Burke & Herbert Financial Services Corp. 10-K

Item 1A. Risk Factors An investment in our Common Stock involves risks and uncertainties. In addition to the other information set forth in this Form 10-K, including information addressed under “Disclosure Regarding Forward-Looking Statements,” investors in our Common Stock should carefully consider the factors discussed below. These factors could materially and adversely affect our business, financial condition, liquidity, results of operations, and capital position and could cause our actual results to differ materially from our historical results or the results contemplated by the forward-looking statements contained in our Form 10-K, in which case the trading price of our Common Stock could decline. The Risk Factors Summary that follows should be read in conjunction with the detailed description of risk factors following this summary section. 22 Table of Contents Risk Factor Summary o Risks Related to Our Lending Activities • We may not be able to measure and limit our credit risk adequately. • Our decisions regarding credit risk could be inaccurate and our allowance for credit losses may be inadequate. • If our non-performing assets increase, our earnings will be adversely affected. • Our focus on lending to small to medium-sized businesses may increase our credit risk. • Adverse changes in the real estate market or economy in our market area could lead to higher levels of problem loans and charge-offs, adversely affecting our earnings and financial condition. • We are exposed to higher credit risk by commercial real estate, commercial and industrial, and acquisition, construction & development-based lending, as well as large lending relationships. • We engage in lending secured by real estate and may be forced to foreclose on the collateral. • A significant percentage of our loans are attributable to a relatively small number of borrowers. • The appraisals and other valuation techniques we use may not accurately reflect the net value of the asset. o Risks Related to Funding and Liquidity • Liquidity risk could impair our ability to fund operations and meet our obligations as they become due. • Loss of deposits or a change in deposit mix could increase our cost of funding. • Limits on our ability to use brokered deposits as part of our funding strategy may affect our profitability. o Risks Related to Our Business, Industry, and Markets • We operate in a highly competitive market and face increasing competition. • Our financial performance may be negatively affected if we are unable to execute our strategy. • Failure to keep up with the rapid technological changes in the financial services industry could have an adverse effect on our competitive position and profitability. • We follow a relationship-based operating model, and our ability to maintain our reputation is critical to the success of our business, and the failure to do so may materially adversely affect our performance. • We are dependent on our management team and key employees. • Changes in interest rates and monetary policy may negatively affect our earnings, income and financial condition, as well as the value of our assets. • We are subject to physical and financial risks associated with climate change impacts. o Risks Related to Our Operations • We face risks related to our operational, technological, and organizational infrastructure. • System failure or breaches of our network security, including as a result of cyber-attacks or data security breaches, could subject us to increased operating costs, litigation, and other liabilities. • We rely on third parties to provide key components of our business infrastructure. • We could be subject to losses, regulatory action, or reputational harm due to fraudulent and negligent acts on the part of loan applicants, our employees, and vendors. • We are subject to claims and litigation pertaining to intellectual property. • We may be adversely affected by the lack of soundness of other financial institutions and market participants. • Our risk management framework may not be effective in mitigating risks and/or losses to us. • Demand for the Company’s services is influenced by general economic and consumer trends. • Our results may suffer if we do not effectively manage our expanded operations, including complying with any enhanced regulatory requirements. o Risks Related to Our Regulatory Environment • Our industry is highly regulated, and the regulatory framework, together with any future legislative or regulatory changes, may have a materially adverse effect on our operations. • We are subject to stringent capital requirements, which could have an adverse effect on our operations. 23 Table of Contents • We face a risk of noncompliance and enforcement action with the BSA and other anti-money laundering statutes and regulations. • We are subject to laws regarding the privacy, information security, and protection of personal information. • Our use of third-party vendors and our other ongoing third-party business relationships are subject to increasing regulatory requirements and attention. • Regulatory requirements affecting our loans secured by commercial real estate could limit our ability to leverage our capital and adversely affect our growth and profitability. • Evolving expectations from customers, regulators, investors, and other stakeholders with respect to Environmental, Social, and Governance (“ESG”) practices may impose additional costs on us or expose us to new or additional risks. o Risks Related to an Investment in Our Common Stock • We currently qualify as an “emerging growth company”, and the reduced disclosures and relief from certain other significant disclosure requirements that are available to emerging growth companies may make our Common Stock less attractive to investors. • If we fail to design, implement, and maintain effective internal control over financial reporting or remediate any future material weakness in our internal control over financial reporting, we may be unable to accurately report our financial results or prevent fraud. • We may issue additional equity securities, or engage in other transactions, which could affect the priority of our Common Stock, which may adversely affect the market price of our Common Stock. • An investment in our Common Stock is not an insured deposit and is not guaranteed by the FDIC. • Holders of our junior subordinated debentures and preferred stock have rights that are senior to those of our common stockholders. • Our Bylaws designate the United States District Court for the Eastern District of Virginia, Alexandria Division, or in the event that court lacks jurisdiction, the Circuit Court of the City of Alexandria, Virginia, as the sole and exclusive forum for certain types of actions and proceedings that may be initiated by our shareholders, which may not be enforced and could discourage lawsuits against us and our directors and officers. 24 Table of Contents Risk Related to Our Lending Activities We may not be able to measure and limit our credit risk adequately, which could adversely affect our profitability. Our business depends on our ability to successfully measure and manage credit risk. As a lender, we are exposed to the risk that the principal of, or interest on, a loan will not be paid timely, or at all, or that the value of any collateral supporting a loan will be insufficient to cover our outstanding exposure. In addition, we are exposed to risks with respect to the period of time over which the loan may be repaid, risks relating to proper loan underwriting, risks resulting from changes in economic and industry conditions, and risks inherent in dealing with individual loans and borrowers. The creditworthiness of a borrower is affected by many factors, including local market conditions and general economic conditions. Many of our loans are made to small to medium-sized businesses that may be less able to withstand competitive, economic, and financial pressures than larger borrowers. If the overall economic climate in the United States, generally, or in our market, specifically, experiences material disruption, our borrowers may experience difficulties in repaying their loans, the collateral we hold may decrease in value or become illiquid, and the level of non-performing loans, charge-offs, and delinquencies could rise and require significant additional provisions for expected credit losses. Additional factors related to the credit quality of multifamily residential, real estate construction, and other commercial real estate loans include the quality of management of the business and tenant vacancy rates. The Chief Credit Officer is responsible for establishing credit risk policies and procedures, including underwriting guidelines and credit approval authority, and monitoring credit exposure and performance of the Company’s lending-related transactions. Credit risk policies and procedures and credit-related risks are reviewed and approved by multiple committees that assess credit risk and enterprise-wide risks. Our risk management practices, such as monitoring the concentration of our loans within specific markets and our credit approval, review, and administrative practices, may not adequately reduce credit risk, and our credit administration personnel, policies, and procedures may not adequately adapt to changes in economic or any other conditions affecting customers and the quality of the loan portfolio. A failure to effectively measure and limit the credit risk associated with our loan portfolio may result in loan defaults, foreclosures, and additional charge-offs, and may necessitate that we significantly increase our allowance for credit losses, each of which could adversely affect our net income. As a result, our inability to successfully manage credit risk could have an adverse effect on our business, financial condition, and results of operations. Our decisions regarding credit risk could be inaccurate and our allowance for credit losses may be inadequate, which could materially and adversely affect our business, financial condition, results of operations, cash flows, and/or future prospects. We attempt to maintain an appropriate allowance for credit losses to provide for our estimate of all expected credit losses for financial assets held at the reporting date based on historical experience, current conditions, and reasonable and supportable forecasts. As of December 31, 2024, the allowance for credit losses was $68.0 million or 1.20% of total gross loans; however, there is no guarantee that it will be sufficient to address credit losses. The determination of the appropriate level of allowance for credit losses inherently involves a high degree of subjectivity and requires us to make significant estimates related to current and expected future credit risks and trends, all of which may undergo material changes. Continuing deterioration in economic conditions affecting borrowers and securities issuers; new information regarding existing loans, credit commitments and securities holdings; global pandemics; natural disasters and risks related to climate change; and identification of additional problem loans, ratings down-grades and other factors, both within and outside of our control, may require an increase in the allowances for credit losses on loans, securities, and off-balance