Evolve Bank and Trust and Evolve Bancorp CD Order

UNITED STATES OF

AMERICA BEFORE THE

BOARD OF GOVERNORS OF THE FEDERAL RESERVE

SYSTEM WASHINGTON, D.C.

ARKANSAS STATE BANK DEPARTMENT

LITTLE ROCK, ARKANSAS

In the Matter of

EVOLVE BANCORP, INC.

West Memphis, Arkansas

and

EVOLVE BANK & TRUST

West Memphis, Arkansas

Docket Nos. 24-012-B-HC

24-012-B-SM

Cease and Desist Order

Issued Upon Consent

Pursuant to the Federal

Deposit Insurance Act,

as amended

WHEREAS, Evolve Bancorp, Inc., West Memphis, Arkansas (“Bancorp”), is a registered

bank holding company, that owns and controls Evolve Bank & Trust, West Memphis, Arkansas

(the “Bank”), a state-chartered bank that is a member of the Federal Reserve System;

WHEREAS, the Board of Governors of the Federal Reserve System (the “Board of

Governors”) is the appropriate federal supervisor of Bancorp and the Bank;

WHEREAS, the Arkansas State Bank Department (the “ASBD”) is the appropriate state

supervisor of Bancorp and the Bank;

WHEREAS, the Bank, through its Open Banking Division (“OBD”), has pursued a

business strategy that primarily involves offering deposit accounts and payment processing

services to financial technology companies (“fintech partners”) that, in turn, offer various financial

products and services to end-user customers, either directly or through a partnership with other

entities”;

WHEREAS, the Federal Reserve Bank of St. Louis (the “Reserve Bank”) and the

ASBD (collectively with the Reserve Bank, the “Supervisors”), in the most recent safety and

soundness examination of the Bank, issued on August 11, 2023, identified deficiencies with

the Bank’s risk management of OBD and other related deficiencies (the “August 11, 2023

Report of Exam”);

WHEREAS, the Reserve Bank’s most recent consumer compliance examination of

the Bank, issued on August 30, 2023, identified deficiencies in the Bank’s management of

OBD’s consumer compliance risk (the “August 30, 2023 Report of Exam”);

WHEREAS, the Supervisors conducted a further examination of the Bank, issued on

January 10, 2024, that identified (i) additional deficiencies with respect to the Bank’s risk

management and compliance with applicable laws, rules, and regulations relating to anti-

money laundering (“AML”), including the Bank Secrecy Act (the “BSA”) (31 U.S.C. § 5311

et seq.); the rules and regulations issued thereunder by the U.S. Department of the Treasury

(31 C.F.R. Chapter X); and the AML requirements of Regulation H of the Board of

Governors (12 C.F.R. §§ 208.62 and 208.63) (collectively, the “BSA/AML Requirements”)

resulting in a compliance program violation, as well as (ii) deficiencies with the Bank’s

compliance related to the regulations issued by the Office of Foreign Assets Control of the

U.S. Department of the Treasury (“OFAC”) (31 C.F.R. Chapter V)(the “OFAC Regulations”)

(the “January 10, 2024 Report of Exam,” and collectively with the August 11, 2023 Report of

Exam and the August 30, 2023 Report of Exam, the “Reports of Examination”);

WHEREAS, Bancorp and the Bank have initiated remedial actions to address the

above deficiencies;

WHEREAS, it is the common goal of Bancorp, the Bank, the Board of Governors,

and the ASBD that Bancorp and the Bank comply with all applicable federal and state laws,

regulations, and rules;

WHEREAS, Bancorp, the Bank, the Board of Governors, and the ASBD have

mutually agreed to enter into this consent Cease and Desist Order (the “Order”); and

WHEREAS, the boards of directors of Bancorp and the Bank have authorized the

undersigned to enter into this Order and consent to compliance with each and every provision

of this Order by Bancorp and the Bank and to waive any and all rights that Bancorp and the

Bank may have pursuant to section 8 of the Federal Deposit Insurance Act, as amended (the

“FDI Act”) (12 U.S.C. § 1818), including, but not limited to: (i) the issuance of a notice of

charges on any matters set forth in this Order; (ii) a hearing for the purpose of taking evidence

on any matters set forth in this Order; (iii) judicial review of this Order; and (iv) challenge or

contest, in any manner, the basis, issuance, validity, terms, effectiveness or enforceability of

the Order or any provision hereof.

