EAGLE FINANCIAL SERVICES INC 10-K

Item 1. Business General Eagle Financial Services, Inc. (the “Company”) is a bank holding company that was incorporated in 1991. The company is headquartered in Berryville, Virginia and conducts its operations through its subsidiary, Bank of Clarke County (the “Bank”). The Bank is chartered under Virginia law. The Bank has twelve full-service branches, two loan production offices, one wealth management office and one drive-through only facility. The Bank’s main office is located at 2 East Main Street in Berryville, Virginia. The Bank opened for business on April 1, 1881. The Bank has Virginia offices located in Clarke County, Frederick County, Fauquier County, Loudoun County and Fairfax County, as well as the Towns of Leesburg and Purcellville and the City of Winchester. The Bank has a Maryland office located in Frederick. This market area is located in the Shenandoah Valley, Northern Virginia and Frederick, Maryland. The Bank offers a wide range of retail and commercial banking services, including demand, savings and time deposits and consumer, mortgage and commercial loans. The Bank has thirteen ATM locations in its trade area and issues Debit cards to deposit customers. These cards can be used to withdraw cash at most ATM’s through the Bank’s membership in both regional and national networks. These cards can also be used to make purchases at retailers who accept transactions through the same regional and national networks. The Bank offers telephone banking, internet banking, and mobile banking to its customers. Internet banking also offers online bill payment to consumer and commercial customers. The Bank offers other commercial deposit account services such as ACH origination and remote deposit capture. Eagle Investment Group (“EIG”), a division of the Bank, offers both a trust department and investment services. The trust services division of EIG offers a full range of personal and retirement plan services, which include serving as agent for bill paying and custody of assets, as investment manager with full authority or advisor, as trustee or co-trustee for trusts under will or under agreement, as trustee of life insurance trusts, as guardian or committee, as agent under a power of attorney, as executor or co-executor for estates, as custodian or investment advisor for individual retirement plans, and as trustee or trust advisor for corporate retirement plans such as profit sharing and 401(k) plans. The brokerage division of EIG offers a full range of investment services, which include tax-deferred annuities, IRAs and rollovers, mutual funds, retirement plans, 529 college savings plans, life insurance, long term care insurance, fixed income investing, brokerage CDs, and full service or discount brokerage services. Non-deposit investment products are offered through a third party provider. The Bank of Clarke County, is a partner in Bankers Title Shenandoah, LLC, which sells title insurance and is an investor in Virginia Bankers Insurance Center, LLC, which serves as the broker for insurance sales through its member banks. Bank of Clarke County is also an investor in building rehabilitation projects in surrounding states. These investments generate tax credits for the Bank. Employees The Company, including the Bank, had 78 officers, 136 other full-time and 16 part-time employees (or 221 full-time equivalent employees) at December 31, 2021. None of the Company’s employees are represented by a union or covered under a collective bargaining agreement. The Company considers relations with its employees to be excellent. Securities and Exchange Commission Filings The Company maintains an internet website at www.bankofclarke.bank . Shareholders of the Company and the public may access, free of charge, the Company’s periodic and current reports (including annual reports on Form 10-K, quarterly reports on Form 10-Q and current reports on Form 8-K, and any amendments to those reports) filed with or furnished to the Securities and Exchange Commission (the "SEC"), through the “Investor Relations” section of the Company’s website. The reports are made available on this website as soon as practicable following the filing of the reports with the SEC. In addition, certain committee charters and the Company's Code of Ethics are available on the Company's website. The information is free of charge and may be reviewed, downloaded and printed from the website at any time. The information on the Company's website is not a part of, and is not incorporated into, this Annual Report on Form 10-K. 4 Competition There is significant competition for both loans and deposits within the Company’s trade area. Competition for loans comes from other commercial banks, savings banks, credit unions, mortgage brokers, finance companies, financial technology firms, insurance companies, and other institutional lenders. Competition for deposits comes from other commercial banks, savings banks, credit unions, brokerage firms, and other financial institutions. Based on total deposits at June 30, 2021 as reported to the FDIC, the Company has 8.52% of the total deposits in its market area. The Company’s deposit market area includes Clarke County, Frederick County, Loudoun County and the City of Winchester. Supervision and Regulation General . As a bank holding company, the Company is subject to