COLUMBIA BANKING SYSTEM, INC. (COLB) Business, 2018

Columbia Banking System, Inc. (referred to in this report as “we,” “our,” “the Company” and “Columbia”) is a registered bank holding company whose wholly owned banking subsidiary is Columbia State Bank (“Columbia Bank” or “the Bank”). Established in 1993 in Tacoma, Washington, we provide a full range of banking services to small and medium-sized businesses, professionals and individuals throughout Washington, Oregon and Idaho. The Company’s subsidiary Columbia Trust Company (“Columbia Trust”) is an Oregon trust company that provides agency, fiduciary and other related trust services with offices in Washington, Oregon and Idaho.

Columbia Bank has locations throughout Washington, Oregon and Idaho. The vast majority of Columbia Bank’s loans and deposits are within its service areas. Columbia Bank is a Washington state-chartered commercial bank, the deposits of which are insured in whole or in part by the FDIC. Columbia Bank is subject to regulation by the FDIC, the Washington State Department of Financial Institutions Division of Banks, the Oregon Department of Consumer and Business Services Division of Finance and Corporate Securities, and the Idaho Department of Finance. Although Columbia Bank is not a member of the Federal Reserve System, the Board of Governors of the Federal Reserve System (“Federal Reserve”) has certain supervisory authority over the Company, which can also affect Columbia Bank.

Having celebrated our 25th anniversary in 2018, our goal is to continue to be a leading Northwest regional community banking company while consistently increasing shareholder value. We continue to build on our reputation for exceptional customer satisfaction in order to be recognized as the bank of choice for individual and business customers in all markets we serve.

We have established a network of 150 branches in Washington, Oregon and Idaho as of December 31, 2018, from which we intend to grow market share. We operate 74 branches in 21 counties in the state of Washington, 62 branches in 16 counties in Oregon and 14 branches in 10 counties in Idaho.

Our branch system funds our lending activities and allows us to better serve both retail and business depositors. We believe this approach enables us to expand lending activities while attracting a stable core deposit base and enhancing utilization of our full range of products and services. To support our strategy of market penetration and increased profitability, while continuing our personalized banking approach, we have invested in experienced banking and administrative personnel and have incurred related costs in the creation of our branch network. Our branch system and other delivery channels are continually evaluated as an important component of ongoing efforts to improve efficiencies without compromising customer service. We are taking major steps towards enhancing our digitally enabled bank that puts the client first and ensures they can bank when, how and where they choose.

Our business strategy is to provide our customers with the financial sophistication and product depth of a regional banking company while retaining the appeal and service level of a community bank. We continually evaluate our existing business processes while focusing on maintaining asset quality and a diversified loan and deposit portfolio. We continue to build our strong core deposit base, expanding total revenue and controlling expenses in an effort to gain operational efficiencies and increase our return on average equity. As a result of our strong commitment to highly personalized, relationship-oriented customer service, our diverse products, our strategic branch locations and the long-standing community presence of our managers and staff, we believe we are well positioned to attract and retain new customers and to increase our market share of loans, deposits, investments and other financial services. We are dedicated to increasing market share in the communities we serve by continuing to leverage our existing branch network and considering business combinations that are consistent with our expansion strategy throughout the Northwest. We have grown our franchise over the past decade through a combination of acquisitions and organic growth.

Table of Contents

We place the highest priority on customer service and assist our clients in making informed decisions when selecting from the products and services we offer. We continually review our product and service offerings to ensure that we provide our customers with the tools to meet their financial needs. A more complete listing of all the services and products available to our customers can be found on our website: www.columbiabank.com. Some of the core products and services we offer include:

Personal Banking Business Banking Wealth Management • Checking and Savings Accounts • Checking and Savings Accounts • Financial Services • Debit and Credit Cards • Debit and Credit Cards • Private Banking • Digital Banking • Business Loans • Trust and Investment Services • Personal Loans • Professional Banking • Home Loans • Treasury Management • Foreign Currency • Merchant Card Services • International Banking

Personal Banking: We offer our personal banking customers an assortment of account products including noninterest and interest-bearing checking, savings, money market and certificate of deposit accounts. Overdraft protection is also available with direct links to the customer’s checking account. Personal banking customers may also choose from a variety of loan products including home mortgages for purchases and refinances, home equity loans and lines of credit, and other personal loans. Eligible personal banking customers with checking accounts are provided a Visa® Debit Card. Further, a variety of Visa® Credit Cards are available to eligible personal banking customers.

In addition, Columbia Connect, our personal digital banking platform, allows our personal banking customers to safely and securely conduct their banking business 24 hours a day, 7 days a week across all of their devices. Columbia Connect has simple navigation and provides access to frequently used features such as depositing checks, paying bills, transferring funds, or locating the nearest Columbia Bank branch or ATM.

Business Banking: A variety of checking, savings, interest bearing money market and certificate of deposit accounts are offered to business banking customers to satisfy all their banking needs. In addition to these core banking products, we provide a breadth of services to support the complete financial needs of small and middle market businesses including Business Debit and Credit Cards, Business Loans, Professional Banking, Treasury Management, Merchant Card Services, and International Banking.

