What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2025-03-14 compared with 2024-03-20 · 353 added, 232 removed, 383 unchanged (60% of the section changed)

1 unchanged sentence

MainStreet Bancshares, Inc.

is a bank holding company that owns 100% of MainStreet Bank and MainStreet Community Capital, LLC.

is a financial holding company that owns 100% of MainStreet Bank and MainStreet Community Capital, LLC.

On October 12, 2021, the Company filed an election to be a financial holding company with the Board of Governors of the Federal Reserve System (the “Federal Reserve”).

36 unchanged sentences

We offer mobile banking apps for iPhones, iPads and Android devices that provide for remote deposit of checks.

In addition, we were the first bank headquartered in the Commonwealth of Virginia to offer CDARS, the Certificate of Deposit Account Registry Service, an innovative deposit insurance solution that provides Federal Deposit Insurance Corporation (“FDIC”) insurance on deposits up to $50 million.

In addition, we were the first bank headquartered in the Commonwealth of Virginia to offer the Certificate of Deposit Account Registry Service ("CDARS"), an innovative deposit insurance solution from the IntraFi Network, LLC ("IntraFi") that provides Federal Deposit Insurance Corporation (“FDIC”) insurance on deposits up to $50 million.

The Bank also participates in the IntraFi Insured Cash Sweep ("ICS") program, which also functions to provide greater FDIC insurance coverage for participating customers.

We believe that enhanced electronic delivery systems and technology increase profitability through greater productivity and cost control, and allow us to offer new and better products and services.

4 unchanged sentences

formally introduced Avenu, a division of MainStreet Bank.

Avenu will provide an embedded Banking as a Service (BaaS) solution that connects our partners (fintechs, application developers, money movers, and entrepreneurs) directly and seamlessly to our Software as a Service (SaaS) solution.

Avenu provides an embedded Banking as a Service (BaaS) solution that connects our partners (fintechs, application developers, money movers, and entrepreneurs) directly and seamlessly to our Software as a Service (SaaS) solution.

Our transformational subledger combined with our high-touch compliance training goes beyond the industry standards to ensure that our Fintech partners will prosper.

This division of MainStreet Bank will serve money service businesses, payment processers, and other clients who have a need to embed deposit gathering and payment processing in their mobile Apps.

This division of MainStreet Bank serves money service businesses, payment processers, and other clients who have a need to embed deposit gathering and payment processing in their mobile Apps.

This division provides the Bank with valuable low-cost deposits and additional streams of fee income.

Our SaaS software program will be deployed in the second quarter of 2024.

Our SaaS software program was deployed in October 2024.

The Avenu division is classified within our Financial Technology reportable segment outlined in Note 26.

Additional information can be found in our investor presentations filed quarterly.

8 unchanged sentences

Allocation awards are expected to be announced during the fourth quarter of 2025.

Emerging Growth Company Status

We qualify as an “emerging growth company” under the JOBS Act and as defined in Section 2(a) of the Securities Act of 1933.

For as long as we are an emerging growth company, we may choose to take advantage of exemptions from various reporting requirements applicable to other public companies but not to emerging growth companies.

See “Risk Factors—We are an emerging growth company, and any decision on our part to comply only with certain reduced reporting and disclosure requirements applicable to emerging growth companies could make our common stock less attractive to investors.”

As an emerging growth company:

we may present as few as two years of audited financial statements and two years of related management discussion and analysis of financial condition and results of operations, in contrast to other reporting companies which must provide audited financial statements for three fiscal years;

we are exempt from the requirement to obtain an attestation and report from our auditors on management’s assessment of our internal control over financial reporting under the Sarbanes-Oxley Act of 2002;

we are permitted to provide less extensive disclosure about our executive compensation arrangements, including recently adopted pay versus performance disclosures;

we are permitted to include less extensive narrative disclosures than required of other reporting companies, particularly with respect to executive compensation.

In this Form 10-K we have elected to take advantage of the reduced disclosure requirements relating to executive compensation, and in the future we may take advantage of any or all of these exemptions for so long as we remain an emerging growth company.

We will remain an emerging growth company until the earliest of (i) the end of the first fiscal year during which we have total annual gross revenues of $1.07 billion or more, (ii) the end of the fiscal year following the fifth anniversary of the completion of our initial registered public offering of common equity securities, which will be in December 31, 2024, (iii) the date on which we have, during the previous three-year period, issued more than $1.0 billion in non-convertible debt and (iv) the date on which we are deemed to be a “large accelerated filer” as defined in Rule 12b-2 under the Securities Exchange Act of 1934 (the “Exchange Act”).

In addition to the relief described above, the JOBS Act permits us an extended transition period for complying with new or revised accounting standards affecting public companies.

We have elected not to take advantage of this extended transition period, which means that the financial statements included in this Form 10-K, as well as any financial statements that we file in the future, will be subject to all new or revised accounting standards generally applicable to public companies.

Nasdaq Listing

37 unchanged sentences

Overall, the Washington D.C.

MSA ranks ninth out of the largest 25 MSAs ranked by population estimates as of 2023 according to the Census Bureau.

MSA ra nks ninth out of the largest 25 MSAs ranked by population estimates as of 2023 according to the Census Bureau.

We expect our strategies to benefit from the continued growth in population and high income of our market area’s residents.

4 unchanged sentences

Median Household Income Projected Change 2025-2030

Unemployment Rate as of November 2023

Unemployment Rate as of November 2022

Unemployment Rate as of October 2024

Unemployment Rate as of October 2023

District of Columbia

6 unchanged sentences

The Washington, D.C.

MSA is a desirable market for a broad range of companies in a variety of industries, including twenty-seven companies from the 2023 Fortune 500 list, and six of the United States’ largest 100 private companies, according to the 2023 Forbes list of largest private companies by revenue.

