FFIN First Financial Bankshares Inc

General

First Financial Bankshares, Inc., a Texas corporation (the “Company”), is a financial holding company registered under the Bank Holding Company Act of 1956, as amended, or BHCA. As such, we are supervised by the Federal Reserve Board, as well as several other bank regulators. We were formed as a bank holding company in 1956 under the original name F & M Operating Company, but our banking operations date back to 1890, when Farmers and Merchants National Bank opened for business in Abilene, Texas. On January 1, 2018, we acquired Commercial Bancshares, Inc. and its wholly owned subsidiary, Commercial State Bank, Kingwood, Texas and merged these entities with and into the Company and our subsidiary bank, respectively. On July 31, 2015, we acquired FBC Bancshares, Inc. and its wholly owned subsidiary, First Bank, N.A., Conroe, Texas and merged these entities with and into the Company and our subsidiary bank, respectively. We also completed an asset purchase of 4Trust Mortgage, Inc. on June 1, 2015 that significantly increased our residential mortgages/loan originations that are sold in the secondary market. On January 1, 2015, our technology subsidiary, First Technology Services, Inc., was contributed to our bank subsidiary, First Financial Bank, National Association, Abilene, Texas, and therefore became an indirect subsidiary of the Company. As of December 31, 2017, our subsidiaries are:

2

Table of Contents

Through our subsidiaries, we conduct a full-service commercial banking business. Our banking centers are located primarily in Central, North Central, Southeast and West Texas. As of December 31, 2017, we had 69 financial centers across Texas, with eleven locations in Abilene, three locations in San Angelo and Weatherford, two locations in Cleburne, Conroe, Stephenville, and Granbury, and one location each in Acton, Albany, Aledo, Alvarado, Beaumont, Boyd, Bridgeport, Brock, Burleson, Cisco, Clyde, Cut and Shoot, Decatur, Eastland, Fort Worth, Glen Rose, Grapevine, Hereford, Huntsville, Keller, Magnolia, Mauriceville, Merkel, Midlothian, Mineral Wells, Montgomery, Moran, New Waverly, Newton, Odessa, Orange, Port Arthur, Ranger, Rising Star, Roby, Southlake, Sweetwater, Tomball, Trent, Trophy Club, Vidor, Waxahachie, Willis and Willow Park, all in Texas.    On January 1, 2018, we completed our acquisition of Commercial Bancshares, Inc. and its wholly owned bank subsidiary, Commercial State Bank and, as a result, added branch locations in Kingwood, Fulshear, El Campo and Palacios.

Even though we operate in a growing number of Texas markets, we continue to believe that decisions are best made at the local level. Although we consolidated our bank charters into one charter, we continue to regionally manage our operations with local advisory boards of directors, local bank region presidents and local decision-makers. We have consolidated many of the backroom operations, such as investment securities, accounting, check processing, technology and employee benefits, which improves our efficiency and frees management of our bank regions to concentrate on serving the banking needs of their local communities. On January 1, 2016, we combined our Huntsville and Conroe Regions and our Abilene, Sweetwater and Eastland Regions and established a Fort Worth Region that previously was a branch of our Weatherford Region. On January 1, 2018, we combined our Mineral Wells and Stephenville Regions.

In the past, we have chosen to keep our Company focused on the State of Texas, one of the nation’s largest, fastest-growing and most economically diverse states. With approximately 27.9 million residents, Texas has more people than any other state except California. The population of Texas grew 19.3% from 2006-2016 according to the U.S. Census Bureau. Many of the communities in which we operate are also experiencing positive growth as shown below:

These economies include dynamic centers of higher education, agriculture, wind energy and natural resources, retail, military, healthcare, tourism, retirement living, manufacturing and distribution.

We believe our community approach to doing business works best for us in small and mid-size markets, where we can play a prominent role in the economic, civic and cultural life of the community. Our goal is to serve these communities well and to experience growth as these markets continue to expand. In many instances, banking competition is less intense in smaller markets, making it easier for us to operate rationally and attract and retain high-caliber employees who prefer not only our community-banker concept but the high quality of life in smaller cities.

Over the years, we have grown in three ways: by growing organically, by opening new branch locations and by acquiring other banks. Since 1997, we have completed thirteen bank acquisitions and have increased our total assets from $1.57 billion to $7.25 billion as of December 31, 2017. We have also established a trust and asset management company and a technology services company. First Financial Trust and Asset Management Company, National

3

Table of Contents

Association operates as a subsidiary of First Financial Bankshares, Inc. and First Technology Services, Inc. operates as a subsidiary of First Financial Bank, National Association, Abilene, Texas. Looking ahead, we intend to continue to grow organically by better serving the needs of our customers and putting them first in all of our decisions. We continually look for new branch locations, so we can provide more convenient service to our customers, and we are actively pursuing acquisition opportunities by calling on banks that we are interested in possibly acquiring.

When targeting a bank for acquisition, the subject bank generally needs to be well managed and profitable, while being located in the type of community that fits our profile. We seek to enter growing communities with good amenities – schools, infrastructure, commerce and lifestyle. We prefer non-metropolitan markets, either around Dallas/Fort Worth, Houston, San Antonio or Austin or along the Interstate 35, 45, 10 and 20 corridors in Texas. We might also consider the acquisition of banks in East Texas, the Texas Hill Country area or in states contiguous to Texas. Banks between $300 million and $1.0 billion in asset size fit our “sweet spot” for acquisition, but we would consider banks that are larger or smaller, or that are in other areas of Texas if we believe they would be a good fit for our Company.

Information on our revenues, profits and losses and total assets appears in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” contained in Item 7 hereof.

First Financial Bankshares, Inc.