sheet credit exposures. There is no precise method of predicting credit losses, and therefore, we always face the risk that losses in future periods will exceed our allowance for credit losses and that we would need to make additional provisions to our allowance for credit losses, which would reduce our earnings. Our methodology for the determination of the adequacy of the allowance for credit losses is set forth in Note 4 — Allowance for Credit Losses in the accompanying Consolidated Financial Statements. Additionally, federal and state banking regulators, as an integral part of their supervisory function, periodically review the allowance for credit losses. These regulatory agencies may require us to increase our provision for credit 25 Table of Contents losses or to recognize further loan charge-offs based upon their judgments, which may be different from ours. If we need to make significant and unanticipated increases in the loss allowance in the future, or to take additional charge-offs for which we have not established adequate reserves, our business, financial condition, and results of operations could be adversely affected at that time. On January 1, 2023, the Company adopted the Current Expected Credit Loss (“CECL”) methodology as required under ASC 326. The CECL standard requires us to record, at the time of origination, credit losses expected throughout the life of our loans as opposed to the previous approach of recording losses when it became probable that a loss event had occurred. Accordingly, our allowance for credit losses may experience more fluctuations under the CECL model than it has in the past, which could in turn result in more volatility in our provision for credit losses and, therefore, earnings. See “Recent Accounting Pronouncements” under Note 1 — Nature of Business Activities and Significant Accounting Policies of this Form 10-K, for further information regarding the implementation of CECL. If our non-performing assets increase, our earnings will be adversely affected. At December 31, 2024, we had $41.2 million in non-performing assets. Non-performing assets consist of non-accrual loans, loans 90 days or more past due and still accruing interest, and other real estate owned. Non-performing assets held by the Company will adversely affect our net income in various ways: • We record interest income only on the cash basis or cost-recovery method for non-accrual loans and we do not record interest income for other real estate owned; • We must provide for probable credit losses through a current period charge to the provision for credit losses; • Non-interest expense increases when we write down the value of properties in our other real estate owned portfolio to reflect changing market values; • There are legal fees associated with the resolution of problem assets, as well as carrying costs, such as taxes, insurance, and maintenance fees; and • The resolution of non-performing assets requires the active involvement of management, which can distract them from more profitable activity. If borrowers become delinquent and do not pay their loans and we are unable to successfully manage our non-performing assets, our losses and troubled assets could increase, which could have a material adverse effect on our financial condition and results of operations. Our focus on lending to small to medium-sized businesses may increase our credit risk. We target our business development and marketing strategy primarily to serve the banking and financial services needs of small to medium-sized businesses. These businesses generally have fewer financial resources in terms of capital access or borrowing capacity than larger entities, frequently have smaller market shares than their competition, and may be more vulnerable to economic downturns. These businesses also often need substantial additional capital to expand or compete, and may experience substantial volatility in operating results, any of which may impair their ability as a borrower to repay a loan. These factors may be especially true given the effects of global macroeconomic conditions, including volatility and market factors related to or caused by any health crises, global political conflict, rising interest rates, labor market volatility, and instability in financial markets. If general economic conditions in the markets in which we operate negatively impact this customer segment, our results of operations and financial condition and the value of our Common Stock may be adversely affected. Moreover, a portion of these loans have been made by us in recent years, and the borrowers may not have experienced a complete business or economic cycle. The deterioration of our borrowers’ businesses may hinder their ability to repay their loans with us, which could have a material adverse effect on our financial condition and results of operations. 26 Table of Contents Adverse changes in the real estate market or economy in our market area could lead to higher levels of problem loans and charge-offs, adversely affecting our earnings and financial condition. A substantial portion of our loans are secured by real estate. These concentrations expose us to the risk that adverse developments in the real estate market, or in the general economic conditions in such areas, or the continuation of such adverse developments, could increase the levels of non-performing loans and charge-offs, and reduce loan demand and deposit growth. In that event, we would likely experience lower earnings or losses. Additionally, if economic conditions in our market area deteriorate, or there is volatility or weakness in the economy or any significant sector of the economy in our markets, our ability to develop our business relationships may be diminished, the quality and collectability of our loans may be adversely affected, our provision for credit losses may increase, the value of collateral may decline, and loan demand may be reduced. We are exposed to higher credit risk by commercial real estate, commercial and industrial, and acquisition, construction & development-based lending as well as large lending relationships. Commercial real estate, commercial and industrial, and acquisition, construction & development-based lending usually involve higher credit risks than 1-4 family residential real estate lending. As of December 31, 2024, the following loan types accounted for the stated percentages of our loan portfolio: commercial real estate – 46.5%; owner-occupied commercial real estate – 10.8%; commercial and industrial – 10.8%; and acquisition, construction & development – 8.2%. These types of loans also involve larger loan balances to a single borrower or groups of related borrowers. These higher credit risks are further heightened when the loans are concentrated in a small number of larger borrowers leading to relationship exposure. As of December 31, 2024, we had 31 relationships that each had over $25 million of outstanding borrowings. While we are not dependent on any of these relationships and while none of these large relationships have directly impacted our allowance for credit losses, a deterioration of any of these large credits could require us to increase our allowance for credit losses or result in significant losses. Commercial and industrial loans and owner-occupied commercial real estate loans are typically based on the borrowers’ ability to repay the loans from the cash flow of their businesses. These loans may involve greater risk because the availability of funds to repay each loan depends substantially on the success of the business itself, which in turn can be dependent upon general economic conditions remaining stable. In addition, the assets securing the loans depreciate over time, are difficult to appraise and liquidate, and fluctuate in value based on the success of the business. Real estate construction and development loan lending involves additional risks because funds are advanced based on the security of the project, which is of uncertain value prior to its completion, and costs may exceed realizable values in declining real estate markets. Because of the uncertainties inherent in estimating construction costs (particularly given recent volatility in supply chains, the availability of raw materials, and general economic conditions) and the realizable market value of the completed project and the effects of governmental regulation of real property, it is relatively difficult to evaluate accurately the total funds required to complete a project and the related loan-to-value ratio. As a result, construction loans often involve the disbursement of substantial funds with repayment dependent, in part, on the success of the ultimate project and the ability of the borrower to sell or lease the property, rather than the ability of the borrower or guarantor to repay principal and interest. If our appraisal of the value of the completed project proves to be overstated or market values or rental rates decline, we may have inadequate security for the repayment of the loan upon completion of construction of the project. If we are forced to foreclose on a project prior to or at completion due to a default, we may not be able to recover all of the unpaid balance of, and accrued interest on, the loan, as well as related foreclosure and holding costs. In addition, we may be required to fund additional amounts to complete the project and may have to hold the property for an unspecified period of time while we attempt to dispose of it. Additionally, commercial real estate loans, commercial and industrial loans, and acquisition, construction & development loans are more susceptible to a risk of loss during a downturn in the business cycle. Our underwriting, review and monitoring cannot eliminate all of the risks related to these loans. In particular, the banking regulatory agencies have expressed concerns about weaknesses in the current commercial real estate market. Banking regulatory authorities typically give commercial real estate lending greater scrutiny and may require banks with higher levels of commercial real estate loans to implement enhanced risk management practices, including stricter 27 Table of Contents underwriting, internal controls, risk management policies, more granular reporting, and portfolio stress testing, as well as possibly higher levels of allowances for losses and capital levels as a result of commercial real estate lending growth and exposure. If our banking regulators determine that our commercial real estate lending activities are particularly risky and are subject to heightened scrutiny, we may incur significant additional costs or be required to restrict certain of our commercial real estate lending activities. We engage in lending secured by real estate and may be forced to foreclose on the collateral and own the underlying real estate, subjecting us to the costs and potential risks associated with foreclosure and the ownership of real property. Since we originate loans secured by real estate, we may have to foreclose on the collateral property to protect our investment and may thereafter own and operate such property, in which case we would be exposed to the risks inherent in the ownership of real estate. The amount that we, as a mortgagee, may realize after a foreclosure depends on factors outside of our control, including, but not limited