MSA is a desirable market for a broad range of companies in a variety of industries, including thirty companies from the 2024 Fortune 500 list, and seven of the United States’ largest 100 private companies, according to the 2024 Forbes list of largest private companies by revenue.

According to the U.S Bureau of Labor Statistics, the Washington, D.C.

12 unchanged sentences

Other Services

Bureau of Labor Statistics, Data as of November 2023

Bureau of Labor Statistics, Data as of October 2024

Data is not seasonally adjusted

12 unchanged sentences

We provide our clients with local decision making and individualized service coupled with products and services offered by our larger institutional competitors.

As our business lenders, officers, and Bank directors are based in or reside in the communities we serve, we are able to maintain a high-level of involvement in local organizations and establish a strong understanding of the banking needs of the respective communities.

As our business lenders, officers, and directors are based in or reside in the communities we serve, we are able to maintain a high-level of involvement in local organizations and establish a strong understanding of the banking needs of the respective communities.

We believe that our customer-centric business philosophy and sales approach enables us to build long-term relationships with desirable customers, which enhances the quality and stability of our funding and lending operations.

6 unchanged sentences

Capital Position .

The Bank exceeds the regulatory guidelines to be classified as “well capitalized.” Our capital position is strong and has consistently grown.

The Bank exceeds the regulatory guidelines to be classified as “well capitalized.” Our capital position remains strong.

At December 31, 2024, the Bank had a tier 1 leverage capital ratio of 12.08%, a common equity tier 1 risk-based capital ratio of 14.64%, a tier 1 risk-based capital ratio of 14.64%, and a total risk-based capital ratio of 15.69%.

17 unchanged sentences

Commercial loans are written for a variety of business purposes, including government contract receivables, plant and equipment, general working capital, contract administration and acquisition lending.

We are also a Preferred Lender for the Small Business Administration (SBA).

Our client base is diverse, and we do not have a concentration of commercial business loans in any specific industry segment.

15 unchanged sentences

Residential Real Estate Lending .

The Bank offers a variety of consumer-oriented residential real estate loans both for purchase and refinancing, most of which are brokered to the secondary market.

The Bank offers a variety of consumer-oriented residential real estate loans both for purchase and refinancing.

Consumer Installment Lending .

We offer consumer loans including term loans and overdraft protection.

We offer consumer loans including term loans, home equity lines of credit, and overdraft protection.

Credit Policies and Administration .

7 unchanged sentences

Lending Limit .

As of December 31, 2023, our legal lending limit for loans to one borrower was approximately $46.8 million.

As of December 31, 2024, our legal lending limit for loans to one borrower was approxima tely $46.8 million .

The Bank “in-house” lending limit is 50% of the legal lending limit for all relationships unless the loan is owner occupied, 1-4 family/residential or a government contract line of credit.

25 unchanged sentences

The Bank invests in fixed rate or floating rate instruments as necessary to reduce interest rate risk exposure.

At December 31, 2023, the held-to-maturity portfolio, which is primarily composed of municipal securities and is carried at amortized cost, totaled $17.3 million.

At that date, the available-for-sale portfolio, which is composed of U.S.

Treasury securities, collateralized mortgage-backed securities, subordinated debt of other financial institutions and U.S.

At December 31, 2024, the held-to-maturity portfolio, which is primarily composed of municipal securities and subordinated debt of other financial institutions, and is carried at amortized cost, totaled $16.1 million.

At that date, the available-for-sale portfolio, which is composed of collateralized mortgage-backed securities, subordinated debt of other financial institutions, preferred stock, municipal securities, and U.S.

Government agency securities and is carried at fair value, totaled $55.7 million.

For additional information, see Note 3 of Notes to Consolidated Financial Statements.

For additional information, see Note 3 of the Notes to Consolidated Financial Statements.

Subordinated Notes .

In April of 2021, the Company completed an issuance and sale of $30 million in fixed-to-floating subordinated notes at an annual fixed interest rate of 3.75% until April 15, 2026.

In April of 2021, the Company completed an issuance and sale of $30 million in fixed-to-floating subordinated notes.

The net proceeds were used to fully call subordinated notes issued in 2016 and to support additional growth for other general business purposes.

The notes have a maturity date of April 15, 2031 and an annual fixed interest rate of 3.75% until April 15, 2026.

After April 15, 2026, the notes will have a floating interest rate based on three-month SOFR rate plus 302 basis points (3.02%) (computed on the basis of a 360-day year of twelve 30-day months) from and including April 15, 2026, to the maturity date or any early redemption date.

16 unchanged sentences

We can also arrange for FDIC insurance for deposits up to $50 million through CDARS, the Certificate of Deposit Account Registry Service, which provides a convenient method for a depositor to enjoy full FDIC insurance on deposits up to $50 million through a single banking relationship.

The Bank also participates in the IntraFi Insured Cash Sweep ("ICS") program, which also functions to provide greater FDIC insurance coverage for participating customers.

For additional information on deposits, see Note 9 of Notes to Consolidated Financial Statements.

2 unchanged sentences

We determined that Financial Technology (“FinTech”) companies were making significant inroads into banking, and we expanded our strategic plan to include banking customers that require BaaS and other payment service solutions.

Consistent with our culture, we worked over the past seven years with a small group of clients in order to understand the risks associated with this business line.

Consistent with our culture, we worked with a small group of clients in order to understand the risks associated with this business line.

We developed an infrastructure to identify, measure, monitor, and control the risks associated with FinTechs, providing BaaS, and payment systems in general.

We designed and implemented comprehensive legal, strategic, procedural and policy documents to guide business opportunities.

We are designing Avenu to be a comprehensive solution that provides FinTechs with an array of embedded banking services they may offer to their customers in a scalable cloud-based platform.

We have designed Avenu to be a comprehensive solution that provides FinTechs with an array of embedded banking services they may offer to their customers in a scalable cloud-based platform.