NOW, THEREFORE, before the filing of any notices, or taking of any testimony or

adjudication of or finding on any issues of fact or law herein, and solely for the purpose of

settling this matter without a formal proceeding being filed and without the necessity for

protracted or extended hearings or testimony, pursuant to section 8(b)(1) and (3) of the FDI

Act (12 U.S.C. § 1818(b)(1) and 1818(b)(3)), it is hereby ordered that Bancorp and the Bank

shall cease and desist and take affirmative action as follows:

Source of Strength

1. The board of directors of Bancorp shall take appropriate steps to fully utilize

Bancorp’s financial and managerial resources, pursuant to section 38A of the FDI Act (12

U.S.C. § 1831o-1) and section 225.4(a) of Regulation Y of the Board of Governors (12

C.F.R. § 225.4(a)), to serve as a source of strength to the Bank, including, but not limited to,

taking steps to ensure that the Bank complies with this Order and any other supervisory

action taken by the Bank’s federal or state regulators.

Board Oversight

2. Within 90 days of the effective date of this Order, the board of directors of the

Bank shall submit a written plan acceptable to the Supervisors to strengthen board oversight

of (i) the management and operations of the Bank and (ii) the Bank’s compliance with the

BSA/AML Requirements and the OFAC Regulations. The plan shall include the following

eight items:

(a) steps to ensure that the Bank’s board of directors monitors

management’s adherence to applicable laws and regulations, approved policies and

procedures, and exceptions to approved policies and procedures;

(b) measures to ensure that the board of directors provides adequate

resources to ensure the Bank’s compliance with this Order, including, but not limited to,

providing sufficient staffing levels with the requisite qualifications, skills, and training to

competently perform present and anticipated duties, including internal audit;

maintain effective control over, and supervision of, the Bank’s major operations and

activities, including the Bank’s lending, earnings, internal audit, OBD’s activities, risk

management practices with respect to credit, interest rate risk, and information technology,

and adherence to approved risk limits;

(d) actions by the board of directors to maintain effective control over and

oversight of Bank management’s compliance with the BSA/AML Requirements and the

OFAC Regulations and approved policies, procedures, and standards related to the same;

(e) measures to improve the quality, comprehensiveness, and granularity

of information reported to the board of directors in its oversight of the operations and

management of the Bank, including information relating to the following items:

(i) lending, earnings, internal audit, OBD’s activities, compliance

with the BSA/AML Requirements and OFAC Regulations, and risk management practices

related to credit, interest rate risk, and information technology; and

(ii) measures to ensure outstanding issues related to the

management and operation of the Bank, and noncompliance with the BSA/AML

Requirements and OFAC Regulations, are appropriately tracked and escalated, and their status

of remediation is reviewed by the Bank’s senior management;

(f) the maintenance of adequate and complete minutes of meetings of the

board of directors, or any committee thereof, related to OBD;

(g) measures to ensure that those at the Bank charged with responsibility

for the Bank’s compliance with the BSA/AML Requirements and the OFAC Regulations

possess appropriate subject matter expertise, stature, and direct reporting access to the board

of directors, or the relevant committee, to carry out such responsibilities; and

(h) measures to ensure the Bank has adequate resources to comply with

the BSA/AML Requirements and OFAC Regulations, including sufficient staffing levels, and

periodic re-evaluation of resource and staffing needs.