Our business banking customers are offered a selection of Visa® Cards including the Business Debit Card that works like a check wherever Visa® is accepted. We also partner with Elan Financial Services to offer a variety of Visa® Credit Cards that come with important business features including expense management tools, free employee cards and added security benefits. A specialty community card for nonprofit organizations and municipalities is also available.

We offer a variety of loan products tailored to meet the diverse needs of business banking customers. Business loan products include agricultural loans, asset-based loans, builder and other commercial real estate loans, and loans guaranteed by the Small Business Administration. In addition, we offer a suite of Business Edge loans designed for small businesses looking to expand, purchase equipment, or in need of working capital.

Columbia Professional Bankers are uniquely qualified to help dentists, physicians and veterinarians acquire, build and grow their practice. We offer tailored banking solutions delivered by experienced bankers with the industry knowledge necessary to meet their business’s unique needs.

Table of Contents

Columbia Bank’s diversified Treasury Management Programs are tailored to meet specific banking needs of each individual business. We combine technology with integrated operations and local expertise for safe, powerful, flexible solutions. Columbia’s clients, of all sizes, choose from a full range of transaction and Treasury Management tools to gain more control over their money. Treasury Management solutions include Business Online and Mobile Banking, Business Bill Pay, Automated Clearing House (ACH) collections and payments, Remote Deposit Capture, and a variety tools to protect against fraud and manage excess funds.

Since 2017, we have partnered with Vantiv to provide businesses with a broad range of payment acceptance solutions to meet their customer’s needs. Our Merchant Card Services powered by Vantiv provide businesses with sophisticated technology, competitive pricing and best-in-class service for their merchant needs.

Columbia International Banking offers a range of financial services to help our business customers explore global markets and conduct international trade smoothly and expediently. We are proud to provide small and mid-size businesses with the same caliber of expertise and personalized service that national banks usually limit to large businesses. Our experience with foreign currency exchange, letters of credit, foreign collections and trade finance services can help companies open the door to new markets and suppliers overseas.

Wealth Management: We offer tailored solutions to individuals, families and professional businesses in the areas of financial services and private banking, as well as trust and investment services.

CB Financial Services(1) offers a comprehensive array of financial solutions that focuses on wealth management by delivering personalized service and experience through dedicated financial advisors serving various geographical areas.

Financial Services solutions include:

Ÿ Financial Planning: Asset Allocation, Net Worth Analysis, Estate Planning & Preservation(2), Education Funding, Wealth Transfer.

Ÿ Wealth Management: Professional Asset Management, Tailored Investment Strategies, and Professional Money Managers.

Ÿ Insurance Solutions: Long-Term Care, Life, and Disability Insurance.

Ÿ Individual Retirement Solutions: Retirement Planning, Retirement Income Strategies, and Traditional and Roth IRAs.

Ÿ Business Solutions: Business Retirement Plans, Key Person Insurance, Business Succession Planning, and Deferred Compensation Plans.

Columbia Private Banking offers affluent clientele and their businesses complex financial solutions, such as deposit and treasury management services, credit services, and wealth management strategies. Each private banker coordinates a relationship team of experienced financial professionals to meet the unique needs of each discerning customer.

__________

(1) Securities and insurance products are offered through Cetera Investment Services LLC (doing insurance business in California as CFGIS Insurance Agency), member FINRA/SIPC. Advisory services are offered through Cetera Investment Advisers LLC. Neither firm is affiliated with the financial institution where investment services are offered.

* Investment products are not FDIC insured * No bank guarantee * Not a deposit * Not insured by any federal government agency * May lose value.

(2) For a comprehensive review of your personal situation, always consult a tax or legal advisor. Neither Cetera, nor any of its representatives may give legal or tax advice.

Table of Contents

Trust and Investment Services: Through our Columbia Trust Company subsidiary, we offer a wide range of high quality fiduciary, investment and administrative trust services, coupled with local, personalized attention to the unique requirements of each trust. Services include Personal Trusts, Special Needs (Supplemental) Trusts, Estate Settlement Services, Investment Agency and Charitable Management Services. A more complete listing of all the services and products available to our customers can be found on Columbia Trust’s website: www.columbiatrustcompany.com. Information contained on Columbia Trust’s website is not incorporated by reference into this report.

Our industry is highly competitive. Several other financial institutions with greater resources compete for banking business in our market areas. These competitors have the ability to make larger loans, finance extensive advertising and promotional campaigns, access international financial markets and allocate their investment assets to regions of highest yield and demand. In addition to competition from other banking institutions, we continue to compete with non-banking companies such as credit unions, brokerage houses, financial technology companies and other financial services companies. We compete for deposits, loans, and other financial services by offering our customers similar breadth of products as our larger competitors while delivering a more personalized service level.

As of December 31, 2018, the Company employed 2,137 full-time equivalent employees. We value our employees and pride ourselves on providing a professional work environment accompanied by comprehensive pay and benefit programs. We are committed to providing flexible and value-added benefits to our employees through a “Total Compensation Philosophy” which incorporates all compensation and benefits. Our continued commitment to employees was demonstrated by Columbia Bank being honored as one of the Puget Sound Business Journal’s “Washington’s Best Workplaces” for the 12th consecutive year.