regulation under the Bank Holding Company Act of 1956, as amended, and the examination and reporting requirements of the Board of Governors of the Federal Reserve System (the "Federal Reserve"). As a state-chartered commercial bank, the Bank is subject to regulation, supervision and examination by the Virginia State Corporation Commission’s Bureau of Financial Institutions. It is also subject to regulation, supervision and examination by the Federal Reserve. Other federal and state laws, including various consumer and compliance laws, govern the activities of the Bank, the investments that it makes and the aggregate amount of loans that it may grant to one borrower. The following sections summarize some of the significant federal and state laws applicable to the Company and its subsidiary. To the extent that statutory or regulatory provisions are described, the description is qualified in its entirety by reference to that particular statutory or regulatory provision. The Bank Holding Company Act . Under the Bank Holding Company Act, the Company is subject to periodic examination by the Federal Reserve and is required to file periodic reports regarding its operations and any additional information that the Federal Reserve may require. Activities at the bank holding company level are limited to the following: • banking, managing or controlling banks; • furnishing services to or performing services for its subsidiaries; and • engaging in other activities that the Federal Reserve has determined by regulation or order to be so closely related to banking as to be a proper incident to these activities. Some of the activities that the Federal Reserve has determined by regulation to be closely related to the business of a banking include making or servicing loans and specific types of leases, performing specific data processing services and acting in some circumstances as a fiduciary or investment or financial adviser. With some limited exceptions, the Bank Holding Company Act requires every bank holding company to obtain the prior approval of the Federal Reserve before: • acquiring substantially all the assets of any bank; • acquiring direct or indirect ownership or control of any voting shares of any bank if after such acquisition it would own or control more than 5% of the voting shares of such bank (unless it already owns or controls the majority of such shares); or • merging or consolidating with another bank holding company. In addition, and subject to some exceptions, the Bank Holding Company Act and the Change in Bank Control Act, together with their regulations, require Federal Reserve approval prior to any person or company acquiring 25% or more of any class of voting securities of the bank holding company. Prior notice to the Federal Reserve is required if a person acquires 10% or more, but less than 25%, of any class of voting securities of a bank or bank holding company and either the institution has registered securities under Section 12 of the Securities Exchange Act of 1934 or no other person owns a greater percentage of that class of voting securities immediately after the transaction. In November 1999, Congress enacted the Gramm-Leach-Bliley Act (“GLBA”), which made substantial revisions to the statutory restrictions separating banking activities from other financial activities. Under the GLBA, bank holding companies that are well-capitalized and well-managed and meet other conditions can elect to become “financial holding companies.” As financial holding companies, they and their subsidiaries are permitted to acquire or engage in previously impermissible activities such as insurance underwriting, securities underwriting and distribution, travel agency activities, insurance agency activities, merchant banking and other activities that the Federal Reserve determines to be financial in nature or complementary to these activities. Financial holding companies continue to be subject to the overall oversight and supervision of the Federal Reserve, but the GLBA applies the concept of functional regulation to the activities conducted by subsidiaries. For example, insurance activities would be subject to supervision and regulation by state insurance authorities. Although the Company has not elected to become a financial holding company in order to exercise the broader activity powers provided by the GLBA, the Company may elect do so in the future. 5 Payment of Dividends . The Company is organized under the Virginia Stock Corporation Act, which prohibits the payment of a dividend if, after giving it effect, the corporation would not be able to pay its debts as they become due in the usual course of business or if the corporation’s total assets would be less than the sum of its total liabilities plus the amount that would be needed, if the corporation were to be dissolved, to satisfy the preferential rights upon dissolution of any preferred shareholders. In addition, the Federal Reserve has indicated that a bank holding company should generally pay dividends only if its current earnings are sufficient to fully fund the dividends, and the prospective rate of earnings retention appears consistent with the organization’s capital needs, asset quality and overall financial condition. The Company is a legal entity separate and distinct from its subsidiary. Its ability to distribute cash dividends will