We guide our FinTech partners through the complex maze of banking regulations by integrating compliance and fraud detection throughout the framework of our solution as well as in-person training for FinTech partners' team members.

82 unchanged sentences

We believe that a diverse workforce enhances our ability to serve our customers and our communities by enabling us to better understand their financial needs and to provide necessary and appropriate financial services.

Seventy-four percent of the Company’s employees self-identify as either female or ethnically diverse (defined as all Equal Employment Opportunity Commission classifications other than white).

The Company is proud to have three veterans on its team as well.

Seventy-three percent of the Company’s employees self-identify as either female or ethnically diverse (defined as all Equal Employment Opportunity Commission classifications other than white).

The Company is proud to have four veterans on its team as well.

As indicated in the discussion of Board Leadership and Oversight, the Company believes effective oversight by the Board of Directors is an essential element of a financially sound and well-managed bank.

3 unchanged sentences

We seek highly qualified directors with skills needed for a forward-looking Board.

The Company had a technology expert on the Board in 2011, well before it became a recommended practice for community banks.

At the Board level, the Company has seven independent directors, out of a total of ten.

The total of ten includes one director who stepped down from management in March 2022 and thus will become an independent director in March 2025.

Two of the independent directors self-identify as female, one self-identifies as an African-American male and one self-identifies as a Hispanic male.

Three of the independent directors self-identify as white males.

The Company has a technology expert on the Board since 2011, well before it became a recommended practice for community banks.

At the Board level, the Company has seven independent directors, out of a total of nine.

The total of nine includes one director who stepped down from manage ment in March 2022 and thus will become an independent director in March 2025.

One of the independent directors self-identify as female, one self-identifies as an African-American male, and one self-identifies as a Hispanic male.

Four of the independent directors self-identify as white males.

Diversity is one factor taken into account when considering candidates to serve on the Board of Directors.

1 unchanged sentence

The matrix below summarizes the self-identified diversity attributes of our Board members.

The categories listed below have the meanings defined in Nasdaq Listing Rule 5605(f)(1).

Total Number of Directors

20 unchanged sentences

Employees by Generation

Pre Baby Booms

Pre Baby Boomers

The gender distribution of our employee base is diversified.

7 unchanged sentences

Supervision, Regulation and Other Factors

banking industry is highly regulated under federal and state law.

Consequently, our growth and earnings performance will be affected not only by management decisions and general and local economic conditions, but also by the statutes administered by, and the regulations and policies of, various governmental regulatory authorities.

These regulators include the Federal Reserve, FDIC, the Bureau, CFPB, SEC, Internal Revenue Service, and state taxing authorities.

President Trump and Republican members of Congress have proposed significant reductions in financial institution regulation.

The effect of these statutes, regulations, and policies and any changes to such statutes, regulations, and policies, if adopted, can be material and cannot be predicted.

The primary goals of the U.S.

bank regulatory framework are to maintain a safe and sound banking system, facilitate the conduct of sound monetary policy, and promote fairness and transparency for financial products and services.

The system of supervision and regulation applicable to us and the Bank establishes a comprehensive framework for their respective operations and is intended primarily for the protection of the FDIC’s Deposit Insurance Fund, the Bank’s depositors, and the public, rather than our shareholders or creditors.

The descriptions below summarize certain elements of the regulatory framework.

The descriptions are not intended to describe all laws and regulations applicable to us and the Bank, and the descriptions are qualified by reference to the full texts of the statutes, regulations, policies, interpretive letters, and other written guidance that are described herein.

Regulation of the Company and Bank .

The Company is a bank holding company that has elected status as a financial holding company.

As such, the Company is subject to extensive regulation under the Bank Holding Company Act of 1956 and to the examination and reporting requirements of the Federal Reserve.

The Company is also subject to the rules and regulations of the SEC under the federal securities laws.

As a Virginia-chartered bank that is a member of the Federal Reserve System, the Bank is subject to regulation, supervision and examination by the Bureau and the Federal Reserve.

As such, the Company is subject to extensive regulation under the Bank Holding Company Act of 1956, as amended (“BHCA”), and to the examination and reporting requirements of the Federal Reserve.

The Company is also subject to the rules and regulations of the SEC and state securities administrators under federal and state securities laws.

As a Virginia-chartered commercial bank that is a member of the Federal Reserve System, the Bank is subject to regulation, supervision and examination by the Bureau and the Federal Reserve.

State and federal laws also govern the activities in which the Bank engages, the investments that it makes and the aggregate amount of loans that may be granted to one borrower.

1 unchanged sentence

In addition, various consumer and compliance laws and regulations affect the Bank’s operations.

The earnings of the Company’s subsidiaries, and therefore the earnings of the Company, are affected by general economic conditions, management policies, changes in state and federal legislation and actions of various regulatory authorities, including those referred to above.

The following description summarizes some of the significant state and federal and state laws to which the Company and the Bank are subject.

To the extent that statutory or regulatory provisions or proposals are described, the description is qualified in its entirety by reference to the particular statutory or regulatory provisions or proposals.

The earnings of the Bank, the Company’s subsidiary, and therefore the earnings of the Company, are affected by general economic conditions, management policies, changes in state and federal legislation and actions of various regulatory authorities, including those referred to above.

The statutes, regulations and policies that govern our operations are under continuous review and are subject to amendment from time to time by Congress, the Virginia legislature and federal and state regulatory agencies.

Any such future statutory or regulatory changes could adversely affect our operations and financial condition.

Regulation of the Bank .

The Bank is subject to regulation and supervision by the Bureau and by the Federal Reserve, which regulation and supervision extends to all aspects of its operations, including but not limited to requirements concerning an allowance for credit losses, lending and mortgage operations, interest rates received on loans and paid on deposits, the payment of dividends to the Company, loans to officers and directors, mergers and acquisitions, capital adequacy, and the opening and closing of branches.

