UNITED STATES SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended December 31, 2023

or

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from  _______  to _______

Commission file number 001-39028

CROSSFIRST BANKSHARES, INC.

(Exact Name of Registrant as Specified in its Charter)

Kansas		26-3212879
(State or other jurisdiction of incorporation or organization)		(I.R.S. Employer Identification No.)
11440 Tomahawk Creek Parkway
Leawood	KS	66211
(Address of principal executive offices)		(Zip Code)

(913) 901-4516

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

Title of each class	Trading Symbol	Name of each exchange on which registered
Common Stock, par value $0.01 per share	CFB	The Nasdaq Stock Market LLC

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.  Yes  ☐  No  ☒

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.  Yes  ☐  No  ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.  Yes  ☒  No  ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (Section 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files).  Yes  ☒  No  ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and ‘‘emerging growth company’’ in Rule 12b-2 of the Exchange Act.

Large accelerated filer	☐	Accelerated filer	☒
Non-accelerated filer	☐	Smaller reporting company	☐
		Emerging growth company	☒

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act.  ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report.  ☐

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements.  ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b).  ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act).  Yes ☐  No ☒

The aggregate market value of common stock held by nonaffiliates was $443,326,730 at June 30, 2023.

There were 49,345,279 shares of common stock, par value $0.01, outstanding at February 23, 2024.

DOCUMENTS INCORPORATED BY REFERENCE: Part III of this Annual Report on Form 10-K incorporates by reference certain information from the registrant’s definitive proxy statement with respect to its 2024 annual meeting of stockholders, which will be filed with the Securities and Exchange Commission within 120 days after the end of the fiscal year to which this Annual Report on Form 10-K relates.

CAUTIONARY NOTE ABOUT FORWARD-LOOKING STATEMENTS

Statements made in this report, the annual report to shareholders of which this report is made a part, other reports and proxy statements filed with the SEC, communications to shareholders, press releases and oral statements made by representatives of the Company that are not historical in nature, or that state the Company’s or management’s intentions, hopes, beliefs, expectations, plans, goals or predictions of future events or performance, may constitute “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. These statements are often, but not always, made through the use of words or phrases such as “may,” “might,” “should,” “could,” “predict,” “positioned,” “growth,” “future,” “opportunity,” “potential,” “believe,” “expect,” “continue,” “will,” “anticipate,” “seek,” “estimate,” “intend,” “plan,” “strive,” “projection,” “goal,” “target,” “aim,” “would,” “annualized” and “outlook,” or the negative version of those words or other comparable words or phrases of a future or forward-looking nature. These forward-looking statements are not historical facts, and are based on current expectations, estimates and projections about our industry, management’s beliefs and certain assumptions made by management, many of which, by their nature, are inherently uncertain and beyond our control. Accordingly, we caution that any such forward-looking statements are not guarantees of future performance and are subject to risks, assumptions, estimates, and uncertainties that are difficult to predict and often outside of our control. Although we believe that the expectations reflected in these forward-looking statements are reasonable as of the date made, actual results may prove to be materially different from the results expressed or implied by the forward-looking statements.

There are or will be important factors that could cause our actual results to differ materially from those indicated in these forward-looking statements, including, but not limited to, the following:

● uncertain or unfavorable business or economic conditions, including possible slowing or recessionary economic conditions and continuing or increasing inflation, nationally, regionally and particularly in our markets - Kansas, Missouri, Oklahoma, Texas, Arizona, Colorado and New Mexico;

● changes in market interest rates that affect the pricing of our products and our net interest income;

● our ability to effectively execute our growth strategy and manage growth, including identifying, consummating and integrating suitable mergers or acquisitions, entering new lines of business or offering new or enhanced services or products;

● fluctuations in the fair value of our investment securities;

● credit risk from concentrations of loans secured by real estate and energy and declines in the value of real estate and other collateral securing such loans;

● risks associated with our commercial loan portfolio, including the risk of deterioration in value of the general business assets that secure such loans;

● borrower and depositor concentration risks;

● risks associated with originating Small Business Administration loans;

● our ability to successfully manage our credit risk and the sufficiency of our allowance for credit losses;

● our dependence on our management team, including our ability to attract, hire and retain key employees and their client and community relationships;

● our ability to raise and maintain sufficient liquidity, including by maintaining and increasing client deposits and funding availability;

● our ability to maintain and comply with any increased capital requirements imposed by banking regulators, which may require us to raise capital at a time when capital is not available on favorable terms or at all;

2

● competition from banks, credit unions, financial technology (Fintech) companies, and other financial services providers;

● ineffective risk management processes and strategies, and our ability to maintain effective internal control over financial reporting;

● accounting estimates;

● our ability to keep pace with technological changes;

● system failures, service denials, cyber incidents or other security breaches;

● employee error, employee or client misconduct, fraud committed against us or our clients, or inaccurate or incomplete information about our clients and counterparties;

● disruptions to our business caused by our third-party service providers;

● our ability to maintain our reputation;

● environmental liabilities or failure to comply with regulatory requirements impacting foreclosed properties;

● costs and effects of litigation, investigations or similar matters to which we may be subject;

● severe weather, natural disasters, pandemics or other health crises, acts of war or terrorism, climate change and responses thereto, or other external events;

● compliance with governmental and regulatory requirements, including the Dodd-Frank and Wall Street Consumer Protection Act (“Dodd-Frank Act”) and other regulations relating to banking, consumer protection, data privacy, securities and tax matters;

● changes in the laws, rules, regulations, interpretations or policies relating to financial institutions, accounting, tax, trade, monetary and fiscal matters, including the policies of the Federal Reserve and as a result of government initiatives;

● changes in the scope and cost of FDIC insurance and other coverage;

● changes in our dividend or share repurchase policies and practices;

● systemic risks across the banking industry associated with the soundness of other financial institutions; and

● volatility in our stock price and other risks associated with our common stock.

The foregoing factors should not be construed as exhaustive and should be read together with the other cautionary statements included in this report under "Part I, Item 1A. Risk Factors" which may also cause our actual future results, performance or achievements, or industry results, to be materially different from the results indicated by the forward-looking statements. Any forward-looking statement speaks only as of the date on which it is made. We undertake no obligation to update or review any forward-looking statement, whether as a result of new information, future developments or otherwise, except as required by law.

3

CrossFirst Bankshares, Inc.

2023 Form 10-K Annual Report

Table of Contents

Part	Item Number	Section	Page Number
I
	1	Business	5
	1A	Risk Factors	17
	1B	Unresolved Staff Comments	32
	1C	Cybersecurity	32
	2	Properties	33
	3	Legal Proceedings	33
	4	Mine Safety Disclosures	33
		Information About Our Executive Officers	33
II
	5	Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities	35
	6	[Reserved]	36
	7	Management’s Discussion and Analysis of Financial Condition and Results of Operations	37
	7A	Quantitative and Qualitative Disclosures about Market Risk	63
	8	Financial Statements and Supplementary Data	63
		Report of FORVIS, LLP Independent Registered Public Accounting Firm	64
		Consolidated Financial Statements and Related Notes
		Consolidated Statements of Financial Condition	66
		Consolidated Statements of Operations	67
		Consolidated Statements of Comprehensive Income (Loss)	68
		Consolidated Statements of Stockholders’ Equity	69
		Consolidated Statements of Cash Flows	70
		Notes to Consolidated Financial Statements	71
	9	Changes in and Disagreements with Accountants on Accounting and Financial Disclosure	117
	9A	Control and Procedures	117
	9B	Other Information	118
	9C	Disclosure Regarding Foreign Jurisdictions that Prevent Inspections	118
III
	10	Directors, Executive Officers and Corporate Governance	119
	11	Executive Compensation	119
	12	Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters	119
	13	Certain Relationships and Related Party Transactions and Director Independence	120
	14	Principal Accountant Fees and Services	120
IV
	15	Exhibits and Financial Statement Schedules	121
		(a) (1) Financial Statements - See listing in Item 8 above
		(a) (2) Financial Statement Schedules - None required
		(a) (3) Exhibits
	16	Form 10-K Summary	123
		Signatures	124

4

Part I

ITEM 1.BUSINESS

Our Company

CrossFirst Bankshares, Inc., a Kansas corporation and registered bank holding company (the “Company”), is the holding company for CrossFirst Bank (the “Bank”). The Company was initially formed as a limited liability company, CrossFirst Holdings, LLC, on September 1, 2008, to become the holding company for the Bank and converted to a corporation in 2017. The Bank was established as a Kansas state-chartered bank in 2007 and provides a full suite of financial services to businesses, business owners, professionals, and their personal networks through our branch offices located in Kansas, Missouri, Oklahoma, Texas, Arizona, Colorado and New Mexico.

Unless we state otherwise or the context otherwise requires, references in the below section to “we,” “our,” “us,” “ourselves,” “our company,” and the “Company” refer to CrossFirst Bankshares, Inc., a Kansas corporation, its predecessors and its consolidated subsidiaries. References to “CrossFirst Bank” and the “Bank” refer to CrossFirst Bank, a Kansas chartered bank and our wholly owned consolidated subsidiary.

Since opening our first branch in 2007, we have grown organically primarily by establishing new branches, attracting new clients and expanding our relationships with existing clients, as well as through four strategic acquisitions. Since inception, our strategy has been to be a trusted partner providing customized financial solutions for our clients, which we believe has driven value for our stockholders. We are committed to a culture of serving our clients and communities in extraordinary ways by providing personalized, relationship-based banking. We believe that success is achieved through establishing and growing the trust of our clients, employees, stockholders, and communities. We remain focused on growth and are equally focused on building stockholder value through greater efficiency and increased profitability. We intend to execute our strategic plan through the following:

● Continue organic growth;

● Selectively pursue opportunities to expand through acquisitions, new markets or new verticals;

● Improve financial performance;

● Attract, retain and develop talent;

● Maintain a branch-light business model with strategically placed locations; and

● Leverage technology to enhance the client experience and improve profitability.

Our Acquisitions and Expansion

During the first quarter of 2023, we completed the integration in connection with the acquisition of Farmers & Stockmens Bank (the “Colorado/New Mexico acquisition”), which closed on November 22, 2022.

On August 1, 2023, the Company completed its acquisition of Canyon Bancorporation, Inc. and Canyon Community Bank, N.A. (collectively, “Canyon”), whereby Canyon Bancorporation, Inc. was merged with and into CrossFirst Bankshares, Inc. and Canyon Community Bank, N.A. was merged with and into CrossFirst Bank (collectively, the “Tucson acquisition”). The stock and cash transaction deepened our Arizona franchise through the addition of a branch in Tucson, Arizona, as well as adding liquidity and talent. The integration in connection with the acquisition was completed during the fourth quarter of 2023.

During 2023, we also continued our organic expansion into high growth metro markets by adding a second branch location in Dallas and a new location in Fort Worth. We also expanded industry verticals during 2023 including Small Business Administration (“SBA”) and Restaurant Finance, which were both added during 2022.

5

Products and Services

The Bank operates as a regional bank providing a broad offering of deposit and lending products to commercial and consumer clients. The Bank’s branches are strategically located in Kansas, Missouri, Oklahoma, Texas, Arizona, Colorado and New Mexico. We also operate in several industry verticals including Energy, Financial Institutions, Restaurant Finance, SBA and Sponsor Finance. Our approach to banking starts with our extraordinary service commitment. We strive to be a trusted partner to our clients by providing customized financial solutions to meet our clients’ needs. In addition to our branch locations, we also offer Private Banking solutions and Commercial Banking solutions. Private Banking services offer clients an enhanced level of service through the support of a dedicated Private Banker. Our Commercial Banking teams are run by experienced business leaders who understand the unique challenges and opportunities that come from running and growing a business. Our commercial banking solutions across lending, deposit and treasury management are designed to meet the needs of our client regardless of size or industry. We serve consumer clients though our branch network as well as our digital banking products.

We focus on the following loan categories: (i) commercial and industrial loans, including enterprise value lending; (ii) commercial real estate loans; (iii) construction and development loans, including home builder lending; (iv) residential real estate loans; (v) multifamily real estate loans; (vi) energy loans; (vii) SBA loans; (viii) credit cards; and (ix) consumer loans.

We also offer deposit banking products including: (i) personal and business checking and savings accounts; (ii) international banking services; (iii) treasury management services; (iv) money market accounts; (v) certificates of deposits; (vi) negotiable order of withdrawal accounts; (vii) automated teller machine access; and (viii) mobile banking.

Competition

The banking and financial services industry is highly competitive, and we compete with a wide range of financial institutions within our markets, including local, regional and national commercial banks and credit unions. We also compete with mortgage companies, trust companies, brokerage firms, consumer finance companies, securities firms, insurance companies, third-party payment processors, financial technology (“Fintech”) companies, and other financial intermediaries. Some of our competitors are not subject to the regulatory restrictions and level of regulatory supervision applicable to us.

Human Capital Resources

Employee Profile

As of December 31, 2023, the Company had 453 full-time equivalent employees primarily in locations across the states of Kansas, Missouri, Oklahoma, Texas, Arizona, Colorado and New Mexico; however, technology has allowed us to expand our reach to include a larger demographic with more remote employees working outside of our physical locations and throughout the country. None of our employees are parties to a collective bargaining agreement, and we consider our relationship with our employees to be good. During fiscal year 2023 we hired 114 employees (including 20 employees as part of the acquisition of Canyon). Our regretted turnover rate was 12.9% in fiscal year 2023, which we believe was due primarily to a competitive labor market and a shortage of talent.

We believe a diverse workforce is critical to long-term success and seek to build and maintain a diverse and inclusive environment. As of December 31, 2023, approximately 59% of our current workforce self-identifies as female and 41% as male. As of December 31, 2023, 57% of our executive leadership team self-identifies as female.

Culture

We strive to attract, retain, and develop top talent with diverse knowledge, perspectives, and experience to achieve our strategic objectives. Our Chief Human Resources Officer, reporting directly to our Chief Executive Officer, oversees our human capital management strategies. In addition, our Board of Directors is actively involved in our human capital management in its oversight of our long-term strategy and through its committees and engagement with management.

The foundation of our culture is based on Gallup’s CliftonStrengths, where our employees utilize their strengths to set the course and are empowered to deliver extraordinary services for our clients. We strive to maintain our high-performance

6

culture and be an employer of choice by creating an inclusive environment that attracts and retains high-quality, engaged employees who embody our core values of character, competence, commitment and connection. We are focused on sourcing and hiring talent that will be a cultural fit to our core values and have backgrounds that are as diverse as the clients we serve.

During 2023, the Company was awarded the Don Clifton Strengths-Based Culture Award from Gallup. We were one of just seven companies to receive this prestigious recognition. This award recognizes companies that drive performance by helping employees focus on what they do best, maximizing potential within teams, and integrating strengths-based development into their mission, vision, and values.

Pay Equity

We believe our employees should be compensated on their experience and performance for the roles they fulfill, and our goal is to attract, retain and develop top-quality talent. To deliver on that commitment, we set pay ranges based on market data and consider factors such as an employee’s role and experience, the location of their job, and their performance. We also regularly review our compensation practices, both in terms of our overall workforce and individual employees, to ensure our pay is fair, equitable and competitive.

Diversity, Equity and Inclusion

We believe that an equitable and inclusive environment with diverse teams supports our core values and strategic initiatives. We are focused on maintaining and enhancing our inclusive culture through our CrossFirst Cares program, which represents our initiatives and efforts to support the diverse thoughts, ideas and perspectives of our employees and their wellbeing. Our IDEA Champions employee resource group is focused on promoting diversity, equity and inclusion, while supporting CrossFirst’s core values and strengths-based culture. These groups enhance an inclusive culture through company events, participation in our recruitment efforts, training opportunities, and input into our development strategies.

Compensation and Benefits Program

As part of our compensation philosophy, we offer and maintain competitive total rewards programs to attract and retain superior talent throughout our market footprint. In addition to competitive base pay, we also offer annual incentive opportunities, long-term incentive opportunities, a Company-augmented employee stock purchase plan, Company-matched 401(k) Plan, healthcare and insurance benefits, health savings and flexible spending accounts, paid time off, parental leave, a Volunteer Time Off (“VTO”) program, flexible work schedules, and employee assistance programs.

Community Involvement

We build strong relationships within the communities we serve, and we strive to support the passions of our employees. We encourage our employees to volunteer their time and talent by serving on boards and supporting the communities where they live and work.

We understand that helping our employees devote their energies to causes that matter to them, to their communities and to those individuals who are most in need makes a broader impact. Our CrossFirst VTO program provides paid leave for these volunteer activities.

Our spirit of employee giving is also championed through our Generous Giving Program. Through this program, we offer every employee the opportunity to provide financial support for others by matching up to $500 per employee gift, per year. Our Generous Giving Program is designed to give our employees additional resources to make a difference in people’s lives. Since its inception in 2017, our Generous Giving Program donations total over $500 thousand.

