclosed assets also increase our risk profile and the capital our regulators believe is appropriate in light of such risks. The resolution of nonperforming assets requires significant time commitments from management and can be detrimental

to the performance of their other responsibilities.responsibilities, and may also involve additional financial resources. If we experience increases in nonperforming loans and nonperforming assets, our net interest income may be negatively impacted and our loan administration costs could increase, each of which could have an adverse effect on our net income and related ratios, such as return on assets and equity.

A significant portion of our loan portfolio is secured by real property. In the ordinary course of business, we may foreclose on and take title to properties securing certain loans. In doing so, there is a risk that hazardous or toxic substances could be found on these properties. If hazardous or toxic substances are found, we may be liable for remediation costs, as well as for personal injury and property damage. Environmental laws may require us to incur substantial expenses and may materially reduce the affected property's value or limit our ability to use or sell the affected property. In addition, future laws or more stringent interpretations or enforcement policies with respect to existing laws may increase our exposure to environmental liability. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on our financial condition and results of operations.

Liquidity is essential to our business. An inability to raise funds through deposits, borrowings, the sale of loans and other sources could have a substantial negative effect on our liquidity. Our most important source of funds consists of customer deposits. Deposit balances can decrease when customers perceive alternative investments, such as the stockmoney market providefunds, treasury securities, and certificates of deposit at other financial institutions as providing a better risk/return trade-off. If customers move money out of bank deposits and into other investments, we could lose a relatively low cost source of funds, which would require us to seek other, potentially higher cost funding alternatives. Other primary sources of funds consist of cash from operations, investment securities maturities and sales, and funds from sales of our stock. Additional liquidity is provided by brokered deposits, bank lines of credit, repurchase agreements and the ability to borrow from the Federal Reserve Bank and the FHLB. The Federal Reserve established the BTFP on March 12, 2023, offering qualifying banks loans of up to one year in length collateralized by qualifying assets, including U.S. securities valued at par, to serve as a source of additional liquidity against high-quality securities and reducing an institution's need to quickly sell high-quality securities to meet liquidity needs. The Federal Reserve has announced that it is ending the BTFP and will cease making new loans under this program on March 11, 2024. Our access to funding sources in amounts adequate to finance or capitalize our activities or on terms that are acceptable to us could be impaired by factors that affect us directly or the financial services industry or economy in general, such as disruptions in the financial markets or negative views and expectations about the prospects for the financial services industry.

Any decline in available funding could adversely impact our ability to originate loans, invest in securities, pay our expenses, pay dividends to our shareholders, or fulfill obligations such as repaying our borrowings or meeting deposit withdrawal demands, any of which could have a material adverse impact on our liquidity, business, financial condition and results of operations.

We are required by federal and state regulatory authorities to maintain adequate levels of capital to support our operations. We intend to grow our business organically and to explore opportunities to grow our business by taking advantage of attractive acquisition opportunities, and such growth plans may require us to raise additional capital to ensure that we have adequate levels of capital to support such growth on top of our current operations. In order to accommodate future capital needs, we maintain a universal shelf registration statement, which allowedallows for future sale up to $75$100 million of securities. During the first and second quarters of 2017, we utilized the shelf registration and issued an additional 750,000 shares of common stock resulting in $24.4 million of new capital for the Company, net of expenses, leaving approximately $49.3 million of securities available to be issued under our shelf registration statement. Our ability to raise additional capital will depend on conditions in the capital markets, economic conditions and a number of other factors, including investor perceptions regarding the banking industry, market conditions and governmental activities, and on our financial condition and performance. If we were required to raise additional capital in the current interest rate environment, we believe the pricing and other terms investors may require in such an offering may not be attractive to us. Accordingly, we cannot assure you of our ability to raise additional capital, if needed or desired, on terms acceptable to us. If we cannot raise additional capital when needed or desired, our ability to further expand our operations through internal growth or acquisitions could be materially impaired.