Open Banking Division Risk Management

3. (a) Within 90 days of the effective date of this Order, the Bank shall

submit a written plan acceptable to the Supervisors to enhance the Bank’s risk management of

OBD. The plan shall include the following four items:

(i) written policies and procedures to identify, manage, and

monitor potential risks, including compliance, and fraud risks, associated with each fintech

partner, product, program, service, business line, or customer;

(ii) measures to ensure that the individuals or groups charged with

responsibility for OBD possess the appropriate subject matter expertise, stature,

independence, and authority; have clearly defined roles and responsibilities; and are allocated

adequate resources and staffing;

(iii) steps to enable the timely identification, measurement, and

reporting of risk exposures associated with each fintech partner, product, program, service,

business line, or customer, including:

(A) a common risk assessment and rating methodology that

is regularly updated to account for changes in relevant risk factors;

(B) appropriate policies, processes, and risk management

standards and rating methodology for the onboarding, regular risk monitoring, and

offboarding of OBD fintech partners and customers;

controls to ensure that ledger and sub-ledger responsibilities of the Bank and fintech partners

are clearly defined, established, and maintained, including in the event of a material business

disruption;

(D) the establishment of appropriate compensating controls

to mitigate risks; and

(E) the provision of sufficient information, data, and reports

to senior management and the board of directors that enable proper identification and

oversight of existing and developing risks; and

(iv) measures to ensure that the Bank’s board of directors or a

committee thereof provide written approval prior to implementing, distributing, or marketing

new products, programs, services, business lines, or onboarding of new fintech partners or

customers through OBD.

(b) (i) Within 60 days of the effective date of this Order, the Bank’s

senior management shall submit a written plan acceptable to the Supervisors to enhance the

OBD consumer compliance management program. The plan shall include the following two

items:

(A) policies and procedures to ensure that consumer

complaints are monitored, investigated, responded to, and escalated promptly and

thoroughly; and

(B) policies and procedures for fintech partners that address

end customer user complaint identification, categorization, investigation, response, root

cause and/or trend identification and analyses, remediation tracking, remediation validation,

and periodic reporting to the Bank.

(ii) Within 60 days of the effective date of this Order, the Bank

shall retain an independent third party acceptable to the Supervisors to: (i) conduct a

comprehensive review of the effectiveness of OBD’s program for compliance with consumer

laws and regulations (the “OBD Consumer Compliance Review”), and (ii) prepare a written

report of findings, conclusions, and recommendations (the “OBD Consumer Compliance

Report”). The OBD Consumer Compliance Review shall include the following three items:

(A) an evaluation of OBD’s initial and periodic consumer

compliance risk assessment methodology, procedures, and processes to ensure consistent and

adequate assessment and documentation of consumer compliance risk;

(B) an assessment of OBD’s oversight of the fintech

partners’ policies, procedures, and training to ensure their compliance with all applicable

consumer laws and regulations and related contractual requirements; and

has an adequate consumer compliance program that is commensurate with its risk profile.

(iii) Within 10 days of the Supervisors’ approval of the independent

third party, the Bank shall submit an engagement letter to the Supervisors for approval. The

engagement letter shall require the independent third party to submit the OBD Consumer

Compliance Report within 90 days of regulatory approval of the engagement letter and a

commitment that the OBD Consumer Compliance Report will be provided to the

Supervisors.

acceptable to the Supervisors to improve the Bank’s capital risk management by considering

OBD’s activities. The plan shall include the following two items:

(i) measures to improve the Bank’s capital planning framework to

account for the Bank’s elevated risk profile, business model, OBD activities, and fintech

partners; and

(ii) evaluation of the adequacy of the Bank’s capital, considering

the volume of adversely classified assets, concentrations of credit, the adequacy of its

allowance for credit losses (“ACL”), current and projected asset growth, projected earnings,

and anticipated and contingency funding needs.

