10-K

Indicate by check mark if the Registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☐ No ☒

Indicate by check mark if the Registrant is not required to file reports pursuant to Section 13 or 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the Registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the Registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the Registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the Registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of "large accelerated filer," "accelerated filer," "smaller reporting company," and "emerging growth company" in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the Registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

The aggregate market value of the voting and non-voting common equity held by non-affiliates of the Registrant, based on the closing price of the Registrant’s common stock on the New York Stock Exchange on June 30, 2023, was approximately $441,941,160.

The number of shares of Registrant’s common stock outstanding as of March 1, 2024 was 44,378,792.

Portions of the Registrant’s Definitive Proxy Statement relating to its 2024 Annual Meeting of Stockholders, scheduled to be held on June 4, 2024, are incorporated by reference into Part III of this Report.

Statements contained in this Annual Report on Form 10-K and in other documents we file with or furnish to the Securities and Exchange Commission ("SEC") that are not historical facts may constitute "forward-looking statements" within the meaning of the U.S. Private Securities Litigation Reform Act of 1995. Any statements about our expectations, beliefs, plans, strategies, predictions, forecasts, objectives or assumptions of future events or performance are not historical facts and may be forward-looking. These statements are often, but not always, made through the use of words or phrases such as "anticipates," "believes," "expects," "can," "could," "may," "predicts," "potential," "opportunity," "should," "will," "estimate," "plans," "projects," "continuing," "ongoing," "expects," "seeks," "intends" and similar words or phrases. Accordingly, these statements involve estimates, known and unknown risks, assumptions and uncertainties that could cause actual strategies, actions or results to differ materially from those expressed in such statements, and are not guarantees of future results or other events or performance. Readers are cautioned not to place undue reliance on such statements.

Our ability to predict results or the actual effects of future plans, strategies or events is inherently uncertain. Factors which could cause actual results or conditions to differ materially from those reflected in forward-looking statements include:

•

uncertainty regarding domestic, foreign, and geopolitical developments and the United States and global economic outlook that may impact market conditions or affect demand for certain banking products and services, and the impact on our customers, which could impair the ability of our borrowers to repay outstanding loans and leases, impair collateral values and further increase our allowance for credit losses - loans and leases, as well as result in possible asset impairment charges;

•

unforeseen credit quality problems or changing economic conditions that could result in charge-offs greater than we have anticipated in our allowance for credit losses - loans and leases or changes in the value of our investments;

•

commercial real estate market conditions in the Chicago metropolitan area and southern Wisconsin;

•

deterioration in the financial condition of our borrowers resulting in significant increases in our loan and lease losses and provisions for those losses and other related adverse impacts to our results of operations and financial condition;

•

estimates of fair value of certain of our assets and liabilities, which could change in value significantly from period to period;

•

competitive pressures in the financial services industry in our market areas relating to both pricing and loan and lease structures, which may impact our growth rate;

•

unanticipated developments in pending or prospective loan and/or lease transactions or greater-than-expected paydowns or payoffs of existing loans and leases;

•

inaccurate information and assumptions in our analytical and forecasting models used to manage our balance sheet;

•

unanticipated changes in monetary policies of the Federal Reserve or significant adjustments in the pace of, or market expectations for, future interest rate changes;

•

availability of sufficient and cost-effective sources of liquidity, funding, and capital as and when needed;

•

our ability to attract, retain or the loss of key personnel or an inability to recruit appropriate talent cost-effectively;

•

adverse effects on our information technology systems resulting from failures, human error or cyberattack, including the potential impact of disruptions or security breaches at our third-party service providers, any of which could result in an information or security breach, the disclosure or misuse of confidential or proprietary information, significant legal and financial losses and reputational harm;

•

greater-than-anticipated costs to support the growth of our business, including investments in new lines of business, products and services, or technology, process improvements or other infrastructure enhancements, or greater-than-anticipated compliance or regulatory costs and burdens;

•

the impact of possible future acquisitions, if any, including the costs and burdens of integration efforts;

•

legislative or regulatory changes, particularly changes in regulation of financial services companies and/or the products and services offered by financial services companies;

•

changes in Small Business Administration ("SBA") and U.S. Department of Agriculture ("USDA") U.S. government guaranteed lending rules, regulations, loan and lease products and funding limits, including specifically the SBA Section 7(a) program, as well as changes in SBA or USDA standard operating procedures or changes to the status of Byline Bank as an SBA Preferred Lender;

•

changes in accounting principles, policies and guidelines applicable to bank holding companies and banking generally;

•

the impact of a possible change in the federal or state income tax rates on our deferred tax assets and provision for income tax expense;

•

the possibility that any of the anticipated benefits of acquisitions will not be realized or will not be realized within the expected time period;

•

the risk that the integration of acquisition operations will be materially delayed or will be more costly or difficult than expected;

These risks and uncertainties should be considered in evaluating any forward-looking statements, and undue reliance should not be placed on such statements. Additional information concerning the Company, including additional factors and risks that could materially affect our business and financial results, are included herein. See Item 1A. "Risk Factors". Forward-looking statements speak only as of the date they are made. We assume no obligation to update any of these statements in light of new information, future events or otherwise unless required under the federal securities laws.

Byline Bancorp, Inc., headquartered in Chicago, Illinois, is a bank holding company and we conduct all our business activities through our subsidiary, Byline Bank, a full service commercial bank, and Byline Bank’s subsidiaries. The words "the Company," "we," "Byline," "our" and "us" refer to Byline Bancorp, Inc. and its consolidated subsidiaries, unless we indicate otherwise.

We offer a broad range of banking products and services to small and medium sized businesses, commercial real estate and financial sponsors and to consumers who generally live or work near our branches. We also offer online account opening to consumer and business customers through our website and provide trust and wealth management services to our customers. In addition to our traditional commercial banking business, we provide small ticket equipment leasing solutions through Byline Financial Group, a wholly-owned subsidiary of Byline Bank, headquartered in Bannockburn, Illinois with sales offices in Illinois, and sales representatives in Illinois, Michigan, New Jersey, and New York. We participate in U.S. government guaranteed lending programs and originate U.S. government guaranteed loans. Byline Bank was the fifth most active originator of SBA loans in the country and the most active SBA lender in Illinois, and Wisconsin, as reported by the SBA for the fiscal year ended September 30, 2023. As of December 31, 2023, we had consolidated total assets of $8.9 billion, total gross loans and leases outstanding of $6.7 billion, total deposits of $7.2 billion, and total stockholders’ equity of $990.2 million.

As part of our strategic growth plan, we explore potential opportunities for expansion in our primary and adjacent market areas through organic growth and the acquisition of financial institutions, branches, and non-banking organizations.

We believe our local presence and our scale are essential to the continued growth of our deposit base. Small businesses are a significant source of low-cost deposits and represent opportunities for future growth. We believe our small business customers value our ability to provide convenience and access to local, responsive decision makers. As of December 31, 2023, commercial deposits accounted for 46.5% of total deposits and were 77.5% of non-interest bearing deposits. Commercial accounts generally have higher deposit balances and transaction volumes than individual deposit accounts.

Our ability to originate loans and leases across a range of industries and product types helps us maintain a diversified loan and lease portfolio across various sectors, including commercial and industrial lending, leasing, U.S. government guaranteed loans and real estate loans, allowing us to efficiently manage our credit exposures and capitalize on more lending opportunities. We have also enhanced our product and lending capabilities with the addition of experienced lending teams hired from larger banks.

The following charts outline the composition of our loan and lease and deposit portfolios as of December 31, 2023:

Our ability to engage in certain merger or acquisition transactions depends on a number of factors, including opportunities in our market areas, access to capital, our bank regulators' views at the time as to the capital levels, quality of management and our overall financial condition, in addition to their assessment of a variety of other factors, including our compliance with laws and regulations. We have successfully completed a number of strategic acquisitions since our recapitalization in 2013, which include:

On July 1, 2023, we completed our acquisition of Inland Bancorp, Inc. ("Inland Bancorp"), and Inland Bancorp's wholly owned bank subsidiary, Inland Bank and Trust, an Illinois chartered bank (collectively "Inland acquisition" or "acquisition of Inland"). Refer to Note 3—Acquisition of a Business contained within Part II, Item 8, Notes to the Consolidated Financial Statements of this document.

The primary market in which we operate is the Chicago metropolitan area, and our 47 branch network in this area is our core distribution channel. We take advantage of our focused footprint and deep-rooted relationships to target local customers with a diversified product offering.

Our local branch network enables us to gather low cost deposits, promote the Byline brand and customer loyalty, originate loans, leases and other products and maintain relationships with our customers through regular community involvement. We believe our branch network is fundamental to our ability to achieve successful customer outreach in line with our culture, which promotes high touch engagement with our customers and proactive solutions.

While our branch network continues to be our primary delivery channel, we understand the evolving banking environment requires digital interaction to keep pace with our customers’ needs. We continually perform strategic reviews of our branch network and our existing banking footprint. With technology improvements and changes to customers’ banking preferences, we examine branch growth and consolidation potential, customer usage, branch profitability, services provided, markets served and proximity to other locations with a goal of minimizing customer impact and deposit runoff.

Since our recapitalization in June 2013, our branch network has been reduced from 88 to 48, including 23 branches added through acquisition. During 2023, we added 10 branches within our network as part of our acquisition of Inland. In the first quarter of 2024, we announced plans to consolidate two branches during the second quarter of 2024. We expect these consolidations to generate approximately $1.1 million of annual cost savings and anticipate a one-time charge of $1.5 million.

We plan to continue to leverage our seasoned management team, the attractive market opportunity in the Chicago metropolitan area, our diversified lending approach and our track record of successfully integrating acquisitions to drive future growth. We believe that having a deep understanding of customers, longstanding ties to the communities in which we operate, a strong market position, and exceptional employees allow us to provide the attention, responsiveness, and customized service our customers seek while offering a diverse range of products to serve a variety of needs.

We have one reportable segment. Our chief operating decision makers evaluate our business and operations using consolidated information for purposes of allocating resources and assessing performance.

We are a full service, commercial bank offering a broad range of deposit products and lending services to small and medium sized businesses, commercial real estate and financial sponsors, and consumers around our 47 branch locations in the Chicago metropolitan area and one branch in Wauwatosa, Wisconsin. The products and services we offer are described below.

Commercial banking is a fundamental component of our business. We define commercial banking as lending to small and medium sized businesses, real estate and financial sponsors. We offer a comprehensive range of commercial loan, deposit and treasury management products. Our primary commercial lending groups are described below:

Commercial & Industrial. Our commercial and industrial ("C&I") group focuses on small and lower middle market businesses with up to $100 million of annual revenue and seeks to establish long term relationships. We believe this customer segment is underserved by larger institutions that do not focus on this space, as well as by smaller institutions that lack product sophistication and capabilities. We offer a broad range of lending products including term loans, revolving lines of credit and treasury management products and services. As of December 31, 2023, the C&I group managed a portfolio of $2.7 billion in loans outstanding.

Commercial real estate. Our commercial real estate ("CRE") business focuses on experienced real estate professionals with long track records of performance and access to ample equity capital sources. We believe our specialized expertise and efficient decision making process differentiate us from our competitors. We offer fixed and floating rate term loans, construction financing and revolving lines of credit with a wide range of term options. Our portfolio is broadly diversified by geography and property type including loans secured by multifamily, industrial, retail, and office properties. As of December 31, 2023, the CRE group had $1.3 billion in loans outstanding.

Sponsor finance. Our sponsor finance group provides senior secured financing solutions to private equity backed lower middle market companies throughout the U.S. with earnings before interest, tax, depreciation and amortization generally between $2.0 million and $10.0 million. We support the acquisition, recapitalization and growth investment efforts of private equity firms operating in the lower middle market, and we believe our expertise in this niche is unique for a bank our size. As of December 31, 2023, we had $658.9 million in sponsor finance loans outstanding.

Syndications. From time to time, our syndications group seeks to deploy excess liquidity by opportunistically participating in syndicated loans, acquiring whole loans, or purchasing participations from lead banks that have existing relationships with well capitalized and experienced sponsors. We employed this strategy extensively following our recapitalization by leveraging our relationships with local, regional and national lenders as we developed our own lending capabilities and had excess liquidity. Now, with developed lending capabilities, our participation in syndications has decreased and represents a smaller portion of our portfolio. The syndications group targets transactions in the home mortgage, CRE, and C&I categories that provide attractive risk/reward characteristics, and we continue to maintain the ability to sell loan positions to manage credit and specific customer and industry concentrations. As of December 31, 2023, the group had $385.7 million in loan syndications outstanding.

Commercial deposits and treasury management. We also support our business customers with a variety of deposit and treasury management products, along with business transaction accounts. Our comprehensive suite of products includes treasury services, information reporting, fraud management, cash collection, and interest rate derivative products. We believe these tailored products allow us to provide a robust service offering to our customers and to support their day to day funding and risk management needs. These services are provided through multiple points of contact including branch, online, and mobile interfaces.

Small Business Capital. Our U.S. government guaranteed lending business serves small businesses in need of, and qualifying for, SBA and USDA loans (referred to together as "U.S. government guaranteed loans"). We provide SBA lending services throughout the country, with a primary focus on the Midwest, Tennessee, Florida, Texas, Colorado, Utah, and California. We generally sell the government guaranteed portion of SBA and USDA loans into the secondary market while retaining the non-guaranteed portion of the loan and the servicing rights. This allows us to realize one time gain on sale income along with a recurring servicing and interest revenue stream. In addition to the business development officers who we rely on to generate new business, we also have a dedicated servicing, portfolio management and workout staff with specialized expertise in U.S. government guaranteed loans. As of December 31, 2023, total loans and leases included the guaranteed amount of U.S. government guaranteed loans of $93.3 million. The total unpaid principal balances of SBA and USDA loans serviced for others was $1.7 billion at December 31, 2023.

We offer customers traditional deposit products through our branch network, consumer and business online account opening through our website, and customer access to their accounts through online and mobile banking platforms. The wide variety of deposit products we offer include non-interest-bearing accounts, money market demand accounts, savings accounts, interest-bearing checking accounts and time deposits with maturities ranging from seven days to five years. We consider our core deposits, defined as all deposits except time deposits exceeding $100,000, to be our primary and most valuable funding source. As of December 31, 2023, core deposits represented 87.0% of our total deposits. In addition to these products, we offer ATM and debit cards as well as online, mobile, and text banking. We strive to retain an attractive deposit mix from both large and small customers as well as a broad market reach, which has resulted in our top 50 customers accounting for approximately 10.3% of all deposits as of December 31, 2023. Our bankers are incentivized to acquire and maintain quality core deposits as we depend on these deposits to fund the majority of our loans and leases. We believe that our long standing and high quality relationships with our depositors who provide us with long term funding are due to the convenience and dedicated service we offer. We leverage our expansive branch locations and deep network of customer relationships in the Chicago metropolitan area to provide both low cost funding sources for our lending business and deposit related fee income. We had $7.2 billion of deposits at December 31, 2023, and our average cost of deposits was 1.90% for the year ended December 31, 2023.

Through our Bank’s subsidiary, Byline Financial Group ("BFG"), we provide financing solutions for equipment vendors and their end users. The vertical markets served by our equipment vendors specialize primarily in manufacturing, small equipment construction, wholesalers, and healthcare. The end users (i.e., our lessees and borrowers) are primarily manufacturers, retailers, wholesalers, physician group practices and other healthcare related entities. The average lease size at origination for BFG for the year ended December 31, 2023 was approximately $75,000. Our sales team originates leases throughout the country, and we have lessees in nearly every state. As of December 31, 2023, BFG had $665.7 million in leases outstanding with a weighted average life of approximately 3.5 years.

We provide investment, trust and wealth management services to our customers, such as foundations and endowments and high net worth individuals, which include fiduciary and executor services, financial planning solutions, investment advisory services, and private banking services. These services are provided through credentialed investment, legal, tax, and wealth management professionals who identify opportunities and provide services tailored to our customers’ goals and objectives. Assets under administration were $770.5 million as of December 31, 2023.

The financial services industry is highly competitive as we compete for loans, leases, deposits and customer relationships within and outside of our markets. Competition involves efforts to retain current customers, make new loans and leases, obtain new deposits, increase the scope and sophistication of services offered, the availability, ease of use, and range of banking services provided on the internet and through mobile devices, and offer competitive interest rates paid on deposits and charged on loans and leases. We face competition not only from other financial holding companies and commercial banks, but also from internet banks, savings and loan associations, FinTech companies, credit unions, trust and wealth management providers, and other providers of financial services and products. Competition is generally based on the variety, rates and terms of products and services offered to customers and the performance of funds under management.