We file annual reports on Form 10-K, quarterly reports on Form 10-Q, periodic reports on Form 8-K, proxy statements and other information with the United States Securities and Exchange Commission (the “SEC”). The public may obtain copies of these reports and any amendments at the SEC’s Internet site, www.sec.gov.

Additionally, reports filed with the SEC can be obtained free of charge through our website at www.columbiabank.com. These reports are made available through our website as soon as reasonably practicable after they are filed electronically with the SEC. Information contained on our website is not incorporated by reference into this report.

The following discussion provides an overview of certain elements of the extensive regulatory framework applicable to the Company and Columbia State Bank, which operates under the name Columbia Bank in Washington, Oregon and Idaho. This regulatory framework is primarily designed for the protection of depositors, customers, federal deposit insurance funds and the banking system as a whole, rather than specifically for the protection of shareholders or non-depository creditors. Due to the breadth and growth of this regulatory framework, our costs of compliance continue to increase in order to monitor and satisfy these requirements.

To the extent that this section describes statutory and regulatory provisions, it is qualified by reference to those provisions. These statutes and regulations, as well as related policies, are subject to change by Congress, state legislatures and federal and state regulators. Changes in statutes, regulations or regulatory policies applicable to us, including the interpretation or implementation thereof, cannot be predicted, but may have a material effect on our business, financial condition, or results of operations. In light of the 2008 financial crisis, numerous changes to the statutes, regulations or regulatory policies applicable to us have been made or proposed. The full extent to which these changes will impact our business is not yet known. In addition, recent political developments, including the change in the presidential administration in the United States, have added additional uncertainty to the implementation, scope and timing of regulatory reforms. However, our continued efforts to monitor and comply with new regulatory requirements add to the complexity and cost of our business.

Table of Contents

General. The Company is a bank holding company as defined in the Bank Holding Company Act of 1956, as amended (the “BHCA”), and is therefore subject to regulation, supervision and examination by the Federal Reserve. In general, the BHCA limits the business of bank holding companies to owning or controlling banks and engaging in other activities closely related to banking. The Company must file reports with and provide the Federal Reserve such additional information as it may require. Under the Financial Services Modernization Act of 1999, a bank holding company may apply to the Federal Reserve to become a financial holding company, and thereby engage (directly or through a subsidiary) in certain expanded activities deemed financial in nature, such as securities and insurance underwriting. As of the date of this report, we have not elected to be treated as a financial holding company.

Holding Company Bank Ownership. The BHCA requires every bank holding company to obtain the prior approval of the Federal Reserve before (i) acquiring, directly or indirectly, ownership or control of any voting shares of another bank or bank holding company if, after such acquisition, it would own or control more than 5% of such shares; (ii) acquiring all or substantially all of the assets of another bank or bank holding company; or (iii) merging or consolidating with another bank holding company. In addition, under the Bank Merger Act of 1960, as amended, the prior approval of the FDIC is required for the Bank to merge with another bank or purchase all or substantially all of the assets or assume any of the deposits of another FDIC-insured depository institution. In reviewing applications seeking approval of merger and acquisition transactions, bank regulators consider, among other things, the competitive effect and public benefits of the transactions, the capital position and managerial resources of the combined organization, the risks to the stability of the U.S. banking or financial system, the applicant’s performance record under the Community Reinvestment Act of 1977 (the “CRA”), the applicant’s compliance with fair housing and other consumer protection laws and the effectiveness of all organizations involved in combating money laundering activities. In addition, failure to implement or maintain adequate compliance programs could cause bank regulators not to approve an acquisition where regulatory approval is required or to prohibit an acquisition even if approval is not required.

Holding Company Control of Nonbanks. With some exceptions, the BHCA also prohibits a bank holding company from acquiring or retaining direct or indirect ownership or control of more than 5% of the voting shares of any company which is not a bank or bank holding company, or from engaging directly or indirectly in activities other than those of banking, managing or controlling banks, or providing services for its subsidiaries. The principal exceptions to these prohibitions involve certain non-bank activities that, by statute or by Federal Reserve regulation or order, have been identified as activities so closely related to the business of banking as to be a proper incident thereto, such as Columbia Trust.

Tying Arrangements. We are prohibited from engaging in certain tie-in arrangements in connection with any extension of credit, sale or lease of property or furnishing of services. For example, with certain exceptions, neither the Company nor its subsidiaries may condition an extension of credit to a customer on either (i) a requirement that the customer obtain additional services provided by us; or (ii) an agreement by the customer to refrain from obtaining other services from a competitor.

Support of Subsidiary Banks. Under Federal Reserve policy, as codified by the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), the Company is required to act as a source of financial and managerial strength to Columbia Bank, including at times when we may not be in a financial position to provide such resources, and it may not be in our, or our shareholders’, best interests to do so. This means that the Company is required to commit resources, as necessary, to support Columbia Bank. Any capital loans a bank holding company makes to its subsidiary banks are subordinate to deposits and to certain other indebtedness of those subsidiary banks.