depend primarily on the ability of the Bank to pay dividends to it, and the Bank is subject to laws and regulations that limit the amount of dividends that it can pay. As a state member bank, the Bank is subject to certain restrictions imposed by the reserve and capital requirements of federal and Virginia banking statutes and regulations. Under Virginia law, a bank may not declare a dividend in excess of its undivided profits. Additionally, the Bank may not declare a dividend if the total amount of all dividends, including the proposed dividend, declared by it in any calendar year exceeds the total of its retained net income of that year to date, combined with its retained net income of the two preceding years, unless the dividend is approved by the Federal Reserve. The Federal Reserve, the FDIC and the state of Virginia have the general authority to limit the dividends paid by insured banks if the payment is deemed an unsafe and unsound practice. These regulators have indicated that paying dividends that deplete a bank’s capital base to an inadequate level would be an unsound and unsafe banking practice. The Bank may also not declare or pay a dividend without the approval of its board and two-thirds of its shareholders if the dividend would exceed its undivided profits, as reported to the Federal Reserve. The Company does not expect that any of these laws, regulations or policies will materially affect the Bank's ability to pay dividends to the Company. During the year ended December 31, 2021, the Bank paid $1.5 million in dividends to the Company. The Company paid cash dividends of $3.3 million and total dividends of $3.8 million, including cash dividends that were reinvested in Company stock. Insurance of Accounts, Assessments and Regulation by the FDIC . The Bank’s deposits are insured up to applicable limits by the FDIC. In July 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act (the "Dodd-Frank Act") permanently raised the standard maximum deposit insurance amount to $250,000. The FDIC has implemented a risk-based assessment system in which assessment rates for insured institutions with under $10 billion in assets are calculated based on supervisory evaluations and certain other financial measures. The assessment base is an institution’s average consolidated total assets less average tangible equity, and the initial base assessment rates are currently between 3 and 30 basis points depending on the institution's composite rating, and subject to potential adjustment based on certain long-term unsecured debt. Once the FDIC’s reserve ratio reaches 2.0% or greater, initial base assessment rates will range from 2 to 28 basis points and, once the reserve ratio reaches 2.5% or greater, the initial base assessment rate will range from 1 to 25 basis points. Capital Requirements . The Federal Reserve and the other federal banking agencies have issued risk-based and leverage capital guidelines applicable to U.S. banking organizations. Those regulatory agencies may from time to time require that a banking organization maintain capital above the minimum levels because of its financial condition or actual or anticipated growth. Pursuant to the Federal Reserve’s Small Bank Holding Company and Savings and Loan Holding Company Policy Statement, qualifying bank holding companies with total consolidated assets of less than $3 billion, such as the Company, is not subject to consolidated regulatory capital requirements. Effective January 1, 2015, the Federal Reserve adopted capital rules intended to revise and strengthen its risk-based and leverage capital requirements and its method for calculating risk-weighted assets. The rules implemented the Basel III regulatory capital reforms from the Basel Committee on Banking Supervision and certain provisions of the Dodd-Frank Act. 6 Under these risk-based capital requirements of the Federal Reserve, the Bank is required to maintain a minimum ratio of total capital (which is defined as core capital and supplementary capital less certain specified deductions from total capital such as reciprocal holdings of depository institution capital instruments and equity investments) to risk-weighted assets of at least 8.0%. At least 6.0% of risk-weighted assets is required to be “Tier 1 capital,” which consists principally of common and certain qualifying preferred shareholders’ equity (including grandfathered trust preferred securities) as well as retained earnings, less certain intangibles and other adjustments. The “Tier 2 capital” consists of cumulative preferred stock, long-term perpetual preferred stock, a limited amount of subordinated and other qualifying debt (including certain hybrid capital instruments), and a limited amount of the allowance for loan losses, including reserves for off-balance sheet commitments. A common equity Tier 1 capital ratio of 4.5% of risk-weighted assets also was added with the rules effective January 1, 2015. Each of the federal bank regulatory agencies also has established a minimum leverage capital ratio of Tier 1 capital to average adjusted assets (“Tier 1 leverage ratio”). The guidelines require a minimum Tier 1 leverage ratio of 3.0% for financial holding companies and banking organizations with the highest supervisory rating. All other banking organizations are required to maintain a minimum Tier 1 leverage ratio of 4.0% unless a