At Byline, we are a bank that believes in putting our name behind everything we do and we are here to roll up our sleeves and help our customers write their stories. Our #1 core value, reflected in our "Things That Matter," is our People, all of whom are encouraged to live out a shared purpose of making people’s lives better, helping businesses thrive, and strengthening the communities we serve. We believe purpose driven leadership facilitates progress in achieving a diverse and inclusive workforce and in driving performance. We are dedicated to attracting, retaining, and developing top talent to accomplish our long-term strategy which is critical to our success. It is this shared purpose and focus on People that allowed us to be recognized in 2023 by Forbes as one of America’s Best Small Employers.

In 2023 we issued our first Environmental, Social and Governance ("ESG") Report. We are proud of all we have accomplished to reach underserved communities, serve the diverse and unique credit and borrowing needs of our clients, measure our carbon footprint, and further increase the diversity of our talent pipeline by focusing on inclusive hiring practices across all roles.

Our Board of Directors and executive management team are committed to executing on our long-term vision. Our Board members are accomplished leaders from diverse backgrounds, bringing the perspectives, skills, and experience necessary to use independent judgment that will effectively challenge and drive continued success. Our Board members oversee our corporate strategy and sets the tone for our culture, values and high ethical standards, and, through its Committees, holds management accountable for results. The Compensation Committee reviews and monitors matters related to human capital management, including compensation and benefits, Company culture, talent development, diversity, equity and inclusion ("DEI") programs and initiatives and other ESG matters.

At Byline Bank we recognize that our most valuable resource is our People. We strive to become an employer of choice and many of our advantages are found within our four Total Rewards pillars: Pay, Benefits, Health and Wellness, Work-Life Harmony, and Professional Development.

We believe our compensation strategy supports our core principles and provides every employee with a competitive compensation package that fairly reflects their individual contributions to Byline. We offer a compensation package which includes base pay, short-term incentives (annual cash bonuses, commissions plans, and referral incentives) and long-term incentives (equity-based compensation) for applicable roles. Our approach to compensation is driven by internal and external equity which seeks to ensure our compensation elements are competitive and market driven. In our commitment to transparency, our job architecture and paygrade structure is communicated to all employees.

We believe that our benefits package not only attracts top talent but also fosters a positive and engaged workforce. We provide a comprehensive health insurance plan that covers medical expenses for our employees and their dependents including legal spouse, domestic partner, children up to age 26, and disabled children over age 26. We offer a 401(k) retirement savings plan, with an employer match, and an Employee Stock Purchase Plan with a discount on the price of the stock. Additionally, employees have access to resources and information to help with financial planning, mental health and wellbeing, and personal, family and life issues. We provide a tuition reimbursement and student loan repayment program. We offer wellness programs, an adoption and surrogacy assistance program, as well as cover fertility planning services within the healthcare plans and provide up to 12 weeks of paid parental leave for employees.

Eligible employees are provided paid time off and 11 paid federal holidays, including Juneteenth, and one floating Cultural Holiday to observe a holiday of personal significance.

Our work-life philosophy is to lead with flexibility. We offer our non-branch employees the opportunity to work either fully remote or hybrid based on the expectations of their role. During 2023, approximately 51% of non-branch employees were working fully remote, 42% were in the office one to three days per week, and 7% were in the office full-time. We believe this level of flexibility to be a competitive advantage to attracting and retaining talent within and outside of our market.

We recognize the critical importance of providing career development and advancement opportunities for all employees, and we provide a variety of formal and informal development opportunities to help employees grow in their current roles and build new skills.

Over 100 senior leaders have attended the Byline Leadership That Matters program and we have made additional investments to the Management That Matters program which focuses on enhancing core management skills. All employees have access to development resources for each of the four behavioral competencies expected of all Byline employees in the annual performance management process: Valuing Differences, Collaborating for Results, Delivering Customer Focused Solutions, and Continuous Improvement. We believe one example of our success in optimally deploying talent is our ability to fill vacancies from within. During 2023, approximately 28% of our position postings were filled internally. We encourage our employees to pursue educational opportunities, including obtaining certifications, that will help improve performance and professional development.

Our Board of Directors oversees the succession planning for executive management on an annual basis. Key development areas are identified by evaluating leadership, business, and executive role-based skills. Succession candidates create development plans that are updated throughout the year.

Our commitment to DEI starts with our Board of Directors, of which 78% are female and/or racially or ethnically diverse. We believe this diversity enables us to set the expectations for the Company and drive meaningful initiatives and change.

To facilitate talent attraction, development and retention across our franchise, we strive to make Byline a diverse, inclusive, safe and healthy workplace, with opportunities for our employees to grow and develop in their careers, supported by strong compensation, benefits, and health and welfare programs.

We seek to leverage our current diverse workforce and prominent community outreach efforts to further define and enhance our DEI focus in four key areas:

•

Workforce – Promoting representation at all levels and in all areas and business lines of the Bank, with attention on recruiting and developing diverse talent and focusing on engagement and employee recognition.

•

Workplace – Creating a culture where everyone brings their authentic self to work and knows that their unique background, ethnicity, experiences, perspective, and contribution serve to strengthen the Bank.

•

Marketplace – Providing greater accessibility to banking products, services, and education to minority owned small businesses ("SMB") and SMBs in low-and moderate-income areas.

Our employee resource groups ("ERG") and affinity resource group ("ARG") were formed to support development, engagement and inclusion across the organization. As part of our workforce initiatives, during 2023 we launched the Women’s Development Program. as well as began providing leadership educational opportunities and peer discussions for members and allies of our ERGs and ARG.

We conduct an annual employee engagement survey with over 90% participation and continue to see improvements in employee engagement year-over-year. We focus on communication with employees and managers through monthly manager forums, quarterly all employee calls, and town hall meetings.

As of December 31, 2023, we had 1,055 employees (1,036 full time, and 19 part time) in locations primarily across the Chicagoland and greater Milwaukee, Wisconsin areas. Our employees are not represented by a collective bargaining agreement. We consider our relationship with our employees to be good. We believe we have a strong bench of talent and are attracting experienced bankers from larger regional banks as a result of continued market disruption.

For additional information, please see our definitive proxy statement for our 2024 Annual Meeting of Stockholders, a copy of which will be filed with the SEC no later than 120 days after the end of our fiscal year.

Our principal executive offices are located at 180 North LaSalle Street, Suite 300, Chicago, Illinois 60601, and our telephone number at that address is (773) 244-7000. Our website address is www.bylinebancorp.com. We make available at this address, under the "Investor Relations" tab, free of charge, our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended (the "Exchange Act") as soon as reasonably practicable after such material is electronically filed with, or furnished to, the SEC. These filings are also available on the SEC's website at www.sec.gov. The contents of our website are not incorporated by reference into this report.

We and our subsidiaries are subject to extensive regulation under federal and state banking laws that establish a comprehensive framework for our operations, and are subject to oversight and supervision by multiple federal and state banking agencies, including the Federal Deposit Insurance Corporation (the "FDIC"), the Board of Governors of the Federal Reserve System (the "FRB") and the Illinois Department of Financial and Professional Regulation (the "IDFPR"). This framework may materially affect our growth potential and financial performance and is intended primarily for the protection of depositors, customers, federal deposit insurance funds and the banking system as a whole, not for the protection of our stockholders and creditors. Any change in applicable laws or regulations, whether by the FDIC, the FRB, the IDFPR or the U.S. Congress, could have a material adverse impact on the operations and financial performance of us and our subsidiaries.

Set forth below is a brief description of the significant elements of the statutes, regulations and policies applicable to us and our subsidiaries. The description below is limited to certain material aspects of the statutes and regulations addressed and is not intended to be a complete description of such statutes and regulations and their effects on us and our subsidiaries.

We are a bank holding company under the Bank Holding Company Act of 1956 (the "BHCA"). Consequently, we and our subsidiaries are subject to supervision, regulation and examination by the FRB. The BHCA provides generally for "umbrella" regulation of bank holding companies and functional regulation of holding company subsidiaries by applicable regulatory agencies. We are also subject to the rules and regulations of the SEC under the federal securities laws, including the disclosure and regulatory requirements of the Securities Act and the Exchange Act as administered by the SEC, and the rules adopted by the New York Stock Exchange (the "NYSE") applicable to NYSE listed companies.

Byline Bank, our bank subsidiary, is an FDIC-insured commercial bank chartered under the laws of Illinois. Our bank is not a member of the FRB. Consequently, the FDIC and the IDFPR are the primary regulators of our bank and also regulate our bank’s subsidiaries. As the owner of an Illinois-chartered commercial bank, we are also subject to supervision and examination by the IDFPR.

In general, the BHCA limits the business of bank holding companies to banking, managing or controlling banks and other activities that the FRB has determined to be so closely related to banking as to be a proper incident thereto, which include certain activities relating to extending credit or acting as an investment or financial advisor. We currently do not conduct any non-banking activities through any non-bank subsidiaries.

Bank holding companies that qualify and elect to be treated as "financial holding companies" may engage in a broader range of additional activities than bank holding companies that are not financial holding companies. In particular, financial holding companies may engage in activities that are (i) financial in nature or incidental to such financial activities or (ii) complementary to a financial activity and do not pose a substantial risk to the safety and soundness of depository institutions or the financial system generally. These activities include securities underwriting and dealing, insurance underwriting and making merchant banking investments. We have not elected to be treated as a financial holding company and currently have no plans to make a financial holding company election.

The FRB has the power to order any bank holding company or any of its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the FRB has reasonable grounds to believe that continuing such activity, ownership or control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company.

As an Illinois-chartered commercial bank, our bank’s business is subject to extensive supervision and regulation by state and federal bank regulatory agencies. Our business is generally limited to activities permitted by Illinois law and any applicable federal laws. Under the Illinois Banking Act, our bank may generally engage in all usual banking activities, including, among other things, accepting deposits; lending money on personal and real estate security; issuing letters of credit; buying, discounting, and negotiating promissory notes and other forms of indebtedness; buying and selling foreign currency and, subject to certain limitations, certain investment securities; engaging in certain insurance activities and maintaining safe deposit boxes on premises.

Illinois law also imposes restrictions on Byline Bank’s activities intended to ensure the safety and soundness of our bank. For example, Byline Bank is restricted under the Illinois Banking Act from investing in certain types of investment securities and is generally limited in the amount of money it can lend to a single borrower or invest in securities issued by a single issuer.

The BHCA, Section 18(c) of the Federal Deposit Insurance Act, popularly known as the "Bank Merger Act," the Illinois Banking Act, the Illinois Bank Holding Company Act and other federal and state statutes regulate acquisitions of commercial banks and other FDIC-insured depository institutions. We must obtain the prior approval of the FRB under the BHCA before (i) acquiring more than 5% of the voting stock of any FDIC-insured depository institution or other bank holding company(other than directly through our bank), (ii) acquiring all or substantially all of the assets of any bank or bank holding company or (iii) merging or consolidating with any other bank holding company. Under the Bank Merger Act, the prior approval of the FDIC is required for our bank to merge with another bank or purchase all or substantially all of the assets or assume any of the deposits of another FDIC-insured depository institution or to assume certain liabilities of non-banks. In reviewing applications seeking approval of merger and acquisition transactions, banking regulators consider, among other things, the competitive effect and public benefits of the transactions, the capital position and managerial resources of the combined organization, the risks to the stability of the U.S. banking or financial system, the applicant’s performance record under the Community Reinvestment Act of 1977 ("CRA"), the applicant’s compliance with fair housing and other consumer protection laws and the effectiveness of all organizations involved in combating money laundering activities. In addition, failure to implement or maintain adequate compliance programs could cause banking regulators not to approve an acquisition where regulatory approval is required or to prohibit an acquisition even if approval is not required.

We are a legal entity separate and distinct from Byline Bank and other subsidiaries. As a bank holding company, we are subject to certain restrictions on our ability to pay dividends under applicable banking laws and regulations.

Federal banking regulators are authorized to determine under certain circumstances relating to the financial condition of a bank holding company or a bank that the payment of dividends would be an unsafe or unsound practice and to prohibit payment thereof. In particular, federal banking regulators have stated that paying dividends that deplete a banking organization’s capital base to an inadequate level would be an unsafe and unsound banking practice and that banking organizations should generally pay dividends only out of current operating earnings. In addition, in the current financial and economic environment, the FRB has indicated that bank holding companies should carefully review their dividend policy and has discouraged payment ratios that are at maximum allowable levels unless both asset quality and capital are very strong. Under the capital rules defined in the Regulatory Capital Requirements section, institutions that seek to pay dividends must maintain 2.5% in Common Equity Tier 1 capital attributable to the capital conservation buffer. For more information on these financial measures at the Company and Byline Bank, refer to Note 20 of the notes to our audited consolidated financial statements contained in Item 8 of this report.

A significant portion of our income, on a stand-alone basis, comes from dividends from our bank, which is also the primary source of our liquidity. In addition to the restrictions discussed previously, our bank is subject to limitations under Illinois law regarding the level of dividends that it may pay to us. Under the Illinois Banking Act, Byline Bank generally may not pay dividends in an amount greater than its net profits then on hand, deducting first therefrom its losses and bad debts. Under these restrictions, Byline Bank could pay aggregate dividends of approximately $206.7 million to us without obtaining affirmative regulatory approvals as of December 31, 2023.

Transactions between our bank and its subsidiaries, on the one hand, and us or any other subsidiary, on the other hand, are regulated under Sections 23A and 23B of the Federal Reserve Act. The Federal Reserve Act imposes quantitative and qualitative requirements and collateral requirements on covered transactions by Byline Bank with, or for the benefit of, its affiliates. Generally, Sections 23A and 23B of the Federal Reserve Act limit the extent to which our bank or its subsidiaries may engage in "covered transactions" with any one affiliate to an amount equal to 10% of our bank’s capital stock and surplus, limits the aggregate amount of all such transactions with all affiliates to an amount equal to 20% of such capital stock and surplus, and requires those transactions to be on terms at least as favorable to our bank as if the transaction were conducted with an unaffiliated third party. Covered transactions are defined by statute to include a loan or extension of credit, as well as a purchase of securities issued by an affiliate, a purchase of

assets (unless otherwise exempted by the FRB) from the affiliate, certain derivative transactions with an affiliate, the acceptance of securities issued by the affiliate as collateral for a loan, and the issuance of a guarantee, acceptance or letter of credit on behalf of an affiliate. In addition, any credit transactions with any affiliate must be secured by designated amounts of specified collateral.

Federal law also limits our bank’s authority to extend credit to its insiders, which is defined under applicable law to include its directors, executive officers and 10% stockholders, as well as to entities controlled by such persons, or their immediate family members as defined under the regulation. Among other things, extensions of credit to insiders are required to be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with unaffiliated persons. Also, the terms of such extensions of credit may not involve more than the normal risk of non-repayment or present other unfavorable features and may not exceed certain limitations on the amount of credit extended to such persons individually and in the aggregate. In addition, we have certain stockholders who are foreign nationals, and we and these foreign national stockholders have entered into commitments with the FRB that restrict our ability to engage in certain business transactions without the consent of the FRB.

FRB policy and federal law require bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. Under this requirement, we are expected to commit resources to support Byline Bank, including at times when we may not be in a financial position to provide such resources, and it may not be in our, or our stockholders’ or creditors’, best interests to do so. In addition, any capital loans we make to our bank are subordinate in right of payment to depositors and to certain other indebtedness of our bank. In the event of our bankruptcy, any commitment by us to a federal banking regulatory agency to maintain the capital of our bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

The FRB monitors the capital adequacy of our holding company on a consolidated basis, and the FDIC and the IDFPR monitor the capital adequacy of our bank. The banking regulators use a combination of risk-based guidelines and a leverage ratio to evaluate capital adequacy. The risk-based capital guidelines applicable to us and our bank are based on the Basel Committee’s December 2010 final capital framework for strengthening international capital standards, known as Basel III, as implemented by the federal banking regulators, as well as various other rules implemented by the federal banking regulators as described below. The risk-based guidelines are intended to make regulatory capital requirements sensitive to differences in credit and market risk profiles among banks and bank holding companies, to account for off-balance sheet exposure and to minimize disincentives for holding liquid assets.

The Capital Rules. Over the past several years, the federal banking regulators have adopted a number of final rules, which we refer to as the Capital Rules, implementing Basel III, various provisions of the Dodd-Frank Wall Street and Consumer Protection Act (the "Dodd-Frank Act"), various provisions of the Economic Growth Regulatory Relief and Consumer Protection Act (the "Consumer Protection Act") and certain other statutory and regulatory provisions relating to capital requirements. The Capital Rules, among other things, (i) include a capital measure called "Common Equity Tier 1" ("CET1"), (ii) specify that Tier 1 capital consists of CET1 and "Additional Tier 1 capital" instruments meeting certain revised requirements, (iii) define CET1 narrowly by requiring that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital and (iv) expand the scope of the deductions/adjustments to capital as compared to prior regulations. The Capital Rules also address risk based capital requirements and risk weights and other issues affecting regulatory capital ratio calculations.