State Law Restrictions. As a Washington corporation, the Company is subject to certain limitations and restrictions under applicable Washington corporate law. For example, state law restrictions in Washington include limitations and restrictions relating to indemnification of directors, distributions to shareholders, transactions involving directors, officers or interested shareholders, maintenance of books, records, and minutes, and observance of certain corporate formalities.

General. The deposits of Columbia Bank, a Washington chartered commercial bank with branches in Washington, Oregon and Idaho, are insured by the FDIC. As a result, Columbia Bank is subject to supervision and regulation by the Washington Department of Financial Institutions’ Division of Banks and the FDIC. These agencies have the authority to prohibit banks from engaging in what they believe constitute unsafe or unsound banking practices. Furthermore, under the Federal Deposit Insurance Act (“FDIA”), insurance of deposits may be terminated by the FDIC if the FDIC finds that the insured depository institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC. With respect to branches of Columbia Bank in Oregon and Idaho, the Bank is also subject to certain laws and regulations governing its activities in those states.

Table of Contents

Consumer Protection. The Bank is subject to a variety of federal and state consumer protection laws and regulations that govern its relationship with consumers, including laws and regulations that impose certain disclosure requirements and regulate the manner in which we take deposits, make and collect loans, and provide other services. Failure to comply with these laws and regulations may subject the Bank to various penalties, including but not limited to, enforcement actions, injunctions, fines, civil monetary penalties, criminal penalties, punitive damages, and the loss of certain contractual rights. Columbia Bank has established a compliance management system designed to ensure consumer protection.

Community Reinvestment. The CRA requires that, in connection with examinations of financial institutions within their jurisdiction, the Federal Reserve or the FDIC evaluate the record of the financial institution in meeting the credit needs of its local communities, including low and moderate-income neighborhoods, consistent with the safe and sound operation of the institution. A bank’s community reinvestment record is also considered by the applicable banking agencies in evaluating mergers, acquisitions and applications to open a branch or facility. The Bank’s failure to comply with the CRA could, among other things, result in the denial or delay in connection with such transactions. The Bank received a rating of “satisfactory” in its most recently completed CRA examination.

Anti-Money Laundering and Anti-Terrorism. The Bank Secrecy Act (the “BSA”) requires all financial institutions, including banks to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. It includes a variety of recordkeeping and reporting requirements (such as cash and suspicious activity reporting) as well as due diligence/know-your-customer documentation requirements.

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001, intended to combat terrorism, was renewed with certain amendments in 2006 (the “Patriot Act”). The Patriot Act further augments and strengthens the requirements set forth in the BSA. The Patriot Act, in relevant part, (i) prohibits banks from providing correspondent accounts directly to foreign shell banks; (ii) imposes due diligence requirements on banks opening or holding accounts for foreign financial institutions or wealthy foreign individuals; (iii) requires financial institutions to establish an anti-money-laundering compliance program; and (iv) eliminates civil liability for persons who file suspicious activity reports. The Patriot Act also includes provisions providing the government with power to investigate terrorism, including expanded government access to bank account records. An institution that fails to meet these standards may be subject to regulatory sanctions, including limitations on growth. Columbia Bank has established compliance programs designed to comply with the BSA and the Patriot Act.

Transactions with Affiliates; Insider Credit Transactions. Transactions between the Bank and its subsidiaries, on the one hand, and the Company or any other subsidiary, on the other hand, are regulated under federal banking law. The Federal Reserve Act imposes quantitative and qualitative requirements and collateral requirements on covered transactions by the Bank with, or for the benefit of, its affiliates. In addition, subsidiary banks of a bank holding company are subject to restrictions on extensions of credit to the holding company or its subsidiaries, on investments in securities of the holding company or its subsidiaries and on the use of their securities as collateral for loans to any borrower. These regulations and restrictions may limit the Company’s ability to obtain funds from Columbia Bank for its cash needs, including funds for payment of dividends, interest and operational expenses.

Banks are also subject to certain restrictions imposed by the Federal Reserve Act on extensions of credit to executive officers, directors, principal shareholders or any related interests of such persons. Extensions of credit (i) must be made on substantially the same terms, including interest rates and collateral, and follow credit underwriting procedures that are at least as stringent as those prevailing at the time for comparable transactions with persons not related to the lending bank; and (ii) must not involve more than the normal risk of repayment or present other unfavorable features. Banks are also subject to certain lending limits and restrictions on overdrafts to insiders. A violation of these restrictions may result in the assessment of substantial civil monetary penalties, regulatory enforcement actions, and other regulatory sanctions. The Columbia Bank board has established controls to ensure compliance with regulatory expectations around affiliated transactions.

Regulation of Management. Federal law (i) sets forth circumstances under which officers or directors of a bank may be removed by the institution’s federal supervisory agency; (ii) places restraints on lending by a bank to its executive officers, directors, principal shareholders, and their related interests; and (iii) generally prohibits management personnel of a bank from serving as directors or in other management positions of another financial institution whose assets exceed a specified amount or which has an office within a specified geographic area.

Table of Contents

Safety and Soundness Standards. Certain non-capital safety and soundness standards are also imposed upon banks. These standards cover internal controls, information systems and internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, compensation, fees and benefits, such other operational and managerial standards as the agency determines to be appropriate, and standards for asset quality, earnings and stock valuation. An institution that fails to meet these standards may be subject to regulatory sanctions, including limitations on growth. Columbia Bank has established policies and risk management activities designed to ensure the safety and soundness of the Bank.

