CAMDEN NATIONAL CORP (CAC) Business, 2020

Overview. Camden National Corporation (hereafter referred to as “we,” “our,” “us,” or the “Company”) is a publicly-held bank holding company, with $4.9 billion in assets at December 31, 2020, incorporated under the laws of the State of Maine and headquartered in Camden, Maine. Camden National Bank (the "Bank"), a wholly-owned subsidiary of the Company, was founded in 1875. The Company was founded in 1984, went public in 1997 and is now registered with NASDAQ Global Market (“NASDAQ”) under the ticker symbol "CAC."

Our consolidated financial statements accompanying this Form 10-K include the accounts of the Company, the Bank and its subsidiaries and divisions. All inter-company accounts and transactions have been eliminated in consolidation.

Who We Are. Since our founding, we have been a values-guided, community-oriented bank that is dedicated to our customers, employees, communities and shareholders.

We are a trusted corporate partner who cares for our neighbors and employees, and we strive to follow responsible business practices under transparent, ethical governance. Our commitment to enhancing environmental, social and governance practices reinforces our focus on building a strong corporate culture across our company. Several characteristics define our culture and approach:

•We are a values-based, socially-responsible organization

•We are committed to our Vision: “Deliver your best banking experience”

•We demonstrate dedication to our four core constituents: customers, employees, communities, and shareholders

Everything we do, both in the office and in the community, is guided and inspired by our Core Values:

•Honesty and integrity – above all else

•Trust – built on fairness

•Service – second to none

•Responsibility – to use our resources for the greater good

•Excellence – through hard work and lifelong learning

Our culture and values are strengths that support our strategic goal to generate consistent, sustainable long-term value for all our constituents.

What We Do. The Company, as a diversified financial services provider, pursues the objective of achieving long-term sustainable growth by balancing growth opportunities against profit, while mitigating risks inherent in the financial services industry. The primary business of the Company and the Bank is to attract deposits from, and to extend loans to, consumer, institutional, municipal, non-profit and commercial customers. The Company, through the Bank, provides a broad array of banking and other financial services, including wealth management and trust services, brokerage, investment advisory and insurance services, to consumer, business, non-profit and municipal customers. For the year ended December 31, 2020, 2019 and 2018, net interest income was our primary revenue source, representing 73%, 75%, and 76%, of our total revenues1, respectively. Net interest income is the interest earned on our lending activities, investment securities and other interest-earning assets, less the interest paid on interest-bearing deposits and borrowings.

We have achieved a five-year compounded annual asset growth rate of 6%, resulting in $4.9 billion in total assets at December 31, 2020. Asset growth over the past five years of $1.2 billion has been all organic, including further growth and expansion into Southern Maine, and pockets of New Hampshire and Massachusetts, with our most recent acquisition being completed in October 2015. Our primary focus continues to be on profitable organic growth and we will pursue acquisitions that support our long-term strategy and fit our culture and core values.

The financial services industry continues to experience consolidations through mergers that could create opportunities for us to promote our value proposition to other financial institutions and financial service companies. We continue to evaluate the possibility of expansion into new markets through both de novo expansion and acquisitions. In addition, we are focused on

1 Revenue is the sum of net interest income and non-interest income.

Table of Contents

maximizing growth across our current markets, and particularly those markets seen as growth markets where we currently have less of a presence and market share. Further details of our financial information can be found within the consolidated financial statements within Item 8. Financial Statements and Supplementary Data of this report.

Camden National Bank. The Bank is a national banking association chartered under the laws of the United States and headquartered in Camden, Maine. Originally founded in 1875, the Bank became a direct, wholly-owned subsidiary of the Company as a result of a corporate reorganization in 1984. The Bank provides a broad array of banking and other financial services to consumer, institutional, municipal, non-profit and commercial customers. As of December 31, 2020, the Bank had 57 branches in 13 of Maine's 16 counties, one branch in Portsmouth, New Hampshire, a commercial loan production office in Manchester, New Hampshire, a mortgage loan production office in Braintree and Wakefield, Massachusetts, and 66 ATMs. The Bank optimizes its in-person professional financial guidance with state-of-the-art technology, delivered through sophisticated digital channels. These digital products empower customers to bank anywhere at any time, including, but not limited to, online and mobile banking; MortgageTouch™, our easy-to-use online platform for consumer borrowers; BusinessTouch™, our online loan application system with instant approval, making borrowing faster and easier for small businesses; and TreasuryLink™, our secure online platform designed to offer advanced cash management, monitoring capabilities and controls for commercial customers.

The Bank offers comprehensive wealth management and trust services, including investment advisory services, through our wealth management team, doing business as Camden National Wealth Management, and brokerage, investment advisory, insurance and financial planning services through our financial consulting team, doing business as Camden Financial Consultants.

•Camden National Wealth Management provides a broad range of fiduciary and asset management services to both individual and institutional clients. The wealth management services provided by Camden National Wealth Management complement the services provided by the Bank, offering high net worth individuals and families, businesses and not-for profit customers investment management, financial planning and trustee services.

•Camden Financial Consultants is in the business of helping clients meet all of their financial needs. Camden Financial Consultants provides full-service brokerage and insurance and its financial offerings include college, retirement, and estate planning, mutual funds, strategic asset management accounts, and variable and fixed annuities.

Securities are offered through LPL Financial, Member FINRA/SIPC. Camden Financial Consultants and the Bank are not registered broker/dealers and are not affiliated with LPL Financial. The investment products sold through LPL Financial are not insured by Bank deposits and are not insured by the Federal Deposit Insurance Corporation ("FDIC"). These products are not obligations of the Bank and are not endorsed, recommended or guaranteed by the Bank or any government agency. The value of the investment may fluctuate, the return on the investment is not guaranteed, and loss of principal is possible.

