A.History and Development of the Company Corporate Information We are a local Bermuda company incorporated under the laws of Bermuda, incorporated on October 22, 1904, pursuant to The N.T. Butterfield & Son Bank Act, 1904 (the "Butterfield Act"). We are registered with the Registrar of Companies in Bermuda under registration number LC 2106. Our registered office and principal executive offices are located at 65 Front Street, Hamilton, HM 12, Bermuda. Our agent for service of process in the United States is C T Corporation System, 28 Liberty Street, New York, New York 10005. Our telephone number is (441) 295 1111. We maintain a website at www.butterfieldgroup.com. Neither this website nor the information on or accessible through this website is included or incorporated in, or is a part of, this report. The SEC maintains an internet site at https://www.sec.gov that contains reports, information statements, and other information regarding issuers that file electronically with the SEC. Our History The origin of The Bank of N.T. Butterfield & Son Limited dates back to the founding of the trading firm of Nathaniel Butterfield circa 1784. In 1858, our company was established as a bank in Bermuda and has been instrumental to the functioning of the local economy ever since. The Bank was later incorporated under a special act of the local Parliament in 1904. In the 1960s, as international businesses began contributing substantially to Bermuda's economy, we developed services to work to meet their needs. In 1967, we opened offices in the Cayman Islands and by the 1980s had expanded our operations to include retail banking, investment management, and fund administration. In 1973, we opened our Guernsey office in order to provide customers with access to the Pound Sterling currency after Bermuda's departure from the British Sterling zone. In addition to being Bermuda's first bank, we opened the first ATMs in Bermuda in the 1980s and launched Bermuda's first internet banking service in 2001. In 1971, we listed our common shares on the BSX under the ticker symbol "NTB.BH". In 2016, we listed our common shares on the NYSE under the ticker symbol "NTB". In 2008 and 2009, as a result of the global financial crisis, we realized losses attributable primarily to US non-agency mortgage backed securities in our investment portfolio, as well as write-downs on local market hospitality loans. To raise capital to offset these losses, the Bank executed a $200 million preference share offering in June 2009. In 2009 and 2010, we implemented a comprehensive restructuring plan for the Company: we hired a new management team, de-risked our balance sheet, and raised $550 million of common equity from a group of investors as well as existing shareholders. Since our restructuring, we have pursued a strategy to focus on our core business in banking and wealth management. We have executed upon our strategy by streamlining the Company's operations through exiting non-core markets, repositioning our balance sheet, investing in efficiency initiatives, and continuing to invest in our core business lines to grow both organically and through acquisitions. By following this strategy, we have improved our financial results and have been able to initiate a progressive capital return policy for investors. The following are the most recent key steps in executing our strategy: •In October 2017, we entered into an agreement to acquire Deutsche Bank AG’s ("Deutsche Bank's") Global Trust Solutions ("GTS") business, excluding its US operations, for net cash payments of $24.7 million. Upon completion of the transaction, Butterfield took over the ongoing management and administration of the GTS portfolio, comprising approximately 1,000 trust structures for some 900 private clients in Guernsey, Switzerland, the Cayman Islands and Singapore. As part of the transaction, we also acquired a service company in Mauritius to provide operations and support services to our trust businesses. This transaction was completed in March 2018. •In February 2018, we entered into an agreement to acquire Deutsche Bank’s banking and custody business in the Cayman Islands and the Channel Islands, which provides services primarily to financial intermediaries and corporate clients. The Bank began to onboard certain customer deposits relating to the acquisition in 2018, and this onboarding activity was completed in the first half of 2019. •In May 2018, we issued $75 million of 5.25% Fixed to Floating Rate Subordinated Notes due in 2028 to repay a portion of our outstanding indebtedness and for other general corporate purposes. •In July 2019, we completed the £160.7 million ($201.1 million) acquisition of ABN AMRO (Channel Islands) Limited ("ABN AMRO (Channel Islands)"), which provides banking, investment management and custody products to three distinct client groups, including trusts, private clients, and funds. •In June 2020, we issued $100 million of 5.25% Fixed to Floating Rate Subordinated Notes due in 2030 for general corporate purposes, including the repayment of a portion of our previously outstanding debt. •In September 2022, we entered into an agreement to acquire assets from the Credit Suisse global trust businesses operating in Singapore, Guernsey and The Bahamas. The transaction was completed in December 2023. •In June 2023, we executed the early redemption of the Bank’s $75 million 5.25% Fixed to Floating Rate Subordinated Notes due June 1, 2028. •In 2024, Butterfield's business in the Channel Islands was reorganized so that all business formerly carried on in or from within Jersey by Butterfield Bank (Jersey) Limited has been transferred to Butterfield Bank (Guernsey) Limited acting through its Jersey branch (Butterfield Bank (Guernsey) Limited, Jersey Branch). The scheme was sanctioned by the Royal Court of Jersey on May 14, 2024 and the transfer of the Business became effective on June 1, 2024. •In June 2025, we executed the early redemption of the Bank’s $100 million 5.25% Fixed to Floating Rate Subordinated Notes due June 15, 2030. 22 B.Business Overview Overview We are a full service bank and wealth manager headquartered in Hamilton, Bermuda. We operate our business through three geographic segments: Bermuda, the Cayman Islands, and the Channel Islands and the UK (CI & UK). We offer banking services, comprising of retail, private and corporate banking, treasury services, and wealth management, which consists of investment management, advisory and brokerage services, trust, estate, and company management in both our Bermuda and Cayman Islands segments, as well as custody services in our Bermuda segment. The CI & UK segment includes the jurisdictions of Guernsey and Jersey (Channel Islands), and the UK. In the Channel Islands, a broad range of services are provided to individuals, private clients and trusts, and to financial intermediaries and funds including deposit services, mortgage lending, private and corporate banking, treasury services, wealth management and fiduciary services. In 2023, we began issuing credit cards to residents of the Channel Islands. The UK jurisdiction provides mortgage lending for high-value residential properties. We also have operations in the jurisdictions of The Bahamas, Canada, Mauritius, Singapore and Switzerland, which we include in our Other segment. For the year ended December 31, 2025, we generated $606.8 million in net revenue after provision for credit losses and other gains/losses ("net revenue"). Our total net revenue, before inter-segment eliminations, by each of our three geographic segments and our non-reportable "Other" segment for the years ended December 31, 2025, 2024 and 2023 are as follows: For the year ended In millions of $ 2025 2024 2023 Net Revenue Bermuda $ 273.7 $ 262.0 $ 269.9 Cayman $ 197.4 $ 189.5 $ 200.6 Channel Islands and the UK $ 114.6 $ 108.3 $ 91.6 Other $ 46.6 $ 42.6 $ 35.9 As at December 31, 2025, we had $14.1 billion in total assets, $4.4 billion in net loans, $12.7 billion in total deposits (50% USD, 21% USD-pegged, 23% GBP), $134.7 billion and $32.3 billion of trust and custody businesses assets under administration, respectively, and $6.9 billion of assets under management. In our Bermuda and Cayman segments, our bank provides a full range of retail and corporate banking services to individuals, local businesses, captive insurers, reinsurance companies, trust companies, and hedge funds. The key products we offer include personal and business deposit services, residential and commercial mortgages, small and medium-sized enterprise and corporate loans, credit and debit cards, merchant acquiring, mobile and internet banking, and cash management. In our Channel Islands and UK segment, our bank provides a broad range of services to individuals, private clients and trusts, and to financial institutions and funds including deposit services, mortgage lending, private and corporate banking, treasury services, wealth management and fiduciary services. In 2023, the segment began issuing credit cards to local residents of the Channel Islands. The UK jurisdiction provides mortgages for high-value residential properties. In all of our segments, we offer wealth management to high net worth and ultra-high net worth individuals, family offices, and institutional and corporate clients. Our wealth management platform has three lines of business: trust, private banking, and asset management. The trust business line, which utilizes specialists in each of our geographic areas, responds to client needs in estate and succession planning, administration of complex asset holdings, and efficient coordination of family affairs. In addition, the business provides pension and employee benefits services for multinational corporations, as well as services that involve administration of and fiduciary responsibility for customized trust structures holding a wide range of asset types including financial assets, property, business assets and art. Our private banking business line offers access to a suite of services, targeted toward high net worth and ultra-high net worth individuals, trusts, and family offices, that can be customized to each client's needs and preferences and delivered as part of a coordinated strategy by a dedicated private banker. We provide clients in our Bermuda, Cayman, and Channel Islands and the UK segments with an integrated model that combines traditional wealth management with banking, lending, cash management, foreign exchange services, custody and access to asset management and trust professionals within Butterfield. We also provide our clients with access to their account information through the use of internet and mobile banking. Our asset management business line provides a broad range of portfolio management services to institutional and private clients. Our target client base includes institutions such as pension funds and captive insurance companies with investable assets over $10 million and private clients such as high net worth and ultra-high net worth individuals, families, and trusts with investable assets over $1 million. Our principal services include discretionary investment management, managed portfolio services, money market, and mutual fund offerings. We also offer advisory and self-directed brokerage options. Over 90% of the business's discretionary investment mandates call for balanced growth to conservative allocations. We focus on delivery of reasonable appreciation with an emphasis on capital preservation. The Bank relies on third parties to provide research and investment management expertise, while our own services are concentrated on portfolio construction and managing client relationships. We also provide customized reporting to meet specific needs of our major clients. From 2020 to 2025, our GAAP net income to common shareholders and our core net income to common shareholders ("Core Net Income to Common")(1) had a CAGR of 9.5% and 9.0%, respectively. Our earnings generation has allowed us to build capital to return to shareholders and invest strategically, both organically and through acquisitions, to further enhance the growth prospects of our Company. We aim to continue to build excess capital in the future, which we can redeploy into growing our business and return to shareholders. __________________________ (1)Core Net Income to Common is a non-GAAP financial measure that is calculated by adjusting net income for income or expense items which management considers not to be representative of the ongoing operations of our business and preference share dividends, guarantee fees and premiums paid on preference share buybacks and redemptions. For a reconciliation of Core Net Income to Common to GAAP net income to common, see Item 5.A. "Operating Results - Reconciliation of Non-GAAP Financial Measures". 23 Our Markets The charts below provide the geographic distribution of our Net Revenue for the year ended December 31, 2025. 2025 Net Revenue: $606.8 million The Bermuda and Cayman Islands banking markets have historically been characterized by a limited number of participants and significant barriers to entry. In addition, these markets provide us with access to several attractive customer bases: in retail banking, we serve local residents and businesses; in corporate banking, we serve captive insurers, hedge funds, middle-market reinsurers, and other corporates; and in wealth management, we serve private trust clients and high net worth and ultra-high net worth individuals and families. The international trust market is primarily concentrated in select jurisdictions, including Bermuda, the Cayman Islands, the Channel Islands, Hong Kong, Singapore, and Switzerland. The leading international trust law firms serve as key introducers of clients to Butterfield and are the primary source of new business. Trust clients often hold assets that are international in nature, and as a result, performance of trust businesses is expected to have limited correlation with the performance of the domestic economies where clients are served. The private banking market in Bermuda, the Cayman Islands, and the Channel Islands is composed largely of resident high net worth and ultra-high net worth individuals meeting minimum deposit and/or loan thresholds. Clients are introduced to the private bank through Butterfield's retail banking operation upon reaching the appropriate deposit or loan threshold, Butterfield's trust and asset management arms, as well as through external introducers. Although locally based, private banking clients often hold international assets, and as a result, business performance is not necessarily correlated to the domestic economies where clients are served. Our asset management business line operates in Bermuda, the Cayman Islands, and the Channel Islands. As at December 31, 2025, 68% of our AUM was in Bermuda, 19% was in the Cayman Islands, and 13% was in the Channel Islands. In Bermuda and the Cayman Islands, a majority of our institutional and private clients are domestic from a domicile perspective while a majority of our clients in the Channel Islands are tied to our trust business and are international in nature. 24 Our International Network and Group Structure The following map presents the several geographic regions in which our business operates. Business support centers in Canada and Mauritius are not shown. The following chart presents our corporate structure, indicating our principal regulated subsidiaries as at December 31, 2025. All of the subsidiaries listed below are wholly owned by the Bank. Bermuda The Bank itself is licensed in Bermuda to provide banking and custody services. Through Butterfield Asset Management Limited and Butterfield Securities (Bermuda) Limited, it is licensed and provides investment services and, through Butterfield Trust (Bermuda) Limited and Bermuda Trust Company Limited, it is licensed and provides corporate trustee, fiduciary and corporate administration services. Butterfield Securities (Bermuda) Limited also provides investment advisory and listing sponsor services. The Bahamas Butterfield Trust (Bahamas) Limited provides trust and fiduciary services. Cayman Islands Butterfield Bank (Cayman) Limited provides banking services and Butterfield Trust (Cayman) Limited provides trustee, fiduciary and corporate administration services. Channel Islands Butterfield Bank (Channel Islands) Limited (previously Butterfield Bank (Guernsey) Limited) provides banking and custody services in Guernsey. The Butterfield Bank (Channel Islands) Limited Jersey Branch provides banking and custody services. Butterfield Trust (Guernsey) Limited provides trustee and fiduciary services. 25 United Kingdom Butterfield Mortgages Limited, UK provides residential property lending services. Switzerland Butterfield Holdings (Switzerland) Limited provides investment services and Butterfield Trust (Switzerland) Limited provides trust and fiduciary services. Singapore Butterfield Trust (Asia) Limited provides trust and fiduciary services. Competition The financial services industry and each of the markets in which we operate are competitive. We face strong competition in gathering deposits, making loans and obtaining client assets for management. We compete, both domestically and internationally, with globally oriented asset managers, retail and commercial banks, investment banking firms, brokerage firms and other investment service firms. Due to the trend toward consolidation in the global financial services industry, our larger competitors tend to have broader ranges of product and service offerings, greater access to capital, and greater efficiency. Larger financial institutions may also have greater ability to leverage increasing regulatory requirements and investment in technology platforms. We also face competition from non-banking financial institutions. These institutions have the ability to offer services previously limited to commercial banks. In addition, non-banking financial institutions are not subject to the same regulatory restrictions as banks, and can often operate with greater flexibility and lower cost structures. The Bermuda banking industry currently consists of four licensed and operating banks and one licensed and operating deposit-taking institution. These include one subsidiary of an international bank, HSBC, and three domestic institutions: Butterfield, Bermuda Commercial Bank and Clarien Bank. In the Cayman Islands, the Bank is one of 3 Class 'A' full service retail banks licensed to conduct business with domestic and international clients. There are also 8 non-retail Category 'A' banks and 68 limited service Category 'B' banks according to CIMA. In the Channel Islands, Guernsey has 21 licensed banks and Jersey has 20, the majority of which are branches with some subsidiaries including global banking groups and brands such as Barclays, RBS, Lloyds, JPMorgan Chase, Investec and Royal Bank of Canada. In certain interest rate environments, additional significant competition for deposits may be expected to arise from corporate and government debt securities and money market mutual funds. We view HSBC in Bermuda and Scotia Bank and CIBC FirstCaribbean in the Cayman Islands as our most significant competitors in those markets. In our wealth management business line, we face competition from local competitors, as well as much larger financial institutions, including financial institutions that are not based in the markets in which we operate. Revenues from the trust and wealth management business depend in large part on the level of assets under management, and larger international banks may have higher levels of assets under management. In our trust business line, we face competition primarily from other specialized trust service providers. There are many trust companies in the main international financial centers, and many of our competitors in this sector offer fund administration and corporate services alongside private client fiduciary services. Competition for deposits is also affected by the ease with which customers can transfer deposits from one institution to another. Our cost of funds fluctuates with market interest rates and may be affected by higher rates being offered by other financial institutions. We believe that our most direct competition for deposits comes from international and domestic financial services firms that target the same customers as the Bank. Deposits We are a deposit-led institution with leading market shares in Bermuda and the Cayman Islands1, and a small but growing market share in the Channel Islands. We strive to maintain deposit growth and to maintain a strong liquidity profile through a significant excess of deposits over loans through market cycles. Our deposits are generated principally by our banking business line, which offers retail and corporate checking, savings, and term deposits through our segments in Bermuda, Cayman and the Channel Islands. In addition, wealth management, through its private banking business line, also provides deposit services to high net worth and ultra-high net worth clients in those same geographic segments. As at December 31, 2025, our Bermuda, Cayman, and Channel Islands and the UK segments contributed $4.5 billion, $4.1 billion and $4.2 billion, respectively, to our total deposit base. Total deposits as at December 31, 2025 were $12.7 billion, down 0.4% over total deposits as at December 31, 2024, primarily due to deposit decreases in Bermuda and the Channel Islands and partially offset by foreign exchange translation gains as a result of a strengthened Pound Sterling. Demand deposits, which include checking, savings and call accounts, totaled $8.8 billion as at December 31, 2025 and 2024, accounting for 69.0% of our total deposits as at December 31, 2025, compared to 64.9%, as at December 31, 2024. Term deposits totaled $3.9 billion as at December 31, 2025 compared to $4.5 billion as at December 31, 2024. The cost of funds on total deposits decreased from 183 basis points in 2024 to 150 basis points in 2025 as central banks cut market interest rates during the year. Lending We offer a broad set of lending products and services including residential mortgage lending, automobile lending, credit cards, consumer financing, and overdraft facilities to our retail customers, and commercial real estate lending, commercial and industrial loans, and overdraft facilities to our commercial and corporate customers. These offerings are provided to our retail, commercial, and private banking clients in our key jurisdictions of Bermuda and the Cayman Islands. We also offer residential mortgage lending through our banking business in the Channel Islands and to our high net worth and ultra-high net worth clients in the UK. Our loan portfolio, net of allowance for credit losses, remains relatively flat at $4.4 billion as at December 31, 2025 compared to $4.5 billion as at December 31, 2024. The loan portfolio represented 31.1% of total assets as at December 31, 2025, and loans, net of allowance for credit losses, as a percentage of total deposits were 34.5%. The effective yield on total loans for the year ended December 31, 2025 was 5.81%, compared to 6.29% for the year ended December 31, 2024. Residential Mortgage Lending The residential mortgage portfolio comprises mortgages to clients with whom we are seeking to establish (or already have) a comprehensive financial services relationship. It includes mortgages to individuals and corporate loans secured by way of first ranking charges over the residential property to which each specific loan relates, generally on terms which allow for the repossession and sale of the property if the borrower fails to comply with the terms of the loan. As at December 31, 2025, residential 1 Based on interpretive data provided by the BMA and CIMA respectively. 