As a state-chartered bank that is a member of the Federal Reserve System, the Bank is subject to periodic examinations by the Bureau and by the Federal Reserve Bank of Richmond.

In these examinations, the examiners assess compliance with state and federal banking regulations and the safety and soundness standards in such matters as loan underwriting and documentation, asset quality, earnings standards, internal controls and audit systems, interest rate risk exposure, and employee compensation and benefits.

The Bureau and the Federal Reserve have enforcement responsibility over the Bank and the authority to bring actions against the Bank and certain institution-affiliated parties, including officers, directors, and employees, for violations of laws or regulations and for engaging in unsafe and unsound practices.

Formal enforcement actions include the issuance of a capital directive or cease and desist order, civil money penalties, removal of officers and/or directors, and receivership or conservatorship of the institution.

Insurance of Deposit Accounts .

The FDIC insures deposits at federally insured financial institutions like the Bank.

Deposit accounts in the Bank are insured by the FDIC generally up to a maximum of $250,000 per separately insured depositor and up to a maximum of $250,000 for self-directed retirement accounts.

The FDIC charges insured depository institutions assessments to maintain the Deposit Insurance Fund (the "DIF").

Assessment rates for small institutions (those with less than $10 billion in assets) are based on an institution’s weighted average CAMELS component ratings and certain financial ratios and are applied to the institution’s assessment base, which equals its average total assets minus its average tangible equity.

In October 2022, the FDIC adopted a final rule that increased the initial base deposit insurance assessment rate schedules uniformly by 2 basis points beginning with the first quarterly assessment period of 2023.

The FDIC increased the insurance assessment rates in response to the 2020 decline in the DIF reserve ratio below the statutory minimum of 1.35% established by the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), and the increased assessment is expected to improve the likelihood that the reserve ratio would be restored to 1.35% by September 30, 2028 prescribed under the FDIC’s restoration plan.

The FDIC’s assessment rates effective January 1, 2023 (which are subject to certain adjustments) range from 3 to 16 basis points for institutions with CAMELS composite ratings of 1 or 2, 6 to 30 basis points for those with a CAMELS composite score of 3, and 16 to 30 basis points for those with CAMELS Composite scores of 4 or 5.

The FDIC has authority to increase insurance assessments.

Any significant increases would have an adverse effect on the operating expenses and results of operations of the Bank.

We cannot predict what the FDIC assessment rates will be in the future.

Insurance of deposits may be terminated by the FDIC upon a finding that an institution has engaged in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.

We do not know of any practice, condition or violation that may lead to termination of our deposit insurance.

Wholesale Deposits .

The Company will refer to brokered deposits as wholesale deposits for the entirety of this filing.

The Federal Deposit Insurance Act prohibits an insured depository institution from accepting wholesale deposits or offering interest rates on any deposits significantly higher than the prevailing rate in the bank’s normal market area or nationally (depending upon where the deposits are solicited), unless it is well-capitalized or is adequately capitalized and receives a waiver from the FDIC.

A depository institution that is adequately capitalized and accepts wholesale deposits under a waiver from the FDIC may not pay an interest rate on any deposit in excess of national and local rate caps set by the FDIC and published on its website.

Regulatory Capital Requirements .

The Bank is required to comply with applicable capital adequacy requirements adopted by the Federal Reserve and the other federal bank regulatory agencies (the “Basel III Capital Rules”).

The Basel III Capital Rules apply to all depository institutions as well as to all top-tier bank and savings and loan holding companies that are not subject to the Federal Reserve’s Small Bank Holding Company Policy Statement.

The capital requirements are quantitative measures established by regulation that require the Bank to maintain minimum amounts and ratios of capital.

Failure to meet minimum capital requirements can initiate certain mandatory and possibly additional discretionary actions by bank regulators that, if undertaken, could have a direct material effect on the Company’s financial statements.

The Basel III Capital Rules require the maintenance of “Common Equity Tier 1” (“CET1”) capital, Tier 1 capital and Total capital to risk-weighted assets of at least 4.5%, 6% and 8%, respectively.

The capital rules also establish a minimum leverage ratio of at least 4% Tier 1 capital to average consolidated assets.

In addition to the above minimum requirements, the Basel III Capital Rules limits capital distributions and certain discretionary bonus payments if a banking organization does not hold a “capital conservation buffer” consisting of 2.5% of CET1 capital to risk-weighted assets above the amount necessary to meet its minimum risk-based capital requirements.

The capital conservation buffer requirement effectively increases the minimum required risk-based capital ratios to 7% for CET1, 8.5% for Tier 1 capital and 10.5% for Total capital.

In determining the amount of risk-weighted assets for purposes of calculating risk-based capital ratios, a bank’s assets, including certain off-balance sheet assets (e.g., recourse obligations, direct credit substitutes and residual interests), are multiplied by a risk weight factor assigned by the capital regulations based on the risk deemed inherent in the type of asset.

Higher levels of capital are required for asset categories believed to present greater risk.

For example, a risk weight of 0% is assigned to cash and U.S.

government securities, a risk weight of 50% is generally assigned to prudently underwritten first lien one- to four-family residential mortgages, a risk weight of 100% is assigned to commercial and consumer loans, a risk weight of 150% is assigned to non-residential mortgage loans that are 90 days past due or otherwise on non-accrual status, and a risk weight of between 0% to 600% is assigned to permissible equity interests, depending on certain specified factors.

Under applicable federal statute, the federal bank regulatory agencies are required to take “prompt corrective action” with respect to institutions that do not meet specified minimum capital requirements.

For these purposes, the statute establishes five capital categories:

well- capitalized, adequately capitalized, undercapitalized, significantly undercapitalized and critically undercapitalized.

Under the implementing regulations, in order to be considered well-capitalized, a bank must have a ratio of CET1 capital to risk-weighted assets of 6.5%, a ratio of Tier 1 capital to risk-weighted assets of 8%, a ratio of total capital to risk-weighted assets of 10%, and a leverage ratio of 5%.