to, general or local economic conditions, environmental cleanup liabilities, assessments, interest rates, real estate tax rates, operating expenses of the mortgaged properties, our ability to obtain and maintain adequate occupancy of the properties, zoning laws, governmental and regulatory rules, and natural disasters. Our inability to manage the amount of costs or size of the risks associated with the ownership of real estate or write-downs in the value of other real estate owned (“OREO”) could have an adverse effect on our business, financial condition, and results of operations. Additionally, consumer protection initiatives or changes in state or federal law may substantially increase the time and expenses associated with the foreclosure process or prevent us from foreclosing at all. A number of states in recent years have either considered or adopted foreclosure reform laws that make it substantially more difficult and expensive for lenders to foreclose on properties in default, including in response to the COVID-19 pandemic. Additionally, federal and state regulators have prosecuted or pursued enforcement action against a number of mortgage servicing companies for alleged consumer law violations. If new federal or state laws or regulations are ultimately enacted that significantly raise the cost of foreclosure or raise outright barriers to foreclosure, they could have an adverse effect on our business, financial condition, and results of operations. A significant percentage of our loans are attributable to a relatively small number of borrowers. Our 10 largest borrowing relationships accounted for approximately 8.8% of our total loans at December 31, 2024. Our largest single borrowing relationship accounted for approximately 1.2% of our total loans at December 31, 2024. The loss of any combination of these borrowers, or a significant decline in their borrowings due to fluctuations related to their business needs or as a result of general economic conditions, could adversely affect our results of operations if we are unable to replace their borrowings with similarly priced new loans or investments. In addition, with this concentration of credit risk among a limited number of borrowers, we may face a greater risk of material credit losses if any one or several of these borrowers fail to perform in accordance with their loans, compared to a bank with a more diversified loan portfolio. The appraisals and other valuation techniques we use in evaluating and monitoring loans secured by real property and other real estate owned may not accurately reflect the net value of the asset. In considering whether to make a loan secured by real property, we generally require an appraisal of the property. However, an appraisal is only an estimate of the value of the property at the time the appraisal is made, and, as real estate values may change significantly in value in relatively short periods of time (especially in periods of heightened economic uncertainty), this estimate may not accurately reflect the net value of the collateral after the loan is made. As a result, we may not be able to realize the full amount of any remaining indebtedness when we foreclose on and sell the relevant property. In addition, we rely on appraisals and other valuation techniques to establish the value of OREO that we acquire through foreclosure proceedings and to determine loan impairments. If any of these valuations are inaccurate, our consolidated financial statements may not reflect the correct value of our OREO, if any, and our allowance for credit losses may not reflect accurate loan impairments. Inaccurate valuation of OREO or inaccurate provisioning for credit losses could have an adverse effect on our business, financial condition, and results of operations. The Company’s OREO amounted to $2.8 million as of December 31, 2024. 28 Table of Contents Risk Related to Funding and Liquidity Liquidity risk could impair our ability to fund operations and meet our obligations as they become due. Liquidity is essential to our business. An inability to maintain sufficient deposits or raise funds through additional deposits, borrowings, the sale of loans, and other sources could have a substantial negative effect on our liquidity. Our access to funding sources in amounts adequate to finance our activities, or on terms that are acceptable to us, could be impaired by factors that affect us specifically, the financial services industry, or the economy, in general. Factors that could detrimentally affect our access to liquidity sources may be beyond our control and include, among other things, market disruptions, changes in our credit ratings, lack of sufficient qualifying collateral to support borrowings, competitive dynamics, reputational damage, the confidence of depositors in us or the financial-services industry, generally, a decrease in the level of our business activity as a result of a downturn in the markets in which our loans are concentrated, and an adverse regulatory action against us. Our ability to borrow could also be impaired by factors that are not specific to us, such as a disruption in the financial markets, increased inflation, tariffs or other disruptions to global trade, trade agreements or supply chains, rising interest rates, the state of the regulatory environment and monetary and fiscal policies, the possibility of the U.S. government defaulting on its debt, or negative views and expectations about the prospects for the financial services industry or the global economy more broadly. Actual events involving limited liquidity, defaults, non-performance, or other adverse developments that affect financial institutions, transactional counterparties, or other companies in the financial services industry or the financial services industry, generally, or concerns or rumors about any events of these kinds or other similar risks, have in the past, and may in the future, lead to market-wide liquidity problems. Among other sources of funds, we rely heavily on deposits for funds to make loans and provide for our other liquidity needs. However, loan demand may exceed the rate at which we are able to build core deposits for which there is substantial competition from a variety of different competitors, so we may rely on more interest-sensitive deposits, including brokered deposits, as sources of funds. Those deposits may not be as stable as other types of deposits, and in the future, depositors may not renew those deposits when they mature, or we may have to pay a higher rate of interest to attract or retain them or to replace them with other deposits or with funds from other sources. Not being able to attract deposits, or to retain or replace them as they mature, would adversely affect our liquidity. Paying higher deposit rates to attract, retain, or replace those deposits could have a negative effect on our net interest margin and operating results. Furthermore, as we and other banking organizations experienced in 2023, the failure of other financial institutions may cause deposit outflows as customers spread deposits among several different banks so as to maximize their amount of FDIC insurance, move deposits to banks deemed “too big to fail” or to remove deposits from the banking system entirely. As of December 31, 2024, approximately 29.6% of our deposits were uninsured and we rely on these deposits for liquidity. Loss of deposits or a change in deposit mix could increase our cost of funding. Deposits are generally a low-cost and stable source of funding. We compete with banks and other financial institutions for deposits. Funding costs may increase if we lose deposits and are forced to replace them with more expensive sources. Depending on the interest rate environment and competitive factors, low-cost deposits may need to be replaced with higher cost funding, resulting in a decrease in net interest income and net income. Limits on our ability to use brokered deposits as part of our funding strategy may affect our profitability. A “brokered deposit” is any deposit that is obtained from, or through the mediation or assistance of, a deposit broker. These deposit brokers attract deposits from individuals and companies throughout the country and internationally whose deposit decisions are based almost exclusively on obtaining the highest interest rates. We have used brokered deposits in the past, and we may continue to use brokered deposits as one of our funding sources to support future growth. As of December 31, 2024, brokered deposits represented approximately 3.8% of our total deposits. Banks may be restricted in their ability to accept brokered deposits, depending on their capital classification. “Well capitalized” banks are permitted to accept brokered deposits, but all banks that are not well capitalized could 29 Table of Contents be restricted from accepting such deposits. Should we lose our “well capitalized” status, these restrictions could materially and adversely affect our ability to access lower costs funds, and thereby decrease our future earnings capacity. 30 Table of Contents Risks Related to Our Business, Industry and Markets We operate in a highly competitive market and face increasing competition from a variety of traditional and new financial services providers. We have many competitors. Our principal competitors are commercial and community banks, credit unions, savings and loan associations, mortgage banking firms, online mortgage lenders, and consumer finance companies, including large national financial institutions that operate in our market. Many of these competitors are larger than us, have significantly more resources, greater brand recognition, more extensive and established branch networks or geographic footprints than we do, and may be able to attract customers more effectively than we can. Because of their scale, many of these competitors can be more aggressive than we can on loan and deposit pricing, and may better afford and make broader use of media advertising, support services, and electronic technology than we do. Also, many of our non-bank competitors have fewer regulatory constraints and may have lower cost structures. We compete with these other financial institutions, both in attracting deposits and making loans. We expect competition to continue to increase as a result of legislative, regulatory, and technological changes, the continuing trend of consolidation in the financial services industry, and the continued emergence of alternative banking sources. Our profitability in large part depends upon our continued ability to compete successfully with traditional and new financial services providers, some of which maintain a physical presence in our market and others of which maintain only a virtual presence. Increased competition could require us to increase the rates we pay on deposits or lower the rates that we offer on loans, which could reduce our profitability. Our financial performance may be negatively affected if we are unable to execute our strategy. Our strategy is to grow organically and supplement that growth with select acquisitions, if available. Our success depends primarily on generating loans and deposits of acceptable risk and expense. There can be no assurance that we will be successful in continuing our organic, or internal, growth strategy. Our ability to identify appropriate markets