We provide management, technical resources and policy direction to our subsidiaries, which enable them to improve or expand their services while continuing their local activity and identity. Each of our subsidiaries operates under the day-to-day management of its own board of directors and officers, including advisory boards of directors for our bank regions. We provide resources and policy direction in, among other things, the following areas:

In particular, we assist our subsidiaries with, among other things, decisions concerning major capital expenditures, employee fringe benefits, including retirement plans and group medical coverage, dividend policies, and appointment of officers and directors, including advisory directors, and their compensation. We also perform, through corporate staff groups or by outsourcing to third parties, internal audits, compliance oversight and loan reviews of our subsidiaries. We provide advice and specialized services for our bank regions related to lending, investing, purchasing, advertising, public relations, and technology services.

4

Table of Contents

We evaluate various potential financial institution acquisition opportunities and approve potential locations for new branch offices. We anticipate that funding for any acquisitions or expansions would be provided from our existing cash balances, available dividends from our subsidiaries, utilization of available lines of credit and future debt or equity offerings.

Services Offered by Our Subsidiaries

Our subsidiary bank, First Financial Bank, National Association, is a separate legal entity that operates under the day-to-day management of its board of directors and officers. Our multiple banking regions, which operate under our subsidiary bank, each have separate advisory boards that make recommendations and provide assistance to regional management of the bank regarding the operations of their respective region. Each of our bank regions provides general commercial banking services, which include accepting and holding checking, savings and time deposits, making loans, automated teller machines, drive-in and night deposit services, safe deposit facilities, remote deposit capture, internet banking, mobile banking, payroll cards, transmitting funds, and performing other customary commercial banking services. We also conduct full service trust activities through First Financial Trust & Asset Management Company, National Association, our trust company. Our trust company has seven locations which are located in Abilene, Fort Worth, Odessa, Beaumont, San Angelo, Stephenville and Sweetwater, all in Texas. Through our trust company, we offer personal trust services, which include wealth management, the administration of estates, testamentary trusts, revocable and irrevocable trusts and agency accounts. We also administer all types of retirement and employee benefit accounts, which include 401(k) profit sharing plans and IRAs. In addition, we provide securities brokerage services through arrangements with an unrelated third party in our Abilene, Cleburne, San Angelo and Weatherford banking regions.

Competition

Commercial banking in Texas is highly competitive, and because we hold less than 1% of the state’s deposits, we represent only a minor segment of the industry. To succeed in this industry, we believe that we must have the capability to compete effectively in the areas of (1) interest rates paid or charged; (2) scope of services offered; and (3) prices charged for such services. Our bank regions compete in their respective service areas against highly competitive banks, thrifts, savings and loan associations, small loan companies, credit unions, mortgage companies, insurance companies, and brokerage firms, all of which are engaged in providing financial products and services and some of which are larger than us in terms of capital, resources and personnel.

Our business does not depend on any single customer or any few customers, and the loss of any one would not have a materially adverse effect upon our business. Although we have a broad base of customers that are not related to us, our customers also occasionally include our officers and directors, as well as other entities with which we are affiliated. Through our bank regions we may make loans to our officers and directors, and entities with which we are affiliated, in the ordinary course of business. We make these loans on substantially the same terms, including interest rates and collateral, as those prevailing at the time for comparable transactions with other persons. Loans to our directors, officers and their affiliates are also subject to numerous restrictions under federal and state banking laws, which we describe in greater detail below, under the heading “Supervision and Regulation – Loans to Directors, Executive Officers and Principal Shareholders.”

Employees

Including all of our subsidiaries, we employed approximately 1,300 full-time equivalent employees at December 31, 2017. Our management believes that our employee relations have been and will continue to be good.

Supervision and Regulation

Both federal and state laws extensively regulate bank holding companies, financial holding companies and banks. These laws (and the regulations promulgated thereunder) are primarily intended to protect depositors and the deposit insurance fund (the “DIF”) of the Federal Deposit Insurance Corporation, or the FDIC. The following information describes particular laws and regulatory provisions relating to financial holding companies and banks. This discussion is qualified in its entirety by reference to the particular laws and regulatory provisions. A change in any of these laws or regulations may have a material effect on our business and the business of our subsidiaries. Recent political developments, including the change in administration of the United States federal government, have added additional uncertainty in the implementation, scope and timing of regulatory reforms.

5

Table of Contents

Bank Holding Companies and Financial Holding Companies

Historically, the activities of bank holding companies were limited to the business of banking and activities closely related or incidental to banking. Bank holding companies were generally prohibited from acquiring control of any company that was not a bank and from engaging in any business other than the business of banking or managing and controlling banks. The Gramm-Leach-Bliley Act, which took effect on March 12, 2000, dismantled many Depression-era restrictions against affiliations between banking, securities and insurance firms by permitting bank holding companies to engage in a broader range of financial activities, so long as certain safeguards are observed. Specifically, bank holding companies may elect to become “financial holding companies” that may affiliate with securities firms and insurance companies and engage in other activities that are financial in nature or incidental to a financial activity. Thus, with the enactment of the Gramm-Leach-Bliley Act, banks, security firms and insurance companies find it easier to acquire or affiliate with each other and cross-sell financial products. The Gramm-Leach-Bliley Act permits a single financial services organization to offer a more complete array of financial products and services than historically was permitted.

A financial holding company is essentially a bank holding company with significantly expanded powers. Under the Gramm-Leach-Bliley Act, in addition to traditional lending activities, the following activities are among those that are deemed “financial in nature” for financial holding companies: securities underwriting, dealing in or making a market in securities, sponsoring mutual funds and investment companies, insurance underwriting and agency activities, activities which the Federal Reserve Board determines to be closely related to banking, and certain merchant banking activities.

We elected to become a financial holding company in September 2001. As a financial holding company, we have very broad discretion to affiliate with securities firms and insurance companies, provide merchant banking services, and engage in other activities that the Federal Reserve Board has deemed financial in nature. In order to continue as a financial holding company, we must continue to be well-capitalized, well-managed and maintain compliance with the Community Reinvestment Act. Depending on the types of financial activities that we may elect to engage in, under the Gramm-Leach-Bliley Act’s functional regulation principles, we may become subject to supervision by additional government agencies. The election to be treated as a financial holding company increases our ability to offer financial products and services that historically we were either unable to provide or were only able to provide on a limited basis. As a result, we will face increased competition in the markets for any new financial products and services that we may offer. Likewise, an increased amount of consolidation among banks and securities firms or banks and insurance firms could result in a growing number of large financial institutions that could compete aggressively with us.