We focus on giving back to the communities we serve and providing opportunities to our employees to share in that effort. At the same time, we recognize that participating in these activities enriches all our lives.

Workplace Health, Safety and Wellness

The success of our business is fundamentally connected to the well-being of our people. Accordingly, we are committed to the health, safety and wellness of our employees. We provide our employees and their families with access to a

7

variety of flexible and convenient health and welfare programs. This includes offering benefits to support their physical and mental well-being; providing tools and resources to help improve or maintain their health status; and offering choices where possible for employees to customize their benefits to meet their needs and the needs of their families. The COVID-19 pandemic led us to evaluate our operating environment to ensure our employees were able to continue working safely. As a result, we implemented significant changes including providing flexible work from home options for a large percentage of our employees, while implementing additional safety measures for employees continuing critical on-site work. We have continued to offer these for the benefit of our employees, clients and communities.

Annually, we conduct an all-employee engagement and satisfaction survey. We consistently have over 90% participation in our engagement survey, scoring in the top third of companies compared to other Gallup organizations, with over 64% of our employees classified by Gallup as engaged during our 2023 survey.

The Company maintains a WELL Health-Safety Rating through the International WELL Building Institute. This rating is an evidence-based, third-party verified rating for all new and existing buildings focused on operational policies, maintenance protocols, stakeholder engagement, and emergency plans to address a post COVID-19 pandemic environment.

Talent Development

We prioritize and invest in creating opportunities to help our employees grow and build their careers through a variety of training and development programs. These include online, classroom and on-the-job learning formats paired with an individualized development approach.

A core tenet of our talent system is to both develop talent from within and supplement with external candidates. This approach drives increased loyalty and commitment in our employee base, which benefits our business and our clients. The addition of new employees and external ideas supports our culture of continuous improvement and a diverse and inclusive workforce.

Our performance management framework includes periodic business and functional reviews, along with one-on-one and quarterly forward-looking goal setting and development discussions for employees, followed by annual opportunities for pay differentiation based on overall performance distinction.

Supervision and Regulation

The following is a general summary of the material aspects of certain statutes and regulations that are applicable to us. These summary descriptions are not complete. Please refer to the full text of the statutes, regulations, and corresponding guidance for more information. These statutes and regulations are subject to change, and additional statutes, regulations, and corresponding guidance may be adopted. We are unable to predict future changes or the effects, if any, that these changes could have on our business or our revenues.

General

We are extensively regulated under U.S. federal and state law. As a result, our growth and earnings performance may be affected not only by management decisions and general economic conditions, but also by federal and state statutes and by the regulations and policies of various bank regulatory agencies, including the Office of the State Bank Commissioner of Kansas, the Federal Reserve, the Federal Deposit Insurance Corporation (“FDIC”) and the Consumer Financial Protection Bureau (“CFPB”). Furthermore, tax laws administered by the Internal Revenue Service (“IRS”) and state and local taxing authorities, accounting rules developed by the Financial Accounting Standards Board (“FASB”), securities laws administered by the Securities and Exchange Commission (“SEC”) and state securities authorities and Anti-Money Laundering (“AML”) laws enforced by the U.S. Department of the Treasury also impact our business. The effect of these statutes, regulations, regulatory policies and rules are significant to our financial condition and results of operations. Further, the nature and extent of future legislative, regulatory or other changes affecting financial institutions are impossible to predict with any certainty.

Federal and state banking laws impose a comprehensive system of supervision, regulation, and enforcement on the operations of banks, their holding companies and their affiliates. These laws are intended primarily for the protection of depositors, clients and the Deposit Insurance Fund of the FDIC (“DIF”) rather than for stockholders.

8

This supervisory and regulatory framework subjects banks and bank holding companies to regular examination by their respective regulatory agencies, which results in examination reports and ratings that, while not publicly available, can affect the conduct and growth of their businesses.

Regulatory Capital Requirements

The federal banking agencies require that banking organizations meet several risk-based capital adequacy requirements known as the “Basel III Capital Rules.” The Basel III Capital Rules implement the Basel Committee’s December 2010 framework for strengthening international capital standards and certain provisions of the Dodd-Frank Act.

The Basel III Capital Rules require the Company and the Bank to comply with four minimum capital standards: (i) a tier 1 leverage ratio of at least 4.0%; (ii) a Common Equity Tier 1 (“CET1”) capital to risk-weighted assets of at least 4.5%; (iii) a tier 1 capital to risk-weighted assets of at least 6.0%; and (iv) a total capital to risk-weighted assets of at least 8.0%. CET1 capital is generally comprised of common stockholders’ equity and retained earnings subject to applicable regulatory adjustments. Tier 1 capital is generally comprised of CET1 capital and additional tier 1 capital. Additional tier 1 capital generally includes certain noncumulative perpetual preferred stock and related surplus and minority interests in equity accounts of consolidated subsidiaries. We are permitted to include qualifying trust preferred securities issued prior to May 19, 2010 as additional tier 1 capital. Total capital includes tier 1 capital (CET1 capital plus additional tier 1 capital) and tier 2 capital. Tier 2 capital is generally comprised of capital instruments and related surplus meeting specified requirements, and may include cumulative preferred stock and long-term perpetual preferred stock, mandatory convertible securities, intermediate preferred stock, and subordinated debt. Also included in tier 2 capital is the allowance for credit losses (“ACL”), formerly known as the allowance for loan and lease losses (“ALLL”), limited to a maximum of 1.25% of risk-weighted assets. The calculation of all types of regulatory capital is subject to deductions and adjustments specified in the regulations.

The Basel III Capital Rules also establish a “capital conservation buffer” of 2.5% above the regulatory minimum risk-based capital requirements. An institution is subject to limitations on certain activities, including payment of dividends, share repurchases and discretionary bonuses to executive officers, if its capital level is below the buffered ratio.

The Basel III minimum capital ratios as applicable to the Bank and to the Company are summarized in the table below:

			Basel III
	Basel III		Additional		Basel III Ratio
	Minimum For		Capital		With Capital
	Capital Adequacy		Conservation		Conservation
	Purposes		Buffer		Buffer
Total risk based capital (total capital to risk-weighted assets)	8.00	%	2.50	%	10.50	%
Tier 1 risk based capital (tier 1 to risk-weighted assets)	6.00		2.50		8.50
Common equity tier 1 risk based capital (CET1 to risk-weighted assets)	4.50		2.50		7.00
Tier 1 leverage ratio (tier 1 to average assets)	4.00	%	—	%	4.00	%

In determining the amount of risk-weighted assets for purposes of calculating risk-based capital ratios, a banking organization’s assets, including certain off-balance sheet assets, are multiplied by a risk weight factor assigned by the regulations based on perceived risks inherent in the type of asset. As a result, higher levels of capital are required for asset categories believed to present greater risk.

As of December 31, 2023, the Company’s and the Bank’s capital ratios exceeded the minimum capital adequacy guideline percentage requirements under the Basel III Capital Rules.

Prompt Corrective Action

The Federal Deposit Insurance Act requires federal banking agencies to take “prompt corrective action” with respect to depository institutions that do not meet minimum capital requirements. For purposes of prompt corrective action, the law establishes five capital tiers: “well-capitalized,” “adequately-capitalized,” “under-capitalized,” “significantly under-

9

capitalized,” and “critically under-capitalized.” A depository institution’s capital tier depends on its capital levels and certain other factors established by regulation. In order to be a “well-capitalized” depository institution, a bank must maintain a CET1 risk-based capital ratio of 6.5% or more, a tier 1 risk-based capital ratio of 8% or more, a total risk-based capital ratio of 10% or more and a leverage ratio of 5% or more (and is not subject to any order or written directive specifying any higher capital ratio). At each successively lower capital category, a bank is subject to increased restrictions on its operations.

As of December 31, 2023, the Bank met the requirements for being deemed “well-capitalized” for purposes of the prompt corrective action regulations and was not otherwise subject to any order or written directive specifying any higher capital ratios.

Enforcement Powers of Federal and State Banking Agencies

The federal banking regulatory agencies have broad enforcement powers, including the power to terminate deposit insurance, impose substantial fines and other civil and criminal penalties, and appoint a conservator or receiver for financial institutions. Failure to comply with applicable laws and regulations could subject us and our officers and directors to administrative sanctions and potentially substantial civil money penalties.

The Company

General

As a bank holding company, the Company is subject to regulation and supervision by the Federal Reserve under the Bank Holding Company Act of 1956, as amended (“BHCA”). Under the BHCA, the Company is subject to periodic examination by the Federal Reserve. The Company is required to file with the Federal Reserve periodic reports of its operations and such additional information as the Federal Reserve may require.

Acquisitions, Activities and Change in Control

The BHCA generally requires the prior approval by the Federal Reserve for any merger involving a bank holding company or a bank holding company’s acquisition of more than 5% of a class of voting securities of any additional bank or bank holding company or to acquire all or substantially all the assets of any additional bank or bank holding company.

Federal law also prohibits any person or company from acquiring “control” of an FDIC-insured depository institution or its holding company without prior notice to the appropriate federal bank regulator. “Control” is conclusively presumed to exist upon the acquisition of 25% or more of the outstanding voting securities of a bank or bank holding company, but may arise under certain circumstances between 5% and 24.99% ownership.

Permitted Activities

The BHCA generally prohibits the Company from controlling or engaging in any business other than that of banking, managing and controlling banks or furnishing services to banks and their subsidiaries. This general prohibition is subject to a number of exceptions. The principal exception allows bank holding companies to engage in, and to own shares of companies engaged in, certain businesses found by the Federal Reserve prior to November 11, 1999 to be “so closely related to banking as to be a proper incident thereto.”

Additionally, bank holding companies that meet certain eligibility requirements prescribed by the BHCA and elect to operate as financial holding companies may engage in, or own shares in companies engaged in, a wider range of nonbanking activities, including securities and insurance underwriting and sales, merchant banking and any other activity that the Federal Reserve, in consultation with the Secretary of the Treasury, determines by regulation or order is financial in nature or incidental to any such financial activity or that the Federal Reserve determines by order to be complementary to any such financial activity and does not pose a substantial risk to the safety or soundness of depository institutions or the financial system generally. The Company has not elected to be a financial holding company, and we have not engaged in any activities determined by the Federal Reserve to be financial in nature or incidental or complementary to activities that are financial in nature.

10

Source of Strength

Bank holding companies, such as the Company, are required by statute to serve as a source of financial strength for their subsidiary depository institutions, by providing financial assistance to their insured depository institution subsidiaries in the event of financial distress. Under the source of strength requirement, the Company could be required to provide financial assistance to the Bank should it experience financial distress. Furthermore, the Federal Reserve has the right to order a bank holding company to terminate any activity that the Federal Reserve believes is a serious risk to the financial safety, soundness or stability of any subsidiary bank. The regulators may require these and other actions in support of controlled banks even if such action is not in the best interests of the bank holding company or its stockholders.

Safe and Sound Banking Practices

Bank holding companies and their nonbanking subsidiaries are prohibited from engaging in activities that represent unsafe and unsound banking practices or that constitute a violation of law or regulations. Under certain conditions the Federal Reserve may conclude that certain actions of a bank holding company, such as a payment of a cash dividend, would constitute an unsafe and unsound banking practice. The Federal Reserve also has the authority to regulate the debt of bank holding companies, including the authority to impose interest rate ceilings and reserve requirements on such debt. Under certain circumstances the Federal Reserve may require a bank holding company to file written notice and obtain its approval prior to purchasing or redeeming its equity securities, unless certain conditions are met.

Dividend Payments, Stock Redemptions and Repurchases

The Company’s ability to pay dividends to its stockholders is affected by both general corporate law considerations and the regulations and policies of the Federal Reserve applicable to bank holding companies, including the Basel III Capital Rules. Generally, a Kansas corporation may declare and pay dividends upon the shares of its capital stock either out of its surplus, as defined in and computed in accordance with K.S.A. 17-6404 and 17-6604, and amendments thereto, or in case there is not any surplus, out of its net profits for the fiscal year in which the dividend is declared or the preceding fiscal year, or both. If the capital of the corporation, computed in accordance with K.S.A. 17-6404 and 17-6604, and amendments thereto, is diminished by depreciation in the value of its property, or by losses, or otherwise, to an amount less than the aggregate amount of the capital represented by the issued and outstanding stock of all classes having a preference upon the distribution of assets, then no dividends may be paid out of such net profits until the deficiency in the amount of capital represented by the issued and outstanding stock of all classes having a preference upon the distribution of assets shall have been repaired.

It is the Federal Reserve’s policy that bank holding companies should generally pay dividends on common stock only out of income available over the past year, and only if prospective earnings retention is consistent with the organization’s expected future needs and financial condition. It is also the Federal Reserve’s policy that bank holding companies should not maintain dividend levels that undermine their ability to be a source of strength to its banking subsidiaries. Additionally, the Federal Reserve has indicated that bank holding companies should carefully review their dividend policy and has discouraged payment ratios that are at maximum allowable levels unless both asset quality and capital are very strong.

Bank holding companies must consult with the Federal Reserve before redeeming any equity or other capital instrument included in tier 1 or tier 2 capital prior to stated maturity, if such redemption could have a material effect on the level or composition of the organization’s capital base. In addition, bank holding companies are unable to repurchase shares equal to 10% or more of their net worth if they would not be well-capitalized (as defined by the Federal Reserve) after giving effect to such repurchase. Bank holding companies experiencing financial weaknesses, or that are at significant risk of developing financial weaknesses, must consult with the Federal Reserve before redeeming or repurchasing common stock or other regulatory capital instruments.

Other Regulation

As a company whose stock is publicly traded, the Company is subject to various federal and state securities laws, including the Securities Act of 1933, as amended (the “Securities Act”), the Securities Exchange Act of 1934, as amended (the “Exchange Act”) and the Sarbanes-Oxley Act of 2002, and the Company files periodic reports with the Securities and

11

Exchange Commission. In addition, because the Company’s common stock is listed with The Nasdaq Stock Market LLC, the Company is subject to the listing rules of that exchange.

The Bank

General

The Bank is a Kansas state-chartered bank and is not a member bank of the Federal Reserve. As a Kansas state-chartered bank, the Bank is subject to the examination, supervision and regulation by the Office of the State Bank Commissioner of Kansas (“OSBCK”), the chartering authority for Kansas banks, and by the FDIC. The Bank is also subject to certain regulations of the CFPB.

The OSBCK supervises and regulates all areas of the Bank’s operations including, without limitation, the making of loans, the issuance of securities, the conduct of the Bank’s corporate affairs, the satisfaction of capital adequacy requirements, the payment of dividends, and the establishment or closing of banking offices. The FDIC is the Bank’s primary federal regulatory agency, and periodically examines the Bank’s operations and financial condition and compliance with federal law. In addition, the Bank’s deposit accounts are insured by the DIF to the maximum extent provided under federal law and FDIC regulations, and the FDIC has certain enforcement powers over the Bank.

Depositor Preference

In the event of the ‘‘liquidation or other resolution’’ of an insured depository institution, the claims of depositors of the institution, including the claims of the FDIC as subrogee of insured depositors, and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution. If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors including the parent bank holding company with respect to any extensions of credit they have made to that insured depository institution.

Brokered Deposit and Deposit Rate Restrictions

In December of 2020, the FDIC finalized revisions to its regulations relating to brokered deposits and interest rate restrictions that apply to less than well-capitalized insured depository institutions. The final rule became effective April 1, 2021 and full compliance with the revised brokered deposit regulation was extended to January 1, 2022.

Well-capitalized institutions are not subject to limitations on brokered deposits, while adequately-capitalized institutions are able to accept, renew or roll over brokered deposits, only with a waiver from the FDIC and subject to certain restrictions on the yield paid on such deposits. Institutions that are not well-capitalized are generally not permitted to accept, renew, or roll over brokered deposits and are subject to a deposit rate cap, pursuant to which the institutions would be prohibited from paying in excess of the higher of (1) 75 basis points above published national deposit rates or (2) for maturity deposits, 120 percent of the current yield on similar maturity U.S. Treasury obligations and, for non-maturity deposits, the federal funds rate plus 75 basis points, unless the FDIC determined that the institutions’ local market rate was above the national rate. As of December 31, 2023, the Bank was eligible to accept brokered deposits without a waiver from the FDIC and was not subject to the deposit rate cap.

Deposit Insurance

As an FDIC-insured institution, the Bank is required to pay deposit insurance premiums to the FDIC. The FDIC has adopted a risk-based assessment system whereby FDIC-insured depository institutions pay insurance premiums at rates based on their risk classification. An institution’s risk classification is assigned based on its capital levels and the level of supervisory concern the institution poses to the regulators. For deposit insurance assessment purposes, an insured depository institution is placed in one of four risk categories each quarter. An institution’s assessment is determined by multiplying its assessment rate by its assessment base. The total base assessment rates range from 2.5 basis points to 42 basis points. While in the past an insured depository institution’s assessment base was determined by its deposit base, amendments to the Federal Deposit Insurance Act revised the assessment base so that it is calculated using average consolidated total assets minus average tangible equity.

