Quiver Quantitative

Risk Factors Dashboard

Once a year, publicly traded companies issue a comprehensive report of their business, called a 10-K. A component mandated in the 10-K is the ‘Risk Factors’ section, where companies disclose any major potential risks that they may face. This dashboard highlights all major changes and additions in new 10K reports, allowing investors to quickly identify new potential risks and opportunities.

View risk factors by ticker

Search filings by term

Risk Factors - TSBK

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

Item 1A. Risk Factors – Our investment securities portfolio may be negatively impacted by fluctuations in market value and interest rates and result in losses” and "Note 3-Investment Securities" of the Notes to the Consolidated Financial Statements contained in Item 8 of this report.

Deposit Activities and Other Sources of Funds

General. Scheduled loan repayments are a relatively stable source of funds, while deposit inflows and outflows and loan prepayments are influenced significantly by general interest rates and money market conditions. Borrowings through the FHLB and the Federal Reserve Bank of San Francisco ("FRB") may be used to compensate for reductions in the availability of funds from other sources.

Deposit Accounts. Substantially all the Bank's depositors are residents of Washington. Deposits are attracted from within the Bank's market area through the offering of a broad selection of deposit instruments, including money market deposit accounts, checking accounts, regular savings accounts and certificates of deposit. Deposit account terms vary, according to the

minimum balance required, the time periods the funds must remain on deposit and the interest rate, among other factors. In determining the terms of its deposit accounts, the Bank considers current market interest rates, profitability to the Bank, matching deposit and loan products and its customer preferences and concerns. The Bank actively seeks consumer and commercial checking accounts through checking account acquisition marketing programs. The Bank also has checking accounts owned by businesses associated with the marijuana (or Initiative-502) industry in Washington State. It is generally permissible in Washington State to handle accounts associated with this industry in compliance with federal regulatory guidelines. At September 30, 2024, the Bank had $17.76 million, or 1.1% of total deposits, from businesses associated with the marijuana industry. See "Item 1A. Risk Factors" -

The Bank had $62.80 million in reciprocal negotiable order of withdrawal ("NOW") checking deposits and $30.67 million in reciprocal money market deposits at September 30, 2024. At September 30, 2024, the Bank had $48.76 million in brokered certificates of deposit. The Bank believes that its jumbo certificates of deposit, which represented 6.9% of total deposits at September 30, 2024, present similar interest rate risks as compared to its other deposits.

The following table sets forth information concerning the Bank's deposits at September 30, 2024:

______________________

(1)Based on remaining maturity of certificates.

The following table indicates the amount of the Bank's jumbo certificates of deposit by time remaining until maturity as of September 30, 2024. Jumbo certificates of deposit have principal balances of $250,000 or more, and the rates paid on these accounts are generally negotiable.

As of September 30, 2024, 2023 and 2022 approximately $471.08 million, $407.61 million and $122.69 million, respectively, of the Bank’s deposit portfolio was uninsured. These amounts are estimates based on methodologies and assumptions used for regulatory reporting purposes. The Bank is an approved public funds deposit institution in Washington, where applicable laws require public funds to be secured by qualified investment securities.

The following table sets forth the portion of our time deposits that are in excess of the FDIC insurance limit, by remaining time until maturity, as of September 30, 2024 (dollars in thousands).

Deposit Flow. The following table sets forth the balances of deposits in the various types of accounts offered by the Bank at the dates indicated:

Certificates of Deposit by Rates. The following table sets forth the certificates of deposit in the Bank classified by rates as of the dates indicated:

Certificates of Deposit by Maturities. The following table sets forth the amount and maturities of certificates of deposit by rate at September 30, 2024:

Deposit Activities. The following table sets forth the deposit activities of the Bank for the years indicated:

For additional information regarding our deposits, see "Note 10 - Deposits" of the Notes to Consolidated Financial Statements contained in Item 8 of this report.

Borrowings. The Bank may use borrowings from the FHLB to supplement its supply of lendable funds and to meet deposit withdrawal requirements. The FHLB functions as a central reserve bank providing credit for member financial institutions. As a member of the FHLB, the Bank is required to own capital stock in the FHLB and is authorized to apply for borrowings on the security of such stock and certain mortgage loans and other assets (principally securities which are obligations of, or guaranteed by, the U.S. government) provided certain creditworthiness standards have been met. Borrowings are made pursuant to several different credit programs. Each credit program has its own interest rate and range of maturities. Depending on the program, limitations on the amount of borrowings are based on the financial condition of the member institution and the adequacy of collateral pledged to secure the credit. A short-term borrowing line of credit of $50.00 million is also maintained at Pacific Coast Bankers' Bank ("PCBB"). The Bank had no outstanding balance on this borrowing line of credit at September 30, 2024.

For additional information regarding our borrowings, see "Note 11 - FHLB Borrowings and Other Borrowings" of the Notes to Consolidated Financial Statements contained in Item 8 of this report.

Bank Owned Life Insurance

The Bank has purchased life insurance policies covering certain officers. These policies are recorded at their cash surrender value, net of any cash surrender charges. Increases in cash surrender value, net of policy premiums, and proceeds from death benefits are recorded in non-interest income. At September 30, 2024, the cash surrender value of bank owned life insurance (“BOLI”) was $23.61 million.

How We Are Regulated

General. As a bank holding company, Timberland Bancorp is subject to examination and supervision by, and is required to file certain reports with, the Federal Reserve. Timberland Bancorp is also subject to the rules and regulations of the SEC under the federal securities laws. The Bank also is subject to regulation and examination by the FDIC, which insures the deposits of the Bank to the maximum extent permitted by law, and requirements established by the Federal Reserve. State law and regulations govern the Bank's ability to take deposits and pay interest thereon, to make loans on or invest in residential and other real estate, to make consumer loans, to invest in securities, to offer various banking services to its customers and to establish branch offices. Under state law, savings banks in Washington also generally have all the powers that federal savings banks have under federal laws and regulations. The Bank is subject to periodic examination and reporting requirements by and of the DFI and the FDIC.

The following is a brief description of certain laws and regulations applicable to Timberland Bancorp and the Bank. Descriptions of laws and regulations here and elsewhere in this report do not purport to be complete and are qualified in their entirety by reference to the actual laws and regulations. Legislation is introduced from time to time in the U.S. Congress or the Washington State Legislature that may affect the operations of Timberland Bancorp and the Bank. Any such legislation or regulatory changes in the future could adversely affect the Company's and the Bank's operations and financial condition. We cannot predict whether any such changes may occur.

The DFI and FDIC have extensive enforcement authority over all Washington state-chartered savings banks, including the Bank. The Federal Reserve has the same type of authority over Timberland Bancorp. This enforcement authority includes, among other things, the ability to assess civil money penalties, issue cease-and-desist orders and removal orders and initiate injunctive actions. In general, these enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices. Other actions or inactions may provide the basis for enforcement action, including misleading or untimely reports filed with the regulators.

Regulation of the Bank

The Bank, as a state-chartered savings bank, is subject to regulation and oversight by the FDIC and the DFI extending to all aspects of its operations.

Insurance of Accounts and Regulation by the FDIC. The Bank’s deposits are insured up to $250,000 per separately insured deposit ownership right or category by the Deposit Insurance Fund (‘DIF”) of the FDIC. As insurer, the FDIC imposes deposit insurance premiums and is authorized to conduct examinations of, and to require reporting by, FDIC-insured institutions. The FDIC assesses deposit insurance premiums quarterly on each FDIC-insured institution applied to its deposit base, which is their average consolidated total assets minus its Tier 1 capital. No institution may pay a dividend if it is in default on its federal deposit insurance assessment. Total base assessment rates currently range from 2.5 to 32 basis points subject to certain adjustments.

In October 2022, the FDIC finalized a rule that increased the initial base deposit insurance assessment rates by 2 basis points, beginning with the first quarterly assessment period of 2023 (January 1, 2023 through March 31, 2023). The FDIC, as required under the Federal Deposit Insurance Act, established a plan in September 2020 to restore the DIF reserve ratio to meet or exceed the statutory minimum of 1.35% within eight years. This plan did not include an increase in the deposit insurance assessment rate. Based on the FDIC’s recent projections, however, the FDIC determined that the DIF reserve ratio is at risk of not reaching the statutory minimum by the statutory deadline of September 30, 2028 without increasing the deposit insurance assessment rates. The increased assessment would improve the likelihood that the DIF reserve ratio would reach the required minimum by the statutory deadline, consistent with the FDIC’s Amended Restoration Plan. The FDIC also concurrently

maintained the Designated Reserve Ratio (“DRR”) for the DIF at 2% for 2024 and will maintain it at that level for 2025. The revised assessment rate schedules will remain in effect unless and until the reserve ratio meets or exceeds 2% to support growth in the DIF in progressing toward the FDIC’s long-term goal of a 2% DRR. Progressively lower assessment rate schedules will take effect when the reserve ratio reaches 2%, and again when it reaches 2.5%.

In a banking industry emergency, the FDIC may also impose a special assessment. As insurer, the FDIC is authorized to conduct examinations of and to require reporting by FDIC-insured institutions. The FDIC also may prohibit any insured institution from engaging in any activity the FDIC determines by regulation or order to pose a serious risk to the DIF. The FDIC also has the authority to take enforcement actions against banks and savings associations. Management is not aware of any existing circumstances which would result in termination of the Bank's deposit insurance.

Capital Requirements. Federally insured financial institutions, such as the Bank, and their holding companies, are required to maintain a minimum level of regulatory capital. The Bank is subject to capital regulations adopted by the FDIC, which establish minimum required ratios for a common equity Tier 1 (“CET1”) capital to risk-based assets ratio, a Tier 1 capital to risk-based assets ratio, a total capital to risk-based assets ratio and a Tier 1 capital to total assets leverage ratio. The capital standards require the maintenance of the following minimum capital ratios: (i) a CET1 capital ratio of 4.5%; (ii) a Tier 1 capital ratio of 6%; (iii) a total capital ratio of 8%; and (iv) a Tier 1 leverage ratio of 4%. Consolidated regulatory capital requirements identical to those applicable to subsidiary banks generally apply to bank holding companies. However, the Federal Reserve has provided a “Small Bank Holding Company” exception to its consolidated capital requirements, and bank holding companies with less than $3.0 billion of consolidated assets are not subject to the consolidated holding company capital requirements unless otherwise directed by the Federal Reserve.

The Economic Growth, Regulatory Relief and Consumer Protection Act (“EGRRCPA”), enacted in May 2018, required the federal banking agencies, including the FDIC, to establish for institutions with assets of less than $10 billion a “community bank leverage ratio” or “CBLR” of between 8 to 10%. Institutions with capital meeting or exceeding the ratio and otherwise complying with the specified requirements (including off-balance sheet exposures of 25% or less of total assets and trading assets and liabilities of 5% or less of total assets) and electing the alternative framework are considered to comply with the applicable regulatory capital requirements, including the risk-based requirements. The CBLR was established at 9% Tier 1 capital to total average assets, effective January 1, 2020. A qualifying institution may opt in and out of the community bank leverage ratio framework on its quarterly call report. An institution that temporarily ceases to meet any qualifying criteria is provided with a two-quarter grace period to again achieve compliance. The Bank has not elected to use the CBLR framework as of September 30, 2024.