Mergers and Acquisitions

We generally must obtain approval from the banking regulators before we can acquire other financial institutions. We may not engage in certain acquisitions if we are undercapitalized. Furthermore, the BHCA provides that the Federal Reserve Board cannot approve any acquisition, merger or consolidation that may substantially lessen competition in the banking industry, create a monopoly in any section of the country, or be a restraint of trade. However, the Federal Reserve Board may approve such a transaction if the convenience and needs of the community clearly outweigh any anti-competitive effects. Specifically, the Federal Reserve Board would consider, among other factors, the expected benefits to the public (greater convenience, increased competition, greater efficiency, etc.) against the risks of possible adverse effects (undue concentration of resources, decreased or unfair competition, conflicts of interest, unsound banking practices, etc.).

Under the BHCA, the Company must obtain the prior approval of the Federal Reserve Board, or acting under delegated authority, the Federal Reserve Bank of Dallas before (1) acquiring direct or indirect ownership or control of any class of voting securities of any bank or bank holding company if, after the acquisition, the Company would directly or indirectly own or control 5% or more of the class; (2) acquiring all or substantially all of the assets of another bank or bank holding company; or (3) merging or consolidating with another bank holding company.

6

Table of Contents

The Change in Bank Control Act of 1978, as amended, or the CIBCA, and the related regulations of the Federal Reserve Board require any person or groups of persons acting in concert (except for companies required to make application under the BHCA), to file a written notice with the Federal Reserve Board before the person or group acquires control of the Company. The CIBCA defines “control” as the direct or indirect power to vote 25% or more of any class of voting securities or to direct the management or policies of a bank holding company or an insured bank. A rebuttable presumption of control arises under the CIBCA where a person or group controls 10% or more, but less than 25%, of a class of the voting stock of a company or insured bank which is a reporting company under the Securities Exchange Act of 1934, as amended, such as the Company, or such ownership interest is greater than the ownership interest held by any other person or group.

Banks

Federal and state laws and regulations that govern banks have the effect of, among other things, regulating the scope of business, investments, cash reserves, the purpose and nature of loans, the maximum interest rate chargeable on loans, the amount of dividends declared, and required capitalization ratios.

National Banking Associations . Banks organized as national banking associations under the National Bank Act are subject to regulation and examination by the Office of the Comptroller of the Currency, or OCC. Effective December 30, 2012, we consolidated our then eleven bank charters into one, that being our Abilene charter. As a result, the OCC now supervises, regulates and regularly examines the following subsidiaries:

The OCC’s supervision and regulation of banks is primarily intended to protect the interests of depositors. The National Bank Act:

Deposit Insurance Coverage and Assessments

Our subsidiary bank is a member of the FDIC. Through the DIF, the FDIC provides deposit insurance protection that covers all deposit accounts in FDIC-insured depository institutions up to applicable limits (currently, $250,000 per depositor).    

Our subsidiary bank must pay assessments to the FDIC under a risk-based assessment system for this federal deposit insurance protection. FDIC-insured depository institutions that are members of the Bank Insurance Fund pay insurance premiums at rates based on their risk classification. Institutions assigned to higher risk classifications (i.e., institutions that pose a greater risk of loss to the DIF) pay assessments at higher rates than institutions assigned to lower risk classifications. An institution’s risk classification is assigned based on its capital levels and the level of supervisory concern the institution poses to bank regulators. Through June 30, 2017, the assessment rate for our subsidiary bank was at the lowest risk-based premium available, which was 3.00% of the assessment base per annum. In addition, the FDIC can impose special assessments to cover shortages in the DIF and has imposed special assessments in the past.

In October 2010, the FDIC adopted a new Restoration Plan for the DIF to ensure that the fund reserve ratio reaches 1.35% by September 30, 2020, as required by the Dodd-Frank Act. On April 26, 2016, the FDIC adopted a rule amending pricing for deposit insurance for institutions with less than $10 billion in assets effective the quarter after the fund reserve ratio reached 1.15%. As of June 30, 2016, the FDIC announced that the fund reserve ratio had reached 1.15%. As a result, the Company’s assessment rate was decreased to the rate stated above. The Dodd-Frank Act also eliminated the requirement that the FDIC pay dividends to insured depository institutions when the reserve ratio exceeds certain thresholds. The Dodd-Frank Act requires the FDIC to offset the effect of increasing the reserve ratio on institutions with total consolidated assets of less than $10 billion, such as the Company.

7

Table of Contents

As required by the Dodd-Frank Act, the FDIC also revised the deposit insurance assessment system, effective April 1, 2011, to base assessments on the average total consolidated assets of insured depository institutions during the assessment period, less the average tangible equity of the institution during the assessment period as opposed to solely bank deposits at an institution. This base assessment change necessitated that the FDIC adjust the assessment rates to ensure that the revenue collected under the new assessment system will approximately equal that under the existing assessment system.

Under the Financial Institutions Reform, Recovery, and Enforcement Act of 1989, or FIRREA, an FDIC-insured depository institution can be held liable for any losses incurred by the FDIC in connection with (1) the “default” of one of its FDIC-insured subsidiaries or (2) any assistance provided by the FDIC to one of its FDIC-receivers, and “in danger of default” is defined generally as the existence of certain conditions indicating that a default is likely to occur in the absence of regulatory assistance.

The FDIC is also empowered to regulate interest rates paid by insured banks. Approval of the FDIC is also required before an insured bank retires any part of its common or preferred stock, or any capital notes or debentures.

Payment of Dividends

We are a legal entity separate and distinct from our banking and other subsidiaries. We receive most of our revenue from dividends paid to us by our bank and trust company subsidiaries. Described below are some of the laws and regulations that apply when either we or our subsidiaries pay or paid dividends.