Customers may also access the Bank’s products and services using other channels, including on-line at www.CamdenNational.com.

Healthcare Professional Funding Corporation. Healthcare Professional Funding Corporation ("HPFC") is a wholly-owned subsidiary of the Bank that was acquired in connection with the acquisition of SBM Financial, Inc., the parent company of The Bank of Maine, on October 16, 2015. Prior to the closing of ongoing operations on February 19, 2016, it provided specialized lending to dentists, optometrists and veterinarians across the U.S. HPFC's website address is www.CamdenNational.com/healthprofunding.

Competition. We compete throughout Maine, and select areas of New Hampshire and Massachusetts. Our primary markets have historically been and continue to be within Maine. Within Maine, we operate in 13 of the state's 16 counties, with our primary markets and presence being throughout coastal and central Maine. Many of these markets are characterized as rural areas. Major competitors in our primary market area include local independent banks, as well as local branches of large regional and national banking organizations and brokerage houses, marketplace lenders and other financial technology companies (“fintechs”), financial advisors, thrift institutions and credit unions. Other competitors for deposits and loans within our primary market area include insurance companies, money market funds, consumer finance companies and financing affiliates of consumer durable goods manufacturers.

We have effectively competed with other financial institutions by emphasizing customer service, highlighted by local decision-making, establishing long-term customer relationships, building customer loyalty and providing products and services designed to meet the needs of customers. Through Camden National Wealth Management and Camden Financial Consultants, we compete for trust, trust-related, investment management, individual retirement, foundation and endowment management

Table of Contents

services and brokerage services with local banks and non-banks, as well as with a number of brokerage firms and investment advisors with offices in our market area. In addition, most of these services are widely available to our customers by telephone, online and mobile channels through firms located outside our market area.

Human Capital. Our employees play a vital role in our company-wide vision of delivering the best banking experience to all of our constituents: customers, employees, communities, and shareholders. As of December 31, 2020, we employed 609 employees. Guided by our core values, we are committed to creating a company culture where everyone is included and respected, and where we support each other in reaching our full potential.

To attract, engage, and retain top talent, we strive to create a supportive workplace, with opportunities for our employees to grow and develop in their careers. We provide numerous training and development opportunities, as well as a robust tuition reimbursement program. We are also deeply committed to the health and well-being of our employees. This includes market-competitive compensation, healthcare, paid time off, retirement benefits, short term and long term disability, as well as a fitness reimbursement program.

Through our commitment to fostering a fair, safe, and welcoming workplace environment for all, we aim to maintain a culture that enables our employees to be their best in serving our customers and communities, while achieving business success.

We maintain a number of human resources and other policies, including a harassment and retaliation policy, to promote a workplace that is safe for all and supports a culture where people feel they can report incidents that threaten that safety. In addition, we have a confidential whistleblower program that forwards complaints to the audit committee and the Board of Directors, and we work to take necessary action as quickly as possible after a complaint is received.

We also prohibit discrimination on the grounds of race, color, religion, sex, sexual orientation (including gender identity and gender expression), national origin, citizenship status, age, disability, genetic information, or veteran status. We employ based on talent and potential for growth, and we value a diversity of backgrounds and ideas.

The COVID-19 pandemic continues to impact lives and businesses in the communities we serve. In 2020, senior leaders from across the bank led our swift and evolving pandemic response, ensuring the highest safety measures were in place as an essential business. 60% of employees quickly shifted to remote work with the help of our Human Resources and Information Technology teams ensuring effective at-home work set-ups. At our branches and office areas, we established a number of safety protocols, including hand sanitizer, face coverings, and physical distancing requirements, along with enhanced cleaning and daily health checks. We are also actively planning for the time when COVID-19 vaccines will be available for our employees, and to encourage participation, we plan to provide employees with paid time off to get their vaccine.

Investor Relations. The Company’s Investor Relations information can be obtained through our internet address, CamdenNational.com. The Company makes available on or through its Investor Relations page, without charge, its annual reports on Form 10-K, quarterly reports on Form 10-Q, and current reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended, as soon as reasonably practicable after such reports are electronically filed with, or furnished to, the SEC. The Company’s reports filed with, or furnished to, the SEC are also available at the SEC’s website at www.sec.gov. In addition, the Company makes available, free of charge, its press releases and Code of Ethics through the Company’s Investor Relations page. Information on our website is not incorporated by reference into this document and should not be considered part of this report.

Information Security. Information security, including cybersecurity, is a high priority for the Company. Recently, highly publicized events have highlighted the importance of cybersecurity, including cyberattacks against financial institutions, government agencies and other organizations that resulted in the compromise of personal and/or confidential information, the theft or destruction of corporate information, and demands for ransom payments to release corporate information encrypted by so-called “ransomware.” A successful cyberattack could harm the Company’s reputation and/or impair its ability to provide services to its customers. The Company has developed policies and technology designed to protect our own and our customers’ information from cyberattacks or loss, allow for the continuity of our business in the event of disruptions to the Company’s or its vendors’ critical systems and comply with regulatory requirements related to the protection of customer data, but cannot assure that it will be able to anticipate, detect, or implement effective preventative measures against all potential threats. Refer to related risk factors in Item 1A. Risk Factors below for additional information.