Under the Capital Rules, the minimum capital ratios are (i) 4.5% CET1 to risk-weighted assets, (ii) 6% Tier 1 capital (that is, CET1 plus Additional Tier 1 capital) to risk-weighted assets, (iii) 8% total capital (that is, Tier 1 capital plus Tier 2 capital) to risk- weighted assets and (iv) 4% Tier 1 capital to average consolidated assets as reported on consolidated financial statements (known as the "leverage ratio").

The current Capital Rules also include a capital conservation buffer designed to absorb losses during periods of economic stress. The capital conservation buffer, which is composed entirely of CET1, is in addition to these minimum risk-weighted asset ratios. The capital conservation buffer is equal to 2.5% of CET1. In addition, the Capital Rules provide for a countercyclical capital buffer applicable only to certain covered institutions. We do not expect the countercyclical capital buffer to be applicable to us or our bank. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer (or below the combined capital conservation buffer and countercyclical capital buffer, when the latter is applied) will face constraints on dividends, equity repurchases, and compensation based on the amount of the shortfall.

As a result of the fully phased-in capital conservation buffer rule, we and our bank are required to maintain an additional capital conservation buffer of 2.5% of CET1, effectively resulting in minimum ratios of (i) 7% CET1 to risk-weighted assets, (ii) 8.5% Tier 1 capital to risk-weighted assets, (iii) 10.5% total capital to risk-weighted assets and (iv) a minimum leverage ratio of 4%.

The Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, certain deferred tax assets and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. Implementation of the deductions and other adjustments to CET1 began on January 1, 2015 and have been phased in over the past several years. The Capital Rules also generally preclude certain hybrid securities, such as trust preferred securities, from being counted as Tier 1 capital for most bank holding companies. Bank holding companies such as us who had less than $15 billion in

assets as of December 31, 2009 (and who continue to have less than $15 billion in assets) are permitted to include qualifying trust preferred securities issued prior to May 19, 2010 as Additional Tier 1 capital under the Capital Rules, however.

In addition, under the general risk-based Capital Rules, the effects of accumulated other comprehensive income items included in capital were excluded for the purposes of determining regulatory capital ratios. Under the Capital Rules, the effects of certain accumulated other comprehensive income items are not excluded; however, non-advanced approaches banking organizations, including us and Byline Bank, were able to make a one-time permanent election to continue to exclude these items.

The Capital Rules also include a standardized approach for risk weightings of assets that include more risk-sensitive categories compared to previous capital rules. These risk-weighting categories depend on the nature of the assets, generally ranging from 0%, for U.S. government and agency securities, to 600% for certain equity exposures, and resulting in higher risk weights for a variety of asset categories.

With respect to our bank, the Capital Rules also revised the prompt corrective action regulations pursuant to Section 38 of the Federal Deposit Insurance Act (the "FDIA"). On September 17, 2019, pursuant to the Consumer Protection Act, the federal banking regulators issued a final rule meant to simplify the capital rules for community banks. Under the final rule, most depository institutions and depository institution holding companies that have less than $10 billion in total consolidated assets, that have limited amounts of off-balance sheet exposures and trading assets and liabilities, and that have a community bank leverage ratio of greater than 9% would be eligible to opt into a community bank leverage ratio framework beginning on January 1, 2020. Under the final rule, should a qualified community bank or its holding company elect to use the community bank leverage ratio and maintain a community bank leverage ratio of greater than 9% then it would not be subject to other risk-based and leverage capital requirements, including the risk-based capital rules relating to high volatility commercial real estate, mortgage servicing rights, certain deferred tax assets and significant investments in non-consolidated financial entities, and would be considered to have met the well capitalized ratio requirements for purposes of Section 38 of the FDIA and the generally applicable capital requirements under the federal banking regulators’ capital rules. While the community bank leverage ratio framework is available to us and Byline Bank, neither we nor Byline Bank have elected to adopt the community bank leverage ratio framework at this time.

As part of the adoption of Accounting Standards Update ("ASU") 2016-13, the Company has elected to opt into the regulators’ joint current expected credit losses ("CECL") transition provision, which allows the Company to phase in the capital impact of the adoption of CECL over the next three years beginning January 1, 2022. Accordingly, capital ratios as of December 31, 2023 reflect 50% of the CECL impact, and capital ratios as of December 31, 2022 reflect 25% of the CECL impact.

Historically, the regulation and monitoring of bank and bank holding company liquidity has been addressed as a supervisory matter, without required formulaic measures. The Basel III final framework requires banks and bank holding companies to measure their liquidity against specific liquidity tests that, although similar in some respects to liquidity measures historically applied by banks and regulators for management and supervisory purposes, going forward would be required by regulation. One test, referred to as the liquidity coverage ratio ("LCR"), is designed to ensure that the banking entity maintains an adequate level of unencumbered high-quality liquid assets equal to the entity’s expected net cash outflow for a 30-day time horizon (or, if greater, 25% of its expected total cash outflow) under an acute liquidity stress scenario. The other test, referred to as the net stable funding ratio, or the ("NSFR"), is designed to promote more medium- and long-term funding of the assets and activities of banking entities over a one-year time horizon. These requirements incentivize banking entities to increase their holdings of U.S. Department of Treasury ("U.S. Treasury") securities and other sovereign debt as a component of assets and increase the use of long-term debt as a funding source.

Federal banking regulators approved final rules implementing the LCR for advanced approaches banking organizations (i.e., banking organizations with $250 billion or more in total consolidated assets or $10 billion or more in total on-balance sheet foreign exposure) and a modified version of the LCR for bank holding companies with at least $50 billion in total consolidated assets that are not advanced approaches banking organizations. Neither of these final versions of the LCR apply to us or our bank. On October 20, 2020, federal banking regulators also approved a final rule implementing the NSFR that requires certain U.S. banking organizations to ensure that they have access to stable funding over a defined time period. However, the final rule implementing the NSFR does not apply to U.S. banking organizations with less than $50 billion in total consolidated assets such as us and Byline Bank.

The FDIA requires federal banking regulators to take prompt corrective action in respect of depository institutions that fail to meet specified capital requirements. The FDIA establishes five capital categories: "well capitalized," "adequately capitalized," "undercapitalized," "significantly undercapitalized," and "critically undercapitalized." Federal banking regulators are required to take certain mandatory supervisory actions, and are authorized to take other discretionary actions, with respect to institutions that are undercapitalized, significantly undercapitalized or critically undercapitalized. The severity of these mandatory and discretionary supervisory actions depends upon the capital category in which the institution is placed. The relevant capital measures, which reflect changes under the Capital Rules that became effective on January 1, 2015, are the total capital ratio, the CET1 capital ratio, the Tier 1 capital ratio and the leverage ratio.

A bank will be (i) "well capitalized" if the institution has a total risk-based capital ratio of 10% or greater, a CET1 capital ratio of 6.5% or greater, a Tier 1 risk-based capital ratio of 8% or greater and a leverage ratio of 5% or greater, and is not subject to any order

or written directive by any such regulatory authority to meet and maintain a specific capital level for any capital measure;(ii) "adequately capitalized" if the institution has a total risk-based capital ratio of 8% or greater, a CET1 capital ratio of 4.5% or greater, a Tier 1 risk- based capital ratio of 6% or greater and a leverage ratio of 4% or greater and is not "well capitalized;" (iii) "undercapitalized" if the institution has a total risk-based capital ratio that is less than 8%, a CET1 capital ratio less than 4.5%, a Tier 1 risk-based capital ratio of less than 6% or a leverage ratio of less than 4%; (iv) "significantly undercapitalized" if the institution has a total risk-based capital ratio of less than 6%, a CET1 capital ratio less than 3%, a Tier 1 risk-based capital ratio of less than 4% or a leverage ratio of less than 3%; and (v) "critically undercapitalized" if the institution’s tangible equity is equal to or less than 2% of average quarterly tangible assets. A bank’s capital category is determined solely for the purpose of applying prompt corrective action regulations, and the capital category may not constitute an accurate representation of Byline Bank’s overall financial condition or prospects for other purposes.

The FDIA generally prohibits a depository institution from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the depository institution would thereafter be "undercapitalized." An institution that is categorized as undercapitalized, significantly undercapitalized or critically undercapitalized is required to submit an acceptable capital restoration plan to its appropriate federal banking regulator. Under the FDIA, in order for the capital restoration plan to be accepted by the appropriate federal banking agency, a bank holding company must guarantee that a subsidiary depository institution will comply with its capital restoration plan, subject to certain limitations. The bank holding company must also provide appropriate assurances of performance. The obligation of a controlling bank holding company under the FDIA to fund a capital restoration plan is limited to the lesser of 5% of an undercapitalized subsidiary’s assets or the amount required to meet regulatory capital requirements. An undercapitalized institution is also generally prohibited from increasing its average total assets, making acquisitions and capital distributions, establishing any branches or engaging in any new line of business, except in accordance with an accepted capital restoration plan or with the approval of the FDIC. Institutions that are undercapitalized and either fail to submit an acceptable capital restoration plan or fail to implement an approved capital restoration plan may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets and cessation of receipt of deposits from correspondent banks.

Significantly undercapitalized depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets, and cessation of receipt of deposits from correspondent banks. Critically undercapitalized depository institutions are subject to appointment of a receiver or conservator.

The appropriate federal banking agency may, under certain circumstances, reclassify a well-capitalized insured depository institution as adequately capitalized. The FDIA provides that an institution may be reclassified if the appropriate federal banking agency determines (after notice and opportunity for hearing) that the institution is in an unsafe or unsound condition or deems the institution to be engaging in an unsafe or unsound practice. The appropriate agency is also permitted to require an adequately capitalized or undercapitalized institution to comply with the supervisory provisions as if the institution were in the next lower category (but not treat a significantly undercapitalized institution as critically undercapitalized) based on supervisory information other than the capital levels of the institution. An institution may be downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios if it is determined to be in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters.

As part of the adoption of ASU 2016-13, the Company has elected to opt into the regulators’ joint CECL transition provision, which allows the Company to phase in the capital impact of the adoption of CECL over a three year period, which began January 1, 2022. Accordingly, capital ratios as of December 31, 2023 reflect 50% of the CECL impact. As of December 31, 2023, our Company was considered "well capitalized" with a Tier 1 capital ratio of 11.39%, total capital ratio of 13.38%, Tier 1 leverage ratio of 10.86%, and a CET1 capital ratio of 10.35%, as calculated under Basel III. For more information on these financial measures at the Company and Byline Bank, refer to Note 20 of the notes to our audited consolidated financial statements contained in Item 8 of this report.

The FDIA requires the federal banking agencies to prescribe standards, by regulations or guidelines, relating to internal controls, information systems and internal audit systems, loan documentation, credit underwriting, interest rate risk exposure, asset growth, asset quality, earnings, stock valuation and compensation, fees and benefits, and such other operational and managerial standards as the agencies deem appropriate. Federal banking agencies adopted the Interagency Guidelines for Establishing Standards for Safety and Soundness. Such guidelines establish general standards relating to internal controls and information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, asset quality, earnings and compensation, fees and benefits. In general, these guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines. These guidelines also prohibit excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal stockholder. In addition, the agencies adopted regulations that authorize, but do not require, an agency to order an institution that has been given notice by an agency that it is not satisfying any of such safety and soundness standards to submit a compliance plan. If, after being so notified, an institution fails to submit an acceptable compliance plan or fails in

any material respect to implement an acceptable compliance plan, the banking regulator must issue an order directing action to correct the deficiency and may issue an order directing other actions of the types to which an undercapitalized institution may be subject under the FDIA. See Item 1. "Business—Supervision and Regulation—Prompt Corrective Action Framework." If an institution fails to comply with such an order, the banking regulator may seek to enforce such order in judicial proceedings and to impose civil money penalties.

As an FDIC-insured bank, our bank must pay deposit insurance assessments to the FDIC based on its average total assets minus its average tangible equity. Deposits are insured up to applicable limits by the FDIC and such insurance is backed by the full faith and credit of the U.S. government.

As an institution with less than $10 billion in assets, our bank’s assessment rates are based on the level of risk it poses to the FDIC’s deposit insurance fund (the "DIF"). The FDIC has the authority to increase insurance assessments and published a final rule on October 24, 2022 to increase initial base deposit insurance assessment rate schedules uniformly by 2 basis points, which began in the first quarterly assessment period of 2023. The stated purpose of the increase in assessment rate schedules is to increase the likelihood that the reserve ratio of the DIF reaches the statutory minimum of 1.35% by the statutory deadline of September 30, 2028. For established smaller institutions, like Byline Bank, supervisory ratings are used along with (i) an initial base assessment rate, (ii) an unsecured debt adjustment (which can be positive or negative) and (iii) a brokered deposit adjustment, to calculate a total base assessment rate. Accordingly, as of January 1, 2023, the total base assessment rate range, which does not include the depository institution debt adjustment, for institutions of Byline Bank’s size is 2.5 basis points to 32 basis points.

The limit on FDIC deposit insurance is $250,000. The coverage limit is per depositor, per insured depository institution for each account ownership category. The minimum DIF reserve ratio is 1.35% of estimated insured deposits. Under the FDIA, the FDIC may terminate deposit insurance upon a finding that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.

All Illinois state-chartered banks are required to pay supervisory assessments to the IDFPR to fund the operations of that agency. The amount of the assessment is calculated on the basis of Byline Bank’s total assets.

The Dodd-Frank Act, pursuant to a statutory provision commonly called the "Volcker Rule," prohibits banks and their affiliates from engaging in proprietary trading and investing in and sponsoring hedge funds and private equity funds. The Volcker Rule became effective in July 2015. On July 9, 2019, pursuant to the Consumer Protection Act, the federal banking regulators issued a final rule to exempt community banks that have total assets of $10 billion or less and total consolidated trading assets and liabilities equal to or less than 5% of total consolidated assets from the Volcker Rule. Although we and Byline Bank qualify for exemption under the final rule, the Volcker Rule would not significantly affect the operations of us and our subsidiaries, as we do not have any significant engagement in the businesses covered by the Volcker Rule.

The FDIA provides that, in the event of the "liquidation or other resolution" of an insured depository institution, the claims of depositors of the institution, including the claims of the FDIC as subrogee of insured depositors, and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution. If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors, including depositors whose deposits are payable only outside of the U.S. and the parent bank holding company, with respect to any extensions of credit they have made to such insured depository institution.

Illinois state-chartered banks, such as Byline Bank, have the authority under Illinois law to establish branches anywhere in the State of Illinois, subject to receipt of all required regulatory approvals.

Federal law permits state and national banks to merge with banks in other states subject to: (i) regulatory approval; (ii) federal and state deposit concentration limits; and (iii) any state law limitations requiring the merging bank to have been in existence for a minimum period of time (not to exceed five years) prior to the merger. The establishment of new interstate branches or the acquisition of individual branches of a bank in another state (rather than the acquisition of an out-of-state bank in its entirety) has historically been permitted only in those states the laws of which expressly authorize such expansion. However, the Dodd-Frank Act permits well-capitalized and well-managed banks to establish new branches across state lines without these impediments.

We are subject to a number of federal and state consumer protection laws that extensively govern our relationship with our customers. These laws include the Equal Credit Opportunity Act (the "ECOA"), the Fair Credit Reporting Act, the Truth in Lending Act (the "TILA"), the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Home Mortgage

Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Fair Debt Collection Practices Act, the Fair Credit Reporting Act, the Service Members Civil Relief Act, the Right to Financial Privacy Act, the Telephone Consumer Protection Act, the CAN-SPAM Act, and these laws’ respective state-law counterparts, as well as state usury laws and laws regarding unfair and deceptive acts and practices. These and other federal laws, among other things, require disclosures of the cost of credit and terms of deposit accounts, provide substantive consumer rights, prohibit discrimination in credit transactions, regulate the use of credit report information, provide financial privacy protections, restrict our ability to raise interest rates on extensions of credit and subject us to substantial regulatory oversight. Violations of applicable consumer protection laws can result in significant potential liability from litigation brought by customers, including actual damages, restitution and attorneys’ fees. Federal banking regulators, state attorneys general and state and local consumer protection agencies may also seek to enforce consumer protection requirements and obtain these and other remedies, including regulatory sanctions, customer rescission rights, action by the state and local attorneys general in each jurisdiction in which we operate and civil money penalties. Failure to comply with consumer protection requirements may also result in our failure to obtain any required bank regulatory approval for merger or acquisition transactions we may wish to pursue or our prohibition from engaging in such transactions even if approval is not required.