The Riegle-Neal Interstate Banking and Branching Efficiency Act of 1994 (the “Interstate Act”) together with the Dodd-Frank Act relaxed prior interstate branching restrictions under federal law by permitting, subject to regulatory approval, state and federally chartered commercial banks to establish branches in states where the laws permit banks chartered in such states to establish branches. The Interstate Act requires regulators to consult with community organizations before permitting an interstate institution to close a branch in a low-income area. Federal banking agency regulations prohibit banks from using their interstate branches primarily for deposit production and the federal banking agencies have implemented a loan-to-deposit ratio screen to ensure compliance with this prohibition.

Columbia is a legal entity separate and distinct from the Bank and its other subsidiaries. As a bank holding company, Columbia is subject to certain restrictions on its ability to pay dividends under applicable banking laws and regulations. Federal bank regulators are authorized to determine under certain circumstances relating to the financial condition of a bank holding company or a bank that the payment of dividends would be an unsafe or unsound practice and to prohibit payment thereof. In particular, federal bank regulators have stated that paying dividends that deplete a banking organization’s capital base to an inadequate level would be an unsafe and unsound banking practice and that banking organizations should generally pay dividends only out of current operating earnings. In addition, in the current financial and economic environment, the Federal Reserve has indicated that bank holding companies should carefully review their dividend policy and has discouraged payment ratios that are at maximum allowable levels unless both asset quality and capital are very strong. A significant portion of our income comes from dividends from the Bank, which is also the primary source of our liquidity. In addition to the restrictions discussed above, the Bank is subject to limitations under Washington law regarding the level of dividends that it may pay to us. Washington law limits a bank’s ability to pay dividends that are greater than the bank’s retained earnings without approval of the applicable banking agency.

In October 2012, as required by the Dodd-Frank Act, the Federal Reserve and the FDIC published final rules regarding company-run stress testing. These rules require bank holding companies and banks with average total consolidated assets greater than $10 billion over a specified period of time to conduct an annual company-run stress test of capital, consolidated earnings and losses under one base and at least two stress scenarios provided by the federal bank regulators. In May 2018, the Economic Growth, Regulatory Relief, and Consumer Protection Act (“EGRRCPA”) was enacted. On January 8, 2019, the Federal Reserve issued proposed rules to amend its stress testing requirements. This followed a similar proposal issued by the FDIC on December 18, 2018. Under the proposed rules, consistent with the requirements imposed by the EGRRCPA, the minimum threshold requiring bank holding companies and state-chartered banks to conduct company-run stress tests would be increased from $10 billion to $250 billion, and would generally require firms above the threshold to conduct company-run stress tests once every other year. We are unable to predict at this time what impact the amendment will have on the Company or the Bank, and any such impact will depend on the final form of the proposed rules. Although the proposed rules would increase the asset size requirement to above our current asset size, we do intend to continue to perform stress testing.

The Federal Reserve monitors the capital adequacy of the Company on a consolidated basis, and the FDIC and the Washington Department of Financial Institutions’ Division of Banks monitor the capital adequacy of the Bank. The risk-based capital standards currently applicable to the Company and the Bank, parts of which are subject to phase-in, are based on the December 2010 final capital framework for strengthening international capital standards, known as Basel III, of the Basel Committee on Banking Supervision (the “Basel Committee”). We believe that, as of December 31, 2018, we and the Bank would meet all capital adequacy requirements under the Capital Rules, as described below, on a fully phased-in basis as if such requirements were then in effect.

Table of Contents

Prior to January 1, 2015, the risk-based capital standards applicable to the Company and the Bank were based on the 1988 Capital Accord, known as Basel I, of the Basel Committee. In July 2013, the federal bank regulators approved final rules implementing Basel III and various provisions of the Dodd-Frank Act (the “Capital Rules”). The Capital Rules substantially revised the risk-based capital requirements applicable to bank holding companies and banks, including us and the Bank, compared to the risk-based capital rules in effect at December 31, 2014. The Capital Rules revised the components of capital and addressed other issues affecting the numerator in regulatory capital ratio calculations. The Capital Rules also addressed risk weights and other issues affecting the denominator in regulatory capital ratio calculations, including by replacing the prior risk-weighting approach derived from Basel I with a more risk-sensitive approach based, in part, on the standardized approach adopted by the Basel Committee in its 2004 capital accords, known as Basel II. The Capital Rules also implemented the requirements of Section 939A of the Dodd-Frank Act to remove references to credit ratings from the federal bank regulators’ rules. Subject to a phase-in period for various provisions, the Capital Rules, became effective for us and for the Bank on January 1, 2015.

The Capital Rules, among other things (i) include a capital measure called Common Equity Tier 1 (“CET1”), (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting specified requirements, (iii) define CET1 narrowly by requiring that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital and (iv) expand the scope of the deductions/adjustments to capital as compared to existing regulations.

