Consent Order Regarding Compass Savings Bank

COMMONWEALTH OF PENNSYLVANIA DEPARTMENT OF BANKING AND SECURITIES : Commonwealth of Pennsylvania, : Docket No.: 25_0009___ (ENF-ORD) Department of Banking and Securities, : Bureau of Bank Supervision : : v. : : Compass Savings Bank : : CONSENT ORDER WHEREAS, Compass Savings Bank, Wilmerding, Pennsylvania (the “Bank”) is a Pennsylvania state-chartered mutual savings bank and subject to regulation by the Commonwealth of Pennsylvania Department of Banking and Securities (the “Department”) and the Federal Deposit Insurance Corporation (“FDIC”); WHEREAS, the Bureau of Bank Supervision (the “Bureau”) is primarily responsible within the Department for the regulation and supervision of the Bank; WHEREAS, the Bank was the subject of a Joint Report of Examination as of July 29, 2024 (the “2024 ROE”); WHEREAS, the 2024 ROE gave the Bureau reason to believe that the Bank had engaged in unsafe or unsound banking practices; WHEREAS, as a result of the 2024 ROE, the Bureau is of the opinion that grounds exist for the entry of a Consent Order against the Bank pursuant to Section 501.A of the Department of Banking Code, 71 P.S. § 733-501.A; and, WHEREAS, the Bank, by and through its duly elected and acting board of trustees (the “Board”), and without admitting or denying wrongdoing, agrees to the issuance of this Consent Order (the “Order”) by the Bureau; FILED 2025 MAR 21 AM 9:16 PA DEPARTMENT OF BANKING AND SECURITIES

• 2 - IT IS HEREBY ORDERED, pursuant to Section 501.A of the Department of Banking and Securities Code, 71 P.S. § 733-501.A, that the Bank, its trustees, officers, employees, agents, and other “institution-affiliated parties,” as that term is defined in Section 3(u) of the FDIA, 12 U.S.C. § 1813(u), and its successors and assigns, shall take the following affirmative action: I. BOARD REQUIREMENTS A. Supervision, Direction, and Oversight. Within 60 days from the effective date of this Order the Board must increase, commensurate with the size and complexity of the Bank, its supervision and direction of Bank management, and its oversight and monitoring of the Bank’s financial condition and operations, including the implementation of and adherence to the Bank’s written policies, procedures, and/or internal controls (collectively, Policies and Procedures). The Board must also satisfactorily address the Board oversight and supervision-related deficiencies and weaknesses identified in 2024 ROE, and, at a minimum, ensure that:

1. Officers. The Bank has appropriate planning, including succession planning, in place to maintain an adequate number of officers with the experience and expertise, sufficient authority, and resources necessary to satisfactorily oversee and manage Bank activities and operations and associated risks, including in the area of information technology, to assure compliance with this Order and applicable laws and regulations, and implement, and adhere to Policies & Procedures on an on-going basis. This planning must formalize and provide for, at a minimum, a strategy to increase staffing to an adequate level and with an appropriate level of expertise to appropriately oversee and manage the Bank, proper succession oversight and training with detailed job descriptions of roles and responsibilities for all positions, viable options to fill unanticipated vacancies with individuals who possess the knowledge and capacity necessary to successfully discharge assigned responsibilities, and cross-training and knowledge transfer procedures.