The Consumer Financial Protection Bureau (the "CFPB"), has broad rulemaking, supervisory and enforcement powers under various federal consumer financial protection laws with respect to certain consumer financial products and services, including the ability to require reimbursements and other payments to customers for alleged legal violations. The CFPB has the authority to impose significant penalties, as well as injunctive relief that prohibits lenders from engaging in allegedly unlawful practices. The CFPB is also authorized to engage in consumer financial education, track consumer complaints, request data and promote the availability of financial services to underserved consumers and communities. Although all institutions are subject to rules adopted by the CFPB and examination by the CFPB in conjunction with examinations by the institution’s primary federal regulator, the CFPB has primary examination and enforcement authority over banks with assets of $10 billion or more. The FDIC has primary responsibility for examination of our bank and enforcement with respect to various federal consumer protection laws so long as our bank has total consolidated assets of less than $10 billion, and state authorities are responsible for monitoring our compliance with all state consumer laws. The CFPB also has the authority to require reports from institutions with less than $10 billion in assets, such as our bank, to support the CFPB in implementing federal consumer protection laws, supporting examination activities, and assessing and detecting risks to consumers and financial markets.

The consumer protection provisions of the Dodd-Frank Act and the examination, supervision and enforcement of those laws and implementing regulations by the CFPB have created a more intense and complex environment for consumer finance regulation. The CFPB has significant authority to implement and enforce federal consumer finance laws, including the TILA and the ECOA.

The CFPB has broad rulemaking authority for a wide range of consumer financial laws that apply to all banks including, among other things, the authority to prohibit "unfair, deceptive, or abusive" acts and practices. Abusive acts or practices are defined in the Dodd-Frank Act as those that (1) materially interfere with a consumer’s ability to understand a term or condition of a consumer financial product or service, or (2) take unreasonable advantage of a consumer’s (a) lack of financial savvy, (b) inability to protect herself or himself in the selection or use of consumer financial products or services or (c) reasonable reliance on a covered entity to act in the consumer’s interests. The review of products and practices to prevent such acts and practices is a continuing focus of the CFPB, and of banking regulators more broadly. The ultimate impact of this heightened scrutiny is uncertain but it could result in changes to pricing, practices, products and procedures. It could also result in increased costs related to regulatory oversight, supervision and examination, additional remediation efforts and possible penalties. The Dodd-Frank Act does not prevent states from adopting stricter consumer protection standards. State regulation of financial products and potential enforcement actions could also adversely affect our business, financial condition or results of operations.

Byline Bank is a member of the Federal Home Loan Bank of Chicago ("FHLB"), which serves as a central credit facility for its members. The FHLB is funded primarily from proceeds from the sale of obligations of the FHLB system. It makes loans to member banks in the form of FHLB advances. All advances from the FHLB are required to be fully collateralized as determined by the FHLB.

As required by the Dodd-Frank Act, the CFPB issued a series of final rules amending Regulation Z, implementing the TILA, which requires mortgage lenders to make a reasonable and good faith determination, based on verified and documented information, that a consumer applying for a residential mortgage loan has a reasonable ability to repay the loan according to its terms. These rules prohibit creditors, such as Byline Bank, from extending residential mortgage loans without regard for the consumer’s ability to repay and add restrictions and requirements to residential mortgage origination and servicing practices. In addition, these rules restrict the imposition of prepayment penalties and restrict compensation practices relating to residential mortgage loan origination.

On April 27, 2021, the CFPB issued two new rules that would modify qualified mortgage loan requirements and provide flexibility to banks and other lenders in determining consumers’ ability-to-repay. Compliance with these rules was required by October 1, 2022. Byline Bank complies with, and will continue with, all applicable qualified mortgage loan requirements.

In December 2015, the federal banking regulators released a statement entitled "Interagency Statement on Prudent Risk Management for Commercial Real Estate Lending" (the "CRE Guidance"). In the CRE Guidance, the federal banking regulators (i)

expressed concerns with institutions that ease commercial real estate underwriting standards, (ii) directed financial institutions to maintain underwriting discipline and exercise risk management practices to identify, measure and monitor lending risks and (iii) indicated that they will continue to pay special attention to commercial real estate lending activities and concentrations going forward. The federal banking regulators previously issued guidance in December 2006, entitled "Interagency Guidance on Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices," which stated that an institution is potentially exposed to significant commercial real estate concentration risk, and should employ enhanced risk management practices, where (1) total commercial real estate loans represent 300% or more of its total capital and (2) the outstanding balance of such institution’s commercial real estate loan portfolio has increased by 50% or more during the prior 36 months.

The federal banking regulators have jointly issued guidance on leveraged lending that updates and replaces prior guidance for leveraged finance activities. The revised leveraged lending guidance describes regulatory expectations for the sound risk management of leveraged lending activities, including the importance for institutions to maintain, among other things, (i) a credit limit and concentration framework consistent with the institution’s risk appetite, (ii) underwriting standards that define acceptable leverage levels, (iii) strong pipeline management policies and procedures and (iv) guidelines for conducting periodic portfolio and pipeline stress tests.

Under the CRA, our bank has an obligation, consistent with safe and sound operations, to help meet the credit needs of the market areas where it operates, which includes providing credit to low- and moderate-income individuals and communities. In connection with its examination of our bank, the FDIC is required to assess our bank’s compliance with the CRA. Our bank’s failure to comply with the CRA could, among other things, result in the denial or delay of certain corporate applications filed by us or our bank, including applications for branch openings or relocations and applications to acquire, merge or consolidate with another banking institution or holding company. Our bank received a rating of "Satisfactory" in its most recently completed CRA examination during March of 2023.

On October 24, 2023, the Office of the Comptroller of the Currency, the FDIC and the FRB jointly issued a final rule to revise the CRA’s implementing regulations. While the final rule formally takes effect on April 1, 2024, the majority of its provisions have a compliance date of January 1, 2026. The final rule implements a revised regulatory framework that, like the current framework, is based on bank asset size and business model. Under the final rule, banks with over $2 billion in total assets as of December 31 in either of the prior two calendar years, such as Byline Bank, will be required to be evaluated under the new "Retail Lending Test," the new "Retail Products and Services Test," the new "Community Development Financing Test" and the new "Community Development Services Test," but banks of all sizes will maintain the option to elect to be evaluated under a strategic plan with the final rule updating the standards for obtaining approval for such plan. The new Retail Lending Test evaluates a bank’s record of helping to meet the credit needs of its community through the origination and purchase of home mortgage, multifamily, small business, small farm and, in certain cases, automobile loans. The new Retail Products and Services Test evaluates the availability of a bank’s retail banking services and retail banking products and the responsiveness of such to the credit needs of the bank’s entire community. The new Community Development Financing Test evaluates a bank’s commitment to making qualifying community development loans and investments, and, lastly, the new Community Development Services Test evaluates a bank’s record of helping to meet the community development services needs of its entire community. At this time, we are unable to determine what impact, if any, the CRA reform may have on the operations of Byline Bank.

The Illinois Community Reinvestment Act ("IL-CRA"), which became law in March 2021, requires banks, credit unions, and nonbank mortgage companies to invest in, loan to, and serve historically disinvested communities. It is anticipated that the IL-CRA will impose certain new obligations on Byline Bank, however, the rules necessary to implement the IL-CRA have not yet been finalized. As a result, at this time, we are unable to determine what impact the IL-CRA may have on the operations of Byline Bank.

On March 30, 2023, the CFPB issued a final rule amending Regulation B, the implementing regulation of the ECOA, to implement section 1071 of the Dodd-Frank Act. Consistent with section 1071, covered financial institutions are required to collect and report to the CFPB data on applications for credit for small businesses, including those that are owned by women or minorities. The rule also addresses the CFPB’s approach to privacy interests and the publication of section 1071 data, shielding certain demographic data from underwriters and other persons, recordkeeping requirements and enforcement provisions. Compliance with the small business lending rule beginning October 1, 2024 is required for covered financial institutions that originate the most covered credit transactions for small businesses (i.e., at least 2,500 covered originations in both 2022 and 2023). However, institutions with a moderate transaction volume (i.e., at least 500 but less than 2,500 covered originations in both 2022 and 2023) have until April 1, 2025 to begin complying with the rule and those with the lowest volume (i.e., at least 100 but less than 500 covered originations in both 2022 and 2023) have until January 1, 2026. Based on Byline Bank’s volume of covered transactions, it will be required to comply by October 1, 2024.

The federal banking regulators have adopted rules limiting the ability of banks and other financial institutions to disclose non- public information about consumers to unaffiliated third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to an unaffiliated third party. These regulations affect how consumer information is transmitted through diversified financial companies and conveyed to outside vendors.

A major focus of governmental policy on financial institutions in recent years has been combating money laundering and terrorist financing. The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001, or the USA PATRIOT Act, substantially broadened the scope of U.S. anti money laundering laws and regulations by imposing significant new compliance and due diligence obligations, creating new crimes and penalties and expanding the extra-territorial jurisdiction of the U.S. in these areas: customer identification programs, money laundering, terrorist financing, identifying and reporting suspicious activities and currency transactions, currency crimes, and cooperation between financial institutions and law enforcement authorities. The U.S. Treasury’s Financial Crimes Enforcement Network ("FinCEN"), among other federal agencies, also promulgates rules and regulations regarding the USA PATRIOT Act with which financial institutions are required to comply. Financial institutions are prohibited from entering into specified financial transactions and account relationships and must use enhanced due diligence procedures in their dealings with certain types of high-risk customers and implement a written customer identification program. Financial institutions must take certain steps to assist government agencies in detecting and preventing money laundering and report certain types of suspicious transactions. Regulatory authorities routinely examine financial institutions for compliance with these obligations, and failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal and reputational consequences for the institution, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required. Regulatory authorities have imposed cease and desist orders and significant civil money penalties against institutions found to be violating these obligations and have in some cases brought criminal actions against some institutions for these types of violations.

On January 1, 2021, the U.S. Congress passed the Corporate Transparency Act as part of the National Defense Authorization Act, which enacted the most significant overhaul of the anti-money laundering laws since the USA PATRIOT Act. Notable amendments include (i) significant changes to the collection of beneficial ownership information ("BOI") and the establishment of a beneficial ownership registry, which requires corporate entities (generally, any corporation, limited liability company, or other similar entity with 20 or fewer employees and annual gross income of $5 million or less) to report BOI to FinCEN (which will be maintained by FinCEN and made available upon request to financial institutions); (ii) enhanced whistleblower provisions, which provide that one or more whistleblowers who voluntarily provide original information leading to the successful prosecution of violations of the anti-money laundering laws in any judicial or administrative action brought by the Secretary of the U.S. Treasury or the U.S. Attorney General resulting in monetary sanctions exceeding $1 million (including disgorgement and interest but excluding forfeiture, restitution, or compensation to victims) will receive not more than 30% of the monetary sanctions collected and will receive increased protections; (iii) increased penalties for violations of anti-money laundering laws and regulations; (iv) improvements to existing information sharing provisions that permit financial institutions to share information relating to suspicious activity reports with foreign branches, subsidiaries, and affiliates (except those located in the People's Republic of China, the Russian Federation or certain other jurisdictions) for the purpose of combating illicit finance risks; and (v) expanded duties and enforcement powers for FinCEN. Many of the amendments, including those with respect to beneficial ownership, require FinCEN to promulgate rules.

On September 29, 2022, FinCEN finalized the first of three proposed rules to implement changes to the beneficial ownership requirements and related amendments set forth in the Corporate Transparency Act. The final rule prescribes which corporate entities created in or registered to do business in the U.S. will be required to provide BOI directly to FinCEN. This first rule is effective, and compliance is required as of January 1, 2024, however, reporting companies created or registered prior to that date will have until January 1, 2025 to file their initial reports with FinCEN.

On December 21, 2023, FinCEN finalized the second of the three proposed rules which allows for FinCEN, upon request, to disclose BOI to a statutorily defined group of governmental authorities and financial institutions. The second final rule identifies the entities FinCEN is allowed to provide access to BOI to include (i) federal agencies engaged in national security, intelligence or law enforcement activity, (ii) state, local and tribal law enforcement agencies with court authorization, (iii) foreign law enforcement agencies, judges, prosecutors and other authorities that meet specific criteria, (iv) U.S. Treasury personnel, (v) financial institutions using BOI in order to comply with customer due diligence ("CDD") requirements and (vi) regulators, acting in a supervisory capacity, evaluating such institutions for CDD-related compliance. The second final rule provides that such CDD requirements could include anti-money laundering and countering the financing of terrorism obligations set forth under the Bank Secrecy Act (e.g., anti-money laundering program, customer identification, suspicious activity reports filing and enhanced due diligence requirements) and compliance with the U.S. Treasury’s Office of Foreign Assets Control ("OFAC") sanctions. This rule provides that FinCEN may disclose BOI to an authorized financial institution provided that such institution has developed and implemented administrative, technical and physical safeguards reasonably designed to protect the information and has received the relevant reporting company’s consent to such disclosure. The second final rule is effective as of February 20, 2024.

OFAC, under authority of various laws, administers and enforces economic and trade sanctions against targeted foreign countries and regimes, including designated foreign countries, nationals and others. OFAC publishes lists of specially designated targets and countries. We and our bank are responsible for, among other things, blocking accounts of, and transactions with, such targets and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence. Failure to comply with these sanctions could have serious legal and reputational consequences and could result in civil money penalties imposed on the institution by OFAC. Failure to comply with these sanctions could also cause applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required.

In March 2015, federal regulators issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyberattack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyberattack. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.

In November 2021, the federal regulators finalized a rule concerning notification requirements for banks related to significant computer security incidents. Under the final rule, a bank or its bank holding company is required to notify its applicable federal banking regulators within 36 hours of incidents that have materially disrupted or degraded, or are reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the organization, or impact the stability of the financial sector. The rule was effective April 1, 2022 and compliance was required by May 1, 2022.

In March 2022, the Cyber Incident Reporting for Critical Infrastructure Act of 2022 ("CIRCIA") was signed into law. The enactment of CIRCIA requires the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (the "CISA") to develop and implement regulations requiring covered entities to report covered cyber incidents and ransomware payments to the CISA in an effort to better equip the CISA to provide resources and assistance to victims suffering attacks and share information necessary to warn other potential victims. In part, CIRCIA requires the CISA to develop and issue regulations requiring covered entities to report to the CISA within 72 hours from the time an entity reasonably believes a covered cyber incident occurred and within 24 hours of making any ransom payments made as a result of a ransomware attack. The CISA is required to complete mandatory rulemaking activities before the reporting requirements go into effect. It is possible, but not yet confirmed, that banks could be subject to CIRCIA.

In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. We employ an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of our defensive measures, the threat from cyberattacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to-date we have not experienced a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our customers and third-party service providers are under constant threat and it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of internet banking, mobile banking and other technology-based products and services by us and our customers.

The U.S. Congress may enact legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of the proposed legislation could affect the regulatory structure under which we operate and may significantly increase our costs, impede the efficiency of our internal business processes, require us to increase our regulatory capital or modify our business strategy, or limit our ability to pursue business opportunities in an efficient manner. Our business, financial condition, results of operations or prospects may be adversely affected, perhaps materially, as a result.

The following list sets forth the name, current age, principal position and recent business experience of each of our executive officers:

Thomas Abraham, 58, became President of Byline Bank’s Small Business Capital ("SBC") line of business in May 2019. Mr. Abraham previously served as Senior Vice President, SBA Sales Manager of SBC since October 2016.

John M. Barkidjija, 60, became Executive Vice President and Head of Commercial Real Estate and Specialty Finance of Byline Bank in January 2019. Mr. Barkidjija previously served as Senior Vice President, Group Head, Commercial Real Estate of Byline Bank since January 2014.

Thomas J. Bell III, 57, became Executive Vice President and Chief Financial Officer of Byline and Byline Bank in August 2022. Mr. Bell has been serving as Corporate Treasurer of Byline Bank since August 2013.

Megan Biggam, 45, became Executive Vice President of Community Banking of Byline Bank in February 2020. Ms. Biggam previously served as Senior Vice President of Community Banking of Byline Bank since June 2013.

Ana Casanueva, 40, became Senior Vice President and Director of Legal of Byline and Byline Bank in June 2021. Ms. Casanueva previously served as Associate General Counsel of Byline Bank since 2019, and as Corporate Development Officer from 2013 to 2019.