different minimum was specified by an appropriate regulatory authority. In addition, for a depository institution to be considered “well capitalized” under the regulatory framework for prompt corrective action, its Tier 1 leverage ratio must be at least 5.0%. Banking organizations that have experienced internal growth or made acquisitions are expected to maintain strong capital positions substantially above the minimum supervisory levels without significant reliance on intangible assets. The Federal Reserve has not advised the Company or the Bank of any specific minimum leverage ratio applicable to either entity. The capital requirements that became effective January 1, 2015 were phased in over a four-year period. As fully phased in effective January 1, 2019, the rules require the Bank to maintain (i) a minimum ratio of common equity Tier 1 to risk-weighted assets of at least 4.5%, plus a 2.5% “capital conservation buffer” (which is added to the 4.5% common equity Tier 1 ratio, effectively resulting in a minimum ratio of common equity Tier 1 to risk-weighted assets of at least 7.0%); (ii) a minimum ratio of Tier 1 capital to risk-weighted assets of at least 6.0%, plus the 2.5% capital conservation buffer (which is added to the 6.0% Tier 1 capital ratio, effectively resulting in a minimum Tier 1 capital ratio of 8.5%); (iii) a minimum ratio of total capital to risk-weighted assets of at least 8.0%, plus the 2.5% capital conservation buffer (which is added to the 8.0% total capital ratio, effectively resulting in a minimum total capital ratio of 10.5%); and (iv) a minimum leverage ratio of 4.0%, calculated as the ratio of Tier 1 capital to average assets. The capital conservation buffer requirement was phased in beginning January 1, 2016, at 0.625% of risk-weighted assets, increasing by the same amount each year until fully implemented at 2.5% effective January 1, 2019. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of common equity Tier 1 to risk-weighted assets above the minimum but below the conservation buffer will face constraints on dividends, equity repurchases, and compensation based on the amount of the shortfall. The Federal Reserve’s final rules also revised the “prompt corrective action” regulations pursuant to Section 38 of the FDIA by (i) introducing a common equity Tier 1 capital ratio requirement at each level (other than critically undercapitalized), with the required ratio being 6.5% for well-capitalized status; (ii) increasing the minimum Tier 1 capital ratio requirement for each category, with the minimum ratio for well-capitalized status being 8.0%; and (iii) eliminating the provision that provided that a bank with a composite supervisory rating of 1 may have a 3.0% Tier 1 leverage ratio and still be well-capitalized. These thresholds were effective for the Bank as of January 1, 2015. The minimum total capital to risk-weighted assets ratio (10.0%) and minimum leverage ratio (5.0%) for well-capitalized status were unchanged by the final rules. In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms (the standards are commonly referred to as “Basel IV”). Among other things, these standards revise the Basel Committee’s standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain “unconditionally cancellable commitments,” such as unused credit card lines of credit) and provide a new standardized approach for operational risk capital. Under the proposed framework, these standards will generally be effective on January 1, 2023, with an aggregate output floor phasing-in through January 1, 2027. Under the current capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not to the Company. The impact of Basel IV on the Company and the Bank will depend on the manner in which it is implemented by the federal bank regulatory agencies. 7 As directed by the Economic Growth, Regulatory Relief and Consumer Protection Act (the “Economic Growth Act”), the federal banking regulators jointly issued a final rule in 2019 that permits qualifying banks that have less than $10 billion in total consolidated assets to elect to be subject to a 9% “community bank leverage ratio.” A qualifying bank that has chosen the proposed framework is not be required to calculate the existing risk-based and leverage capital requirements and would be considered to have met the capital ratio requirements to be “well capitalized” under prompt corrective action rules, provided it has a community bank leverage ratio greater than 9%. The Bank opted into the CBLR framework as of December 31, 2021 . The community bank leverage ratio rules were temporarily modified in response to COVID-19. See “CARES Act” below. Other Safety and Soundness Regulations . There are a number of obligations and restrictions imposed on bank holding companies and their depository institution subsidiaries by federal law and regulatory policy that are designed to reduce potential loss exposure to the depositors of such depository institutions and to the FDIC insurance funds in the event that the depository institution is insolvent or is in danger of becoming insolvent. For example, under the requirements of the Federal Reserve with respect to bank holding company operations, a bank holding company is required to serve as a source of financial strength to its subsidiary depository institutions and to commit resources to support such institutions