Table of Contents

The following table sets forth certain information regarding the executive officers of the Company, as defined by Rule 3b-7 of the Securities and Exchange Act of 1934, as amended, as of December 31, 2020:

Executive Officer Position Age Gregory A. Dufour President and Chief Executive Officer 60 Gregory A. White Executive Vice President, Chief Financial Officer 56 Joanne T. Campbell Executive Vice President, Risk Management Officer 58 Timothy P. Nightingale Executive Vice President, Chief Credit Officer 63 Patricia A. Rose Executive Vice President, Retail and Mortgage Banking Officer 57

Gregory A. Dufour has served as President and CEO of the Company since January 2009. Mr. Dufour joined the Company in April 2001 as Senior Vice President of Finance. In August of 2002, he assumed additional responsibility for Operations and Technology until December 2003. In January 2004, Mr. Dufour was named Chief Banking Officer for the Company and President and Chief Operating Officer for Camden National Bank, and in January 2006, he became President and CEO for Camden National Bank. He also serves on the board of directors of Camden National Bank. Prior to joining the Company, Mr. Dufour was Managing Director of Finance and a member of the Executive Operating Group for IBEX Capital Markets in Boston, Massachusetts. In addition to his experience at IBEX, Mr. Dufour held various financial management positions with FleetBoston Corporation and its affiliates, including Vice President and Controller of Debt Capital Markets, Controller of Investment Banking and Banking Group Controller. Mr. Dufour’s extensive business and finance background, demonstrated ability to effectively manage growth, strong regulatory expertise and leadership capability contributes to his active support of the Board in his director capacity. Mr. Dufour has served in various volunteer capacities on numerous community-related organizations and currently serves as Chair of the board of trustees of MaineHealth, Maine's largest healthcare system, and board member of its affiliate, Coastal Healthcare Alliance system in Rockport, Maine.

Gregory A. White joined the Company in April 2020, and has since served as Executive Vice President ("EVP"), Chief Financial Officer (“CFO”), and Principal Financial and Accounting Officer. Prior to joining the Company, Mr. White served as EVP, CFO and Treasurer of First Connecticut Bancorp and Farmington Bank, based in Farmington, Connecticut for ten years. Mr. White, a Chartered Financial Analyst (CFA), has an extensive career in banking, primarily with regional and community banks in the Connecticut area.

Joanne T. Campbell joined the Company in 1996 as Vice President, Manager of Residential Real Estate. She was promoted to Senior Vice President, Compliance, Audit and Community Reinvestment Act ("CRA") in 2002, and then to Senior Vice President, Risk Management in 2005 and to EVP in January 2011. Ms. Campbell currently serves as a member and Chair of the ABA Risk Management Conference Advisory Board.

Timothy P. Nightingale joined the Company in March 2000 as Regional Vice President of UnitedKingfield Bank. In 2001, Mr. Nightingale was named Senior Lending Officer at UnitedKingfield Bank and was promoted to Senior Vice President in 2003. In September 2006, the Company merged UnitedKingfield Bank into Camden National Bank, at which time Mr. Nightingale was named Senior Vice President, Senior Lending Officer for Camden National Bank. In January 2011, he was promoted to EVP. In September 2020, Mr. Nightingale was named EVP, Chief Credit Officer for Camden National Bank. Mr. Nightingale is a member of the board of directors for the Finance Authority of Maine.

Patricia A. Rose joined Camden National Bank in September 2017 as EVP of Retail & Mortgage Banking. Ms. Rose came to the Company from Citizens Bank where she served for two years as Head of Strategic Onboarding & Orientation, and, prior to that, Director level roles in Retail Network Sales & Strategy at Santander Bank for six years. Ms. Rose began her career in banking at Fleet Bank and Sovereign Bank where she held a variety of leadership roles and served as Market President of Retail Banking in Eastern Massachusetts and New Hampshire.

All of the executive officers hold office at the discretion of the Company’s Board of Directors. There are no arrangements or understandings between any of the directors, officers or any other persons pursuant to which any of the officers have been selected as officers. There are no “family relationships” among the directors and executive officers, as the Securities and Exchange Commission defines that term.

Table of Contents

The following discussion addresses elements of the regulatory framework applicable to bank holding companies and their subsidiaries. This regulatory framework is intended primarily for the protection of depositors, the Federal Deposit Insurance Fund (“DIF”), and the banking system as a whole, rather than the protection of shareholders or non-depository creditors of a bank holding company such as the Company.

As a bank holding company, the Company is subject to regulation, supervision and examination by the Board of Governors of the Federal Reserve System (“FRB”) under the Bank Holding Company Act of 1956, as amended (“BHCA”). As a national bank, the Bank is subject to regulation, supervision and examination by the Office of the Comptroller of the Currency (“OCC”).

The following is a summary of certain aspects of various statutes and regulations applicable to the Company and its direct and indirect subsidiaries. This summary is not a comprehensive analysis of all applicable laws, and you should refer to the applicable statutes and regulations for more information. Changes in applicable laws or regulations, and in their interpretation and application by regulatory agencies and other governmental authorities, cannot be predicted, but may have a material effect on our business, financial condition or results of operations.

As a bank holding company, the Company is subject to regulation, supervision and examination by the FRB, which has the authority, among other things, to order bank holding companies to cease and desist from unsafe or unsound banking practices; to assess civil money penalties; and to order termination of non-banking activities or termination of ownership and control of a non-banking subsidiary by a bank holding company.

Source of Strength. Under the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”), the Company is required to serve as a source of financial strength for the Bank. This support may be required at times when the Company may not have the resources to provide it. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a bank subsidiary will be assumed by the bankruptcy trustee and entitled to a priority of payment.

Acquisitions and Activities. The BHCA prohibits a bank holding company, without prior approval of the FRB, from acquiring all or substantially all the assets of a bank, acquiring control of a bank, merging or consolidating with another bank holding company, or acquiring direct or indirect ownership or control of any voting shares of another bank or bank holding company if, after such acquisition, the acquiring bank holding company would control more than 5% of any class of the voting shares of such other bank or bank holding company. The BHCA also prohibits a bank holding company from engaging directly or indirectly in activities other than those of banking, managing or controlling banks or furnishing services to its subsidiary banks. However, a bank holding company may engage in and may own shares of companies engaged in activities that the FRB has determined, by order or regulation, to be so closely related to banking as to be a proper incident thereto.