To be considered well-capitalized under the prompt corrective action regulations, the Bank must maintain a CET1 risk-based ratio of 6.5%, a Tier 1 risk-based ratio of 8%, a total risk-based capital ratio of 10% and a leverage ratio of 5%, and the Bank must not be subject to an individualized order, directive or agreement under which its primary federal banking regulator requires it to maintain a specific capital level.

In addition to the minimum capital requirements, the Bank must maintain a capital conservation buffer that consists of additional CET1 capital greater than 2.5% of risk-weighted assets above the required minimum risk-based capital ratios to avoid limitations on paying dividends, repurchasing shares and paying certain discretionary bonuses. At September 30, 2024, the Bank met the requirements to be "well capitalized," and the Bank's CET1 capital exceeded the required conservation buffer.

For additional information regarding the Bank's regulatory capital requirements, see "Note 17-Regulatory Matters" of the Notes to the Consolidated Financial Statements contained in Item 8 of this report.

Prompt Corrective Action. Federal statutes establish a supervisory framework based on five capital categories: well capitalized, adequately capitalized, undercapitalized, significantly undercapitalized and critically undercapitalized. An institution’s category depends upon where its capital levels are in relation to relevant capital measures, which include a risk-based capital measure, a leverage ratio capital measure and certain other factors. An institution that is not well capitalized is subject to certain restrictions on brokered deposits, including restrictions on the rates it can offer on its deposits generally. Any institution which is neither well capitalized nor adequately capitalized is considered undercapitalized. The final rule establishing an elective "community bank leverage ratio" regulatory capital framework provides that a qualifying institution whose capital exceeds the CBLR and opts to use the framework will be considered "well capitalized" for purposes of prompt corrective action.

Undercapitalized institutions are subject to certain prompt corrective action requirements, regulatory controls and restrictions which become more extensive as an institution becomes more severely undercapitalized. Failure by an institution to comply

with applicable capital requirements would, if unremedied, result in progressively more severe restrictions on its activities and lead to enforcement actions, including, but not limited to, the issuance of a capital directive to ensure the maintenance of required capital levels and, ultimately, the appointment of the FDIC as receiver or conservator. Banking regulators will take prompt corrective action with respect to depository institutions that do not meet minimum capital requirements. Additionally, approval of any regulatory application filed for their review may be dependent on compliance with capital requirements.

At September 30, 2024, the Bank was categorized as “well capitalized” under the prompt corrective action regulations of the FDIC. For additional information regarding the Bank's minimum regulatory capital requirements, see "Capital Requirements" above and "Note 17 - Regulatory Matters" of the Notes to the Consolidated Financial Statements contained in Item 8 of this report.

Federal Home Loan Bank System. The Bank is a member of the FHLB, one of 11 regional Federal Home Loan Banks that administer the home financing credit function of savings institutions, each serving as a reserve or central bank for its members within its assigned region. The FHLB is funded primarily from proceeds derived from the sale of consolidated obligations of the FHLB System. It makes loans to members in accordance with policies and procedures, established by the Board of Directors of the FHLB, which are subject to the oversight of the Federal Housing Finance Board. All borrowings from the FHLB are required to be fully secured by sufficient collateral as determined by the FHLB. In addition, all long-term borrowings are required to provide funds for residential home financing. See “Deposit Activities and Other Sources of Funds – Borrowings" above.

As a member, the Bank is required to purchase and maintain stock in the FHLB based on the Bank's asset size and level of borrowings from the FHLB. At September 30, 2024, the Bank had $2.04 million in FHLB stock, which was in compliance with this requirement. The FHLB pays dividends quarterly, and the Bank received $158,000 in dividends during the year ended September 30, 2024.

The Federal Home Loan Banks continue to contribute to low- and moderately-priced housing programs through direct loans or interest subsidies on borrowings targeted for community investment and low- and moderate-income housing projects. These contributions have adversely affected the level of FHLB dividends paid and could continue to do so in the future. These contributions could also have an adverse effect on the value of FHLB stock in the future. A reduction in value of the Bank's FHLB stock may result in a decrease in net income and possibly capital.

Standards for Safety and Soundness. Each federal banking agency, including the FDIC, has adopted guidelines establishing general standards relating to internal controls, information and internal audit systems; loan documentation; credit underwriting; interest rate risk exposure; asset growth; asset quality; earnings; and compensation, fees and benefits. In general, the guidelines require, among other things, appropriate systems and practices to identify and manage the risks and exposures specified in the guidelines. The guidelines prohibit excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director, or principal shareholder. If the FDIC determines that an institution fails to meet any of these guidelines, it may require an institution to submit to the FDIC an acceptable plan to achieve compliance. Management of the Bank is not aware of any conditions relating to these safety and soundness standards which would require submission of a plan of compliance.

The federal banking agencies have issued guidance on sound risk management practices for concentrations in commercial real estate lending. The particular focus is on exposure to commercial real estate loans that are dependent on the cash flow from the real estate held as collateral and that are likely to be sensitive to conditions in the commercial real estate market (as opposed to real estate collateral held as a secondary source of repayment or as an abundance of caution). The purpose of the guidance is not to limit a bank’s commercial real estate lending but to guide banks in developing risk management practices and capital levels commensurate with the level and nature of real estate concentrations. The guidance directs the FDIC and other federal bank regulatory agencies to focus their supervisory resources on institutions that may have significant commercial real estate loan concentration risk. A bank that has experienced rapid growth in commercial real estate lending, has notable exposure to a specific type of commercial real estate loan, or is approaching or exceeding the following supervisory criteria may be identified for further supervisory analysis with respect to real estate concentration risk:

•Total reported loans for construction, land development and other land represent 100% or more of the bank’s total regulatory capital; or

•Total commercial real estate loans (as defined in the guidance) represent 300% or more of the bank’s total regulatory capital and the outstanding balance of the bank’s commercial real estate loan portfolio has increased 50% or more during the prior 36 months.

The guidance provides that the strength of an institution’s lending and risk management practices with respect to such concentrations will be taken into account in supervisory guidance on evaluation of capital adequacy. As of September 30, 2024, the Bank’s aggregate recorded loan balances for construction, land development and land loans were 72.42% of regulatory capital. In addition, at September 30, 2024 the Bank’s loans on commercial real estate, as defined by the FDIC, were 290.74% of regulatory capital.

Activities and Investments of Insured State-Chartered Financial Institutions. Federal law generally limits the activities and equity investments of FDIC-insured state-chartered banks to those that are permissible for national banks. An insured state bank is not prohibited from, among other things, (i) acquiring or retaining a majority interest in a subsidiary, (ii) investing as a limited partner in a partnership, the sole purpose of which is direct or indirect investment in the acquisition, rehabilitation or new construction of a qualified housing project, provided that such limited partnership investments may not exceed 2% of the bank's total assets, (iii) acquiring up to 10% of the voting stock of a company that solely provides or reinsures directors' and officers' liability insurance coverage or bankers' blanket bond group insurance coverage for insured depository institutions, and (iv) acquiring or retaining the voting shares of a depository institution owned by another FDIC-insured institution if certain requirements are met.

Under the laws of Washington State, Washington-chartered savings banks may exercise any of the powers of Washington-chartered commercial banks, national banks and federally-chartered savings banks, subject to the approval of the DFI in certain situations. In addition, Washington-chartered savings banks may charge the maximum interest rate allowable for loans and other extensions of credit by federally-chartered financial institutions to Washington residents.

Environmental Issues Associated With Real Estate Lending. The Comprehensive Environmental Response, Compensation and Liability Act (“CERCLA”) is a federal statute that generally imposes strict liability on all prior and present "owners and operators" of sites containing hazardous waste. However, Congress acted to protect secured creditors by providing that the term “owner and operator” excludes a person whose ownership is limited to protecting its security interest in the site. Since the enactment of the CERCLA, this “secured creditor exemption” has been the subject of judicial interpretations which have left open the possibility that lenders could be liable for cleanup costs on contaminated property that they hold as collateral for a loan.

To the extent that legal uncertainty exists in this area, all creditors, including the Bank, that have made loans secured by properties with potentially hazardous waste contamination (such as petroleum contamination) could be subject to liability for cleanup costs, which costs often substantially exceed the value of the collateral property.

Federal Reserve System. The Federal Reserve requires all depository institutions to maintain reserves at specified levels against their transaction accounts, primarily checking accounts. The Federal Reserve reduced reserve requirement ratios to zero percent effective on March 26, 2020. At September 30, 2024, the reserve requirement of zero percent was still in place.

Transactions with Affiliates. Timberland Bancorp, Inc. and the Bank are separate and distinct legal entities. The Bank is an affiliate of Timberland Bancorp, Inc. Federal laws strictly limit the ability of banks to engage in certain transactions with their affiliates. Transactions deemed to be a “covered transaction” under Section 23A of the Federal Reserve Act between a bank and an affiliate are limited to 10% of the bank's capital and surplus and, with respect to all affiliates, to an aggregate of 20% of the bank's capital and surplus. Further, covered transactions that are loans and extensions of credit generally are required to be secured by eligible collateral in specified amounts. Federal law also requires that covered transactions and certain other transactions listed in Section 23B of the Federal Reserve Act between a bank and its affiliates be on terms as favorable to the bank as transactions with non-affiliates.

Community Reinvestment Act. Banks are also subject to the provisions of the Community Reinvestment Act of 1977 (“CRA”), which requires the appropriate federal bank regulatory agency to assess a bank’s performance under the CRA in meeting the credit needs of the community serviced by the bank, including low- and moderate-income neighborhoods. The regulatory agency’s assessment of the bank’s record is made available to the public. Further, a bank’s performance must be considered in connection with a bank’s application to, among other things, establish a new branch office that will accept deposits, relocate an existing office or merge or consolidate with, or acquire the assets or assume the liabilities of, a federally regulated financial institution. The Bank received a “satisfactory” rating during its most recent examination.

On October 24, 2023, the federal banking agencies, including the FDIC, issued a final rule designed to strengthen and modernize regulations implementing the CRA. The changes are designed to encourage banks to expand access to credit, investment and banking services in low and moderate income communities, adapt to changes in the banking industry including mobile and internet banking, provide greater clarity and consistency in the application of the CRA regulations and tailor CRA evaluations and data collection to bank size and type. The Bank cannot predict the impact the changes to the CRA will have on its operations at this time.

