FDIC-insured institutions, like the Bank, their holding companies and their affiliates are extensively regulated under federal and state law. As a result, our growth and earnings performance may be affected not only by management decisions and general

economic conditions, but also by the requirements of federal and state statutes and by the regulations and policies of various bank regulatory agencies, including the Iowa Division of Banking (the “Iowa Division”), the Federal Reserve, the FDIC and the Consumer Financial Protection Bureau (the “CFPB”). Furthermore, taxation laws administered by the Internal Revenue Service and state taxing authorities, accounting rules developed by the FASB, securities laws administered by the SEC and state securities authorities, and anti-money laundering laws enforced by the U.S. Department of the Treasury (“Treasury”) have an impact on our business. The effect of these statutes, regulations, regulatory policies and accounting rules are significant to our operations and results.

Federal and state banking laws impose a comprehensive system of supervision, regulation and enforcement on the operations of FDIC-insured institutions, their holding companies and affiliates that is intended primarily for the protection of the FDIC-insured deposits and depositors of banks, rather than shareholders. These laws, and the regulations of the bank regulatory agencies issued under them, affect, among other things, the scope of our business, the kinds and amounts of investments the Company and the Bank may make, required capital levels relative to assets, the nature and amount of collateral for loans, the establishment of branches, the ability to merge, consolidate and acquire, dealings with our insiders and affiliates and the payment of dividends. In reaction to the global financial crisis and particularly following the passage of the Dodd-Frank Act, we experienced heightened regulatory requirements and scrutiny. Although the reforms primarily targeted systemically important financial service providers, their influence filtered down in varying degrees to community banks over time and caused our compliance and risk management processes, and the costs thereof, to increase. Then, in May 2018, theThe Economic Growth, Regulatory Relief and Consumer Protection Act of 2018 (“Regulatory Relief Act”) was enacted by Congress in part to provide regulatory relief for community banks and their holding companies. To that end, the law eliminated questions about the applicability of certain Dodd-Frank Act reforms to community bank systems, including relieving us of any requirement to engage in mandatory stress tests, maintain a risk committee or comply with the Volcker Rule’s complicated prohibitions on proprietary trading and ownership of private funds. We believe theseThese reforms arehave been favorable to our operations.

The supervisory framework for U.S. banking organizations subjects banks and bank holding companies to regular examination by their respective regulatory agencies, which results in examination reports and ratings that are not publicly available and that can impact the conduct and growth of their business. These examinations consider not only compliance with applicable laws and regulations, but also capital levels, asset quality and risk, management ability and performance, earnings, liquidity, and various other factors. The regulatory agencies generally have broad discretion to impose restrictions and limitations on the operations of a regulated entity where the agencies determine, among other things, that such operations are unsafe or unsound, fail to comply with applicable law or are otherwise inconsistent with laws and regulations.

The following is a summary of the material elements of the supervisory and regulatory framework applicable to the Company and the Bank, beginning with a discussion of the impact of the COVID-19 pandemic on the banking industry.Bank. It does not describe all of the statutes, regulations and regulatory policies that apply, nor does it restate all of the requirements of those that are described. The descriptions are qualified in their entirety by reference to the particular statutory and regulatory provision.

Regulatory capital represents the net assets of a banking organization available to absorb losses. Because of the risks attendant to their business, FDIC-insured institutions are generally required to hold more capital, than other businesses, which directly affects our earnings capabilities. WhileAlthough capital has historically been one of the key measures of the financial health of both bank holding companies and banks, its role became fundamentally more important in the wake of the global financial crisis, as the banking regulators recognized that the amount and quality of capital held by banks prior to the crisis was insufficient to absorb losses during periods of severe stress. Certain provisions of the Dodd-Frank Act and Basel III, discussed below, establish capital standards for banks and bank holding companies that are meaningfully more stringent than those in place previously.

associations, as well as to most bank and savings and loan holding companies, other than “small bank holding companies” (generally certain holding companies with consolidated assets of less than $3 billion) and certain qualifying banking organizations that may elect a simplified framework (which we have not done). Thus, thecompanies. The Company and the Bank are each currently subject to the Basel III RulesRule as described below.