(d) Within 60 days of the effective date of this Order, the Bank shall

submit a written plan acceptable to the Supervisors to improve the Bank’s liquidity risk

management by considering OBD’s activities and significant funding concentrations. The

plan shall include the following three items:

(i) steps to improve oversight by and reporting to the board of

directors of funding sources and uses, concentrations, and contingency funding availability;

(ii) actions to manage funding concentration levels through

diversification of funding sources outside of OBD and establishment of concentration risk

limits within all funding sources; and

(iii) improved liquidity planning and managerial response plans that

are tailored to the Bank’s business model and include impact on earnings, capital, and

applicable regulatory restrictions.

Lending and Credit Risk Management

4. Within 60 days of the effective date of this Order, the Bank shall submit

improved lending and credit risk management policies and procedures for OBD, acceptable

to the Supervisors, that shall include the following two items:

(a) underwriting standards that require documented analyses of:

(i) the borrower’s repayment sources, global cash flow, and

overall debt service ability; and

(ii) the value of any collateral; and

(b) policies and procedures to ensure compliance with loan documentation

and collateral requirements to minimize exceptions, including:

(i) standardized financial documentation required of each fintech

partner;

(ii) establishment of an exception tracking system; and

(iii) required continuous monitoring by senior management and

periodic reporting to the board of directors.

Interest Rate Risk Management

5. Within 60 days of the effective date of this Order, the Bank shall submit a

written plan acceptable to the Supervisors to enhance interest rate risk management practices

that are appropriate for the size and complexity of the Bank. The plan shall include the

following three items:

(a) adequate guidelines and systems, including effective modeling, to

measure, monitor, and control the Bank’s interest rate risk;

(b) appropriate parameters governing the economic risk to the Bank’s

capital due to changes in interest rates; and

consistent with the Interagency Advisory on Interest Rate Risk dated January 11, 2010 (SR

10-1).

Information Technology and Information Security

6. Within 60 days of the effective date of this Order, the Bank shall submit a

written plan acceptable to the Supervisors, including timetables, to correct the information

technology and information security deficiencies identified in the Reports of Examination.

Internal Audit

7. Within 60 days of the effective date of this Order, the Bank shall submit to the

Supervisors an acceptable enhanced written internal audit program for the Bank. The program

shall include the following six items:

(a) completion, at least annually, of a written, board-approved, risk-based

audit plan for the Bank;

(b) controls to ensure audits are completed on a timely basis in accordance

with the approved audit plan;

individuals possessing appropriate experience, knowledge, and skills with the ability to

escalate findings to the board of directors or committee thereof;

(d) requirements for detailed, comprehensive audit reports and adequate

work papers to support and evidence the audit work performed;

(e) timely resolution of audit findings and follow-up reviews to ensure

completion of corrective measures; and

(f) timely distribution of audit reports and comprehensive tracking and

reporting of the status and resolution of audit and examination findings to the audit

committee.

BSA/AML Compliance Review

8. Within 90 days of the effective date of this Order, the Bank shall retain an

independent third party acceptable to the Supervisors (the “Compliance Review Consultant”)

to conduct a comprehensive review of the effectiveness of the Bank’s program for

compliance with the BSA/AML Requirements (the “Compliance Review”), and to prepare a

written report of findings and recommendations (the “Compliance Report”). The

Compliance Review shall include the following two items:

(a) identification of all Bank fintech partners, business lines, activities,

and products to ensure that such fintech partners, business lines, activities, and products are

appropriately risk-rated and included in the Bank’s BSA/AML compliance program, policies,

and procedures; and

(b) a comprehensive assessment of the Bank’s BSA/AML compliance

program, policies, and procedures.

9. Within 10 days of the Supervisors’ approval of the Compliance Review

Consultant, the Bank shall submit an engagement letter to the Supervisors for approval. The

engagement letter shall require the Compliance Review Consultant to submit the Compliance

Report within 60 days of regulatory approval of the engagement letter and a commitment that

the Compliance Report will be provided to the Supervisors.