for expansion, recruit and retain qualified personnel, and fund growth at reasonable cost depends upon prevailing economic conditions, maintenance of sufficient capital, competitive factors, changes in banking laws, and other factors. Our ability to execute on our strategy will also depend, in part, on our ability to retain the talents and dedication of key employees currently employed by the Company. It is possible that these employees may decide not to remain with the Company. If the Company is unable to retain key employees, including management, who are critical to the successful integration and future operations of the companies, the Company could face disruptions in its operations, loss of existing customers, loss of key information, expertise, or know-how, and unanticipated additional recruitment costs. We cannot be certain of our ability to manage increased levels of assets and liabilities without increased expenses and higher levels of non-performing assets. We may be required to make additional investments in equipment and personnel to manage higher asset levels and loan balances, which may adversely affect earnings, shareholder returns, and our efficiency ratio. Increases in operating expenses or non-performing assets may decrease our earnings and the value of the Company’s capital stock. To the extent we are able to supplement organic growth with one or more acquisitions, we will be subject to risks commonly encountered in such transactions, including risks related to the time and expense of identifying, evaluating, and negotiating potential acquisitions, exposure to unknown or contingent liabilities of the target, difficulty of integrating the operations and personnel of the target, potential disruption of our ongoing business, failure to retain key personnel at the acquired business, and failure to realize any expected revenue increases, cost savings, and other projected benefits from an acquisition. Failure to keep up with the rapid technological changes in the financial services industry could have an adverse effect on our competitive position and profitability. The financial services industry is undergoing rapid technological changes with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions to better serve customers and reduce costs. Our future success will depend, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands for convenience, as well as to create additional efficiencies in our operations. Many of our competitors 31 Table of Contents have substantially greater resources to invest in technological improvements than we have. We may not be able to implement new technology-driven products and services effectively or be successful in marketing these products and services to our customers. Failure to keep pace successfully with technological change affecting the financial services industry could harm our ability to compete effectively and could have an adverse effect on our business, financial condition, and results of operations. As these technologies improve in the future, we may be required to make significant capital expenditures in order to remain competitive, which may increase our overall expenses and have an adverse effect on our business, financial condition, and results of operations. We follow a relationship-based operating model, and our ability to maintain our reputation is critical to the success of our business, and the failure to do so may materially adversely affect our performance. We are a community bank, and our reputation is one of the most valuable components of our business. As such, we strive to conduct our business in a manner that enhances our reputation. This is done, in part, by recruiting, hiring, and retaining bankers and other associates who share our core values of being an integral part of the communities we serve, delivering superior service to our customers, and caring about our customers and associates. Furthermore, maintaining our reputation also depends on our ability to protect our brand name and associated trademarks. However, reputation risk, or the risk to our business, earnings, and capital from negative public opinion surrounding our Company, and the financial services industry, generally, is inherent in our business. Negative public opinion can result from our actual or alleged conduct in any number of activities, including business and lending practices, corporate governance, and acquisitions, and from actions taken by government regulators and community organizations in response to those activities. Negative public opinion can adversely affect our ability to keep and attract customers and employees and can expose us to litigation and regulatory action. Although we take steps to minimize reputation risk in dealing with our customers and communities, this risk will always be present given the nature of our business. If our reputation is negatively affected by the actions of our employees, or otherwise, our business and operating results may be materially adversely affected. We are dependent on our management team and key employees. We believe that our continued growth and future success will depend on the retention of our management team and key employees. Our management team and other key employees, including those who conduct our loan origination and other business development activities, have significant industry experience. We cannot ensure that we will be able to retain the services of any members of our management team or other key employees. Though we have employment agreements in place with certain members of our management team, they may still elect to leave at any time. The loss of any of our management team or our key employees could adversely affect our ability to execute our strategy, and we may not be able to find adequate replacements on a timely basis, or at all. Our future success also depends on our continuing ability to attract, develop, motivate, and retain key employees. Qualified individuals are in high demand, and we may incur significant costs to attract and retain them. Because the market for qualified individuals is highly competitive, we may not be able to attract and retain qualified officers or candidates. Failure to attract and retain a qualified management team and qualified key employees could have an adverse effect on our business, financial condition, and results of operations. Changes in interest rates and monetary policy may negatively affect our earnings, income, and financial condition, as well as the value of our assets. Our earnings and cash flows depend substantially upon our net interest income. Net interest income is the difference between interest income earned on interest-earning assets, such as loans and investment securities, and interest expense paid on interest-bearing liabilities, such as deposits and borrowed funds. Interest rates are sensitive to many factors that are beyond our control, including general economic conditions, competition and policies of various governmental and regulatory agencies, and in particular, the policies of the Federal Reserve. An important function of the Federal Reserve is to regulate the money supply and credit conditions. Among the instruments used by the Federal Reserve to implement these objectives are open market purchases and sales of U.S. government securities, adjustments of the discount rate and changes in banks’ reserve requirements against bank 32 Table of Contents deposits. These instruments are used in varying combinations to influence overall economic growth and the distribution of credit, bank loans, investments and deposits. Their use also affects interest rates charged on loans or paid on deposits. Until recently, we were in a rising rate environment. Interest rate increases often result in larger payment requirements for our borrowers, which increases the potential for default. At the same time, the marketability of the property securing a loan may be adversely affected by any reduced demand resulting from higher interest rates. In a rising interest rate environment, there may be an increase in prepayments on loans as borrowers refinance their loans at lower rates. In 2024, the Federal Reserve’s interest rate policy shifted as inflationary pressure began to ease and economic growth moderated. Following a period of aggressive rate hikes in 2022 and 2023 aimed at curbing inflation, the Federal Reserve began lowering rates in 2024, with the Federal Funds target rate ranging from 5.25% to 5.5% at year-end 2023, compared to its range of 4.25% to 4.50% at year end 2024. Interest rate decreases can lead to increased prepayments of loans and mortgage-backed securities as borrowers refinance their loans to reduce borrowing costs. Under these circumstances, we are subject to reinvestment risk as we may have to redeploy such repayment proceeds into lower yielding loans or investments, which would likely hurt our income. It is unclear whether interest rates will continue to decline in 2025. Changes in monetary policy, including changes in interest rates, could not only influence the interest we receive on loans and investment securities and the amount of interest we pay on deposits and borrowings, but such changes could also affect: (1) our ability to originate loans and obtain deposits; (2) the fair value of our financial assets and liabilities, including our securities portfolio; and (3) the average duration of our interest-earning assets. Interest-earning assets may be more responsive to changes in interest rates than interest-bearing liabilities, or vice versa (repricing risk). Individual interest rates or rate indices underlying various interest-earning assets and interest-bearing liabilities may not change in the same degree over a given time period (basis risk), and interest rate relationships may change across the spectrum of interest-earning asset and interest-bearing liability maturities (yield curve risk), including a prolonged flat or inverted yield curve environment. Any substantial, unexpected, prolonged change in market interest rates could have a material adverse effect on our financial condition and results of operations. The monetary policies and regulations of the Federal Reserve have had a significant effect on the operating results of commercial banks in the past and are expected to continue to do so in the future. The effects of such policies upon our business, financial condition and results of operations cannot be predicted. We are subject to physical and financial risks associated with climate change and other weather and natural disaster impacts. We are subject to the growing risk of climate change. Among the risks associated with climate change are more frequent severe weather events. Severe weather events such as hurricanes, tropical storms, tornados, winter storms, freezes, flooding and other large-scale weather catastrophes in our markets subject us to significant risks, and more frequent severe weather events magnify those risks. Large-scale weather catastrophes, or other significant climate change effects that either damage or destroy residential or multifamily real estate underlying mortgage loans or real estate collateral, could decrease the value of our real estate collateral or increase our delinquency rates in the affected areas and thus diminish the value of our loan portfolio. In addition, the effects of climate change may have a significant effect on our geographic markets and could disrupt our operations or the operations of our customers, third-party service providers, or supply chains, more generally. Those disruptions could result in declines in economic conditions in our geographic markets or industries in which our borrowers operate and impact their ability to repay loans or maintain deposits. Climate change could also impact our assets or employees directly or lead to changes in customer preferences that could negatively affect our growth or business strategies. In addition, our reputation and customer relationships could be damaged due to our practices related to climate change, including our or our customers’ involvement in certain industries or projects associated with causing or exacerbating climate change. Moreover, over the past few years, federal banking regulators increasingly focused on the physical and financial risks to financial institutions associated with climate change, which may result in increased requirements regarding the disclosure and management of climate risks and related lending activities, as well as increased compliance costs. While federal regulators are expected to focus less on climate-related risks given the change in the U.S. presidential administration in January 2025, some states are more active in climate-related regulation. 