26 mortgages totaled $3.1 billion, accounting for approximately 70.6% of the Group's total gross loan portfolio with $69.6 million of residential mortgage non-accrual loans representing 76.2% of total non-accrual loans in the loan portfolio. Consumer Lending We provide loans, as part of our normal banking business, in respect of automobile financing, consumer financing, credit cards and overdraft facilities to retail and private banking clients in the jurisdictions in which we operate. As at December 31, 2025, non-residential loans to consumers totaled $195.6 million, accounting for approximately 4.4% of the Group's total gross loan portfolio with $1.0 million of consumer loans representing 1.1% of total non-accrual loans in the loan portfolio. Commercial Real Estate Lending Commercial real estate loans are offered to real estate investors, developers and builders domiciled primarily in Bermuda, the Cayman Islands, Channel Islands and the UK. To manage the Group's credit exposure on such loans, the principal collateral is real estate held for commercial purposes and is supported by a registered mortgage. Cash flows from the properties, primarily from rental income, are generally supported by long-term leases. As at December 31, 2025, our commercial real estate loan portfolio totaled $565.2 million, accounting for approximately 12.8% of the Group's total gross loan portfolio with $3.4 million of commercial real estate non-accrual loans representing 3.8% of total non-accrual loans in the loan portfolio. Our commercial real estate loan portfolio is broken down into two categories: commercial mortgage and construction. As at December 31, 2025, commercial mortgages totaled $487.7 million, and construction loans totaled $77.6 million, accounting for approximately 86.3% and 13.7% of our commercial real estate loan portfolio, respectively. Other Commercial Lending The commercial and industrial loan portfolio includes loans and overdraft facilities advanced primarily to corporations and small and medium-sized entities, which are generally not collateralized by real estate and where loan repayments are expected to flow from the operation of the underlying businesses. As at December 31, 2025, the Group's commercial loan portfolio, excluding loans to governments, totaled $258.3 million, accounting for approximately 5.9% of the Group's total gross loan portfolio and the Group's loans to governments totaled $276.8 million, accounting for approximately 6.3% of our total gross loan portfolio. There was $17.3 million of other commercial non-accrual loans representing approximately 19.0% of total non-accrual loans in the loan portfolio. Investments Given the large customer deposit base commanded in our Bermuda, Cayman Islands and Channel Islands operations, and the relatively low volume of lending demand from our customer base, our investment strategy is more important than may be the case for most financial institutions. In recognition of this, we maintain what we believe to be a conservative approach to investments, requiring the purchase of mainly fixed-rate investments in order to manage interest rate risk. Our investment portfolio comprises mainly securities issued or guaranteed by the US government or federal agencies. The securities in which we invest are limited generally to securities that are considered investment grade (i.e., "BBB" and higher by S&P's Financial Services LLC or an equivalent credit rating). As at December 31, 2025, the Group held $5.7 billion in investments, representing approximately 40.4% of total assets. Cash and Liquidity Management We operate across multiple currency jurisdictions with multi-currency products. In our deposit taking jurisdictions—Bermuda, the Cayman Islands and the Channel Islands—there are currently no dedicated central banks, and no pre-funded deposit insurance scheme infrastructures (such as the Federal Deposit Insurance Corporation in the United States), with the exception of Bermuda, where a pre-funded deposit insurance scheme has been implemented, and as described below in “- Supervision and Regulation” and Item 3.D. “Risk Factors - Risks Relating to the Markets in Which We Operate - Certain jurisdictions in which we operate, including Bermuda, Guernsey and Jersey, have a Deposit Insurance Scheme or Deposit Compensation Scheme and we incur ongoing costs as a result". In addition, we do not have access to borrowing or deposit facilities with the US Federal Reserve or the European Central Bank; therefore, we conservatively manage client deposit balances and the liquidity risk profile of our balance sheets. This involves the retention of significant cash or cash equivalent balances, management of intra-bank counterparty exposure and management of a significant short-dated Canadian, UK and US Treasury Bill portfolio. As at December 31, 2025, the cash and cash equivalents of $1.7 billion was composed primarily of $1.4 billion in interest earning cash equivalents, which are investments with a less than 90-day duration. The remaining amounts were comprised of non-interest bearing and interest bearing deposits of $0.1 billion and $0.2 billion, respectively. Foreign Exchange Services We provide foreign exchange services in the normal course of business in all banking jurisdictions. The major contributors to foreign exchange revenues are Bermuda and the Cayman Islands, accounting for 83% of our foreign exchange revenue for the year ended December 31, 2025. We do not maintain a proprietary trading book. Foreign exchange commission income is generated from client-driven transactions and totaled $52.5 million during the year ended December 31, 2025. Administration Services We provide custody administration and settlement services to a wide range of internal and external investment clients dealing in global markets. Our custody service currently offers custody settlement and safekeeping services in 39 markets globally, including major markets and smaller, less-developed markets, with principal markets covered being the United States, Canada, Europe and Asia. Our custody service offers safekeeping services for physical and book-entry assets. Custody for listed securities is conducted through BNYM. Hedge funds, mutual funds and exchange traded funds are held by BBH. Trading in investment transactions is settled via our global sub-custodians, BNYM and BBH. Custody services are offered from our Bermuda, Cayman and Channel Islands segments and complement core wealth management services offered by other parts of the Group, and we currently anticipate this business to grow in line with our wealth management business. Clients of our custody service include a wide range of investment funds and other investment vehicles, corporations and trusts whose related banking requirements are provided by the Bank. As such, the custody client base, in addition to delivering a fee based income, also provides cash balances and foreign exchange transaction flows. Custody fees are earned based on the value of Assets Under Custody, which are subject to a minimum levels for smaller, less complex portfolios. In addition to these fees, custody clients are charged banking transaction fees based on account activity. 27 Information Technology We devote significant resources to maintaining stable, reliable, efficient and scalable information technology systems. We work with our third-party vendors to monitor and maximize the efficiency of our use of their applications. We use integrated systems to originate and process loans and deposit accounts, which reduces processing time, improves customer experience and reduces costs. Most customer records are maintained digitally. Currently, our information technology is operationally divided into two platforms: (i) Bermuda and Cayman and (ii) Channel Islands and the UK. In 2023, our Bermuda and Cayman operations transitioned from a single outsourced banking technology platform to a multi-cloud, industry standard configuration, spreading operating risk among several large hosting providers, continuing the Group's ongoing cloud outsourcing strategy. In our Channel Islands and UK operations, core services and applications are primarily hosted across two data centers in Guernsey and Jersey. Protecting our systems to ensure the safety of our customers' information is critical to our business. We use multiple layers of protection to control access and reduce risk, including conducting access testing and regular vulnerability scanning on our platforms, systems and applications to reduce the risk that any attacks are successful. To protect against disasters, we have a Business Continuity Management framework and IT Disaster Recovery plans. For more information, see Item 3.D. "Risk Factors - Risks Relating to Operations, Risk Oversight and Internal Controls" and Item 16K. "Cybersecurity". Marketing Through our Marketing & Communications department, we engage select advertising, branding and promotional companies on an as-needed basis and provide business development and sales support for businesses in all jurisdictions. In support of our banking businesses, we broadly market our products and services through print, broadcast, web and social media advertising in the major markets in which we operate. Trust and fiduciary services are marketed primarily to intermediaries through representative attendance at and sponsorship of industry conferences and through print advertising in international trade journals. Intellectual Property In the highly competitive banking industry in which we operate, intellectual property is important to the success of our business. We own a variety of trademarks, service marks, trade names and logos and spend time and resources maintaining this intellectual property portfolio. We control access to our intellectual property through license agreements, confidentiality procedures, non-disclosure agreements with third parties, employment agreements and other contractual rights to protect our intellectual property. For more information, see Item 3.D. "Risk Factors - Risks Relating to Our Strategy, Brand, Portfolio and Other Aspects of Our Business". Supervision and Regulation Bermuda The Bank is subject to regulation and supervision by the Bermuda Monetary Authority (the "BMA") under: •the Bermuda Monetary Authority Act 1969; •the Banks and Deposit Companies Act 1999; •the Trusts (Regulation of Trust Business) Act 2001; •the Investment Business Act 2003; •the Exchange Control Regulations 1973; •the Corporate Services Provider Business Act 2012; and •any applicable code of practice or guidance notes that may be published by the BMA from time to time. The Bank is also subject to regulation by the Minister of Finance in Bermuda under the Companies Act 1981, the Banking (Special Resolution Regime) Act 2016 and the Economic Substance Act 2018 and regulations promulgated thereunder (including applicable guidance notes published by the Registrar of Companies from time to time). It is also subject to the Deposit Insurance Act 2011 and the Deposit Insurance Rules 2016. Supervision and Monitoring by the BMA Our activities are regulated by the BMA and our ability to engage in certain activities is subject to prior approval by the BMA. One of the principal objectives of the BMA is to supervise, regulate and inspect financial institutions which operate in or from within Bermuda and further to promote the financial stability and soundness of such financial institutions. The supervision is primarily for the benefit and protection of the Bank's clients and not for the benefit of our investors. The BMA is also responsible for managing and regulating transactions in foreign currency or gold. In addition to conducting on-site reviews, the BMA utilizes a comprehensive quarterly statistical return system that enables off-site monitoring of institutions licensed under the BDCA. The statistical system, which follows the standards imposed on banks in the UK by the Financial Conduct Authority and is consistent with Basel Committee Standards, provides the BMA with a detailed breakdown of the Bank's balance sheet and profit-and-loss accounts on both a consolidated and unconsolidated basis. This information enables the BMA to monitor the soundness of the Bank's financial position and ensure that it meets certain capital requirements. As the Bank's supervisory authority in Bermuda, the BMA is responsible for the consolidated supervision of our worldwide operations. There are also host regulatory bodies performing a similar function to that of the BMA in all major locations in which the Bank operates regulated activities. Many of these local authorities require detailed reporting on the activities of the Bank's subsidiaries located in their jurisdictions. As part of its oversight process, the BMA receives copies of each of these reports on a regular basis and liaises with the regulatory authorities in the respective locations. From time to time, in the ordinary course of business, the Bank enters into agreements with the BMA under which the Bank agrees to achieve or maintain certain levels of capital and to obtain the BMA's prior approval or letter of no objection to take certain corporate actions. Certain actions that may not be taken without prior BMA approval include: (1) creating or increasing the authorized amount of, or issuing any class of shares; and (2) entering into a material acquisition. Under the market disclosure requirements (referred to as Pillar III disclosures) applicable under the Basel III Accord ("Basel III"), the Bank is required to publish information about the risks to which it is exposed. Effective as of January 1, 2015, the BMA adopted capital and liquidity regulatory requirements consistent with Basel III, a framework released by the BCBS. Basel III aims to raise the quality, consistency and transparency of the capital base, limit the build-up of excess leverage and increase capital requirements for the banking sector. 28 In December 2017, the BCBS published standards that it described as the finalization of the Basel III post-crisis regulatory reforms (the standards are commonly referred to as “Basel IV”). Among other things, these standards revise the BCBS’s standardized approach for credit risk (including recalibrating risk weights and introducing new segmentations for exposures) and provides a new standardized approach for operational risk capital. Under the BCBS framework, these standards were effective on January 1, 20231, with an aggregate output floor phasing in through January 1, 20281. The BMA adopted the BCBS's revised standardized approach for operational and credit risk effective January 1, 2023 and January 1, 2025, respectively, which the Bank has implemented. The Basel standards aim to raise the quality, consistency and transparency of the capital base, limit the build-up of excess leverage and increase capital requirements for the banking sector. We are subject to the following requirements: •CET1 as the primary and predominant form of regulatory capital, with a requirement of CET1 of at least 7.0% of RWA, inclusive of a minimum CET1 capital adequacy ratio of 4.5% plus a capital conservation buffer of 2.5%, but excluding the D-SIB surcharge described below. The BMA allowed Bermuda banks to make the one-time irrevocable election to exclude other comprehensive income on their AFS portfolios from CET1; •a Tier 1 capital requirement of at least 8.5% of RWA, inclusive of a minimum Tier 1 ratio of 6% and the capital conservation buffer of 2.5% but excluding the D-SIB surcharge described below; •a total capital requirement of at least 10.5% of RWA, inclusive of a minimum total capital ratio of 8% and the capital conservation buffer of 2.5% but excluding the D-SIB surcharge described below; •the Bank is considered to be a D-SIB and is subject to a 3% surcharge composed of CET1-eligible capital implemented by the BMA effective September 30, 2015. This is based upon its assessment of the extent to which the Bank (individually and collectively with the other Bermuda banks) poses a degree of material systemic risk to the economy of Bermuda due to its role in deposit taking, corporate lending, payment systems and other core economic functions; •the inclusion of a countercyclical buffer to be introduced when macro-economic indicators provide an assessment of excessive credit or other pressures building in the banking sector, potentially increasing the Bank's required capital buffer by up to 2.5%; •the introduction of a 5% leverage ratio as calculated in accordance with Basel III; •an LCR with a minimum requirement of 100%; and •a NSFR with a minimum requirement of 100%. The minimum capital ratio requirements set forth above do not reflect additional Pillar II add-on requirements that the BMA may impose upon the Group as a prudential measure from time to time. As the Group's capital requirements remain under continuous review by the BMA pursuant to its prudential supervision, the Group cannot guarantee that the BMA will not seek higher total capital ratio requirements from time to time. The Bank may from time to time also be subject to additional regulatory requirements imposed by the BMA in its role as Bermuda’s main prudential regulator such as the Outsourcing Guidance Notes for Relevant Legal Entities and the Operational Cyber Risk Management Code of Conduct, both of which apply to the Bank and certain of its subsidiaries and impose additional requirements relating to risk management and mitigation. Effective February 29, 2020, the Bermuda Banking Association Code of Ethical Conduct was promulgated. This is a voluntary code that the Bank subscribes to. It sets out a number of guiding principles and commitments in the Bermuda banking industry for customers. The code complements the BDCA, and the code of conduct promulgated under the BDCA, in promoting best practice and encouraging higher standards for the benefit of customers through competition and market forces. Bermuda Monetary Authority Act 1969 The Bermuda Monetary Authority Act 1969 established the BMA as a statutory corporate body responsible for, among other things, supervising, regulating and inspecting any financial institution which operates in or from within Bermuda (which includes the Bank). Specific areas of financial regulation, such as the banking industry, are also the subject of separate, specific legislation (some of which is discussed below), but this specific legislation is nevertheless administered by the BMA in its supervisory capacity. In addition to its supervisory functions, both under the Bermuda Monetary Authority Act 1969 and the specific legislation discussed below, the BMA is empowered to assist foreign regulatory bodies by requiring entities supervised and regulated by the BMA to furnish information on demand to the BMA in connection with foreign regulatory requests. In 2022, the objectives of the BMA were expanded to include promoting the protection of customers using products and services provided by financial institutions (such as the Bank) through the oversight by the BMA of the conduct of business by those financial institutions. Banks and Deposit Companies Act 1999 The BDCA prohibits any person from carrying on a deposit-taking business in or from within Bermuda unless that person is a company incorporated in Bermuda and licensed by the BMA under the BDCA. The BDCA provides for three classes of licenses: banking licenses, restricted banking licenses and deposit company licenses. The Bank holds a banking license and a deposit company license. Unless otherwise permitted by the BMA, a company that holds a banking license must provide a range of minimum services to the public in Bermuda, including (without limitation) current accounts in Bermuda dollars, other deposit accounts, loan facilities in Bermuda Dollars, foreign exchange services and credit card or debit card facilities. A company holding a deposit company license typically offers a small range of services but, unless otherwise permitted by the BMA, must also provide some specified services to the public in Bermuda, including (without limitation) savings, deposit or other similar accounts in Bermuda Dollars and loans in Bermuda Dollars secured on mortgages of real property in Bermuda. ______________________________________ 1 In March 2020, in response to the pandemic, the BCBS deferred the implementation timeline from January 1, 2022 to January 1, 2023 and the output floor phasing in from January 1, 2027 to January 1, 2028. 