Mark Fucinato, 67, became Executive Vice President and Chief Credit Officer for Byline and Byline Bank in August 2020. He previously served as Senior Vice President and Senior Credit Officer of Byline Bank since August 2019. Prior to that, Mr. Fucinato served as Senior Credit Officer at MB Financial Bank from 2016 to 2019.

Roberto R. Herencia, 64, became Chairman of Byline Bancorp, Inc. and Byline Bank in June 2013, and Executive Chairman and Chief Executive Officer in February, 2021. He serves as a member of the Board of Director’s risk committee, and as a member of the risk, executive credit, trust, and Asset- Liability Committee ("ALCO") committees of Byline Bank.

Michelle Johnson, 42, became Executive Vice President and Chief Risk Officer of Byline Bank in October 2019. Prior to that, Ms. Johnson served as Deputy Chief Risk Officer since 2018. Ms. Johnson joined Byline Bank in 2015 as Director of IT Risk Management.

Nicolas Mando, 52, became Senior Vice President and Chief Technology and Operations Officer of Byline Bank in November 2021. He served as Director of Special Projects of Byline Bank since 2019. Prior to that, Mr. Mando served as Chief Operating Officer at Bridgeview Bank since 2009.

Sherylle Olano, 46, became Senior Vice President and Chief Accounting Officer of Byline and Byline Bank in August 2022. Prior to that, Ms. Olano previously served as Controller since 2014.

Alberto J. Paracchini, 53, is President and a Director of Byline Bancorp, Inc. and Chief Executive Officer, President and a Director of Byline Bank. He joined Byline in June 2013.

Brogan Ptacin, 63, became Executive Vice President and Head of Commercial Banking for Byline Bank in January 2019. Prior to that, Mr. Ptacin served as a Managing Director of First Bank & Trust since 2009 until First Bank & Trust was acquired by Byline in 2018.

Dana Rose, 54, became Executive Vice President and Chief Human Resources Officer of Byline Bank in November 2019. Prior to that, Ms. Rose served as Interim Chief Human Resources Officer for Discover Financial Services and held various other roles at Discover since 1994.

The material risks and uncertainties that management believes affect us are described below. You should carefully consider these risks, together with all of the information included herein. Any of the following risks, as well as risks that we do not know or currently deem immaterial, could have a material adverse effect on our business, financial condition, or results of operations.

The operation of our business requires us to manage credit risk. As a lender, we are exposed to the risk that our borrowers may be unable to repay their loans and leases according to their terms, and that the collateral securing repayment of their loans or leases, if any, may not be sufficient to ensure repayment. In addition, there are risks inherent in making any loan or lease, including risks with respect to the period of time over which the loan or lease may be repaid, risks relating to proper loan or lease underwriting, risks resulting from changes in economic and industry conditions and risks inherent in dealing with individual borrowers, including the risk that a borrower may not provide information to us about its business in a timely manner, and/or may present inaccurate or incomplete information to us, and risks relating to the value of collateral. In order to manage credit risk successfully, we must, among other things, maintain disciplined and prudent underwriting standards. The weakening of these standards for any reason, a lack of discipline or diligence in underwriting and monitoring loans and leases, the inability to adequately adapt policies and procedures to changes in economic or any other conditions affecting borrowers and the quality of our loan and lease portfolio, may result in defaults, foreclosures

and additional charge-offs and may necessitate that we significantly increase our allowance for credit losses - loans and leases, each of which could adversely affect our net income. As a result, our inability to successfully manage credit risk could have a material adverse effect on our business, financial condition, or results of operations.

We may underestimate the credit losses inherent in our loan and lease portfolio and have credit losses in excess of the amount we provide for loan and lease losses.

The credit quality of our loan and lease portfolio can have a significant impact on our earnings. We maintain an allowance for credit losses, which is a reserve established through a provision charged to expense representing management’s estimate of current expected credit losses. The allowance, in the judgment of management, is necessary to reserve for current expected losses and risks inherent in our loan and lease portfolio. The level of the allowance reflects management’s continuing evaluation of specific credit risks; the quality of the portfolio; the value of the underlying collateral; the level of non-accruing loans and leases; current expected losses inherent in the portfolio; and economic, political, and regulatory conditions. Management estimates the allowance balance using relevant available information from internal and external sources relating to past events, current conditions, and reasonable and supportable forecasts, which could increase the subjectivity of the calculation. This process, which is critical to our financial results and condition, requires difficult, subjective and complex judgments. In accordance with accounting principles generally accepted in the United States of America ("GAAP") for business combination accounting, the loans acquired through subsequent bank acquisitions are recorded at their estimated fair value, and an allowance for credit losses associated with those loans also recorded.

Although we believe our allowance for credit losses is adequate to absorb current expected losses in our loan and lease portfolio, it may not be sufficient. We could sustain credit losses that are significantly higher than the amount of our allowance as a result of a variety of reasons, such as changes in economic conditions affecting borrowers, new information and other factors within and outside our control. If real estate values were to decline or if economic conditions in our markets were to deteriorate unexpectedly, additional losses not incorporated in the existing allowance might occur. Losses in excess of the existing allowance will reduce our net income and could have a material adverse effect on our business, financial condition, or results of operations. A severe downturn in the economy generally, in our markets specifically, or affecting the business and assets of individual customers, would generate increased charge-offs and a need for higher provision for credit losses.

We may also be required to take additional provisions for credit losses in the future to further supplement the allowance due to requirements by our banking regulators. Bank regulatory agencies periodically review our allowance, the policies and procedures we use to determine the level of the allowance and the value attributed to non-performing loans or to real estate acquired through foreclosure. Such regulatory agencies may require us to make further provisions or recognize future charge-offs. Further, charge-offs in future periods that exceed the allowance would require an increase to the allowance.

Any increases in our provision for credit losses will result in a decrease in net income and may reduce retained earnings and capital and, therefore, have a material adverse effect on our business, financial condition and results of operations.

Our business is subject to interest rate risk and fluctuations in interest rates may adversely affect our earnings.

Fluctuations in interest rates may negatively affect our business and may weaken demand for some of our products. Our earnings and cash flows are largely dependent on net interest income, which is the difference between the interest income that we earn on interest-earning assets, such as investment securities, loans, and leases, the interest expense that we pay on interest-bearing liabilities, such as deposits and borrowings. Additionally, changes in interest rates also affect the premiums we may receive in connection with the sale of U.S. government guaranteed loans in the secondary market, pre-payment speeds of loans for which we own servicing rights, our ability to fund our operations with customer deposits, and the fair value of securities in our investment portfolio. Therefore, any change in general market interest rates can have a significant effect on our net interest income and results of operations.

We seek to mitigate our interest rate risk by entering into interest rate swaps and other interest rate derivative contracts from time to time with counterparties. Our hedging strategies rely on assumptions and projections regarding interest rates, asset levels, and general market factors and subject us to counterparty risk. There is no assurance that our interest rate mitigation strategies will be successful, and if our assumptions and projections prove to be incorrect or our hedging strategies do not adequately mitigate the impact of changes in interest rates, we may incur losses that could adversely affect our earnings.

Our interest-earning assets and interest-bearing liabilities may react in different degrees to changes in market interest rates. Interest rates on some types of assets and liabilities may fluctuate prior to changes in broader market interest rates, while rates on other types of assets and liabilities may lag. The result of these changes to rates may cause differing spreads on interest-earning assets and interest-bearing liabilities. Although we take measures intended to manage the risks from changes in market interest rates, we cannot control or accurately predict changes in market rates of interest or be sure our protective measures are adequate.

As of December 31, 2023, we had $1.9 billion of non-interest-bearing demand deposits and $577.6 million of interest-bearing checking accounts. As the Federal Reserve raised its overnight target rate, we have cautiously managed our deposit repricing strategies to seek to expand our net interest margin by keeping deposit rates at relatively low levels. As the competition for funding among banks increases, and customers move money to achieve higher yields, we may need to increase our deposit pricing accordingly. To the extent we offer higher interest rates on targeted interest-bearing deposit products to maintain current customers or attract new customers, our interest expense will increase, perhaps materially. Furthermore, if we fail to offer interest rates at a sufficient level to keep these demand

deposits, our core deposits may be reduced, which would require us to obtain funding in other ways or risk slowing our future asset growth.

We may be adversely impacted by the continuing transition from the London Interbank Offered Rate ("LIBOR") as a reference rate.

On March 5, 2021, the United Kingdom’s Financial Conduct Authority and the Intercontinental Exchange Benchmark Administration announced that the one-week and two-month U.S. dollar LIBOR ("USD LIBOR") settings would cease to be published immediately after December 31, 2021. The publication of overnight and one-, three-, six‑, and 12-month USD LIBOR settings would be extended through June 30, 2023 to provide additional time for market participants to wind down or modify existing contracts that reference these LIBOR tenors.

In response, the FDIC, the Board of Governors of the Federal Reserve System, and the OCC issued joint guidance directing banks and market participants to cease entering new LIBOR contracts after December 31, 2021, which we have done. Although most LIBOR tenors continued to be published through June 30, 2023 to aid in the transition of legacy LIBOR contracts (e.g., maturity), as of January 1, 2021, we no longer originate loans indexed to LIBOR nor enter into modifications which create new LIBOR exposure.

During 2021, we began a transition to using a forward-looking term rate based upon the Secured the Overnight Financing Rate ("SOFR"), CME Term SOFR ("Term SOFR") as the replacement benchmark index in lieu of LIBOR. SOFR is the Alternative Reference Rates Committee’s recommended alternative to USD LIBOR. Because the Term SOFR market continues to develop and deepen, changes in SOFR or Term SOFR or changes in market perceptions of the acceptability of Term SOFR as a benchmark could result in changes to our risk exposures (for example, because SOFR is a broad measurement of the cost borrowing cash secured by U.S. Treasury securities, changes or disruptions in the repo market may adversely affect the availability or cost of floating-rate funding and, therefore, our exposure to fluctuations in interest rates) or otherwise result in losses on a product or having to pay more or receive less on financial instruments that we own or have issued.

Uncertainty as to the nature of other alternative reference rates and their broader acceptance by the market may also adversely affect SOFR rates and the value of SOFR-based loans, and to a lesser extent securities in our portfolio, and may impact the availability and cost of hedging instruments and borrowings, including the rates we pay on our subordinated debentures and trust preferred securities.

Our business, profitability, and liquidity may be adversely affected by deterioration in the credit quality of, or defaults by, third parties who owe us money, securities or other assets or whose securities, or obligations we hold.

In addition to relying on borrowers to repay their loans and leases, we are exposed to the risk that third parties that owe us money, securities, or other assets will not perform their obligations. These parties may default on their obligations to us due to bankruptcy, lack of liquidity, operational failure, or other reasons. A default by a significant market participant, or concerns that such a party may default, could lead to significant liquidity problems, losses, or defaults by other parties, which in turn could adversely affect us.

We are also subject to the risk that our rights against third parties may not be enforceable in all circumstances. Deterioration in the credit quality of third parties whose securities or obligations we hold, including the Federal Home Loan Mortgage Corporation, Government National Mortgage Association and municipalities, could result in significant losses.

We depend on the accuracy and completeness of information about customers and counterparties.

In deciding whether to extend credit or enter into other transactions, and in evaluating and monitoring our loan and lease portfolio on an ongoing basis, we may rely on information furnished by or on behalf of customers and counterparties, including financial statements, credit reports, and other financial information. We may also rely on representations of those customers or counterparties or of other third parties, such as independent auditors, as to the accuracy and completeness of that information. Reliance on inaccurate, incomplete, fraudulent, or misleading financial statements, credit reports or other financial or business information, or the failure to receive such information on a timely basis, could result in loan or lease losses, reputational damage or other effects that could have a material adverse effect on our business, financial condition, or results of operations.

As of December 31, 2023, we owned $1.4 billion of investment securities, which consisted primarily of our positions in U.S. government and government-sponsored enterprises and federal agency obligations, mortgage and asset-backed securities and municipal securities. We evaluate our investment securities on at least a quarterly basis, and more frequently when economic and market conditions warrant such an evaluation, to determine whether any decline in fair value below amortized cost is the result of credit losses. The process for determining whether unrealized losses contain credit losses usually requires complex, subjective judgments in order to assess the probability of receiving all contractual principal and interest payments on the security. We may be required to recognize credit losses in future periods, which could adversely affect our business, results of operations or financial condition. In addition, further increases in market interest rates may continue to affect the market value of our securities portfolio, potentially further reducing accumulated other comprehensive income and/or earnings.

A lack of liquidity could affect operations and jeopardize our business, financial condition, and results of operations.

Liquidity risk is the risk that we will not be able to meet our obligations, including financial commitments, as they come due and is inherent in our operations. An inability to raise funds through deposits, borrowings, the sale of loans and/or investment securities, and from other sources could have a material negative effect on our liquidity. Our most important source of funds consists of our customer deposits. If customers move money out of bank deposits and into other investments, we could lose a relatively low cost source of funds. This loss would require us to seek other funding alternatives in order to continue to grow, thereby increasing our funding costs and reducing our net interest income and net income.

Other primary sources of funds consist of cash from operations and investment maturities, redemptions, and sales, as well as borrowings from the Federal Reserve Bank of Chicago, the FHLB and other third-party lenders from time to time. Our access to funding sources in amounts adequate to finance or capitalize our activities or on terms that are acceptable to us could be impaired by factors that affect us directly or the financial services industry or economy in general, such as disruptions in the financial markets or negative views and expectations about the prospects for the financial services industry.

Any decline in available funding could adversely impact our ability to continue to implement our business plan, which could have a material adverse impact on our liquidity, business, financial condition, and results of operations.

We are a legal entity separate and distinct from Byline Bank, our wholly-owned banking subsidiary. A substantial portion of our cash flow from operating activities, comes primarily from dividends we receive from Byline Bank. Various federal and state laws and regulations limit the amount of dividends that the bank may pay to us. As of December 31, 2023, Byline Bank had the capacity to pay us dividends of up to $206.7 million without the need to obtain prior regulatory approval. Also, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors. In the event Byline Bank is unable to pay dividends to us, we may not be able to service our existing debt or any debt we may incur, pay obligations or pay dividends on our common and preferred stock, which could have a material adverse effect on our business, financial condition or results of operations.

We may need to raise additional capital in the future, and such capital may not be available when needed or at all.

We may need to raise additional capital, in the form of debt or equity securities, in the future to have sufficient capital resources to meet our commitments and fund our business and future growth, particularly if the quality of our assets or earnings were to deteriorate significantly. Our ability to raise additional capital, if needed, will depend on, among other things, conditions in the capital markets at that time, which are outside of our control, and our financial condition. Further, if we need to raise capital in the future, we may have to do so when many other financial institutions are also seeking to raise capital and would then have to compete with those institutions for investors. An inability to raise additional capital on acceptable terms when needed, or at all, could have a material adverse effect on our business, financial condition or results of operations.

We may not be able to implement our growth strategy or manage costs effectively, resulting in lower earnings or profitability.

There can be no assurance that we will be able to continue to grow and to be profitable in future periods, or, if profitable, that our overall earnings will remain consistent or increase in the future. Our strategy focuses on organic growth, supplemented by opportunistic acquisitions.

Our growth requires that we increase our loan and deposit growth while managing risks by following prudent loan underwriting standards without increasing interest rate risk or compressing our net interest margin, maintaining more than adequate capital at all times, hiring and retaining qualified employees, and successfully implementing strategic projects and initiatives. Even if we are able to increase our interest income, our earnings may nonetheless be reduced by increased expenses, such as additional employee compensation or other general and administrative expenses and increased interest expense on any liabilities incurred or deposits solicited to fund increases in assets. Additionally, if our competitors extend credit on terms we find to pose excessive risks, or at interest rates which we believe do not warrant the credit exposure, we may not be able to maintain our lending volume and could experience deteriorating financial performance. Our inability to manage our growth successfully or to continue to expand into new markets could have a material adverse effect on our business, financial condition, or results of operations.

New lines of business, products, product enhancements or services may subject us to additional risks.

From time to time, we may implement new lines of business or offer new products and product enhancements as well as new services within our existing lines of business. There are substantial risks and uncertainties associated with these efforts, particularly in

instances in which the markets are not fully developed. In implementing, developing, or marketing new lines of business, products, product enhancements or services, we may invest significant time and resources and not realize their expected results or returns. Further, initial timetables for the introduction and development of new lines of business, products, product enhancements or services may not be achieved, and price and profitability targets may not prove feasible. External factors, such as compliance with regulations, competitive alternatives and shifting market preferences, may also affect the ultimate implementation of a new line of business or offerings of new products, product enhancements or services. Furthermore, any new line of business, product, product enhancement or service or system conversion could have a significant impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business or offerings of new products, product enhancements or services could have a material adverse effect on our business, financial condition, or results of operations.