33 Table of Contents Risks Related to Our Operations We face risks related to our operational, technological, and organizational infrastructure. Our ability to grow and compete is dependent on the Bank’s ability to build or acquire the necessary operational and technological infrastructure and to manage the cost of that infrastructure as we expand. In our case, operational risk can manifest itself in many ways, such as errors related to failed or inadequate processes, faulty or disabled computer systems, fraud by employees or outside persons, and exposure to external events. As discussed below, we are dependent on our operational infrastructure to help manage these risks. In addition, we are heavily dependent on the strength and capability of the technology systems that the Bank uses both to interface with customers and to manage internal financial and other systems. Our ability to develop and deliver new products that meet the needs of our existing customers and attract new ones depends on the functionality of our technology systems. Additionally, our ability to run our business in compliance with applicable laws and regulations depends on these systems. We continuously monitor our operational and technological capabilities and make modifications and improvements as circumstances warrant. In some instances, the Bank may build and maintain these capabilities itself; however, we outsource many of these functions to third parties. These third parties may experience errors or disruptions, including cyber-attacks, that could adversely impact the Bank and over which the Bank may have limited control. We also face risk from the integration of new infrastructure platforms and/or new third-party providers of such platforms into the Bank’s existing businesses. Many of our larger competitors have substantially greater resources to invest in technological improvements. As a result, they may be able to offer additional or superior technologies or services compared to those that we provide, which could put us at a competitive disadvantage. Accordingly, we may lose customers seeking new technology-driven products and services to the extent we are unable to compete effectively. System failure or breaches of our network security, including as a result of cyber-attacks or data security breaches, could subject us to increased operating costs, as well as litigation and other liabilities. The computer systems and network infrastructure we use may be vulnerable to physical theft, fire, power loss, telecommunications failure, or a similar catastrophic event, as well as security breaches, denial of service attacks, viruses, worms, and other disruptive problems caused by hackers or malicious actors. Any damage or failure that causes breakdowns or disruptions in our customer relationship management, general ledger, deposit, loan, and other systems could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny for failure to comply with required information security standards, or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on us. Computer break-ins, phishing, and other disruptions could also jeopardize the security of information stored in and transmitted through our computer systems and network infrastructure. Information security risks have generally increased in recent years in part because of the proliferation of new technologies, the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists, and other external parties. Our operations rely on the secure processing, transmission, and storage of confidential information in our computer systems and networks. In addition, to access our products and services, our customers may use devices that are beyond our control systems. Although we believe we have robust information security procedures and controls, our technologies, systems, networks, and our customers’ devices may become the target of cyber-attacks or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss, or destruction of the Bank’s or our customers’ confidential, proprietary, and other information, or otherwise disrupt the Bank’s or our customers’ or other third parties’ business operations. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. The Bank is under continuous threat of loss due to hacking and cyber-attacks, especially as we continue to expand customer capabilities to utilize internet and other remote channels to transact business. Two of the most significant cyber-attack risks that we face are e-fraud and loss of sensitive customer data. Loss from e-fraud occurs when cybercriminals extract funds directly from our customer accounts. Attempts to breach sensitive customer data, 34 Table of Contents such as account numbers and social security numbers, present significant reputational, legal, and/or regulatory costs to us, if successful. Our risk and exposure to these matters remains heightened because of the evolving nature and complexity of these threats from cybercriminals and hackers, our plans to continue to provide internet banking and mobile banking channels, and our plans to develop additional remote connectivity solutions to serve our customers. We cannot assure that we will not be the victim of a material hacking or cyberattack that could cause us to suffer material losses or other harms. The occurrence of any cyber-attack or information security breach could result in potential liability to customers, reputational damage, and the disruption of our operations, and regulatory concerns, all of which could adversely affect our business, financial condition, or results of operations. We rely on third parties to provide key components of our business infrastructure, and a failure of these parties to perform for any reason could disrupt our operations. Third parties provide key components of our business infrastructure such as data processing, internet connections, network access, core application processing, statement production, and account analysis. Our business depends on the successful and uninterrupted functioning of our information technology and telecommunications systems and third-party servicers. The failure of these systems, or the termination of a third-party software license or service agreement on which any of these systems is based, could interrupt our operations. Because our information technology and telecommunications systems interface with and depend on third-party systems, we could experience service denials if demand for such services exceeds capacity, or such third-party systems fail or experience interruptions. Replacing vendors or addressing other issues with our third-party service providers could entail significant delay and expense. If we are unable to efficiently replace ineffective service providers, or if we experience a significant, sustained, or repeated system failure or service denial, it could compromise our ability to operate effectively, damage our reputation, result in a loss of customer business, and subject us to additional regulatory scrutiny and possible financial liability, any of which could have an adverse effect on our business, financial condition, and results of operations. We could be subject to losses, regulatory action, or reputational harm due to fraudulent and negligent acts on the part of loan applicants, our employees, and vendors. In deciding whether to extend credit or enter into other transactions with clients and counterparties, and the terms of any such transaction, we may rely on information furnished by, or on behalf of, clients and counterparties, including financial statements, property appraisals, title information, employment and income documentation, account information, and other financial information. We may also rely on representations of clients and counterparties as to the accuracy and completeness of that information and, with respect to financial statements, on reports of independent auditors. Any such misrepresentation or incorrect or incomplete information, whether fraudulent or inadvertent, may not be detected prior to funding. In addition, one or more of our employees or vendors could cause a significant operational breakdown or failure, either as a result of human error or where an individual purposefully sabotages or fraudulently manipulates our loan documentation, operations, or systems. Whether a misrepresentation is made by the applicant or another third-party, we generally bear the risk of loss associated with the misrepresentation. A loan subject to a material misrepresentation is typically unsellable or subject to repurchase if it is sold prior to detection of the misrepresentation. The sources of the misrepresentations may also be difficult to locate, and we may be unable to recover any of the monetary losses we may suffer as a result of the misrepresentations. Any of these developments could have an adverse effect on our business, financial condition, and results of operations. We are subject to claims and litigation pertaining to intellectual property. Banking and other financial services companies, such as ours, rely on technology companies to provide information technology products and services necessary to support their day-to-day operations. Technology companies frequently enter into litigation based on allegations of patent infringement or other violations of intellectual property rights. In addition, patent holding companies seek to monetize patents they have purchased or otherwise obtained. Competitors of our vendors, or other individuals or companies, may from time to time claim to hold intellectual property sold to us by our vendors. Such claims may increase in the future as the financial services sector becomes more reliant on information technology vendors. The plaintiffs in these actions frequently seek injunctions and substantial damages. 