29 As the agency responsible for administering the BDCA, regulating deposit-taking businesses and protecting depositors, the BMA has broad authority to compel companies licensed under the BDCA to take or cease specific actions and comply with informational or access requests. Under the BDCA, the BMA can, or can compel these companies, including us, to, among other things, do any or all of the following: •submit a report prepared by the Bank's auditors or by an accountant or other person with professional skills on any matter about which the BMA could require us to provide information; •produce documentation or other information as the BMA may reasonably require; and •permit any officer, servant or agent of the BMA, on producing evidence of his authority, to enter the Bank's premises to obtain information and documents. In addition, the BMA has the power to do any or all of the following: •require the Bank to take certain steps or to refrain from adopting or pursuing a particular course of action or to restrict the scope of the Bank's business in a particular way; •appoint competent persons to investigate and report to the BMA on the Bank's business or the Bank's ownership and control; •restrict the scope of a license or revoke a license; and •vary or revoke the Bank's banking license and to give directions if it feels these are necessary to protect the Bank's depositors. The Bank's failure to comply with any of the statutory requirements set forth in the BDCA could result in civil or criminal penalties. The Bank is required to report certain transactions to the BMA. These include any transaction or transactions relating to any one person as a result of which the Bank would be exposed to a risk of incurring losses in excess of 10% of the Bank's available capital resources, or where the Bank proposes to enter into a transaction or transactions relating to any one person, which, either alone or together with previous transactions entered into by the Bank in relation to the same person, would result in the Bank being exposed to the risk of incurring losses in excess of 25% of its available capital resources. This also applies where the transaction relates to different persons if they are connected in such a way that the financial soundness of any of them may affect the financial soundness of the others or the same factors may affect the financial soundness of both or all of them. The BMA may extend the scope of this requirement to the Bank's subsidiaries even if these subsidiaries are not licensed under the BDCA as if the transactions and available capital resources of the Bank's subsidiaries were included in the Bank's available capital resources. For the purpose of the foregoing, the transactions which must be reported by the Bank to the BMA are those between the Bank and a person where: (a)that person incurs an obligation to the Bank or as a result of which such person may incur such an obligation; (b)the Bank will incur, or as a result of which it may incur, an obligation in the event of that person defaulting on an obligation to a third party; or (c)the Bank acquires or incurs any obligation to acquire, or as a result of which it may incur an obligation to acquire, an asset the value of which depends wholly or mainly on that person performing their obligations or otherwise on his financial soundness. The risk of loss attributable to the transaction is, in a case within paragraph (a) or (b), the risk of the person concerned defaulting on the obligation therein mentioned and, in a case within paragraph (c), the risk of the person concerned defaulting on the obligations therein mentioned or of a deterioration in such person's financial soundness. The Bank's available capital resources may be determined by the BMA, after consultation with it and in accordance with principles published by the BMA, which are currently the Basel III principles described above. It is an offense for the Bank to fail to make the required reports. Under the BDCA, any person who becomes a significant shareholder of a deposit-taking institution, which is defined to include persons, either individually or with associates (within the meaning of the BDCA), who (i) hold 5% or more of the shares in the institution or another company of which it is a subsidiary company; or (ii) are entitled to exercise, or control the exercise of 5% or more of the voting power at any general meeting of the institution or of another company of which it is such a subsidiary, must notify the BMA in writing of that fact within seven days. Failure to provide the BMA with prompt and appropriate notice would constitute an offense that could result in a fine. The BDCA prohibits a person from becoming a shareholder controller of any company licensed under the BDCA unless the person provides written notice to the BMA of his intent to do so and the BMA does not object. The definition of shareholder controller is set out in the BDCA but generally refers to a person who, among other things, either alone or with any associate or associates (i) holds 10% or more of the shares in the licensed institution or another company of which it is a subsidiary company; (ii) is entitled to exercise, or control the exercise of 10% or more of the voting power at any general meeting of the licensed institution or another company of which it is such a subsidiary; or (iii) is able to exercise a significant influence over the management of the institution or of another company of which it is a subsidiary by virtue of holding shares in or an entitlement to exercise or control the exercise of the voting power at any general meeting of either the institution or the other company concerned. The BDCA distinguishes between shareholder controllers of the following threshold descriptions: "10% shareholder controllers," "20% shareholder controllers," "30% shareholder controllers," "40% shareholder controllers," "50% shareholder controllers," "60% shareholder controllers" and "principal shareholder controllers" who have a 75% or greater interest. A person who intends to become a shareholder controller, or a shareholder controller who intends to increase his shareholding/control, meaning generally, ownership of shares or the ability to exercise or control the exercise of voting rights attached to shares, beyond his present threshold, must provide written notice to the BMA that he intends to do so. It is an offense not to give this notice. The BMA may object to a person's notice of intent to become a shareholder controller of any description or to an existing shareholder controller seeking to increase their control where it appears to the BMA that, among other things, such person is not or is no longer a fit and proper person to be such controller. If the BMA objects, the BMA will provide such person with written notice of its objection. Prior to serving a notice of objection, the BMA shall serve the person seeking to become a shareholder controller of any description or existing shareholder controller seeking to increase their control with a preliminary written notice stating that the BMA is considering service on that person of a notice of objection, and that notice shall state among other things, the reasons for the BMA's proposed objection. The statement of the BMA's reasons for their proposed objection will, however, be subject to the BMA's determination that such statement would not involve the disclosure of confidential information, the disclosure of which would be prejudicial to a third party. A person served with a preliminary written notice may, within a period of 28 days beginning with the day on which the notice is served, make written representations to the BMA and the BMA shall take any such representations into account in deciding whether to serve a notice of objection. If three months pass from the date of giving notice of intent to the BMA without the BMA serving a notice of objection, then the person may become a shareholder controller as requested in the notice of intent. In practice, the BMA's procedure is generally to respond to a shareholder controller notification of intent. If a person becomes a shareholder controller or increases their shareholding/control in spite of the BMA's objection thereto, if a shareholder controller fails to comply with the foregoing notice requirements or if a shareholder controller continues as such after being given notice of objection to his or her being a shareholder controller, the BMA may take the actions specified in the BDCA, including revoking the relevant license where a 50%, 60% or principal shareholder controller is involved, or mandating that any specified shares become subject to one or more of the following restrictions: •any transfer of or agreement to transfer those shares or, in the case of unissued shares, any transfer of or any agreement to transfer the right to be issued with them, will be void; 30 •no voting rights may be exercisable in respect of the shares; •no further shares may be issued in right of them or pursuant to any offer made to their holder; or •except in liquidation, no payment may be made of any sums due from the institution on the shares, whether in respect of capital or otherwise. A court in Bermuda may, on the application of the BMA, order the sale of any such shares. Any person may appeal to a tribunal constituted under the BDCA for a review of a notice of objection given by the BMA as described above. However, this right of appeal does not apply to a person in any case in which such person has failed to give a notice or has become or continued to be a controller in contravention of the BDCA. In addition, if a person has had its license revoked or has been subject to any of the restrictions set forth above, the tribunal may confirm or reverse the decision which is the subject of the appeal but shall not have power to vary it except: •where the decision was made to impose or vary any restriction, the tribunal may direct the BMA to impose different restrictions or to vary them in a different way; or •where the decision was to revoke a license, the tribunal may direct the BMA to restrict it instead. In the event that the BMA imposes any of the restrictions listed above, the restrictions may apply to: •all shares of the institution where the person in question is a shareholder controller that (i) are held by him or any associate of his, and (ii) were not so held immediately before he became such shareholder controller of the institution; and •all shares in another company where the person in question became a shareholder controller (i) as a result of the acquisition by him or any associate of his of shares in such other company, and (ii) the shares were not so held before he became a shareholder controller of such institution. A company licensed under the BDCA must give written notice to the BMA in the event that any person has either become or ceased to be a director, controller or senior executive of such licensed company. The written notice is required to be given to the BMA within 14 days beginning with the day on which the licensed company becomes aware of the relevant change in director, controller or senior executive. The definition of "controller" is set out in the BDCA but generally refers to a shareholder controller, a managing director or chief executive officer of the institution or of another company of which it is a subsidiary, or a person in accordance with whose directions or instructions the directors of the institution or of another company of which the institution is a subsidiary, or persons who are shareholder controllers (or any of them) are accustomed to act. In August 2022, the BMA published a code of conduct issued pursuant to section 8A of the BDCA. The Bank is required to comply with this code of conduct, and the BMA has indicated that the Bank’s compliance with the BDCA code of conduct will be considered when determining whether the Bank’s business is being conducted in a prudential manner as required under the BDCA’s minimum criteria for licensing. The BDCA code of conduct seeks to ensure that, amongst other things, institutions licensed under the BDCA deal with their customers fairly and equitably. To this end, the BDCA code of conduct sets out principles the Bank is expected to observe in several key areas including compliance with laws, integrity and ethics, conflicts of interests, handling of customer information, internal management controls, publication and disclosure of license and cooperation with regulatory authorities. Also in August 2022, the BDCA was amended to add provisions that give the Minister of Finance of Bermuda, in consultation with the BMA, the power to make regulations regulating any commercial or operational business fee, charge or penalty the Bank proposes to charge its clients. In accordance with such powers, the Banks and Deposit Companies (Over-the Limit Fees and Unauthorized Overdraft Fees) Regulations 2025 (the “OTL Regulations”) became operative on September 25, 2025. The OTL Regulations were made to address concerns regarding the nature and timing of fees that banking customers may face for exceeding certain credit limits, including limiting the frequency of such fees and requiring banks to set out all terms and conditions under related agreements and obtain confirmation from customers accepting or declining such terms, conditions or fees. Trusts (Regulation of Trust Business) Act 2001 The principal purpose of the Trusts (Regulation of Trust Business) Act 2001 (the "Trusts Business Act"), is to regulate "trust business," which is generally defined as providing the services of a trustee as a business, trade, profession or vocation. Under the Trusts Business Act, a license is required to conduct trust business in or from within Bermuda. Licenses are designated as either "unlimited" or "limited." Only bodies corporate are entitled to obtain unlimited licenses, which allow them to conduct trust business and solicit business from the public generally. Holding a license under the Trusts Business Act obliges the licensed undertaking to maintain a physical presence in Bermuda at which the licensed undertaking is directed and managed. A licensed undertaking is also required to hold all client funds separately from its own funds or funds held in respect of any other business and maintain such books of account and other records such that client funds may be readily identified at any time. At present, the Bank and certain of its subsidiaries hold unlimited licenses issued by the BMA pursuant to the Trusts Business Act. Pursuant to Section 6 of the Trusts Business Act, the BMA has published a Statement of Principles, in accordance with which it is acting or purporting to act with respect to the exercise of its powers under the Trusts Business Act, including (without limitation) the BMA's minimum licensing criteria, the grounds for revocation of licenses, the power to grant, revoke or restrict a license and the power to obtain information or require the production of documents. As at December 31, 2019, the BMA amended the minimum licensing criteria under the Trusts Business Act, such that a licensed undertaking is not regarded as conducting its business in a prudent manner (which is a requirement for licensing) unless it maintains or will maintain adequate liquidity, having regard to the relationship between its assets and its actual and contingent liabilities, to the time at which those liabilities will or may fall due and its assets mature, and to other factors appearing to the BMA to be relevant. In addition, pursuant to Section 7 of the legislation, the BMA published a Code of Practice that provides guidance as to the duties, requirements, procedures, standards and principles to be observed by persons carrying on trust business under the Trusts Business Act. The BMA's powers under the Trusts Business Act include (without limitation) the power to: •impose conditions on a license with respect to scope and type of business, to protect a client or potential client of a licensee; •revoke a license in certain circumstances including if the licensee has not complied with the licensing criteria; and •request and obtain information from a licensee to ensure compliance with the Trusts Business Act, and to safeguard the interests of the licensee's clients and potential clients. The Trusts Business Act prohibits a person from becoming a 10% shareholder controller or a majority shareholder controller of a licensed undertaking, unless such person provides written notice to the BMA of his intent to do so and the BMA does not object. It is an offense not to provide this notice. The definition of shareholder controller is set out in the Trusts Business Act, but generally refers to a person who, among other things, either alone or with any associate or associates (within the meaning of the Trusts Business Act): (i) holds 10% or more of the shares in the licensed undertaking or another company of which it is a subsidiary company; or (ii) is entitled to exercise, or control the exercise of 10% or more of the voting power at any general meeting of the licensed undertaking or another company of which it is such a subsidiary or (iii) is able to exercise a significant influence over the management of a licensed undertaking or of another company of which the licensed undertaking is a subsidiary by virtue of holding shares in or an entitlement to exercise or control the exercise of the voting power at any general meeting of either the licensed undertaking or the other company concerned. A "majority shareholder controller" is defined under the Trusts Business Act as a shareholder controller which, among other things, (i) holds 50% or more of the shares in the licensed undertaking or another company of which it is a subsidiary company; or (ii) is entitled to exercise, or control the exercise of 50% or more of the voting power at any general meeting of the licensed undertaking or another company of which it is such a subsidiary. 