Under the Capital Rules, the minimum capital ratios as of January 1, 2015 are (i) 4.5% CET1 to risk-weighted assets, (ii) 6% Tier 1 capital (that is, CET1 plus Additional Tier 1 capital) to risk-weighted assets and (iii) 8% total capital (that is, Tier 1 capital plus Tier 2 capital) to risk-weighted assets.

Subject to a transition schedule that was fully phased in on January 1, 2019, the Capital Rules also require an institution to establish a capital conservation buffer of CET1 in an amount above the minimum risk-based capital requirements for “adequately capitalized” institutions equal to 2.5% of total risk-weighted assets. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer will face constraints on dividends, equity repurchases and compensation based on the amount of the shortfall and the institution’s “eligible retained income” (that is, four quarter trailing net income, net of distributions and tax effects not reflected in net income).

The Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, certain deferred tax assets and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. Implementation of the deductions and other adjustments to CET1 began on January 1, 2015 and was fully phased in as of January 1, 2019. The Capital Rules also generally preclude certain hybrid securities, such as trust preferred securities, from being counted as Tier 1 capital for most bank holding companies. However, bank holding companies such as us who had less than $15 billion in assets as of December 31, 2009 (and who continue to have less than $15 billion in assets) are permitted to include trust preferred securities issued prior to May 19, 2010 as Additional Tier 1 capital under the Capital Rules.

The Capital Rules also prescribe a new standardized approach for risk weightings that expands the risk-weighting categories from four Basel I-derived categories (0%, 20%, 50% and 100%) to a much larger and more risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. government and agency securities to 600% for certain equity exposures and resulting in higher risk weights for a variety of asset categories.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms. The standards are commonly referred to as “Basel IV.” Among other things, these standards revise the Basel Committee’s standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain “unconditionally cancellable commitments,” such as home equity lines of credit) and provides a new standardized approach for operational risk capital. Under the Basel framework, these standards will generally be effective on January 1, 2022, with an aggregate output floor phasing in through January 1, 2027. Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to advanced approach institutions. The impact of Basel IV on the Company and the Bank will depend on the manner in which it is implemented by the federal bank regulators.

With respect to the Bank, the Capital Rules also revise the prompt corrective action regulations pursuant to Section 38 of the FDIA. See “Prompt Corrective Action Framework.”

Table of Contents

The FDIA requires the federal bank regulators to take prompt corrective action in respect of depository institutions that fail to meet specified capital requirements. The FDIA establishes five capital categories (“well-capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” and “critically undercapitalized”), and the federal bank regulators are required to take certain mandatory supervisory actions, and are authorized to take other discretionary actions, with respect to institutions that are undercapitalized, significantly undercapitalized or critically undercapitalized. The severity of these mandatory and discretionary supervisory actions depends upon the capital category in which the institution is placed. Generally, subject to a narrow exception, the FDIA requires the regulator to appoint a receiver or conservator for an institution that is critically undercapitalized.

Under the rules currently in effect and as modified by the Capital Rules, an insured depository institution generally would be classified in the following categories based on the capital measures indicated:

“Well-capitalized” “Adequately capitalized” Total capital ratio of at least 10%, Total capital ratio of at least 8%, Tier 1 capital ratio of at least 8%, Tier 1 capital ratio of at least 6% CET1 ratio of at least 6.5% CET1 ratio of at least 4.5%, and Tier 1 leverage ratio of at least 5%, and Tier 1 leverage ratio of at least 4%. Not subject to any order or written directive requiring a specific capital level. “Undercapitalized” “Significantly undercapitalized” Total capital ratio of less than 8%, Total capital ratio of less than 6%, Tier 1 capital ratio of less than 6% Tier 1 capital ratio of less than 4% CET1 ratio of less than 4.5%, or CET1 ratio of less than 3%, or Tier 1 leverage ratio of less than 4%. Tier 1 leverage ratio of less than 3%. “Critically undercapitalized” Tangible equity to average quarterly tangible assets of 2% or less.

An institution may be downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios if it is determined to be in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters. A bank’s capital category is determined solely for the purpose of applying prompt corrective action regulations, and the capital category may not constitute an accurate representation of the bank’s overall financial condition or prospects for other purposes.

As of December 31, 2018, we and the Bank met the capital requirements to be well-capitalized with CET1 capital ratios of 12.7401% and 12.9576%, respectively, Tier 1 capital ratios of 12.7401% and 12.9576%, respectively, total capital ratios of 13.9920% and 13.8494%, respectively, and Tier 1 leverage ratios of 10.2444% and 10.4185%, respectively.

An institution that is categorized as undercapitalized, significantly undercapitalized or critically undercapitalized is required to submit an acceptable capital restoration plan to its appropriate federal bank regulator. Under the FDIA, in order for the capital restoration plan to be accepted by the appropriate federal banking agency, a bank holding company must guarantee that a subsidiary depository institution will comply with its capital restoration plan, subject to certain limitations. The bank holding company must also provide appropriate assurances of performance. The obligation of a controlling bank holding company under the FDIA to fund a capital restoration plan is limited to the lesser of 5% of an undercapitalized subsidiary’s assets or the amount required to meet regulatory capital requirements. An undercapitalized institution is also generally prohibited from increasing its average total assets, making acquisitions and capital distributions, establishing any branches or engaging in any new line of business, except in accordance with an accepted capital restoration plan or with the approval of the FDIC. Institutions that are undercapitalized or significantly undercapitalized and either fail to submit an acceptable capital restoration plan or fail to implement an approved capital restoration plan may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets and cessation of receipt of deposits from correspondent banks. Critically undercapitalized depository institutions failing to submit or implement an acceptable capital restoration plan are subject to appointment of a receiver or conservator.