In order to be considered adequately capitalized, a bank must have the minimum capital ratios required by the regulatory capital rule described above.

Institutions with lower capital ratios are assigned to lower capital categories.

Based on safety and soundness concerns, a bank may be assigned to a lower capital category than would otherwise apply based on its capital ratios.

A bank that is not well-capitalized is subject to certain restrictions on wholesale deposits and interest rates on deposits.

A bank that is not at least adequately capitalized is subject to numerous additional restrictions, and a guaranty by its holding company is required.

A bank with a ratio of tangible equity to total assets of 2.0% or less is subject to the appointment of the FDIC as receiver if its capital level does not improve within 90 days.

As of December 31, 2023, the Bank was in compliance with all regulatory capital standards and qualified as “well-capitalized,” under the prompt correction action regulations.

Bank Holding Company Regulation .

The Company is subject to regulation under the BHCA and to supervision, examination, and enforcement by the Federal Reserve as well as the Bureau.

The BHCA and other federal laws subject bank holding companies to particular restrictions on the types of activities in which they may engage, and to a range of supervisory requirements and activities, including regulatory enforcement actions for violations of laws and regulations.

The Federal Reserve’s jurisdiction also extends to any company that we directly or indirectly control, such as any nonbank subsidiaries and other companies in which we own a controlling interest.

Financial Services Industry Reform .

As final rules and regulations implementing the Dodd-Frank Act have been adopted, and may continue to be adopted and/or modified, this law has changed the bank regulatory framework and has affected the lending, deposit, investment, trading, and operating activities of banks and their holding companies.

A number of the effects of the Dodd-Frank Act are described or otherwise accounted for in various parts of this “Supervision, Regulation and Other Factors” section.

In addition to those requirements, the Dodd-Frank Act addresses many investor protection, corporate governance, and executive compensation matters that affect most U.S.

publicly traded companies.

The Dodd-Frank Act requires certain publicly traded companies to give shareholders a non-binding vote on executive compensation and golden parachute payments;

enhances independence requirements for compensation committee members;

requires national securities exchanges to require listed companies to adopt incentive-based compensation “clawback” policies for executive officers;

requires certain publicly traded companies to disclose the relationship between the executive compensation actually paid by the company and the financial performance of the company;

and authorizes the SEC to promulgate rules that would allow shareholders to nominate their own director candidates using a company’s proxy materials.

While much of the Dodd-Frank Act has been implemented in the form of final rules from the banking agencies, certain aspects of the Dodd-Frank Act remain in proposed form or have not been implemented.

Accordingly, it is possible that existing rules may still be modified or repealed or that new rules may be implemented that may impact our operations.

The Economic Growth, Regulatory Relief and Consumer Protection Act (“Economic Growth Act”), which was signed into law in May 2018, provides certain limited amendments to the Dodd-Frank Act, as well as certain targeted modifications to prior financial services reform regulatory requirements.

Provisions in the Economic Growth Act generally address access to mortgage credit;

consumer access to credit;

protections for veterans, consumers, and homeowners;

and protections for student borrowers.

One of the Economic Growth Act’s highlights, with implications for us, was the asset threshold under the Federal Reserve’s Small Bank Holding Company and Savings and Loan Holding Company Policy Statement being increased from $1 billion to $3 billion, which benefits bank holding companies by, among various other items, allowing for an 18-month safety and soundness examination cycle as opposed to a 12-month examination cycle, changing to scaled biannual regulatory reporting requirements as opposed to quarterly regulatory reporting requirements, and not subjecting bank holding companies to capital adequacy guidelines on a consolidated basis.

Another significant provision was the Economic Growth Act’s directive that federal bank regulatory agencies adopt a threshold for a Community Bank Leverage Ratio (“CBLR”) framework.

The CBLR framework and its implications for us are discussed in more detail below under the heading “- Bank Regulation - Capital Adequacy Requirements.”

In March 2023, the CFPB issued a final rule implementing Section 1071 of the Dodd-Frank Act.

The final rule requires financial institutions to collect and report data to the CFPB on small business loan applicants, including demographic data, lending decisions, and the price and terms of credit.

The purpose of the rule is to increase transparency and combat discrimination in small business lending.

For banks with moderate volume lending, the compliance deadline is January 16, 2026.

On October 22, 2024, the CFPB issued its final rule implementing Section 1033 of the Dodd-Frank Act with respect to personal financial data rights, more commonly known as the “Open Banking Rule.” The final rule, among other things, requires banks and other financial institutions to make a consumer’s data available upon request to the consumer and their authorized third parties in a secure and reliable manner, and establishes obligations for third parties accessing consumers’ data, including data security and privacy protections.

According to the CFPB, the rule is designed to foster competition and innovation in the financial services industry by making it easier for consumers to switch financial providers and for new companies to offer innovative products and services.

The compliance deadline is phased-in based on the asset size of the financial institution.

For banks with $1.5 billion to $3 billion in total assets, the compliance deadline is April 1, 2029.

At this time, it is difficult to anticipate the continued impact the above-described legislation may have on our business, our customers, and the financial industry generally.

Changes resulting from further implementation of, changes to, or repeal of the Dodd-Frank Act and other regulations may impact the profitability of our business activities;

require changes to certain of our business practices;

impose upon us more stringent capital, liquidity, and leverage requirements;

or otherwise adversely affect our business.

These changes may also require us to invest significant management attention and resources to evaluate and make any changes necessary to comply with new statutory and regulatory requirements.

Failure to comply with any new requirements may negatively impact our results of operations and financial condition.

Additionally, the future implementation and enforcement of regulations may be affected by the outcome of the 2024 Presidential election, which resulted in significant changes in the leadership of various bank regulatory agencies.