31 The BMA may object to a person's notice of intent to become a 10% shareholder controller or majority shareholder controller or may object to an existing shareholder controller of any description where it appears to the BMA that, among other things, such person is not or is no longer a fit and proper person to be such a controller of the licensed undertaking. If the BMA objects, the BMA will provide such person with a written notice of objection. Prior to serving any such notice of objection, the BMA shall serve the person seeking to become a shareholder controller or the existing shareholder controller with a preliminary written notice stating that the BMA is considering service on that person of a notice of objection, stating, among other things, the reasons for the BMA's proposed objection. The statement of the BMA's reasons for its proposed objection will, however, be subject to the BMA's determination that such statement would not involve the disclosure of confidential information, the disclosure of which would be prejudicial to a third party. A person served with a preliminary written notice may, within a period of 28 days beginning with the day on which the notice is served, make written representations to the BMA and the BMA shall take any such representations into account in deciding whether to serve a notice of objection. If three months pass from the date of notifying the BMA of a new shareholder controller or an increased shareholding/control beyond a shareholder controller's then current threshold, without the BMA serving a notice of objection, then the person may become a shareholder controller as requested in the notice. In practice, the BMA's procedure is generally to respond to a person's shareholder controller notification. If a person becomes a shareholder controller or increases their shareholding control, in spite of the BMA's objection thereto, if a shareholder controller fails to comply with the foregoing notice requirements or if a shareholder controller continues as such after being given notice of objection to his being a shareholder controller, the BMA may take certain actions, including revoking the relevant license where a shareholder controller holding 50% or more of the shares of the licensed undertaking is involved or mandating that any specified shares become subject to one or more of the following restrictions: •any transfer of or agreement to transfer those shares or, in the case of unissued shares, any transfer of or any agreement to transfer the right to be issued with them, will be void; •no voting rights may be exercisable in respect of the shares; •no further shares may be issued in right of them or pursuant to any offer made to their holder; or •except in liquidation, no payment may be made of any sums due from the licensed undertaking on the shares, whether in respect of capital or otherwise. A court in Bermuda may, on the application of the BMA, order the sale of any such shares. Any person may appeal to a tribunal constituted under the Trusts Business Act for a review of a notice of objection given by the BMA as described above. However, this right of appeal does not apply to a person in any case in which such person has failed to give a notice or has become or continued to be a controller in contravention of the Trusts Business Act. In addition, if a person has had their license revoked or has been subject to any of the restrictions set forth above, the tribunal may confirm or reverse the decision which is the subject of the appeal but shall not have power to vary it except: •where the decision was made to impose different restrictions or vary them in a different way, the tribunal may direct the BMA to impose different restrictions; or •where the decision was to revoke a license, the tribunal may direct the BMA to restrict it instead. In the event that the BMA imposes any of the restrictions listed above, the restrictions may apply to: •all shares of the licensed undertaking of which the person in question is a shareholder controller that (i) are held by him or any associate of his, and (ii) were not so held immediately before he became such shareholder controller of the licensed undertaking; and •all shares in another company where the person in question became a shareholder controller (i) as a result of the acquisition by him or any associate of his of shares in such other company, and (ii) the shares were not so held before he became a shareholder controller of such licensed undertaking. An undertaking licensed under the Trusts Business Act must give written notice to the BMA in the event that any person has either become or ceased to be a controller or officer of such licensed undertaking. The written notice is required to be given to the BMA within 14 days beginning with the day on which the licensed undertaking becomes aware of the change in controller or officer. The definition of "controller" is set out in the Trusts Business Act but generally refers to a shareholder controller, a managing director or chief executive officer of the undertaking or of another company of which it is a subsidiary, or a person in accordance with whose directions or instructions the directors of the undertaking or of another company of which the undertaking is a subsidiary, or persons who are shareholder controllers (or any of them) are accustomed to act. The definition of "officer" under the Trusts Business Act includes a director, secretary or any senior executive. Investment Business Act 2003 The Investment Business Act 2003 (the "Investment Business Act") prohibits any person from carrying on, or purporting to carry on, an investment business in or from within Bermuda unless that person holds a license granted under the Investment Business Act, or is registered as a Class A registered person or a Class B registered person under the Investment Business Act (or is otherwise designated as non-registrable). A person is deemed to carry on investment business in or from Bermuda if it is incorporated or formed in Bermuda and carries on investment business, or is incorporated or formed outside of Bermuda and carries on investment business in or from Bermuda. The Investment Business Act defines "investment business" broadly as the business of dealing in investments, arranging deals in investments, managing or offering investments and giving advice on investments. Under the Investment Business Act, the BMA is given the authority to grant licenses and to supervise license holders (which includes issuing codes of conduct or practice and making rules prescribing prudential and technical standards). The BMA will only grant a license if it is satisfied that the applicant complies with licensing criteria set out in the Investment Business Act, which include (without limitation) that controllers and senior executives of the applicant are fit and proper persons to carry on such business, the applicant company's business is effectively directed by at least two individuals (unless the BMA otherwise approves), the Board of the applicant has a number of non-executive directors considered appropriate by the BMA, the applicant's business is conducted in a prudent manner, the applicant maintains its principal place of business in Bermuda, the position of the applicant in the group does not obstruct effective consolidated supervision and the applicant will carry on the investment business with integrity and professional skill appropriate to the nature and scale of its activities. At the present time, the Bank and its wholly owned subsidiaries Butterfield Trust (Bermuda) Limited, Butterfield Securities (Bermuda) Limited and Butterfield Asset Management Limited hold licenses under the Investment Business Act. Under the Investment Business Act, the BMA may require an accountant's or auditor’s report on a license holder or the appointment of an inspector to carry out an investigation into the affairs of a license holder and/or demand the production of documents or information relating to the investment business of a license holder. The Investment Business Act also grants the BMA broad powers to enforce the provisions of the Investment Business Act, including (without limitation) powers to issue directions, to vary, restrict or cancel a license, to appoint a person to manage and administer an offending investment business, to give directions desirable to safeguard the interests of the investment provider’s clients, to levy fines and to seek from the court injunctions and restitution orders. The Investment Business Act prohibits a person from becoming a 10% shareholder controller or a majority shareholder controller of an investment provider, unless such person provides written notice to the BMA of his intent to do so and the BMA does not object. It is an offense not to provide this notice. The definition of 10% shareholder 32 controller is set out in the Investment Business Act, but generally refers to a person who, among other things, either alone or with any associate or associates (within the meaning of the Investment Business Act): (i) holds 10% or more of the shares in the investment provider or its parent undertaking; (ii) is entitled to exercise, or control the exercise of 10% or more of the voting power in the investment provider or in the parent undertaking; or (iii) is able to exercise a significant influence over the management of the investment provider or its parent undertaking by virtue of the voting power in the investment provider or its parent undertaking. A "majority shareholder controller" is defined under the Investment Business Act as a shareholder controller which (i) holds 50% or more of the issued and outstanding shares in the investment provider or its parent undertaking; or (ii) is entitled to exercise, or control the exercise of 50% or more of the voting power in the investment provider or in the parent undertaking. The BMA may object to a person's notice of intent to become a 10% shareholder controller or majority shareholder controller or to an existing shareholder controller of any description where it appears to the BMA that, among other things, such person is not or is no longer a fit and proper person to be such controller of the licensed company. If the BMA objects, the BMA will provide such person with a written notice of objection. Prior to serving any such notice of objection, the BMA serves the person seeking to become a shareholder controller or will serve an existing shareholder controller with a preliminary written notice stating that the BMA is considering service on that person of a notice of objection, stating, among other things, the reasons for the BMA's proposed objection. The statement of the BMA's reasons for their proposed objection will, however, be subject to the BMA's determination that such statement would involve the disclosure of confidential information, the disclosure of which would be prejudicial to a third party. A person served with a preliminary written notice may, within a period of 28 days beginning with the day on which the notice is served, make written representations to the BMA and the BMA shall take any such representations into account in deciding whether to serve a notice of objection. If ninety days pass from the date of notifying the BMA of a new shareholder controller or an increased shareholding/control beyond a shareholder controller's then current threshold, without the BMA serving a notice of objection, then the person may become a shareholder controller as requested in the notice. In practice, the BMA's procedure is generally to respond to a person's shareholder controller notification. If a person becomes a shareholder controller or increases their shareholding/control in spite of the BMA's objection to his becoming a shareholder controller, or if a shareholder controller fails to comply with the foregoing notice requirements, or if a shareholder controller continues as such after being given notice of objection to his being a shareholder controller, the BMA may take certain actions, including revoking the relevant license where a shareholder controller holding 50% or more of the shares of the licensed company is involved or mandating that any specified shares become subject to one or more of the following restrictions: •any transfer of or agreement to transfer those shares or, in the case of unissued shares, any transfer of or any agreement to transfer the right to be issued with them, will be void; •no voting rights may be exercisable in respect of the shares; •no further shares may be issued in right of them or pursuant to any offer made to their holder; or •except in liquidation, no payment may be made of any sums due from the investment provider on the shares, whether in respect of capital or otherwise. A court in Bermuda may, on the application of the BMA, order the sale of any such shares. Any person may appeal to a tribunal constituted under the Investment Business Act for a review of a notice of objection given by the BMA as described above. However, this right of appeal does not apply to a person in any case in which such person has failed to give a notice or has become or continued to be a controller in contravention of the Investment Business Act. In addition, if a person has had its license revoked or has been subject to any of the restrictions set forth above, the tribunal may confirm or reverse the decision which is the subject of the appeal but shall not have power to vary it except: •where the decision was made to impose or vary any restriction, the tribunal may direct the BMA to impose different restrictions or to vary them in a different way; or •where the decision was to revoke a license, the tribunal may direct the BMA to restrict it instead. In the event that the BMA imposes any of the restrictions listed above, the restrictions may apply to: •all shares of the investment provider of which the person in question is a shareholder controller that (i) are held by him or any associate of his; and (ii) were not so held immediately before he became such shareholder controller of the investment provider; and •all shares in another company where the person in question became a shareholder controller (i) as a result of the acquisition by him or any associate of his of shares in such other company; and (ii) the shares were not so held before he became a shareholder controller of such investment provider. A company licensed under the Investment Business Act must give written notice to the BMA in the event that any person has either become or ceased to be a controller or officer of such investment provider. The written notice is required to be given to the BMA within 14 days beginning with the day on which the investment provider becomes aware of the change in controller or officer. The definition of "controller" is set out in the Investment Business Act but generally refers to a shareholder controller, a managing director or chief executive officer of the investment provider or of another company of which it is a subsidiary, or a person in accordance with whose directions or instructions the directors of the investment provider or of its parent undertaking or persons who are shareholder controllers (or any of them) are accustomed to act. The definition of "officer" under the Investment Business Act includes a director, secretary or any senior executive. Corporate Service Provider Business Act 2012 The CSPB regulates persons carrying on a corporate service provider business in Bermuda. “Corporate service provider business” in this context means the provision of any of the following services for a profit: (a) acting as a company formation agent or agent for establishment of a partnership; (b) providing nominee services, including (among other things) providing nominee shareholders; (c) providing administrative and secretarial services to companies or partnerships (including, among other things, providing a registered office and maintaining the books and records of a company or partnership); (d) performing functions in the capacity as a resident representative under various Bermuda statutes; and (e) providing any other corporate or administrative services as may be specified in regulations made under the CSPB. Under the CSPB, the Bank or any of its subsidiaries is required to hold a corporate service provider license to lawfully provide corporate services to our customers in Bermuda. Licensing under the CSPB is administered by the BMA. Holding a license under the CSPB obliges the licensed undertaking to maintain a physical presence in Bermuda at which the licensed undertaking is directed and managed. A licensed undertaking is also required to hold all client funds separately from its own funds or funds held in respect of any other business and maintain such books of account and other records such that client funds may be readily identified at any time. Pursuant to the provisions of the CSPB any person who, together with their associates (within the meaning of the CSPB), intends to become either a shareholder controller or a majority shareholder controller of a CSPB licensed entity, must first serve notice of their intent to do so on the BMA and either receive a notice of non-objection from the BMA, or wait for the expiration of a three month period starting from the date of the notice to the BMA without the BMA having served a written notice of objection. A “shareholder controller” under the CSPB is any person who, either alone or with any associate or associates, (i) holds 10% or more of shares of the licensed entity (if it is a company) or 10% or more of another company of which the licensed entity is a subsidiary; (ii) is entitled to control or control the exercise of 10% or more of the voting power at any general meeting of the licensed entity (if it is a company) or of another company of which the licensed entity is a subsidiary; or (iii) is able to exercise a significant influence over the management of a licensed entity or of another company of which the licensed entity is a subsidiary by virtue of holding shares in or an entitlement to exercise or control 33 the exercise of the voting power at any general meeting of either the licensed entity (if it is a company) or its holding company. A “majority shareholder controller” under the CSPB has the same meaning as limbs (i) and (ii) in the preceding sentence, save that the relevant percentage threshold for ownership is 50% or more. In addition to the requirement to notify and obtain BMA non-objection (whether express or deemed) of any change in shareholder controller or majority shareholder controller of a CSPB licensed entity, if at any time it appears to the BMA that a person who is a “controller” of any description of a CSPB licensed entity is not a fit and proper person for such role, the BMA may serve a written notice of objection to that controller; provided that, before serving such a notice, the BMA must serve that person with a preliminary written notice stating that the BMA is considering service on that person of a notice of objection, specifying the reasons for which it appears to the BMA why that person is not or is no longer a fit and proper person and advising as to the rights of that person to make written representations to the BMA within 28 days beginning on the day on which such notice is served, and that such written representations shall be taken into account by the BMA in deciding whether to serve a notice of objection. For these purposes a “controller” includes (i) a managing director of a licensed entity or the licensed entity’s holding company; (ii) the CEO of the licensed entity or the licensed entity’s holding company; and (iii) a person in accordance with whose directions or instruction the directors of the licensed entity (or its holding company) are accustomed to act. Upon determining that any individual is not a fit and proper person, the BMA may pass a prohibition order, thereby preventing that individual from exercising any functions in connection with any business requiring licensing under the CSPB. Furthermore, under the CSPB, a licensed entity is required to give written notice to the BMA of any person becoming or ceasing to be a controller or an “officer” (director, company secretary or senior executive) of the licensed entity. Breaches of the CSPB are punishable by a range of criminal and civil penalties including fines, imprisonment and public censure; breaches can result in the licensed entity losing its license and therefore its ability to conduct corporate service provider business. The BMA is also empowered to restrict a controller’s ability to sell any shares (and exercise any rights in respect of such shares) held by the controller in a CSPB licensed entity if they continue to be or become a controller following a notice of objection from the BMA. Companies Act 1981 As a local company incorporated in Bermuda, the Bank is subject to the Companies Act 