35 Table of Contents Regardless of the scope or validity of such patents or other intellectual property rights, or the merits of any claims by potential or actual litigants, we may have to engage in protracted litigation. Such litigation is often expensive, time-consuming, disruptive to our operations, and distracting to management. If we are found to infringe one or more patents or other intellectual property rights, we may be required to pay substantial damages or royalties to a third-party. In certain cases, we may consider entering into licensing agreements for disputed intellectual property, although no assurance can be given that such licenses can be obtained on acceptable terms or that litigation will not occur. These licenses may also significantly increase our operating expenses. If legal matters related to intellectual property claims were resolved against us or settled, we could be required to make payments in amounts that could have an adverse effect on our business, financial condition, and results of operations. We may be adversely affected by the lack of soundness of other financial institutions or other market participants. Our ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services companies may be interrelated as a result of trading, clearing, counterparty, and other relationships. We have exposure to different industries and counterparties, and through transactions with counterparties in the financial services industry, including broker-dealers, commercial banks, investment banks, clearing agencies, exchanges, and other financial intermediaries. As a result, defaults by, declines in the financial condition of, or even rumors or questions about one or more financial services companies, or the financial services industry, generally, could lead to market-wide liquidity problems and losses or defaults by us or other institutions. These losses could have an adverse effect on our business, financial condition, and results of operations. Our risk management framework may not be effective in mitigating risks and/or losses to us. Our risk management framework is governed by various committees, including the Audit Committee, the Compensation Committee, the Nominating and Governance Committee, the Enterprise Risk Management Committee, the Credit Risk Management Committee, the Asset and Liability Management Committee, the Trust & Wealth Management Committee, the Technology Committee, and the Regulatory Risk Committee. The Chief Risk Officer has oversight responsibility for credit risk, enterprise risk, including regulatory risk, and asset and liability management risk, directly reporting to the Chief Executive Officer. Our risk management framework is comprised of various processes, systems, and strategies, and is designed to manage the types of risk to which we are subject, including, among others, credit, market, liquidity, interest rate, and compliance. Our framework also includes financial or other modeling methodologies that involve management assumptions and judgment. Our risk management framework may not be effective under all circumstances. Our risk management framework may not adequately mitigate any risk or loss to us. If our risk management framework is not effective, we could suffer unexpected losses and our business, financial condition, and results of operations could be adversely affected. We may also be subject to potentially adverse regulatory consequences. Demand for the Company’s services is influenced by general economic and consumer trends beyond the Company’s control, including disruptions in the financial services industry, in general, and events such as global pandemics and geopolitical conflict. There can be no assurance that our business and corresponding financial performance will not be adversely affected by general economic or consumer trends or events, including those affecting the financial services industry. Over the past few years, global markets have seen extensive volatility owing to a variety of factors, including high inflation, trade policies and tariffs, volatility in the capital markets, the failure of financial institutions, volatility in the housing market, interest and currency rate fluctuations, labor availability, supply chain disruptions, global pandemics and public health crises and the responses thereto, weather catastrophes and geopolitical instability, including shutdowns and threats of shutdowns of the U.S. federal government, growing tensions between China and the U.S., the Russia-Ukraine war, conflict in the Middle East, and acts of terrorism. These events have created, and may continue to create, significant disruption of the global economy and financial and labor markets. If such conditions continue, recur or worsen, this may have a material adverse effect on the Company’s business, financial condition, and results of operations. Furthermore, such economic conditions have produced downward pressure on 36 Table of Contents share prices and on the availability of credit for financial institutions and corporations, while also driving up interest rates, further complicating borrowing and lending activities. Additionally, the change in the U.S. presidential administration has given rise to uncertainty regarding the potential impact of certain policies and regulatory approaches on the broader economy, particularly in the areas of immigration and trade. For example, any significant new tariffs which may be imposed by the U.S. may increase the cost of raw materials used in construction, which can have an adverse effect on commercial and residential real-estate markets through increased production costs, production delays, and challenges in launching new projects. If current levels of market disruption and volatility continue or increase, the Company might experience reductions in business activity, increases in funding costs, decreases in asset values, additional write-downs and impairment charges, and lower profitability. Our results may suffer if we do not effectively manage our expanded operations, including complying with any enhanced regulatory requirements. The Company may face increased scrutiny from governmental authorities as a result of the size of its business, including if the total assets of the Company grow to exceed $10 billion as of December 31 of any calendar year. Banks with $10 billion or more in total assets are, among other things: examined directly by the CFPB with respect to various federal consumer financial laws; subject to reduced dividends on any holdings of Federal Reserve Bank of Richmond common stock; subject to limits on interchange fees pursuant to Section 920 of the Electronic Funds Transfer Act (known as the Durbin Amendment); subject to certain enhanced prudential standards; no longer treated as a “small institution” for FDIC deposit insurance assessment purposes; and no longer eligible to elect to be subject to the CBLR. Compliance with these additional ongoing requirements may necessitate additional personnel, the design and implementation of additional internal controls, and the incurrence of significant expenses, which could have a significant adverse effect on the Company’s financial condition or results of operations. 37 Table of Contents Risks Related to our Regulatory Environment Our industry is highly regulated, and the regulatory framework, together with any future legislative or regulatory changes, may have a materially adverse effect on our operations. Both the Company and the Bank are subject to extensive regulation, supervision, and examination by the Federal Reserve, our primary federal regulator and the Virginia BFI, our chartering authority. The Bank is also subject to certain regulations of the FDIC, the insurer of the Bank’s deposits. Such regulation, supervision, and examination govern the activities in which we and the Bank may engage and are intended primarily for the protection of the depositors and borrowers of the Bank, the financial system, and the DIF rather than for holders of our Common Stock. Various consumer compliance laws also affect our operations. Regulatory authorities have extensive discretion in their supervisory and enforcement activities, including the imposition of restrictions on our operations, the classification of our assets, and determination of the level of our allowance for credit losses. Any change in such regulation and oversight, whether in the form of regulatory policy, regulations, legislation, or supervisory action, may have a material impact on our operations. The earnings of the Bank, and therefore the earnings of the Company, are affected by changes in federal and state legislation and the actions of various regulatory authorities. We are subject to stringent capital requirements, which could have an adverse effect on our operations. Federal regulations establish minimum capital requirements for insured depository institutions, including minimum risk-based capital and leverage ratios, and define “capital” for calculating these ratios. Not including the capital conservation buffer, the capital rules require community bank holding companies and community banks to maintain a common equity Tier 1 to risk-weighted assets ratio of at least 4.5%, a Tier 1 capital to risk-weighted assets ratio of at least 6.0%, a total capital to risk-weighted assets ratio of at least 8.0%, and a leverage ratio of Tier 1 capital to total consolidated assets of at least 4.0%. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of common equity Tier 1 to risk-weighted assets above the minimum but below the conservation buffer would result in limitations on an institution’s ability to make capital distributions and discretionary bonus payments. In addition, for an insured depository institution to be “well capitalized” under the banking agencies’ “prompt corrective action” framework, it must have a common equity Tier 1 ratio of at least 6.5%, Tier 1 capital ratio of at least 8.0%, a total capital ratio of at least 10.0%, and a leverage ratio of at least 5.0%, and must not be subject to any written agreement, order or capital directive, or “prompt corrective action” directive issued by its primary federal or state banking regulator to meet and maintain a specific capital level for any capital measure. The Federal Reserve requires a bank holding company to act as a source of financial and managerial strength to its subsidiary banks and to commit resources to support its subsidiary banks. Under the “source of strength” doctrine, the Federal Reserve may require a bank holding company to make capital injections into a subsidiary bank at times when the bank holding company may not be inclined to do so and may charge the bank holding company with engaging in unsafe and unsound practices for failure to commit resources to such a subsidiary bank. Accordingly, we could be required to provide financial assistance to the Bank if it experiences financial distress. A capital injection may be required at a time when our resources are limited, and we may be required to borrow the funds or raise capital to make the required capital injection. Any new or revised standards adopted in the future may require us to maintain materially more capital, with common equity as a more predominant component, or manage the configuration of our assets and liabilities to comply with formulaic capital requirements. We may not be able to raise additional capital at all, or on terms acceptable to us. Failure to maintain capital to meet current or future regulatory requirements could have an adverse effect on our business, financial condition, and results of operations. We