• 3 -

2. Oversight and Monitoring. The Bank has Policies & Procedures and/or systems in place to provide the Board with timely reports containing sufficient information and documentation to enable the Board to appropriately oversee, monitor and regularly evaluate the activities and operations of the Bank and the implementation of, adherence to, and effectiveness of Policies & Procedures and all corrective action taken to comply with this Order. The Board must, at a minimum, enhance its oversight of the Bank’s Earnings Improvement Plan, Capital Plan, IRR Improvement Plan, Liquidity Improvement Plan, Strategic Plan, all as defined below, in addition to the internal audit function and information and technology-related Policies & Procedures, including the information technology audit function (collectively, Enhanced Oversight).
3. Board Meetings and Documentation. The Board must ensure that Board and any Board Committee meeting minutes are sufficiently detailed and reflect its Enhanced Oversight, the discussion of and rationale for material decisions, any specific actions taken or to be taken, and any requirements of or directions to Bank management as a result of the Enhanced Oversight and/or other discussions. B. Corrective Action. The Board must also ensure that the Board and the Bank management take all steps necessary, consistent with other provisions of this Order, and safe and sound banking practices to:
4. Banking Practices, Violations, and Nonconformance. Eliminate or correct, and thereafter prevent the unsafe or unsound banking practices, the violations of law or regulation, and nonconformance with Part 364 identified in the 2024 ROE;
5. Deficiencies and Weaknesses. Appropriately address the deficiencies and weaknesses identified in the 2024 ROE; and

• 4 -

3. Order Compliance. Fully comply with the provisions of this Order in a timely manner. II. Earnings Within 90 days from the effective date of this Order, the Board must revise the Bank’s earnings improvement plan (Earnings Improvement Plan) to comprehensively detail the Bank’s strategy to improve earnings to a satisfactory level and submit it to the Bureau for review and comment or non-objection in accordance with Paragraph X of this Order. At a minimum, the Earnings Improvement Plan must, consistent with safe and sound banking practices and appropriately considering the other requirements of this Order, satisfactorily (i) include a comprehensive operating budget addressing all categories of income and expense with formal goals and a detailed description of the operating assumptions forming the basis for major projected income and expense components; (ii) include measurable strategies and realistic timeframes to improve core earnings and the net interest margin; (iii) include detailed and well￾supported descriptions of each strategy or objective to improve earnings with financial projections and supporting assumptions; (iv) quarterly, require evaluation of the Bank’s actual performance in relation to the Earnings Improvement Plan, along with the submission of a report to the Board documenting and reflecting performance evaluations. III. Capital Within 90 days from the effective date of this Order, the Board must revise its capital plan (Capital Plan) to comprehensively detail the Bank’s strategy to improve capital to a satisfactory level and submit it to the Bureau for review and comment or non-objection in accordance with Paragraph X of this Order. At a minimum, the Capital Plan must, consistent with safe and sound banking practices, and appropriately taking into account the other requirements of this Order satisfactorily (i) establish a minimum Leverage Ratio, as defined at 12

• 5 - C.F.R. § 324.10(b)(4), and a minimum Total Capital Ratio, as defined at 12 C.F.R. § 324.10(b)(3), necessary to assure the Bank’s safe and sound operation; (ii) include detailed and well-supported analyses for the minimum capital levels established that considers asset, funding, operational, and concentration risks, in addition to any growth plans; (iii) include a detailed and well-supported strategy with financial projections and supporting assumptions for attaining and maintaining the established minimum capital levels, with a list of the primary and contingent sources of capital and the amount of capital and timeframes for obtaining capital from each source; and (iv) quarterly, require evaluation of the Bank’s actual performance in relation to the Capital Plan, along with the submission of a report to the Board documenting and reflecting performance evaluations. IV. Interest Rate Risk Within 90 days from the effective date of this Order, the Board must ensure that the Bank develops and submits an interest rate risk (IRR) mitigation plan (IRR Mitigation Plan) to comprehensively detail the Bank’s strategy to reduce its interest rate exposure to a level that is appropriate given the levels of earnings and capital and submit it to the Bureau for review, and comment or non-objection in accordance with Paragraph X of this Order. At a minimum, the IRR Improvement Plan must, consistent with safe and sound banking practices and appropriately considering the other requirements of this Order, satisfactorily (i) include measurable strategies and realistic timeframes to reduce its interest rate exposure to a level supported by the level of earnings and capital; (ii) include detailed and well-supported descriptions of each strategy or objective to improve IRR with financial projections and supporting assumptions; (iii) establish Procedures for monitoring and reporting risk exposures to the Board and for addressing exposures outside of established risk limits; and (iv) quarterly, require evaluation of the Bank’s