Dividends. Dividends from the Bank constitute the major source of funds available for dividends which may be paid to Company shareholders. The amount of dividends payable by the Bank to the Company depends upon the Bank's earnings and capital position, and is limited by federal and state laws, regulations and policies. According to Washington law, the Bank may not declare or pay a cash dividend on its capital stock if it would cause its net worth to be reduced below (i) the amount required for liquidation accounts or (ii) the net worth requirements, if any, imposed by the Director of the DFI. In addition, dividends on the Bank's capital stock may not be paid in an aggregate amount greater than the aggregate retained earnings of the Bank, without the approval of the Director of the DFI. Dividends payable by the Bank can be limited or prohibited if the Bank does not meet the capital conservation buffer requirement.

The amount of dividends actually paid during any one period will be strongly affected by the Bank's management policy of maintaining a strong capital position. Federal law further provides that no insured depository institution may pay a cash dividend if it would cause the institution to be “undercapitalized,” as defined in the prompt corrective action regulations. Moreover, the federal bank regulatory agencies also have the general authority to limit the dividends paid by insured banks if such payments should be deemed to constitute an unsafe and unsound practice.

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA Patriot Act) was signed into law on October 26, 2001. The USA PATRIOT Act and the Bank Secrecy Act requires financial institutions to develop programs to prevent financial institutions from being used for money laundering and terrorist activities. If such activities are detected, financial institutions are obligated to file suspicious activity reports with the U.S. Treasury’s Office of Financial Crimes Enforcement Network. These rules require financial institutions to establish procedures for identifying and verifying the identity of customers seeking to open new financial accounts, and, effective in 2018, the beneficial owners of accounts. Bank regulators are directed to consider a holding company’s effectiveness in combating money laundering when ruling on Bank Holding Company Act and Bank Merger Act applications.

Privacy Standards and Cybersecurity. The Gramm-Leach-Bliley Financial Services Modernization Act of 1999 modernized the financial services industry by establishing a comprehensive framework to permit affiliations among commercial banks, insurance companies, securities firms and other financial service providers. Federal banking agencies, including the FDIC, have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of the board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services. These regulations require the Bank to disclose its privacy policy, including informing consumers of its information sharing practices and informing consumers of their rights to opt out of certain practices. In addition, Washington and other federal and state cybersecurity and data privacy laws and regulations may expose the Bank to risk and result in certain risk management costs. In addition, on November 18, 2021, the federal banking agencies announced the adoption of a final rule providing for new notification requirements for banking organizations and their service providers for significant cybersecurity incidents. Specifically, the new rule requires a banking organization to notify its primary federal regulator as soon as possible, and no later than 36 hours after, the banking organization determines that a “computer-security incident” rising to the level of a “notification incident” has occurred. Notification is required for incidents that have materially affected or are reasonably likely to materially affect the viability of a banking organization’s operations, its ability to deliver banking products and services, or the stability of the financial sector. Service providers are required under the rule to notify affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has materially affected or is reasonably likely to materially affect the banking organization’s customers for four or more hours. Compliance with the new rule was required by May 1, 2022. Non-compliance with federal or similar state privacy and cybersecurity laws and regulations could lead to substantial regulatory imposed fines and penalties, damages from private causes of action and/or reputational harm. Please see " Cybersecurity".

Further, on July 26, 2023, the SEC adopted final rules that require public companies to promptly disclose material cybersecurity incidents in a Current Report on Form 8-K (“Form 8-K”) and detailed information regarding their cybersecurity risk management and governance on an annual basis in an Annual Report on Form 10-K (Form 10-K”). Companies will be required to report on Form 8-K any cybersecurity incident they determine to be material within four business days of making that determination. Smaller reporting companies, such as the Company, must begin complying with incident reporting on Form 8-K no later than June 15, 2024. Companies must provide the annual disclosures about cybersecurity risk management and governance beginning with their Form 10-K for fiscal years ending on or after December 15, 2023.

Other Consumer Protection Laws and Regulations. The Bank is subject to consumer protection regulations issued by the CFPB, but as a smaller financial institution, is generally subject to supervision and enforcement by the FDIC and DFI with respect to its compliance with federal and state consumer financial protection laws and regulations.

The Bank is subject to a broad array of federal and state consumer protection laws and regulations that govern almost every aspect of its business relationships with consumers. While the list set forth below is not exhaustive, these include the Truth-in-Lending Act, the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Equal Credit Opportunity Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Home Mortgage Disclosure Act, the Fair Credit Reporting Act, the Fair Debt Collection Practices Act, the Right to Financial Privacy Act, the Home Ownership and Equity Protection Act, the Consumer Leasing Act, the Fair Credit Billing Act, the Homeowners Protection Act, the Check Clearing for the 21st Century Act, laws governing flood insurance, laws governing consumer protections in connection with the sale of insurance, federal and state laws prohibiting unfair and deceptive business practices, and various regulations that implement some or all of the foregoing. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must deal with customers when taking deposits, making loans, collecting loans, and providing other services. Failure to comply with these laws and regulations can subject the Bank to various penalties, including but not limited to, enforcement actions, injunctions, fines, civil liability, criminal penalties, punitive damages, and the loss of certain contractual rights.

Regulation of the Company

General. The Company, as the sole shareholder of the Bank, is a bank holding company registered with the Federal Reserve. Bank holding companies are subject to comprehensive regulation by the Federal Reserve under the Bank Holding Company Act of 1956, as amended (“BHCA”), and the regulations promulgated thereunder. This regulation and oversight are generally intended to ensure that the Company limits its activities to those allowed by law and that it operates in a safe and sound manner without endangering the financial health of the Bank.

As a bank holding company, the Company is required to file semi-annual reports with the Federal Reserve and any additional information required by the Federal Reserve and is subject to regular examinations by the Federal Reserve. The Federal Reserve also has extensive enforcement authority over bank holding companies, including the ability to assess civil money penalties, to issue cease and desist or removal orders and to require that a holding company divest subsidiaries (including its bank subsidiaries). In general, enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices.

BHCA. The Company is supervised by the Federal Reserve under the BHCA. The Federal Reserve has a policy that a bank holding company is required to serve as a source of financial and managerial strength to its subsidiary bank and may not conduct its operations in an unsafe or unsound manner. In addition, the Dodd-Frank Act and earlier Federal Reserve policy provide that a bank holding company should serve as a source of strength to its subsidiary bank by having the ability to provide financial assistance to its subsidiary bank during periods of financial distress to the bank. A bank holding company’s failure to meet its obligation to serve as a source of strength to its subsidiary bank will generally be considered by the Federal Reserve to be an unsafe and unsound banking practice or a violation of the Federal Reserve’s regulations or both. No regulations have yet been proposed by the Federal Reserve to implement the source of strength provisions required by the Dodd-Frank Act. Timberland Bancorp, Inc. and any subsidiaries that it may control are considered “affiliates” within the meaning of the Federal Reserve Act, and transactions between the Bank and affiliates are subject to numerous restrictions. With some exceptions, Timberland Bancorp, Inc. and its subsidiaries are prohibited from tying the provision of various services, such as extensions of credit, to other services offered by Timberland Bancorp, Inc. or by its affiliates.

Acquisitions. The BHCA prohibits a bank holding company, with certain exceptions, from acquiring ownership or control of more than 5% of the voting shares of any company that is not a bank or bank holding company and from engaging in activities other than those of banking, managing or controlling banks, or providing services for its subsidiaries. Under the BHCA, the Federal Reserve may approve the ownership of shares by a bank holding company in any company, the activities of which the Federal Reserve has determined to be so closely related to the business of banking or managing or controlling banks as to be a proper incident thereto. These activities include: operating a savings institution, mortgage company, finance company, credit card company or factoring company; performing certain data processing operations; providing certain investment and financial advice; underwriting and acting as an insurance agent for certain types of credit-related insurance; leasing property on a full-payout, non-operating basis; selling money orders, travelers’ checks and U.S. Savings Bonds; real estate and personal property appraising; providing tax planning and preparation services; and, subject to certain limitations, providing securities brokerage

services for customers. The Federal Reserve must approve the acquisition (or acquisition of control) of a bank or other FDIC-insured depository institution by a bank holding company, and the appropriate federal banking regulator must approve a bank’s acquisition (or acquisition of control) of another bank or other FDIC-insured institution.

Acquisition of Control of a Bank Holding Company. Under federal law, a notice or application must be submitted to the appropriate federal banking regulator if any person (including a company), or group acting in concert, seeks to acquire “control” of a bank holding company. An acquisition of control can occur upon the acquisition of 10% or more of the voting stock of a bank holding company or as otherwise defined by federal regulations. In considering such a notice or application, the Federal Reserve takes into consideration certain factors, including the financial and managerial resources of the acquirer and the anti-trust effects of the acquisition. Any company that acquires control becomes subject to regulation as a bank holding company. Depending on circumstances, a notice or application may be required to be filed with appropriate state banking regulators and may be subject to their approval or non-objection.

Dividends. Federal Reserve policy limits the payment of cash dividends by bank holding companies, which expresses the Federal Reserve's view that a bank holding company should pay cash dividends only to the extent that the company's net income for the past year is sufficient to cover both the cash dividends and a rate of earnings retention that is consistent with the company's capital needs, asset quality and overall financial condition, and that it is inappropriate for a company experiencing serious financial problems to borrow funds to pay dividends. Under Washington corporate law, the Company generally may not pay dividends if after that payment it would not be able to pay its liabilities as they become due in the usual course of business, or its total assets would be less than its total liabilities. The capital conservation buffer requirement can also limit dividends.

Stock Repurchases. Bank holding companies, except for certain “well-capitalized” and highly rated bank holding companies, are required to give the Federal Reserve prior written notice of any purchase or redemption of its outstanding equity securities if the consideration for the purchase or redemption, when combined with the net consideration paid for all such purchases or redemptions during the preceding 12 months, is equal to 10% or more of their consolidated net worth. The Federal Reserve may disapprove a purchase or redemption if it determines that the proposal would constitute an unsafe or unsound practice or would violate any law, regulation, Federal Reserve order, or any condition imposed by, or written agreement with, the Federal Reserve.

Capital Requirements. As discussed above, pursuant to the “Small Bank Holding Company” exception, effective August 30, 2018, bank holding companies with less than $3.0 billion in consolidated assets were generally no longer subject to the Federal Reserve’s capital regulations, which are generally the same as the capital regulations applicable to the Bank. At the time of this change, Timberland Bancorp, Inc. was considered “well capitalized” as defined for a bank holding company with a total risk-based capital ratio of 10.0% or more and a Tier 1 risk-based capital ratio of 8.0% or more, and was not subject to an individualized order, directive or agreement under which the Federal Reserve requires it to maintain a specific capital level. If the Company were subject to regulatory guidelines for bank holding companies with $3.0 billion or more in assets, at September 30, 2024, the Company would have exceeded all regulatory requirements.