12

Additionally, the Dodd-Frank Act altered the minimum designated reserve ratio of the DIF, increasing the minimum from 1.15% to 1.35% of the estimated amount of total insured deposits, and eliminating the requirement that the FDIC pay dividends to depository institutions when the reserve ratio exceeds certain thresholds. The FDIC had until September 3, 2020 to meet the 1.35% reserve ratio target, but it announced in November 2018 that the DIF had reached 1.36%, exceeding the 1.35% reserve ratio target. At least semi-annually, the FDIC updates its loss and income projections for the DIF and, if needed, may increase or decrease the assessment rates, following notice and comment on proposed rule-making. However, as of June 30, 2020, the reserve ratio fell to 1.30%, below the statutory minimum of 1.35%. On September 15, 2020, the FDIC adopted a Restoration Plan to restore the reserve ratio to at least 1.35% within eight years. The FDIC projects that the reserve ratio will return to 1.35% without further action by the FDIC before the end of that eight-year period, but the FDIC will closely monitor deposit balance trends, potential losses, and other factors that affect the reserve ratio. In addition, the FDIC issued a final rule in November 2023 to implement a special assessment to recover the significant losses incurred by the FDIC in connection with the 2023 bank failures. As a result, the Bank’s FDIC deposit insurance premiums could increase.

Audit Reports

Since the Bank is an insured depository institution with total assets of $1 billion or more, financial statements are prepared in accordance with Generally Accepted Accounting Principles (“GAAP”), management’s certifications signed by the Company’s and the Bank’s chief executive officer and chief accounting or financial officer concerning management’s responsibility for the financial statements, and an attestation by the auditors regarding the Bank’s internal controls must be submitted to the FDIC and OSBCK. The Federal Deposit Insurance Corporation Improvement Act of 1991 requires that the Bank (or, as explained below, the Company) have an independent audit committee, consisting of outside directors who are independent of management of the Company and the Bank. The audit committee must include at least two members with experience in banking or related financial management, must have access to outside counsel and must not include representatives of large clients. Certain insured depository institutions with total assets of less than $5 billion, or $5 billion or more and a composite CAMELS (i.e., capital adequacy, assets, management capability, earnings, liquidity, sensitivity) rating of 1 or 2, may satisfy these audit committee requirements if its holding company has an audit committee that satisfies these requirements. The Company’s audit committee satisfies these requirements.

Examination Assessments

Pursuant to the Kansas Banking Code, the expense of every regular examination, together with the expense of administering the banking and savings and loan laws, including salaries, travel expenses, supplies and equipment, are paid by the banks and savings and loan associations of Kansas, which are generally allocated among them based on total asset size.

Capital Requirements

Banks are generally required to maintain minimum capital ratios. For a discussion of the capital requirements applicable to the Bank, see “Regulatory Capital Requirements” above.

Bank Reserves

The Federal Reserve requires all depository institutions to maintain reserves against some transaction accounts (primarily Negotiable Order of Withdrawal (“NOW”) and Super NOW checking accounts). The balances maintained to meet the reserve requirements imposed by the Federal Reserve may be used to satisfy liquidity requirements. An institution may borrow from the Federal Reserve “discount window” as a secondary source of funds if the institution meets the Federal Reserve’s credit standards. The Federal Reserve reduced the reserve requirement to 0% effective March 26, 2020.

Dividend Payments

A primary source of funds for the Company is dividends from the Bank. The Bank is not permitted to pay a dividend to the Company under certain circumstances, including if the Bank is under-capitalized under the prompt corrective action framework or if the Bank fails to maintain the required capital conservation buffer. The Kansas Banking Code also places restrictions on the declaration of dividends by the Bank to the Company. No dividend may be paid from the capital stock account of the Bank. The current dividends of the Bank may only be paid from undivided profits after deducting losses. Before declaring any cash dividend from undivided profits, the Bank’s board of directors must ensure that the surplus fund equals or exceeds the capital stock account. If the surplus fund is less than the capital stock account, the Bank’s board of

13

directors may transfer 25% of the net profits of the Bank, since the last preceding dividend from undivided profits, to the surplus fund, except no additional transfers are required once the surplus fund equals or exceeds the capital stock account. Any other dividend (whether in cash or other property) from the Bank to the Company requires the prior approval of the OSBCK.

The payment of dividends by any financial institution is affected by the requirement to maintain adequate capital pursuant to applicable capital adequacy guidelines and regulations, and a financial institution generally is prohibited from paying any dividends if, following payment thereof, the institution would be under-capitalized. As described above, the Bank exceeded its minimum capital requirements under applicable regulatory guidelines as of December 31, 2023.

Transactions with Affiliates

The Bank is subject to Sections 23A and 23B of the Federal Reserve Act (the “Affiliates Act”) and the Federal Reserve’s implementation of Regulation W. An affiliate of a bank under the Affiliates Act is any company or entity that controls, is controlled by or is under common control with the bank. Accordingly, transactions between the Company, the Bank and any nonbank subsidiaries will be subject to a number of restrictions. The amount of loans or extensions of credit which the Bank may make to nonbank affiliates, or to third parties secured by securities or obligations of the nonbank affiliates, are substantially limited by the Affiliates Act. Such acts further restrict the range of permissible transactions between a bank and an affiliated company. A bank and its subsidiaries may engage in certain transactions, including loans and purchases of assets, with an affiliated company only if the terms and conditions of the transaction, including credit standards, are substantially the same as, or at least as favorable to the bank as, those prevailing at the time for comparable transactions with non-affiliated companies or, in the absence of comparable transactions, on terms and conditions that would be offered to non-affiliated companies.

Loans to Directors, Executive Officers and Principal Stockholders

The authority of the Bank to extend credit to its directors, executive officers and principal stockholders, including their immediate family members and corporations and other entities they control, is subject to substantial restrictions and requirements under the Federal Reserve’s Regulation O, as well as the Sarbanes-Oxley Act.

Limits on Loans to One Borrower

As a Kansas state-chartered bank, the Bank is subject to limits on the amount of loans it can make to one borrower. With certain limited exceptions, loans and extensions of credit from Kansas state-chartered banks outstanding to any borrower (including certain related entities of the borrower) at any one time may not exceed 25% of the capital of the bank. Certain types of loans are exempt from the lending limits, including loans fully secured by segregated deposits held by the bank or bonds or notes of the United States. A Kansas state-chartered bank may lend an additional amount if the loan is fully secured by certain types of real estate. In addition to the single borrower limitation described above, loans to a borrower and its subsidiaries generally may not exceed 50% of the capital of the bank. The Bank’s legal lending limit to any one borrower was $199 million as of December 31, 2023.

Safety and Soundness Standards/Risk Management

The federal banking agencies have adopted guidelines establishing operational and managerial standards to promote the safety and soundness of federally insured depository institutions. The guidelines set forth standards for internal controls, information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, compensation, fees and benefits, asset quality and earnings. In general, the safety and soundness guidelines prescribe the goals to be achieved in each area, and each institution is responsible for establishing its own procedures to achieve those goals. If an institution fails to comply with any of the standards set forth in the guidelines, the financial institution’s primary federal regulator may require the institution to submit a plan for achieving and maintaining compliance. If a financial institution fails to submit an acceptable compliance plan or fails in any material respect to implement a compliance plan that has been accepted by its primary federal regulator, the regulator is required to issue an order directing the institution to cure the deficiency. Until the deficiency cited in the regulator’s order is cured, the regulator may restrict the financial institution’s rate of growth, require the financial institution to increase its capital, restrict the rates the institution pays on deposits or require the institution to take any action the regulator deems appropriate under the circumstances. Noncompliance with the

14

standards established by the safety and soundness guidelines may also constitute grounds for other enforcement action by the federal bank regulatory agencies, including cease and desist orders and civil money penalty assessments.

Community Reinvestment Act

The Community Reinvestment Act (“CRA”) is intended to encourage insured depository institutions, while operating safely and soundly, to help meet the credit needs of their communities. The CRA specifically directs the federal bank regulatory agencies, in examining insured depository institutions, to assess their record of helping to meet the credit needs of their entire community, including low and moderate income neighborhoods, consistent with safe and sound banking practices. The CRA further requires the agencies to take a financial institution’s record of meeting its community credit needs into account when evaluating applications for, among other things, domestic branches, consummating mergers or acquisitions or holding company formations.

The federal banking agencies have adopted regulations which measure a bank’s compliance with its CRA obligations on a performance-based evaluation system. This system bases CRA ratings on an institution’s actual lending service and investment performance rather than the extent to which the institution conducts needs assessments, documents community outreach or complies with other procedural requirements. The ratings range from a high of “outstanding” to a low of “substantial noncompliance.” The Bank had a CRA rating of “satisfactory” as of its most recent CRA assessment. On October 24, 2023, the federal banking regulators issued a joint notice of final rulemaking to modernize the CRA regulatory framework. The final rule is intended, among other things, to adapt to changes in the banking industry, including the expanded role of mobile and online banking, and to tailor performance standards to account for differences in bank size and business models. The final rule adjusts CRA evaluations based on bank size and type, with many of the changes applying only to banks with over $2 billion in assets, such as the Bank, and several applying only to banks with over $10 billion in assets. The final rule takes effect April 1, 2024, with staggered compliance dates of January 1, 2026, and January 1, 2027. We will evaluate the effects of the final rule on the Bank prior to the applicable compliance date and review our CRA program in connection therewith.

Anti-Money Laundering and the Office of Foreign Assets Control Regulation

The Company and the Bank must comply with the requirements of the Bank Secrecy Act (“BSA”). The BSA was enacted to prevent banks and other financial service providers from being used as intermediaries for, or to hide the transfer or deposit of money derived from, drug trafficking, money laundering, and other crimes. Since its passage, the BSA has been amended several times. These amendments include the Money Laundering Control Act of 1986, which made money laundering a criminal act, as well as the Money Laundering Suppression Act of 1994, which required regulators to develop enhanced examination procedures and increased examiner training to improve the identification of money laundering schemes in financial institutions. The USA Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“PATRIOT Act”), substantially broadened the scope of U.S. anti-money laundering laws and regulations by imposing significant new compliance and due diligence obligations, creating new crimes and penalties and expanding the extra-territorial jurisdiction of the United States. The regulations impose obligations on financial institutions to maintain appropriate policies, procedures and controls to detect, prevent, and report money laundering and terrorist financing. The regulations include significant penalties for non-compliance. Likewise, Office of Foreign Assets Control (“OFAC”) administers and enforces economic and trade sanctions against targeted foreign countries and regimes under authority of various laws, including designated foreign countries, nationals and others. OFAC publishes lists of specially designated targets and countries. Financial institutions are responsible for, among other things, blocking accounts of and transactions with such targets and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence. Failure of a financial institution to maintain and implement adequate anti-money laundering and OFAC programs, or to comply with all of the relevant laws or regulations, could have serious legal and reputational consequences for the institution.

Concentrations in Commercial Real Estate

Concentration risk exists when financial institutions deploy too many assets to any one industry or segment. Concentration stemming from commercial real estate (“CRE”) is one area of regulatory concern. The CRE Concentration Guidance, provides supervisory criteria, including the following numerical indicators, to assist bank examiners in identifying banks with potentially significant CRE loan concentrations that may warrant greater supervisory scrutiny: (i) CRE loans

15

exceeding 300% of capital and increasing 50% or more in the preceding three years; or (ii) construction and land development loans exceeding 100% of capital. The CRE Concentration Guidance does not limit banks’ levels of CRE lending activities, but rather guides institutions in developing risk management practices and levels of capital that are commensurate with the level and nature of their CRE concentrations. If a concentration is present, management must employ heightened risk management practices that address the following key elements: (i) board and management oversight and strategic planning; (ii) portfolio management; (iii) development of underwriting standards; (iv) risk assessment and monitoring through market analysis and stress testing; and (v) maintenance of increased capital levels as needed to support the level of commercial real estate lending. On December 18, 2015, the federal banking agencies jointly issued a ‘‘statement on prudent risk management for commercial real estate lending’’ reminding financial institutions of developing risk management practices. See also “Risk Factors—A concentration in commercial real estate lending could cause our regulators to restrict our ability to grow” in this Form 10-K.

Consumer Financial Services

The Bank is subject to federal and state consumer protection statutes and regulations promulgated under those laws, including, without limitation, regulations issued by the CFPB. These laws and regulations could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among financial institutions.

Incentive Compensation Guidance

The federal bank regulatory agencies have issued comprehensive guidance intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of those organizations by encouraging excessive risk-taking. The incentive compensation guidance sets expectations for banking organizations concerning their incentive compensation arrangements and related risk management, control and governance processes. The incentive compensation guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon three primary principles: (i) balanced risk-taking incentives; (ii) compatibility with effective controls and risk management; and (iii) strong corporate governance. Any deficiencies in compensation practices that are identified may be incorporated into the organization’s supervisory ratings, which can affect its ability to make acquisitions or take other actions. In addition, under the incentive compensation guidance, a banking organization’s federal supervisor may initiate enforcement action if the organization’s incentive compensation arrangements pose a risk to the safety and soundness of the organization. Further, the Basel III capital rules limit discretionary bonus payments to bank executives if the institution’s regulatory capital ratios fail to exceed certain thresholds. Although the federal bank regulatory agencies proposed additional rules in 2016 related to incentive compensation for all banks with more than $1 billion in assets, those rules have not yet been finalized. The scope and content of the U.S. banking regulators’ policies on executive compensation are continuing to develop and are likely to continue evolving in the near future.

The Dodd-Frank Act requires public companies to include, at least once every three years, a separate non-binding ‘‘say-on-pay’’ vote in their proxy statement by which stockholders may vote on the compensation of the public company’s named executive officers. In addition, if such public companies are involved in a merger, acquisition, or consolidation, or if they propose to sell or dispose of all or substantially all of their assets, stockholders have a right to an advisory vote on any golden parachute arrangements in connection with such transaction (frequently referred to as ‘‘say-on-golden parachute’’ vote). Other provisions of the Dodd-Frank Act may impact our corporate governance. For instance, the SEC adopted rules prohibiting the listing of any equity security of a company that does not have a compensation committee consisting solely of independent directors, subject to certain exceptions. In addition, the SEC adopted rules requiring all exchange-traded companies to adopt claw-back policies for incentive compensation paid to executive officers in the event of accounting restatements based on material non-compliance with financial reporting requirements, as required under Dodd-Frank. Those rules, however, remain subject to final listing standards to be issued by national securities exchanges. Additionally, the Company is an emerging growth company (“EGC”) under the Jumpstart Our Business Startups Act of 2012 (the “JOBS Act”) and therefore subject to reduced disclosure requirements related to, among other things, executive compensation.

Financial Privacy

The federal bank regulatory agencies have adopted rules that limit the ability of banks and other financial institutions to disclose non-public information about consumers to non-affiliated third parties. These limitations require disclosure of

16

privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a nonaffiliated third party. These regulations affect how consumer information is transmitted through financial services companies and conveyed to outside vendors. In addition, consumers may also prevent disclosure of certain information among affiliated companies that is assembled or used to determine eligibility for a product or service, such as that shown on consumer credit reports and asset and income information from applications. Consumers also have the option to direct banks and other financial institutions not to share information about transactions and experiences with affiliated companies for the purpose of marketing products or services.

Impact of Monetary Policy

The monetary policy of the Federal Reserve has a significant effect on the operating results of financial or bank holding companies and their subsidiaries. Among the tools available to the Federal Reserve to affect the money supply are open market transactions in U.S. government securities, changes in the discount rate on member bank borrowings and changes in reserve requirements against member bank deposits. These tools are used in varying combinations to influence overall growth and distribution of bank loans, investments and deposits, and their use may affect interest rates charged on loans or paid on deposits.

Other Pending and Proposed Legislation

Other legislative and regulatory initiatives which could affect the Company, the Bank and the banking industry in general may be proposed or introduced before the U.S. Congress, the Kansas Legislature and other governmental bodies in the future. Such proposals, if enacted, may further alter the structure, regulation and competitive relationship among financial institutions, and may subject the Company or the Bank to increased regulation, disclosure and reporting requirements. In addition, the various banking regulatory agencies often adopt new rules and regulations to implement and enforce existing legislation. It cannot be predicted whether, or in what form, any such legislation or regulations may be enacted or the extent to which the business of the Company or the Bank would be affected thereby.

Website Access to Company Reports

The Company’s annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and all amendments to those reports are available free of charge on the Company’s website (investors.crossfirstbankshares.com) as soon as reasonably practicable after such material is electronically filed with, or furnished to, the SEC. In addition, copies of the Company’s annual report will be made available, free of charge, upon written request. The Company does not intend for information contained in its website to be part of this annual report on Form 10-K.