Basel III also increased the required quantity and quality of capital. Not only did the Basel III Rulesit increase most of the required minimum capital ratios in effect prior to January 1, 2015, but, in requiring that forms of capital be of higher quality to absorb loss, it introduced the concept of Common Equity Tier 1 Capital, which consists primarily of common stock, related surplus (net of Treasury stock), retained earnings, and Common Equity Tier

In addition, institutions that seek the freedomwant to make capital distributions (including for dividends and repurchases of stock) and pay discretionary bonuses to executive officers without restriction must also maintain 2.5% in Common Equity Tier 1 Capital attributable to a capital conservation buffer. The purpose of the conservation buffer is to ensure that banking institutions maintain a buffer of capital that can be used to absorb losses during periods of financial and economic stress. Factoring in the conservation buffer increases the minimum ratios depicted above to 7% for Common Equity Tier 1 Capital, 8.5% for Tier 1 Capital and 10.5% for Total Capital. The federal bank regulators released a joint statement in response to the COVID-19 pandemic reminding the industry that capital and liquidity buffers were meant to give banks the means to support the economy in adverse situations, and that the agencies would support banks that use the buffers for that purpose if undertaken in a safe and sound manner.

Under the capital regulations of the Federal Reserve for the Company and the FDIC for the Bank, in order to be well‑capitalized, we must maintain:

undercapitalized,” in each case as defined by regulation. Depending upon the capital category to which an institution is assigned, the regulators’ corrective powers include: (i) requiring the institution to submit a capital restoration plan; (ii) limiting the institution’s asset growth and restricting its activities; (iii) requiring the institution to issue additional capital stock

The BHCA generally prohibits us from acquiring direct or indirect ownership or control of more than 5% of the voting shares of any company that is not a bank and from engaging in any business other than that of banking, managing and controlling banks or furnishing services to banks and their subsidiaries. This general prohibition is subject to a number of exceptions. The principal exception allows bank holding companies to engage in, and to own shares of companies engaged in, certain businesses found by the Federal Reserve prior to November 11, 1999 to be “so closely related to banking ... as to be a proper incident thereto.” This authority permits us to engage in a variety of banking-related businesses, including the ownership and operation of a savings association, or any entity engaged in consumer finance, equipment leasing, the operation of a computer service bureau (including software development) and mortgage banking and brokerage services. The BHCA does not place territorial restrictions on the domestic activities of nonbank subsidiaries of bank holding companies.

Additionally, bank holding companies that meet certain eligibility requirements prescribed by the BHCA and elect to operate as financial holding companies may engage in, or own shares in companies engaged in, a wider range of nonbanking activities, including securities and insurance underwriting and sales, merchant banking and any other activity that the Federal Reserve, in consultation with the Secretary of the Treasury, determines by regulation or order is financial in nature or incidental to any such financial activity or that the Federal Reserve determines by order to be complementary to any such financial activity, andas long as the activity does not pose a substantial risk to the safety or soundness of FDIC-insured institutions or the financial system generally. We have elected to operate as a financial holding company. In order to maintain our status as a financial holding company, the Company and the Bank must be well-capitalized, well-managed, and the Bank must have a least a satisfactory CRA rating. If the Federal Reserve determines that either the Company or the Bank is not well-capitalized or well-managed, the Federal Reserve will provide a period of time in which to achieve compliance, but during the period of noncompliance, the Federal Reserve may place any additional limitations on us that it deems appropriate. Furthermore, if non-compliance is based on the failure of the Bank to achieve a satisfactory CRA rating, we would not be able to commence any new financial activities or acquire a company that engages in such activities.

As a general matter, the Federal Reserve has indicated that the board of directors of a bank holding company should eliminate, defer or significantly reduce dividends to shareholders if: (i) the company’s net income available to shareholders for the past four quarters, net of dividends previously paid during that period, is not sufficient to fully fund the dividends; (ii) the prospective rate of earnings retention is inconsistent with the company’s capital needs and overall current and prospective financial condition; or (iii) the company will not meet, or is in danger of not meeting, its minimum regulatory capital adequacy ratios. These factors have come into consideration in the industry as a result of the COVID-19 pandemic. Due to the impact of the goodwill impairment charge on our earnings during the third quarter of 2020, we were required to receive approval from the FRB prior to declaring a dividend. Such approval was received from the FRB prior to the declaration of a cash dividend of $0.22 per share by the board of directors of the Company on October 28, 2020. The Federal Reserve also possesses enforcement powers over bank holding companies and their nonbank subsidiaries to prevent or remedy actions that represent unsafe or unsound practices or violations of applicable statutes and regulations. Among these powers is the ability to proscribe the payment of dividends by banks and bank holding companies. In addition, under the Basel III Rules,Rule, institutions that seek the freedom to pay dividends have to maintain 2.5% in Common Equity Tier 1 Capital attributable to the capital conservation buffer. See “—The Role of Capital” above.

The interagency guidance recognized three core principles. Effective incentive plans should: (i) provide employees incentives that appropriately balance risk and reward; (ii) be compatible with effective controls and risk-management; and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors. Much of the guidance addresses large banking organizations and, because of the size and complexity of their operations, the regulators expect those organizations to maintain systematic and formalized policies, procedures, and systems for ensuring that the incentive compensation arrangements for all executive and non-executive employees covered by this guidance are identified and reviewed, and appropriately balance risks and rewards. Smaller banking organizations like us that use incentive compensation arrangements are expected to be less extensive, formalized, and detailed than those of the larger banks.

Fund (“DIF”) to the maximum extent provided under federal law and FDIC regulations, currently $250,000 per insured depositor category. As an Iowa-chartered FDIC-insured bank, the Bank is subject to the examination, supervision, reporting and enforcement requirements of the Iowa Division, the chartering authority for Iowa banks, and the FDIC, designated by federal law as the primary federal regulator of insured state banks that, like the Bank, are not members of the Federal Reserve System (nonmember banks).

At least semi-annually, the FDIC updates its loss and income projections for the DIF and, if needed, increases or decreases the assessment rates, following notice and comment on proposed rulemaking.

In addition, because the total cost of the failures of Silicon Valley Bank and it refunded all small bank credits asSignature Bank was approximately $16.3 billion, the FDIC adopted a special assessment for banks having deposits above $5 billion, at an annual rate of September 30, 2020.13.4 basis points beginning with the first quarterly assessment period of 2024 (January 1 through March 31, 2024) with an invoice payment date of June 28, 2024, and will continue to collect special assessments for an anticipated total of eight quarterly assessment periods. The base for the special assessment is equal to an insured depository institution’s estimated uninsured deposits for the December 31, 2022 reporting period, adjusted to exclude the first $5 billion in estimated uninsured deposits.

The primary role of liquidity risk management is to: (i) prospectively assess the need for funds to meet financial obligations. To remain viable, FDIC-insured institutions must have enough liquid assetsobligations; and (ii) ensure the availability of cash or collateral to meet their near-term obligations, such as withdrawalsfulfill those needs at the appropriate time by depositors. Becausecoordinating the global financial crisis was in part a liquidity crisis,various sources of funds available to the institution under normal and stressed conditions. Basel III also includes a liquidity framework that requires FDIC-insuredthe largest insured institutions to measure their liquidity against specific liquidity tests. One test, referred to as the liquidity coverage ratio,Liquidity Coverage Ratio, or LCR, is designed to ensure that the banking entity has an adequate stock of unencumbered high-quality liquid assets that can be converted easily and immediately in private markets into cash to meet liquidity needs for a 30-calendar day liquidity stress scenario. The other test, known as the net stable funding ratio,Net Stable Funding Ratio, or NSFR, is designed to promote more medium- and long-term funding of the assets and activities of FDIC-insured institutions over a one-year horizon. These tests provide an incentive for banks and holding companies to increase their holdings in Treasury securities and other sovereign debt as a component of assets, increase the use of long-term debt as a funding source and rely on stable funding like core deposits (in lieu of brokered deposits).

In addition to liquidity guidelines already in place, the federal bank regulatory agencies implemented the Basel III LCR in September 2014, which requires large financial firms to hold levels of liquid assets sufficient to protect against constraints on their funding during times of financial turmoil, and in 2016 proposed implementation of the NSFR. WhileAlthough these rulestests do not, and will not, apply to the Bank, we continue to review our liquidity risk management policies in light of regulatory requirements and industry developments.

thereof, the institution would be undercapitalized. As described above, the Bank exceeded its capital requirements under applicable guidelines as of December 31, 2020.2023. Notwithstanding the availability of funds for dividends, however, the FDIC and the Iowa Division may prohibit the payment of dividends by the Bank if either or both determine such payment would constitute an unsafe or unsound practice. In addition, under the Basel III Rules,Rule, institutions that seek the freedom to pay dividends have to maintain 2.5% in Common Equity Tier 1 Capital attributable to the capital conservation buffer. See “—The Role of Capital” above.

Certain limitations and reporting requirements are also placed on extensions of credit by the Bank to its directors and officers, to directors and officers of the Company and its subsidiaries, to principal shareholders of the Company and to “related interests” of such directors, officers and principal shareholders. In addition, federal law and regulations may affect the terms uponon which any person who is a director or officer of the Company or the Bank, or a principal shareholder of the Company, may obtain credit from banks with which the Bank maintains a correspondent relationship.

In general, the safety and soundness standards prescribe the goals to be achieved in each area, and each institution is responsible for establishing its own procedures to achieve those goals. While regulatory standards do not have the force of law, if an institution operates in an unsafe and unsound manner, the FDIC-insured institution’s primary federal regulator may require the institution to submit a plan for achieving and maintaining compliance. If an FDIC-insured institution fails to submit an acceptable compliance plan, or fails in any material respect to implement a compliance plan that has been accepted by its primary federal regulator, the regulator is required to issue an order directing the institution to cure the deficiency. Until the deficiency cited in the regulator’s order is cured, the regulator may restrict the FDIC-insured institution’s rate of growth, require the FDIC-insured institution to increase its capital, restrict the rates that the institution pays on deposits or require the institution to take any action that the regulator deems appropriate under the circumstances. Noncompliance with safety and soundness may also constitute grounds for other enforcement action by the federal bank regulatory agencies, including cease and desist orders and civil money penalty assessments.

During the past decade, the bank regulatory agencies have increasingly emphasized the importance of sound risk management processes and strong internal controls when evaluating the activities of the FDIC-insured institutions they supervise. Properly managing risksrisk has been identified as critical to the conduct of safe and sound banking activities and has become even more important as new technologies, product innovation, and the size and speed of financial transactions have changed the nature of banking markets. The agencies have identified a spectrum of risks facing a banking institution including, but not limited to, credit, market, liquidity, operational, legal and reputational risk. The federal bank regulators have identified key risk themes identified for 2021 as: credit risk management given projected weaker economic conditions and commercial and residential real estate concentration risk management. The agencies will also be monitoring banks for their transition away from LIBOR as a reference rate, compliance risk management related to COVID-19 pandemic-related activities, Bank Secrecy Act/anti-money laundering (“AML”) compliance, cybersecurity, planning for and implementation of the CECL accounting standard, and CRA performance.2023 are discussed in “Item 1.A. Risk Factors” section. The Bank is expected to have active board and senior management oversight; adequate policies, procedures and limits; adequate risk measurement, monitoring and management information systems; and comprehensive internal controls.

that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures for the protection of personal and confidential information, are in effect across all businesses and geographic locations.

Because abuses in connection with residential mortgages were a significant factor contributing to the financial crisis, many new rules issued by the CFPB, andas required by the Dodd-Frank Act, addressed mortgage and mortgage-related products, their underwriting, origination, servicing and sales. The Dodd-Frank Act significantly expanded underwriting requirements applicable to loans secured by 1-4 family residential real property and augmented federal law combating predatory lending practices. In addition to numerous disclosure requirements, the Dodd‑Frank Act and the CFPB’s rules imposed new standards for mortgage loan originations on all lenders, including banks and savings associations, in an effort to strongly encourage lenders to verify a borrower’s ability to repay, while also establishing a presumption of compliance for certain “qualified mortgages.” The CFPB has from time to time released additional rules as to qualified mortgages and the borrower’s ability to repay, most recently in October of 2020. The CFPB’s rules have not had a significant impact on ourthe Bank’s operations, except for higher compliance costs.

The Federal Reserve made a series of significant increases to the target Federal Funds rate throughout 2022 and 2023 as part of an effort to combat elevated levels of inflation affecting the U.S. economy, which is expected to continue in the near term. This has helped drive a significant increase in prevailing interest rates, which has impacted the value of our securities portfolio, which had $78.0 million in net unrealized losses from available-for-sale investment securities and $179.9 million in net unrealized losses from held-to-maturity securities at December 31, 2023. Higher interest rates can also negatively affect our customers’ businesses and financial condition, and the value of collateral securing loans in our portfolio.

As of December 31, 2020,2023, the fair value of our securities portfolio was approximately $1.7$1.69 billion. Factors beyond our control can significantly influence the fair value of securities in our portfolio and can cause potential adverse changes to the fair value of these securities. For example, fixed-rate securities acquired by us are generally subject to decreases in market value when interest rates rise. Additional factors include, but are not limited to, rating agency downgrades of the securities, defaults by the issuer or individual mortgagors with respect to the underlying securities, and instability in the credit markets. Any of the foregoing factors could result in the recognition of a loss through earnings. Because of changing economic and market conditions affecting interest rates, the financial condition of issuers of the securities and the performance of the underlying collateral, we may recognize realized and/or unrealized losses in future periods, which could have an adverse effect on our financial condition and results of operations.