For additional information, see "Note 17 - Regulatory Matters" of the Notes to the Consolidated Financial Statements contained in Item 8 of this report.

Federal Securities Laws. Timberland Bancorp, Inc.’s common stock is registered with the SEC under Section 12(b) of the Securities Exchange Act of 1934, as amended (“Exchange Act”). The Company is subject to information, proxy solicitation, insider trading restrictions and other requirements under the Exchange Act.

Taxation

Federal Taxation

General. The Company and the Bank report their operations on a fiscal year basis using the accrual method of accounting and are subject to federal income taxation in the same manner as other corporations. The following discussion of tax matters is intended only as a summary and does not purport to be a comprehensive description of the tax rules applicable to the Bank or the Company.

Dividends-Received Deduction. The Company may exclude from its income 100.0% of dividends received from the Bank as a member of the same affiliated group of corporations. The corporate dividends-received deduction is generally 50.0% in the case of dividends received from unaffiliated corporations with which the Company and the Bank will not file a consolidated tax return, except that if the Company or the Bank owns more than 20.0% and less than 80% of the stock of a corporation distributing a dividend, then 65.0% of any dividends received may be deducted.

Audits. The Company is no longer subject to U.S. federal tax examination by tax authorities for years ended on or before September 30, 2020.

For additional information regarding our federal income taxes, see "Note 13-Income Taxes" of the Notes to Consolidated Financial Statements contained in Item 8 of this report.

Washington Taxation

The Company and the Bank are subject to a business and occupation tax imposed under Washington law at the rate of 1.8% of gross receipts at September 30, 2024. In addition, various municipalities also assess business and occupation taxes at differing rates. Interest received on loans secured by mortgages or deeds of trust on residential properties, certain residential mortgage-backed securities, and certain U.S. government and agency securities is not subject to this tax.

Competition

The Bank operates in an intensely competitive market for the attraction of deposits and in the origination of loans. The Bank competes for loans and deposits with other commercial banks, thrift institutions, credit unions, mortgage bankers and other providers of financial services, including finance companies, online-only banks, mutual funds, insurance companies, and more recently with financial technology companies that rely on technology to provide financial services. Many of our competitors have substantially greater resources than we do. Particularly in times of high or rising interest rates, the Bank also faces significant competition for investor's funds from short-term money market securities and other corporate and government securities. The Bank competes for loans principally through the range and quality of services we provide, interest rates and loan fees, and robust delivery channels for our products and services. The Bank actively solicits deposit-related clients and competes for deposits by offering depositors a variety of savings accounts, checking accounts, cash management and other services.

Subsidiary Activities

The Company has one wholly-owned subsidiary, the Bank. (“Timberland Service”), whose primary function is to provide escrow services.

Employees and Human Capital Resources

In line with our dedication to transparency and excellence, we are pleased to present an overview of the Company’s human capital strategies and achievements. Our emphasis on nurturing a dynamic, engaged, and resilient workforce remains central to our success. We are proud of the progress made in enhancing our human capital, recognizing it as a fundamental driver of the Company’s sustained growth. These initiatives collectively underscore our commitment to fostering a workforce deeply connected to the needs and values of our community.

Workforce Representation. As of September 30, 2024, the Company had 274 full-time employees and 14 part-time and on-call employees. The employees are not represented by a collective bargaining unit, and the Company believes that its relationship with its employees is positive. We recognize that our ability to attract and retain employees is a key to our success, and we strive to offer competitive salaries and benefits while staying aligned with market standards. The average tenure among employees was seven years at September 30, 2024, with women representing 76% of the workforce and holding 76% of management roles, including supervisors, managers, and executive leaders. Management tenure averaged 12.7 years. The Company's Board of Directors is comprised of the Company's Chief Executive Officer and seven non-employee directors, four of whom identify as female and one as a member of a minority community.

Talent Acquisition and Attrition. Our strategic talent acquisition efforts have strengthened our workforce by bringing in diverse skill sets aligned with our goals. Our recruitment strategy prioritizes hiring local talent, enhancing our teams with individuals who have strong connections to the communities we serve. To promote diversity, we continue to refine our approach by advertising open positions on platforms that reach diverse audiences. We are committed to a fair and equitable hiring process, ensuring all roles are posted both internally and externally.

Diversity, Equity, and Inclusion (“DEI”). The Company values the unique identities, perspectives, and contributions of its employees. To support this, the Company implemented a formal program designed to create an inclusive environment that ensures equitable access to growth and development opportunities while building a workforce that reflects the communities we serve. This program is overseen by our Human Resources Director and focuses on education, training, recruitment, and hiring practices. Key initiatives include unconscious bias training for hiring managers, DEI online training for all employees, and the introduction of an Employee Resource Group. These efforts aim to promote equity, fairness, and inclusivity across the organization, fostering meaningful employee engagement.

Benefits. The Company provides competitive and comprehensive benefits to its employees. We are committed to maintaining a safe and healthy workplace, implementing proactive measures to protect our team. Benefit programs available to eligible employees may include 401(k) savings plan, employee stock ownership plan, health and life insurance, health savings accounts and flexible spending accounts, employee assistance program, paid holidays, paid time off, paid volunteer time, paid time off for the employee’s birthday and other leave as applicable. To further promote wellness, we provide initiatives through DEI programs and benefits administration that emphasize self-care, nutrition, work-life balance, and financial education. This sustained focus on health and safety reflects our dedication to fostering a secure and supportive work environment.

We are committed to offering competitive and equitable total rewards packages that recognize and reinforce the dedication and contributions of our employees. Our total rewards program reflects this commitment through transparent wage and benefit information for posted positions, a 401(k) plan, an employee stock ownership plan, healthcare and insurance benefits, profit sharing for eligible employees, annual merit-based performance increases, organizational celebrations, wellness campaigns, recognition events, and opportunities for career development within the organization.

Our community-focused approach has significantly boosted employee engagement, fostering a strong sense of belonging and purpose. To this end, we provide continuous training opportunities throughout their careers using a variety of methods, including third-party resources, in-house programs, and computer-based training. Managers and supervisors participate in monthly training sessions on topics such as performance coaching and employee development, which are designed and delivered in-house and offered virtually. To further support career development, employees are encouraged to shadow and observe other areas of the Company.

All employees receive semi-annual performance reviews, and new employees undergo a formal 90-day assessment at the end of their probationary period. Additionally, we conduct an annual Employee Survey to gather feedback, with results informing ongoing engagement strategies.

Employees are encouraged to share their ideas and are supported in their professional growth and contributions to the organization. To attract new talent, the Company offers an employee referral incentive. We also reward employees for performance, tenure, process improvements, and efficiencies. Vacation leave accruals increase with length of service, recognizing employees' commitment to the Company.

Talent Development and Succession Planning. The Company recognizes that the skills and knowledge of its employees are critical to the success of the organization and actively supports training and continuing education as an ongoing priority. For certain positions, additional training and testing programs are available to enhance skills and recognize mastery within those positions. Employees are encouraged to attend external education opportunities in the form of training, conferences, and networking events. The Company’s comprehensive talent development programs are tailored to meet the unique needs of our employees, fostering growth that aligns with our core values.

Volunteerism. The Company embraces social responsibility, with our workforce actively participating in volunteer initiatives that make a positive impact on our communities. Volunteerism remains a cornerstone of our culture, reflecting our commitment to giving back. To support this, eligible employees are provided with 20 hours of paid time annually to volunteer with non-profit organizations within the Company’s geographic footprint, directly benefiting the communities we serve.

Executive Officers of the Registrant

The following table sets forth certain information with respect to the executive officers of the Company and the Bank:

Executive Officers of the Company and Bank

Biographical Information.

Dean J. Brydon has been affiliated with the Bank since 1994 and has served as Chief Executive Officer of the Bank and the Company since February 1, 2023. Prior to his promotion to Chief Executive Officer Mr. Brydon served as President of the Bank and Company from January 2022 to January 2023. Mr. Brydon also served as the Chief Financial Officer of the Company and the Bank from January 2000 to January 2023. Mr. Brydon also served as Secretary of the Company and the Bank from January 2004 to January 2022. Mr. Brydon is a Certified Public Accountant.

Jonathan A. Fischer has been affiliated with the Bank since October 1997 and was promoted to President of the Bank and the Company on February 1, 2023. Mr. Fischer has served as Chief Operating Officer since August 23, 2012 and as Secretary of the Bank and the Company since January 2022. Prior to that, Mr. Fischer had served as the Compliance Officer from January 2000 to October 2012 and the Chief Risk Officer from October 2010 to January 2014.

Marci A. Basich has been affiliated with the Bank since 1999 and was promoted to Executive Vice President and Chief Financial Officer of the Bank and Company on February 1, 2023. Previously Ms. Basich served as Treasurer of the Bank and Company from January 2002 to January 2023. Ms. Basich is a Certified Public Accountant.

Matthew J. DeBord has been affiliated with the Bank since 2012 and was promoted to Executive Vice President and Chief Lending Officer on April 1, 2023. Prior to being promoted to Chief Lending Officer, Mr. DeBord served as a Commercial Loan Officer and Commercial Lending Team Leader. Prior to joining the Bank, Mr. DeBord was employed by a national bank as a Commercial Resolution Officer from January 2010 to December 2012. Mr. DeBord was a Vice President and Portfolio Manager with a local Savings Bank from April 2006 to January 2010 and was employed by the DFI as a Financial Examiner from June of 2003 to April 2006.

Todd W. Van Cise has been affiliated with the Bank since 2012 and has served as Chief Credit Officer since January 2024. Prior to that he had served as a Commercial Lending Team Leader.

Breanne D. Antich, has been affiliated with the Bank since 2007 and was promoted to Chief Technology Officer on January 25, 2022 and was promoted to Executive Vice President on February 1, 2023. Prior to this Ms. Antich served as our Information Technology Manager.

Item 1A. Risk Factors

We assume and manage a certain degree of risk in order to conduct our business. In addition to the risk factors described below, other risks and uncertainties not specifically mentioned, or that are currently known to, or deemed to be immaterial by management, also may materially and adversely affect our financial position, results of operations and/or cash flows. Before making an investment decision, you should carefully consider the risks described below together with all the other information included in this Form 10-K and our other filings with the SEC. If any of the circumstances described in the following risk factors actually occur to a significant degree, the value of our common stock could decline, and you could lose all or part of your investment. This report is qualified in its entirety by these risk factors.

Risks Related to Economic Conditions

Our business may be adversely affected by downturns in the national economy and in the economies in our market areas.

Substantially all our loans are to businesses and individuals in the state of Washington. General economic conditions, including inflation, unemployment and money supply fluctuations, also may adversely affect our profitability. Weakness in the global economy and global supply chain issues have adversely affected many businesses operating in our markets that are dependent upon international trade.