The Federal Reserve Board, the OCC and the FDIC have issued policy statements that recommend that bank holding companies and insured banks should generally only pay dividends to the extent net income is sufficient to cover both cash dividends and a rate of earnings retention consistent with capital needs, asset quality and overall financial condition. Further, the Federal Reserve Board’s policy provides that bank holding companies should not maintain a level of cash dividends that undermines the bank holding company’s ability to serve as a source of strength to its banking subsidiaries. In addition, the Federal Reserve Board has indicated that each bank holding company should carefully review its dividend policy, and has discouraged payment ratios that are at maximum allowable levels, which is the maximum dividend amount that may be issued and allow the company to still maintain its target Tier 1 capital ratio, unless both asset quality and capital are very strong.

To pay dividends, our subsidiaries must maintain adequate capital above regulatory guidelines. Under federal law, our subsidiary bank cannot pay a dividend if, after paying the dividend, the bank would be “undercapitalized.” In addition, if the FDIC believes that a bank under its jurisdiction is engaged in, or is about to engage in, an unsafe or unsound practice (which, depending on the financial condition of the bank, could include the payment of dividends), the FDIC may require, after notice and hearing, that such bank cease and desist from the unsafe practice. The FDIC and the OCC have each indicated paying dividends that deplete a bank’s capital base to an inadequate level would be an unsafe and unsound banking practice.

National banks are required by federal law to obtain the prior approval of the OCC in order to declare and pay dividends if the total of all dividends declared in any calendar year would exceed the total of (1) such bank’s net profits (as defined and interpreted by regulation) for that year plus (2) its retained net profits (as defined and interpreted by regulation) for the preceding two calendar years, less any required transfers to surplus. In addition, these banks may only pay dividends to the extent that retained net profits (including the portion transferred to surplus) exceed bad debts (as defined by regulation).

Our subsidiaries paid aggregate dividends to us of $30.8 million in 2017 and $48.8 million in 2016. Under the dividend restrictions discussed above, as of December 31, 2017, our subsidiaries could have declared in the aggregate additional dividends of approximately $205.75 million from retained net profits, without obtaining regulatory approvals.

8

Table of Contents

Federal Income Tax

On December 22, 2017, the Tax Cuts and Jobs Act was signed into law with sweeping modifications to the Internal Revenue Code. The primary change for the Company was to lower the corporate income tax rate to 21% from 35%. The Company’s deferred tax assets and liabilities were re-measured based on the income tax rates at which they are expected to reverse in the future, which is generally 21%. However, the Company continues to analyze certain aspects of the Act resulting in refinement of the calculation which could potentially affect the measurement of these balances or potentially give rise to new deferred tax amounts. The provisional amount recorded related to the re-measurement of the Company’s deferred tax balance was $7.65 million, a reduction of income tax expense for the year ended December 31, 2017.

Affiliate Transactions

The Federal Reserve Act, the Federal Deposit Insurance Act (“FDIA”) and the rules adopted under these statutes restrict the extent to which we can borrow or otherwise obtain credit from, or engage in certain other transactions with, our subsidiaries. These laws regulate “covered transactions” between insured depository institutions and their subsidiaries, on the one hand, and their nondepository affiliates, on the other hand. The Dodd-Frank Act expanded the definition of affiliate to make any investment fund, including a mutual fund, for which a depository institution or its affiliates serve as investment advisor an affiliate of the depository institution. “Covered transactions” include a loan or extension of credit to a non-depository affiliate, a purchase of securities issued by such an affiliate, a purchase of assets from such an affiliate (unless otherwise exempted by the Federal Reserve Board), an acceptance of securities issued by such an affiliate as collateral for a loan, and an issuance of a guarantee, acceptance, or letter of credit for the benefit of such an affiliate. The Dodd-Frank Act extended the limitations to derivative transactions, repurchase agreements and securities lending and borrowing transactions that create credit exposure to an affiliate or an insider. The “covered transactions” that an insured depository institution and its subsidiaries are permitted to engage in with their non-depository affiliates are limited to the following amounts: (1) in the case of any one such affiliate, the aggregate amount of “covered transactions” cannot exceed ten percent of the capital stock and the surplus of the insured depository institution; and (2) in the case of all affiliates, the aggregate amount of “covered transactions” cannot exceed twenty percent of the capital stock and surplus of the insured depository institution. In addition, extensions of credit that constitute “covered transactions” must be collateralized in prescribed amounts. Further, a bank holding company and its subsidiaries are prohibited from engaging in certain tie-in arrangements in connection with any extension of credit, lease or sale of property or furnishing of services. Finally, when we and our subsidiaries conduct transactions internally among us, we are required to do so at arm’s length.

Loans to Directors, Executive Officers and Principal Shareholders

The authority of our subsidiary bank to extend credit to our directors, executive officers and principal shareholders, including their immediate family members, corporations and other entities that they control, is subject to substantial restrictions and requirements under Sections 22(g) and 22(h) of the Federal Reserve Act and Regulation O promulgated thereunder, as well as the Sarbanes-Oxley Act of 2002. These statutes and regulations impose specific limits on the amount of loans our subsidiary bank may make to directors and other insiders, and specified approval procedures must be followed in making loans that exceed certain amounts. In addition, all loans our subsidiary bank makes to directors and other insiders must satisfy the following requirements:

Furthermore, our subsidiary bank must periodically report all loans made to directors and other insiders to the bank regulators, and these loans are closely scrutinized by the regulators for compliance with Sections 22(g) and 22(h) of the Federal Reserve Act and Regulation O. Each loan to directors or other insiders must be pre-approved by the bank’s board of directors with the interested director abstaining from voting.

9

Table of Contents

Capital

We and our bank subsidiary are each required to comply with applicable capital adequacy standards established by the Federal Reserve Board and the OCC, respectively. The current risk-based capital standards applicable to us and our bank subsidiary, parts of which are currently in the process of being phased-in, are based on the December 2010 final capital framework for strengthening international capital standards, known as Basel III, of the Basel Committee on Banking Supervision (the “Basel Committee”).