in circumstances where it might not do so otherwise. In addition, the “cross-guarantee” provisions of federal law require insured depository institutions under common control to reimburse the FDIC for any loss suffered or reasonably anticipated by the FDIC as a result of the insolvency of commonly controlled insured depository institutions or for any assistance provided by the FDIC to commonly controlled insured depository institutions in danger of failure. The FDIC may decline to enforce the cross-guarantee provision if it determines that a waiver is in the best interests of the deposit insurance funds. The FDIC’s claim for reimbursement under the cross guarantee provisions is superior to claims of shareholders of the insured depository institution or its holding company but is subordinate to claims of depositors, secured creditors and nonaffiliated holders of subordinated debt of the commonly controlled insured depository institutions. Federal Reserve System . In 1980, Congress enacted legislation that imposed reserve requirements on all depository institutions that maintain transaction accounts or nonpersonal time deposits. NOW accounts, money market deposit accounts and other types of accounts that permit payments or transfers to third parties fall within the definition of transaction accounts and are subject to these reserve requirements, as are any nonpersonal time deposits at an institution. The reserve percentages are subject to adjustment by the Federal Reserve. Because required reserves must be maintained in the form of vault cash or in a non-interest-bearing account at, or on behalf of, a Federal Reserve Bank, the effect of the reserve requirement is to reduce the amount of the institution’s interest-earning assets. However, in March 2020, in an unprecedented move, the Federal Reserve announced that the banking system had ample reserves, and, as reserve requirements no longer played a significant role in this regime, it reduced all reserve tranches to zero percent, thereby freeing banks from the reserve maintenance requirement. The action permits the Bank to loan or invest funds that were previously unavailable. The Federal Reserve has indicated that it expects to continue to operate in an ample reserves regime for the foreseeable future. Transactions with Affiliates . Transactions between banks and their affiliates are governed by Sections 23A and 23B of the Federal Reserve Act. An affiliate of a bank is any bank or entity that controls, is controlled by or is under common control with such bank. Generally, Sections 23A and 23B (i) limit the extent to which the Bank or its subsidiaries may engage in “covered transactions” with any one affiliate to an amount equal to 10% of such institution’s capital stock and surplus, and maintain an aggregate limit on all such transactions with affiliates to an amount equal to 20% of such capital stock and surplus, and (ii) require that all such transactions be on terms substantially the same, or at least as favorable, to the association or subsidiary as those provided to a nonaffiliate. The term “covered transaction” includes the making of loans, purchase of assets, issuance of a guarantee and similar other types of transactions. 8 Transactions with Insiders. The Federal Reserve Act and related regulations impose specific restrictions on loans to directors, executive officers and principal shareholders of banks. Under Section 22(h) of the Federal Reserve Act, loans to a director, an executive officer and to a principal shareholder of a bank, and some affiliated entities of any of the foregoing, may not exceed, together with all other outstanding loans to such person and affiliated entities, the bank’s loan-to-one borrower limit. Loans in the aggregate to insiders and their related interests as a class may not exceed two times the bank’s unimpaired capital and unimpaired surplus until the bank’s total deposits equal or exceed $100,000,000, at which time the aggregate is limited to the bank’s unimpaired capital and unimpaired surplus. Section 22(h) also prohibits loans, above amounts prescribed by the appropriate federal banking agency, to directors, executive officers and principal shareholders of a bank or bank holding company, and their respective affiliates, unless such loan is approved in advance by a majority of the board of directors of the bank with any “interested” director not participating in the voting. The FDIC has prescribed the loan amount, which includes all other outstanding loans to such person, as to which such prior board of director approval is required, as being the greater of $25,000 or 5% of capital and surplus (up to $500,000). Section 22(h) requires that loans to directors, executive officers and principal shareholders be made on terms and underwriting standards substantially the same as offered in comparable transactions to other persons. The Dodd-Frank Act also provides that banks may not “purchase an asset from, or sell an asset to” a bank insider (or their related interests) unless (i) the transaction is conducted on market terms between the parties, and (ii) if the proposed transaction represents more than 10 percent of the capital stock and surplus of the bank, it has been approved in advance by a majority of the bank’s non-interested directors. Community Reinvestment Act . Under the Community Reinvestment Act and