1981 (the "Companies Act"). Under section 114 of the Companies Act, no local company may carry on business of any sort in Bermuda unless, among other things, (i) it complies with the control and ownership requirements set out in Part I of the Third Schedule of the Companies Act; (ii) it is licensed under section 114B of the Companies Act and is carrying on such business in accordance with the terms and conditions imposed in such license; or (iii) its shares are listed on a designated stock exchange and the company is engaged as a business in a material way in a prescribed industry pursuant to section 114(1)(e) of the Companies Act. In December 2000, the Minister of Finance issued to the Bank a license pursuant to section 114B of the Companies Act allowing the Bank to carry on business in Bermuda without complying with certain provisions of the Third Schedule to the Companies Act. Effective June 10, 2016, the Bank relinquished its section 114B license and carries on business in Bermuda without complying with the provisions of the Third Schedule in reliance upon the exemption in section 114(1)(e) of the Companies Act. The Bank qualifies for this statutory exemption by virtue of (i) the listing of the Bank's shares on the BSX, which is a "designated stock exchange" for the purposes of the Companies Act and (ii) the Bank's material business of banking, which is a "prescribed industry" for the purposes of the Companies Act. Exchange Control The Bank is designated as resident in Bermuda for exchange control purposes. As a resident, the Bank is subject to certain exchange controls relating to foreign currency transactions. The Bank is also an authorized dealer and depository for exchange control purposes with respect to certain dealings in gold and foreign currency. Financial Crime Regulation Bermuda has enacted a number of laws relating to combating money laundering and terrorist financing. These laws include the Proceeds of Crime Act 1997, the Anti-Terrorism (Financial and Other Measures) Act 2004, the Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Supervision and Enforcement) Act 2008 and the Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2008, the Financial Intelligence Agency Act 2007, and the Anti-Terrorism (Financial and Other Measures) (Businesses in Regulated Sector) Order 2008 each as amended from time to time. The Bank may be regulated together with its branches and subsidiaries in respect of anti-money laundering and anti-terrorist financing policies and procedures as a “financial group” if so designated by the Bermuda minister responsible for justice. Furthermore, under the Bribery Act 2016 of Bermuda, the Bank may be guilty of an offense if persons associated with the Bank (which can include the Bank’s employees, agents or subsidiaries) bribe another person intending to obtain or retain business for the Bank or to obtain or retain an advantage in the conduct of business for the Bank. It is a defense to such offenses if the Bank proves that it has in place adequate procedures designed to prevent persons associated with the Bank from undertaking such bribery. Following the UK’s exit from the EU, the UK enacted the Sanctions and Anti-Money Laundering Act 2018 (SAMLA) as enabling legislation for a raft of economic and other sanctions, and money laundering and terrorist financing regulations. Regulations made under SAMLA have been extended to certain overseas territories (but not Bermuda, owing to Bermuda’s unique measure of self-government) by Order in Council (the “Orders”). Bermuda has separately applied the Orders in its domestic law under the International Sanctions Act 2003. They are listed in the International Sanctions Regulations 2013. Such action to apply the Orders in Bermuda ensures that the list of financial sanctions targets in Bermuda tracks the UK Sanctions List maintained by HM Treasury’s Office for Financial Sanctions Implementation. Bans on new investment and on financial or professional services also track applicable UK sanctions. Stamp Duty Stamp duty is a tax in Bermuda imposed on written documents. The governing legislation is the Stamp Duties Act 1976, as amended (the "Stamp Duties Act"). The Stamp Duties Act sets out the instruments that are subject to stamp duty, which generally include certain instruments or documents as specified in the Stamp Duties Act that are executed in Bermuda or, if executed outside of Bermuda, are then brought into Bermuda. There are certain limited stamp duty exemptions under the Bermuda Stock Exchange Company Act 1992 (the ‘‘BSX Act’’), which extend to local companies, the securities of which are listed on the BSX. The Bank’s common shares are currently listed on the NYSE and BSX. Pursuant to the BSX Act, the provisions of the Stamp Duties Act will not apply to any instrument which relates to (i) a conveyance or transfer on sale, (ii) a conveyance or transfer to effect or having the effect of a voluntary disposition inter vivos, or (iii) any agreement for the lending and borrowing, of any securities which are listed on the BSX. Accordingly, for so long as the common shares of the Bank remain listed on the BSX (and to the extent any other securities issued by the Bank are listed on the BSX), the foregoing stamp duty exemptions under the BSX Act would apply. However, dealings in the Bank’s common shares beyond the limited exemptions under the BSX Act may attract stamp duty under various heads of the Schedule to the Stamp Duties Act. For example, ad valorem stamp duty may be payable (i) where security is granted over shares of the Bank, (ii) where shares of the Bank form part of a deceased’s estate and probate is sought, and (iii) on a share certificate where the share is issued by the Bank for the first time at a premium in excess of the par value thereof. 34 The Stamp Duties Act prescribes the persons liable to pay the stamp duty, whether the amount of duty is a fixed or ad valorem amount and the time period in which the duty must be paid, depending on the nature of the instrument. The Stamp Duties Act also sets out the consequences for failure to stamp instruments which are subject to duty. Generally, if a stampable document has been executed in Bermuda or has been executed outside of Bermuda and then brought into Bermuda and stamp duty is not paid, the document is not valid for any purpose (including registration) in Bermuda, until such time as it is stamped. In addition, a stampable document which is not stamped (i) is not admissible in court proceedings in Bermuda, except in criminal proceedings or stamp duty violation prosecutions; and (ii) may not be acted upon, filed, or registered by any public official or by any company. For any instrument which is liable to stamp duty that is not duly stamped, every person who is specified in the Stamp Duties Act as liable for stamping commits an offense. Limits on Shareholding Generally, the Companies Act imposes limits on the percentage of shares in a local company carrying on business in Bermuda which may be held by persons who are non-Bermudian as that term is defined in the Companies Act. As described above, the Bank relies on an exemption under section 114(1)(e) of the Companies Act to these ownership and related control requirements. Additionally, the bye-laws of the Bank restrict the voting rights of a person who is not "Bermudian" (as such term is defined in the Companies Act) and who is "interested" (as such term is defined in the bye-laws) in the shares of the Bank which constitute more than 40% of all shares then issued and outstanding, and such person is not entitled to vote the shares which are in excess of this 40% interest at any general meeting without the prior written approval of the Minister of Finance. In addition, there are certain prior approval requirements pursuant to the BDCA, the Trusts Business Act, the CSPB and the Investment Business Act with respect to any person who seeks to become a "shareholder controller" (as defined in each of those Acts) of the Bank. The Beneficial Ownership Act 2025 (the “BOA”) came into effect on November 3, 2025 and requires legal persons, as defined thereunder, to identify beneficial owners, maintain a beneficial ownership register and provide certain information with respect to beneficial owners to the ROC. Legal persons whose shares or interest are listed on the BSX or an appointed stock exchange (as defined in the Companies Act), and any subsidiary of such legal person, are exempted from the application of the BOA. As the Bank’s common shares are currently listed on the BSX and the NYSE, the Bank and its subsidiaries are exempt from the requirements under the BOA. Deposit Insurance Scheme Pursuant to the Deposit Insurance Act 2011 and the Deposit Insurance Rules 2016 of Bermuda, a DIS has come into effect in Bermuda. The DIS is administered by the Bermuda Deposit Insurance Corporation. The DIS is designed to protect the deposits of individuals, charities, unincorporated associations, partnerships, sole proprietors and small businesses by guaranteeing up to $25,000 of their aggregate Bermuda Dollar deposits in the event of a Bermuda deposit taking institution’s failure. The DIS is backed by a Deposit Insurance Fund which is in turn funded from premium contributions that are payable by all banks and credit unions licensed by the BMA . As a bank licensed by the BMA, we are required to be a member of the DIS and pay contributions to the Deposit Insurance Fund. Currently, our premium contribution is calculated by the Bermuda Deposit Insurance Corporation as 0.25% per annum of the average total amount of our Bermuda Dollar deposits that are covered by the DIS guarantee over a rolling three-month period based on information disclosed by us to the Bermuda Deposit Insurance Corporation. Each contribution to the Deposit Insurance Fund is payable every three months in arrears. Personal Information Protection Act 2016 Bermuda’s principal data protection legislation is the PIPA. PIPA applies to every organization (which includes any individual, entity or public authority) that uses personal information in Bermuda where that personal information is used by automated or other means which form, or are intended to form, part of a structured filing system. For the purposes of PIPA, “personal information” means any information about an identified or identifiable individual (meaning a natural person), and “use” or “using” are very broadly defined and effectively include possessing or carrying out any operation on personal information. The Bank uses and holds individuals’ personal information in Bermuda, so must comply with the provisions of PIPA. The first Bermuda Privacy Commissioner was appointed with effect from January 20, 2020, and all remaining provisions of PIPA became effective on January 1, 2025. The Bank (and its Bermuda subsidiaries) is required to use all “personal information” in accordance with PIPA (and any related codes of conduct or guidance). This requires the Bank and its Bermuda subsidiaries to, amongst other things, publish and abide by a privacy notice in respect of personal information, ensure that appropriate safeguards are in place in relation to risks associated with the use of personal information (including loss, unauthorized access, destruction, use, modification or disclosure) and ensure that appropriate protections are in place when personal information is transferred to overseas third parties (including affiliates). The Privacy Commissioner is afforded certain authorities under PIPA and may, for example, investigate any data breaches or review any access requests made by individuals in respect of any of their personal information held by the Bank or its Bermuda subsidiaries. Corporate Income Tax Act 2023 and Corporate Income Tax Agency Act 2024 Under the Corporate Income Tax Agency Act 2024, the Corporate Income Tax Agency (“CIT Agency”) is responsible for the administration of the Corporate Income Tax Act 2023 ("CIT Act"). As described in Item 10.E. "Additional Information - Taxation", the CIT Act became effective on January 1, 2025, Bermuda has enacted a corporate tax regime applicable to the Bermuda entities of multi-national enterprises. While the Bank (and its Bermuda subsidiaries) does not at present satisfy the definition of a “multi-national group” for the purposes of the Bermuda CIT Act due to the level of its consolidated revenues, if, in the future, the consolidated revenues of the Bank were to increase such that it was in scope of the CIT Act, the Bank’s (and its Bermuda subsidiaries’) tax filings would be administered (and subject to audit) by the Bermuda CIT Agency. Regardless of whether or not the Bank (or any of its Bermuda subsidiaries) are in scope of the charge to tax under the CIT Act, the CIT Agency also has broad information gathering powers that apply to any person (including the Bank and its Bermuda based subsidiaries and staff) in so far as the CIT Agency can require the production of such information as the Agency may reasonably require to discharge its functions under the CIT Agency or the CIT Act. The Cayman Islands The Cayman Islands Monetary Authority Our activities in the Cayman Islands are regulated by CIMA. CIMA is responsible for currency management, regulation and supervision of the Cayman Islands financial services sector (which includes securities and investments business, banking, insurance and fiduciary services), advice to the Cayman Islands government and cooperation with overseas regulatory authorities. CIMA's principal focus is to promote and maintain a sound financial system in the Cayman Islands and to promote and enhance market confidence, consumer protection and the reputation of the Cayman Islands as a financial center. CIMA has broad statutory powers of enforcement. These powers are intended to permit CIMA to have access to information held or maintained by a licensee as necessary and to enable CIMA to take appropriate remedial action, including imposition of administrative fines, if a licensee is in default of its obligations under applicable laws. 35 Banks & Trust Companies Act (as revised) The BATCA provides that it is an offense to conduct banking business or trust business without the appropriate license. Butterfield Bank (Cayman) Limited holds a category "A" banking license and a trust license, both issued by CIMA. The BATCA is supplemented by certain regulations which, among other things, prescribe the fees that are payable by licensees and certain information that must be submitted to CIMA in connection with any license application. Licensees must adhere to certain capital adequacy requirements and must file audited financial statements with CIMA within three months of their financial year-end. Prior written approval of CIMA is required in a number of circumstances including, but are not limited to, the issue, transfer or disposal of any shares, the appointment of a new director or senior officer or where the licensee wishes to conduct business that deviates from its business plan submitted at the time of its license application. Effective January 31, 2025, Butterfield Bank (Cayman) Limited was designated as a Domestic Systemically Important Deposit-Taking Institution ("D-SIDTI") and became subject to a 3% surcharge above the minimum regulatory capital requirement as of January 31, 2026. Securities Investment Business Act (as revised) The SIBA (as amended) provides that a person shall not carry on, or purport to carry on, securities investment business in or from the Cayman Islands unless that person is for the time being licensed under SIBA or is exempted from the requirement to hold a license pursuant to SIBA. Butterfield Bank (Cayman) Limited holds a securities investment business license, issued by CIMA, to conduct its business. SIBA is essentially designed to achieve the licensing and regulation of securities investment providers and applies to (i) any company, foreign company or partnership incorporated or registered in the Cayman Islands and carrying on "securities investment business" anywhere in the world, or (ii) any entity which has a "place of business" in the Cayman Islands through which "securities investment business" is carried on. The entity need not have a physical presence in the Cayman Islands in order for such entity to fall within the ambit of SIBA. Certain categories of persons conducting activities that would otherwise fall within the definition of securities investment business are categorized as non-registrable persons under SIBA. Such persons include single family offices who do not advise third parties and managers of non-Cayman limited liability companies who carry on securities investment business only in that capacity. In addition, SIBA requires certain persons who are engaged in securities investment business with, among other things, sophisticated or high net worth persons (as such terms are defined in SIBA) to register as a registered person under SIBA. Upon such registration, a registered person is subject to CIMA regulation, however a number of requirements applicable to SIBA licensees do not apply to SIBA registered persons. For example, a SIBA registered person is not required to submit annual audited financial statements or business plans to CIMA. Insurance Act, 2010 (as revised) CIMA regulates the insurance industry in the Cayman Islands pursuant to the IA (as amended). Such regulation includes licensing, ongoing supervision, and enforcement. Pursuant to the IA, a company is required to hold a license in order to carry on insurance or reinsurance business or business as an insurance agent, insurance broker or insurance manager in or from the Cayman Islands. Butterfield Bank (Cayman) Limited (which is not itself an insurer) holds an insurance agent license, issued by CIMA, permitting it to solicit domestic business on behalf of not more than one general insurer and one long term insurer. Companies Act (as revised) Butterfield Bank (Cayman) Limited is an ordinary resident company incorporated in the Cayman Islands, meaning that, subject to it being licensed under the BATCA, it can carry on business within the Cayman Islands. Butterfield Bank (Cayman) Limited is required to comply with the requirements of the Companies Act (as revised), this being the principal statute governing the incorporation and ongoing operations of the Cayman Islands companies. Anti-Money Laundering Regulations (as revised); Proceeds of Crime Act (as revised, the "PCA"); and Terrorism Act (as revised) Butterfield Bank (Cayman) Limited is subject to the Anti-Money Laundering Regulations (as revised) (the "Regulations") made pursuant to the PCA (as revised). The Regulations apply to anyone conducting "relevant financial business" in or from the Cayman Islands intending to form a business relationship or carry out a one-off transaction. The Regulations require a financial service provider to maintain certain anti-money laundering procedures including those for the purposes of verifying the identity and source of funds of an "applicant for business" except in certain circumstances, including where an entity is regulated by a recognized overseas regulatory authority and/or listed on a recognized stock exchange in an approved jurisdiction. In addition, if any person resident in the Cayman Islands knows or suspects, or has reasonable grounds for knowing or suspecting that another person is engaged in criminal conduct, or is involved with terrorism or terrorist property, and the information for that knowledge or suspicion came to their attention in the course of business in the regulated sector, or other trade, profession, business or employment, the person will be required to report such knowledge or suspicion to (i) the Cayman Islands Financial Reporting Authority (the "FRA"), pursuant to the PCA, if the disclosure relates to criminal conduct or money laundering; or (ii) a police officer of the rank of constable or higher, or the FRA, pursuant to the Terrorism Act (as revised), if the disclosure relates to involvement with terrorism or terrorist financing and property. The Cayman Islands Data Protection Act, (as revised, the "DPA") The DPA came into force on September 30, 2019 and establishes a framework of rights and duties designed to safeguard individuals’ personal data, balanced against the need of public authorities, businesses and organizations to collect and use personal data for legitimate purposes. The DPA was developed in line with international best practices while ensuring that it reflects the specific needs of the Cayman Islands. It is based substantially on the Data Protection Act, 1998 of the United Kingdom. The DPA defines “personal data” very widely to include any data which enables a living individual to be identified. In common with most businesses, Butterfield Bank (Cayman) Limited records information in respect of individuals, particularly those who are employees, clients or suppliers, and the obligations under the DPA require a detailed review or establishment of policies and procedures in order to achieve compliance. Non-compliance with the DPA may have serious ramifications. The DPA is centered on eight data protection principles under which personal data must: •be processed fairly and only when specific conditions are met, including where consent has been given, where there is a legal obligation, or where it is necessary for the performance of a contract to which the data subject is a party. Additional conditions apply in respect of “sensitive personal data” (examples of which include racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, health, sex life and offenses); •be obtained only for one or more specified lawful purposes, and shall not be further processed in any manner incompatible with such purposes; 36 •be adequate, relevant and not excessive in relation to the purpose or purposes for which they are collected or processed; •be accurate and, where necessary, kept up to date; •not be kept for longer than is necessary for the purpose; •be processed in accordance with the rights of individuals as specified under the DPA; •be protected by appropriate technical and organizational measures against unauthorized or unlawful processing, and against accidental loss, destruction or damage; and •not be transferred abroad unless the country or territory to which it is transferred ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data. Under the DPA, individuals have the right to be informed how personal data is processed and Butterfield Bank (Cayman) Limited is required to provide individuals with a privacy notice in this regard. Individuals also have the right (i) to request access to their personal data, (ii) to request rectification or correction of personal data, (iii) to request that processing of personal data be stopped or restricted and (iv) to require Butterfield Bank (Cayman) Limited to cease processing personal data for direct marketing purposes. Individuals who believe that their personal data has been handled incorrectly or are not satisfied with responses from Butterfield Bank (Cayman) Limited to any requests made regarding the use of their personal data have a right under the DPA to complain to the Cayman Islands’ Ombudsman. The Bahamas The Central Bank of The Bahamas Butterfield Trust (Bahamas) Limited has been granted a license from the Central Bank of The Bahamas to conduct trust business from within The Bahamas. As the primary regulator of Butterfield Trust (Bahamas) Limited, the Central Bank of The Bahamas is responsible for the regulation and supervision of Butterfield Trust (Bahamas) Limited with respect to all of its operations, corporate governance issues, and compliance with applicable laws and regulations. The Central Bank of The Bahamas' regulations on capital adequacy and the regulatory framework within The Bahamas take into account the recommendations of the BCBS. The Banks and Trust Companies Regulation Act and Regulations The Banks and Trust Companies Regulation Act and Regulations set forth the basic provisions relating to the licensing and operations of banks and trust companies in The Bahamas, as well as the powers of the Central Bank of The Bahamas to supervise and audit the activities of such entities. As it relates to the preservation of confidentiality, the Banks and Trust Companies Regulation Act makes it an offense for certain individuals to disclose without customer consent, inter alia, the identity, assets, liabilities, transactions or accounts of a customer of a licensee, save for in specified circumstances. Recently the Act was amended to provide further privacy in trust proceedings by mandating that those proceedings are held in private unless the circumstances warrant them being held in public. The Central Bank of The Bahamas Act and Regulations The Central Bank of The Bahamas Act provides general provisions relating to the structure and operation of the Central Bank of The Bahamas, the regulatory reporting required to be submitted to the Central Bank of The Bahamas by the licensees and the penalties that may be imposed for failure to comply with the orders of the Central Bank of The Bahamas. From time to time, the Central Bank issues regulations, guidelines and policies which are available on its website. Financial and Corporate Service Providers Act The Financial and Corporate Service Providers Act provides regulations for the administration and supervision of all licensed financial and corporate service providers in The Bahamas. This Act details the obligations and duties of a licensee under the Act and sets out the supervisory powers of the Securities Commission over its licensees inclusive of penalties and sanctions for non-compliance. Financial Intelligence and Reporting The Financial Intelligence Unit Act provides for the establishment of the financial intelligence unit organization in The Bahamas that is responsible for receiving, analyzing, obtaining and disseminating information which relates to or may relate to the proceeds of offenses under the Proceeds of Crime Act or the Anti-Terrorism Act. The Financial Transactions Reporting (Amended) Act and Regulations provides the basic requirements applicable to financial institutions in The Bahamas with respect to verifying the identities of facility holders and bank customers, the obligation to report suspicious transactions to the financial intelligence unit, and minimum record retention policies and procedures. Data Protection (Privacy of Personal Information) Act This Data Protection (Privacy of Personal Information) Act makes provision for the protection of the privacy of the personal data of individuals and the regulation of its collection, processing, keeping, use and disclosure. Other Relevant Legislation Butterfield Trust (Bahamas) Limited is also subject to various other acts and regulations, including the Proceeds of Crime Act, which sets forth that it is a crime in The Bahamas for a person to conceal, transfer or deal with the proceeds of criminal conduct (such as money laundering) and the Anti-Terrorism Act, which sets forth that it is a crime in The Bahamas for a person to provide or collect funds or provide financial services or make such services available to persons with the intention that such funds or services are to be used in full or in part to carry out a terrorist act. In addition to the laws and regulations set forth above, Butterfield Trust (Bahamas) Limited is also obligated to comply with the guidelines released by the Central Bank of The Bahamas from time to time. Guernsey Guernsey Financial Services Commission Our activities in Guernsey are monitored by the GFSC through its Probability Risk and Impact System. The primary objective of the GFSC is to regulate and supervise financial services businesses in the Bailiwick of Guernsey ("Guernsey" or the "Bailiwick"). Almost all financial service activities in Guernsey are required to be licensed by the GFSC. Once licensed, the businesses are subject to the regulation, oversight, investigatory, information gathering and enforcement powers of the GFSC. 37 The various divisions of the GFSC perform regular visits with the purpose of understanding the business and reviewing the risk management and internal control environment (including monitoring and any outsourced functions). Such visits also monitor compliance with applicable law and regulation. In addition to conducting on-site reviews, the GFSC has a continuing duty to determine whether entities it regulates and the persons who own or run them remain fit and proper. Licensees therefore have a statutory obligation to notify the GFSC of various changes, which are set out in comprehensive rules and regulations. The GFSC also requires financial services businesses to submit periodic returns for statistical analysis and inclusion in thematic studies. The GFSC has wide powers of enforcement to address shortcomings and breaches by financial services businesses. These range from private warnings and reprimands to revocation and suspension of applicable licenses and consents, fines and referral for criminal prosecution, among others. The Banking Supervision (Bailiwick of Guernsey) Law, 2020 The BSL provides that no person in the Bailiwick shall accept a deposit in the course of carrying on, whether in Guernsey or elsewhere, a deposit-taking business except under the authority of and in accordance with the conditions of a license granted by the GFSC. Butterfield Bank (Channel Islands) Limited holds a license under the BSL. In order to be granted a license, a company's business must be carried on with prudence, integrity, professional skills and in a manner which will not tend to bring the Bailiwick into disrepute. The business must also be directed by at least two individuals who are resident in the Bailiwick of Guernsey with appropriate standing and experience and sufficiently independent of each other. Businesses must also adhere to applicable codes, guidance, principles, policies, rules and instructions issued from time to time. The Regulation of Fiduciaries, Administration Businesses and Company Directors, etc. (Bailiwick of Guernsey) Law, 2020 The Regulation of Fiduciaries, Administration Businesses and Company Directors, etc. (Bailiwick of Guernsey) Law 2020 (the "Guernsey Fiduciaries Law") provides that only a person licensed by the GFSC under the Guernsey Fiduciaries Law can carry on in or from within the Bailiwick fiduciary businesses, which includes: •formation, management and administration of trusts; •company or corporate administration; •provision of executorship services; and •the formation, management and administration of foundations. The GFSC can grant three different categories of license, including a primary or secondary fiduciary license, which can only be granted to a company, other legal person or a partnership, and a personal fiduciary license. The primary fiduciary license also covers any director, partner or employee acting in the course of their employment. Secondary license holders must be associated with a designated primary licensee. The Protection of Investors (Bailiwick of Guernsey) Law, 2020 Under the POI (Bailiwick of Guernsey) Law, 2020 (the "POI Law"), a person shall not (subject to certain exemptions) carry on, or hold himself out as carrying on, any controlled investment business in or from within the Bailiwick, except under and in accordance with the terms of a license. For the purposes of the POI Law, a controlled investment includes collective investment schemes and general securities and derivatives. All Guernsey domiciled funds have to be authorized by or registered with the GFSC and be administered by a Guernsey licensed administrator. In addition, open-ended funds must also have a Guernsey-licensed custodian. The Financial Services Commission (Bailiwick of Guernsey) Law, 1987 The Financial Services Commission (Bailiwick of Guernsey) Law, 1987 provides that the general functions of the GFSC are, among other things, to supervise the finance business in the Bailiwick, to counter financial crime and the financing of terrorism and to maintain confidence in the Bailiwick's financial services sector. The Criminal Justice (Proceeds of Crime) (Bailiwick of Guernsey) Law, 1999 The Criminal Justice (Proceeds of Crime) (Bailiwick of Guernsey) Law, 1999 established certain offenses in connection with the proceeds of criminal conduct including concealing or transferring the proceeds of crime, assisting another person to retain the proceeds of criminal conduct, acquisition, possession or use of proceeds of criminal conduct and tipping-off. The Disclosure (Bailiwick of Guernsey) Law, 2007 The Disclosure (Bailiwick of Guernsey) Law, 2007 requires a person to report internally if that person knows or suspects, or has reasonable grounds for knowing or suspecting, that another person is engaged in money laundering or that certain property is or is derived from the proceeds of criminal conduct and the information came to that person in the course of the business of a financial services business. A money laundering reporting officer must be appointed to fulfil this function and to make disclosure to a police officer who is a member of the Financial Intelligence Unit (the "FIU") or a member of the FIU who is not a police officer. The Terrorism and Crime (Bailiwick of Guernsey) Law, 2002 The Terrorism and Crime (Bailiwick of Guernsey) Regulations, 2002 provides for a positive obligation on a person to report internally if that person knows or suspects, or has reasonable grounds for knowing or suspecting, that another person is engaged in terrorist financing or that certain property is or is derived from terrorist property and the information came to that person in the course of the business of a financial services business. A money laundering reporting officer must be appointed to fulfil this function and to make disclosure to the relevant division of Guernsey's police unit or a member of the FIU who is not a police officer. The Guernsey Banking Deposit Compensation Scheme (Bailiwick of Guernsey) Ordinance, 2008 Pursuant to the Banking Deposit Compensation Scheme (Bailiwick of Guernsey) Ordinance, 2008, a Guernsey DCS is in effect in Guernsey. The Guernsey DCS provides compensation of up to £50,000 per qualifying deposit in the event of the failure of a Guernsey-licensed bank. The maximum total amount of compensation is capped at £100 million in any 5 year period. If claims exceed this cap, compensation will be reduced pro rata. The cap also means that compensation in respect of any one bank cannot exceed £100 million. The Guernsey DCS is paid for by Guernsey banks through an annual administration levy and, in the event of a bank failure, a compensation levy. The Data Protection (Bailiwick of Guernsey) Law, 2017 The DPL 2017 came into force on May 25, 2018 to coincide with the enforcement of the EU's General Data Protection Regulation (EU) 2016/679 ("GDPR"). The DPL 2017 updated Guernsey's data protection framework to ensure that Guernsey retained its data protection "adequacy" status with the European Commission. Guernsey also has "adequacy" status under the UK General Data Protection Regulation. 38 The DPL 2017 applies to the processing of personal data and provides rights to data subjects (i.e., individuals) and places obligations on data controllers and processors of personal data including, among other matters, in relation to subject access requests, transfers of personal data and notification of data breaches. The Office of the Data Protection Authority is the independent regulatory authority responsible for the regulatory functions under the DPL 2017, including the ability to levy fines. The Lending, Credit and Finance (Bailiwick of Guernsey) Law, 2022 The LCF Law and the regulatory rules which underpin it came into force on January 1, 2023, with full implementation on July 1, 2023. The primary purpose of the LCF Law is to regulate the credit and finance sector to protect consumers who make use of consumer credit, including individual loans, home finance and credit for the purchase of goods and services. Firms offering or intermediating such services in or from within Guernsey need to be licensed to do so and regulated by the GFSC. Jersey Butterfield Bank (Channel Islands) Limited, Jersey Branch is regulated by the JFSC to carry on deposit-taking business under the Banking Business (Jersey) Law 1991; investment business pursuant to the Financial Services (Jersey) Law 1998; fund services business pursuant to the Financial Services (Jersey) Law 1998; and has notified the JFSC that it is carrying on money service business pursuant to the Financial Services (Jersey) Law 1998. Butterfield's business in the Channel Islands was reorganized in 2024 so that all business, including deposit-taking business (as defined in the Banking Business (Jersey) Law 1991), lending and other banking business, Investment Business, Money Service Business and Fund Services Business (each as defined in the Financial Services (Jersey) Law 1998) formerly carried on in or from within Jersey by Butterfield Bank (Jersey) Limited (together, the "Business") has been transferred to Butterfield Bank (Channel Islands) Limited (previously Butterfield Bank (Guernsey) Limited) acting through it's Jersey branch (Butterfield Bank (Channel Islands) Limited, Jersey Branch) by way of a court sanctioned scheme. The scheme was sanctioned by the Royal Court of Jersey on May 14, 2024 and the transfer of the Business became effective on June 1, 2024. The JFSC uses four key areas in supervising banks which are the development of regulatory requirements in relation to prudential matters, conduct of business and anti-money laundering/countering of terrorist financing/countering of proliferation financing, including by means of laws and codes of practice; on-site examinations and meetings; off-site supervision including the analysis of financial information; and international dialogue and liaison with other regulators involved in the supervision of the broader group. The JFSC has wide powers of enforcement to address shortcomings and breaches by financial services businesses. These range from private warnings and reprimands to revocation and suspension of applicable licenses and consents, civil financial penalties and referral to the Attorney General to consider whether to pursue a criminal prosecution, among others. Financial Services Commission (Jersey) Law 1998 The Financial Services Commission (Jersey) Law 1998 provides that the JFSC is, among other things, responsible for the supervision and development of financial services in or from within Jersey and by Jersey companies, preparing and submitting recommendations for legislation regarding financial services, supervising regulated entities, and administering laws such as the Control of Borrowing (Jersey) Law 1947 and the Companies (Jersey) Law 1991. It also has particular regard to the reduction of risk to the public of financial loss, to protecting and enhancing the reputation and integrity of Jersey, to the best economic interests of Jersey and the need to counter financial crime. Banking Business (Jersey) Law 1991 The BBL provides that no person shall carry on or hold themselves out as carrying on a deposit taking business in or from within Jersey or in any part of the world if they are a Jersey company unless they are registered under the BBL. Butterfield Bank (Channel Islands) Limited, Jersey Branch holds a license under the BBL. In order to be granted a license, the JFSC will consider the integrity, competence and financial standing, amongst other factors of a company's business and that it would be in the best interests of persons who may deposit money that the company should be registered. The business must also have a physical presence in Jersey involving meaningful decision making and management, and be subject to supervision by a relevant supervisory authority. Businesses must adhere to secondary legislation and codes issued from time to time. This law also contains provisions regarding approval of directors, controllers, key persons and managers, and sets out further powers of the JFSC. Financial Services (Jersey) Law 1998 This law regulates investment, trust company, general insurance mediation, money service, fund services and alternative investment fund services business. It includes requirements to register if carrying on regulated business, provisions for the supervision of financial services (including requirements to notify of changes to principal persons, key persons and shareholders), and gives the JFSC powers to issue directions and public statements, request information, and issue further orders and regulations. It also sets out the offenses of market manipulation, misleading information and insider dealing. Collective Investment Funds (Jersey) Law 1988 Under the Collective Investment Funds (Jersey) Law, a person shall not (subject to certain exemptions) be or hold himself out as being a functionary of a recognized fund in or from within Jersey, except under a permit. For the purposes of this law, a recognized fund is a type of collective investment fund subject to additional regulations. Any person carrying on the business of an unclassified fund must also hold a certificate. This law also contains provisions regarding notification of principal persons, key persons and shareholders, and sets out further powers of the JFSC. Bank (Recovery and Resolution) (Jersey) Law 2017 The Bank (Recovery and Resolution) (Jersey) Law 2017 came into force in 2022. Butterfield Bank (Channel Islands) Limited, Jersey Branch is therefore now subject to the recovery and resolution powers, as well as investigatory powers, exercisable by the Jersey Resolution Authority. Butterfield Bank (Channel Islands) Limited, Jersey branch is, potentially to a limited extent, subject to the bank winding up procedure set out in this Law. This Law notes that where a bank is a branch of a foreign bank, the provisions of the law for the bank's home jurisdiction with respect to the ranking provided for the claims of ordinary creditors may, where notice is given by the Jersey Resolution Authority of its consent, apply to the resolution of that bank. The Law also contains provisions for the recognition (or refusal) of foreign resolution actions. 