Limitations on Acquisitions of Company Common Stock. The Change in Bank Control Act prohibits a person or group of persons acting in concert from acquiring “control” of a bank holding company unless the FRB has been notified and has not objected to the transaction. Under a rebuttable presumption established by the FRB, the acquisition of 10% or more of a class of voting securities of a bank holding company with a class of securities registered under Section 12 of the Exchange Act would generally constitute the acquisition of control of a bank holding company. In addition, the BHCA prohibits any company from acquiring control of a bank or bank holding company without first having obtained the approval of the FRB. Under the BHCA, a company is deemed to control a bank or bank holding company if the company owns, controls or holds with power to vote 25% or more of a class of voting securities of the bank or bank holding company, controls in any manner the election of a majority of directors or trustees of the bank or bank holding company, or the FRB determines that the company has the power to exercise a controlling influence over the management or policies of the bank or bank holding company.

The Bank is subject to regulation, supervision, and examination by the OCC. Additionally, the Federal Deposit Insurance Corporation (“FDIC”) has secondary supervisory authority as the insurer of the Bank’s deposits. The Bank is also subject to regulations issued by the Consumer Financial Protection Bureau (“CFPB”), as enforced by the OCC. Pursuant to the Dodd-Frank Act, the FRB may directly examine the subsidiaries of the Company, including the Bank. The enforcement powers available to the federal banking regulators include, among other things, the ability to issue cease and desist or removal orders; to terminate insurance of deposits; to assess civil money penalties; to issue directives to increase capital; to place the Bank into receivership; and to initiate injunctive actions against banking organizations and institution-affiliated parties.

Table of Contents

Deposit Insurance. The deposit obligations of the Bank are insured by the FDIC’s DIF up to the applicable limits. Under the Federal Deposit Insurance Act (“FDIA”), insurance of deposits may be terminated by the FDIC if the FDIC finds that the insured depository institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.

The Bank’s deposits are subject to deposit insurance assessments to maintain the DIF. The Bank’s deposit insurance assessments are based on its assets. To determine its deposit insurance assessment, the Bank computes the base amount of its average consolidated assets less its average tangible equity (defined as the amount of Tier I capital) and the applicable assessment rate. The rule for calculating assessment rates for established small banks, including the Bank, utilizes the CAMELS rating system, which is a supervisory rating system designed to take into account and reflect all financial and operational risks that a bank may face, including capital adequacy, asset quality, management capability, earnings, liquidity and sensitivity to market risk. Each of the seven financial ratios and a weighted average of CAMELS component ratings is multiplied by a corresponding pricing multiplier. The sum of these products is added to a uniform amount, with the resulting sum being an institution’s initial base assessment rate (subject to minimum or maximum assessment rates based on a bank’s CAMELS composite rating). This method takes into account various measures, including an institution’s leverage ratio, brokered deposit ratio, one year asset growth, the ratio of net income before taxes to total assets and considerations related to asset quality. Assessments for established small banks range from 1.5 to 30 basis points, after adjustments. The FDIC has the power to adjust deposit insurance assessment rates at any time, and the Company is not able to predict the amount or timing of any adjustment.

The FDIA, as amended by the Federal Deposit Insurance Reform Act and the Dodd-Frank Act, establishes a minimum reserve ratio of the DIF to estimated insured deposits of 1.15% prior to September 2020 and 1.35% thereafter. Further, the Dodd-Frank Act required that, in setting assessments, the FDIC offset the effect of the increase in the minimum reserve ratio from 1.15% to 1.35% on banks with less than $10 billion in assets.

To offset the effect of the increase in the reserve ratio on small banks, including the Bank, those banks received credits for the portion of their assessments that helped to raise the reserve ratio from 1.15% to 1.35%. All remaining small bank credits were refunded to banks on September 30, 2020, and small banks, including the Bank, will no longer receive these credits in future periods.

Activities and Investments of National Banking Associations. National banking associations must comply with the National Bank Act and the regulations promulgated thereunder by the OCC, which limit the activities of national banking associations to those that are deemed to be part of, or incidental to, the “business of banking.” Activities that are part of, or incidental to, the business of banking include taking deposits, borrowing and lending money and discounting or negotiating promissory notes, drafts, bills of exchange, and other evidences of debt. Subsidiaries of national banking associations generally may only engage in activities permissible for the parent national bank.

Lending Restrictions. Federal law limits a bank’s authority to extend credit to its insiders, including its directors, executive officers and 10% shareholders, as well as to entities controlled by such persons. Among other things, extensions of credit to insiders are required to be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with unaffiliated persons. Also, the terms of such extensions of credit may not involve more than the normal risk of repayment or present other unfavorable features and may not exceed certain limitations on the amount of credit extended to such persons, individually and in the aggregate, which limits are based, in part, on the amount of the bank’s capital. The Dodd-Frank Act explicitly provides that an extension of credit to an insider includes credit exposure arising from a derivatives transaction, repurchase agreement, reverse repurchase agreement, securities lending transaction or securities borrowing transaction. Additionally, the Dodd-Frank Act requires that asset sale transactions with insiders must be on market terms, and if the transaction represents more than 10% of the capital and surplus of the Bank, be approved by a majority of the disinterested directors of the Bank.