related regulations, depository institutions have an affirmative obligation to assist in meeting the credit needs of their market areas, including low and moderate-income areas, consistent with safe and sound banking practice. The Community Reinvestment Act directs each bank to maintain a public file containing specific information, including all written comments received from the public for the current year and each of the previous two calendar years that specifically relate to the bank’s performance in helping to meet community credit needs. Depository institutions are periodically examined for compliance with the Community Reinvestment Act and are periodically assigned ratings in this regard. Banking regulators consider a depository institution’s Community Reinvestment Act rating when reviewing applications to establish new branches, undertake new lines of business, and/or acquire part or all of another depository institution. An unsatisfactory rating can significantly delay or even prohibit regulatory approval of a proposed transaction by a bank holding company or its depository institution subsidiaries. Fair Lending; Consumer Laws . In addition to the Community Reinvestment Act, other federal and state laws regulate various lending and consumer aspects of the banking business. Governmental agencies, including the Department of Housing and Urban Development, the Federal Trade Commission and the Department of Justice, have become concerned that prospective borrowers experience discrimination in their efforts to obtain loans from depository and other lending institutions. These agencies have brought litigation against depository institutions alleging discrimination against borrowers. Many of these suits have been settled, in some cases for material sums, short of a full trial. These governmental agencies have clarified what they consider to be lending discrimination and have specified various factors that they will use to determine the existence of lending discrimination under the Equal Credit Opportunity Act and the Fair Housing Act, including evidence that a lender discriminated on a prohibited basis, evidence that a lender treated applicants differently based on prohibited factors in the absence of evidence that the treatment was the result of prejudice or a conscious intention to discriminate, and evidence that a lender applied an otherwise neutral non-discriminatory policy uniformly to all applicants, but the practice had a discriminatory effect, unless the practice could be justified as a business necessity. Banks and other depository institutions are also subject to numerous consumer-oriented laws and regulations. These laws, which include the Truth in Lending Act, the Truth in Savings Act, the Real Estate Settlement Procedures Act, the Electronic Funds Transfer Act, the Funds Availability Act, the Equal Credit Opportunity Act, and the Fair Housing Act, require compliance by depository institutions with various disclosure requirements and requirements regulating the availability of funds after deposit or the making of some loans to customers. 9 Privacy Regulations. The GLBA contains extensive customer privacy protection provisions. Under these provisions, a financial institution must provide to its customers, both at the inception of the customer relationship and on an annual basis, the institution’s policies and procedures regarding the handling of customers’ nonpublic personal financial information. The law provides that, except for specific limited exceptions, an institution may not provide such personal information to unaffiliated third parties unless the institution discloses to the customer that such information may be so provided and the customer is given the opportunity to opt out of such disclosure. An institution may not disclose to a non-affiliated third party, other than to a consumer reporting agency, customer account numbers or other similar account identifiers for marketing purposes. The GLBA also provides that the states may adopt customer privacy protections that are more strict than those contained in the act. Amendment to the Annual Privacy Notice Requirement Under the Gramm-Leach-Bliley Act (Regulation P) . In July 2016 the CFPB proposed to update Regulation P to implement a December 2015 statutory amendment to the Gramm-Leach-Bliley Act. The August 10, 2018 rule finalized that proposal. The rule provides an exception under which financial institutions that meet certain conditions are not required to provide annual privacy notices to customers. To qualify for this exception, a financial institution must not share nonpublic personal information about customers except as described in certain statutory exceptions. In addition, the rule requires that the financial institution must not have changed its policies and practices with regard to disclosing nonpublic personal information from those that the institution disclosed in the most recent privacy notice it sent. As part of its implementation, the CFPB also amended Regulation P to provide timing requirements for delivery of annual privacy notices in the event that a financial institution that qualified for this annual notice exception later changes its policies or practices in such a way that it no longer qualifies for the exception. The CFPB further removed the Regulation P provision that allowed for use of the