ITEM 1A.RISK FACTORS

In addition to the other information set forth in this report, you should carefully consider the following factors, which could materially affect our business, financial condition, results of operations or cash flows in future periods. While we believe we have identified and discussed below the key risk factors affecting our business, there may be additional risks and uncertainties not currently known to us or that we currently deem to be immaterial that may adversely affect our business, financial condition, results of operations, cash flows or share price in the future.

Risks Relating to Our Business and Market

A decline in general business and economic conditions and any regulatory responses to such conditions could have a material adverse effect on our business, financial position, results of operations and growth prospects.

Our business and operations, which primarily consist of lending money to clients in the form of loans and borrowing money from clients in the form of deposits, are sensitive to general economic conditions, particularly in Kansas, Missouri, Oklahoma, Texas, Arizona, Colorado and New Mexico. Unfavorable or uncertain economic and market conditions, including slowing or recessionary economic conditions, may constrain our growth and profitability from our lending and deposit operations, lead to credit quality concerns related to borrower repayment ability and collateral protection and reduce demand for the products and services we offer. Increases in inflation can adversely affect the value of our investment securities, increase the costs of our business operations and adversely affect the ability of our clients to repay their loans with us. The United States has experienced higher inflation rates in recent years. Our business is also significantly affected by monetary and other regulatory policies, which are influenced by macroeconomic conditions and other factors beyond our control. The

17

Federal Reserve Board has increased the target federal funds rate several times beginning in 2022. Uncertainty surrounding the federal fiscal policymaking process, the medium and long-term fiscal outlook of the federal government and future tax rates are concerns for businesses, consumers and investors. Adverse economic conditions and governmental policy responses to such conditions could have a material adverse effect on our business, financial position, results of operations and growth prospects.

Our profitability depends on interest rates generally, and we may be adversely affected by changes in market interest rates.

Our profitability depends in substantial part on our net interest income, which depends on many factors that are partly or completely outside of our control, including competition, economic conditions and monetary and fiscal policies. Monetary policy in particular has a significant impact on the Company, including deposit costs, interest income, loan prepayments and loan defaults. The ratio of variable- to fixed-rate loans in our loan portfolio, the ratio of short-term (maturing at a given time within 12 months) to long-term loans and the ratio of our demand, money market and savings deposits to certificates of deposit (and their time periods) are the primary factors affecting the sensitivity of our net interest income to changes in market interest rates. Our ability to attract and maintain deposits, as well as our cost of funds, has been and will continue to be significantly affected by general economic conditions. In addition, as market interest rates rise, we will continue to have competitive pressure to increase the rates we pay on deposits. If we continue to increase interest rates paid to retain deposits, our earnings may be adversely affected. Fluctuations in market rates and other market disruptions are neither predictable nor controllable and may adversely affect our financial condition, earnings and results of operations. Stockholders' equity, specifically accumulated other comprehensive (loss) income ("AOCI"), is increased or decreased by the amount of change in the estimated fair value of our securities available-for-sale, net of deferred income taxes. Increases in long-term interest rates generally decrease the fair value of securities available-for-sale, which adversely impacts stockholders' equity.

We may not be able to implement aspects of our growth strategy, which may adversely affect our ability to maintain our historical earnings trends.

We may not be able to sustain our growth at the rate we have enjoyed during the past several years, which has been driven primarily by new market expansion, new industry vertical expansion, the strength of commercial and industrial and real estate lending in our market areas and our ability to identify and attract high caliber experienced banking talent. A downturn in local economic market conditions, our failure to attract and retain high performing personnel and the inability to attract core funding and quality lending clients, among other factors, could limit our ability to grow at the rate we have in the past. Additionally, expenses may grow at a greater rate than revenues. Consequently, our historical results of operations will not necessarily be indicative of our future operations. Any limitation on our ability to grow may adversely affect our business, financial condition and results of operations.

We may not be able to manage the risks associated with our anticipated growth and expansion through de novo branching, mergers and acquisitions, new lines of business, or new offerings of services, products or product enhancements.

If our business continues to grow as anticipated, we may become more susceptible to risks related to both general growth and specific areas of growth. Generally, risks are associated with attempting to maintain effective financial and operational controls as we grow, such as maintaining appropriate loan underwriting and credit monitoring procedures, maintaining an adequate allowance for credit losses, controlling concentrations, maintaining adequate liquidity and funding, and complying with regulatory or accounting requirements. Such risks may result in, among other effects, increased loan losses, reduced earnings, potential regulatory penalties and future restrictions on growth. We may also be exposed to certain risks associated with the specific components of our growth strategy, as discussed in more detail below.

Expansion through De Novo Branching: Our growth strategy includes evaluating opportunities to grow through de novo branching. De novo branching carries with it certain potential risks, including significant startup costs and anticipated initial operating losses; an inability to timely obtain regulatory approval; an inability to hire or retain qualified senior management to successfully operate the branch and integrate our corporate culture; challenges associated with securing attractive locations at a reasonable cost; poor market reception in locations where we do not have a preexisting reputation; unfavorable local economic conditions; and the additional strain on management resources and internal systems and controls.

Mergers and Acquisitions: As part of our growth strategy, we may continue to pursue mergers and acquisitions of banks and non-bank financial services companies within or outside our principal market areas. Mergers and acquisitions, including our recently completed Tucson acquisition, involve numerous risks associated with entry into new markets or

18

locations; integration and management of the combined entities; diversion of financial and management resources from existing operations; assumption of unanticipated problems, such as non-performing loans and latent liabilities; unanticipated costs; and potential future impairments to goodwill and other intangible assets. If we finance acquisitions by issuing convertible debt or equity securities, our existing stockholders may be diluted, which could affect the market price of our common stock. Additionally, regulatory approval is required to close a transaction. As a condition to receiving regulatory approval, we may be required to divest certain assets or take other actions, which may not be preferable or may reduce the anticipated benefits of the transaction. If we are unable to obtain any required regulatory approval, or there is a significant delay in obtaining the necessary regulatory approval, our business plans could be adversely impacted and our growth plans could be restricted.

New Lines of Business, Services, Products or Product Enhancements: From time to time, we may implement or acquire new lines of business or offer new services, products or product enhancements. There are substantial risks and uncertainties associated with developing, implementing and marketing such offerings, including significant investment of financial and other resources, inability to accurately estimate price and profitability targets, failure to realize expected benefits, regulatory compliance requirements and shifting market preferences.

Failure to adequately manage any of the preceding risks could have an adverse effect on our business, financial condition and results of operations.

The fair value of our investment securities can fluctuate due to factors outside of our control.

As of December 31, 2023, 2022 and 2021, the fair value of our investment securities portfolio was approximately $767 million, $687 million and $746 million, respectively. Factors beyond our control can significantly influence the fair value of securities in our portfolio and may cause potential adverse changes to the fair value of these securities. These factors include, but are not limited to, rating agency actions, defaults by the issuer or with respect to the underlying securities, changes in market interest rates and instability in the capital markets. In addition, our inability to accurately predict the future performance of an issuer or to efficiently respond to changing market conditions could result in a decline in the value of our investment securities portfolio. These and other factors could cause realized or unrealized losses in future periods and declines in other comprehensive income and the value of our common stock, any of which could materially and adversely affect our business, results of operations, financial condition and prospects.

Our business is highly susceptible to credit risk and fluctuations in the value of real estate and other collateral securing such credit.

There are risks inherent in making any loan, including risks inherent in dealing with individual borrowers, risks of non-payment, risks resulting from uncertainties as to the future value of collateral and risks resulting from changes in economic and industry conditions. There is no assurance that our loan approval and credit risk monitoring procedures are or will be adequate to reduce the inherent risks associated with lending. Our credit administration personnel and our policies and procedures may not adequately adapt to changes in economic or any other conditions affecting clients and the quality of our loan portfolio. Specifically, adverse changes affecting real estate values or operating cash flows of real estate, particularly in the markets in which we operate, could increase the credit risk associated with our loan portfolio and may require us to increase our allowance for credit losses on loans any of which could have a material adverse impact on our business, results of operations and growth prospects. The market value of real estate can fluctuate significantly in a short period of time. Adverse credit factors could result in higher delinquencies, higher non-performing assets, greater charge-offs or losses in future periods which could materially and adversely impact us. Similarly, we have credit risk embedded in our securities portfolio.

We have credit exposure to the energy industry.

We have credit exposure to the energy industry in each of our primary markets and across the United States. As of December 31, 2023, our energy loans totaled $214 million, or 3% of total loans. A downturn or lack of growth in the energy industry and energy-related business could adversely affect our clients which may lead to higher delinquencies and greater charge-offs in future periods. Any pricing pressures on oil and gas could lead to increased credit stress in our energy portfolio, increased losses associated with our energy portfolio, increased utilization of our contractual obligations to extend credit and weaker demand for energy lending. Sustained uncertainty and price volatility in the energy sector could have other adverse impacts that are difficult to isolate or quantify, all of which could have a material adverse effect on us. Additionally, to the extent that climate change and responses to climate change negatively impact the businesses and financial condition of

19

our clients in the energy industry, the credit risk associated with loans and other credit exposures to those clients may increase.

A concentration in commercial real estate lending could cause our regulators to restrict our ability to grow.

As a part of their regulatory oversight, the federal regulators have issued guidance on Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices (the “CRE Concentration Guidance”) with respect to a financial institution’s concentrations in CRE lending activities. Such guidance identifies certain concentration levels that, if exceeded, will expose an institution to additional supervisory analysis The guidelines identify the following as preliminary indications of possible CRE concentration risk: (i) the institution’s total construction, land development and other land loans represent 100% or more of total capital and reserves; or (ii) total CRE loans as defined in the guidance, or Regulatory CRE, represent 300% or more of the institution’s total capital and reserves and the institution’s Regulatory CRE has increased by 50% or more during the prior 36-month period. We believe that the CRE Concentration Guidance is applicable to us. Our CRE portfolio was 321% of total capital and reserves and our total construction, land development and other land loans was 112% of total capital and reserves at December 31, 2023. The FDIC or other federal regulators may become concerned about our CRE loan portfolio and could limit our ability to grow by restricting approvals of new branches and other growth opportunities or by requiring us to raise additional capital, reduce our loan concentrations or undertake other remedial actions that may adversely affect us.

Many of our loans are to commercial borrowers, which have a higher degree of risk than other types of loans.

As of December 31, 2023, approximately 91% of our loan portfolio related to commercial-based lending. Commercial purpose loans are often larger and involve greater risks than other types of lending. Repayment of these loans often depends on the successful operation or development of the property or business involved and are highly sensitive to adverse conditions in the real estate market or the industry in which the business operates or the general economy. Accordingly, a downturn in the real estate market or other industry in which the business operates or the general economy could impair the borrowers’ ability to repay and heightens our risk related to commercial purpose loans, particularly CRE loans. Losses incurred on a small number of commercial purpose loans could have a material adverse impact on our financial condition and results of operations due to the larger-than-average size of each commercial purpose loan and collateral that is generally less readily-marketable.

Our largest loan relationships make up a significant percentage of our total loan portfolio.

As of December 31, 2023, our 25 largest borrowing relationships totaled approximately $1.9 billion in total commitments, representing, in the aggregate, 23% of our total outstanding commitments as of December 31, 2023. Our five largest borrowing relationships, based on total commitments, accounted for 8% of total commitments as of December 31, 2023. This concentration of borrowers may expose us to material losses if one or more of these relationships becomes delinquent or suffers default. The allowance for credit losses on loans may not be adequate to cover such losses and any loss or increase in the allowance would negatively affect our earnings and capital. Even if these loans are adequately collateralized, an increase in classified assets could harm our reputation with our regulators and inhibit our ability to execute our business plan.

Small Business Administration lending is an important and growing part of our business. Our SBA lending program is dependent upon the U.S. Federal government, and we face specific risks associated with originating SBA loans.

As an approved participant in the SBA Preferred Lender’s Program (an “SBA Preferred Lender”), we enable our clients to obtain SBA loans without being subject to the potentially lengthy SBA approval process necessary for lenders that are not SBA Preferred Lenders. The SBA periodically reviews the lending operations of participating lenders to assess, among other things, whether the lender exhibits prudent risk management. When weaknesses are identified, the SBA may request corrective actions or impose enforcement actions, including revocation of the lender’s SBA Preferred Lender status. If we were to lose our status as an SBA Preferred Lender, we may lose new opportunities, and a limited number of existing SBA loans, to lenders who are SBA Preferred Lenders. In addition, any changes to the SBA program, including changes to the level of guarantee provided by the federal government on SBA loans, changes to program-specific rules impacting volume eligibility under the guaranty program, as well as changes to the program amounts authorized by Congress, may have a material adverse effect on our SBA lending program. In addition, any default by the U.S. government on its obligations or any prolonged government shutdown could, among other things, impede our ability to originate SBA loans or collect on

20

guarantees in the event a borrower defaults on its obligations, and could materially adversely affect our SBA lending business.

Our allowance for credit losses may not be adequate to absorb actual credit losses inherent in our loans and securities portfolios.

A significant source of risk arises from the possibility that we could sustain losses due to loan defaults and non-performance on loans. We establish an allowance for credit losses and maintain it at a level considered adequate by management to absorb expected credit losses based on our analysis of the loan portfolio, securities portfolio and market environment. The allowance for credit losses represents our estimate of expected losses in the portfolio and is based upon relevant information available to us. The amount of future losses is susceptible to changes in economic, operating and other conditions, including changes in interest rates and inflationary or recessionary trends, many of which are beyond our control. We use historical information, current conditions and reasonable forecasts to estimate the expected loss over the life of the loan. Our underwriting policies, adherence to credit monitoring processes and risk management systems and controls may not prevent unexpected losses. Our allowance may not be adequate to cover actual loan losses. Additional credit losses may occur in the future and may occur at a rate greater than we previously experienced. We may be required to take additional provisions for credit losses in the future to further supplement the allowance for credit losses, either due to management’s decision to do so or requirements by our banking regulators. In addition, bank regulatory agencies will periodically review the allowance for credit losses and the value attributed to nonaccrual loans or to real estate acquired through foreclosure. Such regulatory agencies may require us to recognize future charge-offs. These adjustments could adversely affect our business, financial condition and results of operations.

We rely on our senior management team and may have difficulty identifying, attracting and retaining necessary personnel, which may divert resources and limit our ability to execute our business strategy and successfully grow our business.

Our continued growth and successful operation of our business depends, in large part, on our ability to hire and retain highly qualified and motivated personnel at every level. Our senior management team has significant industry experience, and their knowledge and relationships would be difficult to replace in the event of departure or retirement. We must also hire and retain qualified banking personnel to continue to grow our business. Competition for skilled personnel in the financial services and banking industry is significant and costs associated with incenting and retaining skilled personnel may be material and continue to increase. If we are unable to hire and retain qualified personnel or successfully address management succession issues, we may be unable to successfully execute our business strategy and manage our growth, which could have a material adverse effect on our business, financial condition or results of operations.

Our largest deposit relationships currently make up a significant percentage of our deposits and the withdrawal of deposits by our largest depositors could force us to fund our business through more expensive and less stable sources.

At December 31, 2023, our 25 largest depositors accounted for 15% of our total deposits and our five largest depositors accounted for 7% of our total deposits. Withdrawals of deposits by any one of our largest depositors or by one of our related client groups, or failure to attract additional deposits, could force us to rely more heavily on borrowings and other sources of funding to meet business and withdrawal demands, adversely affecting our net interest margin and results of operations. Such circumstances may require us to raise deposit rates to attract new deposits and rely more heavily on other funding sources that could be more expensive and less stable. Additionally, if market interest rates continue to rise or stay at heightened levels, we will continue to have competitive pressure to increase the rates we pay on deposits, which may adversely affect our earnings. Under applicable regulations, if the Company was no longer “well-capitalized,” we would be required to obtain FDIC approval to accept brokered deposits and could also be subject to a deposit rate cap prohibiting us from paying in excess of 75 basis points above national deposit rates.

Failure to maintain sufficient liquidity could impair our ability to fund operations and meet our obligations as they become due and could materially adversely affect our growth, business, profitability and financial condition.

Effective liquidity management is essential for the operation of our business. Sufficient levels of liquidity are required to fund asset growth, serve client demand for loans, pay our debt obligations and meet other funding commitments. Liquidity risk is the potential that we will be unable to meet our obligations as they come due because of an inability to liquidate assets or obtain adequate funding without adverse conditions or consequences. Liquidity risk can increase due to a number of factors, including an over-reliance on a particular source of funding, market-wide phenomena such as market dislocation and

21

major disasters, client deposit by geography or industry, and a high concentration of large depositors. The Bank’s primary funding source is client deposits. Other sources of funding may include advances from the Federal Home Loan Bank (“FHLB”), the Federal Reserve Bank of Kansas City (“FRB”), sales of investment securities or loans, and our acquisition of brokered deposits, internet subscription certificates of deposit and reciprocal deposits through the Intrafi Network. We also may borrow funds from third-party lenders, such as other financial institutions. Although the Bank has historically been able to replace maturing deposits and advances as necessary, it might not be able to replace such funds in the future. An inability to raise funds through deposits, borrowings, the sale of loans, securities and other sources could have a substantial negative effect on liquidity. Any substantial, unexpected or prolonged change in the level or cost of liquidity could have a material adverse effect on our financial condition and results of operations and could impair our ability to fund operations and meet our obligations as they become due and could jeopardize our financial condition.