BSA/AML Compliance Program

10. Within 60 days of receipt of the Compliance Report, the Bank shall submit a

written BSA/AML compliance program acceptable to the Supervisors. The program shall

include the following five items:

(a) a system of internal controls reasonably designed to ensure ongoing

compliance with the BSA/AML Requirements;

(b) a comprehensive risk assessment that appropriately identifies and

considers all products and services of the Bank, customer types, geographic locations, and

transaction volumes, as appropriate, in determining inherent and residual risks;

timely reviews of the Bank’s BSA/AML compliance program are performed on a regular

basis by qualified parties who are independent of the Bank’s business lines and compliance

function, provided, however, that the first independent test of the Bank’s BSA/AML

compliance program shall be conducted by an independent third party acceptable to the

Supervisors;

(d) management of the Bank’s BSA/AML compliance program by a

qualified compliance officer, who is given full autonomy, independence, and responsibility

for implementing and maintaining an effective BSA/AML compliance program that is

commensurate with the Bank’s size and risk profile, has meaningful decision-making

authority, and is supported by adequate staffing levels and resources; and

(e) effective training for all personnel, including targeted training for

personnel with compliance-related responsibilities, in all aspects of the BSA/AML

Requirements and applicable internal policies and procedures.

Customer Due Diligence

11. Within 60 days of receipt of the Compliance Report, the Bank shall submit a

written customer due diligence program acceptable to the Supervisors. The program shall

include the following five items:

(a) policies, procedures, and controls to ensure that the Bank collects,

analyzes, and retains complete and accurate information for all customers, including, but not

limited to:

(i) documentation necessary to verify the identity, source of

wealth, and business activities of the customer; and

(ii) documentation necessary to understand the normal and

expected transactions of the customer;

(b) a plan, with intermediate timelines and milestones, to remediate

deficient due diligence for existing OBD customers;

factors such as type of customer, type of products and services, geographic location, and

transaction type and volume;

(d) a risk-focused assessment of the Bank’s customer base to:

(i) identify customers whose transactions and banking activities

are routine and usual;

(ii) identify customers that pose a heightened risk of conducting

potentially illicit activities at or through the Bank; and

(iii) determine the appropriate level of enhanced due diligence

when required by law and additional due diligence necessary for those customers that pose a

heightened risk of conducting potentially illicit activities at or through the Bank; and

(e) procedures to ensure that periodic reviews and evaluations of customer

and account information are conducted and documented for all account holders.

Transaction Monitoring System

12. Within 90 days of the effective date of this Order, the Bank shall engage an

independent third party (the “Transaction Monitoring System Consultant”) acceptable to the

Supervisors to: (i) validate the effectiveness of the Bank’s transaction monitoring system

(“Transaction Monitoring System Validation”) and (ii) prepare a written report of findings,

conclusions, and recommendations (the “Transaction Monitoring System Report”). The

Transaction Monitoring System Validation shall include the following three items:

(a) evaluation of the appropriateness of filtering criteria and thresholds

used in the Bank’s transaction monitoring system;

(b) testing of the Bank’s transaction monitoring system to ensure that

intended information is accurately captured; and

monitoring system and associated processes are subject to periodic reviews and timely

updates.

13. Within 10 days of the Supervisors’ approval of the Transaction Monitoring

System Consultant, the Bank shall submit an engagement letter to the Supervisors for

approval. The engagement letter shall require the Transaction Monitoring System Consultant

to submit the Transaction Monitoring System Report within 60 days of regulatory approval

of the engagement letter and a commitment that the Transaction Monitoring System Report

will be provided to the Supervisors.

14. Within 60 days of the completion of the Transaction Monitoring System

Report, the Bank shall submit to the Supervisors an acceptable written plan to address

findings and correct any deficiencies cited in the Transaction Monitoring System Report.

