Phocas Financial Corporation

FEES AND COMPENSATION

Phocas’ fees are generally calculated as a percentage of the total market value of assets under
management and are generally billed quarterly in arrears. Institutional clients are billed
accordingly. Fees are negotiable and vary according to arrangements with clients. Clients may
terminate an investment advisory agreement upon written notice to Phocas. In the event a client
terminates an account prior to quarter-end, client will pay a prorated fee calculated to the
termination date of that account.

Phocas’ fees for private wealth management clients may be directly debited from their respective
custodial accounts. In those cases, clients provide Phocas with written authorizations to debit
advisory fees directly from their accounts. Clients are sent their fee invoices showing the
amounts of the fees, the values of their assets on which the fee was based, and the specific ways
our fee was calculated. The custodian is also sent a similar invoice indicating only the amount of
the fees to be paid by the custodian on behalf of the client. It is the client’s responsibility to
verify the fee calculations. The custodian will not determine whether fees are properly

calculated. The custodian will send statements to clients, at least quarterly, indicating all
amounts disbursed from accounts including the amounts of advisory fees paid directly to Phocas.
Clients should contact their custodians or Phocas immediately if they do not receive statements
from their custodians.

Account custodians may charge fees, which are in addition to and separate from the investment
advisory service fees. Custodians may charge accounts for various transaction costs, retirement
plan and administration fees. In addition, some mutual fund assets deposited in the account may
have been subject to deferred sales charges and 12(b)(1) fees and other mutual fund annual
expenses as described in the fund’s prospectus. Advisory clients should also note that fees for
comparable services vary and lower fees for comparable services may be available from other
sources.

Phocas’ fee schedules, subject to negotiation, are as follows:

Institutional Clients ($10 Million Minimum)

   •   U.S. Small Cap Value Strategy:       1% of assets per annum
   •   Real Estate Investment Trusts:       1% of assets per annum
   •   Equity Income:                       1% of assets per annum

Private Wealth Management Clients

   •   1.0% of assets per annum

While the above normally applies to the private wealth management clients, Phocas may agree to
different fees based upon certain circumstances such as the total amount of assets under
management, the nature of such assets, services provided, and other factors.

TYPES OF CLIENTS

Phocas’ clients include:

   •   Individuals;
   •   Pooled Investment Vehicles;
   •   State and/or municipal government entities;
   •   Corporate Plans; and
   •   Other Investment Advisers.

Phocas generally requires minimum account sizes of one million dollars ($1,000,000.00) for
Individuals and ten million dollars ($10,000,000.00) for all others. Account size minimums may
be waived under certain circumstances.

    METHODS OF ANALYSIS, INVESTMENT STRATEGIES AND RISK OF LOSS

U.S. Small Capitalization Value Equity:
This strategy employs fundamental research, GICS sector-peer decile ranking algorithms, and
various ratio analyses to value investment candidates and portfolio holdings. At the portfolio
level, risk is managed by observation of fundamental information, valuations, and portfolio
diversification.

This strategy invests in U.S. small cap companies. That involves additional risks such as limited
liquidity and greater volatility. Small Cap stocks typically are more volatile than larger value
capitalization stocks, and value stocks may have lower expected growth rates in earnings and
sales than other categories of stocks.

Real Estate Investment Trusts:
This strategy depends on fundamental research, compound valuation, and various ratio analyses
to value investment candidates and portfolio holdings. At the portfolio level, risk is managed by
observation of fundamental information, and valuations.

This strategy may invest in foreign securities which involve political, economic and currency
risks, greater volatility, and differences in accounting methods. The REIT strategy is non-
diversified, meaning it may concentrate its assets in one asset class and/or fewer individual
holdings than a more diversified strategy. Therefore, the REIT strategy is more exposed to
individual stock volatility than a more diversified strategy.

Equity Income:
This strategy employs fundamental research, fundamental analysis, including balance sheet
analysis and cash flow stability, and various ratio analyses to value investment candidates and
portfolio holdings. At the portfolio level, risk is managed by observation of fundamental
information, valuations, and portfolio diversification.

This strategy may invest in foreign securities therefore involving political, economic and
currency risks, greater volatility, and differences in accounting methods. EI may also invest in
small-cap companies, which involves additional risks such as limited liquidity and greater
volatility. Small Cap stocks typically are more volatile than value stocks; however, value stocks
have lower expected growth rates in earnings and sales.

There is an inherent risk of loss of both income and principal that is associated
with investing in any securities, including mutual funds.

Data Sources Risk
Phocas subscribes to external data sources used to observe and enforce investment restrictions or
exclusion lists, to assist in making investment decisions, investment research, index creation,
pricing and valuation of securities, processing corporate actions and collateral management.
Although Phocas believes its third-party data sources to be generally reliable, if information that
Phocas receives from a third-party data source is incorrect, a client may be negatively impacted
and may not achieve desired results. Moreover, there may be time lags associated with inputting
or implementing vendor data that can impact certain processes and thereby impact Phocas’
advisory services and/or investments.
Phocas typically receives third-party data on an “as is” basis and cannot guarantee that the data
received from these sources will be accurate or timely. Phocas is not responsible for errors by
these sources.
Natural & Unavoidable Events:
Global markets are interconnected, and events like hurricanes, floods, earthquakes, forest fires
and similar natural disturbances, war, terrorism or threats of terrorism, civil disorder, public
health crises, and similar “Acts of God” events have led, and may in the future lead, to increased
short-term market volatility and may have adverse long-term and wide-spread effects on the
world economies and markets generally. Clients can have exposures to countries and markets
impacted by such events, which could result in material losses.

Cybersecurity Risk:
Phocas faces a variety of cybersecurity risks that can impact operations, customers, and
reputation. Some of the most significant cybersecurity risks they navigate in their threat-
landscape include:

1) Data Breaches
   Data breaches can result from a variety of sources, including cybercriminals, insider threats,
   and third-party vendors. Data breaches can result in the theft or loss of sensitive information,
   including customer data, intellectual property, and other confidential information.

2) Ransomware Attacks
   Ransomware attacks are a type of malware that encrypts a victim's files, rendering them
   inaccessible until a ransom is paid. These attacks can be devastating for financial
   institutions, as they can lead to downtime, data loss, and reputational damage.

3) Phishing Attacks
   Phishing attacks are a type of social engineering attack that uses email or other
   communication methods to trick victims into providing sensitive information or clicking on
   malicious links. These attacks can result in the theft of customer data, login credentials, and
   other sensitive information.

4) Third-Party Vendor Risks
   Many SEC-regulated firms rely on third-party vendors for various services, including data
   processing, software development, and other IT-related services. These vendors can
   introduce additional cybersecurity risks, as they may have weaker security controls or be
   vulnerable to attacks.

5) Insider Threats
   Insider threats are a significant risk for many financial institutions, as they can result in the
   theft or misuse of sensitive information. Insider threats can come from employees,
...