39 Proceeds of Crime (Jersey) Law 1999 and Terrorism (Jersey) Law 2002 The Proceeds of Crime (Jersey) Law 1999 established certain offenses in connection with the proceeds of criminal conduct including acquiring, using or having possession or control of criminal property, concealing, disguising, converting, transferring or removing such criminal property from Jersey, and tipping off and interference with material that is likely to be relevant to an investigation. The Terrorism (Jersey) Law 2002 contains similar offenses regarding using, possessing, providing, collecting or receiving property for the purposes of terrorism, and otherwise dealing with terrorist property. Both the Proceeds of Crime (Jersey) Law 1999 and the Terrorism (Jersey) Law 2002 provide for a positive obligation on businesses to report any suspicions of money laundering or terrorist financing to the Jersey Financial Intelligence Unit and create offenses for "tipping off" third parties in relation to such reports. The Proceeds of Crime (Jersey) Law 1999 was also amended in 2022 to introduce an offense of failing to prevent money laundering by employees, agents, service providers or customers, as a result of failing to maintain and apply adequate prevention procedures. Butterfield Bank (Channel Islands) Limited, Jersey Branch, is also required by the Money Laundering (Jersey) Order 2008 and the JFSC's AML/CFT/CPF Handbook, to maintain policies and procedures to prevent and detect money laundering, including customer due diligence measures, record-keeping, screening of employees, internal control, risk assessment and management and the monitoring and management of compliance with such policies and procedures. Butterfield Bank (Channel Islands) Limited, Jersey Branch, is subject to the supervisory and enforcement powers of the JFSC in relation to such matters. Depositors Compensation Scheme, 2009 Pursuant to the Banking Business (Depositors Compensation) (Jersey) Regulations 2009, the Jersey Bank DCS ("Jersey DCS") is in effect in Jersey. The law covers all "eligible deposits" and, in the event of the failure of a Jersey bank, provides protection of up to £50,000 for deposits placed in Jersey per person, per banking group, for local and international depositors. The maximum liability of the Jersey DCS is capped at £100 million in any 5 year period. Data Protection (Jersey) Law, 2018 / Data Protection Authority (Jersey) Law, 2018 The DPJL, and its companion statute the DPAJL, came into force on May 25, 2018 to coincide with implementation of the GDPR. The DPJL updated Jersey's data protection framework expressly to mirror the GDPR and ensure that Jersey retained its data protection "adequacy" status with the European Commission. Jersey also has "adequacy" status under the UK General Data Protection Regulation. In outline, the DPJL governs the processing of personal data in Jersey or in relation to Jersey residents; it provides rights to data subjects (i.e. individuals) and places obligations on data controllers and processors of personal data including, among other matters, in relation to subject access requests, transfers of personal data and notification of data breaches. The DPAJL requires any organization which is "established" in Jersey to be registered with the JOIC and to pay an annual charge. The JOIC is the independent authority responsible for the regulatory and enforcement functions of the DPJL and DPAJL, including the ability to levy fines. United Kingdom Regulatory Regime Butterfield Mortgages Limited provides UK residential property lending services. The primary legislation governing the provision of Butterfield Mortgages Limited's services is the FSMA and its secondary regulations. FSMA requires that in order to carry on mortgage and investment services in the UK, a firm must be authorized (or exempt) and have the necessary permissions. Butterfield Mortgages Limited is authorized and has permissions to enter into, advise on and administer regulated mortgage contracts. Because its permissions are limited to mortgage activities, Butterfield Mortgages Limited is regulated by the FCA. The FCA has responsibility for both prudential and conduct of business regulation of Butterfield Mortgages Limited. Butterfield Mortgages Limited must comply with the FCA handbook which contains detailed rules and guidance in respect of governance and conduct matters. The FCA's Principles for Business require, among other things, that Butterfield Mortgages Limited conducts its business with integrity and due skill, care and diligence, to a consumer duty standard which ensures an appropriate level of protection for retail customers and deals with its regulators in an open and cooperative way. In addition, certain persons occupying senior management functions and certifications at Butterfield Mortgages Limited are subject to statements of principle and a code of practice that describes behaviors expected of persons operating in the regulated sector. Butterfield Mortgages Limited is subject to and has implemented the FCA's Senior Management and Certification Regime, the purpose of which is to increase individual accountability of senior management under the UK regulatory system. Control FSMA requires any person seeking to obtain (and in certain circumstances increase) control over Butterfield Mortgages Limited to first get approval from the FCA. A person will become a controller if it holds (itself or with another where they are acting together) (i) 20% or more of the shares of Butterfield Mortgages Limited or in any parent undertaking; or (ii) 20% or more of the voting power in Butterfield Mortgages Limited or any parent. The Companies Act 2006 requires that UK incorporated companies maintain a register of persons who have significant control over them. A person will be considered to have significant control if it holds (itself or with another where they are acting together) 25% or more of the company's shares or voting rights or has the ability to appoint a majority of the board of directors. Capital Butterfield Mortgages Limited is subject to capital rules under the FCA's Prudential sourcebook for MIPRU. The MIPRU capital rules stipulate the minimum level and quality of capital that must be maintained to support the activities carried on. AML and Financial Crime Butterfield Mortgages Limited is subject to a range of legislation at a UK level requiring it to take steps to detect and prevent potential money laundering, financial crime, terrorist financing or proliferation financing. The FCA and law enforcement have investigatory powers in relation to suspected breaches. 40 The principal UK anti-money laundering legislation applicable to the regulated activities of Butterfield Mortgages Limited is the MLRs 2017 from June 26, 2017. The MLRs 2017 prescribed obligations in relation to KYC information and assessment as well as ongoing monitoring obligations. Further, Butterfield Mortgages Limited must comply with its obligations under the Proceeds of Crime Act 2002, the Terrorism Act 2000, the Anti-terrorism, Crime and Security Act 2001, the Counter-Terrorism Act 2008 (Schedule 7), the Sanctions and Anti-Money Laundering Act 2018, the UK Bribery Act 2010, the Economic Crime and Corporate Transparency Act 2023, certain specific obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and certain specific obligations in FSMA and the requisite sourcebooks within the FCA Handbook. Together, this legislation requires regulated firms to create a robust system and controls framework and appropriate and risk-sensitive policies and procedures in relation to customer due diligence and monitoring of transactions, to avoid financing terrorism or money laundering or facilitating either of these, and to avoid dealing with certain persons specified by HM Treasury, and to disclose suspicious activity to the relevant regulatory authorities. Butterfield Mortgages Limited, as a wholly-owned subsidiary of the Bank of N.T. Butterfield & Son Limited, must also comply with legislation of third countries to the extent that such legislation has extra-territorial effect and is applicable to it. Examples of this are the US PATRIOT Act of 2001, the FATCA of 2010, and the Sarbanes-Oxley Act 2002. UK Data Protection Law The DPA 2018 came into force on May 25, 2018 and supplemented and tailored the EU GDPR to the UK legal framework. Following the UK leaving the EU on January 31, 2020, the EU GDPR was amended and incorporated into the UK’s domestic law by the European Union (Withdrawal) Act 2018, as further amended by the European Union (Withdrawal Agreement) Act 2020 (that makes legal provision for ratifying the Brexit Withdrawal Agreement of January 24, 2020 and implementing it into the domestic law of the United Kingdom as the UK GDPR). It sits alongside an amended version of the DPA 2018, and the Data (Use and Access) Act 2025, which further amends and supplements the UK GDPR. Butterfield Mortgages Limited is required to have in place compliant policies, procedures, risk assessments and other records, and contracts to meet the UK GDPR (as amended and supplemented) obligations to deal with personal data appropriately. Additionally, there are still implications under the EU GDPR on UK controllers who broadly, have customers in the EEA or monitor individuals in the EEA as the EU GDPR applies to this processing. Breaches of the legislation included are criminal offenses and can result in severe penalties. The Information Commissioner’s Office has regulatory and disciplinary powers and a breach of the UK data protection law can give rise to financial penalties based on a percentage of annual turnover, alongside other enforcement options like mandatory audits or changes to personal data processing. Switzerland Financial Institutions Act FinIA and FinIO set forth the basic provisions relating to the licensing in Switzerland of financial institutions, which includes trustees and (collective) asset managers but excludes banks and insurance companies as they are already subject to specific legislation. Pursuant to FinIA, Swiss trustees acting on a professional basis in Switzerland or from Switzerland, must obtain a license from the FINMA to carry on their trustee activities. A Swiss branch or a Swiss representative office of a foreign trustee must also obtain a license from FINMA. FINMA is responsible for granting the license and for taking any enforcement actions. In order to obtain a license from FINMA, a trustee will first need to affiliate to a Supervisory Organization, which is licensed and supervised by FINMA. The Supervisory Organization will conduct the day-to-day supervision and perform regular audits of the affiliated trustees. In order to obtain a license, the applicant must further, inter alia, comply with minimum capital requirements, have an appropriate level of own funds, an appropriate organization, qualified executives and generally meet a "fit and proper" requirement. In accordance with the obligations for existing trustees under FinIA, Butterfield Trust (Switzerland) Ltd complies with the licensing requirements as set forth under FinIA, is affiliated to a Supervisory Organization (see below under Swiss Anti-Money Laundering Act) and was granted a Trustee license by FINMA on January 15, 2024. Swiss Anti-Money Laundering Act The AMLA and the related implementing ordinances apply to financial intermediaries, which include trustees. It governs the combating of money laundering and terrorist financing. It ensures the exercise of due diligence by the financial institutions in the conduct of financial transactions. Pursuant to AMLA, financial institutions must affiliate to a recognized Self-Regulatory Organisation or a recognized Supervisory Organisation (see above under Financial Institutions Act) which shall supervise compliance by financial intermediaries of their duties set out in AMLA. Butterfield Trust (Switzerland) Ltd must comply with its obligations under AMLA and is currently affiliated to SO-FIT, a Supervisory Organisation licensed and supervised by FINMA. Swiss Data Protection Act On September 1, 2023, the revised Federal Act on Data Protection 2020 ('FADP', or 'DPA and the DPO') entered into force. The revision responds to technological advancements, aligns Swiss data protection law with international data protection standards, including the GDPR, to allow Switzerland to uphold its status as a country adequately protecting personal data from an EU perspective. The DPA and DPO aim to protect the privacy and the fundamental rights of persons when their data is processed. The DPA and DPO provide for several requirements and limits with respect to data processing in Switzerland as well as the transfer of data outside Switzerland. The data protection legislation applies to any private entity processing data related to individuals ("data subjects"). Data processing is defined as any handling of personal data, irrespective of the means and procedures used, in particular the collection, storage, keeping, use, modification, disclosure, archiving or destruction of data. The DPA and DPO impose a series of duties on the so-called controller of the processing of personal data, i.e. the person who defines the purpose and controls the content of the collected personal data. The activities of Butterfield Trust (Switzerland) Ltd imply the processing of personal data of various data subjects. As a result, it is to comply with the provisions of the DPA when processing personal data. The general principles of the Swiss data protection legislation include the obligations to process personal data lawfully, and to ensure that the processing is carried out in good faith and to be proportionate. Further, personal data may only be collected for a specific purpose that the data subject can recognize and must be destroyed or anonymized as soon as they are no longer required. The controller must also arrange the data processing in technical and organizational terms so that the principles as set forth in the DPA and DPO are respected. In particular, the controller must guarantee a level of data security appropriate to the risk of accidental destruction, loss, theft and any other unauthorized use, by taking suitable technical and organizational measures. Under the DPA, the data subjects have a right of access to their personal data if they request so and have the opportunity to request the correction of the personal data that is inaccurate. A data subject may also request the controller to deliver the personal data in an electronic format. Finally, the revised DPO now appends a list of countries providing for adequate data protection legislation for cross-border transfer purposes. Switzerland also has “adequacy” status under the EU GDPR and the UK GDPR, respectively. 41 Singapore Butterfield Trust (Asia) Limited holds a trust business license issued by the MAS pursuant to the TCA. As the integrated financial services regulatory authority in Singapore, the MAS administers (among other financial services related statutes) the TCA and regulates and supervises (among other types of financial institutions) trust business license holders (such as Butterfield Trust (Asia) Limited) in accordance with the TCA and all related subsidiary legislation, notices, guidelines and other regulatory instruments issued by the MAS ("MAS Instruments"). These MAS Instruments cover a wide range of ongoing obligations relating to, inter alia, capital adequacy, audit, conduct of business, confidentiality, anti-money laundering and countering of terrorist financing and also impose approval and/or notification requirements in respect of controllers, directors and key officers. Under the TCA, the MAS is empowered to conduct inspections and/or investigations of Butterfield Trust (Asia) Limited to ensure that it is in compliance with requirements contained in the MAS Instruments. Where there is a breach, the MAS may pursue a wide range of enforcement sanctions, including private warnings, private or public reprimands, composition offers (i.e., allowing the offense to be compounded by payment of a fine), prohibition orders, suspension or revocation of licenses, civil penalties and criminal prosecution. United States Foreign Account Tax Compliance Act Under FATCA, US federal tax legislation, a 30% withholding tax will be imposed on "withholdable payments" made to non-US financial institutions (including non-US investment funds and certain other non-US financial entities) that fail (or, in some cases, that have 50% affiliates which are also non-US financial institutions that fail) to provide certain information regarding their US accountholders and/or certain US investors (such US accountholders and US investors, "US accountholders") to the IRS. For non-US financial institutions that fail to comply, this withholding will generally apply without regard to whether the beneficial owner of a withholdable payment is a US person or would otherwise be entitled to an exemption from US federal withholding tax. "Withholdable payments" generally include, among other items, payments of US-source interest and dividends. Furthermore, FATCA may also impose withholding on non-US source payments by non-US financial institutions that comply with FATCA to non-US financial institutions that fail to comply with FATCA. However, under proposed Treasury regulations, such withholding will not apply to payments made before the date that is two years after the date on which final regulations defining the term "foreign pass thru payment" are published. In general, non-publicly traded debt and equity interests in investment vehicles will be treated as "accounts" and be subject to these reporting requirements. In addition, certain insurance policies and annuities are considered accounts for these purposes. Some countries, including Bermuda, the Cayman Islands, Channel Islands, the UK, Singapore, Switzerland and The Bahamas, have entered into, and other countries are expected to enter into, intergovernmental agreements ("IGAs") with the United States to facilitate the type of information reporting required under FATCA. While the existence of IGAs will not eliminate the risk of the withholding described above, these agreements are expected to reduce that risk for financial institutions and investors in countries that have entered into IGAs. IGAs will often require financial institutions in those countries to report some information on their US accountholders to the taxing authorities of those countries, which will then pass the information to the IRS. The Group has taken all the steps it believes are necessary to comply with current FATCA regulations, including analysis of its group entities and conclusions as to their FATCA classifications, entering into agreements with the US tax authorities (as necessary), identification of reportable accounts, and timely and accurate filing of all required annual FATCA filings, all in accordance with the appropriate IGA. Certain payments to the Group may be subject to withholding under FATCA if, in the future, the Group cannot enter into such agreements or satisfy the requirements thereunder (including as a result of local laws in non-IGA countries prohibiting information-sharing with the IRS, as a result of contracts or local laws prohibiting withholding on certain payments to account holders, policyholders, annuitants or other investors, or as a result of the failure of account holders, policyholders, annuitants or other investors to provide requested information). The possibility of such withholding and the need for US account holders, policyholders, annuitants and investors to provide certain information may adversely affect the sales of certain of the Group's products. In addition, entering into agreements with the IRS and compliance with the terms of such agreements and with FATCA and any regulations or other guidance promulgated thereunder or any legislation promulgated under an IGA may substantially increase the Group's compliance costs. Office of Foreign Assets Control Regulation The US Treasury Department's Office of Foreign Assets Control ("OFAC"), administers and enforces economic and trade sanctions against targeted foreign countries and regimes, under authority of various laws, including designated foreign countries, nationals and others. OFAC publishes lists of specially designated targets and countries. OFAC sanctions apply to all transactions that take place in the United States. Transactions that take place outside the United States may become subject to the jurisdiction of the United States and subject to compliance with OFAC sanctions if they involve US persons or payment in US dollars. Such payments typically are cleared through the US Dollar settlement system located in the United States and involve the intermediation of US financial institutions. Although we currently do not have any operations in the United States, our operations may involve transactions with US persons or in US Dollars and as a result, in order to comply with OFAC sanctions, we are responsible for, among other things, blocking any such transactions with designated targets and countries and reporting blocked transactions after their occurrence. Failure to comply with these sanctions could have serious legal and reputational consequences, including the imposition of civil money penalties or causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required. Anti-Money Laundering and the US PATRIOT Act A major focus of worldwide governmental policy on financial institutions in recent years has been aimed at combating money laundering and terrorist financing. In particular, United States anti-money laundering laws and regulations including the US PATRIOT Act of 2001, and the Anti-Money Laundering Act of 2020 ("2020 AMLA"), applicable to non-US banks with operations in the United States, including banks that engage in transactions outside the United States with US persons or in US Dollars, such as the Bank, impose significant compliance and due diligence obligations. Under these laws and regulations, financial institutions are prohibited from entering into specified financial transactions and account relationships and must use enhanced due diligence procedures in their dealings with certain types of high-risk customers and implement a written customer identification program. Financial institutions must also take certain steps to assist government agencies in detecting and preventing money laundering and report certain types of suspicious transactions. Regulatory authorities routinely examine financial institutions for compliance with these obligations, and failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal and reputational consequences for the institution, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required. Institutions that violate these obligations can be subject to cease and desist orders, civil money penalties and criminal sanctions. Moreover, the 2020 AMLA requires the U.S. Treasury Department to issue National Anti-Money Laundering and Countering the Financing of Terrorism Priorities, conduct studies and issue regulations that may, over the next few years, significantly alter some of the due diligence, recordkeeping and reporting requirements that may be imposed on financial institutions. The 2020 AMLA also expands the US Department of Justice’s subpoena authority with respect to any foreign bank that maintains a 42 correspondent account in the US, increases penalties for violations of US anti-money laundering laws and significantly expands a whistleblower award program, which could increase the prospect of regulatory enforcement. Many of the statutory provisions in the 2020 AMLA will require additional rulemakings, reports and other measures, and the impact of the 2020 AMLA will depend on, among other things, rulemaking and implementation guidance. In June 2021, the Financial Crimes Enforcement Network of the US Treasury Department issued the required priorities, which include: corruption, cybercrime, terrorist financing, fraud, transnational crime, drug trafficking, human trafficking and proliferation financing. Future Legislation and Regulation The above jurisdictions and the other jurisdictions in which we operate may enact legislation from time to time that affects the regulation of the financial services industry or that affect the regulation of financial institutions chartered by or operating in those jurisdictions. These governments and their regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. For example, see Item 3.D “Risk Factors – Regulatory and Tax-Related Risks – We operate in a complex and changing regulatory environment and legal and regulatory changes or our failure to comply with laws and regulations could have a negative impact on our business, financial condition or results of operations“ and Item 3.D “Risk Factors – Risks Relating to Our Strategy, Brand, Portfolio and Other Aspects of Our Business – Requirements and expectations from our regulators and other stakeholders on sustainability, environmental, social and governance issues could significantly impact our business”. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of the proposed legislation could impact the regulatory structure under which we operate and may significantly increase our costs, impede the efficiency of our internal business processes, require us to increase our regulatory capital and modify our business strategy, and limit our ability to pursue business opportunities in an efficient manner. Our business, financial condition, results of operations or prospects may be adversely affected, perhaps materially, as a result. Additional Information The Butterfield Act and our current amended and restated bye-laws have been filed as exhibits to this annual report on Form 20-F. The information contained in these exhibits is incorporated by reference herein. Information regarding the rights, preferences and restrictions attaching to each class of our common and preferred shares, as well as other information regarding director and shareholder rights and proceedings, is described in the section entitled "Description of Share Capital" in our registration statement on Form F-1 filed with the SEC on February 12, 2017 with the file number 333-216018 and incorporated by reference herein. C.Organizational Structure Refer to Item 4.B. "Business Overview". D.Property, Plants and Equipment Our corporate headquarters is located at 65 Front Street, Hamilton HM 12, Bermuda. In addition to our corporate headquarters we also maintain offices in the Cayman Islands, Guernsey, Jersey (a branch of the Channel Islands), the UK, The Bahamas, Switzerland, Singapore, Mauritius and Canada. Additionally, we operate three branch locations in Bermuda and three branch locations in the Cayman Islands. Premises are owned in Bermuda and the Cayman Islands, with the remainder being held under commercial leases. E.Selected Statistical Data The following tables present select statistical information as required by subpart 1400 of Regulation S-K. Distribution of Assets, Liabilities and Shareholders' Equity; Interest Rates and Interest Differential Average Balance Sheet and Interest Rates The following table presents average consolidated balance sheets and net interest income for the years indicated: 43 For the year ended December 31 2025 2024 2023 (in millions of $) Average balance Interest income (expense) Average yield/ rate Average balance Interest income (expense) Average yield/ rate Average balance Interest income (expense) Average yield/ rate Assets Cash and cash equivalents — Interest bearing 1,674.8 61.6 3.68 % 2,027.6 86.6 4.26 % 1,704.1 67.3 3.95 % Securities purchased under agreements to resell 1,049.0 43.2 4.12 % 546.0 27.5 5.03 % 81.7 4.6 5.62 % Short-term investments 830.4 26.3 3.17 % 831.6 42.9 5.14 % 862.9 40.3 4.67 % Available-for-sale 2,406.8 77.9 3.23 % 1,910.9 48.9 2.55 % 1,925.3 35.6 1.85 % Held-to-maturity 3,124.9 70.7 2.26 % 3,357.4 75.6 2.25 % 3,604.8 80.5 2.23 % Investment in securities(1) 5,531.7 148.6 2.69 % 5,268.3 124.5 2.36 % 5,530.1 116.1 2.10 % Commercial loans 1,256.6 80.3 6.39 % 1,336.3 88.3 6.59 % 1,393.9 93.1 6.68 % Consumer loans 3,203.5 197.1 6.15 % 3,276.6 215.8 6.57 % 3,519.8 224.2 6.37 % Total loans, net of allowance for credit losses(2) 4,460.0 277.4 6.22 % 4,612.9 304.1 6.57 % 4,913.7 317.4 6.46 % Interest-earning assets 13,546.0 557.1 4.11 % 13,286.4 585.7 4.40 % 13,092.5 545.6 4.17 % Other assets 434.6 423.5 409.1 Total assets 13,980.6 13,709.9 13,501.5 Liabilities Deposits 10,011.7 (189.1) (1.89) % 9,785.9 (227.0) (2.31) % 9,410.9 (170.5) (1.81) % Securities sold under agreements to repurchase 4.8 (0.2) (4.56) % 46.8 (2.0) (4.32) % 1.4 (0.1) (5.59) % Long-term debt 44.1 (3.7) (8.34) % 98.6 (5.5) (5.55) % 129.2 (8.1) (6.26) % Interest bearing liabilities 10,060.7 (193.0) (1.92) % 9,931.3 (234.5) (2.35) % 9,541.4 (178.7) (1.87) % Non-interest bearing current accounts 2,621.9 2,577.9 2,803.6 Other liabilities 246.6 247.2 248.2 Total liabilities 12,929.1 12,756.4 12,593.2 Shareholders' equity 1,051.5 953.5 908.3 Total liabilities and shareholders' equity 13,980.6 13,709.9 13,501.5 Non-interest bearing funds net of non-interest-earning assets (free balance) 3,485.3 3,355.1 3,551.1 Net interest margin 364.1 2.69 % 351.2 2.64 % 367.0 2.80 % Net interest spread 2.49 % 2.43 % 2.62 % Ratio of average interest earning asset/ interest bearing liabilities 134.6 % 133.8 % 137.2 % ______________________________ (1)Yields are based on average historical costs and yields on securities held in income tax exempt jurisdictions are not computed on a tax-equivalent yield basis. (2)Interest income and rates on loans include loan fees (2025: $4.3 million; 2024: $5.1 million and 2023: $5.1 million). Additionally, average non-accrual loans were included in the average loan balances used to determine the average yield on loans in all of the periods presented. Interest income on non-accrual loans is recognized only to the extent it is received in cash. See "Note 2: Significant accounting policies" of our audited consolidated financial statements for further information. 44 Analysis of Changes in Volume and Rate on Interest Income and Interest Expense The following table presents the amount of changes in interest income and interest expense from December 31, 2024 to December 31, 2025 and from December 31, 2023 to December 31, 2024, due to changes in both average volume and average rate. Changes not solely due to volume or rate have been allocated to volume. 2025 compared to 2024 2024 compared to 2023 (in millions of $) Increase/ (Decrease) due to Changes in Net Increase/ (Decrease) Increase/ (Decrease) due to Changes in Net Increase/ (Decrease) Volume Rate Volume Rate Interest income related to: Cash and cash equivalents — Interest bearing (13.19) (11.81) (25.00) 14.02 5.36 19.38 Securities purchased under agreements to resell 20.67 (4.98) 15.69 23.43 (0.48) 22.95 Short-term investments (0.11) (16.47) (16.58) (1.49) 4.09 2.60 Available-for-sale 15.87 13.09 28.96 (0.23) 13.53 13.30 Held-to-maturity (5.47) 0.55 (4.92) (5.35) 0.46 (4.89) Total investment in securities(1) 10.40 13.64 24.04 (5.58) 13.99 8.41 Commercial loans (5.33) (2.68) (8.01) (3.56) (1.30) (4.86) Consumer loans (5.05) (13.69) (18.74) (15.38) 6.99 (8.39) Total loans, net of allowance for credit losses(2) (10.38) (16.37) (26.75) (18.94) 5.69 (13.25) Total interest-earning assets 7.39 (35.99) (28.60) 11.44 28.65 40.09 Interest expenses related to: Deposits (3.76) 41.63 37.87 (9.30) (47.20) (56.50) Securities sold under agreements to repurchase 1.92 (0.11) 1.81 (1.97) 0.02 (1.95) Long-term debt 4.57 (2.76) 1.81 1.68 0.93 2.61 Total interest bearing liabilities 2.73 38.76 41.49 (9.59) (46.25) (55.84) Change in net interest income 10.12 2.77 12.89 1.85 (17.60) (15.75) ______________________________ (1)Yields are based on average historical costs and yields on securities held in income tax exempt jurisdictions are not computed on a tax-equivalent yield basis. (2)Interest income and rates on loans include loan fees (2025: $4.3 million; 2024: $5.1 million and 2023: $5.1 million). Additionally, average non-accrual loans were included in the average loan balances used to determine the average yield on loans in all of the periods presented. Investment Portfolio The following table presents an analysis of the weighted average yields for interest bearing debt securities as at December 31, 2025: Remaining term to maturity Within 1 year 1 to 5 years After 5 through 10 years After 10 years No specific or single maturity Total Available-for-sale (measured at fair value) US government and federal agencies 2.1 % 3.3 % — % — % 3.7 % 3.2 % Residential mortgage-backed securities — % — % — % — % 3.3 % 3.3 % Weighted average yield(1) 2.1 % 3.3 % — % — % 3.7 % 3.2 % Held-to-maturity (measured at amortized cost) US government and federal agencies — % — % — % — % 2.5 % 2.5 % Weighted average yield(1) — % — % — % — % 2.5 % 2.5 % Total Weighted average yield(1) 2.1 % 3.3 % — % — % 2.9 % 2.9 % ___________ (1)Yields are based on average historical costs and yields on securities held in income tax exempt jurisdictions are not computed on a tax-equivalent yield basis. 45 Loan Portfolio Maturity Profile of the Loan Portfolio The following table presents certain items in our loan portfolio by contractual maturity as at December 31, 2025: Remaining term to average contractual maturity (in millions of $) Within 1 year 1 to 5 years After 5 years through 15 years After 15 years No specific maturity(1) Total Commercial loans Government 61.8 5.7 209.3 — — 276.8 Commercial and industrial 80.2 99.3 16.5 1.6 — 197.6 Commercial overdrafts 63.7 — — — — 63.7 Total Commercial loans 205.7 105.0 225.8 1.6 — 538.1 Commercial real estate loans Commercial mortgage 12.5 143.4 328.7 2.9 — 487.5 Construction 71.5 6.1 — — — 77.6 Total Commercial real estate loans 84.0 149.5 328.7 2.9 — 565.1 Consumer loans Automobile financing 1.0 14.9 3.2 — — 19.1 Credit card 99.1 — — — — 99.1 Overdrafts 35.1 — — — — 35.1 Other consumer 6.5 13.4 11.1 11.3 — 42.3 Total Consumer loans 141.7 28.3 14.3 11.3 — 195.6 Total Residential mortgages 458.8 887.2 790.4 975.6 — 3,112.0 Non-interest bearing items without a contractual maturity(1) — — — — (3.0) (3.0) Total 890.2 1,170.0 1,359.2 991.4 (3.0) 4,407.8 The following table presents our loan portfolio by maturity and type of interest as at December 31, 2025: Remaining term to average contractual maturity (in millions of $) Within 1 year 1 to 5 years After 5 years through 15 years After 15 years No specific maturity(1) Total Loans with fixed interest rates: Commercial loans 5.0 6.6 217.2 — — 228.8 Commercial real estate loans 1.3 68.0 162.7 2.3 — 234.3 Consumer loans 0.4 2.1 2.2 7.2 — 11.9 Residential mortgages 129.5 367.8 349.6 617.0 — 1,463.9 Total Loans with fixed interest rates 136.2 444.5 731.7 626.5 — 1,938.9 Loans with floating or adjustable interest rates: Commercial loans 200.7 98.4 8.6 1.6 — 309.3 Commercial real estate loans 82.7 81.5 166.0 0.6 — 330.8 Consumer loans 141.3 26.2 12.1 4.1 — 183.7 Residential mortgages 329.3 519.4 440.8 358.6 — 1,648.1 Total loans with floating or adjustable interest rates 754.0 725.5 627.5 364.9 — 2,471.9 Non-interest bearing items without a contractual maturity(1) — — — — (3.0) (3.0) Total loans 890.2 1,170.0 1,359.2 991.4 (3.0) 4,407.8 (1)Included here are items without a contractual maturity such as deferred loans fees and fair value adjustments. 46 Credit Ratios The following table presents our credit ratios for the years indicated: For the year ended December 31 (in millions of $) 2025 2024 2023 Allowance for credit losses to total loans outstanding: Allowance for credit losses 25.4 25.7 25.8 Total loans outstanding 4,407.8 4,499.3 4,771.6 0.6 % 0.6 % 0.5 % Non-accrual loans to total loans outstanding: Non-accrual loans 91.3 76.7 61.0 Total loans outstanding 4,407.8 4,499.3 4,771.6 2.1 % 1.7 % 1.3 % Allowance for credit losses to non-accrual loans: Allowance for credit losses 25.4 25.7 25.8 Non-accrual loans 91.3 76.7 61.0 27.8 % 33.5 % 42.2 % Net charge-offs (recoveries) during the period to average loans outstanding: Commercial loans Net charge-offs (recoveries) during the period 0.6 0.5 1.5 Average amount outstanding 601.3 650.5 678.7 0.09 % 0.07 % 0.22 % Commercial real estate loans Net charge-offs (recoveries) during the period 0.1 0.4 0.0 Average amount outstanding 582.9 603.6 608.2 0.01 % 0.06 % — % Consumer loans Net charge-offs (recoveries) during the period -0.0 0.8 0.8 Average amount outstanding 189.1 191.9 188.0 (0.01) % 0.40 % 0.43 % Residential Mortgages Net charge-offs (recoveries) during the period 0.0 0.3 1.5 Average amount outstanding 3,138.7 3,167.1 3,431.1 — % 0.01 % 0.04 % Total loans Net charge-offs (recoveries) during the period 0.6 1.9 3.8 Average amount outstanding 4,460.0 4,612.9 4,913.7 0.01 % 0.04 % 0.08 % Allowance for credit losses to loans outstanding remained flat at 0.6% in 2025 compared to 2024. Non-accrual loans to total loan outstanding ratio increased to 2.1% in 2025 from 1.7% in 2024 driven by a residential mortgage facility in the Channel Islands and UK segment and partially offset by the settlement of a commercial real estate loan facility in Bermuda. Allowance for credit losses to non-accrual loans decreased to 27.8% in 2025 from 33.5% in 2024 due to the abovementioned net increase in non-accrual loans. Net charge-off (recoveries) ratio decreased from 0.04% in 2024 to 0.01% in 2025 which remains at a negligible level as a percentage of total gross loans. 47 Allocation of the Allowance for Credit Losses December 31, 2025 (in millions of $) Amount Percent of loans in each category to total loans Balance at End of Period Applicable to: Commercial 12.4 12 % Commercial real estate 1.1 13 % Consumer 3.4 4 % Residential Mortgage 8.5 71 % 25.4 100 % See "Note 6: Loans" to our audited consolidated financial statements as at December 31, 2025 for the breakdown of allowance for credit losses by each loan category. Deposits The following table presents our deposits by category for the years indicated: For the year ended December 31 2025 2024 2023 (in millions of $) Averagebalance Averagerate Average balance Average rate Average balance Average rate Interest bearing deposits Bermuda Demand 1,990.1 0.38 % 1,926.3 0.16 % 1,936.2 0.23 % Term 954.0 3.23 % 1,019.2 3.90 % 771.0 3.10 % Total Bermuda 2,944.1 2,945.5 2,707.2 Non-Bermuda Demand 3,979.6 1.07 % 3,689.7 1.12 % 4,062.8 0.80 % Term 3,088.0 3.51 % 3,150.8 4.37 % 2,640.8 4.15 % Non-Bermuda 7,067.6 6,840.5 6,703.6 Total interest bearing deposits 10,011.7 9,786.0 9,410.8 Non-interest bearing demand deposits Bermuda 1,616.4 1,619.1 1,730.2 Non-Bermuda 1,005.5 958.8 1,073.4 Total non-interest bearing deposits 2,621.9 2,577.9 2,803.6 The following table presents the amount of uninsured deposits by reportable segment: As at December 31 (in millions of $) 2025 2024 Bermuda(1) 4,231.1 4,540.6 Cayman(2) 4,065.8 3,971.1 Channel Islands and the UK(3)(4) 3,922.7 3,797.7 12,219.6 12,309.4 ___________________________ (1)The Bermuda Deposit Insurance Scheme covers only BMD deposits up to a maximum of $25,000 per group of depositor relationships. Eligibility is limited to individuals; sole proprietors; partnerships; unincorporated associations; charities; and companies registered in the Register of Small Businesses maintained by the Bermuda Economic Development Corporation. (2)Cayman Islands currently has no deposit insurance scheme in place. (3)The Guernsey DCS covers deposits up to a maximum of £50,000 per qualifying claimant which is defined as a natural person; the trustee of a Guernsey Retirement Annuity Trust; the executor or administrator of a deceased person's estate; or a Guernsey-registered charity. The total amount of compensation is capped at £100 million in any 5-year period. Claims exceeding this cap will be reduced pro rata. (4)The Jersey DCS covers deposits up to a maximum of £50,000 per qualifying depositor per Jersey banking group. Qualifying depositors are defined as private individuals and charities. The total amount of compensation is capped at £100 million in any 5-year period. 48 The following table presents the amount of uninsured time deposits by reportable segment and time to maturity as at December 31, 2025: Remaining term to contractual maturity (in millions of $) Within 3 months 3 to 6 months 6 to 12 months Over 12 months Total Time deposits in excess of insured limit: Bermuda 37.9 32.1 41.7 25.9 137.6 Channel Islands and the UK 281.8 33.9 75.7 — 391.4 Total time deposits in excess of insured limit 319.7 66.0 117.4 25.9 529.0 Time deposits in uninsured accounts: Bermuda 686.8 58.5 39.4 19.8 804.5 Cayman 917.5 122.7 41.3 3.7 1,085.2 Channel Islands and the UK 1,172.1 144.6 138.7 — 1,455.4 Total time deposits in uninsured accounts 2,776.4 325.8 219.4 23.5 3,345.1 Total uninsured time deposits 3,096.1 391.8 336.8 49.4 3,874.1