alternative delivery method for annual privacy notices because the CFPB believes the alternative delivery method will no longer be used in light of the annual notice exception. Anti-Money Laundering Laws and Regulations. The Bank is subject to several federal laws that are designed to combat money laundering, terrorist financing, and transactions with persons, companies or foreign governments designated by U.S. authorities (“AML laws”). This category of laws includes the Bank Secrecy Act of 1970, the Money Laundering Control Act of 1986, the USA PATRIOT Act of 2001, and the Anti-Money Laundering Act of 2020. The Anti-Money Laundering Act of 2020, the most sweeping anti-money laundering legislation in 20 years, requires various federal agencies to promulgate regulations implementing a number of its provisions. The AML laws and their implementing regulations require insured depository institutions, broker-dealers, and certain other financial institutions to have policies, procedures, and controls to detect, prevent, and report money laundering and terrorist financing. The AML laws and their regulations also provide for information sharing, subject to conditions, between federal law enforcement agencies and financial institutions, as well as among financial institutions, for counter-terrorism purposes. Federal banking regulators are required, when reviewing bank holding company acquisition and bank merger applications, to take into account the effectiveness of the anti-money laundering activities of the applicants. To comply with these obligations, the Company has implemented appropriate internal practices, procedures, and controls. Cybersecurity . The federal banking agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a financial institution’s board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services. The federal banking agencies expect financial institutions to establish lines of defense and ensure that their risk management processes also address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack. If the Bank fails to meet the expectations set forth in this regulatory guidance, it could be subject to various regulatory actions and any remediation efforts may require significant resources of the Bank. In addition, all federal and state bank regulatory agencies continue to increase focus on cybersecurity programs and risks as part of regular supervisory exams. In November 2021, the federal banking agencies approved a final rule that, among other things, would require banking organizations to notify their primary regulator within 36 hours of becoming aware of a “computer-security incident” that rises to the level of a “notification incident.” The rule also requires bank service providers to notify their banking organization customers as soon as possible after becoming aware of similar incidents. 10 Sarbanes-Oxley Act of 2002. The Sarbanes-Oxley Act implemented a number of laws affecting corporate governance, accounting obligations and corporate reporting. The Sarbanes-Oxley Act is applicable to all companies with equity securities registered or that file reports under the Securities Exchange Act of 1934. In particular, the Sarbanes-Oxley Act established: (i) requirements for audit committees, including independence, expertise, and responsibilities; (ii) responsibilities regarding financial statements for the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) standards for auditors and regulation of audits; (iv) disclosure and reporting obligations for reporting companies and their directors and executive officers; and (v) civil and criminal penalties for violations of the securities laws. Because the Company’s common stock is registered with the SEC, it is currently subject to these requirements. Incentive Compensation. In June 2010, the Federal Reserve issued a final rule on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. Banking organizations are instructed to review their incentive compensation policies to ensure that they do not encourage excessive risk-taking and implement corrective programs as needed. The Federal Reserve will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Bank, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Dodd-Frank Act. In July 2010, the Dodd-Frank Act was signed into law, incorporating numerous financial institution regulatory reforms. The Dodd-Frank Act implements far-reaching reforms of major elements of the financial landscape, particularly for larger financial institutions. Many of its provisions do not directly impact community-based institutions like the Bank. For instance, provisions that regulate derivative transactions and limit derivatives trading activity of federally-insured institutions, enhance supervision of “systemically significant” institutions, impose new regulatory authority over hedge funds, limit proprietary trading by banks, and phase-out the eligibility of trust preferred securities for Tier 1 capital are among the provisions that do not directly impact the Bank either because of exemptions for institutions below a certain asset size or because of the nature of the Bank’s operations. Certain aspects of the Dodd-Frank Act remain subject to rulemaking and interpretation and will take effect over several years, and their impact on the Company or the financial industry is difficult to predict before such regulations