A significant portion of our operations are located in areas that are susceptible to floods, droughts, tornadoes and other severe weather events. Severe weather events, such as the derecho experienced in 2020,natural disasters and effects of climate change, could cause disruptions to our operations and could have a material adverse effect on our overall business, results of operations or financial condition. While we maintain insurance covering many of these weather-related events, including coverage for lost profits and extra expense, there is no insurance against the disruption that a severe weather event could produce to the markets that we serve and the resulting adverse impact on our borrowers to timely repay their loans and the value of any collateral held by us. The severity and impact of weather-related events are difficult to predict and may be exacerbated by global climate change.

There are risks inherent in making any loan, including risks inherent in dealing with individual borrowers, risks of nonpayment, risks resulting from uncertainties as to the future value of collateral and cash flows available to service debt and risks resulting from changes in economic and industry conditions. Default risk may arise from events or circumstances that are difficult to detect, such as fraud, or difficult to predict, such as catastrophic events affecting certain industries. In addition, we primarily serve the banking and financial services needs of small to mid-sized businesses. These businesses generally have fewer financial resources in terms of capital or borrowing capacity than larger entities, may be more vulnerable to economic downturns, may experience volatility in operating results, and may have elevated business continuity risk due to the limited size of the management group, any of which may impair a borrower’s ability to repay a loan. We attempt to minimize our credit risk through prudent loan application approval procedures, careful monitoring of the concentration of our loans within specific industries and periodic independent reviews of outstanding loans by our credit review department. We periodically examine our credit process and implement changes to improve our procedures and standards. However, we cannot assure you that such approval and monitoring procedures will reduce these credit risks. If the overall economic climate in the United States, generally, or our market areas, specifically, declines, or even if it does not, our borrowers may experience difficulties in repaying their loans, and the level of nonperforming loans, charge-offs and delinquencies could rise and require increases in the provision for loan losses, which would cause our net income and return on equity to decrease.

Commercial real estate lending comprises a significant portion of our lending business. Specifically, commercial real estate loans were approximately 49.8%54.0% of our total loan portfolio as of December 31, 2020.2023. The market value of real estate securing our commercial real estate loans can fluctuate significantly in a short period of time as a result of market conditions in the geographic area in which the real estate is located. Although a significant portion of such loans is secured by real estate as a secondary form of repayment, adverse developments affecting real estate values in one or more of our markets could increase the credit risk associated with our loan portfolio. Additionally, the repayment of the commercial real estate loanslending typically involves higher loan principal amounts, and repayment is generally is dependent, in large part, on sufficient income from the properties securing the loans to cover operating expenses and debt service. Economic events, including decreases in office occupancy as a result of the shift to remote working environments following the COVID-19 pandemic, or governmental regulations outside of the control of the borrower or lender could negatively impact the future cash flow and market values of the affected properties.

If problems develop in the commercial real estate sector, particularly within one or more of our markets, the value of collateral securing our commercial real estate loans could decline, which could adversely affect our operating results, financial condition and/or capital. In light of the continued general uncertainty that exists in the economy and credit markets nationally, we may experience deterioration in the performance of our commercial real estate loan customers.

Commercial, industrial, and agricultural loans (including credit cards and commercially related overdrafts) were approximately 33.6%28.9% of our total loan portfolio as of December 31, 2020.2023. Our commercial loans are primarily made based on the identified cash flow of the borrower and secondarily on the underlying collateral provided by the borrower. Most often, this collateral is accounts receivable, inventory and equipment. Credit support provided by the borrower for most of these loans and the probability of repayment is based on the liquidation value of the pledged collateral and enforcement of a personal guarantee, if any exists. As a result, in the case of loans secured by accounts receivable, the availability of funds for the repayment of these loans may be substantially dependent on the ability of the borrower to collect amounts due from its customers. The collateral securing these loans may depreciate over time, may be difficult to appraise and may fluctuate in value based on the success of the business. In addition, if the U.S. economy declines, this could harm the businesses of our commercial and industrial customers and reduce the value of the collateral securing these loans.

Payments on agricultural loans are dependent on the successful operation or management of the farm property. The success of the farm may be affected by many factors outside the control of the borrower, including adverse weather conditions that prevent the planting of a crop or limit crop yields, such as hail, drought and floods (although borrowers may attempt to mitigate this risk by purchasing crop insurance), loss of livestock due to disease or other factors, declines in market prices for agricultural