Our business may be adversely affected by conditions in the financial markets and economic conditions generally.

Our financial performance generally, and in particular the ability of our borrowers to pay interest on and repay principal of outstanding loans and leases and the value of collateral securing those loans and leases, as well as demand for loans and leases and other products and services we offer, is highly dependent upon the business environment in the markets in which we operate and in the United States as a whole. Unlike larger banks that are more geographically diversified, we provide banking and financial services to customers primarily in the Chicago metropolitan area. The economic conditions in this local market may be different from, or worse than, the economic conditions in the United States as a whole. Some elements of the business environment that affect our financial performance include short-term and long-term interest rates, the prevailing yield curve, inflation and price levels, tax policy, monetary policy, unemployment, and the strength of the domestic economy and the local economy in the markets in which we operate. Also, the occurrence of other external events, such as geopolitical events and widespread public health emergencies or pandemics may negatively affect the business environment in our markets. Unfavorable market conditions can result in a deterioration in the credit quality of our borrowers and the demand for our products and services, an increase in the number of loan and lease delinquencies, defaults and charge-offs, additional provisions for credit losses and an overall material adverse effect on the quality of our loan and lease portfolio. Unfavorable or uncertain economic and market conditions can be caused by, among other factors, declines in economic growth, business activity or investor or business confidence; limitations on the availability or increases in the cost of credit and capital; changes in inflation or interest rates; increases in real estate and other state and local taxes; high unemployment; natural disasters; geopolitical issues, conflicts and uncertainty; public health concerns; and other external factors or a combination of these or other factors.

Our business is significantly dependent on the real estate markets in which we operate, as a significant percentage of our loan portfolio is secured by real estate.

Many of the loans in our portfolio are secured by real estate. As of December 31, 2023, our real estate loans held for investment include $525.7 million of construction and development loans, $399.3 million of multifamily loans, $1.0 billion of non-owner occupied CRE loans and $320.2 million of residential mortgage loans, with the majority of these real estate loans concentrated in the Chicago metropolitan area and the State of Illinois. Real property values in our primary market may differ from real property values in other markets where we may do business and may be affected by a variety of factors outside of our control and the control of our borrowers, including national and local economic conditions, generally. The Chicago metropolitan area has experienced volatility in real estate values over the past decade. Declines in real estate values, including prices for homes and commercial properties in the Chicago metropolitan area, could result in a deterioration of the credit quality of our borrowers, an increase in the number of loan delinquencies, defaults and charge-offs, and reduced demand for our products and services, generally. In addition, our appraisal of the property may change significantly in relatively short periods of time and may not accurately describe the fair value of the real property collateral after the loan is made, resulting in loss if we foreclose on the property prior to realizing the full amount of any remaining indebtedness. Our CRE loans may have a greater risk of loss than residential mortgage loans, in part because these loans are generally larger or more complex to underwrite. In particular, real estate construction and acquisition and development loans have certain risks not present in other types of loans, including risks associated with construction cost overruns, project completion risk, general contractor credit risk and risks associated with the ultimate sale or use of the completed construction. In addition, declines in real property values could reduce the value of any collateral we realize following a default on these loans. An increase in the level of non-performing assets increases our risk profile and may affect the capital levels regulators believe are appropriate in light of the ensuing risk profile. In addition, we rely on appraisals and other valuation techniques to establish the value of our other real estate owned ("OREO") and personal property that we acquire through foreclosure proceedings and to determine certain loan impairments. If any of these valuations are inaccurate, our consolidated financial statements may not reflect the correct value of our OREO, and our allowance for credit losses - loans and leases may not reflect accurate loan impairments. This could have a material adverse effect on our business, financial condition or results of operations. Our failure to effectively mitigate these risks could have a material adverse effect on our business, financial condition, or results of operations.

We depend on information technology and telecommunications systems of third parties, and any systems failures, interruptions, or data breaches involving these systems could adversely affect our operations and financial condition.

Our business is highly dependent on the successful and uninterrupted functioning of our information technology and telecommunications systems, third-party servicers, accounting systems, mobile and online banking platforms and financial intermediaries. We outsource to third parties many of our major systems, such as data processing, loan servicing, deposit processing, and internal audit systems. The failure of these systems, or the termination of a third-party software license or service agreement on which any of these systems is based, could interrupt our operations. Because our information technology and telecommunications systems interface with and depend on third-party systems, we could experience service denials if demand for such services exceeds capacity, or such third-party systems fail or experience interruptions. If sustained or repeated, a system failure or service denial could result in a deterioration of our ability to operate effectively or service our customers, resulting in potential noncompliance with applicable laws or regulations, loss of customer business, and/or subject us to additional regulatory scrutiny and possible financial liability, any of which could have a material adverse effect on our financial condition. In addition, failure of third parties to comply with applicable laws and regulations, or fraud or misconduct on the part of employees of any of these third parties, could disrupt our operations or adversely affect our reputation.

It may be difficult for us to replace some of our third-party vendors, particularly vendors providing our core banking, debit card services, and information services, in a timely manner if they are unwilling or unable to provide us with these services in the future for any reason, and even if we are able to replace them, it may be at higher cost or result in the loss of customers. Any such events could have a material adverse effect on our business, financial condition, or results of operations.

The occurrence of fraudulent activity, breaches or failures of our information security controls, or cybersecurity-related incidents could have a material adverse effect on our business, financial condition, or results of operations.

As a financial institution, we are susceptible to fraudulent activity, information security breaches, and cybersecurity-related incidents that may be committed against us, our customers, or third-party service providers that we utilize, which may result in financial losses or increased costs to us or our customers, disclosure or misuse of our information or our customer information, misappropriation of assets, privacy breaches against our customers, litigation, or damage to our reputation. Information security breaches and cybersecurity-related incidents may include fraudulent or unauthorized access to systems used by us or our customers, denial or degradation of service attacks, and malware or other cyberattacks. There continues to be a rise in electronic fraudulent activity, security breaches, and cyberattacks directed at the financial services industry. Consistent with industry trends, we have also experienced an increase in attempted electronic fraudulent activity, security breaches, and cybersecurity-related incidents. Information pertaining to us and our customers is maintained, and transactions are executed, on networks and systems maintained by us and certain third-party partners, such as our online banking or reporting systems. The secure maintenance and transmission of confidential information, as well as execution of transactions over these systems, are essential to protect us and our customers against fraud and security breaches and to maintain our customers’ confidence and privacy. Although we have developed, and continue to invest in, systems and processes that are designed to detect and prevent security breaches and cyberattacks and periodically test our security, our or our third-party partners’ inability to anticipate, or failure to adequately mitigate, breaches of security could result in: losses to us or our customers; our loss of business and/or customers; damage to our reputation; the incurrence of additional expenses; disruption to our business; our inability to grow our online services or other businesses; additional regulatory scrutiny or penalties; or our exposure to civil litigation and possible financial liability-any of which could have a material adverse effect on our business, financial condition, or results of operations.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new, technology-driven products and services. Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements than we do. We may not be able to effectively implement new, technology-driven products and services, or be successful in marketing these products and services to our customers. In addition, the implementation of technological changes and upgrades to maintain current systems and integrate new ones may also cause service interruptions, transaction processing errors, and system conversion delays, and may cause us to fail to comply with applicable laws. Failure to successfully keep pace with technological change affecting the financial services industry and failure to avoid interruptions, errors, and delays could have a material adverse effect on our business, financial condition, or results of operations.

Small Business Administration lending and other government guaranteed lending is an important part of our business. Our government guaranteed lending programs are dependent upon the U.S. federal government, and we face specific risks associated with originating SBA and other government guaranteed loans.

Our SBA lending program is dependent upon the U.S. federal government. As an approved participant in the SBA Preferred Lender’s Program (an "SBA Preferred Lender"), we enable our customers to obtain SBA loans without being subject to the potentially lengthy SBA approval process necessary for lenders that are not SBA Preferred Lenders. The SBA periodically reviews the lending operations of participating lenders to assess, among other things, whether the lender exhibits prudent risk management. When weaknesses are identified, the SBA may request corrective actions or impose enforcement actions, including revocation of the lender’s SBA Preferred Lender status. If we lose our status as an SBA Preferred Lender, we may lose some or all of our customers to lenders who are SBA Preferred Lenders, and as a result we could experience a material adverse effect to our financial results. Any changes to the SBA program, changes to program-specific rules impacting volume eligibility under the guaranty program, as well as changes to the program amounts authorized by Congress, may also have a material adverse effect on our business. In addition, any default by the U.S. government on its obligations or any prolonged government shutdown could impede our ability to originate SBA loans or other government guaranteed loans or sell such loans in the secondary market, which could materially adversely affect our business, results of operations, and financial condition.

Generally, we sell the guaranteed portion of our SBA 7(a) loans in the secondary market. These sales result in premium income for us at the time of sale and create a stream of future servicing income, as we retain the servicing rights to these loans. For the reasons described above, we may not be able to continue originating these loans or sell them in the secondary market. Furthermore, even if we are able to continue to originate and sell SBA 7(a) loans in the secondary market, we might not continue to realize premiums upon the sale of the guaranteed portion of these loans, or the premiums may decline due to economic and competitive factors. When we originate SBA loans, we incur credit risk on the non-guaranteed portion of the loans, and if a customer defaults on a loan, we share any loss and recovery related to the loan pro-rata with the SBA. If the SBA establishes that a loss on an SBA guaranteed loan is attributable to significant technical deficiencies in the manner in which the loan was originated, funded, or serviced by us, the SBA may seek recovery of the principal loss related to the deficiency from us. Generally, we do not maintain reserves or loss allowances for such potential claims and any such claims could materially adversely affect our business, financial condition, or results of operations.

The laws, regulations and standard operating procedures that are applicable to government guaranteed loan products may change in the future. We cannot predict the effects of these changes on our business and profitability. Because government regulation greatly affects the business and financial results of all commercial banks and bank holding companies and especially our organization, changes in the laws, regulations and procedures applicable to government guaranteed loans could adversely affect our ability to operate profitably.

The recognition of gains on the sale of loans and servicing asset valuations reflect certain assumptions.

We continue to expect that gains on the sale of U.S. government guaranteed loans will continue to comprise a significant component of our revenue. The gain on such sales recognized for year ended December 31, 2023 was $22.8 million. The determination of these gains is based on assumptions regarding the value of unguaranteed loans retained, servicing rights retained and deferred fees and costs, and net premiums paid by purchasers of the guaranteed portions of U.S. government guaranteed loans. The value of retained unguaranteed loans and servicing rights are determined based on market-derived factors such as prepayment rates, current market conditions and recent loan sales. Deferred fees and costs are determined using internal analysis of the cost to originate loans. Significant errors in assumptions used to compute gains on sale of loans or servicing asset valuations could result in material revenue misstatements, which may have a material adverse effect on our business, results of operations and profitability. In addition, while we believe these valuations reflect fair value and such valuations are subject to validation by an independent third-party, if such valuations are not reflective of fair market value, then our business, results of operations and financial condition may be materially and adversely affected.

Our accounting estimates and risk management processes and controls rely on analytical and forecasting techniques and models and assumptions, which may not accurately predict future events.

Our accounting policies and methods are fundamental to the manner in which we record and report our financial condition and results of operations. Our management must exercise judgment in selecting and applying many of these accounting policies and methods so they comply with GAAP and reflect management’s judgment of the most appropriate manner to report our financial condition and results of operations. In some cases, management must select the accounting policy or method to apply from two or more alternatives, any of which may be reasonable under the circumstances, yet which may result in our reporting materially different results than would have been reported under a different alternative.

Certain accounting policies and estimates are critical to presenting our financial condition and results of operations. They require management to make difficult, subjective or complex judgments about matters that are uncertain. Materially different amounts could be reported under different conditions or using different assumptions or estimates. These critical accounting policies and estimates include (i) determining the provision and allowance for credit losses, (ii) the valuation of intangible assets such as goodwill, servicing assets, core deposit intangibles, and customer relationship intangible, and (iii) the determination of fair value for financial instruments. Refer to Note 1 of the notes to our audited consolidated financial statements contained in Item 8 of this report for further information. Because of the uncertainty of estimates involved in these matters, we may be required to do one or more of the following: significantly increase the allowance for credit losses - loans and leases or sustain loan and lease losses that are significantly higher than the reserve provided; reduce the carrying value of an asset measured at fair value; or significantly increase our accrued tax liability. Any of these could have a material adverse effect on our business, financial condition or results of operations. See Item 7. "Management’s Discussion and Analysis of Financial Condition and Results of Operations".

Our internal controls, disclosure controls, processes and procedures, and corporate governance policies and procedures are based in part on certain assumptions and can provide only reasonable (not absolute) assurances that the objectives of the system are met. Furthermore, we currently outsource our internal audit function. Any failure or circumvention of our controls, processes and procedures or failure to comply with regulations related to controls, processes and procedures could necessitate changes in those controls, processes and procedures, which may increase our compliance costs, divert management attention from our business or subject us to regulatory actions and increased regulatory scrutiny. Any of these could have a material adverse effect on our business, financial condition, or results of operations.

Our goodwill may become impaired, which may adversely impact our results of operations and financial condition and may limit Byline Bank’s ability to pay dividends to us, thereby causing liquidity issues.

As of December 31, 2023, we had goodwill of $181.7 million, or 18.4% of our total stockholders’ equity. The excess purchase consideration over the fair value of net assets from acquisitions, or goodwill, is evaluated for impairment at least annually and on an interim basis if an event or circumstance indicates that it is more likely than not that an impairment has occurred. In testing for impairment, we conduct a qualitative assessment, and we also estimate the fair value of net assets based on analyses of our market value, discounted cash flows and peer values. Consequently, the determination of the fair value of goodwill is sensitive to market-based economics and other key assumptions. Variability in market conditions or in key assumptions could result in impairment of goodwill, which is recorded as a non-cash adjustment to income. An impairment of goodwill could have a material adverse effect on our business, financial condition and results of operations.

The accounting for loans acquired in connection with our recapitalization and acquisitions is based on numerous subjective determinations that may prove to be inaccurate and have a negative impact on our results of operations.

All loans acquired as part of our recapitalization in 2013 as well as loans acquired in connection with our subsequent acquisitions were recorded at their estimated fair value on their acquisition date without a carryover of the related allowance for credit losses. The determination of estimated fair value of purchased credit deteriorated and acquired non-credit-deteriorated loans requires management to make subjective determinations regarding discount rate, estimates of losses on defaults, market conditions and other factors that are highly subjective in nature. A risk exists that our estimate of the fair value of purchased credit deteriorated and acquired non-credit-deteriorated loans will prove to be inaccurate and that we ultimately will not recover the amount at which we recorded such loans on our balance sheet, which would require us to recognize losses.

Loans acquired that have experienced more than insignificant credit deterioration since origination are accounted for under Accounting Standards Codification ("ASC") Topic 326, Financial Instruments – Credit Losses. These purchased credit deteriorated ("PCD") loans have experienced more than insignificant credit deterioration since origination, like non-credit-deteriorated loans acquired, and have been recorded at the amount paid. An allowance for credit losses is determined using the same methodology as other loans held for investment. The initial allowance for credit losses - loans and leases, determined on a collective basis, is allocated to individual loans. The sum of the loan’s purchase price and allowance for credit losses becomes its initial amortized cost basis. The difference between the initial amortized cost basis and the par value of the loan is a noncredit discount or premium, which is amortized into interest income over the life of the loan. Subsequent changes to the allowance for credit losses are recorded through credit loss expense.

Acquired non‑credit-deteriorated loans and leases are accounted for under ASC Subtopic 310‑20, Receivables Nonrefundable Fees and Other Costs ("ASC 310‑20"). The difference between the fair value and unpaid principal balance of the loan at the acquisition date is amortized or accreted to interest income over the life of the loan. While credit discounts are included in the determination of the fair value from non-credit-deteriorated loans, since these discounts are expected to be accreted over the life of the loans, they cannot be used to offset the allowance for credit losses that must be recorded at the acquisition date. As a result, an allowance for credit losses is determined at the acquisition date using the same methodology as other loans held for investment and is recognized as a provision for credit losses in the consolidated statements of operations. Any subsequent deterioration (improvement) in credit quality is recognized by recording a provision (recapture) for credit losses.

Our ability to recognize the benefits of deferred tax assets is dependent on future cash flows and taxable income.