In early February 2025, the CFPB’s Acting Director issued directives to cease virtually all CFPB activities, including supervision, examinations, rulemaking, enforcement actions, and pending investigations.

CFPB staff were instructed to suspend the effective dates of all rules that have been issued, but have not yet gone into effect.

Further, the Acting Director announced that the CFPB would not be taking its next draw of unappropriated funding.

A new CFPB Director has recently been nominated and is subject to Senate confirmation.

The future of the CFPB is uncertain at this time.

Holding Company Capital Requirements .

As a bank holding company with less than $3 billion in total consolidated assets, the Company is eligible to be treated as a “small bank holding company” under the Federal Reserve’s Small Bank Holding Company and Savings and Loan Holding Company Policy Statement.

As a result, the Company’s capital adequacy is evaluated at the bank level and on a parent-only basis, and it is not subject to consolidated capital standards for regulatory purposes.

Imposition of Liability for Undercapitalized Subsidiaries .

Federal banking regulations require FDIC-insured banks that become undercapitalized to submit a capital restoration plan.

The capital restoration plan of a bank controlled by a bank holding company will not be accepted by the regulators unless the bank holding company guarantees the subsidiary’s compliance with the capital restoration plan up to a certain specified amount.

Any such guarantee from a bank holding company is entitled to a priority of payment in bankruptcy.

The aggregate liability of the holding company of an undercapitalized bank in such a guarantee is limited to the lesser of 5% of the bank’s assets at the time it became undercapitalized or the amount necessary to cause the institution to be adequately capitalized.

The bank regulatory agencies have greater power in situations where a bank becomes significantly or critically undercapitalized or fails to submit a capital restoration plan.

For example, a bank holding company controlling such a bank can be required to obtain prior Federal Reserve approval of proposed dividends, or might be required to divest the bank or other affiliates.

Acquisitions by Bank Holding Companies .

We must obtain the prior approval of the Federal Reserve before acquiring more than 5% of the voting stock of any bank or other bank holding company, acquiring all or substantially all of the assets of any bank or bank holding company, or merging or consolidating with any other bank holding company.

In evaluating applications with respect to these transactions, the Federal Reserve is required to consider, among other things, the effect of the acquisition on competition;

the financial condition, managerial resources, and prospects of the bank holding company and the bank(s) concerned;

the convenience and needs of the communities to be served (including the record of performance under the CRA);

the effectiveness of the applicant in combating money laundering activities;

and the extent to which the proposed acquisition would result in greater or more concentrated risks to the stability of the U.S.

banking or financial system.

The Federal Reserve can deny an application based on the above criteria or other considerations.

In addition, as a condition to receiving regulatory approval, the Federal Reserve can impose conditions on the acquiror or the business to be acquired, which may not be acceptable or, if acceptable, may reduce the benefit of a proposed acquisition.

Control Acquisitions .

Subject to various exceptions, the BHCA and the Change in Bank Control Act, together with related regulations, require Federal Reserve approval or non-objection prior to any person or company (or group acting in concert) acquiring “control” of a bank holding company.

Although “control” is based on the facts and circumstances surrounding the investment, control is conclusively presumed to exist if a person or company (or group acting in concert) acquires 25% or more of any class of voting securities of the bank holding company.

Control of a bank holding company is rebuttably presumed to exist under the Change in Bank Control Act if the acquiring person or entity (or group acting in concert) will own 10% or more of any class of voting securities immediately following the transaction and either no other person will hold a greater percentage of that class of voting securities after the acquisition or the bank holding company has publicly registered securities.

The BHCA’s definition of “control” can also be triggered when a company acquires 5% or more of any class of voting securities and certain other factors are present or when a company acquires one-third or more of total equity (both voting and non-voting).

Regulatory Restrictions on Dividends;

Source of Strength .

As a bank holding company, we are subject to certain restrictions on dividends under applicable banking laws and regulations.

The Federal Reserve has issued a supervisory letter on the payment of cash dividends by bank holding companies, which expresses the Federal Reserve’s view that a bank holding company should pay cash dividends only to the extent that:

(1) the holding company’s net income for the past four quarters, net of any dividends previously paid during that period, is sufficient to fully fund the dividends;

(2) the prospective rate of earnings retention is consistent with the bank holding company’s capital needs, asset quality, and overall financial condition;

and (3) the bank holding company will continue to meet, and is not in danger of failing to meet, minimum regulatory capital adequacy ratios.

Failure to comply with the supervisory letter could result in a supervisory finding that the bank holding company is operating in an unsafe and unsound manner.

In the current financial and economic environment, the Federal Reserve has indicated that bank holding companies should carefully review their dividend policy and has discouraged payment ratios that are at maximum allowable levels unless both asset quality and capital are very strong.

The Federal Reserve may further restrict the payment of dividends by engaging in supervisory action to restrict dividends or by requiring us to maintain a higher level of capital than would otherwise be required under any applicable minimum capital requirements.

Our ability to pay dividends and make other distributions depends in part upon the receipt of dividends from the Bank, which is subject to certain restrictions on dividends as discussed in more detail below.

Under longstanding Federal Reserve policy, which has been codified by the Dodd-Frank Act, we are expected to act as a source of financial strength to, and to commit resources to support, the Bank.

This support may be required at times when we may not be inclined to provide it.

In addition, any capital loans that we make to the Bank are subordinate in right of payment to deposits and to certain other indebtedness of the Bank.

As discussed above, in certain circumstances, we could also be required to guarantee the capital restoration plan of the Bank, if the Bank became undercapitalized for purposes of the FDIC’s prompt corrective action regulations.

In the event of our bankruptcy, any commitment by us to a federal bank regulatory agency to maintain the capital of the Bank under a capital restoration plan would be assumed by the bankruptcy trustee and entitled to a priority of payment.

Scope of Permissible Activities .