Interim Transaction Monitoring Procedures

15. Within 30 days of the effective date of this Order, the Bank shall submit to the

Supervisors acceptable written interim transaction monitoring procedures for international

wire services that shall remain in effect until the policies and procedures referred to in

paragraph 16 have been determined to be acceptable by the Supervisors and fully

implemented by the Bank. These interim procedures shall be designed to monitor the

transactions of the Bank so that it can immediately comply with applicable BSA/AML

Requirements.

Suspicious Activity Monitoring and Reporting

16. Within 60 days of receipt of the Transaction Monitoring System Report, the

Bank shall submit a written program acceptable to the Supervisors to reasonably ensure the

identification and timely, accurate, and complete reporting by the Bank of all known or

suspected violations of law or suspicious transactions to law enforcement and supervisory

authorities, as required by applicable suspicious activity reporting laws and regulations. The

program shall include the following five items:

(a) a well-documented methodology for establishing monitoring rules and

processes that take into consideration the Bank’s risk profile, type of customer, type of

product or service, geographic location, and banking activities;

(b) policies and procedures that provide for periodic review of the

monitoring rules and thresholds;

timely detection, investigation, and reporting of all known or suspected violations of law and

suspicious transactions, including:

(i) effective monitoring of customer accounts and transactions;

(ii) appropriate allocation of resources to manage alert and case

inventory;

(iii) adequate escalation of information about potentially suspicious

activity through appropriate levels of management; and

(iv) maintenance of sufficient documentation with respect to the

investigation and analysis of potentially suspicious activity, including the resolution and

escalation of concerns;

(d) policies, procedures, and processes for identifying subjects of law

enforcement requests, monitoring the transaction activity of those subjects when appropriate,

identifying unusual or potentially suspicious activity related to those subjects, and filing, as

appropriate, suspicious activity reports related to those subjects; and

(e) measures to ensure that alert dispositions are supported with adequate

rationale and documentation to evidence the research performed and the due diligence that

was relied upon to arrive at the analyst’s conclusion.

Transaction Review

17. (a) Within 60 days of the effective date of this Order, the Bank shall

engage an independent third party acceptable to the Supervisors (the “Transaction Review

Consultant”) to conduct a review of domestic and international wire transaction activity

associated with the Bank’s fintech partners conducted at, by, or through the Bank from April

1, 2023 to September 30, 2023 to determine whether suspicious activity at, by, or through the

Bank was properly identified and reported in accordance with applicable suspicious activity

reporting regulations (the “Transaction Review”) and to prepare a written report detailing the

findings (the “Transaction Review Report”).

(b) Within 10 days of the Supervisors’ approval of the Transaction

Monitoring System Consultant, the Bank shall submit an engagement letter to the

Supervisors for approval. The engagement letter shall detail the methodology for conducting

the Transaction Review, including any sampling procedures to be followed; the expertise and

resources to be dedicated to the Transaction Review; and the anticipated date of completion

of the Transaction Review and the Transaction Review Report. The engagement letter shall

include a commitment that the Transaction Review Report will be provided to the

Supervisors at the same time that it is provided to the Bank’s board of directors, and that all

supporting materials associated with the final Transaction Review Report will be made

available to the Supervisors upon request.

Review, the Supervisors may direct the Bank to conduct a review of the types of transactions

described in paragraph 17(a) for additional time periods.

(d) Throughout the Transaction Review, the Bank shall ensure that all

matters or transactions required to be reported that have not previously been reported are

reported in accordance with applicable rules and regulations.

Office of Foreign Assets Control Compliance

18. Within 60 days of the effective date of this Order, the Bank shall submit a

written plan acceptable to the Supervisors to address the Bank’s compliance with the OFAC

Regulations, including, but not limited to, policies and procedures including OFAC screening

procedures, a methodology for assessing OFAC risks, training related to compliance with the

OFAC Regulations appropriate to the employee’s job responsibilities that is provided on an

ongoing, periodic basis.