We recognize the expected future tax benefit from deferred tax assets when it is more likely than not that the tax benefit will be realized. Otherwise, a valuation allowance is applied against deferred tax assets, reducing the value of such assets. Assessing the recoverability of deferred tax assets requires management to make significant estimates related to expectations of future taxable income from all sources, including reversal of taxable temporary differences, forecasted operating earnings and available tax planning strategies. Estimates of future taxable income are based on forecasted income from operations and the application of existing tax laws in each jurisdiction. Our acquisitions and risk profile are key components used in the determination of our ability to realize the expected future benefit of our deferred tax assets. To the extent that future taxable income differs significantly from estimates as a result of the interest rate environment and loan and lease growth capabilities or other factors, our ability to realize the net deferred tax assets could be affected.

Certain activities are restricted due to commitments entered into with the FRB by us and our foreign national stockholders.

We have certain stockholders who invested in our recapitalization who are foreign nationals, and we and these foreign national stockholders have entered into commitments with the FRB that restrict some of our activities. In particular, without approval of the FRB, we are restricted from engaging in certain transactions with these foreign national stockholders, their immediate families, and any company controlled by such foreign national stockholders or by their immediate families. If we were to fail to comply with any of these restrictions, we could be subject to enforcement and other legal actions by the FRB, including civil and criminal penalties, which could have a material adverse effect on our business, financial condition and results of operations.

Monetary policies and regulations of the FRB could adversely affect our business, financial condition, and results of operations.

In addition to being affected by general economic conditions, our earnings and growth are affected by the policies of the FRB. An important function of the FRB is to regulate the money supply and credit conditions. Among the instruments used by the FRB to implement these objectives are open market purchases and sales of U.S. government securities, adjustments of the discount rate, and changes in banks’ reserve requirements against bank deposits. These instruments are used in varying combinations to influence overall economic growth and the distribution of credit, bank loans, investments, and deposits. Their use also affects interest rates charged on loans or paid on deposits.

The monetary policies and regulations of the FRB have had a significant effect on the operating results of commercial banks in the past and are expected to continue to do so in the future. The effects of such policies upon our business, financial condition, and results of operations cannot be predicted.

We are subject to numerous laws designed to protect consumers, including the Community Reinvestment Act and fair lending laws, and failure to comply with these laws could lead to a wide variety of sanctions.

The CRA requires our bank, consistent with safe and sound operations, to ascertain and meet the credit needs of its entire community, including low and moderate income areas. Our bank’s failure to comply with the CRA could, among other things, result in the denial or delay of certain corporate applications filed by us or our bank, including applications for branch openings or relocations and applications to acquire, merge or consolidate with another banking institution or holding company. In addition, the ECOA, the Fair Housing Act, and other fair lending laws and regulations prohibit discriminatory lending practices by financial institutions. A challenge to an institution’s compliance with fair lending laws and regulations could result in a wide variety of sanctions, including damages and civil money penalties, injunctive relief, restrictions on mergers and acquisitions activity, restrictions on expansion, and restrictions on entering new business lines. Private parties may also challenge an institution’s performance under fair lending laws in private class action litigation. Such actions could have a material adverse effect on our business, financial condition, results of operations, and growth prospects.

Litigation and regulatory actions, including possible enforcement actions, could subject us to significant fines, penalties, judgments, or other requirements resulting in increased expenses or restrictions on our business activities.

Our business is subject to increased litigation and regulatory risks as a result of a number of factors, including the highly regulated nature of the financial services industry and the focus of state and federal prosecutors on banks and the financial services industry generally. In the normal course of business, we have in the past and may in the future be named as a defendant in various legal actions, including arbitrations, class actions, and other litigation, arising in connection with our current and/or prior business activities. Legal actions could include claims for substantial compensatory or punitive damages or claims for indeterminate amounts of damages, resulting in increased expenses, diminished income, damage to our reputation, and divert management attention from the operation of our business. In addition, while the arbitration provisions in certain of our customer agreements historically have limited our exposure to consumer class action litigation, there can be no assurance that we will be successful in enforcing our arbitration clause in the future. Further, we have in the past and may in the future be subject to consent orders with our regulators.

We may also, from time to time, be the subject of subpoenas, requests for information, reviews, investigations and proceedings (both formal and informal) by governmental agencies regarding our current and/or prior business activities. Further, any settlement, consent order or adverse judgment in connection with any formal or informal proceeding or investigation by government agencies may result in litigation, investigations or proceedings as other litigants and government agencies begin independent reviews of the same activities. As a result, the outcome of legal and regulatory actions could be material to our business, results of operations, financial condition and cash flows.

Non-compliance with the USA PATRIOT Act, the Bank Secrecy Act or other laws and regulations could result in fines or sanctions against us.

The USA PATRIOT Act of 2001 and the Bank Secrecy Act require financial institutions to design and implement programs to prevent financial institutions from being used for money laundering and terrorist activities. If such activities are detected, financial institutions are obligated to file suspicious activity reports with the Financial Crimes Enforcement Network of the U.S. Department of the Treasury. These rules require financial institutions to establish procedures for identifying and verifying the identity of customers seeking to open new financial accounts. Federal and state bank regulators also have focused on compliance with Bank Secrecy Act and anti-money laundering regulations. Failure to comply with these regulations could result in fines or sanctions, including restrictions on conducting acquisitions or establishing new branches. While we have developed policies and procedures designed to assist in compliance with these laws and regulations, these policies and procedures may not be effective in preventing violations of these laws and regulations. Failure to maintain and implement adequate programs to combat money laundering and terrorist financing could also have serious reputational consequences for us, which could have a material adverse effect on our business, financial condition or results of operations.

Regulations relating to privacy, information security, and data protection could increase our costs, affect or limit how we collect and use personal information, and adversely affect our business opportunities.

We are subject to various privacy, information security, and data protection laws, including requirements concerning security breach notification, and we could be negatively affected by these laws. For example, our business is subject to the Gramm-Leach-Bliley Act which, among other things: (i) imposes certain limitations on our ability to share nonpublic personal information about our customers with nonaffiliated third parties; (ii) requires that we provide certain disclosures to customers about our information collection, sharing and security practices, and (iii) requires that we develop, implement and maintain a written comprehensive information security program. Various state and federal banking regulators and states have also enacted data security breach notification requirements with varying levels of individual, consumer, regulatory or law enforcement notification in certain circumstances in the event of a security breach. Moreover, legislators and regulators in the United States are increasingly adopting or revising privacy, information security and data protection laws that potentially could have a significant impact on our privacy, data protection and information security-related practices, our collection, use, sharing, retention and safeguarding of consumer or employee information, and some of our current or planned business activities. This could also increase our costs of compliance and business operations and could reduce income from certain business initiatives.

Compliance with current or future privacy, data protection, and information security laws to which we are subject could result in higher compliance and technology costs and could restrict our ability to provide certain products and services, which could have a material adverse effect on our business, financial condition or results of operations. Our failure to comply with privacy, data protection and information security laws could result in potentially significant regulatory or governmental investigations or actions, litigation, fines, sanctions and damage to our reputation, which could have a material adverse effect on our business, financial condition, or results of operations.

We may be adversely affected by risks associated with completed and potential acquisitions, including execution risks, failure to realize anticipated transaction benefits, and failure to overcome integration risks, which could adversely affect our growth and profitability.

We have continued to grow our business both organically and through the acquisition of smaller banks that management believes strategically fit within our franchise and that we believe support our businesses and make financial and strategic sense. In the event that we continue to pursue further acquisitions, we may have difficulty executing on and may not realize the anticipated benefits of any transaction we complete. Any of the foregoing matters could materially and adversely affect us.

Generally, any acquisition of target financial institutions, branches, or other banking assets by us will require approval by, and cooperation from, a number of governmental regulatory agencies, possibly including the FRB and the FDIC as well as the IDFPR. Such regulators could deny our application, which would restrict our growth, or the regulatory approvals may not be granted on terms that are acceptable to us.

As to any acquisition that we complete, we may fail to realize some or all of the anticipated transaction benefits if the integration process takes longer or is more costly than expected or otherwise fails to meet our expectations. Depending on the condition of any

institution or assets or liabilities that we may acquire, that acquisition may, at least in the near term, adversely affect our capital and earnings and, if not successfully integrated with our organization, may continue to have such effects over a longer period. Also, acquisitions may involve the payment of a premium over book and market values and, therefore, some dilution of our tangible book value and net income per common share may occur in connection with any future transaction. Our inability to overcome these risks could have a material adverse effect on our profitability, return on equity, return on assets, and our ability to implement our business strategy and enhance stockholder value, which, in turn, could have a material adverse effect on our business, financial condition, and results of operations.

Loss of deposits could increase our funding costs and negatively affect our liquidity.

We rely on customer deposits to meet a considerable portion of our funding needs, and we continue to seek customer deposits to maintain this funding base. We accept deposits directly from consumer and commercial customers and, as of December 31, 2023, we had $7.2 billion in deposits. These deposits are subject to potential fluctuations in availability or the price we must pay (in the form of interest) to obtain them due to certain factors outside our control, such as increasing competitive pressures from other financial services firms for deposits and changes in interest rates and returns on other investment classes, which could result in significant outflows of deposits within short periods of time or significant changes in pricing necessary to maintain current deposits or attract additional deposits. The loss of customer deposits for any reason could increase our funding costs, and negatively affect our liquidity.

We operate in a highly competitive and changing industry and market area and compete with both banks and non-banks.

We operate in the highly competitive financial services industry and face significant competition for customers from financial institutions located both within and beyond our principal markets. We compete with national commercial banks, regional banks, private banks, savings banks, credit unions, non-bank financial services companies, FinTech companies and other financial institutions operating within or near the areas we serve, many of whom are much larger and have significantly greater resources than us and that target the same customers we do in the Chicago metropolitan area. In order to compete, we may have to pay higher interest rates to attract deposits, accept lower yields to attract loans and pay higher wages for new employees, resulting in lower net interest margins and reduced profitability. As customer preferences and expectations continue to evolve, technology has lowered barriers to entry and made it possible for banks to expand their geographic reach by providing digital banking services and for non-banks to offer products and services traditionally provided by banks. The banking industry is experiencing rapid changes in technology, and, as a result, our future success will depend in part on our ability to address our customers’ needs by using technology. Many of our non-bank competitors are not subject to the same extensive regulations that govern our activities and, as a result, may have greater flexibility in competing for business. We also face increased competition in our U.S. government guaranteed lending business, which can adversely affect our volume and the premium, if any, recognized on sales of the guaranteed portions of such U.S. government guaranteed loans. Our inability to compete successfully in the markets in which we operate could have a material adverse effect on our business, financial condition, or results of operations.

Our principal stockholder, MBG Investors I, L.P. has significant influence over us, and its interests could conflict with those of our other stockholders.

Currently, our principal stockholder, MBG Investors I, L.P., owns approximately 27.0% of the outstanding shares of our common stock and its general partner is one of our directors. As a result, MBG Investors I, L.P. is able to influence matters requiring approval by our stockholders, including the election of directors and the approval of mergers or other extraordinary transactions. MBG Investors I, L.P. may also have interests that differ from yours and may vote in a way with which you disagree, and which may be adverse to your interests. The concentration of ownership may also have the effect of delaying, preventing, or deterring a change of control of the Company, could deprive our stockholders of an opportunity to receive a premium for their common stock as part of a private sale of their shares of the Company, subject us to the influence of a presently unknown third-party and might ultimately affect the market price of our common stock.

Future sales of our common stock in the public market, including by our pre-IPO stockholders, could lower our stock price.

The market price of our common stock could decline as a result of sales of a large number of shares of our common stock or from the perception that such sales could occur. These sales, or the possibility that these sales may occur, also may make it more difficult for us to raise additional capital by selling equity securities in the future, at a time and price that we deem appropriate.

Certain of our pre-IPO stockholders, including affiliates such as MBG Investors, I, L.P., hold restricted shares that could be sold in accordance with the volume, manner of sale, and other limitations under Rule 144 or through registration under the Securities Act. We cannot predict the size of future issuances or sales of our common stock by our pre-IPO stockholders or the effect, if any, that future issuances or sales of shares of our common stock may have on the market price of our common stock. Sales or distributions of substantial amounts of our common stock (including shares issued in connection with an acquisition), or the perception that such sales could occur, may cause the market price of our common stock to decline.

In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data.

We have developed an Information Security Program (the “Program”) as part of our overall risk assessment and Enterprise Risk Management ("ERM") to address material risks from potential cybersecurity threats, as well as to facilitate the governance and oversight of cybersecurity risks. The Program, which is administered by our Chief Risk Officer, includes policies and procedures that identify how security measures and controls are developed, implemented, maintained and assessed.

As part of our ERM, our Board of Directors reviews and approves the Program on an annual basis. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing management’s reporting on Program effectiveness. In addition to a Privacy and Security Governance Committee, we also have Governance, Risk, Information Technology and Compliance functions that monitor and address enterprise risks, including cybersecurity risks.

A risk assessment, based on a method and guidance from a recognized national standards organization, is conducted at least annually. The risk assessment, along with risk-based analysis and judgment, are used to select security controls to address and to seek to mitigate risks. Factors considered during this process include, but are not limited to, the likelihood and severity of the risk, the impact on the Company and others, such as our customers, if a risk materializes, the feasibility and cost of controls, and the impact of controls on our operations.

Specific controls that address cybersecurity risks include endpoint threat detection and response, identity and access management, logging and monitoring involving the use of security information and event management, multi-factor authentication, conditional access, firewalls and intrusion detection and prevention, and vulnerability and patch management. We engage third-party security firms in different capacities to provide or operate some of these controls, such as vulnerability assessments, penetration testing and other procedures to identify potential weaknesses in our systems and processes. In addition, as a financial institution, we conduct appropriate due diligence and monitoring procedures to address potential cybersecurity threats related to the use of third-party technology and outsourced services, including pre-acquisition due diligence, imposition of contractual obligations, and performance monitoring.

We have processes in place to oversee and manage risks associated with third-party service providers, including risks related to data breaches or other security incidents. This includes conducting security due diligence reviews of critical third-party providers, subjecting third parties to periodic risk assessments and requiring third parties to sign standard contractual provisions before receiving sensitive information from the Company.

We recognize that individual employees are frequent targets of threat actors. We regularly train employees on the importance of protecting our information, and communicate with our customers and employees on the importance to protect information and enhancing cybersecurity through security campaigns, newsletters, posters and ad-hoc communications. If specific threats are identified, management may communicate those threats directly to employees for heightened awareness. Our cybersecurity program requires employees to review and acknowledge information security and privacy policies annually, complete multiple cybersecurity training courses throughout the year, and participate in mock phishing campaigns regularly.

We also have a written Incident Response Plan and conduct tabletop exercises to enhance incident response preparedness. Business Continuity and Disaster Recovery plans are used to prepare for the potential for a disruption in technology we rely on. Employees undergo security awareness training when hired and annually.

While to-date we have not experienced a significant cybersecurity incident, significant data loss or any material financial losses related to cybersecurity attacks on our systems and those of our customers and third-party service providers are under constant threat, and it is possible that we could experience an incident in the future that could have a material adverse effect on our business strategy, results of operations and financial condition. See also Item 1A, Risk Factors – Technology Risks.

As a financial institution (or third parties it relies on) we may not be able to fully, continuously, and effectively, implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In

addition, security controls, no matter how well designed or implemented, may only mitigate, and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.

Our corporate headquarters is located at 180 North LaSalle Street, Suite 300, Chicago, IL 60601. In addition to our corporate headquarters, we operate 47 branch offices located in the Chicago metropolitan area and one branch office in Wauwatosa, Wisconsin. We lease 17 of our branch offices and our headquarters and own the remainder of our branch offices. We are continually evaluating opportunities to improve our existing branches and branch network, and we have in the recent past closed and may in the future choose to close branches in certain circumstances in order to improve our efficiency or for other business reasons.

We operate in a highly regulated environment. From time to time, we are a party to various litigation matters incidental to the conduct of our business. We are not presently a party to any legal proceedings the resolution of which we believe would have a material adverse effect on our business, financial condition, liquidity, results of operation, cash flows or capital levels.

Item 5. Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities.

Our common stock is listed on the NYSE under the symbol "BY". There were approximately 1,132 holders of record of our common stock as of March 1, 2024.

The timing and amount of cash dividends paid on our common stock depends on our earnings, financial condition, capital requirements and other relevant factors. The primary sources for payment of dividends to our stockholders are dividends paid to the Company by Byline Bank and cash on hand. We are subject to state law limitations on the payment of dividends. Delaware law generally limits dividends if: (a) the corporation does not have a surplus; or (b) the corporation does not have net profits for the fiscal year in which the dividend is declared and/or the preceding fiscal year. We have an internal policy that prohibits the Board of Byline Bank from declaring and paying dividends that would cause the minimum capital amounts required for Byline Bank to be considered less than "well capitalized" for regulatory purposes. See Item 1. "Business – Supervision and Regulations – Dividends" above and Note 20 of notes to consolidated financial statements contained in Item 8 of this report.