Brokered Deposits. Section 29 of the FDIA and FDIC regulations generally limit the ability of an insured depository institution to accept, renew or roll over any brokered deposit unless the institution’s capital category is “well capitalized” under the prompt corrective action framework described below or, with a waiver from the FDIC, “adequately capitalized.” A bank that is “adequately capitalized” and that accepts or renews brokered deposits subject to a waiver from the FDIC is subject to additional restrictions on the interest rates it may offer. Depository institutions that have brokered deposits in excess of 10% of total assets will be subject to increased FDIC deposit insurance premium assessments. The Economic Growth, Regulatory Relief, and Consumer Protection Act (“EGRRCPA”) amended Section 29 of the FDIA to exempt a capped amount of reciprocal deposits from treatment as brokered deposits. In December 2018, the FDIC adopted a final rule that permits an institution that is “well capitalized” and has a CAMELS composite rating of 1 or 2 to exempt reciprocal deposits from treatment as brokered deposits up to the lesser of $5 billion or 20% of the institution’s total liabilities. Institutions that are not well rated or “well

Table of Contents

capitalized” may treat reciprocal deposits as non-brokered up to an amount equal to a “special cap” set forth in the final rule. In addition, in December 2020, the FDIC finalized a rule that is intended to bring the brokered deposits regulations in line with modern deposit taking methods and that may reduce the amount of deposits that would be classified as brokered.

Community Reinvestment Act ("CRA"). The CRA requires the OCC to evaluate the Bank’s performance in helping to meet the credit needs of the entire communities it serves, including low and moderate-income neighborhoods, consistent with its safe and sound banking operations, and to take this record into consideration when evaluating certain applications. The OCC rates a national bank’s compliance with the CRA as “Outstanding,” “Satisfactory,” “Needs to Improve” or “Substantial Noncompliance.” Failure of the Bank to receive at least a “Satisfactory” rating could inhibit the Bank or the Company from undertaking certain activities, including acquisitions of other financial institutions. The Bank currently has an “Outstanding” CRA rating.

In December 2019, the OCC and the FDIC proposed a rule that would seek to expand the types of activities that qualify for CRA credit; revise how banks delineate their CRA assessment areas; and establish new standards for evaluating banks with more than $500 million in assets, including, among others, the number of qualifying retail loan originations to low- and moderate-income individuals. In May 2020, the OCC issued its final CRA rule, effective October 1, 2020 with full compliance by banks that are subject to the general performance standards (banks with over $2.5 billion in assets, including the Bank) required by January 1, 2023. The FDIC has not finalized the revisions to its CRA rule.

Regulatory Capital Requirements. The Company and the Bank are subject to risk-based capital requirements and rules issued by the FRB, the OCC and the FDIC (the “Capital Rules”) that are based on the Basel Committee on Banking Supervision’s (“Basel Committee”) framework for strengthening capital and liquidity regulation (referred to as Basel III). The Capital Rules are intended to reflect the relationship between the banking organization’s capital and the degree of risk associated with its operations based on transactions recorded on-balance sheet as well as off-balance sheet items. The FRB and the OCC may from time to time require that a banking organization maintain capital above the minimum levels discussed below, due to the banking organization’s financial condition or actual or anticipated growth. Under the Capital Rules, the Company and the Bank apply the Standardized Approach in measuring their risk-weighted assets (“RWA”) and regulatory capital.

The Capital Rules define qualifying capital instruments and specify minimum amounts of capital as a percentage of assets that banking organizations are required to maintain.

Under the Capital Rules, risk-based capital ratios are calculated by dividing Common Equity Tier 1 (“CET1”) capital, Tier 1 capital and total risk-based capital, respectively, by RWA. Assets and off-balance sheet credit equivalents are assigned a risk weight based primarily on supervisory assessments of relative credit risk.

Under the Capital Rules, the Company and the Bank are each required to maintain a minimum CET1 capital to RWA ratio of 4.5%, a minimum Tier 1 capital to RWA ratio of 6%, a minimum total capital to RWA ratio of 8% and a minimum leverage ratio of 4%. Additionally, the Capital Rules require an institution to establish a capital conservation buffer of CET1 capital in an amount above the minimum risk-based capital requirements for “adequately capitalized” institutions equal to 2.5% of total RWA, resulting in a requirement for the Company and the Bank effectively to maintain CET1, Tier 1 and total capital ratios of 7%, 8.5% and 10.5%, respectively. Banking institutions with a ratio of CET1 capital to RWA above the minimum requirement but below the capital conservation buffer face restrictions on the ability to pay dividends, pay discretionary bonuses, and to engage in share repurchases based on the amount of the shortfall and the institution’s “eligible retained income” (since March 2020, the greater of (i) net income for the preceding four quarters, net of distributions and associated tax effects not reflected in net income and (ii) average net income over the preceding four quarters).

The Capital Rules provide for a number of deductions from and adjustments to CET1 capital, including, for example, goodwill, other intangible assets, and deferred tax assets (“DTAs”) that arise from net operating loss and tax credit carryforwards net of any related valuation allowance. Mortgage servicing rights (“MSRs”), DTAs arising from temporary differences that could not be realized through net operating loss carrybacks and significant investments in non-consolidated financial institutions must also be deducted from CET1 capital to the extent that they exceed certain thresholds. In November 2017, the federal bank regulators revised the Capital Rules to extend the transitional treatment of certain DTAs, MSRs, investments in non-consolidated financial institutions and minority interests for non-advanced approaches banking organizations, such as the Company and the Bank, until January 1, 2020, when the revisions to simplify the regulatory capital treatment of those items took effect.

Table of Contents

The Company and the Bank, as non-advanced approaches banking organizations, made a one-time, permanent election under the Capital Rules to exclude the effects of certain components of accumulated other comprehensive income (“AOCI”) included in shareholders’ equity under U.S. GAAP in determining regulatory capital ratios.