Limitation on Open Banking Division Activities

19. Effective immediately, the Bank shall not without the prior written approval

of the Supervisors: (i) establish any new fintech partners, subsidiaries, business lines,

products, programs, services, or program managers related to OBD, or (ii) offer new

products, programs, or services to an existing fintech partner, program manager, or

subsidiary of OBD. All requests for prior approval shall be submitted in writing, and shall

contain, at a minimum, any proposed contract, any management, board, or board committee

minutes approving the activity or relationship, a description of the applicable measures to

effectively manage the risk posed by the activity or relationship. Before exiting a

relationship with a fintech partner, the Bank shall conduct and provide the Supervisors with

an impact analysis on the Bank’s liquidity.

Cash Flow

20. Within 60 days of the effective date of this Order, Bancorp shall submit to the

Supervisors a written statement of its planned sources and uses of cash for debt service,

operating expenses, and other purposes (“Cash Flow Projection”) for 2024. Bancorp shall

submit to the Supervisors a Cash Flow Projection for each calendar year subsequent to 2024 at

least one month prior to the beginning of that calendar year.

Capital Conservation

21. (a) Effective immediately, Bancorp and the Bank shall not, directly or

indirectly, declare or pay dividends, engage in share repurchases, or make any other capital

distribution in respect of common shares, preferred shares, or other capital instruments,

including, without limitation, any interest payments due on subordinated debentures, without

the prior written approval of the Reserve Bank, the Director of Supervision and Regulation of

the Board of Governors, and the ASBD. All requests for prior approval shall be received in

writing at least 30 days prior to the earlier of the proposed declaration, payment, or

distribution date, or required notice of deferral, and shall contain, at a minimum, current and

projected information, as appropriate, on Bancorp and the Bank’s respective capital,

earnings, and cash flow; the Bank’s asset quality, earnings, and allowance for loan and lease

losses; and identification of the source(s) of funding for the proposed payment or

distribution.

(b) Effectively immediately, Bancorp and the Bank shall not, directly or

indirectly, incur, increase, prepay, or guarantee any debt without the prior written approval of

the Reserve Bank, the Director of Supervision and Regulation of the Board of Governors,

and the ASBD. All requests for prior approval shall be received at least 30 days prior to the

proposed transaction date and contain, but not be limited to, a statement regarding the

purpose of the debt, the terms of the debt, and the planned source(s) for debt repayment, and

an analysis of the cash flow resources available to meet such debt repayment.

Compliance with Laws and Regulations

22. (a) The Bank shall take all necessary steps to correct all violations of law

or regulation cited in the Reports of Examination. In addition, the Bank shall take necessary

steps to ensure future compliance with all applicable laws and regulations.

(b) In appointing any new director or senior executive officer, or changing

the responsibilities of any senior executive officer so that the officer would assume a

different senior executive officer position, Bancorp and the Bank shall comply with the

notice provisions of section 32 of the FDI Act (12 U.S.C. § 1831i) and Subpart H of

Regulation Y of the Board of Governors (12 C.F.R. §§ 225.71 et seq.).

indemnification and severance payments of section 18(k) of the FDI Act (12 U.S.C. § 1828(k))

and Part 359 of the Federal Deposit Insurance Corporation’s regulations (12 C.F.R. § 359).

Approval, Implementation, and Progress Reports

23. (a) Bancorp or the Bank, as applicable, shall submit written plans,

policies, procedures, programs, and statements that are acceptable to the Supervisors, as

applicable, within the applicable time periods set forth in paragraphs 2, 3(a), 3(b), 3(c), 3(d),

4, 5, 6, 7, 10, 11, 14, 15, 16, 18, and 20 of this Order. Each plan, policy, procedure, program,

and statement shall contain a timeline for full implementation of the plan, policy, procedure,

or program with specific deadlines for the completion of each component of the plan, policy,

procedure, program, or statement. Independent third parties acceptable to the Supervisors

shall be retained by the Bank within the time periods set forth in paragraphs 3(b)(ii), 8, 12,

and 17(a) of this Order. Engagement letters acceptable to the Supervisors shall be submitted

within the time periods set forth in paragraphs 3(b)(iii), 9, 13, and 17(b) of this Order.