A deterioration in economic conditions in the market areas we serve as a result of inflation, a recession, war, geopolitical conflicts, adverse weather or other factors could result in the following consequences, any of which could have a materially adverse impact on our business, financial condition and results of operations:

•loan delinquencies, problem assets and foreclosures may increase;

•we may increase our ACL;

•the sale of foreclosed assets may slow;

•demand for our products and services may decline possibly resulting in a decrease in our total loans, total deposits, or assets;

•collateral for loans made may decline in value, exposing us to increased risk loans, reducing customers’ borrowing power, and reducing the value of assets and collateral associated with existing loans;

•the net worth and liquidity of loan guarantors may decline, impairing their ability to honor commitments to us; and

•reduction in our low-cost or noninterest-bearing deposits.

A decline in local economic conditions may have a greater effect on our earnings and capital than on the earnings and capital of larger financial institutions whose real estate loans are geographically diverse. Many of the loans in our portfolio are secured by real estate. Deterioration in the real estate markets where collateral for a mortgage loan is located could negatively affect the borrower's ability to repay the loan and the value of the collateral securing the loan. Real estate values are affected by various other factors, including changes in general or regional economic conditions, government rules or policies and natural disasters such as fires and earthquakes. If we are required to liquidate a significant amount of collateral during a period of reduced real estate values, our financial condition and profitability could be adversely affected.

External economic factors, such as changes in monetary policy and inflation and deflation, may have an adverse effect on our business, financial condition and results of operations.

Our financial condition and results of operations are affected by credit policies of monetary authorities, particularly the Federal Reserve. Actions by monetary and fiscal authorities, including the Federal Reserve, could lead to inflation, deflation, or other economic phenomena that could adversely affect our financial performance. Inflation has risen sharply since the end of 2021 and throughout 2022 at levels not seen for over 40 years. Inflationary pressures dissipated throughout fiscal 2024, with the annual inflation rate in the United States decreasing to 2.4% during September 2024 from its high of 7.0% in December 2021,

as reported by the U.S. Bureau of Labor Statistics. Small to medium-sized businesses may be impacted more during periods of high inflation as they are not able to leverage economies of scale to mitigate cost pressures compared to larger businesses. Furthermore, a prolonged period of inflation could cause wages and other costs to the Company to increase, which could adversely affect our results of operations and financial condition. Virtually all our assets and liabilities are monetary in nature. As a result, interest rates tend to have a more significant impact on our performance than general levels of inflation or deflation. Interest rates do not necessarily move in the same direction or by the same magnitude as the prices of goods and services.

Risks Related to our Lending Activities

Our real estate construction and land loans expose us to significant risks.

We specialize in real estate construction loans for individuals and builders, mainly focusing on residential property development. Our loans are initiated regardless of whether the property used as collateral is under a sales contract. These were allocated as follows: $172.00 million for residential real estate projects, $29.46 million for commercial projects, and $17.74 million for land development. Notably, approximately $132.10 million of our residential construction loans are structured to convert into permanent loans upon construction completion.

Construction lending involves inherent risks due to estimating costs in relation to project values. Uncertainties in construction costs, market value, and regulatory impacts make accurately evaluating total project funds and loan-to-value ratios challenging. Factors like shifts in housing demand and unexpected building costs can significantly deviate actual results from estimates. Additionally, this type of lending often involves higher principal amounts and might be concentrated among a few builders. A downturn in housing or real estate markets could escalate delinquencies, defaults, foreclosures, and compromise collateral value.

Some builders have multiple outstanding loans, meaning problems with one loan pose a substantial risk to us. Moreover, certain construction loans do not require borrower payments during the term, accumulating interest into the principal. Thus, repayment depends heavily on project success and the borrower's ability to sell, lease, or secure permanent financing, rather than their ability to repay principal and interest directly.

Misjudging a project's value could leave us with inadequate security and potential losses upon completion. Actively monitoring construction loans, involving cost comparisons and on-site inspections, adds complexity and cost. Market interest rate hikes also might significantly impact construction loans, affecting end-purchaser borrowing costs, potentially reducing demand or the homeowner's ability to finance the completed home. Further, properties under construction are hard to sell and often need completion for successful sales, complicating problem loan resolution. This might require additional funds or engaging another builder, incurring additional costs and market risks. As of September 30, 2024, $11.50 million of our construction portfolio consisted of speculative one- to four-family construction loans.

We also offer land loans for land acquisition, which can be used for building or recreational purposes. During this extended financing-to-completion period, the collateral often generates no cash flow.

As of September 30, 2024, all our construction and land loans were performing according to their terms. A significant rise in non-performing construction or land loans could materially impact our financial condition and results of operations.

Our emphasis on commercial real estate lending may expose us to increased lending risks.

Our current business strategy includes an emphasis on commercial real estate lending. Collateral evaluation and financial statement analysis in these types of loans requires a more detailed analysis at the time of loan underwriting and on an ongoing basis.

At September 30, 2024, we had $599.22 million of commercial real estate loans, representing 39.6% of our total loan portfolio. These loans typically involve higher principal amounts than other types of loans, and repayment is dependent upon income generated, or expected to be generated, by the property securing the loan in amounts sufficient to cover operating expenses and debt service, which may be adversely affected by changes in the economy or local market conditions.

A secondary market for most types of commercial real estate loans is not readily liquid, so we have less opportunity to mitigate credit risk by selling part or all our interest in these loans. As a result of these characteristics, if we foreclose on a commercial real estate loan, our holding period for the collateral typically is longer than for one- to four-family residential mortgage loans because there are fewer potential purchasers of the collateral. Accordingly, charge-offs on commercial real estate loans may be larger as a percentage of the total principal outstanding than those incurred with our residential or consumer loan portfolios.

Repayment of our commercial business loans is often dependent on the cash flows of the borrower, which may be unpredictable, and the collateral securing these loans may fluctuate in value.

Our business loans are primarily made based on borrowers’ cash flow, with collateral as a secondary factor. However, the unpredictability of borrowers' cash flow and the fluctuating value of collateral, often in the form of accounts receivable, inventory, or equipment, present significant risks. Loans secured by accounts receivable are contingent on the borrower's ability to collect from their customers, while other collateral may depreciate, be challenging to assess, lack liquidity, and vary in value based on the success of the business. Additionally, economic fluctuations can significantly impact borrowers' repayment abilities, more so than loans secured by real estate.

At September 30, 2024, $347.04 million, or 22.9% of our total loan portfolio was secured by one- to four-family mortgage loans and home equity loans. This type of lending is highly sensitive to regional economic conditions, which can affect borrowers' ability to meet their payment obligations and make loss levels difficult to predict. Factors such as higher interest rates, recessionary conditions, lower real estate sales volumes and prices, and elevated unemployment may lead to higher loan delinquencies, problem assets, and reduced demand for our products and services, adversely impacting our capital, liquidity, and financial condition.

A decline in residential real estate values, particularly in the Washington housing market, may reduce the value of collateral securing these loans and increase our risk of loss if borrowers default. Some of our residential mortgage loans are secured by properties with little or no borrower equity, either due to high loan-to-value ratios at origination or declining home values. Loans with higher loan-to-value ratios are more sensitive to declining property values, resulting in a higher risk of default and loss. Additionally, for home equity lines of credit secured by second mortgages, recovering loan proceeds in the event of default may be difficult unless we repay the first mortgage, which may not be justified by the property’s value. Consequently, we may experience higher rates of delinquency, default, and losses on our residential loans.

Lending money is a substantial part of our business. Every loan carries a risk that it will not be repaid in accordance with its terms or that any underlying collateral will not be sufficient to assure repayment. This risk is affected by, among other things:

•the cash flow of the borrower and/or the project being financed;

•the changes and uncertainties as to the future value of the collateral, in the case of a collateralized loan;

•the duration of the loan;

•the credit history of a particular borrower; and

•changes in economic and industry conditions.

To address these risks, we maintain an allowance for credit losses on loans, which is a reserve established through a provision for credit losses on loans charged against operating income, that we believe is appropriate to provide for expected losses in our loan portfolio. The appropriate level of the allowance of credit losses is determined by management through periodic comprehensive reviews and consideration of several factors, including, but not limited to our collective loss reserve, for loans evaluated on a pool basis with similar risk characteristics based on our life of loan historical default and loss experience, certain macroeconomic factors, reasonable and supportable forecasts, regulatory requirements, management’s expectations of future events and certain qualitative factors.

The ACL is an estimate of the expected credit losses on financial assets measured at amortized cost. The ACL is evaluated and calculated on a collective basis for those loans which share similar risk characteristics. For loans that do not share similar risk characteristics and cannot be evaluated on a collective basis, the Company will evaluate the loan individually using the present value of the expected future cash flows or the fair value of the underlying collateral.

The determination of the appropriate level of the allowance for credit losses inherently involves a high degree of subjectivity and requires us to make significant estimates of current credit risks and future trends, all of which may undergo material changes. If our estimates are incorrect, the allowance for credit losses for loans may not be sufficient to cover losses inherent in our loan portfolio, resulting in the need for increases in our allowance for credit losses through the provision for credit losses which is charged against income. Management also recognizes that significant new growth in loan portfolios, new loan products and the refinancing of existing loans can result in portfolios comprised of unseasoned loans that may not perform in a historical or projected manner and will increase the risk that our allowance may be insufficient to absorb losses without significant additional provisions.

Bank regulatory agencies also periodically review our allowance for credit losses and may require an increase in the provision for possible credit losses or the recognition of further loan charge-offs based on their judgment about information available to them at the time of their examination. If charge-offs in future periods exceed the allowance for credit losses, we may need additional provisions to increase the allowance for credit losses.

If our non-performing assets increase, our earnings will be adversely affected.

At September 30, 2024, our non-performing assets (which consisted solely of non-accruing loans, non-accrual investment securities, and OREO) were $3.94 million, or 0.2% of total assets. Our non-performing assets adversely affect our net income in various ways:

•We do not record interest income on non-accrual loans or non-performing investment securities, except on a cash basis when the collectability of the principal is not in doubt.

•We must recognize expected credit losses through a current period charge to the provision for credit losses.

•Non-interest expense increases if we must write down the value of OREO properties to reflect market declines.

•Non-interest income decreases when we recognize other-than-temporary impairment on non-performing investment securities.

•There are legal fees and carrying costs (such as taxes, insurance, and maintenance) associated with OREO.

•Managing non-performing assets requires significant management attention, diverting resources from more profitable activities.

If delinquencies increase and we are unable to effectively manage our non-performing assets, our losses and troubled assets could increase significantly, materially impacting our financial condition and results of operations.

Risk Related to our Business Strategy

We may be adversely affected by risks associated with completed and potential acquisitions.