The EGRRCPA required the federal bank regulators to adopt regulations to implement an exemption from the Capital Rules for smaller banking organizations, including the Company and the Bank, that maintain a “Community Bank Leverage Ratio” of at least 8% to 10%. Specifically, the legislation provides that if any depository institution or depository institution holding company with less than $10 billion in total consolidated assets maintains tangible equity in excess of this leverage ratio, as implemented by the federal bank regulators, it would be deemed to be in compliance with (i) the leverage and risk-based capital requirements promulgated by the federal banking agencies; (ii) in the case of a depository institution, the capital ratio requirements to be considered “well-capitalized” under the federal banking agencies’ “prompt corrective action” regime (see “—Prompt Corrective Action” below); and (iii) “any other capital or leverage requirements” to which the depository institution or holding company is subject, unless the appropriate federal banking agency determines otherwise based on the particular institution’s risk profile.

In November 2019, the FRB, OCC and FDIC issued a final rule to implement the Community Bank Leverage Ratio. Under the final rule, a “qualifying small banking organization” can choose to apply the Community Bank Leverage Ratio framework if its Community Bank Leverage Ratio (i.e., the ratio of its Tier 1 capital to average total consolidated assets minus certain deductions from total assets), is greater than 9%. The Company evaluated the potential impact of this rule and elected not to apply the Community Bank Leverage Ratio framework to its operations, and instead measures its capital adequacy under the Capital Rules as described above. Under the final rule, as long as the Company and the Bank continue to meet the requirements to be qualifying small banking organizations (i.e., they have less than $10 billion in total consolidated assets and meet certain risk-based criteria), they are permitted to opt into (or out of) the Community Bank Leverage Ratio framework at any time and for any reason. The Company will continue to evaluate the impact of the Community Bank Leverage Ratio and may opt into that framework in the future. The Company cannot guarantee, however, that it or the Bank will continue to meet the conditions to be eligible to apply the Community Bank Leverage Ratio, nor can the Company predict at this time whether it or the Bank will choose to apply the Community Bank Leverage Ratio in the future.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms (the standards are commonly referred to as “Basel IV”). Among other things, these standards revise the Basel Committee's standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain "unconditionally cancellable commitments," such as home equity lines of credit) and provides a new standardized approach for operational risk capital. Under the Basel framework, these standards will generally be effective on January 1, 2023, with an aggregate output floor phasing in through January 1, 2028. Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not to the Company or Bank. The impact of Basel IV on the Company and the Bank will depend on the manner in which it is implemented by the federal bank regulators.

Prompt Corrective Action. The FDIA requires the federal banking agencies to take prompt corrective action with respect to depository institutions that do not meet the minimum capital requirements described above. The FDIA establishes five capital categories (“well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” and “critically undercapitalized”). The federal banking regulators must take certain mandatory supervisory actions, and are authorized to take other discretionary actions, with respect to institutions that are less than adequately capitalized, with supervisory actions progressively becoming more punitive as the institution’s capital category declines. Supervisory actions include: (i) restrictions on payment of capital distributions and management fees, (ii) requirements that a federal bank regulator monitor the condition of the institution and its efforts to restore its capital, (iii) submission of a capital restoration plan, (iv) restrictions on the growth of the institution’s assets and (v) requirements for prior regulatory approval of certain expansion proposals. A bank that is “critically undercapitalized” (i.e., has a ratio of tangible equity to total assets that is equal to or less than 2.0%) will be subject to further restrictions and generally will be placed in conservatorship or receivership within 90 days. An insured depository institution is considered “well capitalized” if it (i) has a total risk-based capital ratio of 10.0% or greater; (ii) has a Tier 1 risk-based capital ratio of 8.0% or greater; (iii) has a CET1 ratio of at least 6.5% or greater; (iv) has a leverage capital ratio of 5.0% or greater; and (v) is not subject to any written agreement, order, capital directive, or prompt corrective action directive to meet and maintain a specific capital level for any capital measure.

The FDIA’s prompt corrective action provisions apply only to depository institutions such as the Bank, and not to bank holding companies. Under the FRB’s regulations, a bank holding company, such as the Company, is considered “well capitalized” if the bank holding company (i) has a total risk based capital ratio of at least 10%, (ii) has a Tier 1 risk-based capital ratio of at least 6%, and (iii) is not subject to any written agreement order, capital directive or prompt corrective action directive to meet and maintain a specific capital level for any capital measure. Although prompt corrective action regulations

Table of Contents

apply only to depository institutions and not to bank holding companies, a bank that is required to submit a capital restoration plan generally must concurrently submit a performance guarantee by its parent holding company. The liability of the parent holding company under any such guarantee is limited to the lesser of five percent of the bank’s assets at the time it became “undercapitalized” or the amount needed to comply.

Information concerning the Company and the Bank with respect to capital requirements is incorporated by reference

from Item 7. "Management’s Discussion and Analysis of Financial Condition and Results of Operations—Capital

Resources" and Note 14 of the consolidated financial statements included within this report.

The Bank and the Company meet all capital requirements under the Capital Rules, including the capital conservation buffer, and each meet the capital ratio requirements to be “well capitalized” for purposes of the prompt corrective action provisions of the FDIA and applicable FRB regulations, respectively.

Safety and Soundness Standards. The FDIA requires the federal bank regulatory agencies to prescribe safety and soundness standards, by regulations or guidelines, as the agencies deem appropriate. Guidelines adopted by the federal bank regulatory agencies establish general standards relating to internal controls and information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, asset quality, earnings and compensation, fees and benefits. In general, these guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines. The guidelines prohibit excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal shareholder. In addition, the federal banking agencies adopted regulations that authorize, but do not require, an agency to order an institution that has been given notice by an agency that it is not satisfying any of such safety and soundness standards to submit a compliance plan. If, after being so notified, an institution fails to submit an acceptable compliance plan or fails in any material respect to implement an acceptable compliance plan, the agency must issue an order directing action to correct the deficiency and may issue an order restricting asset growth, requiring an institution to increase its ratio of tangible equity to assets or directing other actions of the types to which an undercapitalized institution is subject under the “prompt corrective action” provisions of the FDIA. See “—Prompt Corrective Action” above. If an institution fails to comply with such an order, the agency may seek to enforce such order in judicial proceedings and to impose civil money penalties.