(b) Within 10 days of approval by the Supervisors, Bancorp or the Bank, as

applicable, shall adopt the approved plans, policies, procedures, programs, and statement. Upon

adoption, Bancorp or the Bank, as applicable, shall promptly implement the approved plans,

policies, procedures, programs, and statement, and thereafter fully comply with them.

procedures, programs, and statement shall not be amended or rescinded without the prior

written approval of the Supervisors.

24. Within 30 days after the end of each calendar quarter following the date of

this Order, Bancorp and the Bank, as applicable, shall submit to the Supervisors written

progress reports detailing the form and manner of all actions taken to secure compliance with

this Order, a timetable and schedule to implement specific remedial actions to be taken, and

the results thereof. The Supervisors may, in writing, discontinue the requirement for

progress reports or modify the reporting schedule.

Communications

25. All communications regarding this Order shall be sent to:

(a) Mr. Jason Gonzalez

Deputy Associate General Counsel

Federal Reserve Board

& C St. NW

Washington, DC 20551

(b) Mr. Allen North

Vice President

Federal Reserve Bank of St. Louis

P.O. Box 442

St. Louis, Missouri 63166

Bank Commissioner

Arkansas State Bank Department

#1 Commerce Way, Suite 303

Little Rock, Arkansas 72202

(d) Mr. Scott Stafford

President and Chief Executive Officer

Evolve Bank & Trust

Triad Centre 1

6000 Poplar Avenue, Suite 300

Memphis, Tennessee 38119

(e) Mr. B. Scot Lenoir

Chairman of the Board

Evolve Bancorp, Inc.

Evolve Bank & Trust

Triad Centre 1

6000 Poplar Avenue, Suite 300

Memphis, Tennessee 38119

(f) Mr. Jeffrey Naimon

Ms. Caroline Stapleton

Orrick, Herrington & Sutcliffe LLP

2100 Pennsylvania Ave. NW

Washington, DC 20037

Miscellaneous

26. Notwithstanding any provision of this Order, the Supervisors, as applicable,

may in their sole discretion, grant written extensions of time to Bancorp or the Bank to

comply with any provision of this Order.

27. The provisions of this Order shall be binding upon Bancorp, the Bank, and

their institution-affiliated parties, as defined in sections 3(u) and 8(b)(3) of the FDI Act (12

U.S.C. §§ 1813(u) and 1818(b)(3)), in their capacities as such, and their successors and

assigns.

28. Each provision of this Order shall remain effective and enforceable until stayed,

modified, terminated, or suspended in writing by the Supervisors.

29. The provisions of this Order shall not bar, estop, or otherwise prevent the

Board of Governors, the Reserve Bank, the ASBD, or any other federal or state agency from

taking any other action affecting Bancorp, the Bank, or any of its current or former

institution-affiliated parties and their successors and assigns.

By order of the Board of Governors of the Federal Reserve System effective this

day of June, 2024.

EVOLVE BANCORP, INC. BOARD OF GOVERNORS OF THE

FEDERAL RESERVE SYSTEM

By: /s/ Scot Lenoir By: /s/ Benjamin W. McDonough

Scot Lenoir Benjamin W. McDonough

Chairman of the Board Deputy Secretary of the Board

EVOLVE BANK & TRUST ARKANSAS STATE BANK

DEPARTMENT

By: /s/ Scott Stafford By: /s/ Susannah Marshall

Scott Stafford Susannah Marshall

President and Chief Executive Officer Bank Commissioner