In general, the BHCA limits the activities permissible for bank holding companies to the business of banking, managing, or controlling banks, and such other activities as the Federal Reserve has determined to be so closely related to banking as to be properly incidental thereto.

Permissible activities for a bank holding company include, among others, operating a mortgage, finance, credit card, or factoring company;

performing certain data processing operations;

providing investment and financial advice;

acting as an insurance agent for certain types of insurance;

leasing personal property on a full-payout, nonoperating basis;

and providing certain stock brokerage services.

A bank holding company may also make an investment of up to 5% of any class of voting securities of any company that is otherwise a non-controlling investment.

The Company has elected status as a financial holding company.

As such, it may engage in activities that are financial in nature or incidental to such financial activity, or complementary to a financial activity and which do not pose a substantial risk to the safety and soundness of the Bank or to the financial system generally.

These activities include securities dealing, underwriting and market making, insurance underwriting and agency activities, merchant banking, and insurance company portfolio investments.

Expanded financial activities of financial holding companies generally are regulated according to the type of such financial activity:

banking activities by banking regulators, securities activities by securities regulators, and insurance activities by insurance regulators.

A bank holding company, such as the Company may elect to be treated as a financial holding company if all of its depository institution subsidiaries are “well-capitalized” and “well-managed,” and have received a rating of not less than “Satisfactory” on their most recent examination under the CRA.

Volcker Rule .

Section 13 of the BHCA, commonly known as the “Volcker Rule,” has generally prohibited insured depository institutions and their affiliates from sponsoring or acquiring an ownership interest in certain investment funds, including hedge funds and private equity funds.

The Volcker Rule also places restrictions on proprietary trading.

The Economic Growth Act exempts from the Volcker Rule insured depository institutions with $10 billion or less in total consolidated assets and whose total trading assets and trading liabilities are 5% or less of total consolidated assets.

The Federal Reserve has effectively extended the exemption to bank holding companies with $10 billion or less in total consolidated assets.

Since we meet the criteria listed above, we are exempt from the Volcker Rule.

Safe and Sound Banking Practices .

Bank holding companies are not permitted to engage in unsafe and unsound banking practices.

For example, the Federal Reserve’s Regulation Y generally requires a bank holding company to provide the Federal Reserve with prior notice of any redemption or repurchase of its own equity securities, if the consideration to be paid, together with the consideration paid for any repurchases or redemptions in the preceding year, is equal to 10% or more of the bank holding company’s consolidated net worth.

The Federal Reserve may oppose the transaction if it believes that the transaction would constitute an unsafe or unsound practice or would violate any law or regulation.

In certain circumstances, the Federal Reserve could take the position that paying a dividend would constitute an unsafe or unsound banking practice.

The Federal Reserve has broad authority to prohibit activities of bank holding companies and their nonbanking subsidiaries that represent unsafe and unsound banking practices, result in breaches of fiduciary duty, or which constitute violations of laws or regulations, and can assess civil money penalties or impose enforcement actions for such activities.

Bank Regulation .

The Bank is a commercial bank chartered under the laws of the Commonwealth of Virginia and is a member of the Federal Reserve.

As such, the Bank is subject to extensive regulation, supervision, and examination by the Bureau and the Federal Reserve.

In addition, the Bank’s deposits are insured to the maximum extent permitted by law by the FDIC.

The bank regulatory agencies have the power to enforce compliance with applicable banking laws and regulations.

These requirements and restrictions include requirements to maintain reserves against deposits, restrictions on the nature and amount of loans that may be made and the interest that may be charged thereon, and restrictions relating to investments and other activities of the Bank.

Capital Adequacy Requirements .

The Federal Reserve and the Bureau monitor the capital adequacy of the Bank by using a combination of risk-based guidelines and leverage ratios.

These agencies consider the Bank’s capital levels when taking action on various types of applications and when conducting supervisory activities related to the safety and soundness of the Bank and the banking system.

Under the Basel III capital rules, an institution’s assets and off-balance sheet items, such as letters of credit and unfunded loan commitments, are assigned to broad risk categories, each with appropriate risk weights.

Regulatory capital, in turn, is classified in one of two tiers.

“Tier 1” capital includes two components:

common equity Tier 1 capital and additional Tier 1 capital.

Common equity Tier 1 capital consists solely of common stock (plus related surplus), retained earnings and limited amounts of minority interests that are in the form of common stock.

Additional Tier 1 capital includes other perpetual instruments historically included in Tier 1 capital, such as non-cumulative perpetual preferred stock.

“Tier 2” capital includes, among other things, qualifying subordinated debt and allowances for credit losses, subject to limitations.

The resulting capital ratios represent capital as a percentage of total risk-weighted assets and off-balance sheet items.

Pursuant to the regulatory capital rules, the Bank has made an election not to include unrealized gains and losses in the investment securities portfolio for purposes of calculating “Tier 1” capital and “Tier 2” capital.

Under the current Basel III regulatory framework, the Bank is required to maintain the following minimum regulatory capital ratios:

A ratio of common equity Tier 1 capital to total risk-weighted assets of at least 4.5%;

A ratio of Tier 1 capital to total risk-weighted assets of at least 6%;

A ratio of Tier 1 capital plus Tier 2 capital to total risk-weighted assets of at least 8%;

A leverage ratio (Tier 1 capital to adjusted total assets) of at least 4%.

In addition to these minimum regulatory capital ratios, the Basel III regulations establish a capital conservation buffer (“CCB”) with respect to the first three capital ratios listed above.

Specifically, banks must hold common equity Tier 1 capital in excess of their minimum risk-based capital ratios by at least 2.5% of risk-weighted assets in order to avoid limits on capital distributions (including dividend payments, discretionary payments on Tier 1 instruments, and stock buybacks) and certain discretionary bonus payments to executive officers.