Table of Contents

The FDIA prohibits an insured depository institution from accepting brokered deposits or offering interest rates on any deposits significantly higher than the prevailing rate in the bank’s normal market area or nationally (depending upon where the deposits are solicited), unless it is well-capitalized or is adequately capitalized and receives a waiver from the FDIC. A depository institution that is adequately capitalized and accepts brokered deposits under a waiver from the FDIC may not pay an interest rate on any deposit in excess of 75 basis points over certain prevailing market rates.

On December 18, 2018, the FDIC issued an advance notice of proposed rulemaking in connection with the FDIC’s comprehensive review of its regulatory approach to brokered deposits to solicit comment on all aspects of the FDIC’s brokered deposit regulations. The Company is not able to predict at this time whether any regulatory changes will be adopted as a result of the FDIC’s notice, or what impact if any, such changes would have on the Bank.

The Federal Reserve conducts periodic inspections of bank holding companies. The supervisory objectives of the inspection program are to ascertain whether the financial strength of the bank holding company is being maintained on an ongoing basis and to determine the effects or consequences of transactions between a holding company or its non-banking subsidiaries and its subsidiary banks.

Banks are subject to periodic examinations by their primary regulators. Bank examinations have evolved from reliance on transaction testing in assessing a bank’s condition to a risk-focused approach. These examinations are extensive and cover the entire breadth of operations of the bank. Generally, FDIC safety and soundness examinations for a bank of our size are completed on an annual basis through the execution of a quarterly focal review process. The FDIC and state bank regulatory agencies complete these examinations on a combined schedule.

The Consumer Financial Protection Bureau (the “CFPB”) has primary examination and enforcement authority over institutions with assets of $10 billion or more, including the Bank, with respect to various federal consumer protection laws, and we are subject to continued examination by the FDIC on certain consumer regulations. State authorities are also responsible for monitoring our compliance with all state consumer laws.

The frequency of consumer compliance and CRA examinations is linked to the size of the institution and its compliance and CRA ratings at its most recent examinations. However, the examination authority of the Federal Reserve and the FDIC allows them to examine supervised banks as frequently as deemed necessary based on the condition of the bank or as a result of certain triggering events.

The Sarbanes-Oxley Act of 2002 (“SOX”) addresses, among other things, corporate governance, auditing and accounting, enhanced and timely disclosure of corporate information, and penalties for non-compliance. Generally, SOX (i) requires chief executive officers and chief financial officers to certify to the accuracy of periodic reports filed with the SEC; (ii) imposes specific and enhanced corporate disclosure requirements; (iii) accelerates the time frame for reporting of insider transactions and periodic disclosures by public companies; (iv) requires companies to adopt and disclose information about corporate governance practices, including whether or not they have adopted a code of ethics for senior financial officers and whether the audit committee includes at least one “audit committee financial expert;” and (v) requires the SEC, based on certain enumerated factors, to regularly and systematically review corporate filings.

Table of Contents

The Bank’s deposits are insured under the FDIA, up to the maximum applicable limits and are subject to deposit insurance assessments designed to tie what banks pay for deposit insurance to the risks they pose. The Dodd-Frank Act broadened the base for FDIC insurance assessments. Under the FDIC’s assessment system for determining payments to the Deposit Insurance Fund (the “DIF”), insured depository institutions with more than $10 billion in assets (“large IDIs”) are assessed under a complex “scorecard” methodology that seeks to capture both the probability that an individual large IDI will fail and the magnitude of the impact on the DIF if such a failure occurs. The assessment base of a large IDI is its total assets less tangible equity. In addition, the Dodd-Frank Act raised the minimum designated reserve ratio (the FDIC is required to set the reserve ratio each year) of the Deposit Insurance Fund (the “DIF”) from 1.15% to 1.35%; required that the DIF meet that minimum ratio of insured deposits by 2020; and eliminated the requirement that the FDIC pay dividends to insured depository institutions when the reserve ratio exceeds certain thresholds. The rule imposed a surcharge on the assessments of depository institutions with $10 billion or more in assets beginning in the third quarter of 2016. The surcharge continued through September 30, 2018, when the reserve ratio reached 1.36% of insured deposits, exceeding the statutorily required minimum reserve ratio of 1.35%.

As a result of the financial crisis, on July 21, 2010, the Dodd-Frank Act was signed into law. The Dodd-Frank Act significantly changed the bank regulatory structure and is affecting the lending, deposit, investment, trading and operating activities of financial institutions and their holding companies, including the Company and Columbia Bank. The full impact of the Dodd-Frank Act may not be known for years. Some of the provisions of the Dodd-Frank Act that may impact our business are summarized below.