In July 2013, the federal bank regulators approved final rules (the “Basel III Rules”) implementing the Basel III framework as well as certain provisions of the Dodd-Frank Act. The Basel III Rules substantially revised the risk-based capital requirements applicable to bank holding companies and their depository institution subsidiaries. The Basel III Rules became effective for us and our subsidiary bank on January 1, 2015 (subject to a phase-in period for certain provisions).

The Basel III Rules established three components of regulatory capital: (1) common equity tier 1 capital (“CET1”), (2) additional tier 1 capital, and (3) tier 2 capital. Tier 1 capital is the sum of CET1 and additional tier 1 capital instruments meeting certain revised requirements. Total capital is the sum of tier 1 capital and tier 2 capital. Under the Basel III Rules, for most banking organizations, the most common form of additional tier 1 capital is non-cumulative perpetual preferred stock and the most common form of tier 2 capital is subordinated notes and a portion of the allocation for loan and lease losses, in each case, subject to the Basel III Rules’ specific requirements. As of December 31, 2017, we do not have any non-cumulative perpetual preferred stock or subordinated notes. CET1, tier 1 capital, and total capital serve as the numerators for three prescribed regulatory capital ratios. Risk-weighted assets, calculated using the standardized approach in the Basel III Capital Rules for us and our subsidiary bank, provide the denominator for such ratios. There is also a leverage ratio that compares tier 1 capital to average total assets.

Pursuant to the Basel III Rules, the effects of certain accumulated other comprehensive income or loss (“AOCI”) items are not excluded; however, “non-advanced approaches banking organizations,” including us and our subsidiary bank, could make a one-time permanent election to continue to exclude these items. The Company made its a one-time, permanent election to continue to exclude AOCI from capital in its filing with the Federal Reserve Board for the quarter ended March 31, 2015. If the Company would not have made this election, unrealized gains and losses would have been included in the calculation of its regulatory capital. The Basel III Rules also preclude certain hybrid securities, such as trust preferred securities issued prior to May 19, 2010, from inclusion in our Tier 1 capital, subject to grandfathering in the case of companies, such as us, that had less than $15 billion in total consolidated assets as of December 31, 2009.

Under the Basel III Rules, the minimum capital ratios effective as of January 1, 2015 are:

The Basel III Rules also establish a fully-phased “capital conservation buffer” of 2.5% above the new regulatory minimum risk-based capital requirements. The conservation buffer, when added to the capital requirements, results in the following minimum ratios: (i) a CET1 risk-based capital ratio of 7.0%, (ii) a Tier 1 risk-based capital ratio of 8.5%, and (iii) a total risk-based capital ratio of 10.5%. The new capital conservation buffer requirement is being phased in beginning in January 2016 at 0.625% of risk-weighted assets and will increase by that amount each year until fully implemented in January 2019. At December 31, 2017, the required capital conservation buffer was 1.50%. An institution is subject to limitations on certain activities including payment of dividends, share repurchases and discretionary bonuses to executive officers if its capital level is below the buffer amount.

10

Table of Contents

The Basel III Rules prescribe a standardized approach for risk weightings that expanded the risk-weighting categories from the general risk-based capital rules to a much larger and more risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. government and agency securities, to 600% for certain equity exposures, and resulting in higher risk weights for a variety of asset categories.

With respect to our bank subsidiary, the Basel III Rules also revise the “prompt corrective action” regulations pursuant to Section 38 of the Federal Deposit Insurance Act, as discussed below under “Prompt Corrective Action.”

As of December 31, 2017, we had a total risk-based capital ratio of 19.85%, a Tier 1 capital to risk-weighted asset ratio of 18.66%, a common equity Tier 1 to risk-weighted assets ratio of 18.66% and a Tier 1 leverage ratio of 11.09%. These regulatory capital ratios were calculated under Basel III rules.

Prompt Corrective Action.

A banking organization’s capital plays an important role in connection with regulatory enforcement as well. Federal law provides the federal banking regulators with broad power to take prompt corrective action to resolve the problems of undercapitalized institutions. The extent of the regulators’ powers depends on whether the institution in question is “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” or “critically undercapitalized,” in each case as defined by regulation. Depending upon the capital category to which an institution is assigned, the regulators’ corrective powers include: (i) requiring the institution to submit a capital restoration plan; (ii) limiting the institution’s asset growth and restricting its activities; (iii) requiring the institution to issue additional capital stock (including additional voting stock) or to be acquired; (iv) restricting transactions between the institution and its affiliates; (v) restricting the interest rate that the institution may pay on deposits; (vi) ordering a new election of directors of the institution; (vii) requiring that senior executive officers or directors be dismissed; (viii) prohibiting the institution from accepting deposits from correspondent banks; (ix) requiring the institution to divest certain subsidiaries; (x) prohibiting the payment of principal or interest on subordinated debt; and (xi) ultimately, appointing a receiver for the institution.

Under current regulations, our subsidiary bank was “well capitalized” as of December 31, 2017.

Our Support of Our Subsidiaries

Under Federal Reserve Board policy, we are expected to commit resources to act as a source of strength to support each of our subsidiaries. The Dodd-Frank Act codified this policy as a statutory requirement. This support may be required at times when, absent such Federal Reserve Board policy, we would not otherwise be required to provide it. In addition, any loans we make to our subsidiaries would be subordinate in right of payment to deposits and to other indebtedness of our subsidiaries. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and be subject to a priority of payment.

Under the Federal Deposit Insurance Act, in the event of a loss suffered or anticipated by the FDIC (either as a result of the default of a banking subsidiary or related to FDIC assistance provided to a subsidiary in danger of default) our other subsidiaries may be assessed for the FDIC’s loss.

Safe and Sound Banking Practices.