On December 12, 2022, we announced that our Board of Directors approved a new stock repurchase program authorizing the purchase of up to an aggregate of 1,250,000 shares of our outstanding common stock. The program was in effect from January 1, 2023 until December 31, 2023.

We did not purchase any shares of our common stock under the stock repurchase program during 2023.

On December 6, 2023, we announced that our Board of Directors approved a new stock repurchase program authorizing the purchase of up to an aggregate of 1,250,000 shares of our outstanding common stock. The program will be in effect from January 1, 2024 until December 31, 2024, unless terminated earlier. The shares may, at the discretion of management, be repurchased from time to time in open market purchases as market conditions warrant or in privately negotiated transactions. We are not obligated to purchase any shares under the program, and the program may be discontinued at any time. The actual timing, number and share price of shares purchased under the repurchase program will be determined by us at our discretion and will depend on a number of factors, including the market price of our stock, general market and economic conditions and applicable legal requirements. The shares authorized to be repurchased represent approximately 2.9% of the Company’s outstanding common stock at December 31, 2023.

The table below includes information regarding purchases of our common stock during the quarter ended December 31, 2023. We did not purchase any shares of our common stock during the fourth quarter of 2023 under our stock repurchase program.

(1) These shares were acquired pursuant to our 2017 Omnibus Incentive Compensation Plan. Under the terms of this plan, we can accept previously owned shares of common stock to be surrendered to satisfy the exercise price of stock options, the settlement of restricted stock awards and tax withholding obligations upon vesting and/or exercise.

Recent Sales of Unregistered Securities; Use of Proceeds From Registered Securities.

The following graph compares the cumulative total stockholder return on our common stock from December 31, 2018 through December 31, 2023, with the cumulative total return of: (1) the Russell 2000 (U.S. Stock) Index, (2) a peer group of the S&P U.S. SmallCap Banks Index and, (3) the KBW NASDAQ Regional Bank Index ("KRX"). Included in the KRX index are U.S. regional banks that we believe are similar to the Company. We believe the KRX index provides a meaningful comparison to our cumulative total return. Total return assumes the reinvestment of all dividends.

* The information assumes that $100 was invested at the closing price on December 31, 2018 in our stock and each index, and that all dividends are reinvested.

Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations.

The following is a discussion and analysis of our financial condition and results of operations and should be read in conjunction with our financial statements and notes thereto included in Item 8 of this report. In addition to historical information, this discussion contains forward‑looking statements that involve risks, uncertainties and assumptions that could cause actual results to differ materially from management’s expectations. Factors that could cause such differences are discussed in the sections entitled "Special Note Regarding Forward‑Looking Statements" and "Risk Factors". Byline assumes no obligation to update any of these forward‑looking statements.

Management’s discussion focuses on 2023 results compared to 2022. For a discussion of 2022 results compared to 2021, refer to Part I, Item 7 of our 2022 Annual Report filed on Form 10-K, which was filed with the SEC on March 6, 2023.

Our results of operations depend substantially on net interest income, which is the difference between interest income on interest-earning assets, consisting primarily of interest income on loans and lease receivables, including accretion income on loans, investment securities and other short-term investments, and interest expense on interest-bearing liabilities, consisting primarily of deposits and borrowings. Our results of operations are also dependent upon our generation of non-interest income, consisting primarily of income from fees and service charges on deposits, loan servicing revenue, wealth management and trust income, ATM and interchange fees, and net gains on sales of investment securities and loans. Other factors contributing to our results of operations include our provisions for credit losses, provision for income taxes, and non-interest expenses, such as salaries and employee benefits, occupancy and equipment expenses and other miscellaneous operating costs.

We reported consolidated net income of $107.9 million for the year ended December 31, 2023, compared to net income of $88.0 million for the year ended December 31, 2022, an increase of $19.9 million. The increase in net income was attributable to a $65.3 million increase in net interest income, offset by a $25.5 million increase in non-interest expense, an $11.1 million increase in provision for income taxes, and a $7.8 million increase in provision for credit losses. The increase in net interest income was primarily a result of higher interest income and fees on loans and leases due to growth including acquired loans, and higher yields, partially offset by an increase in deposit interest expense due to higher rates paid and growth. The increase in non-interest expense was driven mainly by expenses related to the Inland acquisition. The increase in provision for credit losses was mainly driven by an increase in non-performing loans and acquired non-credit-deteriorated loans. The increase in provision for income taxes was mostly driven by an increase in net income before provision for income taxes during the period.

Dividends declared and paid on preferred shares were $196,000 for the year ended December 31, 2022. There was no preferred stock issued or outstanding during 2023. Dividends declared on common shares were $14.6 million $13.5 million for the years ended December 31, 2023 and 2022, respectively. Dividends paid on common shares were $14.6 million and $13.4 million for the years ended December 31, 2023 and 2022, respectively. For the years ended December 31, 2023 and 2022, net income available to common stockholders was $107.9 million, or $2.69 per basic and $2.67 per diluted common share, and $87.8 million, or $2.37 per basic and $2.34 per diluted common share, respectively. Our results of operations for the years ended December 31, 2023 and 2022, produced an annual return on average assets of 1.34% and 1.25% and a return on average stockholders’ equity of 12.50% and 11.33%, respectively.

Since our recapitalization in June 2013, our branch network has been reduced from 88 to 48, including 23 branches added through acquisition. During 2023 we added 10 branches within our network as a result of our acquisition of Inland.

Our accounting and reporting policies conform to GAAP and to general practices within the banking industry. To prepare financial statements and interim financial statements in conformity with GAAP, management makes estimates, assumptions and judgments based on available information. These estimates, assumptions and judgments affect the amounts reported in the financial statements and accompanying notes; and are based on information available as of the date of the financial statements. As this information changes, actual results could differ from the estimates, assumptions and judgments reflected in the financial statements. In particular, management has identified several accounting policies that, due to the estimates, assumptions and judgments inherent in those policies, are critical in understanding our financial statements.

These critical accounting policies and estimates include (i) determination of the allowance for credit losses, (ii) the valuation of intangible assets such as goodwill, and assessment of impairment, (iii) fair value estimates, and (iv) the determination and assessment of impairment for other intangible assets.

The following is a discussion of the critical accounting policies and significant estimates that require us to make complex and subjective judgments. Additional information about these policies can be found in Note 1 of our audited consolidated financial statements contained in Item 8 of this report.

The allowance for credit losses ("ACL") represents management’s estimate of current expected credit losses over the life of a financial asset carried at amortized cost at an appropriate level based upon management’s evaluation of the adequacy of collectively and individually evaluated loss reserves.

The ACL is maintained at a level that management believes is appropriate to provide for current expected credit losses as of the dates of the Consolidated Statements of Financial Condition, and we have established methodologies for the determination of its adequacy. The methodologies are set forth in a formal policy and take into consideration relevant available information, from internal and external sources, relating to past events, current conditions, and reasonable and supportable forecasts. We increase our ACL by recording provisions for current expected credit losses against our income and decrease by charge‑offs, net of recoveries.

The evaluation is inherently subjective, as it requires estimates that are susceptible to significant revision as more information becomes available. While management uses available information to recognize losses on loans and leases, changes in economic or other conditions may necessitate revision of the estimate in future periods.

For each portfolio, management estimates expected credit losses over the life of each loan and lease utilizing lifetime or cumulative loss rate methodology. The lifetime loss rates are estimated by analyzing a combination of internal and external data related to historical performance of each loan and lease pool over a complete economic cycle. Loss rates are based on historical averages for each loan and lease pool, adjusted to reflect the impact of a forward-looking forecast of certain macroeconomic variables, primarily unemployment rates, which management considers to be both reasonable and supportable. Various economic scenarios are considered and weighted to arrive at the forecast that most reflects management’s expectation of future conditions. After a one-year forecast period, a one-year reversion period adjusts loss experience to the historical average on a straight-line basis.

Management also considers qualitative risk factor adjustments that are intended to capture internal and external trends not reflected in historical loss history. Each risk factor is assigned an allowance level based on management’s judgment as to the expected impact of each risk factor on each loan and lease portfolio and is monitored quarterly. All loans and leases of $500,000 or greater with an internal risk rating of substandard or below, or on nonaccrual status are individually evaluated for impairment on a quarterly basis.

The Company also maintains an allowance for credit losses on off-balance sheet credit exposures for unfunded loan commitments. The estimate includes consideration of the likelihood that funding will occur and an estimate of expected credit losses on commitments expected to be funded over its estimated life based on management’s consideration of past events, current conditions, and reasonable and supportable economic forecasts. Management tracks the level and trends in unused commitments and takes into consideration the same factors as those considered for purposes of the allowance for credit losses on outstanding loans.

Results for the years ended December 31, 2023 and 2022 are presented under CECL methodology while December 31, 2021 amounts are reported using prior accounting guidance. Additional information about these policies can be found in Note 1 of our audited consolidated financial statements contained in Part II, Item 8 of this report.

For acquisitions, we are required to record the assets acquired, including identified intangible assets such as goodwill, and the liabilities assumed at their fair value. These determinations often involve estimates based on third party valuations, such as appraisals or other valuations based on discounted cash flow analyses or other valuation techniques that may consider estimates such as attrition, growth rates, or other relevant assumptions. Goodwill is not amortized but is evaluated for impairment on an annual basis or more frequently should events warrant. We have selected November 30 as the date to perform the annual goodwill impairment test.

Impairment testing is performed using either a qualitative or quantitative approach at the reporting unit level. Our goodwill is allocated to Byline Bank, which is our only applicable reporting unit for the purposes of testing goodwill for impairment. We first apply a qualitative approach in which we consider if any recent events or circumstances indicate it is more likely than not that the fair value of the reporting unit is less than its carrying amount. These events and circumstances include our performance, the condition of the related industry in which Byline Bank operates and general economic environment. If we determine it is more likely than not that impairment exists, we will consider the quantitative approach. Using a quantitative approach, we compare the reporting unit’s fair value to its carrying value. If the carrying value of the reporting unit is determined to be higher than its fair value, we would measure and recognize an impairment loss. An impairment loss would not exceed the total amount of goodwill allocated to the reporting unit.

Other intangible assets primarily consist of core deposit intangible assets and customer relationship intangible. In valuing intangible assets, we consider variables such as servicing costs, attrition rates and market discount rates. Intangible assets are reviewed annually, or more frequently when events or changes in circumstances occur that indicate that their carrying values may not be recoverable. If the recoverable amount of the intangible asset is determined to be less than its carrying value, we would then measure the amount of impairment based on an estimate of the fair value at that time. We also evaluate whether the events or circumstances have occurred that warrant a revision to the remaining useful lives of intangible assets. In cases where a revision is deemed appropriate, the remaining carrying amounts of the intangible assets are amortized over the revised remaining useful life. Core deposit intangibles are currently amortized over an approximate ten-year period and customer intangibles are amortized over a twelve-year period.

A portion of the Company’s assets and liabilities are carried at fair value on the Consolidated Statements of Financial Condition, with changes in fair value recorded either through earnings or other comprehensive income in accordance with applicable accounting principles. These include the Company’s available-for-sale debt securities, equity securities, derivatives, and servicing assets.

ASC Topic 820, Fair Value Measurement defines fair value as the price that would be received to sell a financial asset or paid to transfer a financial liability in an orderly transaction between market participants at the measurement date.

The degree of management judgment involved in determining the fair value of assets and liabilities is dependent upon the availability of quoted market prices or observable market parameters. Assets acquired, liabilities assumed, and consideration exchanged are recorded at their respective acquisition date fair values. For financial instruments that trade actively and have quoted market prices or observable market parameters, there is minimal subjectivity involved in measuring fair value. When observable market prices and parameters are not available, management judgment and the use of models are necessary to estimate fair value. Significant assumptions used in models, which include assumptions for interest rates, discount rates, prepayments, and credit losses, are independently verified against observable market data when possible. When changes in market conditions reduce the availability of quoted prices or observable data, the estimate of fair value becomes more subjective and requires a higher degree of management judgment.

Refer to Note 17 of the notes to our audited consolidated financial statements contained in Item 8 of this report for a complete discussion of our use of fair value and the related measurement practices.

The following table summarizes certain selected historical consolidated financial data of Byline as of or for the fiscal years ended December 31, 2023, 2022, and 2021, and is derived from our audited financial statements. You should read this information in conjunction with our consolidated financial statements and related notes included in Item 8 of this report. Management uses the non-GAAP financial measures set forth herein in its analysis of our performance and believes that these non-GAAP financial measures provide useful information to management and investors; however, you should not view these disclosures as a substitute for results determined in accordance with GAAP financial measures.


Delaware	36-3012593
(State or other jurisdiction of incorporation or organization)	(I.R.S. Employer Identification No.)
180 North LaSalle Street, Suite 300 Chicago, IL	60601
(Address of principal executive offices)	(Zip Code)


Title of each class	Trading Symbol	Name of each exchange on which registered
Common Stock	BY	New York Stock Exchange


Auditor Firm Id:	659	Auditor Name:	Moss Adams LLP	Auditor Location:	Portland, Oregon, United States of America


		Page
PART I
Item 1.	Business	4
Item 1A.	Risk Factors	19
Item 1B.	Unresolved Staff Comments	30
Item 1C.	Cybersecurity	30
Item 2.	Properties	31
Item 3.	Legal Proceedings	31
Item 4.	Mine Safety Disclosures	31

PART II
Item 5.	Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities	32
Item 6.	[Reserved]	33
Item 7.	Management’s Discussion and Analysis of Financial Condition and Results of Operations	34
Item 7A.	Quantitative and Qualitative Disclosures About Market Risk	61
Item 8.	Financial Statements and Supplementary Data	63
Item 9.	Changes in and Disagreements With Accountants on Accounting and Financial Disclosure	127
Item 9A.	Controls and Procedures	127
Item 9B.	Other Information	127
Item 9C.	Disclosure Regarding Foreign Jurisdictions that Prevent Inspections	127

PART III
Item 10.	Directors, Executive Officers and Corporate Governance	127
Item 11.	Executive Compensation	128
Item 12.	Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters	128
Item 13.	Certain Relationships and Related Transactions, and Director Independence	129
Item 14.	Principal Accounting Fees and Services	129

PART IV
Item 15.	Exhibits and Financial Statement Schedules	130
Item 16.	Form 10-K Summary	131
	Signatures	132


	Female	Male	Racial/Ethnic	Overall Diversity
Workforce	61%	39%	43%	73%
Executive Leadership	43%	57%	36%	64%
Board of Directors	33%	67%	67%	78%


☒	ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934


☐	TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934 FOR THE TRANSITION PERIOD FROM TO


Large accelerated filer	☐	Accelerated filer	☒	Emerging growth company	☐

Non-accelerated filer	☐	Smaller reporting company	☐


Year		Company Acquired
2023		Inland Bancorp, Inc.
2019		Oak Park River Forest Bankshares, Inc.
2018		First Evanston Bancorp, Inc.
2016		Ridgestone Financial Services, Inc.
2014		Baytree Leasing Company LLC


Issuer Purchases of Equity Securities
							Maximum Number of
	Total		Average		Total Number of Shares		Shares that
	Number of		Price		Purchased as Part of a		May Yet Be
	Shares		Paid per		Publicly Announced		Purchased Under the
	Purchased(1)		Share		Plan or Program		Plan or Program
October 1 - October 31, 2023		3,206	$	19.62		—		1,250,000
November 1 - November 30, 2023		—		—		—		1,250,000
December 1 - December 31, 2023		15,228		23.56		—		1,250,000
Total		18,434	$	22.88		—



Index	12/31/2018		12/31/2019		12/31/2020		12/31/2021		12/31/2022		12/31/2023
Byline Bancorp, Inc.	$	100.00	$	117.65	$	93.85	$	168.27	$	143.47	$	149.67
Russel 2000		100.00		125.52		150.58		172.90		137.56		160.85
S&P U.S. Small Cap Bank		100.00		125.46		113.94		158.62		139.85		140.55
KRX		100.00		120.38		105.82		140.94		127.62		122.51


	As of or for the years ended December 31,
(Dollars in thousands except share and per share data)	2023		2022		2021
Income Statement Data
Net interest income	$	330,621	$	265,330	$	236,387
Provision for credit losses		31,653		23,879		973
Non-interest income		56,315		57,314		74,253
Non-interest expense		209,603		184,082		185,455
Income before income taxes		145,680		114,683		124,212
Provision for income taxes		37,802		26,729		31,427
Net income		107,878