• 6 - actual performance in relation to the IRR Improvement Plan, along with the submission of a report to the Board documenting and reflecting performance evaluations. V. Interest Rate Risk Measurement Within 90 days from the effective date of this Order, the Board must, consistent with safe and sound banking practices and appropriately considering the other requirements of this Order, satisfactorily (i) improve the IRR measurement and modeling system by ensuring model assumptions are appropriate for the Bank’s balance sheet structure and operating strategies; (ii) ensure model assumptions are well-supported, with appropriate documentation and updated as appropriate; and (iii) ensure appropriate back testing of the system is completed at an appropriate frequency. VI. Liquidity Within 90 days from the effective date of this Order, the Board must develop a liquidity improvement plan (Liquidity Improvement Plan) to comprehensively detail the Bank’s strategy to improve the liquidity position to a satisfactory level and submit it to the Bureau for review and comment or non-objection in accordance with Paragraph X of this Order. At a minimum, the Liquidity Improvement Plan must, consistent with safe and sound banking practices and appropriately considering the other requirements of this Order, satisfactorily (i) include measurable strategies and realistic timeframes to improve liquidity to a satisfactory level, based on supportive assumptions; (ii) include detailed and well-supported descriptions of each strategy or objective with financial projections and supporting assumptions; and (iii) quarterly, require evaluation of the Bank’s actual performance in relation to the Liquidity Improvement Plan, along with the submission of a report to the Board documenting and reflecting performance evaluations.

• 7 - VII. Internal Audit Function Within 120 days from the effective date of this Order, the Board must ensure the Bank’s internal audit function is appropriate for the size and complexity of the Bank and provide for satisfactory monitoring of internal controls over operational areas. At a minimum, the internal audit function must, consistent with safe and sound banking practices and appropriately considering the other requirements of this Order, satisfactorily (i) include Policies & Procedures with guidelines for the engagement of auditors, staffing, audit frequency, scoping, audit plan risk ratings, documentation, workpapers and reports, tracking of audit and regulatory findings and recommendations and (ii) require tracking of corrective action and management’s remediation process. VIII. Information Technology Within 120 days from the effective date of this Order, the Board must ensure the Bank’s information technology function is appropriate for the size and complexity of the Bank and provide for satisfactory monitoring of information technology operations. At a minimum, the Board must, consistent with safe and sound banking practices and appropriately considering the other requirements of this Order, satisfactorily (i) improve information security standards by expanding business continuity and incident response planning, patch management, user access reviews, environmental controls, end-of-life preparedness, encryption, and network monitoring; (ii) ensure governance is commensurate with risk and complexity of operations by expanding Board and committee reporting, vendor management, information technology management knowledge and resources, the identity theft red flags program, and cybersecurity preparedness; and (iii) improve the information technology audit function by expanding recommendation tracking and increasing information technology governance and oversight.

• 8 - IX. Strategic Plan Within 120 days from the effective date of this Order and no later than December 15 of each calendar year thereafter while this Order is in effect, the Board must revise and submit the Bank’s written strategic plan (Strategic Plan) to the Bureau for review, and comment or non￾objection in accordance with Paragraph X of this Order. At a minimum, the Strategic Plan must, consistent with safe and sound banking practices and appropriately considering the other requirements of this Order, satisfactorily (i) assess the Bank’s current financial condition, market area, and capital needs appropriately, and current and projected assets, liabilities, Bank activities, earnings, operational costs, and concentrations; (ii) address the Bank’s next three (3) years of operations and, at a minimum, establish objectives for the Bank’s earnings performance, growth, balance sheet mix, liability structure, and capital, together with strategies for achieving those objectives; (iii) establish specific goals and measurable performance metrics; (iv) establish plans for the sale, merger, or liquidation of the Bank in the event primary and contingent sources of capital identified in the Capital Plan are not available or insufficient to attain and maintain established minimum capital levels; and (v) require quarterly evaluations of actual performance in relation to the Strategic Plan, document the results of the evaluation with a detailed explanation of, and reasons for, variances of 10 percent or more and any action to be taken as a result of the evaluation. X. Non-objection, Implementation and Adherence A. Review, Comment or Non-objection. When a provision of this Order requires the Bank to submit a matter to the Bureau for review, and comment or non-objection (Submission), or engage in any other communications with the Bureau, the Bank will make the submission (which may be by electronic mail) to:

• 9 - Robert C. Lopez, Director Bureau of Bank Supervision Commonwealth of Pennsylvania Department of Banking and Securities 17 North Second Street, Suite 1300 Harrisburg, Pennsylvania 17101 rolopez@pa.gov Within 30 days from receipt of comments from the Bureau, the Board or Bank will make such modifications as may be necessary to respond to the Bureau’s comments and resubmit the Submission for review, and additional comments or non-objection. B. Adoption, Implementation and Adherence. The Board will adopt any Submission, at its next regularly scheduled meeting following receipt of the Bureau’s written non-objection to such Submission. For any matter required by this Order but not requiring the written non-objection of the Bureau, the Board must act on such matter within the timeframe required for such action in this Order. All actions must be appropriately reflected in the Board minutes. Thereafter, the Board must ensure that the Bank fully implements and adheres to the plan, Policy & Procedure, or other matter as adopted. In the event a Submission required by this Order and adopted by the Board, or any portion thereof, is not fully implemented or adhered to, the Board must promptly, in no instance more than 30 days from the event, advise the Bureau in writing of the specific reasons for the deviation or delay and the steps it will take to address the deviation or delay. The Bureau may either provide a written non-objection to any such deviation or delay or require compliance with the Submission as adopted by the Board. XI. Progress Reports Within 45 days of the end of each calendar quarter following the effective date of this Order, the Board must furnish to the Bureau written progress reports detailing the form, manner, and results of any actions taken to secure compliance with this Order. Supporting documentation

• 10 - must also be submitted with each written progress report. All progress reports and other written responses to this Order must be reviewed and approved by the Board and be made a part of the Board minutes. XII. Miscellaneous A. Section 403 Reports to the Bureau. All reports required to be submitted to the Bureau under this Order are special reports being required under Section 403 of the Department of Banking and Securities Code, 71 P.S. § 733-403, and shall be submitted to the Bureau in accordance with Section 403.B of the Department of Banking and Securities Code, 71 P:S. § 733-403.B. B. Other Actions.

1. If at any time the Bureau shall deem it appropriate in fulfilling the responsibilities placed upon the Bureau under applicable law to undertake any further action affecting the Bank, nothing in this Order shall in any way inhibit, estop, bar or otherwise prevent the Bureau from doing so.
2. Nothing herein shall preclude any proceedings brought by the Bureau to enforce the terms of this Order, and that nothing herein constitutes, nor shall the Bank contend that it constitutes, a waiver of any right, power or authority of any other representatives of the United States, departments or agencies thereof , Department of Justice, or any other representatives of the Commonwealth of Pennsylvania or any other departments or agencies thereof, including any prosecutorial agency, to bring other actions deemed appropriate. C. Binding Nature. The provisions of this Order including the recital paragraphs shall be binding upon the Bank and all of their institution-affiliated parties, in their capacities as such, and their successors and assigns.

• 11 - D. Effective Date. The effective date of this Order shall be the date upon which this Order has been executed by the Bureau. Each provision of this Order shall remain effective and enforceable, jointly and severally, until stayed, modified, terminated or suspended by the Bureau. E. Titles. The titles used to identify the paragraphs of this document are for the convenience of reference only and do not control the interpretation of this document. SO ORDERED 3/20/25

---

Date Robert C. Lopez, Director Bureau of Bank Supervision Commonwealth of Pennsylvania Department of Banking and Securities 17 North Second Street, Suite 1300 Harrisburg, PA 17101 Redacted