The Company is a legal entity separate and distinct from its subsidiaries. The revenue of the Company (on a parent-only basis) is derived primarily from interest and dividends paid to it by the Bank. The right of the Company, and consequently the right of shareholders of the Company, to participate in any distribution of the assets or earnings of the Bank through the payment of such dividends or otherwise is necessarily subject to the prior claims of creditors of the Bank (including depositors), except to the extent that certain claims of the Company in a creditor capacity may be recognized. The Company and the Bank are subject to various federal and state restrictions on their ability to pay dividends as described below.

Restrictions on Bank Holding Company Dividends. The FRB has the authority to prohibit bank holding companies from paying dividends if such payment is deemed to be an unsafe or unsound practice. The FRB has indicated generally that it may be an unsafe or unsound practice for bank holding companies to pay dividends unless the bank holding company’s net income over the preceding year is sufficient to fund the dividends and the expected rate of earnings retention is consistent with the organization’s capital needs, asset quality and overall financial condition. FRB guidance also directs bank holding companies to inform the FRB reasonably in advance of declaring or paying a dividend that exceeds earnings for the period for which the dividend is being paid. Further, the Company’s ability to pay dividends is restricted if it does not maintain the capital conservation buffer. See “—Capital Adequacy and Safety and Soundness—Regulatory Capital Requirements” above.

Under Maine law, a corporation’s Board of Directors may declare, and the corporation may pay, dividends on its outstanding shares, in cash or other property, generally only out of the corporation’s unreserved and unrestricted earned surplus, or out of the unreserved and unrestricted net earnings of the current fiscal year and the next preceding fiscal year taken as a single period, except under certain circumstances, including when the corporation is insolvent, or when the payment of the dividend would render the corporation insolvent or when the declaration would be contrary to the corporation’s charter.

Restrictions on Bank Dividends. Under OCC regulations, national banks generally may not declare a dividend in excess of the bank’s undivided profits or, absent OCC approval, if the total amount of dividends declared by the national bank in any calendar year exceeds the total of the national bank’s retained net income year-to-date combined with its retained net income for the preceding two years. National banks also are prohibited from declaring or paying any dividend if, after making the dividend, the national bank would be considered “undercapitalized” (as defined by reference to other OCC regulations). The

Table of Contents

OCC has the authority to use its enforcement powers to prohibit a national bank, such as the Bank, from paying dividends if, in its opinion, the payment of dividends would constitute an unsafe or unsound practice. Further, the Bank’s ability to pay dividends is restricted if it does not maintain the capital conservation buffer. See “—Capital Adequacy and Safety and Soundness—Regulatory Capital Requirements” above.

Restrictions on Share Repurchases. In July 2019, the FRB eliminated the standalone prior approval requirement in the Capital Rules for a bank holding company’s repurchase or redemption of its common stock. In certain circumstances, however, the Company’s repurchases of its common stock may be subject to a prior approval or notice requirement under the regulations or policies of the FRB.

Sections 23A and 23B of the Federal Reserve Act and the FRB’s Regulation W restrict transactions between a bank and its affiliates, including its parent bank holding company. The Bank is subject to these restrictions, which include quantitative and qualitative limits on the amounts and types of transactions that may occur, including extensions of credit (which include credit exposure arising from repurchase and reverse repurchase agreements, securities borrowing and derivative transactions) to affiliates, investments in the stock or securities of affiliates, purchases of assets from affiliates and other “covered transactions.” Generally, a bank’s (including its subsidiaries) covered transactions with any affiliate are subject to the following limits: (i) the aggregate amount of covered transactions with any one affiliate cannot exceed 10% of the bank’s capital stock and surplus; and (ii) the aggregate amount of covered transactions with all affiliates cannot exceed 20% of the bank’s capital stock and surplus. Transactions between a bank and its affiliates, including a parent holding company, must be on market terms and not otherwise unduly favorable to an affiliate, and, in the case of extensions of credit, be secured by specified amounts and types of collateral.

Generally, a bank is prohibited from extending credit, leasing or selling property, furnishing any service or fixing or varying the consideration for any of the foregoing on the condition that (i) the customer obtains additional credit, property or services from the bank’s parent holding company or any subsidiary of the holding company, or (ii) the customer will not obtain credit, property or services from a competitor of the bank or its affiliates (except to the extent the restriction is a reasonable condition imposed to assure the soundness of the credit extended).

The Company and the Bank are subject to federal and state laws designed to protect consumers and prohibit unfair or deceptive business practices, including the Equal Credit Opportunity Act, the Fair Housing Act, the Home Ownership Protection Act, the Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”), the Gramm-Leach-Bliley Act of 1999 (“GLBA”), the Truth in Lending Act, the CRA, the Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, the National Flood Insurance Act and various state law counterparts. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must interact with customers when taking deposits, making loans, collecting loans and providing other services. In addition, the CFPB has a broad mandate to prohibit unfair, deceptive or abusive acts and practices, is specifically empowered to require certain disclosures to consumers and draft model disclosure forms, and is responsible for making rules and regulations under the federal consumer protection laws relating to financial products and services. Failure to comply with consumer protection laws and regulations can subject financial institutions to enforcement actions, fines and other penalties. The OCC examines the Bank for compliance with CFPB rules and enforces CFPB rules with respect to the Bank.