Downgrades in the credit rating of one or more insurers that provide credit enhancement for our state and municipal securities portfolio may have an adverse impact on the market for, and valuation of, these types of securities.

We invest in tax-exempt and taxable state and local municipal securities, some of which are insured by monoline insurers. As of December 31, 2017,2023, we had $268.3$671.9 million of amortized cost of municipal securities, (recorded values), which represented 41.7%34.5% of our total securities portfolio.portfolio based upon amortized cost. Following the onset of the financial crisis, several of these insurers came under scrutiny by rating agencies. Even though management generally purchases municipal securities on the overall credit strength of the issuer, the reduction in the credit rating of an insurer may negatively impact the market for and valuation of our investment securities. Such a downgrade could adversely affect our liquidity, financial condition and results of operations.

Our ability to pay dividends is subject to certain limitations and restrictions, and there is no guarantee that we will be able to continue paying the same level of dividends in the future that we have paid in the past or that we will be able to pay future dividends at all.

The ability of the Bank to pay dividends to us is limited by its obligations to maintain sufficient capital and liquidity and by other general restrictions on dividends that are applicable to the Bank, including the requirement under the Iowa Banking Act that the Bank may not pay dividends in excess of its undivided profits. If these regulatory requirements are not met, the Bank will not be able to pay dividends to us, and we may be unable to pay dividends on our common stock.

In addition, as a bank holding company, our ability to declare and pay dividends is subject to the guidelines of the Federal Reserve regarding capital adequacy and dividends. The Federal Reserve guidelines generally require us to review the effects of the cash payment of dividends on common stock and other Tier 1 capital instruments (i.e.,(e.g. perpetual preferred stock and trust preferred debt) in light of our earnings, capital adequacy and financial condition. As a general matter, the Federal Reserve indicates that the board of directors of a bank holding company (including a financial holding company) should eliminate, defer or significantly reduce the Company’scompany’s dividends if:

As of December 31, 2017,2023, we had $23.8$42.3 million of junior subordinated debentures held by threefive statutory business trusts that we control. Interest payments on the debentures, which totaled $0.9$3.5 million for the year ended December 31, 2017,2023, must be paid before we pay dividends on our capital stock, including our common stock. We have the right to defer interest payments on the debentures for up to 20 consecutive quarters. However, if we elect to defer interest payments, all deferred interest must be paid before we may pay dividends on our capital stock.

Our ability to attractengage in routine funding and retain managementother transactions could be negatively affected by the actions and key personnel may affect future growththe soundness of other financial institutions. Financial services institutions are generally interrelated as a result of trading, clearing, counterparty, credit, reputational, or other relationships. We have exposure to many different industries and earnings.

The banking and financial services businesses in our markets are highly competitive. Our competitors include large regional banks, local community banks, savings and loan associations, securities and brokerage companies, mortgage companies, insurance companies, finance companies, money market mutual funds, small local credit unions as well as large aggressive and expansion-minded credit unions, fintech companies, and other non-bank financial services providers. Many of these competitors are not subject to the same regulatory restrictions as we are. Many of our unregulated competitors compete across geographic boundaries and are able to provide customers with a competitive alternative to traditional banking services.services, including financial transaction processing, lending platforms, and maintenance of funds.

Increased competition in our markets may result in a decrease in the amounts of our loans and deposits, reduced spreads between loan rates and deposit rates, increased pressure on underwriting standards, or loan terms that are more favorable to the borrower. Any of these results could have a material adverse effect on our results, our financial condition, and our ability to grow and remain profitable. If increased competition causes us to significantly discountIn addition, the interest rates we offer on loans or increase the amount we pay on deposits, our net interest income could be adversely impacted. If increased competition causes us to modify our underwriting standards, we could be exposed to higher losses from lending activities. Additionally, many of our competitors are much larger in total assets and capitalization, have greater access to capital markets, have larger lending limits and offer a broader range of financial services than we can offer.

