This Annual Report contains certain forward-looking statements that are not historical in nature and may be considered forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended, which are intended to be covered by the safe harbor for "forward-looking statements" provided by the Private Securities Litigation Reform Act of 1995. You can find many of these statements by looking for words such as "anticipates," "expects," "believes," "estimates," "intends" and "forecast" and words or phrases of similar meaning. We makeThese forward-looking statements include, without limitation, statements regarding our liquidity position; projected sources of funds; the effectsCompany’s future plans, results, strategies, and expectations, including but not limited to expectations around changing economic markets. These statements can generally be identified by the use of the COVID-19 pandemicwords and actions taken in response thereto; our securities portfolio; loan sales; adequacy of our allowance for loan and lease losses and reserve for unfunded commitments; impaired loans and future losses; litigation; dividends; fair values of certain assets and liabilities, including mortgage servicing rights values; tax rates; the effect of accounting pronouncements; and strategic initiatives and the timing, benefits, costs and synergies of future acquisition, dispositionphrases “may,” “will,” “should,” “could,” “would,” “goal,” “plan,” “potential,” “estimate,” “project,” “believe,” “intend,” “anticipate,” “expect,” “target,” “aim,” “predict,” “continue,” “seek,” “project,” “forecasts” “likely,” “future,” “strategy” and other growth opportunities.

A number of factors that could cause our actual results to differ materially from those indicated in thesecontemplated by the forward-looking statements including, but not limited to, the following:

The foregoing factors should not be construed as exhaustive and should be read in conjunction with the sections entitled “Risk factors”Factors” and “Management’s discussionDiscussion and analysisAnalysis of financial conditionFinancial Condition and resultsResults of operations”Operations” included in this Annual Report.Report; and in any of the Company’s subsequent Securities and Exchange Commission Filings. Many of these factors are beyond the Company’s ability to control or predict. If one or more events related to these or other risks or uncertainties materialize, or if ourthe underlying assumptions prove to be incorrect, actual results may differ materially from ourthe forward-looking statements. Accordingly, youshareholders and investors should not place undue reliance on any such forward-looking statements. Any forward-looking statement speaks only as of the date of this Annual Report, and we do not undertake anythe Company undertakes no obligation to publicly update or review any forward-looking statement, whether as a result of new information, future developments or otherwise, except as required by law. New risks and uncertainties may emerge from time to time, and it is not possible for usthe Company to predict their occurrence or how they will affect us.the Company. The Company qualifies all forward-looking statements by these cautionary statements.

In this annual report,Annual Report, the terms "we," "our," "ours," "us," "FB Financial," and "the Company" refer to FB Financial Corporation, a Tennessee corporation, and our wholly-owned subsidiaries, including our state-chartered consolidated banking subsidiary, FirstBank, a Tennessee state chartered bank,"FirstBank" or "the Bank," unless the context indicates that we refer only to the parent company, FB Financial Corporation. The terms "FirstBank" or "the Bank" refer to our wholly owned subsidiary and Tennessee banking corporation.

FB Financial Corporation is a bank holding company designated as a financial holding company. We are headquartered in Nashville, Tennessee. Our wholly ownedwholly-owned bank subsidiary is FirstBank is the third largest Tennessee-headquartered bank, based on total assets. FirstBankwhich provides a comprehensive suite of commercial and consumer banking services to clients in select markets primarily in Tennessee, NorthKentucky, Alabama Southern Kentucky, and North Georgia. As of December 31, 2020,2022, our footprint included 8182 full-service bank branches and several other limited service banking, ATM and mortgage loan production locations serving the Tennessee metropolitan markets of Nashville, Chattanooga (including North Georgia), Knoxville, Memphis, and Jackson in addition to the metropolitan markets of HuntsvilleBirmingham, Florence and Florence,Huntsville, Alabama and Bowling Green, Kentucky. The Bank also operates in 16 community markets. TheFurther, the Company also provides mortgage banking services utilizing its bank branch network and mortgage banking offices located throughout the southeastern United States in addition to its national internet delivery channel.States. As of December 31, 2020,2022, we had total assets of $11.21$12.85 billion, loans held for investment of $7.08$9.30 billion, total deposits of $9.46$10.86 billion, and total common shareholders’ equity of $1.29$1.33 billion.

Throughout our history, we have steadfastly maintained a community banking approach of personalized relationship-based service, which is delivered locally through experienced bankers in each market. As we have grown, maintaining this relationship-based approach utilizing local, talented and experienced bankers in each market has been an integral component of our success. Our bankers utilize their local knowledge and relationships to deliver timely solutions to our clients. We empower these bankers by giving them local decision making authority supplemented by appropriate risk management. In our experience, business owners and operators prefer to deal with decision makers, and our banking model is built to place the decision maker as close to the client as possible. We have designed our operations, technology, and centralized risk oversight processes to specifically support our operating model. We deploy this operating model universally in each of our markets, regardless of size. We believe we have a competitive advantage in our markets versus both smaller community banks and larger regional and national banks. Our robust offering of products, services and capabilities differentiate us from community banks, and our significant local market knowledge, client service level and the speed with which we are able to make decisions and deliver our services to customers differentiate us from larger regional and national banks.

We seek to leverage our operating model by focusing on profitable growth opportunities across our footprint, focused primarily on both in high-growth metropolitan markets and in stable community markets. As a result, we are able to strategically deploy our capital across our markets to take advantage of those opportunities that we believe provide the greatest certainty of profitable growth and highest returns.

Originally chartered in 1906, we are one of the longest continually operating banks in Tennessee. While our deep community roots go back over 100 years, our growth trajectory changed in 1984 when Tennessee businessman James W. Ayers, our Vice Chairmanan experienced banker and Founder, acquiredentrepreneur partnered to acquire Farmers State Bank with an associate.a focus on growing the Bank. In 1988, weFarmers State Bank purchased the assets of First National Bank of Lexington, Tennessee and changed ourthe name to FirstBank, forming the foundation of our current franchise. In 1990, Mr.James W. Ayers became ourFirstBank's sole shareholder and remained ourthe sole shareholder until our initial public offering in September 2016. Under Mr. Ayers’ ownership, weThe Bank grew from a community bank with only $14 million in assets in 1984 to the third largest bank headquartered in Tennessee, based on total assets of $11.21$12.8 billion at December 31, 2020.

From 1984 to 2001, we operated as a community bank growing organically and through small acquisitions in community markets in West Tennessee. In 2001, our strategy evolved from serving purely community markets to include a modest presence in metropolitan markets, expanding our reach and enhancing our growth. We entered Nashville and Memphis in 2001 by opening a branch in each of those markets. In 2004 and 2008, we opened our first branches in Knoxville and Chattanooga, respectively. Although we experienced some growth in each metropolitan market, itthose markets did not become a majorsignificant strategic focus until we implemented our current strategy in the Nashville metropolitan statistical area (“MSA”) in 2012. The successful implementation of this strategy, along with strategic key acquisitions, resulted in growing Nashville into our largest market with 50%48% of our total deposits as of June 30, 2020.2022. Additionally, we expanded into the Huntsville, Alabama MSA in 2014 by opening a branch in Huntsville and loan production office in Florence, Alabama, which was converted to a full service branch in 2019. During 2020, we expanded into the Bowling Green, Kentucky MSA with our acquisition of FNB Financial Corp. in addition to increasing our Nashville MSA market share through our acquisition of Franklin Financial Network, Inc. During 2021, we expanded our banking division into Central Alabama with hiring of additional experienced senior bankers in Birmingham. As a result of this evolution and focus on continuous organic

growth, we operate a balanced business model that serves a diverse customer base in both metropolitan and community markets.

On July 31, 2017, the Bank completed its merger with Clayton Bank and Trust (“CBT”) and American City Bank (“ACB” and together with CBT,(together the “Clayton Banks”), pursuant to the Stock Purchase Agreement with Clayton HC, Inc., a Tennessee corporation (“Seller”), and James L. Clayton, the majority shareholder of Seller, dated February 8, 2017, as amended on May 26, 2017, with a purchase price of approximately $236.5 million. The Company issued 1,521,200 shares of common stock and paid cash of $184.2 million to purchase all of the outstanding shares of the Clayton Banks. At closing, the Clayton Banks merged with and into FirstBank, with FirstBank continuing as the surviving banking entity. As of July 31, 2017, the estimated fair value of loans acquired and deposits assumed as a result of the merger was $1,059.7 million and $979.5 million, respectively.

On April 5, 2019, the Bank acquired 11 Tennessee and three Georgia branch locations from Atlantic Capital Bank, N.A., ("the Branches") further increasing market share in existing markets and expanding the Company's footprint into new locations. Under the terms of the agreement, the Bank assumed $588.9 million in deposits for a premium of 6.25% and acquired $374.4 million in loans at 99.32% of principal outstanding.

On February 14, 2020, the Company acquired FNB Financial Corp. and its wholly ownedwholly-owned subsidiary, Farmers National Bank of Scottsville (collectively, "Farmers National"). Following the acquisition, Farmers National was merged into the Company with FB Financial Corporation continuing as the surviving entity. The transaction added four branches and expanded the Company's footprint into Kentucky. Under the terms of the agreement, the Company acquired total assets of $258.2 million, loans of $182.2 million and assumed total deposits of $209.5 million. Farmers National shareholders received 954,797 shares of the Company's common stock as consideration in connection with the merger, in addition to $15.0 million in cash consideration.

On August 15, 2020, the Company completed its largest merger to date with Franklin Financial Network, Inc. and its wholly ownedwholly-owned subsidiaries, with FB Financial Corporation continuing as the surviving entity. Under the terms of the agreement, the Company acquired total assets of $3.63 billion, loans of $2.79 billion and assumed total deposits of $3.12 billion in a transaction valued at $477.8 million, which included the issuance of 15,058,181 shares of the Company's common stock. The transaction added a new subsidiary to the Company, FirstBank Risk Management, ("FBRM"), which provides risk management services to the Company in the form of enhanced insurance coverages. It also added a new subsidiary to the Bank, FirstBank Investments of Tennessee, Inc. ("FBIT"), which provides investment services to the Bank. FBIT has a wholly ownedwholly-owned subsidiary, FirstBank Investments of Nevada, Inc. ("FBIN") to provide investment services to FBIT. FBIN has a controlling interest in a subsidiary, FirstBank Preferred Capital, Inc. ("FBPC"), which serves as a real estate investment trust, ("REIT"), to allowwhich allows the Bank to sell real estate loans to the REIT to obtain aoptimize our tax benefit.structure. During the year ended December 31, 2022, the Company began the process of dissolving FBRM which is expected to be completed in the first half of 2023.

See Note 2, “Mergers and acquisitions” in the notes to the consolidated financial statements for further details regarding the terms and conditions of these acquisitions.

Our market footprint is the southeastern United States, centered around Tennessee, and includes portions of North Alabama, North Georgia and Kentucky.

being deemphasized by national and regional banks which provides us with opportunities to hire talented bankers in these communities and maintain or grow market share in these community markets.

Our core client profile across our footprint includes small businesses, corporate clients and owners, and investors of commercial real estate. We target business clients with substantial operating history that have annual revenues of up to $250 million.history. Our typical business client would keep business deposit accounts with us, and we would look to provide banking services to the owners and employees of the business as well. We also have an active consumer lending business that includes deposit products, mortgages, home equity lines and small consumer finance loans. We continuously strive to build deeper relationships by actively cross-selling incrementaladvising clients and offering products tothat meet thetheir banking needs of our clients.

The following tables show our deposit market share ranking among banks in Tennessee as of June 30, 20202022 (the most recent date where such information is publicly available). Of the 10 largest banks in the state based on total deposits, fivesix are national or regional banks, which we believe provides us with significant opportunities to gain market share from these banks.

Our overall business strategy is comprised of the following core strategies.