Corporate Governance. The Dodd-Frank Act requires publicly traded companies to provide their shareholders with (i) a non-binding shareholder vote on executive compensation, (ii) a non-binding shareholder vote on the frequency of such vote, (iii) disclosure of “golden parachute” arrangements in connection with specified change in control transactions, and (iv) a non-binding shareholder vote on golden parachute arrangements in connection with these change in control transactions.

Risk Committee. The Dodd-Frank Act required bank holding companies with in excess of $10 billion in total consolidated assets to establish a dedicated risk committee of the board of directors responsible for overseeing enterprise wide risk management policies. The Company has established such a risk committee; however, the EGRRCPA amended the risk committee provision to require risk committees for bank holding companies with $50 billion or more in total consolidated assets.

Prohibition Against Charter Conversions of Troubled Institutions. The Dodd-Frank Act generally prohibits a depository institution from converting from a state to federal charter, or vice versa, while it is subject to an enforcement action unless the bank seeks prior approval from its regulator and complies with specified procedures to ensure compliance with the enforcement action.

Consumer Financial Protection Bureau. As described above, we are subject to oversight and examination by the CFPB because our total consolidated assets exceed $10 billion.

Repeal of Demand Deposit Interest Prohibition. The Dodd-Frank Act repealed the federal prohibitions on the payment of interest on demand deposits, thereby permitting depository institutions to pay interest on business transaction and other accounts.

The Volcker Rule. The Dodd-Frank Act prohibits banks and their affiliates from engaging in proprietary trading and investing in and sponsoring hedge funds and private equity funds. The statutory provision is commonly called the “Volcker Rule.” The Volcker Rule does not significantly impact the operations of the Company and the Bank, as we do not have any significant engagement in the businesses prohibited by the Volcker Rule.

Interchange Fees. Under the Durbin Amendment to the Dodd-Frank Act, the Federal Reserve adopted rules establishing standards for assessing whether the interchange fees that may be charged with respect to certain electronic debit transactions are “reasonable and proportional” to the costs incurred by issuers for processing such transactions.

Table of Contents

Interchange fees, or “swipe” fees, are charges that merchants pay to us and other card-issuing banks for processing electronic payment transactions. Under the final rules, the maximum permissible interchange fee is equal to no more than 21 cents plus 5 basis points of the transaction value for many types of debit interchange transactions. The Federal Reserve also adopted a rule to allow a debit card issuer to recover one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements required by the Federal Reserve. The Federal Reserve also has rules governing routing and exclusivity that require issuers to offer two unaffiliated networks for routing transactions on each debit or prepaid product.

The Dodd-Frank Act requires the federal bank regulators and the SEC to establish joint regulations or guidelines prohibiting incentive-based payment arrangements at specified regulated entities, including us and the Bank, having at least $1 billion in total assets that encourage inappropriate risks by providing an executive officer, employee, director or principal stockholder with excessive compensation, fees, or benefits or that could lead to material financial loss to the entity. In addition, these regulators must establish regulations or guidelines requiring enhanced disclosure to regulators of incentive-based compensation arrangements.

In June 2010, the Federal Reserve and FDIC issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that appropriately balance risk and financial results in a manner that does not encourage employees to expose their organizations to imprudent risk, (ii) be compatible with effective internal controls and risk management and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

During the second quarter of 2016, the U.S. financial regulators, including the Federal Reserve and the SEC, proposed revised rules on incentive-based payment arrangements at specified regulated entities having at least $1 billion in total assets. The proposed revised rules would establish general qualitative requirements applicable to all covered entities, which would include (i) prohibiting incentive arrangements that encourage inappropriate risks by providing excessive compensation; (ii) prohibiting incentive arrangements that encourage inappropriate risks that could lead to a material financial loss; (iii) establishing requirements for performance measures to appropriately balance risk and reward; (iv) requiring board of director oversight of incentive arrangements; and (v) mandating appropriate record-keeping. Under the proposed rule, larger financial institutions with total consolidated assets of at least $50 billion would also be subject to additional requirements applicable to such institutions’ “senior executive officers” and “significant risk-takers.”

If the rules are adopted in the form proposed, they may restrict our flexibility with respect to the manner in which we structure compensation and adversely affect our ability to compete for talent.

The Federal Reserve will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as us, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

Proposed legislation relating to the banking industry is introduced in almost every legislative session. Certain of such legislation could dramatically affect the regulation of the banking industry. We cannot predict if any such legislation will be adopted or if it is adopted how it would affect the business of Columbia Bank or the Company. Recent history has demonstrated that new legislation or changes to existing laws or regulations usually results in a greater compliance burden and therefore generally increases the cost of doing business.

Table of Contents

Our earnings and growth are affected not only by general economic conditions, but also by the fiscal and monetary policies of the federal government, particularly the Federal Reserve. The Federal Reserve implements national monetary policy for such purposes as curbing inflation and combating recession, but its open market operations in U.S. government securities, control of the discount rate applicable to borrowings from the Federal Reserve, and establishment of reserve requirements against certain deposits, influence the growth of bank loans, investments and deposits, and also affect interest rates charged on loans or paid on deposits. The nature and impact of future changes in monetary policies and their impact on us cannot be predicted with certainty.

Table of Contents