As part of our general growth strategy, on October 1, 2018, we completed the acquisition of South Sound Bank, a Washington-state chartered bank, headquartered in Olympia, Washington. The consummation of any future acquisitions may dilute shareholder value or may have an

adverse effect upon our operating results while the operations of the acquired business are being integrated into our operations. In addition, once integrated, acquired operations may not achieve levels of profitability comparable to those achieved by our existing operations, or otherwise perform as expected. Further, transaction-related expenses may adversely affect our earnings. Acquiring banks, bank branches or businesses involves risks commonly associated with acquisitions, including:

•We may be exposed to potential asset quality issues or unknown or contingent liabilities of the banks, businesses, assets, and liabilities we acquire. If these issues or liabilities exceed our estimates, our results of operations and financial condition may be materially negatively affected;

•We could experience higher than expected deposit attrition;

•The acquisition of other entities generally requires integration of systems, procedures and personnel of the acquired entity into our company to make the transaction economically successful. This integration process is complicated and time consuming and can also be disruptive to the customers of the acquired business. If the integration process is not conducted successfully and with minimal adverse effect on the acquired business and its customers, we may not be able to realize the anticipated economic benefits of the acquisition within the expected time frame, and we may lose customers or employees of the acquired business. We may also experience greater than anticipated customer losses even if the integration process is successful;

•To the extent that our costs of an acquisition exceed the fair value of the net assets acquired, the acquisition will generate goodwill. As discussed below, we are required to assess our goodwill for impairment at least annually, and any goodwill impairment charge could have a material adverse effect on our results of operation and financial condition; and

•We expect that our net income will increase following an acquisition; however, we also expect our general and administrative expenses to increase, which could result to an increase in our efficiency ratio. Ultimately, we would expect our efficiency ratio to improve; however, if we are not successful in our integration process, this may not occur, and our acquisition or branching activities may not be accretive to earnings in the short or long-term.

Risk Related to Market Interest Rates

Changes in interest rates may reduce our net interest income and may result in higher defaults in a rising rate environment.

Our earnings and cash flows are largely dependent upon our net interest income. Interest rates are highly sensitive to many factors that are beyond our control, including general economic conditions and policies of various governmental and regulatory agencies and, in particular, the Federal Reserve. If the FOMC further decreases the targeted federal funds rate, overall interest rates will likely decrease, which may negatively impact our net interest income, but could positively impact both the housing market by increasing refinancing activity and new home purchases and the U.S. economy.

We principally manage interest rate risk by managing our volume and mix of our earning assets and funding liabilities. Changes in monetary policy, including changes in interest rates, could influence not only the interest we receive on loans and investments and the amount of interest we pay on deposits and borrowings, but these changes could also affect: (1) our ability to originate and/or sell loans and obtain deposits; (2) the fair value of our financial assets and liabilities, which could negatively impact shareholders’ equity, and our ability to realize gains from the sale of such assets; (3) our ability to obtain and retain deposits in competition with other available investment alternatives; (4) the ability of our borrowers to repay adjustable or variable rate loans; and (5) the average duration of our investment securities portfolio and other interest-earning assets. If the interest rates paid on deposits and borrowings increase at a faster rate than the interest received on loans and other investments, our net interest income, and therefore earnings, could be adversely affected. Earnings could also be adversely affected if the interest rates received on loans and other investments decline more rapidly than the interest rates paid on deposits and other borrowings. In a changing interest rate environment, we may not be able to manage this risk effectively. If we are unable to manage interest rate risk effectively, our business, financial condition and results of operations could be materially affected.

Changes in interest rates could also have a negative impact on our results of operations by reducing the ability of borrowers to repay their current loan obligations or by reducing our margins and profitability. Changes in interest rates (up or down) could adversely affect our net interest margin and, as a result, our net interest income. Changes in the slope of the

"yield curve," or the spread between short-term and long-term interest rates, could also reduce our net interest margin. Normally, the yield curve is upward sloping, meaning short-term rates are lower than long-term rates. Because our liabilities tend to be shorter in duration than our assets, when the yield curve flattens or even inverts, we could experience pressure on our net interest margin as our cost of funds increases relative to the yield we can earn on our assets. Also, interest rate decreases can lead to increased prepayments of loans and mortgage-backed securities as borrowers refinance their loans to reduce borrowing costs. Under these circumstances we are subject to reinvestment risk as we may have to redeploy such repayment proceeds into lower yielding investments, which would likely negatively impact our income.

A sustained increase or decrease in market interest rates could adversely affect our earnings. As is the case with many financial institutions, our emphasis on increasing core deposits, those deposits bearing no or a relatively low rate of interest with no stated maturity, has resulted in our having a significant amount of these deposits which have a shorter duration than our assets. At September 30, 2024, we had $313.82 million in certificates of deposit that mature within one year and $1.28 billion in non-interest bearing, NOW checking, savings and money market accounts. We would incur a higher cost of funds to retain these deposits in a rising interest rate environment.

Changes in interest rates also affect the value of our investment securities available for sale. Generally, the fair value of fixed-rate securities fluctuates inversely with changes in interest rates. Unrealized gains and losses on investment securities available for sale are reported as a separate component of equity, net of tax. Increases in the fair value of investment securities available for sale resulting from decreases in interest rates could have a positive effect on stockholders' equity. Stockholders' equity, specifically accumulated other comprehensive income (loss) ("AOCI"), is increased or decreased by the amount of change in the estimated fair value of our securities available for sale, net of deferred income taxes. Increases in interest rates generally decrease the fair value of securities available for sale, which adversely impacts stockholders' equity.

Any substantial, unexpected or prolonged change in market interest rates could have a material adverse effect on our financial condition, liquidity and results of operations. Also, our interest rate risk modeling techniques and assumptions likely may not fully predict or capture the impact of actual interest rate changes on our balance sheet or projected operating results. For further discussion of how changes in interest rates could impact us, see "Part II, Item 7A. Quantitative and Qualitative Disclosures About Market Risk" for additional information about our interest rate risk management.

Our securities portfolio may be negatively impacted by fluctuations in market value and interest rates.

Factors beyond our control can significantly influence the fair value of securities in our portfolio and can cause potential adverse changes to the fair value of these securities. These factors include, but are not limited to, rating agency actions in respect of the securities, defaults by, or other adverse events affecting, the issuer or with respect to the underlying securities, and changes in market interest rates and continued instability in the capital markets. The Company analyzes investment securities to determine whether there have been any events or economic circumstances to indicate that a security has incurred a credit-related loss. The Company considers many factors including recent events specific to the issuer or industry, and for securities, external credit ratings and recent downgrades. Credit component losses are reported in allowance for credit losses in the income statement when the present value of expected future cash flows is less than the amortized cost. Noncredit component losses are recorded in other comprehensive income (loss) when the Company (1) does not intend to sell the security or (2) is not more likely than not to have to sell the security prior to the security’s anticipated recovery.

An increase in interest rates, change in the programs offered by Freddie Mac or our ability to qualify for their programs may reduce our mortgage revenues, which would negatively impact our non-interest income.

The sale of residential mortgage loans to Freddie Mac has historically provided a significant portion of our noninterest income. Mortgage banking is generally considered a volatile source of income because it depends largely on the level of loan volume which, in turn, depends largely on prevailing market interest rates. This would result in a decrease in mortgage revenues and a corresponding decrease in non-interest income. In addition, our results of operations are affected by the amount of non-interest expense associated with our loan sale activities, such as salaries and employee benefits, occupancy, equipment and data processing expense and other operating costs. During periods of reduced loan demand, our results of operations may be adversely affected to the extent that we are unable to reduce expenses commensurate with the

decline in loan originations. In addition, although we sell loans to Freddie Mac or into the secondary market without recourse, we are required to give customary representations and warranties about the loans we sell. If we breach those representations and warranties, we may be required to repurchase the loans and we may incur a loss on the repurchase.

Risks Related to Laws and Regulations

The level of our commercial real estate loan portfolio may subject us to additional regulatory scrutiny.

The FDIC, the Federal Reserve and the Office of the Comptroller of the Currency have promulgated joint guidance on sound risk management practices for financial institutions with concentrations in commercial real estate lending. Under this guidance, a financial institution that, like us, is actively involved in commercial real estate lending should perform a risk assessment to identify concentrations. A financial institution may have a concentration in commercial real estate lending if, among other factors (i) total reported loans for construction, land development and other land represent 100% or more of total capital, or (ii) total reported loans secured by multi-family and non-farm non-residential properties, loans for construction, land development and other land, and loans otherwise sensitive to the general commercial real estate market, including loans to commercial real estate related entities, represent 300% or more of total capital. The purpose of the guidance is to guide banks in developing risk management practices and capital levels commensurate with the level and nature of real estate concentrations. The guidance states that management should employ heightened risk management practices including board and management oversight and strategic planning, development of underwriting standards, risk assessment and monitoring through market analysis and stress testing. While we believe that we have implemented policies and procedures with respect to our commercial real estate loan portfolio consistent with this guidance, bank regulators could require us to implement additional policies and procedures consistent with their interpretation of the guidance that may result in additional costs to us.

The financial services industry is extensively regulated. Federal banking regulations are designed primarily to protect the deposit insurance funds and consumers, not to benefit a company's shareholders. These laws, regulations, rules, standards, policies, and interpretations are constantly evolving and may change significantly over time. Any new regulations or legislation, change in existing regulations or oversight, whether a change in regulatory policy or a change in a regulator's interpretation of a law or regulation, could have a material impact on our operations, increase our costs of regulatory compliance and of doing business and adversely affect our profitability. In this regard, the U.S. Department of the Treasury's Financial Crimes Enforcement Network ("FinCEN"), published guidelines in 2014 for financial institutions servicing marijuana businesses that are legal under state law. These guidelines allow us to work with marijuana-related businesses that are operating in accordance with state laws and regulations as long as we comply with required regulatory oversight of their accounts with us. In addition, legislation is currently pending in Congress that would allow banks and financial institutions to serve marijuana businesses in states where it is legal without any risk of federal prosecution. At September 30, 2024, approximately 1.1% of our total deposits and a portion of our service charges from deposits are from legal marijuana-related businesses. Any adverse change in this FinCEN guidance, any new regulations or legislation, any change in existing regulations or oversight, whether a change in regulatory policy or a change in a regulator's interpretation of a law or regulation, could have a negative impact on our non-interest income, as well as the cost of our operations, increasing our cost of regulatory compliance and of doing business and/or otherwise affect us, which may materially affect our profitability.

Non-compliance with the USA PATRIOT Act, Bank Secrecy Act, or other laws and regulations could result in fines or sanctions and limit our ability to get regulatory approval of acquisitions.

The USA PATRIOT and Bank Secrecy Acts require financial institutions to develop programs to prevent financial institutions from being used for money laundering and terrorist activities. Failure to comply with these regulations could result in fines or sanctions and limit our ability to get regulatory approval of acquisitions. While we have developed policies and procedures designed to assist in compliance with these laws and regulations, no assurance can be given that these policies and procedures will be effective in preventing violations of these laws and regulations. Failure to maintain and implement adequate programs to combat money laundering and terrorist financing could also have serious reputational consequences for us. Any of these results could have a material adverse effect on our business, financial condition, results of operations and growth prospects.