or interpretations are adopted. In May 2018, the Economic Growth, Regulatory Relief, and Consumer Protection Act (the "Economic Growth Act") was enacted to modify or remove certain regulatory financial reform rules and regulations, including some of those implemented under the Dodd-Frank Act. While the Economic Growth Act maintains most of the regulatory structure established by the Dodd-Frank Act, it amends certain aspects of the regulatory framework for small depository institutions with assets of less than $10 billion, such as the Bank, and for large banks with assets of more than $50 billion. Among other matters, the Economic Growth Act expands the definition of qualified mortgages which may be held by a financial institution with total consolidated assets of less than $10 billion, exempts community banks from the Volcker Rule, and includes additional regulatory relief regarding regulatory examination cycles, call reports, mortgage disclosures and risk weights for certain high-risk commercial real estate loans. Future Legislation and Regulation . Congress may enact legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of the proposed legislation could impact the regulatory structure under which the Company and the Bank operate and may significantly increase costs, impede the efficiency of internal business processes, require an increase in regulatory capital, require modifications to business strategy, and limit the ability to pursue business opportunities in an efficient manner. A change in statutes, regulations or regulatory policies applicable to the Company or the Bank could have a material, adverse effect on the business, financial condition and results of operations of the Company and the Bank. Future legislation, regulation, and government policy could affect the banking industry as a whole, including the business and results of operations of the Company and the Bank, in ways that are difficult to predict. The Company fully expects that the financial institution industry will remain heavily regulated in the near future and that additional laws or regulations may be adopted further regulating specific banking practices. 11 Wage and Hour Division, Department of Labor. On December 16, 2019, the Department of Labor issued a final rule, the rule updates a number of regulations on the calculation of overtime compensation both to provide clarity and to better reflect the 21st-century workplace. These changes will promote compliance with the FLSA, provide appropriate and updated guidance in an area of evolving law and practice, and encourage employers to provide additional and innovative benefits to workers without fear of costly litigation. This final rule was effective on January 15, 2020. CARES Act. In response to the COVID-19 pandemic, President Trump signed into law the Coronavirus Aid, Relief, and Economic Security (“CARES”) Act on March 27, 2020. Among other things, the CARES Act included the following provisions impacting financial institutions: • Community Bank Leverage Ratio. The CARES Act directed federal banking agencies to adopt interim final rules to lower the threshold under the CBLR from 9% to 8% and to provide a reasonable grace period for a community bank that falls below the threshold to regain compliance, in each case until the earlier of the termination date of the national emergency or December 31, 2020. In October 2020, the federal bank regulatory agencies issued two interim final rules implementing this directive. The interim final rules provide that, as of the second quarter 2020, banking organizations with leverage ratios of 8% or greater (and that meet the other existing qualifying criteria) may elect to use the CBLR framework. The leverage ratio requirement increases to 8.5% effective January 1, 2021 and 9% effective January 1, 2022. The final rules also establish a two-quarter grace period for qualifying community banking organizations who fail to meet the qualifying criteria, including the leverage ratio, so long as the banking organization maintains a leverage ratio of 7% or greater effective the second quarter of 2020, 7.5% effective January 1, 2021, and 8% effective January 1, 2022. • Temporary Troubled Debt Restructurings (“TDR”) Relief. The CARES Act allows banks to elect to suspend requirements under GAAP for loan modifications related to the COVID-19 pandemic (for loans that were not more than 30 days past due as of December 31, 2019) that would otherwise be categorized as a TDR, including impairment for accounting purposes, until the earlier of 60 days after the termination date of the national emergency or December 31, 2020. Federal banking regulators are required to defer to the determination of the banks making such suspension. The Consolidated Appropriations Act, 2021, signed into law on December 27, 2020, extended this temporary relief until January 1, 2022. • Small Business Administration (“SBA”) Paycheck Protection Program. The CARES Act created the SBA’s Paycheck Protection Program. Under the Paycheck Protection Program, funds were authorized for small business loans to pay payroll and group health costs, salaries and commissions, mortgage and rent payments, utilities, and interest on other debt. The loans were provided through participating financial institutions, including the Bank, that processed loan applications and serviced the loans. 12