face a risk of noncompliance and enforcement action with the BSA and other anti-money laundering statutes and regulations. The BSA, the USA PATRIOT Act, and other laws and regulations require financial institutions, among other duties, to institute and maintain an effective anti-money laundering program and to file reports, such as suspicious activity reports and currency transaction reports. We are required to comply with these and other anti-money 38 Table of Contents laundering requirements. Our federal and state banking regulators, the Financial Crimes Enforcement Network, and other government agencies are authorized to impose significant civil money penalties for violations of anti-money laundering requirements. We are also subject to increased scrutiny of compliance with the regulations issued and enforced by OFAC, which is responsible for helping to ensure that U.S. entities do not engage in transactions with certain prohibited parties as defined by various Executive Orders and Acts of Congress. If our program is deemed deficient, we could be subject to liability, including fines, civil money penalties, and other regulatory actions, which may include restrictions on our business operations and our ability to pay dividends, restrictions on merger and acquisition activity, restrictions on expansion, and restrictions on entering new business lines. Failure to maintain and implement adequate programs to combat money laundering and terrorist financing could also have significant reputational consequences for us. Any of these circumstances could have an adverse effect on our business, financial condition, and results of operations. We are subject to laws regarding the privacy, information security, and protection of personal information and any violation of these laws or other incident involving personal, confidential, or proprietary information of individuals could damage our reputation and otherwise adversely affect our business. Our business requires the collection and retention of large volumes of customer data, including personally identifiable information (“PII”), in various information systems that we maintain and in those maintained by third-party service providers. We also maintain important internal company data, such as PII about our employees and information relating to our operations. We are subject to complex and evolving laws and regulations governing the privacy and protection of PII of individuals (including customers, employees, and other third parties). For example, our business is subject to the GLB Act, which, among other things: (i) imposes certain limitations on our ability to share nonpublic PII about our customers with nonaffiliated third parties; (ii) requires that we provide certain disclosures to customers about our information collection, sharing, and security practices and afford customers the right to “opt out” of any information sharing by us with nonaffiliated third parties (with certain exceptions); and (iii) requires that we develop, implement, and maintain a written comprehensive information security program containing appropriate safeguards based on our size and complexity, the nature and scope of our activities, and the sensitivity of customer information we process, as well as plans for responding to data security breaches. Various federal and state banking regulators and states have also enacted data breach notification requirements with varying levels of individual, consumer, regulatory, or law enforcement notification in the event of a security breach. Ensuring that our collection, use, transfer, and storage of PII complies with all applicable laws and regulations can increase our costs. Furthermore, we may not be able to ensure that customers and other third parties have appropriate controls in place to protect the confidentiality of the information that they exchange with us, particularly where such information is transmitted by electronic means. If personal, confidential, or proprietary information of customers or others were to be mishandled or misused (in situations where, for example, such information was erroneously provided to parties who are not permitted to have the information, or where such information was intercepted or otherwise compromised by third parties), we could be exposed to litigation or regulatory sanctions under privacy and data protection laws and regulations. Concerns regarding the effectiveness of our measures to safeguard PII, or even the perception that such measures are inadequate, could cause us to lose customers or potential customers and thereby reduce our revenues. Accordingly, any failure or perceived failure to comply with applicable privacy or data protection laws and regulations may subject us to inquiries, examinations, and investigations that could result in requirements to modify or cease certain operations or practices, or in significant liabilities, fines or penalties, and could damage our reputation and otherwise adversely affect our business, financial condition, and results of operations. Our use of third-party vendors and our other ongoing third-party business relationships are subject to increasing regulatory requirements and attention. We regularly use third-party vendors in our business, and we rely on some of these vendors for critical functions, including, but not limited to, our core processing function. Third-party relationships are subject to increasingly demanding regulatory requirements and attention by bank regulators. We expect our regulators to hold us responsible for deficiencies in our oversight or control of our third-party vendor relationships and in the performance of the parties with which we have these relationships. As a result, if our regulators conclude that we have not exercised adequate oversight and control over our third-party vendors or that such vendors have not 39 Table of Contents performed adequately, we could be subject to administrative penalties or fines as well as requirements for consumer remediation, any of which could have a material adverse effect on our business, financial condition, and results of operations. Regulatory requirements affecting our loans secured by commercial real estate could limit our ability to leverage our capital and adversely affect our growth and profitability. The federal banking agencies have issued guidance regarding concentrations in commercial real estate lending for institutions that are deemed to have particularly high concentrations of commercial real estate loans within their lending portfolios. Under this guidance, an institution that has (i) total reported loans for construction, land development, and other land which represent 100% or more of the institution’s total risk-based capital; or (ii) total commercial real estate loans representing 300% or more of the institution’s total risk-based capital, where the outstanding balance of the institution’s commercial real estate loan portfolio has increased 50% or more during the prior 36 months, is identified as having potential commercial real estate concentration risk. An institution that is deemed to have concentrations in commercial real estate lending is expected to employ heightened levels of risk management with respect to its commercial real estate portfolios, and may be required to maintain higher levels of capital. As of December 31, 2024, acquisition, construction & development loans were 50.6% of our total risk-based capital, and commercial real estate, including owner-occupied loans, were 353.6% of our total risk-based capital. Commercial real estate loans, including acquisition, construction & development and owner-occupied loans, have increased 193.5% during the prior 36 months, mostly due to the Merger. We cannot guarantee that any risk management practices we implement will be effective in preventing losses relating to our commercial real estate portfolio. Management has extensive experience in commercial real estate lending and has implemented, and continues to maintain, heightened portfolio monitoring and reporting and strong underwriting criteria with respect to our commercial real estate portfolio. Nevertheless, we could be required to maintain higher levels of capital as a result of our commercial real estate concentration, which could limit our growth, require us to obtain additional capital, and have an adverse effect on our business, financial condition, and results of operations. Evolving expectations from customers, regulators, investors, and other stakeholders with respect to Environmental, Social, and Governance (“ESG”) practices may impose additional costs on us or expose us to new or additional risks. As a regulated financial institution listed on a national exchange, we face evolving scrutiny from customers, regulators, investors, and other stakeholders related to ESG practices and disclosure. Investor advocacy groups, investment funds, and influential investors are increasingly focused on these practices, especially as they relate to climate risk, hiring practices, the diversity of the work force, and racial and social justice issues, with various stakeholders advocating both for and against such policies. Recently, ESG regulations and rules have faced a political backlash and are increasingly being successfully challenged in court. Additionally, the U.S. presidential administration has moved to overturn and reject all efforts aimed at promoting diversity, equity and inclusion in the federal government and has advocated for the same in the private sector. While federal regulators have in past years called for increased ESG disclosure, it is expected that any federal ESG-related regulations under the U.S. presidential administration will call for less disclosure or mandate the abandonment of ESG programs, while regulations at the state level will vary. Failure to adapt to or comply with regulatory requirements or investor or stakeholder expectations and standards could negatively impact our reputation, ability to do business with certain customers and business partners, and stock price. 