If the goodwill that we have recorded or may record in connection with a business acquisition becomes impaired, it could require charges to earnings, which would adversely affect our business, financial condition and results of operations.

Goodwill represents the amount by which the cost of an acquired business exceeded the fair value of the net assets we acquired. Goodwill is reviewed for impairment at least annually, or more frequently if a triggering event occurs which indicates that the carrying value of the asset might be impaired. There can be no assurance that our future evaluations of our existing goodwill or goodwill we may acquire in the future will not result in findings of impairment and related write-downs, which could adversely affect our business, financial condition and results of operations.

We may not be able to maintain sufficient capital in the future, which may adversely affect our financial condition, liquidity, results of operations and our ability to maintain regulatory compliance.

Our business strategy calls for continued growth. We may need to raise additional capital in the future to support our continued growth and to maintain our required regulatory capital levels. Our ability to raise additional capital depends on conditions in the capital markets, economic conditions and a number of other factors, including investor perceptions regarding the banking industry, market conditions and governmental activities, our financial condition and performance and competition with other financial institutions for capital sources. We cannot guarantee that we will be able to raise additional capital in the future on acceptable terms, which may adversely affect our liquidity, growth strategy, financial condition and results of operations.

We face strong competition from banks, credit unions, financial technology or Fintech companies and other financial services providers that offer banking services, which may limit our ability to attract and retain banking clients.

Competition in the banking industry generally, and in our primary markets specifically, is intense. Competitors include banks and other financial services providers, such as savings and loan institutions, brokerage firms, credit unions, mortgage banks and other financial intermediaries. In particular, we compete with larger national and regional financial institutions, whose greater resources afford them many competitive advantages. Such resources may enable our competitors to achieve larger economies of scale; offer more services; spend more on advertising and technological investments; offer better lending rates to clients; better diversify their loan portfolio; and have less vulnerability to downturns in local economies and real estate markets. If we are unable to offer competitive products and services as quickly as our larger competitors, our business may be negatively affected. We also compete against community banks, credit unions and nonbank financial services companies with strong local ties to small- and medium-sized businesses that we target, and we may be unable to attract and retain such clients as effectively as these smaller competitors. Additionally, we face growing competition from so-called “online businesses” with few or no physical locations, including financial technology companies, online banks, lenders and consumer and commercial lending platforms and automated retirement and investment service providers. New technology and other changes increasingly allow parties to effectuate online financial transactions with little to no involvement from banks, including bill payment, funds transfers and maintenance of funds in brokerage accounts or mutual funds that would have historically been held as bank deposits. The process of eliminating banks as intermediaries, known as “disintermediation,” could reduce our income from fees and deposits. Ultimately, we may be unable to compete successfully against current and future competitors, which may reduce our revenue stream and prevent us from growing our loan and deposit portfolios, any of which may adversely affect our results of operations and financial condition.

22

We are required to make significant judgments, assumptions and estimates in the preparation of our financial statements and our judgments, assumptions and estimates may not be accurate.

The preparation of financial statements and related disclosures in conformity with GAAP requires us to make judgments, assumptions and estimates that affect the amounts reported in our consolidated financial statements and accompanying notes. Our critical accounting policies and estimates, which are included in the section captioned “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” describe those significant accounting policies and estimates used in the preparation of our consolidated financial statements that we consider “critical” because they require judgments, assumptions and estimates that materially affect our consolidated financial statements and related disclosures. As a result, if future events or regulatory views concerning such analysis differ significantly from the judgments, assumptions and estimates in our critical accounting policies and estimates, those events or regulatory views could have a material impact on our consolidated financial statements and related disclosures, in each case resulting in our need to revise or restate prior period financial statements, cause damage to our reputation and the price of our common stock and adversely affect our business, financial condition and results of operations.

Our risk management framework may not be effective in mitigating risks or losses to us, and we may incur losses due to ineffective risk management processes and strategies.

Our risk management framework is comprised of various processes, systems and strategies designed to manage our risk exposure, including credit, liquidity, interest rate, price, operational, reputation, strategic and compliance risks. Our framework also includes financial or other modeling methodologies that involve highly subjective management assumptions and judgment. Our risk management framework may not be effective under all circumstances and may not adequately mitigate risks or losses, which could result in adverse regulatory consequences and unexpected losses and our business, financial condition, results of operations or growth prospects could be materially and adversely affected.

If we fail to maintain effective internal control over financial reporting, we may not be able to report accurate and timely financial results, which may cause material harm to our business.

Our management team is responsible for establishing and maintaining adequate internal control over financial reporting and for evaluating and reporting on that system of internal control. Our internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP. As a public company, we are required to comply with the Sarbanes-Oxley Act and other rules that govern public companies. Once we are no longer an emerging growth company, our independent registered public accounting firm will be required to provide an attestation report on the effectiveness of our internal control over financial reporting. We will continue to periodically test and update, as necessary, our internal control systems, including our financial reporting controls. Our actions, however, may not be sufficient to result in an effective internal control environment, and any future failure to maintain effective internal control over financial reporting could impair the reliability of our financial statements which in turn could harm our business, impair investor confidence in the accuracy and completeness of our financial reports and our access to the capital markets, cause the price of our common stock to decline and subject us to regulatory penalties.

Failure to keep pace with technological change could adversely affect our business.

Advances and changes in technology could significantly affect our business, financial condition, results of operations and future prospects. The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services, including those incorporating data analytics, artificial intelligence (“AI”), generative AI, and machine learning. Failure to successfully keep pace with technological change affecting our industry could harm our ability to compete effectively. Many of our competitors have substantially greater resources to invest in technological improvements. We face many challenges, including the increased demand to provide clients electronic access to their accounts and the cost and implementation of systems to perform electronic banking transactions. Our ability to compete depends on our ability to continue to adapt technology on a timely and cost-effective basis to meet these demands. We may not be able to effectively or timely implement new technology-driven products and services or be successful in marketing these products and services to our clients. In addition, the implementation of technological changes and upgrades to maintain current systems and integrate new ones may cause service interruptions, transaction processing errors, system conversion delays and other adverse effects. As these technologies are improved in the future, we may be required to make significant capital expenditures in order to remain competitive, which may increase our overall expenses and have a material adverse effect on our business, financial condition, results of operations and cash flows.

23

We are exposed to cybersecurity threats and potential security breaches and our efforts to minimize or respond to such threats may not be effective to prevent significant harm to the Company.

Cybersecurity threats and potential security breaches could compromise our information and expose us to liability, which would cause our business and reputation to suffer. We conduct a portion of our business over the Internet. We rely heavily upon data processing, software, communications and information systems from a number of third parties to conduct our business. Our business involves the storage and transmission of clients’ proprietary information and security breaches could expose us to the risk of loss or misuse of such information, litigation and potential liability. The secure processing, maintenance and transmission of this information is critical to our operations and business strategy. We, our clients and other financial institutions with which we interact, are subject to increasingly frequent, continuous attempts, including ransomware and malware attacks, to penetrate key systems by individual hackers, organized criminals, and in some cases, state-sponsored organizations. Our operations are also vulnerable to disruptions from human error, natural disasters, power loss, computer viruses, unauthorized access and other unforeseen events. Undiscovered data corruption could render our client information inaccurate. Third-party or internal systems and networks may fail to operate properly or become disabled due to deliberate attacks or unintentional events. These risks are further heightened by factors such as developments in generative AI, increased remote working and geopolitical turmoil. Cyberattacks and security breaches may also cause significant increases in operating costs, including the costs of compensating clients for any resulting losses they may incur, and the costs and capital expenditures required to correct the deficiencies in and strengthen the security of data processing and storage systems, and these costs may exceed coverage limits under our cyber insurance policies.

While we believe we are in compliance with all applicable privacy and data security laws, a cyber-incident could put our client’s confidential information at risk and expose us to significant liability. While we have not experienced a material cyber-incident or security breach that has been successful in compromising our data or systems to date, financial institutions are one of the top targets for cyber-attacks, and we can never be certain that all of our systems are entirely free from vulnerability to breaches of security or other technological difficulties or failures. The perpetual evolution of known cyber-threats requires us to devote significant resources to maintain, regularly update and backup our data security systems and processes, as we may not be able to anticipate, or effectively implement preventative measures against, all cyber-attacks. We also incur significant costs in maintaining cybersecurity protections, including costs associated with maintaining cyber insurance coverage. A security breach or other cyber-incident could have an adverse impact on, among other things, our revenue, ability to attract and maintain clients and our reputation. In addition, a security breach could also subject us to additional regulatory scrutiny and expose us to civil litigation and possible financial liability, all of which could have a material adverse effect on our business, financial condition, results of operations, system availability and operational support.

We rely on client, counterparty and third-party information as part of our credit process, which subjects us to risks if that information is not accurate or is incomplete.

In deciding whether to extend credit or enter into other transactions with clients and counterparties, we rely on information furnished to us by or on behalf of clients and counterparties, including financial statements and other financial information. We also rely on representations of clients and counterparties as to the accuracy and completeness of that information and, with respect to financial statements, on reports of independent auditors. While we have a practice of seeking to independently verify client information that we use in deciding whether to extend credit or to agree to a loan modification, including employment, assets, income and credit score, not all client information is independently verified and if any of the information that is independently verified (or any other information considered in the loan review process) is misrepresented and such misrepresentation is not detected prior to loan funding, the value of the loan may be significantly lower than expected. Whether a misrepresentation is made by the applicant, another third party or one of our employees, we generally bear the risk of loss associated with the misrepresentation. We may not detect all misrepresented information in our approval process. Any such misrepresented information could adversely affect our business, financial condition and results of operations.

We are subject to certain operating risks related to employee error and client, employee and third-party misconduct, which could harm our reputation and business.

Employee error or employee and client misconduct could subject us to financial losses or regulatory sanctions and seriously harm our reputation. Misconduct by our employees could include hiding unauthorized activities from us, unauthorized use of generative AI tools, improper or unauthorized activities on behalf of our clients or improper use of confidential information. It is not always possible to prevent employee error or misconduct and the precautions we take to prevent and detect this activity may not be effective in all cases. Because the nature of the financial services business

24

involves a high volume of transactions, certain errors, which may be automated or manual or involve the use of generative AI, may be repeated or compounded before they are discovered and successfully rectified. Our necessary dependence upon processing systems to record and process transactions and our large transaction volume may further increase the risk that employee errors, tampering or manipulation of those systems will result in losses that are difficult to detect. Employee error or misconduct could also subject us to financial claims. If our internal control systems fail to prevent or detect an occurrence, it could have a material adverse effect on our business, financial condition and results of operations.

Fraudulent activity could damage our reputation, disrupt our businesses, increase our costs and cause losses.

As a financial institution, we are inherently exposed to operational risk in the form of theft and other fraudulent activity by employees, clients and other third parties targeting us and our clients' accounts or data. Such activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering and other dishonest acts. Although the Company devotes substantial resources to maintaining effective policies and internal controls to identify and prevent such incidents, given the increasing sophistication of possible perpetrators and developments in technologies such as generative AI, the Company may experience financial losses or reputational harm as a result of fraud. In addition, we may be required to make significant capital expenditures in order to modify and enhance our protective measures or to investigate and remediate fraudulent activity. Although we have not experienced any material business or reputational harm as a result of fraudulent activities in the past, the occurrence of fraudulent activity could damage our reputation, disrupt our business, increase our costs and cause losses in the future.

Our operations could be interrupted if our third-party service providers experience difficulty, terminate their services or fail to comply with banking regulations.

We depend, to a significant extent, on a number of relationships with third-party service providers. Specifically, we receive core systems processing, essential web-hosting and other internet systems, loan and deposit-processing and other processing services from third-party service providers. If our third-party service providers experience financial, operational or technological difficulties or terminate their services and we are unable to replace them with other service providers, our operations could be interrupted. If an interruption were to continue for a significant period of time, our business, financial condition and results of operations could be materially adversely affected. Even if we are able to replace our service providers, it may be at a higher cost to us, which could adversely affect our business, financial condition and results of operations.

We follow a relationship-based operating model and negative public opinion could damage our reputation and adversely impact our earnings.

Reputation risk, or the risk to our business, earnings and capital from negative public opinion, is inherent in our business. Negative public opinion can result from our actual or alleged conduct in any number of activities, including lending practices, corporate governance, acquisitions, and from actions taken by government regulators and community organizations in response to those activities. Negative public opinion can adversely affect our ability to keep and attract clients and employees and can expose us to litigation and regulatory action that may adversely affect our results of operations. Although we take steps to minimize reputation risk in dealing with our clients and communities, this risk will always be present given the nature of our business.

If third parties infringe upon our intellectual property or if we were to infringe upon the intellectual property of third parties, we may expend significant resources enforcing or defending our rights or suffer competitive injury.

We rely on a combination of copyright, trademark, trade secret laws and confidentiality provisions to establish and protect our intellectual property rights. If we fail to successfully maintain, protect and enforce our intellectual property rights, our competitive position could materially suffer. Similarly, if we were to infringe on the intellectual property rights of others, our competitive position could materially suffer. Third parties may challenge, invalidate, circumvent, infringe or misappropriate our intellectual property, or our intellectual property may not be sufficient to permit us to take advantage of current market trends or otherwise to provide competitive advantages, which could result in costly redesign efforts, discontinuance of certain product or service offerings or other competitive harm.

We may also be required to spend significant resources to monitor and police our intellectual property rights. Our competitors may independently develop similar technology, duplicate our products or services, design around our intellectual property or infringe on our intellectual property rights through the use of generative AI tools, and in such cases, we may not be able to assert our intellectual property rights against such parties. Further, our contractual arrangements may not

25

effectively prevent disclosure of our confidential information or provide an adequate remedy in the event of unauthorized disclosure of our confidential or proprietary information. We may have to litigate to enforce or determine the scope and enforceability of our intellectual property rights, trade secrets and know-how, which could be time-consuming and expensive, divert resources and may not prove successful. The loss of intellectual property protection or the inability to obtain rights with respect to third-party intellectual property could harm our business and ability to compete. In addition, because of the rapid pace of technological change in our industry, aspects of our business, and our products and services rely on technologies developed or licensed by third parties and we may not be able to obtain or continue to obtain licenses and technologies from these third parties on reasonable terms or at all.

We may be exposed to risk of environmental liabilities or failure to comply with regulatory requirements with respect to properties to which we take title.

In the course of our business, we may foreclose and take title to real estate and these properties could subject us to environmental liabilities and other federal, state or local regulatory requirements, such as the Americans with Disabilities Act. We do not know whether existing requirements will change or whether compliance with future requirements will involve significant expenditures. We may be held liable to a governmental entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination, or we may be required to investigate or clean up hazardous or toxic substances, or chemical releases at a property. The costs associated with these investigations or remediation activities could be substantial. If we are the owner or former owner of a contaminated site, we may be subject to claims and damages from third parties related to environmental contamination emanating from the property. We could also be required to cure deficiencies with local building codes, requirements under the Americans with Disabilities Act, or other federal, state or local property regulation requirements. If we ever become subject to significant environmental liabilities or costs or fail to comply with regulatory requirements with respect to these properties, our business, financial condition, liquidity and results of operations could be materially and adversely affected.

The costs and effects of litigation, regulatory actions, investigations or similar matters, or adverse facts and developments related thereto, could materially affect our business, operating results and financial condition.

We may be involved from time to time in a variety of litigation, investigations or similar matters arising out of our business. It is inherently difficult to assess the outcome of these matters and we may not prevail in proceedings or litigation. Insurance may not cover all such claims or losses, our indemnification rights may not be honored and we may suffer damage to our reputation, regardless of the merit or eventual outcome of a claim. The ultimate judgments or settlements in any litigation or investigation could have a material adverse effect on our business, financial condition and results of operations. In addition, premiums for insurance covering the financial and banking sectors are rising. We may not be able to obtain appropriate types or levels of insurance in the future, nor may we be able to obtain adequate replacement policies with acceptable terms or at historic rates, if at all.

Financial counterparties expose the Company to risks.

We maintain correspondent bank relationships, manage certain loan participations, engage in securities transactions and engage in other activities with financial counterparties that are customary to our industry. Many of these transactions expose us to counterparty credit, liquidity and reputational risk in the event of default by the counterparty, negative publicity and complaints about the counterparty or the financial services industry in general. Although we seek to manage these risks through internal controls and procedures, we may experience loss or interruption of business, damage to our reputation, or incur additional costs or liabilities as a result of unforeseen events with these counterparties. Any financial cost, liability or reputational damage could have a material adverse effect on our business, which in turn, could have a material adverse effect on our financial condition and results of operations.