Bank holding companies are not permitted to engage in unsafe and unsound banking practices. The Federal Reserve Board’s Regulation Y, for example, generally requires a holding company to give the Federal Reserve Board prior notice of any redemption or repurchase of its own equity securities, if the consideration to be paid, together with the consideration paid for any repurchases or redemptions in the preceding year, is equal to 10% or more of the bank holding company’s consolidated net worth. The Federal Reserve Board may oppose the transaction if it believes that the transaction would constitute an unsafe or unsound practice or would violate any law or regulation. Depending upon the circumstances, the Federal Reserve Board could take the position that paying a dividend would constitute an unsafe or unsound banking practice.

11

Table of Contents

The Federal Reserve Board has broad authority to prohibit activities of bank holding companies and their nonbanking subsidiaries which represent unsafe and unsound banking practices or which constitute violations of laws or regulations, and can assess civil money penalties for certain activities conducted on a knowing and reckless basis, if those activities caused a substantial loss to a depository institution. The penalties can be as high as $1.0 million for each day the activity continues.

Interstate Banking and Branching

Effective June 1, 1997, the Riegle-Neal Interstate Banking and Branching Efficiency Act of 1994 amended the Federal Deposit Insurance Act and certain other statutes to permit state and national banks with different home states to merge across state lines, with approval of the appropriate federal banking agency, unless the home state of a participating bank had passed legislation prior to May 31, 1997 expressly prohibiting interstate mergers. Under the Riegle-Neal Act amendments, once a state or national bank has established branches in a state, that bank may establish and acquire additional branches at any location in the state at which any bank involved in the interstate merger transaction could have established or acquired branches under applicable federal or state law. If a state opted out of interstate branching within the specified time period, no bank in any other state may establish a branch in the state which has opted out, whether through an acquisition or de novo.

However, under the Dodd-Frank Act, the national branching requirements have been relaxed and national banks and state banks are able to establish branches in any state if that state would permit the establishment of the branch by a state bank chartered in that state.

The Federal Deposit Insurance Act, or FDIA, requires that the FDIC review (1) any merger or consolidation by or with an insured bank, or (2) any establishment of branches by an insured bank. Additionally, the Texas Department of Banking “Banking Department” accepts applications for interstate merger and branching transactions, subject to certain limitations on ages of the banks to be acquired and the total amount of deposits within the state a bank or financial holding company may control. Since our primary service area is Texas, we do not expect that the ability to operate in other states will have any material impact on our growth strategy. We may, however, face increased competition from out-of-state banks that branch or make acquisitions in our primary markets in Texas.

Community Reinvestment Act of 1977

The Community Reinvestment Act of 1977, or CRA, subjects a bank to regulatory assessment to determine if the institution meets the credit needs of its entire community, including low- and moderate-income neighborhoods served by the bank, and to take that determination into account in its evaluation of any application made by such bank for, among other things, approval of the acquisition or establishment of a branch or other depository facility, an office relocation, a merger, or the acquisition of shares of capital stock of another financial institution. The regulatory authority prepares a written evaluation of an institution’s record of meeting the credit needs of its entire community and assigns a rating. These ratings are “Outstanding,” “Satisfactory,” “Needs Improvement” and “Substantial Non-Compliance.” Institutions with ratings lower than “Satisfactory” may be restricted from engaging in the aforementioned activities. We believe our subsidiary bank has taken and takes significant actions to comply with the CRA, and received a “satisfactory” rating in its most recent review by federal regulators with respect to its compliance with the CRA.

Monitoring and Reporting Suspicious Activity

Under the Bank Secrecy Act, or BSA, we are required to monitor and report unusual or suspicious account activity that might signify money laundering, tax evasion or other criminal activities, as well as transactions involving the transfer or withdrawal of amounts in excess of prescribed limits. The BSA is sometimes referred to as an “anti-money laundering” law (“AML”). Several AML acts, including provisions in Title III of the USA PATRIOT Act of 2001, have been enacted up to the present to amend the BSA. Under the USA PATRIOT Act, financial institutions are subject to prohibitions against specified financial transactions and account relationships as well as enhanced due diligence and “know your customer” standards in their dealings with financial institutions and foreign customers. For example, the enhanced due diligence policies, procedures and controls generally require financial institutions to take reasonable steps:

12

Table of Contents

Under the USA PATRIOT Act, financial institutions are also required to establish anti-money laundering programs. The USA PATRIOT Act sets forth minimum standards for these programs, including:

In addition, under the USA PATRIOT Act, the Secretary of the U.S. Department of the Treasury, or Treasury, has adopted rules addressing a number of related issues, including increasing the cooperation and information sharing between financial institutions, regulators, and law enforcement authorities regarding individuals, entities and organizations engaged in, or reasonably suspected based on credible evidence of engaging in, terrorist acts or money laundering activities. Any financial institution complying with these rules will not be deemed to violate the privacy provisions of the Gramm-Leach-Bliley Act that are discussed below. Finally, under the regulations of the Office of Foreign Asset Control, or OFAC, we are required to monitor and block transactions with certain “specially designated nationals” who OFAC has determined pose a risk to U.S. national security.

Incentive Compensation

In June 2010, the Federal Reserve Board, OCC and FDIC issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

The Federal Reserve Board will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Company, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

13

Table of Contents

In addition, Section 956 of the Dodd-Frank Act required certain regulators (including the FDIC, SEC and Federal Reserve Board) to adopt requirements or guidelines prohibiting excessive compensation. In April and May 2016, the Federal Reserve, jointly with five other federal regulators, published a proposed rule in response to Section 956 of the Dodd-Frank Act, which requires implementation of regulations or guidelines to: (1) prohibit incentive-based payment arrangements that encourage inappropriate risks by certain financial institutions by providing excessive compensation or that could lead to material financial loss, and (2) require those financial institutions to disclose information concerning incentive-based compensation arrangements to the appropriate federal regulator.