The financial services industry continues to undergo rapid technological changes with frequent introductions of new technology-driven products and services. In addition to enabling us to better serve our customers, the effective use of technology increases efficiency and the potential for cost reduction. Our future success will depend in part upon our ability, both internally and through our core processor, and other third party partners, to address the needs of our customers by using technology to provide products and services that will satisfy customer demands for convenience as well as to create additional efficiencies in our operations as we continue to grow our market share. Many of our larger competitors have substantially greater resources to invest in technological improvements. As a result, they may be able to offer additional or superior products to those that we will be able to offer, which could put us at a competitive disadvantage. Accordingly, we cannot provide you with assurance that we will be able to effectively implement new technology-driven products and services or be successful in marketing such products and services to our customers.

As a bank, we are susceptible to fraudulent activity, information security breaches and cybersecurity-related incidents that may be committed against us, our third party partners, or our clients, which may result in financial losses or increased costs to us or our clients, disclosure or misuse of our information or our client information, misappropriation of assets, privacy breaches against our clients, litigation or damage to our reputation. Such fraudulent activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering and other dishonest acts. Information security breaches and cybersecurity-related incidents may include fraudulent or unauthorized access to systems used by us or our clients, denial or degradation of service attacks, andransomware, malware or other cyber-attacks.

There continues to be a rise in electronic fraudulent activity, security breaches and cyber-attacks within the financial services industry, especially in the commercial banking sector due to cyber criminals targeting commercial bank accounts. Moreover, in recent periods, severalaccounts, and as a result of increasingly sophisticated methods of conducting cyber attacks, including those employing artificial intelligence. Several large corporations, including financial institutions, vendors specializing in providing services to financial institutions and retail companies, have suffered major data breaches, in some cases exposing not only confidential and proprietary corporate information, but also sensitive financial and other personal information of their customers and employees and subjecting them to potential fraudulent activity.

Information pertaining to us and our clients is maintained, and transactions are executed, on networks and systems maintained by us and certain third party partners, such as our online banking, mobile banking or accounting systems. The secure maintenance and transmission of confidential information, as well as execution of transactions over these systems, are essential to protect us and our clients against fraud and security breaches and to maintain the confidence of our clients. Breaches of information security also may occur through intentional or unintentional acts by those having access to our systems or the confidential information of our clients, including employees. In addition, increases in criminal activity levels and sophistication, advances in computer capabilities, new discoveries, vulnerabilities in third party technologies (including browsers and operating systems) or other developments could result in a compromise or breach of the technology, processes and controls that we use to prevent fraudulent transactions and to protect data about us, our clients and underlying transactions, as well as the technology used by our clients to access our systems. Our third party partners’ inability to anticipate, or failure to adequately mitigate, breaches of security could result in a number of negative events, including losses to us or our clients, loss of business or clients, damage to our reputation, the incurrence of additional expenses, disruption to our business, additional regulatory scrutiny or penalties or our exposure to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition, results of operations and growth prospects. While we maintain insurance coverage that may, subject to policy terms and conditions, cover certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses.

Our business is highly dependent on the successful and uninterrupted functioning of our information technology and telecommunications systems, third party servicers, accounting systems, mobile and online banking platforms and financial intermediaries. We outsource to third parties many of our major systems, such as data processing and mobile and online banking. The failure of these systems, or the termination of a third party software license or service agreement on which any of these systems is based, could interrupt our operations. Because our information technology and telecommunications systems interface with and depend on third party systems, we could experience service denials if demand for such services exceeds capacity or such third party systems fail or experience interruptions. A system failure or service denial could result in a deterioration of our ability to process loans or gather deposits and provide customer service, compromise our ability to operate effectively, result in potential noncompliance with applicable laws or regulations, damage our reputation, result in a loss of customer business or subject us to additional regulatory scrutiny and possible financial liability, any of which could have a material adverse effect on business, financial condition, results of operations and growth prospects. In addition, failures of third parties to comply with applicable laws and regulations, or fraud or misconduct on the part of employees of any of these third parties, could disrupt our operations or adversely affect our reputation.