Severe weather, natural disasters, pandemics or other health crises, acts of war or terrorism and other external events could significantly impact our business.

Severe weather, including tornadoes, droughts and hailstorms, as well as wildfires and other natural disasters, pandemics or other health crises, acts of war or terrorism and other adverse external events (“Adverse Events”) could have a significant impact on our, our clients’ or our business partners’ ability to conduct business. While it is difficult to predict the ultimate effects of an Adverse Event on the broader economy or our markets, future impacts to the business of the Company, our clients and our third-party providers could be widespread and material, such as increased unemployment, supply-chain interruptions, declines in demand for loans and other banking services and products, reduction in business activity and

26

financial transactions, increased commercial property vacancy rates, declines in the value of loan collateral, including energy and real-estate collateral, declines in the credit quality of our loan portfolio, volatile performance of our investment securities portfolio, and overall economic and financial market instability. Such events could cause significant property damage, result in loss of revenue or cause us to incur additional expenses. Operations in our markets could be disrupted by both the evacuation of large portions of the population as well as damage or lack of access to our banking and operation facilities. Military conflicts and geopolitical turmoil, including the current military conflicts between Russia and Ukraine and Israel and Hamas, may increase volatility in commodity and energy prices, create supply chain issues and cause instability in financial markets, which may adversely affect us and our clients. In addition, additional regulation in response to the Adverse Event may significantly impact our business. Although management has established business continuity plans and procedures, the occurrence of any such events could have a material adverse effect on our business, financial condition and results of operations.

Climate change and responses to climate change may adversely impact our business, financial condition and results of operations.

Concerns over the long-term impacts of climate change have led and will continue to lead to governmental efforts to mitigate those impacts. Consumers and businesses are also changing their behavior and business preferences as a result of these concerns. New governmental regulations or guidance relating to climate change, as well as changes in consumers’ and businesses’ behaviors and business preferences, may cause us and our clients to experience cost increases, asset value reductions, operating process changes and delays in completion of projects. To the extent that climate change and responses to climate change negatively impact the businesses and financial condition of our clients, including clients in the energy industry, the credit risk associated with loans and other credit exposures to those clients may increase.

Risks Relating to Our Regulatory Environment

We are subject to extensive regulation, which increases the cost and expense of compliance and could limit or restrict our activities, which in turn may adversely impact our earnings and ability to grow.

We operate in a highly regulated environment and are subject to regulation, supervision and examination by a number of governmental regulatory agencies, including, with respect to the Bank, the FDIC and the OSBCK and, with respect to the Company, the Federal Reserve. Regulations adopted by these agencies govern a comprehensive range of matters relating to ownership and control of our shares, our acquisition of other companies and businesses, permissible activities for us to engage in, maintenance of adequate capital levels, dividend payments and other aspects of our operations. Bank regulators possess broad authority to prevent or remedy unsafe or unsound practices or violations of law. If, as a result of an examination, a banking agency determines that an aspect of our operations is unsatisfactory, or that we are, or our management is, in violation of any law or regulation, they may take a number of different remedial actions as they deem appropriate. These actions include the power to enjoin ‘‘unsafe or unsound’’ practices, to require affirmative action to correct any conditions resulting from any violation or practice, to issue an administrative order that can be judicially enforced, to direct an increase in our capital, to restrict our growth, to assess civil money penalties against us or our officers or directors, to fine or remove officers and directors and, if it is concluded that such conditions cannot be corrected or there is an imminent risk of loss to depositors, to terminate the Bank’s FDIC deposit insurance and place the Bank into receivership or conservatorship. Any regulatory action against us could have a material adverse effect on our business, financial condition and results of operations.

Government policy, legislation and regulation, particularly monetary policy from the Federal Reserve, significantly affect economic growth and financial operations, including our distribution of credit, bank loans, investments, deposits, product offerings and disclosures, interest rates and bankruptcy proceedings for consumer residential real estate mortgages. The laws and regulations applicable to the banking industry could change at any time and we cannot predict the effects of these changes on our business, profitability or growth strategy. Increased regulation could increase our cost of compliance, adversely affect profitability and inhibit our ability to conduct business consistent with historical performance. If we do not comply with governmental regulations, we may be subject to fines, penalties, lawsuits or material restrictions on our businesses and growth that may damage our reputation and adversely affect our business operations. Proposed legislative and regulatory actions may not occur within expected time frames, or at all, which creates additional uncertainty for our business and industry. Accordingly, legislative and regulatory actions taken now or in the future could have a material adverse impact on our business, financial condition and results of operation.

27

Many of our expansion and growth plans require regulatory approvals and failure to obtain them may restrict our growth.

As part of our growth strategy, we may expand our business by pursuing strategic acquisitions of financial institutions, adding branches and pursuing acquisitions of other complementary businesses. Generally, we must receive federal and state regulatory approval before we can acquire an FDIC-insured depository institution or related business. Such regulatory approvals may not be granted on terms that are acceptable to us, or at all. In determining whether to approve a proposed acquisition, federal and state banking regulators will consider, among other factors, the effect of the acquisition on competition, our financial condition, our future prospects and the impact of the proposal on U.S. financial stability. The regulators also review current and projected capital ratios, the competence, experience and integrity of management and its record of compliance with laws and regulations, the convenience and needs of the communities to be served and the effectiveness of the acquiring institution in combating money laundering activities.

The Federal Reserve may require the Company to commit capital resources to support the Bank.

As a matter of policy, the Federal Reserve expects a bank holding company to act as a source of financial and managerial strength to its subsidiary banks. The Federal Reserve may require a bank holding company to make capital injections into a troubled subsidiary bank at times when the bank holding company may not be inclined to do so and may charge the bank holding company with engaging in unsafe and unsound practices for failing to commit resources to such a subsidiary bank. Accordingly, we may be required to make capital injections into a troubled subsidiary bank, even if such contribution creates a detriment to the Company or its stockholders. If we do not have sufficient resources on hand to fund the capital injection, we may be required to borrow funds or raise capital. Any such loans are subordinate in right of payment to deposits and to certain indebtedness of the subsidiary bank. In the event of bankruptcy of the bank holding company, claims based upon any commitments to fund capital injections are entitled to a priority of payment over claims made by general unsecured creditors, including holders of indebtedness. Thus, any borrowing incurred by the Company to make required capital injections to the Bank could adversely impact our financial condition, results of operations and future prospects. Additionally, under the Financial Institutions Reform Recovery and Enforcement Act of 1989 (“FIRREA”), losses caused by a failing bank subsidiary might be charged to the capital of an affiliate bank. Moreover, any bank operating under the Company’s common control may also be required to contribute capital to a failing affiliate bank within the Company’s control group. This is known as FIRREA’s “cross-guarantee” provision. The Company currently has one bank subsidiary.

The Company and the Bank are subject to stringent capital requirements that may limit our operations and potential growth.

The Company and the Bank are subject to various regulatory capital requirements. Failure to meet minimum capital requirements will result in certain mandatory and discretionary actions by regulators that, if undertaken, could have a direct material effect on our financial statements. Under capital adequacy guidelines and the regulatory framework for prompt corrective action, the Company and the Bank must meet specific capital guidelines that involve quantitative measures of our assets, liabilities and certain off-balance sheet commitments as calculated under these regulations. The failure to meet the established capital requirements under the prompt corrective action framework could result in one or more of our regulators placing limitations or conditions on our activities, including our growth initiatives, or restricting the commencement of new activities and such failure could subject us to a variety of enforcement remedies available to the federal regulatory authorities, including limiting our ability to pay dividends, issuing a directive to increase our capital and terminating the Bank’s FDIC deposit insurance, which is critical to the continued operation of the Bank.

Many factors affect the calculation of our risk-based assets and our ability to maintain the level of capital required to achieve acceptable capital ratios, such as increases to our risk-weighted assets, loan impairments, loan losses exceeding the amount reserved for such losses and other factors that decrease our capital, thereby reducing the level of the applicable ratios. Our failure to remain well-capitalized could affect client and investor confidence, our ability to grow, our costs of funds, the interest rates that we pay on deposits, FDIC insurance costs, our ability to pay dividends on common stock, our ability to make acquisitions and our business, results of operations and financial condition.

Higher FDIC deposit insurance premiums and assessments could adversely affect our financial condition.

Our deposits are insured up to applicable limits by the DIF and are subject to deposit insurance assessments to maintain deposit insurance. As an FDIC-insured institution, we are required to pay quarterly deposit insurance premium assessments to the FDIC. Growth in insured deposits at FDIC-insured financial institutions in recent years caused the ratio of the DIF to total insured deposits to fall below the current statutory minimum, and the FDIC has approved an increase in the

28

base assessment rates to increase the likelihood that the reserve ratio of the DIF reaches the statutory minimum level by the statutory deadline. In addition, the FDIC issued a final rule in November 2023 to implement a special assessment to recover the significant losses incurred by the FDIC in connection with the 2023 bank failures. Although we do not anticipate any impact to the Bank from the special assessment, it is possible that our regular deposit insurance rates will increase should the FDIC alter the assessment rate schedule or calculation methodology for all larger financial institutions (including the Bank) as a result of the recent bank failures or other events. Although we cannot predict what the insurance assessment rates will be in the future, either a deterioration in our risk-based capital ratios, regulatory exam results, asset mix, credit quality or further adjustments to the base assessment rates could have a material adverse impact on our business, financial condition, results of operations and cash flows.

We face a risk of noncompliance and enforcement action with respect to the Bank Secrecy Act and other anti-money laundering statutes and regulations.

The BSA, the PATRIOT Act and other laws and regulations require financial institutions, among other duties, to institute and maintain an effective anti-money laundering program and to file reports such as suspicious activity reports and currency transaction reports. Violation of such requirements may result in significant civil money penalties imposed by federal banking agencies and the U.S. Department of the Treasury's Financial Crimes Enforcement Network (“FinCEN”), which agencies have recently engaged in coordinated enforcement efforts against banks and other financial services providers with the U.S. Department of Justice (“DOJ”), the Drug Enforcement Administration and the IRS. We are also subject to increased scrutiny of compliance with the rules enforced by the OFAC, which may require sanctions for dealing with certain persons or countries. If the policies, procedures and systems of our company, or any of our subsidiaries, are deemed deficient, we would be subject to fines and regulatory actions, which may include restrictions on our ability to pay dividends and requirements to obtain regulatory approvals to proceed with certain aspects of our business plan, including our acquisition plans. Failure to maintain and implement adequate programs to combat money laundering and terrorist financing could also have serious reputational consequences for us. Any of these results could have a material adverse effect on our business, financial condition, results of operations and growth prospects.

Regulations relating to privacy, information security and data protection could increase our costs, affect or limit how we collect and use personal information and adversely affect our business opportunities.

We are subject to various privacy, information security and data protection laws, including requirements concerning security breach notification and we could be negatively impacted by these laws. For example, our business is subject to the Gramm-Leach-Bliley Act which, among other things: (i) imposes certain limitations on our ability to share non-public personal information about our clients with non-affiliated third parties; (ii) requires that we provide certain disclosures to clients about our information collection, sharing and security practices and afford clients the right to “opt out” of any information sharing by us with non-affiliated third parties (with certain exceptions); and (iii) requires that we develop, implement and maintain a written comprehensive information security program containing safeguards that are appropriate based on our size and complexity, the nature and scope of our activities and the sensitivity of client information we process, as well as plans for responding to data security breaches. Many state and federal banking regulators, states and foreign countries have also enacted data security breach notification requirements with varying levels of individual, consumer, regulatory or law enforcement notification in certain circumstances in the event of a security breach. Moreover, legislators and regulators in the United States and other countries are increasingly adopting or revising privacy, information security and data protection laws that potentially could have a significant impact on our current and planned privacy, data protection and information security-related practices, our collection, use, sharing, retention and safeguarding of client or employee information and some of our current or planned business activities. This could also increase our costs of compliance and business operations and could reduce income from certain business initiatives. This includes increased privacy-related enforcement activity at the federal level by the Federal Trade Commission, as well as at the state level.

Compliance with current or future privacy, data protection and information security laws (including those regarding security breach notification) affecting client or employee data to which we are subject could result in higher compliance and technology costs and could restrict our ability to provide certain products and services, which could have a material adverse effect on our business, financial condition or results of operations. Our failure to comply with data privacy, data protection and information security laws could result in potentially significant regulatory or governmental investigations or actions, litigation, fines, sanctions and damage to our reputation, which could have a material adverse effect on our business, financial condition or results of operations.

29

We face increased risk under the terms of the CRA as we accept additional deposits in new geographic markets.

Under the CRA, each appropriate federal bank regulatory agency is required, in connection with its examination of a bank, to assess such bank’s record in assessing and meeting the credit needs of the communities served by that bank, including low- and moderate-income neighborhoods. During these examinations, the regulatory agency rates such bank’s compliance with the CRA as “Outstanding,” “Satisfactory,” “Needs to Improve” or “Substantial Noncompliance.” The Bank had a CRA rating of “Satisfactory” as of its most recent CRA assessment. The regulatory agency’s assessment of an institution’s record is part of the regulatory agency’s consideration of applications to acquire, merge or consolidate with another banking institution or its holding company, or to open or relocate a branch office. As we accept additional deposits in new geographic markets, we will be required to maintain an acceptable CRA rating, which may be difficult.

We are subject to numerous laws designed to protect consumers, including the CRA and fair lending laws and failure to comply with these laws could lead to a wide variety of sanctions.

The CRA, the Equal Credit Opportunity Act, the Fair Housing Act and other fair lending laws and regulations impose nondiscriminatory lending requirements on financial institutions. The U.S. Department of Justice and other federal agencies are responsible for enforcing these laws and regulations. A successful regulatory challenge to an institution’s performance under the CRA or fair lending laws and regulations could result in a wide variety of sanctions, including damages and civil money penalties, injunctive relief, restrictions on mergers and acquisitions activity, restrictions on expansion and restrictions on entering new business lines. Private parties also could challenge an institution’s performance under fair lending laws in private class action litigation. Such actions could have a material adverse effect on our business, financial condition, results of operations and future prospects.

Risks Related to Our Stock

The price of our common stock could be volatile.

The market price of our common stock may be volatile and could be subject to wide price fluctuations in response to various factors, some of which are beyond our control. These factors include, among other things, actual or anticipated variations in our quarterly or annual results of operations; recommendations by securities analysts; operating performance or fluctuations in the stock price performance of other companies that investors deem comparable to us; news reports relating to trends, concerns and other issues in the financial services industry generally; conditions in the banking industry such as credit quality and monetary policies; domestic and international economic factors unrelated to our performance; perceptions, general market conditions and, in particular, developments related to market conditions for the financial services industry; loss of investor confidence in the market for stocks; new technology used, or services offered, by competitors; loss of investor confidence and changes in government regulations. If any of the foregoing occurs, it could cause our stock price to fall and may expose us to lawsuits that, even if unsuccessful, could be costly to defend and be a distraction to management.

Kansas law and the provisions of our articles of incorporation and bylaws may have an anti-takeover effect and there are substantial regulatory limitations on changes of control of bank holding companies.

Collectively, Kansas corporate law, provisions of our articles of incorporation and our bylaws and other statutory and regulatory provisions may delay, prevent or deter a merger, acquisition, tender offer, proxy contest or other transaction that might otherwise result in our stockholders receiving a premium over the market price for their stock. Furthermore, with certain limited exceptions, federal regulations prohibit a person or company or a group of persons deemed to be “acting in concert” from, directly or indirectly, acquiring more than 10%, or 5% if the acquirer is a bank holding company, of any class of our voting stock or obtaining the ability to control in any manner the election of a majority of our directors or otherwise direct the management or policies of our Company without prior notice or application to and the approval of the Federal Reserve. Accordingly, prospective investors need to be aware of and comply with these requirements, if applicable, in connection with any purchase of shares of our common stock. The combination of these provisions effectively inhibits certain business combinations, which, in turn, could adversely affect the market price of our common stock.

Shares of our preferred stock rank prior to our common stock with respect to dividends, distributions and payments upon liquidation and have other terms that could negatively impact the value of shares of our common stock or make it difficult for another company to acquire us.