The proposed rule identifies three categories of institutions that would be covered by these regulations based on average total consolidated assets, applying less prescriptive incentive-based compensation program requirements to the smallest covered institutions (Level 3) and progressively more rigorous requirements to the larger covered institutions (Level 1). Under the proposed rule, we would fall into the smallest category (Level 3), which applies to financial institutions with average total consolidated assets greater than $1 billion and less than $50 billion. The proposed rules would establish general qualitative requirements applicable to all covered entities, which would include (i) prohibiting incentive arrangements that encourage inappropriate risks by providing excessive compensation; (ii) prohibiting incentive arrangements that encourage inappropriate risks that could lead to a material financial loss; (iii) establishing requirements for performance measures to appropriately balance risk and reward; (iv) requiring board of director oversight of incentive arrangements; and (v) mandating appropriate recordkeeping. Under the proposed rule, larger financial institutions with total consolidated assets of at least $50 billion would also be subject to additional requirements applicable to such institutions’ “senior executive officers” and “significant risk-takers.” These additional requirements would not be applicable to us because we currently have less than $50 billion in total consolidated assets. Comments on the proposed rule were due by July 22, 2016. As of the date of this document, the final rule has not yet been published by these regulators.

In addition, the Dodd-Frank Act requires publicly traded companies to give stockholders a non-binding vote on executive compensation at their first annual meeting taking place six months after the date of enactment and at least every three years thereafter and on so-called “golden parachute” payments in connection with approvals of mergers and acquisitions unless previously voted on by shareholders. The new legislation also authorizes the Securities and Exchange Commission (“SEC”) to promulgate rules that would allow stockholders to nominate their own candidates using a company’s proxy materials. Additionally, the Dodd-Frank Act directs the federal banking regulators to promulgate rules prohibiting excessive compensation paid to executives of depository institutions and their holding companies with assets in excess of $1.0 billion, regardless of whether the company is publicly traded or not. The Dodd-Frank Act gives the SEC authority to prohibit broker discretionary voting on elections of directors and executive compensation matters.

Consumer Laws and Regulations

We are also subject to certain consumer laws and regulations that are designed to protect consumers in transactions with banks. While the following list is not exhaustive, these laws and regulations include the Truth in Lending Act, the Truth in Savings Act, the Electronic Funds Transfer Act, the Expedited Funds Availability Act, the Equal Credit Opportunity Act, The Fair and Accurate Credit Transactions Act, The Real Estate Settlement Procedures Act and the Fair Housing Act, among others. These laws and regulations, among other things, prohibit discrimination on the basis of race, gender or other designated characteristics and mandate various disclosure requirements and regulate the manner in which financial institutions must deal with customers when taking deposits or making loans to such customers. These and other laws also limit finance charges or other fees or charges earned in our activities. We must comply with the applicable provisions of these consumer protection laws and regulations as part of our ongoing customer relations.

Consumer Financial Protection Bureau

The Dodd-Frank Act created a new, independent federal agency called the Consumer Financial Protection Bureau (“CFPB”), which is granted broad rulemaking, supervisory and enforcement powers under various federal consumer financial protection laws, including the Equal Credit Opportunity Act, Truth in Lending Act, Real Estate Settlement Procedures Act, Fair Credit Reporting Act, Fair Debt Collection Act, the Consumer Financial Privacy provisions of the Gramm-Leach-Bliley Act and certain other statutes. The CFPB has examination and primary

14

Table of Contents

enforcement authority with respect to depository institutions with $10 billion or more in assets. Smaller institutions are subject to rules promulgated by the CFPB but continue to be examined and supervised by federal banking regulators for consumer compliance purposes. The CFPB has authority to prevent unfair, deceptive or abusive practices in connection with the offering of consumer financial products. The Dodd-Frank Act permits states to adopt consumer protection laws and standards that are more stringent than those adopted at the federal level and, in certain circumstances, permits the state attorney general to enforce compliance with both the state and federal laws and regulations.

The CFPB has finalized rules relating to, among other things, remittance transfers under the Electronic Fund Transfer Act, which requires companies to provide consumers with certain disclosures before the consumer pays for a remittance transfer. These rules became effective in October 2013. The CFPB has also amended certain rules under Regulation C relating to home mortgage disclosure to reflect a change in the asset-size exemption threshold for depository institutions based on the annual percentage change in the Consumer Price Index for Urban Wage Earners and Clerical Workers. In addition, on January 10, 2013, the CFPB released its final “Ability-to-Repay/Qualified Mortgage” rules, which amended the Truth in Lending Act (Regulation Z). Regulation Z prohibits a creditor from making a higher-priced mortgage loan without regard to the consumer’s ability to repay the loan. The final amended rule implemented sections 1411 and 1412 of the Dodd-Frank Act, which generally require creditors to make a reasonable, good faith determination of a consumer’s ability to repay any consumer credit transaction secured by a dwelling (excluding an open-end credit plan, timeshare plan, reverse mortgage, or temporary loan) and establishes certain protections from liability under this requirement for “qualified mortgages.” The final rule also implemented section 1414 of the Dodd-Frank Act, which limits prepayment penalties. Finally, the final rule requires creditors to retain evidence of compliance with the rule for three years after a covered loan is consummated. This rule became effective January 10, 2014.

Technology Risk Management and Consumer Privacy

State and federal banking regulators have issued various policy statements emphasizing the importance of technology risk management and supervision in evaluating the safety and soundness of depository institutions with respect to banks that contract with outside vendors to provide data processing and core banking functions. The use of technology-related products, services, delivery channels and processes exposes a bank to various risks, particularly operational, privacy, security, strategic, reputation and compliance risk. Banks are generally expected to prudently manage technology-related risks as part of their comprehensive risk management policies by identifying, measuring, monitoring and controlling risks associated with the use of technology.

Under Section 501 of the Gramm-Leach-Bliley Act, the federal banking agencies have established appropriate standards for financial institutions regarding the implementation of safeguards to ensure the security and confidentiality of customer records and information, protection against any anticipated threats or hazards to the security or integrity of such records and protection against unauthorized access to or use of such records or information in a way that could result in substantial harm or inconvenience to a customer. Among other matters, the rules require each bank to implement a comprehensive written information security program that includes administrative, technical and physical safeguards relating to customer information.

Under the Gramm-Leach-Bliley Act, a financial institution must also provide its customers with a notice of privacy policies and practices. Section 502 prohibits a financial institution from disclosing nonpublic personal information about a customer to nonaffiliated third parties unless the institution satisfies various notice and opt-out requirements and the customer has not elected to opt out of the disclosure. Under Section 504, the agencies are authorized to issue regulations as necessary to implement notice requirements and restrictions on a financial institution’s ability to disclose nonpublic personal information about customers to nonaffiliated third parties. Under the final rule the regulators adopted, all banks must develop initial and annual privacy notices which describe in general terms the bank’s information sharing practices. Banks that share nonpublic personal information about customers with nonaffiliated third parties must also provide customers with an opt-out notice and a reasonable period of time for the customer to opt out of any such disclosure (with certain exceptions). Limitations are placed on the extent to which a bank can disclose an account number or access code for credit card, deposit or transaction accounts to any nonaffiliated third party for use in marketing.

15

Table of Contents

Concentrated Commercial Real Estate Lending Regulations

The federal banking agencies, including the FDIC, have promulgated guidance governing financial institutions with concentrations in commercial real estate lending. The guidance provides that a bank has a concentration in commercial real estate lending if (i) total reported loans for construction, land development, and other land represent 100% or more of total capital or (ii) total reported loans secured by multifamily and non-farm residential properties and loans for construction, land development, and other land represent 300% or more of total capital and the bank’s commercial real estate loan portfolio has increased 50% or more during the prior 36 months. Owner occupied loans are excluded from this second category. If a concentration is present, management must employ heightened risk management practices that address the following key elements: including board and management oversight and strategic planning, portfolio management, development of underwriting standards, risk assessment and monitoring through market analysis and stress testing, and maintenance of increased capital levels as needed to support the level of commercial real estate lending.

UDAP and UDAAP

Banking regulatory agencies have increasingly used a general consumer protection statute to address “unethical” or otherwise “bad” business practices that may not necessarily fall directly under the purview of a specific banking or consumer finance law. The law of choice for enforcement against such business practices has been Section 5 of the Federal Trade Commission Act, referred to as the FTC Act, which is the primary federal law that prohibits unfair or deceptive acts or practices, referred to as UDAP, and unfair methods of competition in or affecting commerce. “Unjustified consumer injury” is the principal focus of the FTC Act. Prior to the Dodd-Frank Act, there was little formal guidance to provide insight to the parameters for compliance with UDAP laws and regulations. However, UDAP laws and regulations have been expanded under the Dodd-Frank Act to apply to “unfair, deceptive or abusive acts or practices,” referred to as UDAAP, which have been delegated to the CFPB for supervision. The CFPB has published its first Supervision and Examination Manual that addresses compliance with and the examination of UDAAP.

Monetary Policy

Banks are affected by the credit policies of monetary authorities, including the Federal Reserve Board, that affect the national supply of credit. The Federal Reserve Board regulates the supply of credit in order to influence general economic conditions, primarily through open market operations in United States government obligations, varying the discount rate on financial institution borrowings, varying reserve requirements against financial institution deposits, and restricting certain borrowings by financial institutions and their subsidiaries. The monetary policies of the Federal Reserve Board have had a significant effect on the operating results of banks in the past and are expected to continue to do so in the future.

Enforcement Powers of Federal Banking Agencies

The Federal Reserve and other state and federal banking agencies and regulators have broad enforcement powers, including the power to terminate deposit insurance, issue cease-and-desist orders, impose substantial fines and other civil and criminal penalties and appoint a conservator or receiver. Our failure to comply with applicable laws, regulations and other regulatory pronouncements could subject us, as well as our officers and directors, to administrative sanctions and potentially substantial civil penalties.

Regulatory Reform and Legislation

From time to time, various legislative and regulatory initiatives are introduced in Congress and state legislatures, as well as by regulatory agencies. Such initiatives may include proposals to expand or contract the powers of bank holding companies and depository institutions or proposals to substantially change the financial institution regulatory system. Such legislation could change banking statutes and the operating environment of the Company in substantial and unpredictable ways. If enacted, such legislation could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among banks, savings associations, credit unions, and other financial institutions. The Company cannot predict whether any such legislation will be enacted, and, if enacted, the effect that it, or any implementing regulations, would have on the financial condition or results of operations of the Company. A change in statutes, regulations or regulatory policies applicable to the Company or our subsidiaries could have a material effect on the Company’s business, financial condition and results of operations.

16

Table of Contents

Dodd-Frank Wall Street Reform and Consumer Protection Act

The Dodd-Frank Act, which was enacted in July 2010, effected a fundamental restructuring of federal banking regulation. In addition to those provisions discussed above, among the Dodd-Frank Act provisions that have affected us are the following:

Many of the Dodd-Frank Act’s provisions are still subject to the final rulemaking by federal banking agencies, and the implication of the Dodd-Frank Act for the Company’s business will depend to a large extent on how such rules are adopted and implemented. The Company’s management continues to review actively the provisions of the Dodd–Frank Act and assess its probable impact on its business, financial condition, and results of operations.

Available Information

We file annual, quarterly and current reports, proxy statements and other information with the SEC. You may read and copy any document we file at the SEC’s Public Reference Room at 100 F Street, N.E., Washington, D.C. 20549. Please call the SEC at 1-800-SEC-0330 for further information on the public reference room. Our SEC filings are also available to the public at the SEC’s web site at http://www.sec.gov. Our web site is http://www.ffin.com . You may also obtain copies of our annual, quarterly and special reports, proxy statements and certain other information filed with the SEC, as well as amendments thereto, free of charge from our web site. These documents are posted to our web site after we have filed them with the SEC. Our corporate governance guidelines, including our code of conduct applicable to all our employees, officers and directors, as well as the charters of our audit and nominating committees, are available at www.ffin.com . The foregoing information is also available in print to any shareholder who requests it. Except as explicitly provided, information on any web site is not incorporated into this Form 10-K or our other securities filings and is not a part of them.

17

Table of Contents