It may be difficult for us to replace some of our third party vendors, particularly vendors providing our core banking and information services, in a timely manner if they are unwilling or unable to provide us with these services in the future for any reason, and even if we are able to replace them, it may be at higher cost or result in the loss of customers. Any such events could have a material adverse effect on our business, financial condition, results of operations and growth prospects.

Our operations rely heavily on the secure processing, storage and transmission of information and the monitoring of a large number of transactions on a minute-by-minute basis, and even a short interruption in service could have significant consequences. We also interact with and rely on retailers, for whom we process transactions, as well as financial counterparties and regulators. Each of these third parties may be targets of the same types of fraudulent activity, computer break-ins and other cyber securitycybersecurity breaches described above, including those employing artificial intelligence, and the cyber securitycybersecurity measures that they maintain to mitigate the risk of such activity may be different than our own and may be inadequate.

As a result of financial entities and technology systems becoming more interdependent and complex, a cyber incident, information breach or loss, or technology failure that compromises the systems or data of one or more financial entities could have a material impact on counterparties or other market participants, including ourselves. As a result of the foregoing, our

ability to conduct business may be adversely affected by any significant disruptions to us or to third parties with whom we interact.

Employee errors and employee and customer misconduct could subject us to financial losses or regulatory sanctions and seriously harm our reputation. Misconduct by our employees could include hiding unauthorized activities from us, improper or unauthorized activities on behalf of our customers or improper use of confidential information. It is not always possible to prevent

We maintain a system of internal controls and insurance coverage to mitigate against operational risks, including data processing system failures and errors and customer or employee fraud. Should our internal controls fail to prevent or detect an occurrence, and if any resulting loss is not insured or exceeds applicable insurance limits, such failure could have a material adverse effect on our business, financial condition and results of operations.

Our risk management framework seeks to mitigate risk and loss to us. We have established processes and procedures intended to identify, measure, monitor, report and analyze the types of risk to which we are subject, including liquidity risk, credit risk, market risk, interest rate risk, operational risk, compensation risk, legal and compliance risk, and reputational risk, among others. However, as with any risk management framework, there are inherent limitations to our risk management strategies as there may exist, or develop in the future, risks that we have not appropriately anticipated or identified. Our ability to successfully identify and manage risks facing us is an important factor that can significantly impact our results. If our risk management framework proves ineffective, we could suffer unexpected losses and could be materially adversely affected.

Management regularly reviews and updates our internal controls, disclosure controls and procedures and corporate governance policies and procedures. Any system of controls, however well designed and operated, is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met. Any failure or circumvention of our controls and procedures or failure to comply with regulations related to controls and procedures could have a material adverse effect on our financial condition and results of operations.

In deciding whether to extend credit or enter into other transactions with customers and counterparties, we may rely on information furnished to us by or on behalf of customers and counterparties, including financial statements and other financial information. We also may rely on representations of customers and counterparties as to the riskaccuracy and completeness of that information. In deciding whether to extend credit, we may rely upon our business,customers' representations that their financial statements conform to GAAP and present fairly, in all material respects, the financial condition, or results of operations from negative publicity, is inherent inand cash flows of the customer. We also may rely on customer representations and certifications, or other audit or accountants' reports, with respect to the business and financial condition of our business. Negative publicity can result from actual or alleged conduct in a numberclients. Our financial condition, results of areas, including legaloperations, financial reporting and regulatory compliance, lending practices, corporate governance, litigation, inadequate protection of customer data, ethical behavior of our

Future increases in order to comply, and could therefore also materially and adversely affect our business, financial condition and results of operations.