Our articles of incorporation authorize us to issue up to 5,000,000 shares of one or more series of preferred stock, and in 2023 we issued shares of Series A Non-Cumulative Perpetual Preferred Stock (the “Series A Preferred Stock”). So long as

30

any Series A Preferred Stock remains outstanding, unless full dividends for the most recently completed dividend period have been declared and paid (or declared and the payment amount has been set aside), we may not, subject to certain exceptions, declare, pay or set aside for payment any dividend on our common stock, or repurchase or redeem our common stock. Upon our liquidation, dissolution, or winding-up, holders of Series A Preferred Stock are entitled to be paid out of our assets legally available for distribution to stockholders before any distribution of assets is made to holders of common stock, a liquidating distribution in the amount of the liquidation preference of $1,000 per share, plus any declared and unpaid dividends prior to the payment of the liquidating distribution. Holders of the Series A Preferred Stock also have certain approval rights with respect to certain changes in the terms of the Series A Preferred Stock, the issuance of capital stock ranking senior to the Series A Preferred Stock, certain fundamental business transactions and as otherwise required by applicable law, subject to certain limitations. Our obligations to the holders of Series A Preferred Stock could limit our ability to obtain additional financing or increase our borrowing costs, which could have an adverse effect on the value of our common stock. If we issue additional shares of preferred stock in the future, they would likely also have preference over our common stock with respect to payment of dividends or upon our liquidation, dissolution or winding up. So long as we have preferred stock outstanding, the rights of the holders of our common stock could be adversely affected, and it could be more difficult for another company to acquire us.

Future equity issuances could result in dilution, which could cause the price of our shares of common stock to decline.

We are generally not restricted from issuing additional shares of stock (up to the limits set forth in our articles of incorporation), subject to the approval of the Series A Preferred Stock holders with respect to certain issuances of preferred stock. We may issue additional shares of our common stock in the future in various transactions, including pursuant to current or future equity compensation plans, upon conversions of preferred stock or debt, upon exercise of warrants or in connection with future acquisitions or financings. If we choose to issue additional shares of our common stock, or securities convertible into shares of our common stock, for any reason, the issuance would have a dilutive effect on the holders of our common stock and could adversely affect the market price of our common stock.

Our dividend policy may change without notice, and our future ability to pay dividends is subject to restrictions.

Holders of our common stock are entitled to receive only such dividends as our Board of Directors may declare out of funds legally available for such payments. The Federal Reserve has indicated that bank holding companies should carefully review their dividend policy in relation to the organization’s overall asset quality, current and prospective earnings and capital level, composition and quality. Furthermore, the Federal Reserve may prohibit payment of dividends that are deemed unsafe or unsound practice. Accordingly, any declaration and payment of dividends on our common stock will depend upon many factors, including our earnings and financial condition, liquidity and capital requirements, the general economic and regulatory climate, our ability to service any equity or debt obligations senior to our common stock, our capital management policies and strategic plans; our growth initiatives; and other factors deemed relevant by our Board of Directors. Any such factor could adversely affect the amount of dividends, if any, paid to our common stockholders. If declared, dividends will be payable to the holders of shares of our common stock on a pro rata basis in accordance with their shares held. Our shares of Series A Preferred Stock are entitled to priority over the common shares as to dividends. Other than the stock dividend provided to our stockholders pursuant to our two-for-one stock split in 2018, we have no history of paying dividends to holders of our common stock.

We are a bank holding company and our only source of cash, other than further issuances of securities, is distributions from our wholly owned subsidiaries.

We are a bank holding company that is legally separate and distinct from CrossFirst Bank, our wholly-owned banking subsidiary. We have no material activities other than activities incidental to holding the common stock of the Bank. Our principal source of funds to pay distributions on our common stock and service any of our obligations, other than further issuances of securities, is dividends received from our wholly owned subsidiaries. Furthermore, our wholly owned subsidiaries are not obligated to pay dividends to us and any dividends paid to us would depend on the earnings or financial condition of our wholly owned subsidiaries and various business considerations. As is the case with all financial institutions, the profitability of our wholly owned subsidiaries is subject to the fluctuating cost and availability of money, changes in interest rates and economic conditions in general. In addition, various federal and state statutes limit the amount of dividends that our wholly owned subsidiaries may pay to the Company without regulatory approval.

31

As an emerging growth company (“EGC”), we utilize certain exemptions from disclosure requirements which could make our shares less attractive to investors and make it more difficult to compare our performance with other public companies.

As an EGC, we are not required to comply with, among others, auditor attestation requirements relating to management’s assessment of the effectiveness of the Company's internal control over financial reporting or certain executive compensation disclosures. In addition, as an EGC we are not required to comply with new or revised financial accounting standards until private companies are required to comply (unless we elect to adopt the new or revised standard sooner). This may make the comparison of our financial statements with other public companies difficult or impossible because of the potential differences in accounting standards used. If some investors find our shares less attractive as a result of our reliance on these exemptions, the trading prices of our shares may be lower than they otherwise would be.

ITEM 1B.UNRESOLVED STAFF COMMENTS

None.

ITEM 1C.CYBERSECURITY

The Company maintains a cyber security risk management program designed to prevent, detect and respond to information security threats. The program is designed to align with the National Institute of Standards and Technology (NIST) Cybersecurity Framework, as well as the banking-specific framework from the FFIEC’s Cybersecurity Assessment Tool (CAT). The Company’s program is led by our Chief Technology Officer (“CTO”) and chief information security officer (“CISO”), whose teams are responsible for leading short and long-term enterprise-wide cybersecurity strategy, policy, standards, monitoring, architecture and processes. The CTO chairs the Bank’s Technology, Operations, and Compliance (“TOC”) Committee, which has primary management responsibility for oversight of operations, technology and operational risk, including information security, fraud, vendor, data protections and privacy, business continuity and cybersecurity risks. TOC meets at least quarterly to assess, among other things, cyber threats or risks to the Company and drive awareness and alignment across the Company for effective cybersecurity risk management and reporting.

The Risk Committee of the Board of Directors (the “Risk Committee”) is responsible for reviewing the Company’s information security programs, including oversight of cybersecurity risks and threats. The Risk Committee receives quarterly reports from our CISO and CTO on, among other things, the Company’s cyber risks and threats, the status of projects to strengthen the Company’s information security program, the emerging threat landscape and key metrics from cybersecurity systems and monitoring. The Company’s cyber security program and technology program are periodically audited by internal audit or independent third-party audit firms, and the results of these audits are reported to the Risk Committee, as well as the Audit Committee of the Board of Directors.

The Company’s processes for assessing, identifying, and managing material risks from cybersecurity threats include using a wide-range of industry-leading security tools, regularly updating our technology roadmaps, and mandating cybersecurity awareness, business continuity, and incident response training for all employees. This training is also supplemented with periodic phishing tests.

We have a detailed incident response plan in place in the event of a cybersecurity incident for contacting authorities and informing key stakeholders to ensure that any non-routine events are properly escalated. The Company participates in cybersecurity incident response exercises to test pre-planned response actions from the Company’s plan and to facilitate group discussions regarding the effectiveness of the Company’s cybersecurity incident response strategies and tactics. We use a third-party Security Operations Center to provide 24x7x365 monitoring of logs, administrator and user actions, network and security appliances, and endpoint agents, and our CISO and CTO actively engage with key vendors, industry participants, the U.S. Department of Homeland Security, and intelligence and law enforcement communities. The company also maintains a vendor relationship with a cyber security firm that supports the Bank to review and mitigate any potential cyber incidents. Strong vendor management and monitoring controls are enforced and require, at a minimum, annual due diligence on critical vendors.

As of the date of this report, cybersecurity threats have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. See Item 1A. Risk Factors for information on the risks that cybersecurity threats pose to the Company.

32

ITEM 2.PROPERTIES

Our headquarters is located at 11440 Tomahawk Creek Parkway, Leawood, Kansas. Including our headquarters building, we operate 15 full-service banking centers located in: Leawood, Kansas; Wichita, Kansas; Kansas City, Missouri; Oklahoma City, Oklahoma; Tulsa, Oklahoma; Dallas, Texas; Fort Worth, Texas; Frisco, Texas; Phoenix, Arizona; Tucson, Arizona; Denver, Colorado; Colorado Springs, Colorado and Clayton, New Mexico. We own our headquarters building, our banking centers in Leawood, Kansas, Wichita, Kansas, Oklahoma City, Oklahoma, Tucson, Arizona, and Clayton, New Mexico, and we lease the remainder of our locations. We believe that the leases to which we are subject are generally on terms consistent with prevailing market terms. We also believe that our facilities are in good condition and are adequate to meet our operating needs for the foreseeable future.

ITEM 3.LEGAL PROCEEDINGS

In the normal course of business, we are named or threatened to be named as defendant in various lawsuits. Management, following consultation with legal counsel, does not expect the ultimate disposition of any one matter or a combination of these matters to have a material adverse effect on our business, financial condition, results of operations, cash flows or growth prospects. However, given the nature, scope and complexity of the extensive legal and regulatory landscape applicable to our business (including laws and regulations governing consumer protection, fair lending, fair labor, privacy, information security and anti-money laundering and anti-terrorism laws), we, like all banking organizations, are subject to heightened legal and regulatory compliance and litigation risk.

ITEM 4.MINE SAFETY DISCLOSURES

Not applicable.

INFORMATION ABOUT OUR EXECUTIVE OFFICERS

The following table sets forth certain information regarding our executive officers and the executive officers of the Bank, including their names, ages and positions as of February 29, 2024:

Name	Age	Position(s)
Michael J. Maddox	54	President and Chief Executive Officer of the Company and Chief Executive Officer of the Bank
W. Randall Rapp	59	President of the Bank
Benjamin R. Clouse	50	Chief Financial Officer of the Company and the Bank
Amy J. Fauss	56	Chief Operating Officer of the Company and the Bank
Jennifer M. Payne	47	Chief Risk Officer of the Company and the Bank
Amy C. Abrams	41	General Counsel and Corporate Secretary of the Company and the Bank
Meggin A. Nilssen	42	Chief Marketing Officer and Chief of Staff of the Company and the Bank

Michael J. Maddox—Mr. Maddox has served as President and Chief Executive Officer of the Company since June 1, 2020, and as Chief Executive Officer of the Bank since November 28, 2008. He also served as President of the Bank from November 2008 until June 2022, when the roles of Chief Executive Officer and President of the Bank were split. Prior to joining the Bank, he was a Regional President for Intrust Bank. In this role, he managed Intrust Bank’s operations in Northeast Kansas. Mr. Maddox has over 20 years of banking experience. Mr. Maddox attended the University of Kansas from which he received a Business degree and a law degree. While at KU, Mr. Maddox was a four-year basketball letterman and a member of the KU team that won the National Championship in 1988. Mr. Maddox completed the Graduate School of Banking at the University of Wisconsin - Madison in 2003. Mr. Maddox is involved with a number of community organizations, including the Kansas City Civic Council, KU Advancement Board, KU School of Business Dean’s Advisory Board and YPO. He has served on the board of CrossFirst Bank since 2008 and currently serves as Chairman of the Board of CrossFirst Bank.

W. Randall Rapp—Mr. Rapp was appointed President of the Bank effective July 1, 2022. He served as the Chief Risk and Credit Officer for the Bank from April 2021 until July 2022, and Chief Credit Officer of the Bank from April 2019 until April 2021. Prior to joining the Bank, Mr. Rapp held various positions at Texas Capital Bank, N.A. from March 2000 until

33

March 2019, including serving as Executive Vice President and Chief Credit Officer from May 2015 until March 2019, and as a Senior Credit Officer from 2013 until May 2015. He has more than three decades of commercial banking experience, most of which has been spent in credit management for private and public banks in the Dallas/Fort Worth metroplex. He earned a BBA in Accounting from The University of Texas at Austin and an MBA in Finance from Texas Christian University. He is also a licensed CPA. Mr. Rapp is a member of the CrossFirst Bank Board of Directors.

Benjamin R. Clouse—Mr. Clouse has served as Chief Financial Officer of the Company since July 2021, leading the financial organization and overall long-range financial planning and reporting of the Company and the Bank, as well as supporting the execution of the Bank’s growth strategy. He also serves as Chief Financial Officer and Cashier of the Bank. Prior to joining CrossFirst, Mr. Clouse served as Chief Financial Officer of Waddell & Reed Financial, Inc., a financial services firm, from 2018 until its acquisition in 2021. Mr. Clouse held a variety of other senior leadership roles at Waddell & Reed between October 2015 and February 2018, including Vice President and Chief Accounting Officer, Vice President and Principal Accounting Officer and Vice President. Prior to joining Waddell & Reed, Mr. Clouse served as Chief Financial Officer of Executive AirShare Corporation, a private aviation company, from September 2012 to October 2015. From 2006 to 2012 and from 2002 to 2005, he served in various roles with H&R Block, Inc., a tax preparation company in Kansas City, Missouri, including Assistant Vice President—Audit Services and Assistant Vice President and Controller—Tax Services. From 2005 to 2006, Mr. Clouse served as Vice President—Finance and Corporate Controller of Gold Bank Corporation, Inc., a bank holding company. From September 1996 to January 2002, he served in various roles in the audit practice of Deloitte. Mr. Clouse obtained a business degree and a Master of Accountancy degree from Kansas State University.

Amy J. Fauss—Ms. Fauss has held multiple executive leadership roles for the Company and the Bank, currently serving as Chief Operating Officer. Prior to returning to the Chief Operating Officer role, Ms. Fauss served as Chief Human Resources Officer and Chief Administrative Officer of the Company and the Bank from May 2023 to February 2024; Chief Human Resources Officer of the Company and the Bank from January 2021 until May 2023; and Chief Operating Officer of the Bank from December 2009 until June 2022. Prior to joining CrossFirst, she served as Executive Vice President and Chief Operating Officer of Solutions Bank, where she directed all aspects of daily operations and human resources. Her experience also includes senior management positions at Hillcrest Bank and Citizens-Jackson County Bank. Ms. Fauss holds a Bachelor of Science degree in Finance from Central Missouri State University and an MBA from University of Missouri – Kansas City. She has also completed the Graduate School of Banking at the University of Wisconsin – Madison.

Jennnifer M. Payne – Ms. Payne joined the Bank in 2020 as Director, Risk Management and was promoted to Chief Risk Officer in July 2022. In this role, she is responsible for the design, implementation and leadership of the Bank’s enterprise-wide risk management program strategy and framework consistent with the Board-approved risk appetite framework, risk tolerances and risk profile, as well as identifying, monitoring and assessing material and emerging risks for the Company. Prior to joining the Bank, Ms. Payne held various roles at UMB Financial Corporation/UMB Bank, including Chief Risk Officer from 2016 to 2019, Director, Corporate Risk Services from 2012 to 2015 and Director, Internal Audit from 2005 to 2012. Her experience also includes audit and risk roles at Sprint Corporation and Arthur Andersen. Ms. Payne holds a Bachelor of Science in Business Administration from Kansas State University.

Amy C. Abrams – Ms. Abrams has been General Counsel and Corporate Secretary of the Company and the Bank since June 2022. As General Counsel and Corporate Secretary, Ms. Abrams is responsible for the oversight of CrossFirst’s legal affairs and corporate governance matters. Prior to joining the Company and the Bank, Ms. Abrams provided legal assistance to Cerner Corporation and its global affiliates (“Cerner”) from October 2011 until May 2022, most recently serving as Lead Counsel – SEC & Corporate and Assistant Secretary. Cerner (acquired by Oracle Corporation) was a supplier of healthcare information technology services, devices, and hardware. Prior to Cerner, Ms. Abrams was an attorney at the law firm of Polsinelli P.C. Ms. Abrams earned her Juris Doctorate degree from Loyola University-Chicago School of Law and has a business degree from the University of Kansas.

Meggin A. Nilssen – Ms. Nilssen joined the Bank in 2016 and has held various leadership roles, currently serving as Chief Marketing Officer and Chief of Staff of the Company and the Bank. In this role, she is responsible for driving the Bank’s vision of helping people achieve their financial dreams by building marketing programs and aligning the prioritization of the Company’s strategic initiatives. Prior to joining the Bank, Ms. Nilssen served as the Vice President, Sales Management of Bank of Blue Valley. During her 17-year career, she served in a number of roles, including innovation, brand management, advertising, treasury sales, and operations. Ms. Nilssen earned a Bachelor of Science degree from Emporia State University.

34

Part II

ITEM 5. MARKET FOR REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES

Our common stock is traded on the Nasdaq Global Select Market under the symbol “CFB.” We had 310 holders of record at February 23, 2024. Management estimates that the number of beneficial owners is significantly greater.

Performance Graph

The following table and graph sets forth the cumulative total stockholder return for the Company’s common stock from August 15, 2019 (the date that our common stock commenced trading on the Nasdaq Global Select Market) through December 29, 2023 (the last trading day of the year), compared to an overall stock market index (Russell 2000 Index) and one peer group index (KBW Nasdaq Regional Banking Index) for the same period. The indices are based on total returns assuming reinvestment of dividends. The graph assumes an investment of $100 on August 15, 2019. The performance graph represents past performance and should not be considered to be an indication of future performance.

The performance graph and related text are being furnished to and not filed with the SEC, and will not be deemed “soliciting material” or subject to Regulation 14A or 14C under the Exchange Act or to the liabilities of Section 18 of the Exchange Act, and will not be deemed to be incorporated by reference into any filing under the Securities Act or the Exchange Act, except to the extent we specifically incorporate such information by reference into such a filing.