40 Table of Contents Risks Related to an Investment in Our Common Stock We currently qualify as an “emerging growth company”, and the reduced disclosures and relief from certain other significant disclosure requirements that are available to emerging growth companies may make our Common Stock less attractive to investors. We are an “emerging growth company,” as defined in the federal securities laws, and we intend to continue to take advantage of certain exemptions from various reporting requirements that apply to other public companies that are not emerging growth companies. These exemptions include not being required to comply with the auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act, less extensive disclosure obligations regarding executive compensation in our periodic reports and proxy statements, and exemptions from the requirements to hold non-binding advisory votes on executive compensation and shareholder approval of any golden parachute payments not previously approved. We could remain an emerging growth company until the last day of the fiscal year following the fifth anniversary of the first sale of our common equity securities in an offering registered under the Securities Act, though we may cease to be an emerging growth company earlier, if our gross revenues exceed $1.235 billion, if we issue more than $1.0 billion in non-convertible debt in a three-year period, or if the market value of our Common Stock held by non-affiliates exceeds $700 million as of any June 30 before that time, in which case we would no longer be an emerging growth company as of the following December 31. Investors and securities analysts may find it more difficult to evaluate our Common Stock because we rely on one or more of these exemptions. If, as a result, some investors find our Common Stock less attractive, there may be a less active trading market for our Common Stock, which could result in reductions and greater volatility in the prices of our Common Stock. If we fail to design, implement and maintain effective internal control over financial reporting or remediate any future material weakness in our internal control over financial reporting, we may be unable to accurately report our financial results or prevent fraud. Our internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of the financial reporting and the preparation of financial statements for external purposes in accordance with U.S. generally accepted accounting principles (“GAAP”). Effective internal control over financial reporting is necessary for us to provide reliable reports and prevent fraud. We may not be able to identify all significant deficiencies and/or material weaknesses in our internal control over financial reporting in the future, and our failure to maintain effective internal control over financial reporting could have an adverse effect on our business, financial condition, and results of operations. In the normal course of our operations, we may identify deficiencies that would have to be remediated to satisfy the SEC rules for certification of our internal control over financial reporting. A material weakness is defined by the standards issued by the Public Company Accounting Oversight Board (“PCAOB”), as a deficiency, or combination of deficiencies, in internal control over financial reporting that results in a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. As a consequence, we would have to disclose in periodic reports we file with the SEC any material weakness in our internal control over financial reporting. The existence of a material weakness would preclude management from concluding that our internal control over financial reporting is effective, and when we cease to be an emerging growth company under the JOBS Act, preclude our independent registered public accounting firm from rendering their report addressing an assessment of the effectiveness of our internal control over financial reporting. In addition, disclosures of deficiencies of this type in our SEC reports could cause investors to lose confidence in our financial reporting, and may negatively affect the market price of our Common Stock, and could result in the delisting of our securities from the securities exchanges on which they trade. Moreover, effective internal controls are necessary to produce reliable financial reports and to prevent fraud. If we have deficiencies in our disclosure controls and procedures or internal control over financial reporting, such deficiencies may adversely affect us. 41 Table of Contents We may issue additional equity securities, or engage in other transactions, which could affect the priority of our Common Stock, which may adversely affect the market price of our Common Stock. Our Board may determine from time to time, that we need to raise additional capital by issuing additional shares of our Common Stock or other securities. Sales of substantial amounts of our Common Stock (including shares issued in connection with an acquisition), or the perception that such sales could occur, may adversely affect prevailing market prices of our Common Stock. We are not restricted from issuing additional shares of Common Stock, including securities that are convertible into, or exchangeable for, or that represent the right to receive Common Stock. Because our decision to issue securities in any future offering will depend on market conditions and other factors beyond our control, we cannot predict or estimate the amount, timing or nature of any future offerings, or the prices at which such offerings may be effected. Any additional issuance of Common Stock could be dilutive to existing common shareholders. We may also issue, without shareholder approval, shares of preferred stock that will provide investors in such shares with rights, preferences, and privileges that are senior to, and that adversely affect, our then current common shareholders. Additionally, if we raise additional capital by making additional offerings of debt or preferred equity securities, upon liquidation, holders of our debt securities and shares of preferred stock and lenders with respect to other borrowings will receive distributions of our available assets prior to the holders of our Common Stock, which ranks junior to our customer deposits and indebtedness. Additional equity offerings may dilute the holdings of our existing shareholders or reduce the market price of our Common Stock, or both. Holders of our Common Stock are not entitled to preemptive rights or other protections against dilution. An investment in our Common Stock is not an insured deposit and is not guaranteed by the FDIC, so you could lose some or all of your investment. An investment in our Common Stock is not a deposit account or other obligation of the Bank and, therefore, is not insured against loss or guaranteed by the FDIC, any other deposit insurance fund, or by any other governmental, public, or private entity. An investment in our Common Stock is inherently risky for the reasons described herein. As a result, if you acquire our Common Stock, you could lose some or all of your investment. Holders of our junior subordinated debentures and preferred stock have rights that are senior to those of our common stockholders. We have three statutory business trusts for which we became sponsors in connection with the Merger. The trusts have issued mandatorily redeemable securities (the “capital securities”) for which we are obligated to third-party investors related, and hold our junior subordinated debentures (the “debentures”). The debentures held by the trusts are their sole assets. Our subordinated debentures of these unconsolidated statutory trusts totaled approximately $19.6 million excluding the related fair value mark incurred as of acquisition, at December 31, 2024. Payments of the principal and interest on the trust preferred securities of the statutory trusts are conditionally guaranteed by us. The junior subordinated debentures are senior to our shares of common stock. As a result, we must make payments on the junior subordinated debentures before any dividends can be paid on our common stock and, in the event of our bankruptcy, dissolution or liquidation, the holders of the junior subordinated debentures must be satisfied before any distributions can be made on our common stock. We have the right to defer distributions on the junior subordinated debentures (and the related trust preferred securities) for up to five (5) years, during which time no dividends may be paid on our common stock. See Note 7 — Borrowed Funds in Notes to Consolidated Financial Statements for additional information regarding our trust preferred securities. We also have 1,500 shares of our 6.0% Fixed Rate Non-Cumulative Perpetual Preferred Stock, Series 2021 outstanding, which is senior to our common stock with respect to dividends upon liquidation or dissolution of the Company. While the regular dividends payable on such preferred stock are non-cumulative, we are not permitted to pay dividends on or repurchase our common stock to the extent we do not pay dividends on such preferred stock for each applicable dividend period. 42 Table of Contents Our Bylaws designate the United States District Court for the Eastern District of Virginia, Alexandria Division, or in the event that court lacks jurisdiction, the Circuit Court of the City of Alexandria, Virginia, as the sole and exclusive forum for certain types of actions and proceedings that may be initiated by our shareholders, which may not be enforced and could discourage lawsuits against us and our directors and officers. Our Bylaws provide that, unless we consent in writing to the selection of an alternative forum, the United States District Court for the Eastern District of Virginia, Alexandria Division, or in the event that court lacks jurisdiction, the Circuit Court of the City of Alexandria, Virginia, will be the sole and exclusive forum for any derivative action or proceeding brought on behalf of us, any action asserting a claim of breach of a fiduciary duty owed by any director, officer, employee, or other agent of ours to us or our shareholders, any action asserting a claim arising pursuant to any provision of the Virginia Stock Corporation Act (“VSCA”) or our Articles of Incorporation or Bylaws, or any action asserting a claim governed by the internal affairs doctrine, including, without limitation, any action to interpret, apply, enforce, or determine the validity of the Articles of Incorporation or Bylaws, in each case subject to such court having personal jurisdiction over the indispensable parties named as defendants in any such action. By its terms, the exclusive forum provision in our bylaws would apply to claims made under the Exchange Act or the Securities Act. However, Section 27 of the Exchange Act creates exclusive federal jurisdiction over all suits brought to enforce any duty or liability created by the Exchange Act or the rules and regulations thereunder. In addition, Section 22 of the Securities Act creates concurrent jurisdiction for federal and state courts over all suits brought to enforce any duty or liability created by the Securities Act or the rules and regulations thereunder. As a result of these provisions, the exclusive forum provisions may not apply to, and there is uncertainty as to whether a court would enforce such exclusive forum provisions with respect to, suits brought to enforce any duty or liability created by the Exchange Act or the Securities Act or any other claim for which the federal and state courts have concurrent jurisdiction, and our stockholders will not be deemed to have waived our compliance with the federal securities laws and the rules and regulations thereunder. Any person or entity purchasing or otherwise acquiring any interest in shares of our capital stock shall be deemed to have notice of and to have consented to this provision of our Bylaws. The exclusive forum provision may limit the ability of our shareholders to bring a claim in a judicial forum that such shareholders find favorable for disputes with us or our directors or officers and the provision may increase costs on a shareholder pursuing any claims against us, which may discourage such lawsuits against us and our directors and officers. Alternatively, if a court were to find this exclusive forum provision inapplicable to, or unenforceable in respect of, one or more of the specified types of actions or proceedings described above, we may incur additional costs associated with resolving such matters in other jurisdictions, which could adversely affect our business, results of operations, and financial condition. 43 Table of Contents