The Federal Reserve, the FDIC, and the Iowa Division of Banking periodically examine our business, including our compliance with laws and regulations. If, as a result of an examination, a banking agency were to determine that our financial condition, capital resources, asset quality, earnings prospects, management, liquidity or other aspects of any of our operations had become unsatisfactory, or that we were in violation of any law or regulation, they may take a number of different remedial actions as they deem appropriate. These actions include the power to enjoin “unsafe or unsound” practices, to require affirmative action to correct any conditions resulting from any violation or practice, to issue an administrative order that can be judicially enforced, to direct an increase in our capital, to restrict our growth, to assess civil money penalties, to fine or remove officers and directors and, if it is concluded that such conditions cannot be corrected or there is an imminent risk of loss to depositors, to terminate our deposit insurance and place our bank into receivership or conservatorship. Any regulatory action against us could have an adverse effect on our business, financial condition and results of operations.

The CRA requires our bank,the Bank, consistent with safe and sound operations, to ascertain and meet the credit needs of its entire community, including low and moderate income areas. Our bank’sThe Bank’s failure to comply with the CRA could, among other things, result in the denial or delay of certain corporate applications filed by us or our bank,the Bank, including applications for branch openings or relocations and applications to acquire, merge or consolidate with another banking institution or holding company. In addition, the Equal Credit Opportunity Act, the Fair Housing Act and other fair lending laws and regulations prohibit discriminatory lending practices by financial institutions. The U.S. Department of Justice, federal banking agencies, and other federal agencies are responsible for enforcing these laws and regulations. A challenge to an institution’s compliance with fair lending laws and regulations could result in a wide variety of sanctions, including damages and civil money penalties, injunctive relief, restrictions on mergers and acquisitions activity, restrictions on expansion, and restrictions on entering new business lines. Private parties may also challenge an institution’s performance under fair lending laws in private class action litigation. Such actions could have a material adverse effect on our business, financial condition, results of operations and growth prospects.

The USA PATRIOT Act and the Bank Secrecy Act require financial institutions to design and implement programs to prevent financial institutions from being used for money laundering and terrorist activities. If such activities are detected, financial institutions are obligated to file suspicious activity reports with the Financial Crimes Enforcement Network of the Treasury. These rules require financial institutions to establish procedures for identifying and verifying the identity of customers seeking to open new financial accounts. Federal and state bank regulators also have focused on compliance with Bank Secrecy Act and anti-money laundering regulations. Failure to comply with these regulations could result in fines or sanctions, including restrictions on conducting acquisitions or establishing new branches. In recent years, several banking institutions have received large fines for non-compliance with these laws and regulations. While we have developed policies and procedures designed to assist in compliance with these laws and regulations, these policies and procedures may not be effective in preventing violations of these laws and regulations. Failure to maintain and implement adequate programs to combat money laundering and terrorist financing could also have serious reputational consequences for us, which could have a material adverse effect on our business, financial condition or results of operations.

Although our common shares are listed for quotation on the Nasdaq Global Select Market, the trading in our common shares has substantially less liquidity than many other companies listed on Nasdaq. A public trading market having the desired characteristics of depth, liquidity and orderliness depends on the presence in the market of willing buyers and sellers of our common shares at any given time. This presence depends on the individual decisions of investors and general economic and

market conditions over which we have no control. We cannot assure you that the volume of trading in our common shares will increase in the future.

PART II

On April 27, 2023, the Board of Directors of the Company approved a share repurchase program, allowing for the repurchase of up to $15.0 million of the Company's common stock through December 31, 2025. This repurchase program replaced the Company’s prior repurchase program, adopted in June 2021, which was due to expire on December 31, 2023. Since April 28, 2023 and through December 31, 2023, the Company repurchased no shares of common stock. Of the $5.0stock, leaving $15.0 million of stock authorized under the repurchase plan, $5.0 million remained available for possible future repurchases as of December 31, 2017.to be repurchased.