Climate change and related legislative and regulatory initiatives may materially affect our business and results of operations.

Climate change continues to be a pressing concern, prompting heightened awareness and action on a global scale. Efforts include international agreements such as the Paris Agreement, with the United States rejoining, and ongoing initiatives at various governmental levels to address climate-related issues. Under the current administration, additional measures are anticipated, potentially impacting banks' risk management practices, stress testing, credit portfolio concentrations, and investment strategies. The lack of empirical data makes it challenging to predict the precise financial impact of climate change, though its physical effects, such as more frequent weather disasters, could directly affect our real estate collateral and loan portfolios. Inadequate insurance coverage for borrowers may compound these risks, impacting our financial condition. Furthermore, climate change's broader economic effects could adversely affect our customers and the communities we serve, potentially impacting our financial performance.

On March 6, 2024, the SEC implemented new climate-related disclosure rules for U.S. public companies and foreign private issuers. These rules introduce extensive disclosure requirements, increasing reporting costs, risks, and complexity. Challenges include short compliance timelines, interpretive issues, legal liabilities, and global regulatory overlaps. Lawsuits contesting these rules add further uncertainty. However, on March 15, 2024, the Fifth Circuit granted an administrative stay, temporarily halting the implementation of the SEC's climate rules.

Risks Related to Cybersecurity, Third-Parties and Technology

As of September 30, 2024 there has not been any cybersecurity or related breach of the risk factors discussed below that would require disclosure.

The financial services market is undergoing rapid technological changes and, if we are unable to stay current with those changes, we may not be able to effectively compete.

The financial services market, including banking services, is undergoing rapid changes with frequent introductions of new technology-driven products and services. Our future success will depend, in part, on our ability to keep pace with the technological changes and to use technology to satisfy and grow customer demand for our products and services and to create additional efficiencies in our operations. Some of our competitors have substantially greater resources to invest in technological improvements and will be able to invest more heavily in developing and adopting new technologies, which may put us at a competitive disadvantage. We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers. As a result, our ability to effectively compete to retain or acquire new business may be impaired, and our business, financial condition or results of operations may be adversely affected.

We are subject to certain risks in connection with our use of technology.

Our security measures may not be sufficient to mitigate the risk of a cyber-attack. Communications and information systems are essential to the conduct of our business, as we use such systems to manage our customer relationships, our general ledger and virtually all other aspects of our business. Our operations rely on the secure processing, storage, and transmission of confidential and other information in our computer systems and networks. Although we take protective measures and endeavor to modify them as circumstances warrant, the security of our computer systems, software, and networks may be vulnerable to breaches, fraudulent or unauthorized access, denial or degradation of service attacks, misuse, computer viruses, malware or other malicious code and cyber-attacks that could have a security impact. If one or more of these events occur, this could jeopardize our or our customers' confidential and other information processed and stored in, and transmitted through, our computer systems and networks, or otherwise cause interruptions or malfunctions in our operations or the operations of our customers or counterparties. We may be required to expend significant additional resources to modify our protective measures or to investigate and remediate vulnerabilities or other exposures, and we may be subject to litigation and financial losses that are either not insured or not fully covered through any insurance maintained by us. We could also suffer significant reputational damage.

Security breaches in our internet banking activities could further expose us to possible liability and damage our reputation. Increases in criminal activity levels and sophistication, advances in computer capabilities, vulnerabilities in third-party technologies (including browsers and operating systems) or other developments could result in a compromise or breach of the technology, processes and controls that we use to prevent fraudulent transactions and to protect data about us, our clients and underlying transactions. Any compromise of our security could deter customers from using our internet banking services that involve the transmission of confidential information. Although we have developed and continue to invest in systems and processes that are designed to detect and prevent security breaches and cyberattacks and periodically test our security, these

precautions may not protect our systems from compromises or breaches of our security measures, and could result in losses to us or our customers, our loss of business and/or customers, damage to our reputation, the incurrence of additional expenses, disruption to our business, our inability to grow our online services or other businesses, additional regulatory scrutiny or penalties, or our exposure to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition and results of operation.

Our security measures may not protect us from system failures or interruptions. While we have established policies and procedures to prevent or limit the impact of systems failures and interruptions, there can be no assurance that such events will not occur or that they will be adequately addressed if they do. In addition, we outsource certain aspects of our data processing and other operational functions to certain third-party providers. While the Company selects third-party vendors carefully, it does not control their actions. If our third-party providers encounter difficulties, including those resulting from breakdowns, or other disruptions in communication services provided by a vendor, failure of a vendor to handle current or higher transaction volumes, cyber-attacks and security breaches or if we otherwise have difficulty in communicating with them, our ability to adequately process and account for transactions could be affected, and our ability to deliver products and services to our customers and otherwise conduct business operations could be adversely impacted. Replacing these third-party vendors could also entail significant delay and expense. Threats to information security also exist in the processing of customer information through various other vendors and their personnel.

We cannot assure you that such breaches, failures or interruptions will not occur or, if they do occur, that they will be adequately addressed by us or the third-parties on which we rely. We may not be insured against all types of losses as a result of third-party failures and insurance coverage may be inadequate to cover all losses, resulting from breaches, systems failures or other disruptions. If any of our third-party service providers experience financial, operational or technological difficulties, or if there is any other disruption in our relationships with them, we may be required to identify alternative sources of such services, and we cannot assure that we could negotiate terms that are as favorable to us or could obtain services with similar functionality as found in our existing systems without the need to expend substantial resources, if at all. Further, the occurrence of any systems failure or interruption could damage our reputation and result in a loss of customers and business, could subject us to additional regulatory scrutiny, or could expose us to legal liability. Any of these occurrences could have a material adverse effect on our business financial condition and results of operations.

Our business may be adversely affected by an increasing prevalence of fraud and other financial crimes.

We are susceptible to fraudulent activity that may be committed against us or our customers which may result in financial losses or increased costs to us or our customers, disclosure or misuse of our information or our customers' information, misappropriation of assets, privacy breaches against our customers, litigation or damage to our reputation. Such fraudulent activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering and other dishonest acts. Nationally, reported incidents of fraud and other financial crimes have increased. We have also experienced losses due to apparent fraud and other financial crimes. While we have policies and procedures designed to prevent such losses, there can be no assurance that such losses will not occur.

We rely on other companies to provide key components of our business infrastructure.

These third-party vendors are sources of operational and informational security risks to us, including risks associated with operational errors, information system failures, interruptions or breaches and unauthorized disclosures of sensitive or confidential client or customer information. If these vendors encounter any of these issues, or if we have difficulty communicating with them, we could be exposed to disruption of operations, loss of service or connectivity to customers, reputational damage, and litigation risk that could have a material adverse effect on our business and, in turn, our financial condition and results of operations.

Risks Related to Accounting Matters

The Company’s reported financial results depend on management’s selection of accounting methods and certain assumptions and estimates, which, if incorrect, could cause unexpected losses in the future.

The Company’s accounting policies and methods are fundamental to how the Company records and reports its financial condition and results of operations. The Company’s management must exercise judgment in selecting and applying many of these accounting policies and methods so they comply with GAAP and reflect management’s judgment regarding the most appropriate manner to report the Company’s financial condition and results of operations. In some cases, management must select the accounting policy or method to apply from two or more alternatives, any of which might be reasonable under the circumstances, yet might result in the Company’s reporting materially different results than would have been reported under a different alternative.

Certain accounting policies, most notably the accounting for credit losses, are critical to presenting the Company’s financial condition and results of operations. They require management to make difficult, subjective or complex judgments about matters that are uncertain. Materially different amounts could be reported under different conditions or using different assumptions or estimates. For more information, refer to “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Critical Accounting Estimates” contained in this 2024 Form 10-K.

We may experience future goodwill impairment, which could reduce our earnings.

In accordance with GAAP, we record assets acquired and liabilities assumed in a business combination at their fair value with the excess of the purchase consideration over the net assets acquired resulting in the recognition of goodwill. As a result, acquisitions typically result in recording goodwill. We perform a goodwill evaluation at least annually to test for goodwill impairment. If our judgment was incorrect, or if events or circumstances change, and an impairment of goodwill was deemed to exist, we would be required to record a non-cash charge to earnings in our financial statements during the period in which such impairment is determined to exist. Any such charge could have a material adverse effect on our results of operations.

We are subject to an extensive body of accounting rules and best practices. Periodic changes to such rules may change the treatment and recognition of critical financial line items and affect our profitability.

Our business operations are significantly influenced by the extensive body of accounting regulations in the United States. Regulatory bodies periodically issue new guidance, altering accounting rules and reporting requirements, which can substantially affect the preparation and reporting of our financial statements. These changes might necessitate retrospective application, potentially leading to restatements of prior period financial statements.

One such significant change in fiscal 2024 was the implementation of the CECL model, which we adopted on October 1, 2023. Under the CECL model, financial assets carried at amortized cost, such as loans and held-to-maturity debt securities, are presented at the net amount expected to be collected. This forward-looking approach in estimating expected credit losses contrasts starkly with the prior, "incurred loss" model, which delays recognition until a loss is probable. CECL mandates considering historical experience, current conditions, and reasonable forecasts affecting collectability, leading to periodic adjustments of financial asset values. However, this forward-looking methodology, reliant on macroeconomic variables, introduces the potential for increased earnings volatility due to unexpected changes in these indicators between periods. An additional consequence of CECL is an accounting asymmetry between loan-related income, recognized periodically based on the effective interest method, and credit losses, recognized upfront at origination. This asymmetry might create the perception of reduced profitability during loan expansion periods due to the immediate recognition of expected credit losses. Conversely, periods with stable or declining loan levels might seem relatively more profitable as income accrues gradually for loans where losses had been previously recognized.

As a result of the change in methodology from the incurred loss model to the CECL model, on October 1, 2023, the Company recorded a one-time, net of tax charge of $488,000 to retained earnings, a $461,000 increase to the allowance for credit losses on loans, a $92,000 increase to the allowance for credit losses on investment securities and a $65,000 increase to the allowance for credit losses on unfunded commitments.

We may experience decreases in the fair value of our loan servicing rights, which could reduce our earnings.

Loan servicing rights are capitalized at estimated fair value when acquired through the origination of loans that are subsequently sold with servicing rights retained. At September 30, 2024, our loan servicing rights totaled $1.37 million. Loan servicing rights are amortized to servicing income on loans sold over the period of estimated net servicing income. The estimated fair value of loan servicing rights at the date of the sale of loans is determined based on the discounted present value of expected future cash flows using key assumptions for servicing income and costs and prepayment rates on the underlying loans. On a quarterly basis, we evaluate the fair value of loan servicing rights for impairment by comparing actual cash flows and estimated cash flows from the loan servicing assets to those estimated at the time loan servicing assets were originated. Our methodology for estimating the fair value of loan servicing rights is highly sensitive to changes in assumptions, such as prepayment speeds. The effect of changes in market interest rates on estimated rates of loan prepayments represents the predominant risk characteristic underlying the loan servicing rights portfolio. For example, a decrease in interest rates typically increases the prepayment speeds of loan servicing rights and therefore decreases the fair value of the loan servicing rights.