Based on market and competitive similarities, we believe our growth strategies are transferable to our other metropolitan markets. Wemarkets and we have implemented these strategies with a focus on thein additional markets across our footprint. In Knoxville and Chattanooga, and Knoxville MSAs. Ourwe have achieved top 10 deposit market shares through our acquisitions of Northwest Georgia Bank, the Clayton Banks, and the branches from Atlantic Capital Bank have acceleratedand continued strong organic growth in those markets. In the Memphis, Huntsville and Birmingham MSAs, our growth and profitability in the Chattanooga and Knoxville MSAs,banking model has attracted strong leadership teams and we have continued to build momentumexperienced significant growth in these markets.both deposits and loans.

Our operating model demands a strong risk culture built to address multiple areas of risk, including credit risk, interest rate risk, liquidity risk, price risk, compliance risk, information security/cyber risk, third-party risk, operational risk, strategic risk and reputational risk. Our risk culture is supported by investments in the right people and technologies to protect our business. Our board of directors, through its risk committee,Risk Committee, is ultimately responsible for overseeing risk management of the Company. We have a Chief Risk Officer who oversees risk management across our business (including the Bank).business. Our board, Chief Executive Officer and Chief Risk Officer are supported by the heads of other functional areas at the Bank, including credit, legal, IT, audit, compliance, capital markets, creditloan review, information security and physical security. Our comprehensive risk management framework is designed to complement our core strategy of empowering our experienced, local bankers with local-decision making to better serve our clients.

Our credit policies support our goal of maintaining sound credit quality standards while achieving balance sheet growth, earnings growth, appropriate liquidity and other key objectives. We maintain a risk management infrastructure that includes local authority, centralized policymaking and a strong system of checks and balances under the direction of our Chief Credit Officer.balances. The fundamental principles of our credit policy and procedures are to maintain credit quality standards, which enhance our long-term value to our clients, associates, shareholders and communities. Our loan policies provide our bankers with a sufficient degree of flexibility to permit them to deliver responsive and effective lending solutions to our clients while maintaining appropriate credit quality. Furthermore, our bankers and associates are hired for the long-term and they are incented to focus on long-term credit quality. Since lending represents credit risk exposure, the board of directors and its duly appointed committees seek to ensure that the Bank maintains appropriate credit quality standards. We have established management oversight committees to administer the loan portfolio and monitor credit risk. These committees include our audit committeeACL Committee and credit committee,Corporate Credit Risk Committee and they meet at least quarterly to review the lending activities.

Diversification of risk is a key factor in prudent asset management. Our loan portfolio is balanced between our metropolitan and community markets and by type, thereby diversifying our loan concentration. Our granular loan portfolio reflects a balanced mix of consumer and commercial clients across these markets that we think provides a natural hedge to industry and market cycles. In addition, risk from concentration is actively managed by management and reviewed by the board of directors of the Bank, and exposures relating to borrower, industry and commercial real estate categories are tracked and measured against policy limits. These limits are reviewed as part of our periodic review of the credit policy. Loan concentration levels are monitored by the ChiefCorporate Credit OfficerRisk Committee and reported to the Credit Risk Committee of the board of directors.

The loan approval process at the Bank is characterized by local authority supported by a risk control environment that provides for prompt and thorough underwriting of loans. Our localized decision making is reinforced through a centralized review process supported by technology that monitors credits to ensure compliance with our credit policies. Our loan approval method is based on a hierarchy of individual lending authorities for new credits and renewals granted to our individual bankers, market presidents, regional presidents, credit officers, senior management and credit committee.committees. The board of directorsCorporate Credit Risk Committee, along with senior management, establishes the maximum lending limits at each level and our senior management team sets individual authorities within these maximum limits to each individual based on demonstrated experience and expertise, and are periodically reviewed

individual loan authority up to specified levels based on experience and track record coupled with appropriate approval limits for our market presidents, regional presidents, credit officers, senior management and credit officerscommittees allows us to provide prompt and appropriate responses to our clients while still allowing for the appropriate level of oversight.

As a relationship-oriented lender, rather than transaction-oriented lender, substantially alla majority of our loans HFI are made to borrowers or relationships located or operating in our market area. This provides us with a better understanding of their business, creditworthiness and the economic conditions in their market and industry. Furthermore, our associates are held accountable for all of their decisions, which effectively aligns their incentives to reflect appropriate risk management.

The board of directorsCorporate Credit Risk Committee reviews and approves any amendments to the credit policy, monitors loan portfolio trends and credit trends, and reviews andloan reviews. The Credit Risk Committee of the board of directors approves loan transactions that exceed management authorized thresholds as set forth in our credit policy. Loan pricing is established in conjunction with the loan approval process based on pricing guidelines for loans that are set by the Bank’s senior management. We believe that our loan approval process provides for thorough internal controls, underwriting, and decision making.

The Bank is limited in the amount it can loan in the aggregate to a single borrower or related borrowers by the amount of our regulatory capital. Tennessee’s legal lending limit is a safety and soundness measure intended to prevent one person or a relatively small and economically related group of persons from borrowing an unduly large amount of bank funds. It is also intended to safeguard bank’s depositors by diversifying the risk of potential loan losses among a relatively large number of creditworthy borrowers engaged in various types of businesses. Generally, under Tennessee law, loans and extensions of credit to a borrower may not exceed 15% of our bank’s Tier 1 capital, plus an additional 10% of the bank’s Tier 1 capital, with approval of the bank’s board. Further, the Bank may elect to conform to similar standards applicable to national banks under federal law, in lieu of Tennessee law. Because the federal law and Tennessee state law standards are determined as a percentage of the Bank’s capital, these state and federal limits both increase or decrease as the Bank’s capital increases or decreases. Based upon the capitalization of the Bank at December 31, 2020,2022, the Bank’s legal lending limits were approximately $171.4$194.0 million (15%) and $285.6$323.4 million (25%). The Bank may seek to sell participations in our larger loans to other financial institutions, which will allow us to manage the risk involved in these loans and to meet the lending needs of our clients requiring extensions of credit in excess of these limits.

In addition to these legally imposed lending limits, we also employ appropriate limits on our overall loan portfolio and requirements with respect to certain types of lending and individual lending relationships. For example, we have lending limits related to maximum borrower, industry and certain types of commercial real estate exposures.

We maintain an enterprise risk management program that helps us to identify, manage, monitor and control potential risks that may affect us, including credit risk, interest rate risk, liquidity risk, price risk, compliance risk, operational risk, information security/ cyber risk, third-party risk, strategic risk and reputational risk. Our operating model demands a strong risk culture built to address the multiple areas of risk we face, and our risk management strategy is supported by significant investments in the right people and technologies to protect the organization.

Our comprehensive risk management framework and risk identification is a continuous process and occurs at both the transaction level and the portfolio level. While our local bankers and associates support our day-to-day risk practices,

We control risks through limits that are communicated through policies, standards, procedures and processes that define responsibility and authority. Such limits serve as a means to control exposures to the various risks associated with our activities, and are meaningful management tools that can be adjusted if conditions or risk tolerances change. In addition, we maintain a process to authorize exceptions or changes to risk limits when warranted. These risk management practices help to ensure effective reporting, compliance with all laws, rules and regulations, avoid damage to our reputation and related consequences, and attain our strategic goals while avoiding pitfalls and surprises along the way.

The Risk Committee of the board of directors approves policies that set operational standards and risk limits, and any changes require approval by the Bank’s board of directors.limits. Management is responsible for the implementation, integrity and maintenance of our risk management systems ensuring the directives are implemented and administered in compliance with the approved policy. Our Chief Risk Officer supervises the overall management of our risk management program, reports to managementthe Chief Executive Officer and yet also retains independent access to the Risk Committee of the board of directors.

Credit risk management is a key component of our risk management program. We employ consistent analysis and underwriting to examine credit information and prepare underwriting documentation. We monitor and approve exceptions to our credit policies as required, and we also track and address technical exceptions.

We assign a credit risk rating at the time a commercial loan is made and adjust it as conditions warrant. Portfolio monitoring systems allow management to proactively assess risk and make decisions that will minimize the impact of negative developments. Successful credit management is achieved by lenders consistently meeting with clients and reviewing their financial conditions regularly. This enables both the recognition of future opportunities and potential weaknesses early.

The board of directors supports a strong loan review program and is committed to its effectiveness as part of the independent process of assessing our lending activities. We have communicated to our credit and lending staff that the identification of emerging problem loans begins with the lending personnel knowing their client and supported by credit personnel, actively monitoring their client relationships. The loan review process is meant to augment this active management of client relationships and to provide an independent and broad-based look into our lending activities. We believe that our strong client relationships support our ability to identify potential deterioration of our credits at an early stage enabling us to address these issues early on to minimize potential losses.

We maintain a robust loan review function by utilizing an internal loan review team as well as third-party loan review firms. All reportsThe results from internal and external loan reviewreviews are made available directlyreported to the Risk Committee of the board of directors or designated board committee to ensure independence and objectivity. The examinations performed by the loan review department are based on risk assessments of individual loan commitments within our loan portfolio over a period of time. At the conclusion of each review, the loan review department provides management and the board of directors with a report that summarizes the findingsresults of the review. At a minimum, the report

addresses risk rating accuracy, compliance with regulations and policies, loan documentation accuracy, the timely receipt of financial statements, and any additional material issues.

Our liquidity planning framework is focused on ensuringrobust forecasting and risk management to ensure predictable funding needs and availability. We strive to maintain the lowest cost of funding available and planning for unpredictable funding circumstances.while maintaining stable sources of liquidity. To achieve these objectives, we utilize a simple funding and capital structure consisting primarily of deposits and common equity. We remain continually focused on growing our noninterest-bearing and other low-cost core deposits while replacing higher cost funding sources, including wholesale time deposits and other borrowed debt, to fund our balance sheet growth. The following chart shows our overall funding structure as of December 31, 2020.2022.

The Company has implemented a comprehensive set of information security policies, standards, and related trainings that every employee is required to review, acknowledge, and/or complete in connection with the employee’s onboarding process at the time they are hired. Each employee is required to formally review and understand any changes to these policies and standards and complete additional training on at least an annual basis. These policies, standards, and trainings address, but are not limited to, the following topics: data privacy and security, password protection, internet use,

The Company’s information security practices and risks are reviewed annually by our internal audit team and our external auditors in connection with our annual audit process. Key Risk Indicators, established in conjunction with board approved Statement of Risk Appetite, are reported to the Information Technology Steering Committee and Risk Management Committee on at least a quarterly basis. Our Risk Committee of the Board of Directors is responsible for overseeing the Company’s information security risk management process.and receives updates on a quarterly basis. Our Board of Directors or the Board’s Risk Committee is provided an information security update on an annual basis. The Company does adhere to and implement NIST guidelines and utilizes the ABA recommended Cyber Risk Institute Profile to annually evaluate our information security practices. The results of those annual evaluations are provided to and monitored by the FDIC and the Board’s Risk Committee. The Company also maintains coverage under a cyber security insurance policy. Levels of coverage are reviewed periodically to ensure alignment with the organizations risk appetite.

We conduct our core banking operations primarily in Tennessee and surrounding states and compete in the commercial banking industry solely through our wholly ownedwholly-owned banking subsidiary, FirstBank. The banking industry is highly competitive, and we experience competition in our market areas from many other financial institutions. We compete with commercial banks, credit unions, savings institutions, mortgage banking firms, online mortgage lenders, online deposit banks, digital banking platforms, consumer finance companies, securities brokerage firms, insurance companies, money market funds and other mutual funds, as well as super-regional, national and international financial institutions that operate offices in our market areas and elsewhere. In addition, a number of out-of-state financial intermediaries have opened production offices, or otherwise solicit deposits, in our market areas. Increased competition in our markets may result in reduced loans and deposits, as well as reduced net interest margin and profitability. Furthermore, the Tennessee market hasour markets have grown increasingly competitive in recent years with a number of banks entering thisthese market, with a primary focus on the state’s metropolitan markets. We believe this trend will continue as banks look to gain a foothold in these growing markets. This trend will result in greater competition primarily in our metropolitan markets. However, we firmly believe that our market position and client-focused operating model enhancesenhance our ability to attract and retain clients.

See “Our markets” in this section above for a further discussion of the markets we compete in and the competitive landscape in these markets.

At FB Financial, we value our associates, because our associates are FirstBank. They do the work; they serve our communities and they build relationships with our customers. As of December 31, 2020, we had 1,8522022, the Company employed 1,757 full-time equivalent employeesassociates with an average tenure of over 6.26six years of service.

We pride ourselves on our culture which is underpinned bycultivates the talents of our missionassociates helping them give more and get more out of "Helping People Build a Better Future."their jobs than they thought possible. At FirstBank, our vision is to:

We also pride ourselves in our values, which we aspire to live by every day:

Providing a great place to work includes our commitment to diversity, equity, and inclusion. In 2020, we chartered an internal Diversity Council to begin work in 2021 and nearly 20% of our newly hired associates were representative of minority groups.2022, FirstBank was recognized by the Mortgage Bankers Association with the 2020 Diversity and Inclusion Residential Leadership Award.

We are committed to attracting and retaining the best talent in our markets. We provide competitive compensation and benefits that meet the needs of our employees, including market-competitive pay, healthcare benefits, equity incentives, and an employee stock purchase plan. We also provide meaningful training and development opportunities designed to train our next generation of leaders and provide them opportunities for advancement within the Company.

The COVID-19 pandemic allowed us the opportunityThrough our FirstBank Give More program, we added paid volunteer hours to demonstrate our commitment to the health and safety ofallow our associates customers, and communities. to participate in activities supporting community organizations in their local areas.

The pandemic presented challenges in protecting customers and associates while remaining available to serve customer needs. FirstBank rose to the occasion through insight, communication and swift action. The Company's Emergency Management Committee (EMC) is a board-appointed committee comprisedCompany contributes an average of senior managers charged with making critical decisions during emergencies or disasters.

In 2020, significant technology efforts were undertaken to ensureDuring the company could continue to operate with a large remote workforce in response toyear ended December 31, 2022, FirstBank continued the pandemic. Hundreds of additional laptop computers were deployed, and systems supporting secure remote access were enhanced to support this unprecedented requirement. Also, investments were made in technology to support the PPP program, allowing the bank to make over 3,000 loans, protecting pay for over 37,000 of our customers' employees.

The following is a general summary of the material aspects of certain statutes and regulations applicable to us and the Bank. These summary descriptions are not complete, and you should refer to the full text of the statutes, regulations, and corresponding guidance for more information. These statutes and regulations are subject to change, and additional statutes, regulations, and corresponding guidance may be adopted. We are unable to predict these future changes or the effects, if any, that these changes could have on our business, revenues, and financial results.

The Company is subject to regulation and supervision by multiple regulatory bodies. As a registered bank holding company, we are subject to ongoing regulation, supervision, and examination by the Federal Reserve under the existing PPP andBank Holding Company Act of 1956, as amended. The Federal Reserve’s jurisdiction also extends to any company that is directly or indirectly controlled by the expansion of existing PPP loans for certain qualified, existing PPP borrowers. In addition to extending and amending the PPP, the HHSB Act also creates a new grant program for “shuttered venue operators.” bank holding company.

As a participating lender in the PPP, the Company continues to monitor legislative, regulatory, and supervisory developments related thereto, including the most recent changes implemented by the HHSB Act.

The Bank’s deposits are insured by the deposit insurance fund of the FDIC published an interim final ruleup to delayapplicable legal limits. The FDIC charges deposit insurance assessments to FDIC-insured institutions, including the estimated impactBank, to fund and support the DIF. The rate of these deposit insurance assessments is based on, regulatory capital stemming fromamong other things, the implementationrisk characteristics of CECL, the provisionsBank. The FDIC has the power to terminate the Bank’s deposit insurance if it determines the Bank is engaging in unsafe or unsound practices. Federal banking laws provide for the appointment of which became final on September 30, 2020. The final rule maintains the three-year transition optionFDIC as receiver in the previous rule and provides banksevent the optionBank were to delay for two years an estimatefail, such as in connection with undercapitalization, insolvency, unsafe or unsound conditions or other financial distress. In a receivership, the claims of CECL’s effect on regulatory capital, relativethe Bank’s depositors (and those of the FDIC as subrogee of the Bank) would have priority over other general unsecured claims against the Bank.

The Company is also subject to the incurred loss methodology’s effectdisclosure and regulatory requirements of the Securities Act and the Exchange Act, both as administered by the SEC. The Company’s common stock is listed on regulatory capital, followed by a three-year transition period (five-year transition option). The Company has adopted the capital transition relief overNew York Stock Exchange under the permissible five-year period.trading symbol “FBK” and, therefore, is subject to the rules of the NYSE for listed companies.

As a result of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, or Dodd-Frank Act, the regulatory framework under which the Company operates has changed. The Dodd-Frank Act brought about a significant overhaul of many aspects of the regulation of the financial services industry, addressing issues including, among others, systemic risk, capital adequacy, deposit insurance assessments, consumer financial protection, interchange fees, lending limits, mortgage lending practices, registration of investment advisers and changes among the bank regulatory agencies. In particular, portions of the Dodd-Frank Act that affected us and the Bank include, but are not limited to:

Concurrent with $10 billion or moreenactment of the CARES Act, in total consolidated assets. On December 2,March 2020, the OCC, the Board of Governors of the Federal Register issued "Temporary Asset Thresholds"Reserve System, and the FDIC published an interim final rule giving relief to institutions that may have experienced temporary balance sheet growth above one or moredelay the estimated impact on regulatory thresholds. FirstBank has been granted relief under thiscapital stemming from the implementation of CECL, the provisions of which became final on September 30, 2020. The final rule maintains the three-year transition option in the previous rule and as such, will not be subjectprovides banks the option to delay for two years an estimate of CECL’s effect on regulatory capital, relative to the interchange fee restrictions during 2021.incurred loss methodology’s effect on regulatory capital, followed by a three-year transition period (five-year transition option). On January 1, 2020, the Company adopted ASU 2016-13, "Financial Instruments - Credit Losses (Topic 326): Measurement of Credit Losses on Financial Instruments" and elected

As a regulated bank holding company, we are subject to various laws and regulations that affect our business. These laws and regulations, among other matters, prescribe minimum capital requirements, limit transactions with affiliates, impose limitations on the business activities in which we can engage, limit the dividend or distributions that the Bank can pay to us, restrict the ability of institutions to guarantee our debt, and impose certain specific accounting requirements on us that may be more restrictive and may result in greater or earlier charges to earnings or reductions in our capital than generally accepted accounting principles, among other things.

FB Financial has elected to be treated as a financial holding company, which allows us to engage in a broader range of activities than would otherwise be permissible for a bank holding company, including activities such as securities underwriting, insurance underwriting, and merchant banking. To qualify as a financial holding company, a bank holding company must be well-capitalized and well-managed, as those terms are used by the Federal Reserve. In addition, each subsidiary bank of a bank holding company must also be well-capitalized and well-managed and be rated at least "satisfactory" under the CRA. A bank holding company that does not qualify, or has not chosen, to become a financial holding company must limit its activities to traditional banking activities and those non-banking activities the Federal Reserve has deemed to be permissible because they are closely related to the business of banking.

Under the BHCA, as amended, a bank holding company is generally permitted to engage in, or acquire direct or indirect control of more than five percent of any class of the voting shares of any company that is not a bank or bank holding company and that is engaged in, the following activities (in each case, subject to certain conditions and restrictions and prior approval of the Federal Reserve):

While the Federal Reserve has found these activities in the past acceptable for other bank holding companies, the Federal Reserve may not allow us to conduct any or all of these activities, which are reviewed by the Federal Reserve on a case by case basis upon application by a bank holding company.

The Federal Reserve has the authority to order a bank holding company or its subsidiaries to terminate any of these activities or to terminate its ownership or control of any subsidiary when it has reasonable cause to believe that the bank holding company’s continued ownership, activity or control constitutes a serious risk to the financial safety, soundness or stability of itthe bank holding company or any of its bank subsidiaries.

The BHCA requires the prior approval of the Federal Reserve for a bank holding company to acquire substantially all the assets of a bank or to acquire direct or indirect ownership or control of more than 5% of any class of the voting shares of any bank, bank holding company, savings and loan holding company or savings association, or to increase any such non-majoritynon-

majority ownership or control of any bank, bank holding company, savings and loan holding company or savings association, or to merge or consolidate with any bank holding company.

Under current law and Federal Reserve policy, a bank holding company is expected to act as a source of financial and managerial strength to its depository institution subsidiaries and to maintain resources adequate to support such subsidiaries, whichsubsidiaries. Under the “source of strength” doctrine, the Federal Reserve may require a bank holding company to make capital injections into a troubled subsidiary bank and may charge the bank holding company with engaging in unsafe and unsound practices for failure to commit resources to such a subsidiary bank. As a result, we could require usbe required to commit resources to support the Bank in situations where additional investments in a bank may not otherwise be warranted. These situations include guaranteeing the compliance of an “undercapitalized”"undercapitalized" bank with its obligations under a capital restoration plan, as described further under “Bank"Bank regulation: Capitalization levels and prompt corrective action”action" below. As a result of these obligations, a bank holding company may be required to contribute additional capital to its subsidiaries in the form of capital notes or other instruments that qualify as capital under regulatory rules. Any such loan from a holding company to a subsidiary bank is likely to be unsecured and subordinated to the bank’sbank's depositors and perhaps to other creditors of the bank. If we were to enter bankruptcy or become subject to the orderly liquidation process established by the Dodd-Frank Act, any commitment by us to a federal bank regulatory agency to maintain the capital of the Bank would be assumed by the bankruptcy trustee or the FDIC, as appropriate, and entitled to a priority of payment.

The ability of the Company or the Bank to pay dividends, repurchase stock and make other capital distributions is limited by regulatory capital rules and other aspects of the regulatory framework. The Federal Reserve’sReserve's policy regarding dividends is that a bank holding company should not declare or pay a cash dividend that would impose undue pressure on the capital of any bank subsidiary or would be funded only through borrowing or other arrangements that might adversely affect a bank holding company’scompany's financial position. As a general matter, the Federal Reserve has indicated that the board of directors of a bank holding company should consult with the Federal Reserve and eliminate, defer or significantly reduce the bank holding company’scompany's dividends if:

Should an insured depository institution controlled by a bank holding company be “significantly undercapitalized” under the applicable federal bank capital ratios, or if the bank subsidiary is “undercapitalized” and has failed to submit an acceptable capital restoration plan or has materially failed to implement such a plan, federal banking regulators (in the case of the Bank, the FDIC) may choose to require prior Federal Reserve approval for any capital distribution by the bank holding company. For more information, see “Bank regulation: Capitalization levels and prompt corrective action.”

In addition, since our legal entity is separate and distinct from the Bank and does not conduct stand-alone operations, our ability to pay dividends depends on the ability of the Bank to pay dividends to us, which is also subject to regulatory restrictions as described below in “Bank regulation: Bank dividends.”

Under Tennessee law, we are not permitted to pay cash dividends if, after giving effect to such payment, we would not be able to pay our debts as they become due in the usual course of business or our total assets would be less than the sum of our total liabilities plus any amounts needed to satisfy any preferential rights if we were dissolving. In addition, in deciding whether or not to declare a dividend of any particular size, our board of directors must consider our current and prospective capital, liquidity, and other needs.

In July 2013, federal banking regulators, including the Federal Reserve and the FDIC, adopted the U.S. Basel Capital Rules implementing many aspects of the Basel III Capital Standards. The requirements in the U.S. Basel III Capital Rules

were fully phased-in as of January 1, 2019. Specifically, the rules impose the following minimum capital requirements applicable to us and the Bank:

Under the U.S. Basel III Capital Rules, Tier 1 Capital is defined to include two components: common equity Tier 1 Capital and additional Tier 1 Capital. The highest form of capital, Common Equity Tier 1 Capital, ("CET1 Capital"), consists solely of common stock plus related surplus, retained earnings, accumulated other comprehensive income, and minority interests in the equity accounts of consolidated subsidiaries and noncumulative perpetual preferred stock (and related surplus).subsidiaries.

The rules permit bank holding companies with less than $15.0$15 billion in total consolidated assets, to continue to include trust-preferred securities and cumulative perpetual preferred stock issued before May 19, 2010, in Tier 1 Capital, but not in

In addition, in order to avoid restrictions on capital distributions or discretionary bonus payments to executives, a covered banking organization must maintain a capital conservation buffer on top of its minimum risk-based capital requirements. This buffer must consist solely of Tier 1 Common Equity, but the buffer applies to all three risk-based measurements (CET1 Capital, Tier 1 Capital and total capital). The capital conservation buffer consists of an additional amount of common equity equal to 2.5% of risk-weighted assets.

The U.S. Basel III Capital Standards require certain deductions from or adjustments to capital. As a result, deductions from CET1 Capital are required for goodwill (net of associated deferred tax liabilities); intangible assets such as non-mortgage servicing assets and purchased credit card relationships (net of associated deferred tax liabilities); and deferred tax assets that arise from net operating loss and tax credit carryforwards (net of any related valuation allowances and net of deferred tax liabilities); any gain on sale in connection with a securitization exposure; any defined benefit pension fund net asset (net of any associated deferred tax liabilities) held by a bank holding company; the aggregate amount of outstanding equity investments (including retained earnings) in financial subsidiaries; and identified losses.. Other deductions are required from different levels of capital. The U.S. Basel III Capital Rules also increaseincreased the risk weight for certain assets, meaning that more capital must be held against such assets. For example, commercial real estate loans that do not meet certain underwriting requirements must be risk-weighted at 150% rather than the current 100%.

Additionally, the U.S. Basel III Capital Standards provide for the deduction of three categories of assets: (i) deferred tax assets arising from temporary differences that cannot be realized through net operating loss carrybacks (net of related valuation allowances and of deferred tax liabilities), (ii) mortgage servicing assets (net of associated deferred tax liabilities) and (iii) investments in more than 10% of the issued and outstanding common stock of unconsolidated financial institutions (net of associated deferred tax liabilities). The joint agencies issued the Regulatory Capital: Simplifications to the Capital Rule Pursuant to the Economic Growth and Regulatory Paperwork Reduction Act of 1996 (Capital Simplifications Final Rule) on July 22, 2019. Under the Capital Simplifications Final Rule,As a non-advanced approachesapproach banking organizationsorganization, we are subject to simpler regulatory capital requirements for the three categories of assets discussed above.above per the Capital Simplifications final rule. There is a 25% CET1 Capital deduction threshold for all three categories combined.

Accumulated other comprehensive income, or AOCI is presumptively included in CET1 Capital and often would operate to reduce this category of capital. The U.S. Basel III Capital Rules provided a one-time opportunity at the end of the first quarter of 2015 for covered banking organizations to opt out of much of this treatment of AOCI, which we elected. The rules also have the effect of increasing capital requirements by increasing the risk weights on certain assets, including high volatility commercial real estate, mortgage servicing rights not includable in CET1 Capital, equity exposures, and claims on securities firms, which are used in the denominator of the three risk-based capital ratios.

The U.S. Basel III Capital Rules also make important changes to the “prompt corrective action” framework discussed below in “Bank regulation: Capitalization levels and prompt corrective action.”

See “Bank regulation: Restrictions on transactions with affiliates” below.

We are a bank holding company regulated by the Federal Reserve. Subject to certain exceptions, the Change in Bank Control Act or (“CIBCA”), and its implementing regulations require that any individual or company acquiring “control” of a bank or bank holding company, either directly or indirectly, give the Federal Reserve 60 days’ prior written notice of the proposed acquisition. If within that time period the Federal Reserve has not issued a notice disapproving the proposed acquisition, extended the period for an additional period up to 90 days or requested additional information, the acquisition may proceed. An acquisition may be made before expiration of the disapproval period if the Federal Reserve issues written notice that it intends not to disapprove the acquisition. Acquisition of 25 percent or more of any class of voting securities constitutes control, and it is generally presumed for purposes of the CIBCA that the acquisition of 10 percent or more of

any class of voting securities would constitute the acquisition of control, although such a presumption of control may be rebutted.

Also, under the CIBCA, the shareholdings of individuals and companies that are deemed to be “acting in concert” would be aggregated for purposes of determining whether such holders “control” a bank or bank holding company. “Acting in concert” under the CIBCA generally means knowing participation in a joint activity or parallel action towards the common goal of acquiring control of a bank or a bank holding company, whether or not pursuant to an express agreement. The manner in which this definition is applied in individual circumstances can vary and cannot always be predicted with certainty. Many factors can lead to a rebuttable presumption of acting in concert, including where: (i) the shareholders are commonly controlled or managed; (ii) the shareholders are parties to an oral or written agreement or understanding

Furthermore, under the BHCA and its implementing regulations, and subject to certain exceptions, any company would be required to obtain Federal Reserve approval prior to obtaining control of a bank or bank holding company. The Federal Reserve issued a final rule in 2019, effective April 1, 2020, which established tieredTiered presumptions of control are used to determine whether one company has control over another as detailed in the table below. The final rule provides clarity forThere are circumstances where a company acquires less than 25% of any class of voting securities; however, control continues to exist in circumstances where a company directly or indirectly owns, controls or has power to vote 25% or more of any class of voting securities or control in any manner the election of a majority of the directors or trustees of the other company. There is a presumption of non-control for any holder of less than 5% of any class of voting securities, assuming none of the generally applicable presumptions are triggered.

In 2010, the federalUnder regulatory guidance applicable to banking agencies issuedorganizations, incentive compensation policies must be consistent with safety and soundness principles. Under this guidance, to regulated banks and bank holding companies intendedfinancial institutions must review their compensation programs to ensure that incentive compensation arrangements at financial organizations take into accountthey: (i) provide employees with incentives that appropriately balance risk and are consistent with safereward and sound practices. The guidance is based on three “key principles” calling for incentive compensation plans to: appropriately balance risks and rewards; bethat do not encourage imprudent risk, (ii) are compatible with effective controls and risk management;management, and be backed up(iii) are supported by strong corporate governance. Further, in 2016governance, including active and effective oversight by the federal banking regulators re-proposed rules that would prohibitorganization’s board of directors. Monitoring methods and processes used by a banking organization should be commensurate with the size and complexity of the organization and its use of incentive compensation arrangements that would encourage inappropriate risks by providing excessive compensation or that could lead to a material financial loss, and include certain prescribed standards for governance and risk management for incentive compensation for institutions.compensation.

The Bank is a banking institution that is chartered by and headquartered in the State of Tennessee, and it is subject to supervision and regulation by the TDFI, FDIC, and the FDIC.CFPB. The TDFI and FDIC supervise and regulate all areas of the Bank’s operations including, without limitation, the making of loans, the issuance of securities, the conduct of the Bank’s corporate affairs, the satisfaction of capital adequacy requirements, the payment of dividends, and the establishment or closing of banking offices. The FDIC is the Bank’s primary federal regulatory agency, which periodicallyregularly examines the Bank’s operations and financial condition and compliance with federal consumer protection laws. In addition, the Bank’s deposit accounts are insured by the FDIC to the maximum extent permitted by law, and the FDIC has certain enforcement powers over the Bank. The supervision and oversight by the CFPB on the Bank is discussed in greater detail in “Business: Supervision and regulation: Bank regulation: Consumer laws and regulations”.

As a state-chartered banking institution in the State of Tennessee, the Bank is empowered by statute, subject to the limitations contained in those statutes, to take and pay interest on deposits, to make loans on residential and other real estate, to make consumer and commercial loans, to invest, with certain limitations, in equity securities and in debt obligations of banks and corporations and to provide various other banking services for the benefit of the Bank’s clients. Various state consumer laws and regulations also affect the operations of the Bank, including state usury laws, consumer credit and equal credit opportunity laws, and fair credit reporting. In addition, the Federal Deposit Insurance Corporation Improvement Act of 1991, or FDICIA generally prohibits insured state charteredstate-chartered institutions from conducting activities as principal that are not permitted for national banks. The Bank is also subject to various requirements and restrictions under federal and state law, including but not limited to requirements to maintain reserves against deposits, lending limits, limitations on branching activities, limitations on the types of investments that may be made, activities that may be engaged in, and types of services that may be offered. Various consumer laws and regulations also affect the operations of the Bank. Also, the Bank and certain of its subsidiaries are prohibited from engaging in certain tying arrangements in connection with extensions of credit, leases or sales of property, or furnishing products or services.

See “Holding company regulation: U.S. Basel III capital rules.”

Federal law and regulations establish a capital-based regulatory scheme designed to promote early intervention for troubled banks and require the FDIC to choose the least expensive resolution of bank failures. The capital-based regulatory framework contains five categories of regulatory capital requirements, including “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” A well-capitalized insured depository institution is one (i) having a total risk-based capital ratio of 10 percent or greater, (ii) having a Tier 1 risk-based capital ratio of 8 percent or greater, (iii) having a CET1 capital ratio of 6.5 percent or greater, (iv) having a leverage capital ratio of 5 percent or greater and (v) that is not subject to any order or written directive to meet and maintain a specific capital level for any capital measure.

Generally, a financial institution must be “well capitalized” before the Federal Reserve will approve an application by a bank holding company to acquire a bank or merge with a bank holding company, and the FDIC applies the same requirement in approving bank merger applications.

An institution that fails to remain well-capitalized becomes subject to a series of restrictions that increase in severity as its capital condition weakens. Such restrictions may include a prohibition on capital distributions, restrictions on asset growth or restrictions on the ability to receive regulatory approval of applications.

As of December 31, 2020,2022, the Bank had sufficient capital to qualify as “well capitalized” under the requirements contained in the applicable regulations, policies and directives pertaining to capital adequacy, and it is unaware of any material violation or alleged material violation of these regulations, policies or directives. Rapid growth, poor loan portfolio performance, or poor earnings performance, or a combination of these factors, could change the Bank’s capital position in a relatively short period of time, making additional capital infusions necessary.

It should be noted that the minimum ratios referred to above in this section are merely guidelines, and the bank regulators possess the discretionary authority to require higher capital ratios.

The Federal Reserve imposes reserve requirements on certain types of deposits and other liabilities of depository institutions. The Federal Reserve Board determined to reduce the reserve requirement ratios to zero percent effective March 26, 2020 in light of the shift to an ample reserves regime. The interim final rule was adopted as a final rule without change in February 2021.

The FDIC prohibits any distribution that would result in the bank being “undercapitalized” (<4% leverage ratio, <4.5% CET1 Risk-Based ratio, <6% Tier 1 Risk-Based ratio, or <8% Total Risk-Based ratio). Tennessee law places restrictions on the declaration of dividends by state charteredstate-chartered banks to their shareholders, including, but not limited to, that the board of directors of a Tennessee-chartered bank may only make a dividend from the surplus profits arising from the business of the bank, and may not declare dividends in any calendar year that exceeds the total of its retained net income of that year combined with its retained net income of the preceding two (2) years without the prior approval of the TDFI commissioner. Furthermore, the FDIC and the TDFI also have authority to prohibit the payment of dividends by a Tennessee bank when it determines such payment to be an unsafe and unsound banking practice.

The Bank paysFDIC imposes a risk-based deposit insurance assessmentspremium assessment system, which was amended pursuant to the Federal Deposit Insurance Fund, whichReform Act of 2005. Under this system, the amount of FDIC assessments paid by an individual insured depository institution, like the Bank, is determined through a risk-based assessment system.based on the level of perceived risk incurred in its activities. The Bank’sBank's deposit accounts are currently insured by the Deposit Insurance Fund, generally up to a maximum of $250,000 per separately insured depositor. The Bank pays deposit insurance assessments to the FDIC for such deposit insurance.to be insured by the DIF. Under the current assessment system, the FDIC assigns an institution to a risk category based on the institution’sinstitution's most recent supervisory and capital evaluations, which are designed to measure risk. Under the FDIA, the FDIC may terminate a bank’sbank's deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order, agreement or condition imposed by the FDIC. Under the Dodd-Frank Act, the FDIC has adopted regulations that base deposit insurance assessments on total assets less capital rather than deposit liabilities and include off-balance sheet liabilities of institutions and their affiliates in risk-based assessments. After an institution's average assets exceed $10 billion over four quarters, the assessment rate increases compared to institutions at lower average asset levels. In addition, for largerlarge institutions, the FDIC uses a performance score and a loss-severity score that are used to calculate an initial assessment rate. In calculating these scores, the FDIC uses a bank’sbank's capital level and supervisory ratings and

The Bank is subject to sections 23A and 23B of the Federal Reserve Act, or FRA, and the Federal Reserve’s Regulation W, as made applicable to state nonmember banks by section 18(j) of the FDIA. An affiliate of a bank is any company or entity that controls, is controlled by or is under common control with the Bank, and, in our case, includes, among others, the Company as well as our Viceformer Chairman, James W. Ayers and the companies he controls. Accordingly, transactions between the Bank on the one hand, and the Company or Mr. Ayers or any of his affiliates, on the other hand, will be subject to a number of restrictions, including restrictions relating to extensions of credit, contracts, leases and purchases or sale of assets. Such restrictions and limitations prevent the Company or Mr. Ayers or hisother affiliates from borrowing from the Bank unless the loans are secured by specified collateral of designated amounts. Furthermore, such secured loans by the Bank to the Company or Mr. Ayers and his other

affiliates are limited, individually, to ten percent (10%) of the Bank’s capital and surplus, and such secured loans are limited in the aggregate to twenty percent (20%) of the Bank’s capital and surplus.

All such transactions must be on terms that are no less favorable to the Bank than those that would be available from nonaffiliated third parties. Federal Reserve policies also forbid the payment by bank subsidiaries of management fees which are unreasonable in amount or exceed the fair market value of the services rendered or, if no market exists, actual costs plus a reasonable profit.

Loans to executive officers, directors or to any person who directly or indirectly, or acting through or in concert with one or more persons, owns, controls or has the power to vote more than 10% of any class of voting securities of a bank, which the Bank refers to as “10% Shareholders,” or to any political or campaign committee the funds or services of which will

The Community Reinvestment Act, or CRA and its corresponding regulations are intended to encourage banks to help meet the credit needs of their service areas, including low and moderate-income neighborhoods, consistent with safe and sound operations. These regulations provide for regulatory assessment of a bank’s record in meeting the credit needs of its service area. Federal banking agencies are required to make public a rating of a bank’s performance under the CRA. The federal banking agencies consider a bank’s CRA rating when a bank submits an application to establish banking centers, merge, or acquire the assets and assume the liabilities of another bank. In the case of a bank holding company, the CRA performance record of all banks involved in the merger or acquisition are reviewed in connection with the filing of an application to acquire ownership or control of shares or assets of a bank or to merge with any other financial holding company. An unsatisfactory record can substantially delay, block or impose conditions on the transaction. The Bank received a satisfactory rating on its most recent CRA assessment.

In December 2019, the FDIC and the Office of the Comptroller of the Currency (“OCC”) jointly proposed rules that would significantly change existing CRA regulations. The proposed rules are intended to increase bank activity in low- and moderate-income communities where there is significant need for credit, more responsible lending, greater access to banking services, and improvements to critical infrastructure. The proposals change four key areas: (i) clarifying what activities qualify for CRA credit; (ii) updating where activities count for CRA credit; (iii) providing a more transparent and objective method for measuring CRA performance; and (iv) revising CRA-related data collection, record keeping, and reporting. However, the Federal Reserve Board did not join in that proposed rulemaking. In May 2020, the OCC issued its final CRA rule, effective October 1, 2020. The FDIC has not finalized the revisions to its proposed CRA rule. In September 2020, the Federal Reserve Board issued an Advance Notice of Proposed Rulemaking (“ANPR”)ANPR that invites public comment on an approach to modernize the regulations that implement the CRA by strengthening, clarifying, and tailoring them to reflect the current banking landscape and better meet the core purpose of the CRA. The ANPR seeks feedback on ways to evaluate how banks meet the needs of low- and moderate-income communities and address inequities in credit access. In May 2022, the federal banking regulators issued a joint proposed rule that would substantially revise how an insured depository institution's CRA performance is evaluated. As such, we will continue to evaluate the impact of any changes to the regulations implementing the CRA and their impact to our financial condition, results of operations, and/or liquidity, which cannot be predicted at this time.

The USA PATRIOT Act provides the federal government with additional powers to address terrorist threats through enhanced domestic security measures, expanded surveillance powers, increased information sharing and broadened anti-money laundering requirements. By way of amendments to the BSA, the USA PATRIOT Act imposed new requirements that obligate financial institutions, such as banks, to take certain steps to control the risks associated with money laundering and terrorist financing.

Among other requirements, the USA PATRIOT Act and implementing regulations require banks to establish anti-money laundering programs that include, at a minimum:

Additionally, the USA PATRIOT Act requires each financial institution to develop a customer identification program (“CIP”) as part of the Bank’s anti-money laundering program. The key components of the CIP are identification, verification, government list comparison, notice and record retention. The purpose of the CIP is to enable the financial institution to

Likewise, the U.S. Department of the Treasury’s Office of Foreign Assets Control, or OFAC is responsible for helping to ensure that United States entities do not engage in transactions with the subjects of U.S. sanctions, as defined by various Executive Orders and Acts of Congress. Currently, OFAC administers and enforces comprehensive U.S. economic sanctions programs against certain specified countries/regions. In addition to the country/region-wide sanctions programs, OFAC also administers complete embargoes against individuals and entities identified on OFAC’s list of Specially Designated Nationals and Blocked Persons (“SDN List”).Persons. The SDN List includes thousands of parties that are located in many jurisdictions throughout the world, including in the United States and Europe. The Bank is responsible for determining whether any potential and/or existing clients appear on the SDN List or are owned or controlled by a person on the SDN List. If any client appears on the SDN List or is owned or controlled by a person or entity on the SDN List, such client’s account must be placed on hold and a blocking or rejection report, as appropriate and if required, must be filed within 10 business days with OFAC. In addition, if a client is a citizen of, has provided an address in, or is organized under the laws of any country or region for which OFAC maintains a comprehensive sanctions program, the Bank must take certain actions with respect to such clients as dictated under the relevant OFAC sanctions program. The Bank must maintain compliance with OFAC by implementing appropriate policies and procedures and by establishing a recordkeeping system that is reasonably appropriate to administer the Bank’s compliance program. The Bank has adopted policies, procedures and controls to comply with the BSA, the USA PATRIOT Act and OFAC regulations.

Federal and state banking laws grant substantial enforcement powers to federal and state banking regulators. This enforcement authority includes, among other things, the ability to assess civil money penalties, to issue consent or removal orders and to initiate injunctive actions against banking organizations and “institution-affiliated parties,” such as management, employees and agents. In general, these enforcement actions may be initiated for violations of laws, regulations and orders of regulatory authorities, or unsafe or unsound practices. Other actions or inactions, including filing false, misleading or untimely reports with regulatory authorities, may provide the basis for enforcement action. When issued by a banking regulator, consent and similar orders may, among other things, require affirmative action to correct any harm resulting from a violation or practice, including restitution, reimbursement, indemnifications or guarantees against loss. A bank may also be ordered to restrict its growth, dispose of certain assets, rescind agreements or contracts, or take other actions determined to be appropriate by the ordering regulatory agency.

The Bank is a member of the Federal Home Loan Bank of Cincinnati, which is one of 11 regional Federal Home Loan Banks (“FHLBs”).Banks. Each FHLB serves as a reserve or central bank for its members within its assigned region. It is funded primarily from funds deposited by member institutions and proceeds from the sale of consolidated obligations of the FHLB system. It makes loans to members (i.e., advances) in accordance with policies and procedures established by the board of directors of the FHLB.

As a member of the FHLB of Cincinnati, the Bank is required to own capital stock in the FHLB in an amount generally at least equal to 0.20% (or 20 basis points) of the Bank’s total assets at the end of each calendar year, plus 4.5% of its

outstanding advances (borrowings) from the FHLB of Cincinnati under the activity-based stock ownership requirement. These requirements are subject to adjustment from time to time. On December 31, 2020,2022, the Bank was in compliance with this requirement.

Under the GLBA, federal banking regulators adopted rules limiting the ability of banks and other financial institutions to disclose nonpublic information about consumers to nonaffiliated third parties. The rules require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to nonaffiliated third parties. The GLBA also directed federal regulators, including the FDIC, to prescribe standards for the security of consumer information. The Bank is subject to regulations implementing the privacy protection provisions of GLBA. These regulations require the Bank to disclose its privacy policy, including identifying with whom it shares "nonpublic personal information," to customers at the time of establishing the customer relationship and annually thereafter. The regulations also require the Bank to provide its customers with initial and annual notices that accurately reflect its privacy policies and practices. In addition, to the extent its sharing of such standards, as well asinformation is not covered by an exception, the Bank is required to provide its customers with the ability to "opt-out" of having the Bank share their nonpublic personal information with unaffiliated third parties.

The Bank is subject to regulatory guidelines establishing standards for notifying clientssafeguarding customer information. These regulations implement certain provisions of the GLBA. The guidelines describe the federal bank regulatory agencies’ expectations for the creation, implementation and maintenance of an information security program, which would include administrative, technical and physical safeguards appropriate to the size and complexity of the institution and the nature and scope of its activities. The standards set forth in the eventguidelines are intended to ensure the security and confidentiality of customer records and information, protect against any anticipated threats or hazards to the security or integrity of such records and protect against unauthorized access to or use of such records or information that could result in substantial harm or inconvenience to any customer. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services.

In November 2021, the federal bank agencies approved a final rule that places reporting requirements on banks and banking service providers that experience cybersecurity incidents. Under this rule, banks must report these incidents within 36 hours to federal regulator. In addition, banks are required to inform customers of any computer security breach.

The Bank is also subjectCFPB and the federal banking agencies continue to other federal and statefocus attention on consumer protection laws and regulationsregulations. The CFPB is responsible for promoting fairness and transparency for mortgages, credit cards, deposit accounts and installment financial products and services and for interpreting and enforcing the federal consumer financial laws that govern the provision of such products and services. Federal consumer financial laws enforced by the CFPB include, but are designednot limited to, protect consumers in transactions with banks. While the list set forth below is not exhaustive, these laws and regulations include the Truth in Lending Act, the Truth in Savings Act, the Electronic Funds Transfer Act, the Expedited Funds Availability Act, the Check Clearing for the 21st Century Act, the Fair Credit Reporting Act, the Fair Debt Collection Practices Act, the Equal Credit Opportunity Act, the Fair Housing Act, the Home Mortgage Disclosure Act, the Fair and Accurate Transactions Act, the Servicemembers Civil Relief Act, the Military Lending Act, the Mortgage Disclosure Improvement Act, and the Real Estate Settlement Procedures Act, among others. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must deal with consumers when offering consumer financial products and services. The CFPB is also authorized to prevent any institution under its authority from engaging in an unfair, deceptive, or abusive act or practice in connection with consumer financial products and services. We are subject to multiple federal consumer protection statutes and regulations, including, but not limited to, those referenced above.

The CFPB may issue regulations that impact products and services offered by us or the Bank. The regulations could reduce the fees that we receive, alter the way we provide our products and services, or expose us to greater risk of private litigation or regulatory enforcement action.

Various legislative acts are from time to time introduced in Congress and the Tennessee legislature. This legislation may change banking statutes and the environment in which we operate in substantial and unpredictable ways. We cannot determine the ultimate effect that potential legislation, if enacted, or implementing regulations and interpretations with respect thereto, would have on our financial condition or results of operations.

Our website address is www.firstbankonline.com. weWe file or furnish to the SECSecurities Exchange and Commission Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, proxy statements and annual reportsAnnual Reports to shareholders, and from time to time, amendments to these documents and other documents called for by the SEC. The reports and other documents filed with or furnished to the SEC are available to investors on or through our website at https://investors.firstbankonline.com under the heading “Stock & Filings” and then under “SEC Filings.” These reports are available on our website free of charge as soon as reasonably practicable after we electronically file them with the SEC.

In addition to our website, the SEC maintains an internet site that contains our reports, proxy and information statements and other information we file electronically with the SEC at https://www.sec.gov.

Making any loan involves various risks, including risks inherent in dealing with individual borrowers, risks of nonpayment, risks resulting from uncertainties as to the future value of collateral and cash flows available to service debt, and risks resulting from changes in economic and market conditions. Our credit risk approval and monitoring procedures may fail to identify or reduce these credit risks, and they cannot completely eliminate all credit risks related to our loan portfolio. If the overall economic climate, including employment rates, real estate markets, interest rates and general economic growth, in the United States, generally, or Tennessee, (particularly the Nashville MSA), specifically, experiences material disruption, our borrowers may experience difficulties in repaying their loans, the collateral we hold may decrease in value or become illiquid, and the levels of nonperforming loans, charge-offs and delinquencies could rise and require additional provisions for loan losses, which would cause our net income and return on equity to decrease.

We maintain an allowance for credit losses, which is a reserve established through a provision for credit losses charged to expense, which represents the portion of the loan's amortized cost basis that we do not expect to collect due to credit losses over the loan's life, considering past events, current conditions, and reasonable and supportable forecasts of future economic conditions considering macroeconomic forecasts. In addition, we record a reserve for unfunded commitments, considering the same items included in the allowance for credit losses with the addition of expected funding. Management’s determination of the appropriateness of the allowance and reserve for unfunded commitments is based on periodic evaluation of the loan portfolio, lending-related commitments and other relevant factors, including macroeconomic forecasts and historical loss rates. Deterioration in economic conditions affecting borrowers, new information regarding existing loans, identification of additional problem loans and other factors, both within and outside of our control, may require an increase in the allowance for credit losses and/or the reserve for unfunded commitments. The model is sensitive to changes in macroeconomic forecasts and incorporates management judgement.judgment. If we are required to materially increase our level of allowance for credit losses for any reason, such increase could adversely affect our business, financial condition and results of operations.

The application of the purchase method of accounting in our acquisitions (and any future acquisitions) also will affect our allowance for credit losses. We are required to determine whether purchased loans held for investment have experienced more-than-insignificant deterioration in credit quality since origination. Loans that have experienced this level of deterioration in credit quality are subject to special accounting at initial recognition. We initially measure the amortized cost of a purchase credit deteriorated loan by adding the acquisition date estimate of expected credit losses to the loan's purchase price (i.e. the "gross up" approach). If we have underestimated credit losses at recognition, we will incur additional expense in our provision for credit losses to maintain an appropriate level of allowance for credit losses on those loans.

As of December 31, 2020,2022, approximately 77.9%82% of our loan portfolio was comprised of loans with real estate as a primary or secondary component of collateral. This includes collateral consisting of income producing and residential construction properties, which properties tend to be more sensitive to general economic conditions and downturns in real estate markets. As a result, adverse developments affecting real estate values in our market areas could increase the credit risk associated with our real estate loan portfolio. Adverse changes affecting real estate values and the liquidity of real estate in one or more of our markets could increase the credit risk associated with our loan portfolio and could result in losses that would adversely affect credit quality and our financial condition or results of operations. These adverse changes could significantly impair the value of property pledged as collateral to secure the loans and affect our ability to sell the collateral upon foreclosure without a loss or additional losses. If real estate values decline, it is also more likely that we would be required to increase our allowance for credit losses. Thus, declines in the value of real estate collateral could adversely affect our financial condition, results of operations or cash flows.

As of December 31, 2020, the following loan types accounted for the stated percentages of our loan portfolio:Our exposure to commercial real estate (both owner-occupied and non-owner occupied) - 36%;, commercial and industrial, - 19%; and construction - 17%. These loans expose us to greater credit risk than loans secured by other types of collateral because the collateral securing these loans is typically more difficult to liquidate. Additionally, these types of loans also often involve larger loan balances to a single borrower or groups of related borrowers. These higher credit risks are further heightened when the loans are concentrated in a small number of larger borrowers leading to relationship exposure. As of December 31, 2022,

Non-owner occupied commercial real estate loans may be affected to a greater extent than residential loans by adverse conditions in real estate markets or the economy because commercial real estate borrowers’ ability to repay their loans depends on successful development of their properties. These loans also involve greater risk because they generally are not fully amortizing over the loan period, and therefore have a balloon payment due at maturity. A borrower’s ability to make a balloon payment typically will depend on being able to either refinance the loan or sell the underlying property in a timely manner. In addition, banking regulators have been giving commercial real estate lending greater scrutiny, and may require banks with higher levels of commercial real estate loans to implement improved underwriting, internal controls, risk management policies and portfolio stress testing, as well as possibly higher levels of allowances for losses and capital levels as a result of commercial real estate lending growth and exposures.

Commercial and industrial loans and owner-occupied commercial real estate loans are typically based on the borrowers’ ability to repay the loans from the cash flow of their businesses. These loans may involve greater risk because the availability of funds to repay each loan depends substantially on the success of the business itself. In addition, the assets securing the loans depreciate over time, are difficult to appraise and liquidate, and fluctuate in value based on the success of the business.

Risk of loss on a construction loan depends largely upon whether our initial estimate of the property’s value at completion of construction or development equals or exceeds the cost of the property construction or development (including interest), the availability of permanent take-out financing and the builder’s ability to sell the property. During the construction or development phase, a number of factors can result in delays and cost overruns. If estimates of value are inaccurate or if actual construction costs exceed estimates, the value of the property securing the loan may be insufficient to ensure full repayment when completed through a permanent loan or by foreclosure on collateral.

Commercial real estate loans, commercial and industrial loans, and construction loans are more susceptible to a risk of loss during a downturn in the business cycle due to the vulnerability of these sectors during a downturn. Our underwriting, review and monitoring cannot eliminate all of the risks related to these loans. We also make both secured and unsecured loans to our commercial customers. Unsecured loans generally involve a higher degree of risk of loss than secured loans because, without collateral, repayment is wholly dependent upon the success of the borrowers’ businesses. Because of this lack of collateral, we are limited in our ability to collect on defaulted unsecured loans. Further, the collateral that secures our secured commercial and industrial loans typically includes inventory, accounts receivable and equipment, which usually have a value that is insufficient to satisfy the loan without a loss if the business does not succeed. Our loan

We conduct our banking operations primarily in Tennessee. As of December 31, 2020,2022, approximately 76%73% of our loans and approximately 81%82% of our deposits were made to borrowers or received from depositors who live and/or primarily conduct business in Tennessee. Therefore, our success will depend in large part upon the general economic conditions in this area. This geographic concentration imposes risks from lack of geographic diversification, as adverse economic developments in Tennessee (including the Nashville MSA, our largest market), among other things, could affect the

volume of loan originations, increase the level of nonperforming assets, increase the rate of foreclosure losses on loans, reduce the value of our loans and loan servicing portfolio, reduce the value of the collateral securing our loans and reduce the amount of our deposits.

Any regional or local economic downturn that affects Tennessee or existing or prospective borrowers, depositors or property values in this area may affect us and our profitability more significantly and more adversely than our competitors whose operations are less geographically concentrated.

Our earnings and financial condition are dependent to a large degree upon net interest income, which is the difference, or spread, between interest earned on loans, securities and other interest-earning assets and interest paid on deposits, borrowings and other interest-bearing liabilities. When market rates of interest change, the interest we receive on our assets and the interest we pay on our liabilities may fluctuate. This may cause decreases in our spread and may adversely affect our earnings and financial condition. Interest rates are highly sensitive to many factors including, without limitation: the rate of inflation; economic conditions; federal monetary policies; and stability of domestic and foreign markets.

Although we have implemented procedures we believe will reduce the potential effects of changes in interest rates on our net interest income, these procedures may not always be successful. Accordingly, changes in levels of market interest rates could materially and adversely affect our net interest income and our net interest margin, asset quality, loan and lease origination volume, liquidity or overall profitability. Additionally, changes in interest rates can adversely impactaffect the origination of mortgage loans held for sale and resulting mortgage banking revenues.

In November 2020, the ICE Benchmark Administration, the London Interbank Offered Rate administrator, announced its intention to continue most U.S. Dollar LIBOR tenors until June 30, 2023. The Financial Conduct Authority announced support for this development, signaling an extension from its prior communication that it would no longer require panel banks to submit rates for LIBOR after 2021. In addition, the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation issued a statement encouraging banks to transition away from U.S. Dollar LIBOR as soon as practicable. The Alternative Reference Rates Committee was convened in the U.S. to explore alternative reference rates and supporting processes.support processes to help ensure a successful transition from U.S. Dollar LIBOR to a more robust reference rate. The ARRC is made up of financial and capital marketmarkets institutions, is convened by the Federal Reserve Board and the Federal Reserve Bank of New York, and includes participation by various regulators. The ARRC identified a potential successor rate to LIBOR inhas recommended the Secured Overnight Financing Rate as a successor rate to U.S. Dollar LIBOR and crafted thehas developed a Paced Transition Plan to facilitate the transition.transition from LIBOR. However, there are conceptual and technical differences between LIBOR and SOFR.

The retirement of LIBOR is a significant shift in the industry. The transition will change our market risk profiles, requiring changes to risk and pricing models, valuation tools, product design and hedging strategies. Furthermore, failureWe established a LIBOR Transition Committee to transition from LIBOR to alternative rates and has continued its efforts consistent with industry timelines. As part of these efforts, during the fourth quarter of 2021, we ceased utilization of LIBOR as an index in newly originated loans or loans that are refinanced. Additionally, we identified existing products that utilize LIBOR and are reviewing contractual language to facilitate the transition to alternative reference rates. Failure to adequately manage this transition process with our customers could adversely impact our reputation. Although we are currently unable to assess what the ultimate impact of the transition from LIBOR will be, failure to adequately manage the transition could have a material adverse effect on our business, financial condition and results of operations.

Changes in interest rates may negatively affect both the returns on and fair value of our investment securities. Interest rate volatility can reduce unrealized gains or increase unrealized losses in our portfolio. Interest rates are highly sensitive to many factors including monetary policies, domestic and international economic and political issues, and other factors beyond our control. Additionally, actual investment income and cash flows from investment securities that carry prepayment risk, such as mortgage-backed securities and callable securities, may materially differ from those anticipated at the time of investment or subsequently as a result of changes in interest rates and market conditions. These occurrences could have a material adverse effect onmaterially and adversely affect our net interest income or our results of operations.

Financial services institutions are interrelated as a result of trading, clearing, counterparty, or other relationships. We have exposure to many different industries and counterparties, and routinely execute transactions with counterparties in the

financial services industry, including commercial banks, brokers and dealers, investment banks and other institutional customers. Many of these transactions expose us to credit risk in the event of a default by, or questions or concerns about the creditworthiness of, a counterparty or client, or concerns about the financial services industry generally. In addition, our credit risk may be exacerbated when the collateral held by us cannot be realized upon or is liquidated at prices not sufficient to recover the full amount of the credit or derivative exposure due to us. Any such losses could have a material adverse effect on us.

We rely on our ability to generate deposits and effectively manage the repayment and maturity schedules of our loans and investment securities to ensure that we have adequate liquidity to fund our operations. In addition to our traditional funding sources, we also may borrow funds from third-party lenders or issue equity or debt securities to investors. Our access to funding sources in amounts adequate to finance or capitalize our activities, or on terms that are acceptable to us, could be impaired by factors that affect us directly or the financial services industry or economy in general, such as disruptions in the financial markets or negative views and expectations about the prospects for the financial services industry. Any decline in available funding could adversely impact our ability to originate loans, invest in securities, meet our expenses, pay dividends to our shareholders, or to fulfill obligations such as repaying our borrowings or meeting deposit withdrawal demands, any of which could have a material adverse impact on our liquidity, business, financial condition or results of operations.

Because we sell a substantial portion of the mortgage loans we originate, the profitability of our mortgage banking business also depends in large part on our ability to aggregate a high volume of loans and sell them in the secondary market at a gain. In fact, whenIf interest rates rise, we expect increasing industry-wide competitive pressures related to changing market conditions to reduce pricing margins and mortgage revenues generally. If our level of mortgage production declines, our continued profitability will depend upon our ability to further reduce our costs commensurate with the reduction of revenue from our mortgage operations.costs. If we are unable to do so, our continued profitability may be materially and adversely affected.

newly originated loans that we originate directly with borrowers qualify under existing standards for inclusion in MBS issued by Fannie Mae or Freddie Mac or guaranteed by Ginnie Mae. A number of legislative proposals have been introduced in recent years that would wind down or phase out the GSEs. It is not possible to predict the scope and nature of the actions that the U.S. government, will ultimately take with respect to the GSEs. Any changes in laws and regulations affecting the relationship between Fannie Mae and Freddie Mac and their regulators or the U.S. federal government, and any changes in leadership at these entities, could adversely affect our business and prospects. Any discontinuation of, or significant reduction in, the operation of Fannie Mae or Freddie Mac or any significant adverse change in their capital structure, financial condition, activity levels in the primary or secondary mortgage markets or in underwriting criteria could materially and adversely affect our business, financial condition, liquidity and results of operations.

Elimination of the traditional roles of Fannie Mae and Freddie Mac, or any changes to the nature or extent of the guarantees provided by Fannie Mae and Freddie Mac or the fees, terms and guidelines that govern our selling and servicing relationships with them, could also materially and adversely affect our ability to sell and securitize loans through our loan production segment, and the performance, liquidity and market value of our investments. Moreover, any changes to the nature of the GSEs or their guarantee obligations could redefine what constitutes an Agency MBS and could have broad adverse implications for the market and our business, financial condition, liquidity and results of operations.

Our mortgage operation originates, sells and services residential mortgage loans. Changes in interest rates, housing prices, applicable government regulations and pricing decisions by our loan competitors may adversely affect demand for our residential mortgage loan products, the revenue realized on the sale of loans, the revenues received from servicing such loans for others and, ultimately, reduce our net income. New regulations, increased regulatory reviews, and/or changes in the structure of the secondary mortgage markets which we utilize to sell mortgage loans may increase costs and make it more difficult to operate a residential mortgage origination business. Our revenue from the mortgage banking

We act as servicer for approximately $9.79$11.09 billion of mortgage loans owned by third parties as of December 31, 2020.2022. As a servicer for those loans, we have certain contractual obligations to third parties. If we commit a material breach of our obligations as servicer, we may be subject to termination if the breach is not cured within a specified period of time following notice, causing us to lose servicing income. For certain investors and/or transactions, we may be contractually obligated to repurchase a mortgage loan or reimburse the investor for credit losses incurred on the loan as a remedy for origination errors with respect to the loan. If we have increased repurchase obligations because of claims that we did not satisfy our obligations as a servicer, or if we have increased loss severity on such repurchases, we may have a significant reduction to net servicing income within our mortgage banking noninterest income. In addition, we may be subject to fines and other sanctions imposed by federal or state regulators as a result of actual or perceived deficiencies in our foreclosure practices. Any of these actions may harm our reputation or negatively affect our residential lending or servicing business and, as a result, our profitability.

FB Financial CorporationThe Company and FirstBankthe Bank are subject to extensive federal and state regulation and supervision by the FDIC, Tennessee Department of Financial Institution, the Federal Reserve Board, and the CFPB, among others, the primary focus of which is to protect customers, depositors, the deposit insurance fund and the safety and soundness of the banking system as a whole, and not shareholders. The quantity and scope of applicable federal and state regulations may place banks at a competitive disadvantage compared to less regulated competitors such as financial technology companies, finance companies, credit unions, mortgage banking companies and leasing companies. These laws and regulations apply to almost every aspect of our business, and affect our lending practices and procedures, capital structure, investment activities, deposit gathering activities, our services and products, risk management practices, dividend policy and growth, including through acquisitions.

supervisory guidance, could affect us in substantial and unpredictable ways, and could subject us to additional costs, restrict our growth, limit the services and products we may offer or limit the pricing of banking services and products. In

addition, establishing systems and processes to achieve compliance with laws and regulation increases our costs and could limit our ability to pursue business opportunities.

If we receive less than satisfactory results on regulatory examinations, we could be subject to damage to our reputation, significant fines and penalties, requirements to increase compliance and risk management activities and related costs and restriction on acquisitions, new locations, new lines of business, or continued growth. Future changes in federal and state banking could adversely affect our operating results and ability to continue to compete effectively. For example, the Dodd-Frank Act and related regulations, including the Home Mortgage Disclosure Act, subject us to additional restrictions, oversight and reporting obligations, which have significantly increased costs. And over the last several years, state and federal regulators have focused on enhanced risk management practices, mortgage law and regulation, compliance with the Bank Secrecy Act and anti-money laundering laws, data integrity and security, use of service providers, and fair lending and other consumer protection issues, which has increased our need to build additional processes and infrastructure. Government agencies charged with adopting and interpreting laws, rules and regulations, may do so in an unforeseen manner, including in ways that potentially expand the reach of the laws, rules or regulations more than initially contemplated or currently anticipated. We cannot predict the substance or impact of pending or future legislation or regulation, or the application thereof. Compliance with such current and potential regulation and scrutiny could significantly increase our costs, impede the efficiency of our internal business processes, require us to increase our regulatory capital and limit our ability to pursue business opportunities in an efficient manner. Our success depends on our ability to maintain compliance with both existing and new laws and regulations.

The Company and the Bank are subject to various regulatory restrictions relating to the payment of dividends. In addition, the Federal Reserve has the authority to prohibit bank holding companies from engaging in unsafe or unsound practices in conducting their business. These federal and state laws, regulations and policies are described in greater detail in “Business: Supervision and regulation: Bank regulation: Bank dividends” and “Business: Supervision and regulation: Holding company regulation: Restriction on bank holding company dividends,” and generally consider previous results and net income, capital needs, asset quality, existence of enforcement or remediation proceedings, and overall financial

The Federal Reserve requires us to act as a source of strength to the Bank and to commit capital and financial resources to support the Bank. This support may be required at times when we might otherwise determine not to provide it. In addition, if we commit to a federal bank regulator that we will maintain the capital of the Bank, whether in response to the Federal Reserve’s invoking its source-of-strength authority or in response to other regulatory measures, that commitment will be assumed by a bankruptcy trustee and, as a result, the Bank will be entitled to priority payment in respect of that commitment, ahead of our other creditors. Thus, any borrowing that must be done by us in order to support the Bank may adversely impact our cash flow, financial condition, results of operations or prospects.

We may be involved from time to time in a variety of litigation, investigations or similar matters arising out of our business. From time to time, and particularly during periods of economic stress, customers may make claims or otherwise take legal action pertaining to performance of our responsibilities. These claims are often referred to as “lender liability” claims. Whether customer claims and legal action related to the performance of our responsibilities are founded or unfounded, if such claims and legal actions are not resolved in a favorable manner, they may result in significant financial liability and/or adversely affect our market perception, products and services, as well as potentially affecting customer demand for those products and services. In many cases, we may seek reimbursement from our insurance carriers to cover such costs and expenses. These claims, as well as supervisory and enforcement actions by our regulators could involve large monetary claims, capital directives, regulatory agreements and directives and significant defense costs. The outcome of any such cases or actions is uncertain. Substantial legal liability or significant regulatory action against us could have material

adverse financial effects or cause significant reputational harm to us, which in turn could seriously harm our business prospects. Our insurance may not cover all claims that may be asserted against us, and any claims asserted against us, regardless of merit or eventual outcome, may harm our reputation. Should the ultimate judgments or settlements in any litigation or investigation significantly exceed our insurance coverage, they could have a material adverse effect on our business, financial condition or results of operations.

We depend on manya range of third-party service providers that are integral to the operation of our business. These vendors service our mortgage loan business, provide critical core systemssystems' processing services, essential web hosting and other internet systems, and deposit processing services. If any of these service providers fail to perform servicing duties or perform those duties inadequately, we could experience a temporary interruption in our business, sustain credit losses on our loans and/or incur additional costs to obtain a replacement servicer. There can be no assurance that a replacement servicer could be retained in a timely manner or at a similar cost.

We cannot be sure that we will beBeing able to maintain these relationships on favorable terms.terms is not guaranteed. In addition, some of our data processing services are provided by companies associated with our competitors. The loss of these vendor relationships could disrupt the services we provide to our customers and cause ussignificant expenses to incur significant expense in connection with replacingreplace these services. If theseOur operations could be significantly disrupted if third-party service providers experienceexperienced their own difficulties, or terminate their services, and we are unable to replace them with other service providers, particularly on a timely basis, our operations could be interrupted.services. If an interruption were to continue for a significant period, of time, our business,business' financial condition or results ofand operations could be adversely affected, perhaps materially. Even ifAssuming we arewere able to replace third-party service providers, it may be at a higher cost to us, which could adversely affect our business, financial condition or results of operations. Ifcost. For example, if we experienced issues with our mortgage servicing provider ourit could result in a range of critical issues including; servicing rights could bebecoming terminated, or we may be required to repurchaserepurchasing of mortgage loans, and/or reimburse investors as a result of such failures of our third-party service providers, any of which could adversely affect our reputation, results of operations or financial condition.reimbursements to investors.

Additionally, we utilize many vendors that provide services to support our operations, including the storage and processing of sensitive consumer and business customer data. A cyber security breach of a vendor's system may result in theft and/or unavailability of our data or disruption of business processes. In most cases, we will remain primarilyWe could be liable to our

Our risk management framework is comprised of various processes, systems, and strategies, and isthat are designed to manage the types of risk to which we are subject, including, among others, credit, market,price, liquidity, interest rate and compliance risks. Our framework also includes financial or other modeling methodologies that involve management assumptions and judgment. Our risk management framework may not be effective under all circumstances and may not adequately mitigate any risk or loss to us. If our framework is not effective, we could suffer unexpected losses and our business, financial condition, results of operations or prospects could be materially and adversely affected.

The computer systems and network infrastructure we, and our vendors, use may be vulnerable to physical theft, fire, power loss, telecommunications failure or a similar catastrophic event, as well asevent. Additionally, security breaches, denial of service attacks, viruses, ransomware, and other disruptive problems caused by cyber criminals. Any damage or failure that causes breakdowns or disruptions in our client relationship management, general ledger, deposit, loan and other systems could damage our reputation, result in a loss of client business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on us.

Computer break-ins,Compromised computers, phishing and other disruptions could also jeopardize the security of information stored in and transmitted through our computer systems and network infrastructure. A cybersecurity breach of our information systems could lead to fraudulent activity such as identity theft, losses on the part of our banking customers, additional security costs, negative publicity and damage to our reputation and brand. In addition, our customers could be subject to scams that may result in the release of sufficient information concerning themselves or their accounts to allow unauthorized access to their accounts or our systems (e.g., “phishing” and “smishing”). Claims for compensatory or other damages may be brought against us because of a breach of our systems or fraudulent activity. If we are unsuccessful in defending against such resulting claims, we may be forced to pay damages, which could materially and adversely affect our financial condition and results of operations.

Information security risks have generally increased in recent years in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, increase in

remote working, and the increased sophistication and activities of organized crime, hackers, nation state supported organizations, terrorists, and other external parties. The methods used to obtain unauthorized access, disable or degrade service or sabotage systems change frequently and often are not recognized until launched against a target. We may be unable to anticipate these techniques or to implement adequate preventative measures. Further, computer viruses or malware could infiltrate our systems and disrupt our delivery of services making our applications unavailable. Although we utilize several preventative and detective security controls in our network, they may be ineffective in preventing computer viruses or malware that could damage our relationships with our merchant customers, cause a decrease in transactions by individual cardholders, or cause us to be in non-compliance with applicable network rules and regulations. In addition, a significant incident of fraud or an increase in fraud levels generally involving our products could result in reputational damage to us, which could reduce the use of our products and services. Such incidents of fraud could also lead to regulatory intervention, which could increase our compliance costs. Compliance with the various complex laws and regulations is costly and time consuming, and failure to comply could have a material adverse effect on our business. Additionally, increased regulatory requirements on our services may increase our costs, which could materially and adversely affect our business, financial condition and results of operations. Accordingly, account data breaches and related fraudulent activity could have a material adverse effect on our future growth prospects, business, financial condition and results of operations.

Our operations rely on the secure processing, transmission and storage of confidential information in our computer systems and networks. Although we believe we have robust information security procedures and controls, our technologies,encryption software, systems, vendors, networks, and our customers’ devices themselves may become the target of cyber-attacks or information security breaches thatbreaches. Such events could result in the unauthorized release, gathering, monitoring, misuse, unavailability, loss, or destruction of our or our customers’ confidential, proprietary and other information, or otherwise disrupt our or our customers’ business operations. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities.

We are under continuous threat of loss due to organized cyber-attacks especiallyinvolving unauthorized access, computer hackers, computer viruses, malicious code, and other security problems and system disruptions as we continue to expand client capabilities to utilize internet and other remote channels to transact business. We have invested and intend to continue to devote significant resources to the security of our computer systems, but they may still be vulnerable to these threats. A user who circumvents security measures can misappropriate confidential or proprietary information, including information regarding us, our personnel and/or our clients, or cause interruptions or malfunctions in operations. The occurrence of any cyber-attack or information security breach could result in significant potential liabilities to customers and other third parties, reputational damage, the disruption of our operations and regulatory concerns, all of which could materially and adversely affect our business, financial condition or results of operations. The harm to our business could be even greater if such an event occurs during a period of disproportionately heavy demand for our products or services or traffic on our systems or networks.

The financial services industry is undergoing rapid technological changes with frequent introductions of new technology-driven products and services. In addition to better serving customers, the effective use of technology increases efficiency and enables financial institutions to reduce costs. Our future success will depend, in part, upon our ability to address the technological needs of our customers by using technology to provide products and services that will satisfy client demands for convenience as well asin addition to provideproviding secure electronic environments asenvironments. As we continue to grow and expand our market area.area, part of our growth strategy is to focus on expanding market share and product offerings through partnerships with financial technology companies that will supplement our existing offerings, such as: remote account opening, remote deposit capture, mobile and digital banking, and other innovative technologies such as blockchain-based products. These technological advances are intended to allow us to acquire new customers and generate additional core deposits at a lower cost. Many of our larger competitors have substantially greater resources to invest, and have invested significantly more than us, in technological improvements. As a result, they may be able to offer additional or more convenient products compared to those that we will be able to provide, which would put us at a competitive disadvantage. Accordingly, we may not be able to effectively implement new technology-driven products and services or be successful in marketing such products and services to our customers, which could impair our growth and profitability.

Employee errors and employee and client misconduct could subject us to financial losses or regulatory sanctions and seriously harm our reputation. Misconduct by our employees could include hiding unauthorized activities from us, improper or unauthorized activities on behalf of our customers or improper use of confidential information. It is not always possible to prevent employee errors and misconduct, and the precautions we take to prevent and detect this activity may not be effective in all cases. Employee errors could also subject us to financial claims for negligence. We maintain a system of internal controls and insurance coverage to mitigate against these operational risks. If our internal controls fail to prevent or detect an occurrence, or if any resulting loss is not insured or exceeds applicable insurance limits, it could have a material adverse effect on our business, financial condition, or results of operations.

In addition, weWe rely heavily upon information supplied by third parties, including the information contained in credit applications, property appraisals, title information, equipment pricing and valuation and employment and income documentation, in deciding which loans we will originate, as well as the terms of those loans. If any of the information upon which we relysuch data is misrepresented, either fraudulently or inadvertently, and the misrepresentation is not detected prior to asset funding, the value of the asset may be significantly lower than expected, or we may fund a loan that we would not have funded or on terms we would not have extended.

A significant portion of our business is located in the Southeast and includes areas which are susceptible to weather-related events such as tornadoes, floods, droughts, and fires.fires, the severity and frequency of which can be impacted by climate change. Such events can disrupt our operations, cause damage to our properties, and negatively affect the local economies in which we operate. Climate change and weather-related events may also have a negative impact on the financial condition of our clients, which may decrease revenues from those clients and increase the credit risk associated with loans and other credit exposures to those clients. The severity and impact of future natural disasters such as earthquakes, fires, hurricanes, tornadoes, droughts, floods, and other weather-related events are difficult to predict. While we maintain insurance covering many of these weather-related events, there is no insurance against the disruption that such a catastrophic event could cause in the markets that we serve and the resulting adverse impact on our borrowers’ ability to timely repay their loans, and/or the value of any collateral held by us.

In addition, geopolitical matters includingincluding: international trade disputes, political unrest, the emergence of widespread health emergencies or pandemics, cyber attackscyber-attacks or campaigns, and slow growth in the global economy, as well as acts of terrorism, war, and other violence could result in disruptions in the financial markets or the markets that we serve. These negative events could have a material adverse effect on our results of operations or financial condition and may affect our ability to access capital.

We intend to continue pursuing a strategy that includes acquisitions, which involves significant operational, strategic, and regulatory risks. Acquisitions may disrupt our business and dilute stockholder value, and integrating acquired companies may be more difficult, costly, or time-consuming than we expect.

The market for acquisition targets is highly competitive, which may adversely affect our ability to find acquisition candidates that fit our strategy and standards. Our ability to compete in acquiring target institutions will depend on our available financial resources to fund the acquisitions, including the amount of cash and cash equivalents we have and the

liquidity and market price of our common stock. In addition, increased competition may also drive up the acquisition consideration that we will be required to pay in order to successfully capitalize on attractive acquisition opportunities. To the extent that we are unable to find suitable acquisition targets, an important component of our growth strategy may not be realized.

Acquisitions of financial institutions also involve operational risks and uncertainties, such as the time and expense associated with identifying and evaluating potential acquisition targets and negotiation terms of potential transactions, which could result in our attention being diverted from the operation of our existing business, unknown or contingent liabilities with no available manner of recourse, using inaccurate estimates and judgments to evaluate credit, operations, management and market risks with respect to the target institution or assets, exposure to unexpected problems such as asset quality, the retention of key employees and customers, and other issues that could negatively affect our business. We may not be able to complete future acquisitions or, if completed, we may not be able to successfully integrate the operations, technology platforms, management, products and services of the entities that we acquire or to realize our attempts to eliminate redundancies. The integration process may also require significant time and attention from our management that would otherwise be directed toward servicing existing business and developing new business. Failure to successfully integrate the entities we acquire into our existing operations in a timely manner may increase our operating costs significantly and adversely affect our business, financial condition and results of operations. Further, acquisitions typically involve the payment of a premium over book and market values and, therefore, some dilution of our tangible book value and net income per common share may occur in connection with any future acquisition, resulting in a dilution of the value of your investment, and the carrying amount of any goodwill that we currently maintain or may acquire may be subject to impairment in future periods.

If we continue to grow, we will face risks arising from our increased size. If we do not manage such growth effectively, we may be unable to realize the benefit from the investments in technology, infrastructure and personnel that we have made to support our expansion. In addition, we may incur higher costs and realize less revenue growth than we expect, which would reduce our earnings and diminish our future prospects, and we may not be able to continue to implement our business strategy and successfully conduct our operations. Risks associated with failing to maintain effective financial and operational controls as we grow, such as maintaining appropriate loan underwriting procedures, information technology systems, determining adequate allowances for loan losses and complying with regulatory accounting requirements, including increased loan losses, reduced earnings and potential regulatory penalties and restrictions on growth, all could have a negative effect on our business, financial condition and results of operations.

From time to time, we evaluate and engage in the acquisition of other banking organizations. We must satisfy a number of meaningful conditions before we can complete an acquisition of another bank or bank holding company, including federal and state bank regulatory approvals. The process for obtaining required regulatory approvals can be time-consuming and unpredictable and is subject to numerous regulatory and policy factors, a number of which are beyond our control. We may fail to pursue or to complete strategic and competitively significant acquisition opportunities as a result of the perceived difficulty or impossibility of obtaining required regulatory approvals in a timely manner or at all.

At December 31, 2020,2022, our goodwill and other identifiable intangible assets were $265.0$254.9 million. Under current accounting standards, if we determine goodwill or intangible assets are impaired because, for example, the acquired business does not meet projected revenue targets or certain key employees leave, we are required to write down the carrying value of these assets. We conduct a review at least annually to determine whether goodwill is impaired. Our goodwill impairment evaluation indicated no impairment of goodwill for our reporting segments. We cannot provide assurance, however, that we will not be required to take an impairment charge in the future. Any impairment charge would have an adverse effect on our shareholders' equity and financial results and could cause a decline in our stock price.

We conduct our banking operations primarily in Tennessee, with our largest market being the Nashville MSA, which is a highly competitive banking market. Many of our competitors offer the same, or a wider variety of, banking services within our market areas, and we compete with them for the same customers. These competitors include banks with nationwide operations, regional banks and community banks. In many instances these national and regional banks have greater resources than we do, and the smaller community banks may have stronger ties in local markets than we do, which may put us at a competitive disadvantage. We also face competition from many other types of financial institutions, including thrift institutions, finance companies, brokerage firms, insurance companies, credit unions, mortgage banks and other internet-based companies offering financial services which enjoy fewer regulatory constraints and some may have lower

Our principal executive offices and FirstBank’s main office are located at 211 Commerce Street, Suite 300, Nashville, Tennessee 37201. As of December 31, 2020, we operated 81 full-service bank branches and nine limited service branch locations throughout our geographic market areas as well as 23 mortgage offices throughout the southeastern United States. We have banking locations in the Tennessee metropolitan markets of Nashville, Chattanooga, Knoxville, Memphis, and Jackson in addition to the metropolitan markets of Birmingham, Huntsville and Florence, Alabama and Bowling Green, Kentucky. As of December 31, 2022, we operated 82 full-service bank branches and nine limited service branch locations throughout our geographic market areas as well as 20 mortgage offices throughout the southeastern United States. We also operate in 16 community markets throughout our footprint. See “ITEM 1. Business – Our Markets” for more detail. We own 5270 of these banking locations and lease our other banking locations, which include nearly all of our mortgage offices and our principal executive office. We believe that our offices and banking locations are in good condition, are suitable to our needs and, for the most part, are relatively new or refurbished. Additionally, we continue to upgrade our properties to make them more energy efficient and protect the environment.

Various legal proceedings to which FB Financial Corporation or a subsidiary of FB Financial Corporation is party arise from time to time in the normal course of business. As of the date hereof, there are no material pending legal proceedings to which FB Financial Corporation or any of its subsidiaries is a party or of which any of its or its subsidiaries' assets or properties are subject.

Not applicable.

The Company had approximately 1,9622,193 stockholders of record as of March 5, 2021.February 14, 2023. A substantially greater number of holders of FBK common stock are "street name" or beneficial holders, whose shares of record are held by banks, brokers, and other financial institutions.

During the second quarter of 2018, our board of directorsWe declared a dividend to shareholders of record for the first time as a public company and has done so for each subsequent quarter since. Our dividend declarations have also been applicable to outstanding restricted stock units, for which related cash distributions are made on the vesting dates of the underlying units.

The Company did not sell any unregistered equity securities during 2020.

The following is a discussion of our financial condition at December 31, 2022 and 2021, and our results of operations for the years ended December 31, 2022 and 2021, and should be read in conjunction with our audited consolidated financial statements and notes thereto included elsewhere herein. The purpose of this discussion is to focus on information about our financial condition and results of operations which is not otherwise apparent from our consolidated financial statements. This discussion and analysis contains forward-looking statements that are subject to certain risks and uncertainties and are based on certain assumptions that we believe are reasonable but may prove to be inaccurate. Certain risks, uncertainties and other factors, including those set forth in the "Cautionary note regarding forward-looking statements" and Risk Factors" sections of this Annual Report, may cause actual results to differ materially from those projected results discussed in the forward-looking statements appearing in this discussion and analysis. We assume no obligation to update any of these forward-looking statements. Discussion and analysis of our financial condition and results of operations for the years ended December 31, 2021 and 2020 are included in the respective sections within "Part II. Item 7 - Management's Discussion and Analysis of Financial Condition and Results of operations" of our Annual Report filed on Form 10-K with the SEC for the year ended December 31, 2021.

The following table presents certain selected historical consolidated income statement data and key indicators as of the dates or for the years indicated. Our historical results for any prior period are not necessarily indicative of results to be expected in any future period.