	8/15/2019		12/31/2019		12/31/2020		12/31/2021		12/30/2022		12/29/2023
CrossFirst Bankshares, Inc.	$	100.00	$	99.45	$	73.63	$	106.92	$	85.00	$	93.01
Russell 2000 Index	$	100.00	$	114.85	$	137.77	$	158.19	$	125.86	$	147.17
KBW Nasdaq Regional Banking Index	$	100.00	$	116.94	$	102.79	$	136.92	$	123.86	$	119.00

Dividends

Historically, CrossFirst has not declared or paid any dividends on its common stock. Payments of future dividends, if any, will be at the discretion of our Board of Directors and will depend upon our results of operations, our financial

35

condition, capital requirements, general economic conditions, regulatory and contractual restrictions, our business strategy, our ability to service any equity or debt obligations senior to our common stock and other factors that our Board of Directors deems relevant. We are not obligated to pay dividends on our common stock and are subject to restrictions on paying dividends on our common stock.

Our principal source of funds to pay dividends on our common stock would be dividends received from our wholly-owned subsidiaries. Furthermore, our wholly-owned subsidiaries are not obligated to pay dividends to us, and any dividends paid to us would depend on the earnings or financial condition of our wholly-owned subsidiaries and various business considerations. As is the case with all financial institutions, the profitability of our wholly-owned subsidiaries is subject to the fluctuating cost and availability of money, changes in interest rates and economic conditions in general. In addition, various federal and state statutes limit the amount of dividends that our wholly-owned subsidiaries may pay to the Company without regulatory approval.

Share Repurchase Program

On May 10, 2022, the Company announced that its Board of Directors approved a share repurchase program under which the Company may repurchase up to $30 million of its common stock. No shares were repurchased during the three-months ended December 31, 2023. As of December 31, 2023, approximately $16 million remains available for repurchase under this share repurchase program. Repurchases under the program may be made in open market or privately negotiated transactions in compliance with SEC Rule 10b-18, subject to market conditions, applicable legal requirements and other relevant factors. The program does not obligate the Company to acquire any amount of common stock, and it may be suspended at any time at the Company’s discretion. No time limit has been set for completion of the program.

Securities Authorized for Issuance Under Equity Compensation Plans

See Part III, Item 12 for information relating to securities authorized for issuance under our equity compensation plans.

ITEM 6.[RESERVED]

36

ITEM 7. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

Overview

This section includes a discussion of the financial condition and results of operations of CrossFirst Bankshares, Inc. and its subsidiaries. Refer to Management’s Discussion and Analysis of Financial Condition and Results of Operations in our 2022 Form 10-K filed with the SEC on March 3, 2023 for a discussion of the financial condition and results of operations of the Company for the period ended December 31, 2021 and a comparison between the 2022 and 2021 results.

Tables may include additional periods to comply with disclosure requirements or to illustrate trends in greater depth. You should read the following financial data in conjunction with the other information contained in this 10-K, including under “Part I, Item 1A. Risk Factors,” and in the financial statements and related notes included elsewhere in this 10-K.

Growth History

We have grown organically primarily by establishing our branch light network in seven states, attracting new clients and expanding our relationships with existing clients, as well as through four strategic acquisitions. The data below presents the business’ growth in key areas for the past five years and the related compound annual growth rate (“CAGR”):

	2019 to 2023		As of December 31,
	CAGR		2023		2022		2021		2020		2019
	(Dollars in thousands)
Available-for-sale (“AFS”) securities	1	%	$	766,653	$	686,901	$	745,969	$	654,588	$	739,473
Gross loans (net of unearned income)(1)	12			6,127,690		5,372,729		4,256,213		4,441,897		3,852,244
Total assets	11			7,380,680		6,601,086		5,621,457		5,659,303		4,931,233
Non-interest-bearing deposits	17			990,458		1,400,260		1,163,224		718,459		521,826
Total deposits	13	%	$	6,491,276	$	5,651,308	$	4,683,597	$	4,694,740	$	3,923,759

⁽¹⁾ Includes $2 million, $3 million and $65 million of Paycheck Protection Program (“PPP”) loans at December 31, 2023, 2022 and 2021, respectively.

Performance Measures

	As of or for the Year Ended December 31,
	2023			2022			2021
	(Dollars in thousands, except per share data)
Return on average assets		0.95	%		1.07	%		1.24	%
Adjusted return on average assets(1)		1.04	%		1.19	%		1.31	%
Return on average common equity		10.36	%		9.97	%		10.84	%
Adjusted return on average common equity(1)		11.32	%		11.11	%		11.40	%
Basic earnings per common share	$	1.35		$	1.24		$	1.35
Diluted earnings per common share	$	1.34		$	1.23		$	1.33
Adjusted diluted earnings per common share(1)	$	1.47		$	1.37		$	1.40
Efficiency ratio(2)		59.84	%		57.75	%		54.50	%
Adjusted efficiency ratio - fully tax equivalent ("FTE")(1)(2)(3)		55.17	%		54.40	%		52.02	%
Ratio of equity to assets		9.59	%		9.22	%		11.88	%

⁽¹⁾ Represents a non-GAAP financial measure. See “Non-GAAP Financial Measures” below for a reconciliation of these measures.

⁽²⁾ We calculate efficiency ratio as non-interest expense divided by the sum of net interest income and non-interest income.

⁽³⁾ Tax exempt income (tax-free municipal securities) is calculated on a tax equivalent basis. The incremental tax rate used is 21.0%.

37

2023 Highlights

● Improved profitability as operating revenue and diluted earnings per common share increased compared to the prior year

● Total assets were $7.4 billion primarily made up of $6.1 billion in loans and $767 million in securities

● Loans grew $755 million for the year or 14%; excluding the Tucson acquisition, loans grew 12% for the year

● Deposits grew $840 million for the year or 15%; excluding the Tucson acquisition, deposits grew 12% for the year

● Non-performing assets were 0.34% of total assets at year-end; net charge-offs for the full year were 0.09% of average loans

● Reduced non-interest expense for the fourth quarter of 2023 compared to the prior quarter and the same quarter in the prior year as we realized anticipated synergies from our acquisitions as well as executed on targeted efficiency initiatives

● Issued $7.8 million of Series A Preferred Stock, further bolstering our capital position

● Grew book value per share 14% to $14.35 at December 31, 2023. Tangible book value per share⁽¹⁾ also grew 13% to $13.56

● Built capital in a tough operating environment with total risk-based capital increasing to 11.2% and common equity Tier 1 capital increasing to 10.0%

● Executed a bond portfolio repositioning, which is expected to benefit future earnings and improve liquidity and regulatory capital ratios; The $1.1 million pre-tax loss on sale is expected to have less than a one-year earn back

● Completed the Tucson acquisition, adding liquidity and talent while deepening our Arizona franchise

o Added $106 million of loans net of $5.2 million in acquired loan marks, $165 million of deposits and $4.5 million of core deposit intangible

● Opened a second Dallas branch and one in Fort Worth to expand our footprint in the Dallas-Fort Worth metro market

(1) Represents a non-GAAP financial measure. See “Non-GAAP Financial Measures” below for a reconciliation of these measures.

Banking Industry Events

The banking industry faced significant upheaval due to the collapse of several banks in March 2023 related to failings in their liquidity management and their significant concentration in certain industries, including exposure to the technology sector and cryptocurrency. We do not have significant industry concentration or any significant exposure to the technology or crypto sectors. Competition for deposits was exacerbated by renewed focus on deposits in excess of FDIC insurance limits following the failures, in addition to increased focus on liquidity and interest rate management at all banks. These challenges, combined with uncertainties around continued cost pressures from inflation, FDIC special assessments and potential for higher provisioning for expected credit losses all led to a highly volatile market for banks. We focused on the following strategies and data:

● Mobilized our business continuity team and aspects of our contingency funding plan in response to the headline and publicity risk created by the bank failures

38

● Conducted frequent executive team meetings (including daily during certain periods) during March to monitor our response, which was focused on client outreach and maintaining and increasing liquidity

● Expanded liquidity available at the Federal Reserve Bank by pledging additional loans

● Conducted proactive client outreach by bankers to communicate the strength, stability and relationship focus that clients have come to expect from CrossFirst Bank

● Improved liquidity in our securities portfolio

● Expanded our utilization of the Intrafi network as we served clients who were interested in the program; our insured cash sweep offering dates back to 2013

Concentrations

As of December 31, 2023, the Company’s top 25 largest borrowing relationships totaled approximately $1.9 billion in total commitments, representing, in the aggregate, 23% of our total outstanding commitments. As of December 31, 2023, the Company’s top 25 deposit relationships represented approximately 20%, or $1.3 billion, of total deposits. The majority of the $1.3 billion are money market deposit accounts and insured cash sweep deposits. The Company believes that there are sufficient funding sources, including on-balance sheet liquid assets and wholesale deposit options, so that an immediate reduction in these deposit balances would not be expected to have a materially detrimental effect on the Company’s financial position or operations.

Discussion and Analysis - Results of Operations

Income from Operations

Net income totaled $66.7 million, or $1.34 per diluted common share, for 2023, compared to $61.6 million, or $1.23 per diluted common share for 2022. Higher net interest income and non-interest income more than offset higher provision expense and non-interest expense. Full year adjusted net income⁽¹⁾ of $72.8 million, or $1.47 per diluted common share on an adjusted basis⁽¹⁾, increased compared to $68.6 million, or $1.37 per diluted common share on an adjusted basis⁽¹⁾, for the prior year.

Return on average assets was 0.95% for the year ended December 31, 2023. Adjusted return on average assets⁽¹⁾ was 1.04% for the same period. Return on average common equity was 10.36% for the year ended December 31, 2023. Adjusted return on average common equity⁽¹⁾ was 11.32% for the same period.

⁽¹⁾ Represents a non-GAAP financial measure. See "Non-GAAP Financial Measures" below for a reconciliation of these measures.

Net Interest Income

Our profitability depends in substantial part on our net interest income, which is presented on a GAAP and FTE basis. We believe reporting on an FTE basis provides for improved comparability between the various earning assets. Changes in interest income and interest expense result from changes in average balances (volume) of interest-earning assets and interest-bearing liabilities, as well as changes in interest yields.

39

The following table presents, for the periods indicated, average statement of financial condition information, interest income, interest expense and the corresponding yield and rates paid:

	For the Years Ended December 31,
	2023						2022						2021
			Interest						Interest						Interest
	Average		Income /				Average		Income /				Average		Income /
	Balance		Expense		Yield / Rate(5)		Balance		Expense		Yield / Rate(5)		Balance		Expense		Yield / Rate(5)
	(Dollars in thousands)
Interest-earning assets:
Securities - taxable	$	343,451	$	12,378	3.60	%	$	220,760	$	5,286	2.39	%	$	201,419	$	3,955	1.96	%
Securities - tax-exempt - FTE(1)		500,781		16,754	3.35			551,734		18,559	3.36			488,544		16,981	3.48
Federal funds sold		562		13	2.31			3,139		49	1.56			—		—	—
Interest-bearing deposits in other banks		175,353		8,004	4.56			239,240		3,702	1.55			389,893		502	0.13
Gross loans, net of unearned income(2)(3)		5,821,027		400,910	6.89			4,603,697		224,138	4.87			4,340,791		174,660	4.02
Total interest-earning assets - FTE(1)		6,841,174	$	438,059	6.40	%		5,618,570	$	251,734	4.48	%		5,420,647	$	196,098	3.62	%
Allowance for credit losses(4)		(67,687)						(57,388)						(73,544)
Other non-interest-earning assets		225,408						198,849						244,368
Total assets	$	6,998,895					$	5,760,031					$	5,591,471
Interest-bearing liabilities
Transaction deposits	$	661,700	$	21,137	3.19	%	$	538,604	$	4,951	0.92	%	$	608,063	$	1,152	0.19	%
Savings and money market deposits		2,798,937		111,339	3.98			2,475,891		33,599	1.36			2,338,315		8,225	0.35
Time deposits		1,572,352		69,336	4.41			688,095		11,432	1.66			812,774		9,146	1.13
Total interest-bearing deposits		5,032,989		201,812	4.01			3,702,590		49,982	1.35			3,759,152		18,523	0.49
FHLB and short-term borrowings		210,838		8,258	3.92			232,018		4,855	2.09			279,379		5,840	2.09
Trust preferred securities, net of fair value adjustments		1,084		240	22.14			1,072		142	13.25			982		96	9.76
Non-interest-bearing deposits		1,005,722		—	—			1,146,594		—	—			876,309		—	—
Cost of funds		6,250,633	$	210,310	3.36	%		5,082,274	$	54,979	1.08	%		4,915,822	$	24,459	0.50	%
Other liabilities		102,735						60,175						35,447
Stockholders’ equity		645,527						617,582						640,202
Total liabilities and stockholders’ equity	$	6,998,895					$	5,760,031					$	5,591,471
Net interest income - FTE(1)			$	227,749					$	196,755					$	171,639
Net interest spread - FTE(1)					3.04	%					3.40	%					3.12	%
Net interest margin - FTE(1)					3.33	%					3.50	%					3.17	%

⁽¹⁾ Calculated on an FTE basis. Tax-free municipal securities are exempt from Federal taxes. The incremental tax rate used is 21%.

⁽²⁾ Loans, net of unearned income includes non-accrual loans of $18 million, $11 million and $31 million as of December 31, 2023, 2022 and 2021, respectively.

⁽³⁾ Loan interest income includes loan fees of $14 million, $14 million and $18 million for the years ended December 31, 2023, 2022 and 2021, respectively.

⁽⁴⁾ For 2021, this line represents the allowance for loan losses.

⁽⁵⁾ Actual unrounded values are used to calculate the reported yield or rate disclosed. Accordingly, recalculations using the amounts in thousands as disclosed in this report may not produce the same amounts.

Full year net interest income was $224.8 million and $193.5 million for 2023 and 2022, respectively. Full year net interest income – FTE was $227.7 million, an increase of $31.0 million, or 16%, compared to 2022. The net interest margin was 3.29% and 3.44% for the years ended December 31, 2023 and 2022, respectively. The net interest margin – FTE for the full year narrowed to 3.33% from 3.50% in the prior year as our cost of funds rose more than our increase in yield on earning assets which was partially offset by the mix of earning assets and benefit of average non-interest-bearing deposits.

The yield on earning assets increased 1.92%, led by a 2.02% increase in loan yields driven by the repricing of existing variable rate loans and origination of new loans. The yield on the investment portfolio also increased 36 basis points. The cost of funds increased 2.28% over the same period due to pricing pressure on deposits as well as client migration into higher cost deposit products compared to the prior year.

Average earning assets increased to $6.8 billion due to $1.2 billion higher average loans and a $71.7 million increase in the average investment portfolio partially offset by $63.9 million lower average cash balances. Average loan balances were higher due to strong loan growth, both organically and due to the Tucson acquisition. The mix shift toward loans and investments contributed to an improvement in net interest margin compared to 2022. We currently expect the NIM – FTE will be in a range of 3.20% to 3.25% for 2024 with some potential for expansion in the event of rate cuts during 2024.

40

Provision for Credit Losses

	For the Year Ended December 31, 2023
	2023		2022		2021
	(Dollars in thousands)
Provision for credit losses - loans(1)	$	16,764	$	7,997	$	(4,000)
Provision for credit losses - off-balance sheet(1)		(2,275)		3,504		N/A
Total provision for credit losses	$	14,489	$	11,501	$	(4,000)

⁽¹⁾ For 2021 this line represents the provision for loan losses

Provision expense of $14.5 million for 2023 included $0.9 million in Day 1 reserves for the loan portfolio acquired from the Tucson acquisition. The remainder of the provision expense was due to loan growth, higher specific reserves and changes in underlying credit quality and economic factors, all partially offset by a decrease in unfunded commitments which lowered the off-balance sheet provision. Provision expense for 2022 totaled $11.5 million and included $4.6 million in Day 1 reserves for the loan portfolio acquired from the Colorado/New Mexico acquisition. The remainder of provision expense was due to strong loan growth and an increase in unfunded commitments, partially offset by lower specific reserves.

Non-interest Income

The components of non-interest income were as follows for the periods shown:

	For the Year Ended December 31,
						Change
	2023			2022		$		%
	(Dollars in thousands)
Service charges and fees on client accounts	$	8,186		$	6,228	$	1,958	31	%
ATM and credit card interchange income		5,469			6,523		(1,054)	(16)
Gain on sale of loans		2,684			47		2,637	5,611
Income from bank-owned life insurance		1,709			1,602		107	7
Swap fees and credit valuation adjustments, net		365			188		177	94
Other non-interest income		2,251			2,693		(442)	(16)
Total non-interest income	$	20,664		$	17,281	$	3,383	20	%
Non-interest income to average assets		0.30	%