Mortgage Reform. The Dodd-Frank Act prescribes certain standards that mortgage lenders must consider before making a residential mortgage loan, including verifying a borrower’s ability to repay such mortgage loan, and allows borrowers to assert violations of certain provisions of the Truth in Lending Act as a defense to foreclosure proceedings. Under the Dodd-Frank Act, prepayment penalties are prohibited for certain mortgage transactions and creditors are prohibited from financing insurance policies in connection with a residential mortgage loan or home equity line of credit. In addition, the Dodd-Frank Act prohibits mortgage originators from receiving compensation based on the terms of residential mortgage loans and generally limits the ability of a mortgage originator to be compensated by others if compensation is received from a consumer. The Dodd-Frank Act requires mortgage lenders to make additional disclosures prior to the extension of credit, in each billing statement and for negative amortization loans and hybrid adjustable rate mortgages.

Data Privacy and Cyber Security. The GLBA requires financial institutions to implement policies and procedures regarding the disclosure of nonpublic personal information about consumers to nonaffiliated third parties. In general, the Bank must provide its customers with an initial and annual disclosure that explains its policies and procedures regarding the

Table of Contents

disclosure of such nonpublic personal information, and, except as otherwise required or permitted by law, the Bank is prohibited from disclosing such information except as provided in such policies and procedures. However, an annual disclosure is not required to be provided by a financial institution if the financial institution only discloses information under exceptions from GLBA that do not require an opt out to be provided and if there has been no change in its privacy policies and practices since its most recent disclosure provided to consumers. The GLBA also requires that the Bank develop, implement and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information (as defined under GLBA), to protect against anticipated threats or hazards to the security or integrity of such information; and to protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. The Bank is also required to send a notice to customers whose sensitive information has been compromised if unauthorized use of this information is reasonably possible.

Most states, including the states where the Bank operates, have enacted legislation concerning breaches of data security and Congress is considering federal legislation that would require consumer notice of data security breaches. Pursuant to the FACT Act, the Bank must develop and implement a written identity theft prevention program to detect, prevent, and mitigate identity theft in connection with the opening of certain accounts or certain existing accounts. Additionally, the FACT Act amends the Fair Credit Reporting Act to generally prohibit a person from using information received from an affiliate to make a solicitation for marketing purposes to a consumer, unless the consumer is given notice and a reasonable opportunity and a reasonable and simple method to opt out of the making of such solicitations.

In December 2020, the U.S. federal bank regulatory agencies released a proposed rule regarding notification requirements for banking organizations related to significant computer security incidents. Under the proposal, a bank holding company, such as the Company, and a national bank, such as the Bank, would be required to notify the FRB or OCC, respectively, within 36 hours of incidents that could result in the banking organization’s inability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. The effects of this rulemaking on the Company and the Bank will depend on the final form of the rule and how it is implemented.

The Bank Secrecy Act. Under the Bank Secrecy Act (“BSA”), as amended by the USA PATRIOT Act of 2001, a financial institution is required to have systems in place to detect certain transactions, based on the size and nature of the transaction, and to monitor and report suspicious activity to appropriate law enforcement or regulatory authorities. Financial institutions, such as the Bank, are also required to adopt and implement policies and procedures with respect to, among other things, anti-money laundering (“AML”) compliance, suspicious activity, currency transaction reporting, customer identity verification and customer risk analysis. In addition, financial institutions are required to take steps to monitor their correspondent banking and private banking relationships as well as, if applicable, their relationships with “shell banks.” In evaluating an application under Section 3 of the BHCA to acquire a bank or an application under the Bank Merger Act to merge banks or affect a purchase of assets and assumption of deposits and other liabilities, the applicable federal banking regulator must consider the AML compliance record of both the applicant and the target.

In January 2021, the Anti-Money Laundering Act of 2020 (“AMLA”), which amends the BSA, was enacted. The AMLA is intended to comprehensively reform and modernize U.S. anti-money laundering laws. Among other things, the AMLA codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the development of standards by the U.S. Department of the Treasury for evaluating technology and internal processes for BSA compliance; and expands enforcement- and investigation-related authority, including a significant expansion in the available sanctions for certain BSA violations. Many of the statutory provisions in the AMLA will require additional rulemakings, reports and other measures, and the impact of the AMLA will depend on, among other things, rulemaking and implementation guidance.

OFAC. The U.S. has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others. These sanctions, which are administered by the U.S. Treasury’s Office of Foreign Assets Control (“OFAC”), take many different forms. Generally, however, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on “U.S. persons” engaging in financial or other transactions relating to a sanctioned country or with certain designated persons and entities; (ii) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons); and (iii) restrictions on transactions with or involving certain persons or entities. Blocked assets (for example, property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal and reputational consequences for the Company.

Table of Contents

Volcker Rule Restrictions on Proprietary Trading and Sponsorship of Hedge Funds and Private Equity Funds. Since its enactment, the Dodd-Frank Act has barred banking organizations, such as the Company and the Bank, from engaging in proprietary trading and from sponsoring and investing in hedge funds and private equity funds, except as permitted under certain circumstances, in a provision commonly referred to as the “Volcker Rule.”

The EGRRCPA amended the Volcker Rule to exclude smaller banking organizations, effective immediately following enactment of the EGRRCPA. In July 2019, the OCC, FRB, FDIC, SEC and Commodity Futures Trading Commission jointly issued a final rule to implement the EGRRCPA’s exclusion with respect to small banking organizations. Under the final rule, an insured depository institution, such as the Bank, that has, and is controlled only by companies that have, (i) total consolidated assets of $10 billion or less, and (ii) total trading assets and liabilities that are 5% or less of total assets generally would not be a “banking entity” and therefore would not be subject to the Volcker Rule. As a result, the Company and the Bank are not subject to the Volcker Rule. We do not expect this change to have a material impact on the Company.

Table of Contents