Future decreases in interest rates could decrease the fair value of our loan servicing rights below their recorded amount, which would decrease our earnings.

If our investments in real estate are not properly valued or sufficiently reserved to cover actual losses, or if we are required to increase our valuation allowances, our earnings could be reduced .

We obtain updated valuations in the form of appraisals and broker price opinions when a loan has been foreclosed and the property is taken in as OREO, and at certain other times during the asset's holding period. Our net book value (“NBV”) in the loan at the time of foreclosure and thereafter is compared to the updated estimated market value of the foreclosed property less estimated selling costs (fair value). If our valuation process is incorrect or if the property declines in value after foreclosure, the fair value of our OREO may not be sufficient to recover our NBV in such assets, resulting in the need for a valuation allowance.

In addition, bank regulators periodically review any OREO we may have and may require us to recognize further valuation allowances.

Other Risks Related to Our Business

Ineffective liquidity management could adversely affect our financial results and condition.

Liquidity is essential to our business. Our primary sources of liquidity are increases in deposit accounts, cash flows from loan payments and our securities portfolio. Borrowings also provide us with a source of funds to meet liquidity demands. An inability to raise funds through deposits, borrowings, the sale of loans or other sources could have a substantial negative effect on our liquidity. Although we have historically been able to replace maturing deposits and borrowings if desired, we may not be able to replace such funds in the future if, among other things, our financial condition, the financial condition of the FHLB or FRB, or market conditions change. Factors that could detrimentally impact our access to liquidity sources include a decrease in the level of our business activity due to a downturn in the Washington markets in which our loans and deposits are concentrated, negative operating results, or adverse regulatory action against us. Our ability to borrow could also be impaired by factors that are not specific to us, such as a disruption in the financial markets or negative views and expectations about the prospects for the financial services industry or deterioration in credit markets. Any decline in available funding in amounts adequate to finance our activities or on terms which are acceptable could adversely impact our ability to originate loans, invest in securities, meet our expenses, or fulfill obligations such as repaying our borrowings or meeting deposit withdrawal demands, any of which could, in turn, have a material adverse effect on our business, financial condition and results of operations. See “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations — Liquidity” of this Form 10-K.

Our growth or future losses may require us to raise additional capital in the future, but that capital may not be available when it is needed or the cost of that capital may be exceedingly high.

We are required by federal regulatory authorities to maintain adequate levels of capital to support our operations. Our ability to raise additional capital, if needed, will depend on conditions in the capital markets at that time, which are outside our control, and on our financial condition and performance. If we are able to raise capital, it may not be on terms that are acceptable to us. Accordingly, we cannot make assurances that we will be able to raise additional capital if needed on terms that are acceptable to us, or at all. If we cannot raise additional capital when needed, our ability to further expand our operations could be materially impaired and our financial condition and liquidity could be materially and adversely affected. Further, if we are unable to raise additional capital when required by our bank regulators, we may be subject to adverse regulatory action.

Our framework for managing risks may not be effective in mitigating risk and loss to us.

We have established processes and procedures intended to identify, measure, monitor, report, analyze and control the types of risk to which we are subject. These risks include liquidity risk, credit risk, market risk, interest rate risk, operational risk, legal and compliance risk, and reputational risk, among others. We also maintain a compliance program to identify, measure, assess and report on our adherence to applicable laws, policies and procedures. While we assess and improve these programs on an ongoing basis, there can be no assurance that our risk management or compliance programs, along with other related controls, will effectively mitigate all risk and limit losses in our business. As with any risk management framework, there are inherent limitations to our risk management strategies as there may exist, or develop in the future, risks that we have not appropriately

anticipated or identified. If our risk management framework proves ineffective, we could suffer unexpected losses which could have a material adverse effect on our financial condition and results of operations.

We are dependent on key personnel, and the loss of one or more of those key personnel may materially and adversely affect our prospects.

Competition for qualified employees and personnel in the banking industry is intense, and there are a limited number of qualified persons with knowledge of, and experience in, the community banking industry where the Bank conducts its business. The process of recruiting personnel with the combination of skills and attributes required to carry out our strategies is often lengthy. Our success depends to a significant degree upon our ability to attract and retain qualified management, loan origination, finance, administrative, marketing and technical personnel and upon the continued contributions of our management and personnel. In particular, our success has been and continues to be highly dependent upon the abilities of key executives, including our Chief Executive Officer and certain other employees. In addition, our success has been and continues to be highly dependent upon the services of our directors, and we may not be able to identify and attract suitable candidates to replace such directors.

Item 1B. Unresolved Staff Comments

Not applicable.

Cybersecurity

Cyber Risk Management and Strategy

Safeguarding the confidentiality, integrity and availability of customer and sensitive financial data, records and transactions is essential to Timberland and Timberland Bank. Our risk management program is designed to identify, assess and mitigate risks across various aspects of the Bank, including financial, operational, regulatory, reputational and legal.

Cybersecurity is a critical component of our risk management program; thus we have implemented a Cyber and Information Security Program to protect the confidentiality, integrity and availability of our information and information technology environment. Our program aligns with applicable federal and state regulations, industry frameworks such as the Federal Financial Institutions Examination Council ("FFIEC") and best practices from the National Institute of Standards and Technology ("NIST"). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. The framework focuses on ensuring the confidentiality, integrity and availability of sensitive information. NIST is part of the U.S. Department of Commerce, which develops cybersecurity standards, guidelines and other resources.

We have employed a multi-layered, risk-based approach to cyber and information security, incorporating a variety of tools and processes to aid in risk identification, assessment and management. The Bank conducts a variety of information security risk assessments throughout the year. We employ a defense in depth strategy that incorporates preventive, detective, and administrative safeguards including but not limited to, configuration hardening, robust patch management and vulnerability scanning, advanced anti-malware firewall technologies, anti-phishing and web filtering controls. These controls are tested annually by an independent third-party audit firm. Quarterly employee training is performed on cybersecurity, information security, identify theft prevention and data privacy.

The Bank has not experienced any material losses relating to cybersecurity threats or incidents to date.

Incident Response

Response to cyber incidents is guided by the Bank’s Incident Response Policy. The Bank’s plan is based on the National Infrastructure Protection Center ("NIPC") guidelines, with the addition of specific reporting and notification requirements required by regulation.

Third Party Service Provider Monitoring

The Bank maintains a robust Vendor Management Program to appropriately measure, monitor and control risks associated with outsourcing products and services, including cybersecurity risks. Under the program, vendors are assigned a risk rating based

on an assessment of the vendor and its access to network, systems and confidential information. The Bank’s Information Security Officer conducts regular periodic reviews of the adequacy of its oversight of controls over third party relationships.

Cybersecurity Governance

Timberland Bank’s Board of Directors (“Board”) recognizes the significance of cybersecurity risks and provides oversight of the Bank’s Cyber and Information Security Program. The Bank’s Board of Directors is currently comprised of the Chief Executive Officer and seven non-employee directors; one of which has completed and received Cybersecurity Oversight Certification from the National Association of Corporate Directors (“NACD”). The Bank’s primary responsibility for managing cyber risk is vested in the Bank’s Information Security Analyst ("ISA"). The ISA reports to the Chief Risk Officer and serves as the primary custodian of the Bank’s Cyber Security and Information Security Program.

The Technology Steering Committee meets on a regular basis and is tasked with providing oversight and guidance regarding both information technology and cybersecurity related issues of strategic importance to the Bank. The Technology Steering Committee is comprised of numerous members of the management team, Chief Technology Officer ("CTO") and ISA. The Technology Steering committee reports to the Board of Directors through Committee minutes.

The Board Technology Committee assists the Board of Directors in fulfilling its oversight responsibilities with respect to the overall role of technology in executing the business strategy of the institution, including but not limited to major technology investments, technology strategy, operational performance and technology trends that may affect customers. The Board Technology Committee meets regularly and receives reports from the CTO and ISA on cybersecurity and information technology risks. The Board Technology Committee reports to the Board of Directors through Committee minutes.

The Board’s Audit Committee also has oversight responsibility for audits related to information technology, security and information technology governance.

Recently Filed

Click on a ticker to see risk factors

Ticker *	File Date
BRRN	18 minutes ago
BRRN	2 days, 18 hours ago
NRT	5 days, 22 hours ago
EXPR	6 days, 12 hours ago
DJCO	6 days, 14 hours ago
ISSC	6 days, 15 hours ago
CETX	6 days, 16 hours ago
GIPL	6 days, 17 hours ago
BLYQ	6 days, 17 hours ago
BRRN	1 week ago
FCEL	1 week, 2 days ago
OTLK	1 week, 2 days ago
IMKTA	1 week, 2 days ago
FORD	1 week, 2 days ago
BDL	1 week, 2 days ago
FUST	1 week, 3 days ago
VPLM	1 week, 3 days ago
SIF	1 week, 6 days ago
BLIN	1 week, 6 days ago
CLAY	1 week, 6 days ago
EEGI	1 week, 6 days ago
SMME	1 week, 6 days ago
AVXL	1 week, 6 days ago
LMNR	1 week, 6 days ago
SNTW	1 week, 6 days ago
TRCK	1 week, 6 days ago
OCC	1 week, 6 days ago
GEF	1 week, 6 days ago
TBLT	2 weeks, 2 days ago
AVGO	2 weeks, 2 days ago
TOL	2 weeks, 2 days ago
CSPI	2 weeks, 2 days ago
CIEN	2 weeks, 2 days ago
A	2 weeks, 3 days ago
ARKR	2 weeks, 3 days ago
LTCH	2 weeks, 3 days ago
LIVE	2 weeks, 3 days ago
HEI	2 weeks, 3 days ago
ESOA	2 weeks, 3 days ago
AVO	2 weeks, 3 days ago
JOB	2 weeks, 3 days ago
ABM	2 weeks, 3 days ago
MGYR	2 weeks, 3 days ago
OPXS	2 weeks, 3 days ago
HPE	2 weeks, 4 days ago
NDSN	2 weeks, 4 days ago
HOV	2 weeks, 4 days ago
NVOS	2 weeks, 4 days ago
YCBD	2 weeks, 4 days ago
TTC	2 weeks, 4 days ago

OTHER DATASETS

House Trading

Dashboard

Corporate Flights

Dashboard

App Ratings

Dashboard

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - TSBK

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - TSBK

-New additions in green-Changes in blue-Hover to see similar sentence in last filing

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing