Better Health for All

QCR Holdings, Inc. is a bank, and its core financial products and services are generally neutral in terms of direct health impact. The company's Community Reinvestment Act (CRA) initiatives, however, demonstrate a commitment to serving low-to-moderate income neighborhoods, with an 'Outstanding' CRA rating.

The bank's main office is in a low-income census tract, and its lending activities show excellent geographic distribution and good borrower distribution across income levels. The company provides comprehensive health benefits to its employees, including medical, mental health, substance use disorder, and preventative care services. These benefits include coverage for autism spectrum disorders and breastfeeding support, and detail deductibles and out-of-pocket maximums. The company also offers a sabbatical program and up to 40 hours of paid leave per year for employees, which can be used for any reason. The company's health plan includes HIPAA compliance for data privacy. Furthermore, QCR Holdings employees provided 3,788 hours of community development services, primarily financial literacy education to low- and moderate-income individuals.

Fair Money & Economic Opportunity

No specific, quantifiable evidence was found in the provided articles to assess QCR Holdings, Inc. against the defined KPIs for Fair Money & Economic Opportunity. The articles primarily focus on general financial performance

or broad community involvement (such as total volunteer hours or total donations) without providing metrics on underserved client share, pricing fairness, exploitative fee exposure, inclusion initiatives, data accessibility, fair lending compliance, wealth building outcomes, profit reinvestment percentages, financial literacy program reach/outcomes, debt burden ratios, geographic inclusion, or product simplicity as required by the rubric's quantitative thresholds.

Fair Pay & Worker Respect

In the 2024 fiscal year, the CEO pay ratio was 22:1, derived from the CEO's total compensation of $1,356,825 and a median employee pay of $70,817.

For 2023, the company's employee engagement survey score was 78%, with 92% of employees participating. This engagement score was reported to be above the financial services national benchmark of 75%.

Honest & Fair Business

The company has established procedures for handling complaints regarding accounting, internal controls, or auditing matters, including confidential and anonymous submission options, with reporting channels to the Audit Committee, Executive Vice President, Director of Internal Audit, or Audit Committee Chair.

The Code of Business Conduct and Ethics explicitly prohibits corruption, bribery, and unfair advantages to public officials or third parties. This code has been reviewed and updated annually since 2003. Corporate Governance Guidelines, last revised in May 2022, emphasize board independence and diversity, requiring board members to be independent, free from relationships that would interfere with independent judgment, and meet Nasdaq, other exchange, and SEC independence requirements. The policy also requires disclosure of potential conflicts and recusal from relevant matters.

Planet-Friendly Business

The company does not report any carbon emissions data, reduction targets, or climate pledges, and is not participating in tracked reduction initiatives or disclosure networks.

No specific data is available for sustainability initiatives such as renewable energy, water use, or waste diversion. While the company provides financing for solar projects ($98 million) and PACE financing ($9 million), this is not evidence of reinvestment of its own EBIT into climate-positive initiatives. No information is provided regarding environmental compliance violations, climate-related financial risks, or supply chain climate transparency.

Respect for Cultures & Communities

QCR Holdings, Inc. reported using translation services 1,491 times and translating materials into 11 languages in 2023, indicating strong local language support.

The company's business model as a multi-bank holding company does not inherently involve activities that typically lead to cultural appropriation incidents, cultural site disruptions, or require Free, Prior, and Informed Consent (FPIC) processes, community governance inclusion, or specific cultural preservation investments. Therefore, these KPIs are scored at 0, indicating they are not applicable to the business model or no incidents were reported. There is no specific evidence provided for formal partnerships, revenue reinvested in local community development, local employment ratios, grievance mechanisms, complaint resolution times, local procurement, indigenous suppliers, charitable giving to cultural heritage organizations, or cultural sensitivity training completion.

Safe & Smart Tech

The company reports that no cybersecurity threats or incidents have materially affected it to date.

It provides periodic cybersecurity training for its workforce. The company states it takes reasonable steps to protect personal information from unauthorized access, use, and disclosure, and that it uses authentication credentials for online banking and transactions. It also mentions previous experience in secure data transfer and authentication mechanisms for integrations. The company has security and privacy policies in effect across all businesses and geographic locations, and states it will not collect additional categories of personal data or use collected data for materially different purposes without notice. However, the company collects a broad range of personal information, including device contact lists, camera, and photos. It retains data until the expiration of retention limits set by applicable law, which can be 7+ years, indicating limited data minimization. Users have minimal control over their data, with rights to not receive marketing promotions, update information, and relate concerns, but not comprehensive control over data sharing with affiliates or deletion. The company's website uses essential, analytics, and marketing cookies, including geolocation cookies, and states it does not collect personal data, which conflicts with the detailed list of personal information collected elsewhere. Critical vulnerabilities are patched within 21-30 days on average. #7 The company states it is in accordance with RA 10173, the Data Privacy Act of 2012, but this is a basic compliance statement without further detail on implementation or proactive measures. MFA is available for less than 20% of services, as implied by the general statement about authentication credentials for online banking and transactions, without specifying broader MFA availability. #7

Zero Waste & Sustainable Products

QCR Holdings, Inc. has eliminated single-use plastic products across its operations.

The company has also implemented several waste reduction initiatives, including company-wide recycling programs, donating old office furniture, and promoting the use of e-statements by customers. Furthermore, the company promotes the use of e-statements to customers, which serves as a clear initiative to reduce paper waste.