Thus, when including the 2.5% CCB, a bank’s minimum ratio of common equity Tier 1 capital to total risk-weighted assets increases to 7%, its minimum ratio of Tier 1 capital to total risk-weighted assets increases to 8.5%, and its minimum ratio of total capital to total risk-weighted assets increases to 10.5%.

These capital requirements are minimum requirements.

The Federal Reserve and the Bureau may also set higher capital requirements if warranted by the Bank’s risk profile, economic conditions impacting its markets, or other circumstances particular to the Bank.

For example, Federal Reserve guidance provides that higher capital may be required to take adequate account of, among other things, interest rate risk and the risks posed by concentrations of credit, nontraditional activities, or securities trading activities.

In addition, the Federal Reserve’s prompt corrective action regulations discussed below also apply to the Bank.

Failure to meet capital guidelines could subject the Bank to a variety of enforcement remedies, including issuance of a capital directive, restrictions on business activities, and other measures under the Federal Reserve’s prompt corrective action regulations.

As part of the directive under the Economic Growth Act, in September 2019, the Federal Reserve and other federal bank regulatory agencies approved the CBLR framework.

This optional framework became effective January 1, 2020, and is available to the Bank as an alternative to the Basel III risk-based capital framework.

The CBLR framework provides a simple measure of capital adequacy for certain community banking organizations.

Specifically, depository institutions and depository institution holding companies that have less than $10 billion in total consolidated assets and meet other qualifying criteria, including a Tier I leverage ratio of greater than 9%, are considered qualifying community banking organizations eligible to opt into the CBLR framework and replace the applicable Basel III risk-based capital requirements.

As of December 31, 2024, the Bank qualified for the CBLR framework.

Management does not intend to utilize the CBLR framework.

Corrective Measures for Capital Deficiencies .

The federal banking regulators are required by the Federal Deposit Insurance Act, as amended (“FDIA”), to take “prompt corrective action” with respect to capital-deficient banks that are FDIC-insured.

For this purpose, a bank is placed in one of the following five capital tiers:

“well-capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” A bank’s capital tier depends upon how its capital levels compare with various relevant capital measures and certain other regulatory factors.

To be well-capitalized, a bank must have a total risk-based capital ratio of at least 10%, a Tier I risk-based capital ratio of at least 8%, a common equity Tier I risk-based capital ratio of at least 6.5%, and a leverage ratio of at least 5%, and must not be subject to any written agreement, order, or directive requiring it to maintain a specific capital level for any capital measure.

As of December 31, 2024, the Bank was in compliance with all regulatory capital standards and qualified as “well-capitalized” under the prompt corrective action regulations.

See Note 16 of Notes to Consolidated Financial Statements.

Transactions with Related Parties .

The Bank is subject to the Federal Reserve’s Regulation W, which comprehensively implements the restrictions of Sections 23A and 23B of the Federal Reserve Act on transactions between a bank and its “affiliates.” The sole “affiliate” of the Bank, as defined in Regulation W, is the Company.

Section 23A and the implementing provisions of Regulation W generally place limits on the amount of a bank’s loans or extensions of credit to, investments in, or certain other transactions with its affiliates, and on the amount of advances to third parties collateralized by the securities or obligations of affiliates.

Section 23B and Regulation W generally require a bank’s transactions with affiliates to be on terms substantially the same, or at least as favorable to the bank, as those prevailing at the time for comparable transactions with non-affiliated companies.

The Bank is also subject to certain restrictions on extensions of credit to executive officers, directors, certain principal shareholders and their related interests.

Such extensions of credit must be made on substantially the same terms, including interest rates and collateral, as those prevailing at the time for comparable transactions with third parties and must not involve more than the normal risk of repayment or present other unfavorable features.

Community Reinvestment Act and Fair Lending Laws .

All insured depository institutions have a responsibility under the Community Reinvestment Act of 1977 (the “CRA”) and federal regulations thereunder to help meet the credit needs of their communities, including low- and moderate-income neighborhoods.

In connection with its examination of a state-chartered Federal Reserve member bank like the Bank, the Federal Reserve is required to assess our record of meeting the credit needs of our entire community.

The CRA requires the Bank’s record of compliance with the CRA to be taken into account in the evaluation of applications by the Bank or the Company for approval of an expansionary proposal, such as a merger or other acquisition of another bank or the opening of a new branch office.

The Bank received an “ Outstanding ” CRA rating in its most recent assessment received on August 22, 2022 by the Federal Reserve.

In October 2023, the Federal Reserve, the Office of the Comptroller of the Currency, and the FDIC issued a final rule to strengthen and modernize the CRA regulations.

Under the final rule a bank with assets of at least $600 million as of December 31 in both the prior two calendar years and less than $2 billion as of December 31 in either of the prior two calendar years will be an “intermediate bank,” and a bank with assets of at least $2 billion as of December 31 in both of the prior two calendar years will be a “large bank.” The agencies will evaluate large banks under four performance tests:

the Retail Lending Test, the Retail Services and Products Test, the Community Development Financing Test, and the Community Development Services Test.

The agencies will evaluate intermediate banks under the Retail Lending Test and either the current community development test, referred to in the final rule as the Intermediate Bank Community Development Test, or, at the bank’s option, the Community Development Financing Test.

The applicability date for the majority of the provisions in the CRA regulations is January 1, 2026, and additional requirements will be applicable on January 1, 2027.

Those regulations are not currently effective, and management has not determined the impact of the new regulations on the Bank.

In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibit lenders from discriminating in their lending practices on the basis of characteristics specified in those statutes.

A failure to comply with the Equal Credit Opportunity Act or the Fair Housing Act could result in enforcement actions by a bank’s principal federal regulatory agency, as well as by other federal regulatory agencies or the Department of Justice.

Other Consumer Protection Laws .

The Bank’s lending and deposit-taking operations are subject to numerous other federal and state laws designed to protect consumers.

The Consumer Financial Protection Bureau (“CFPB”) issues regulations and standards under the federal consumer protection laws, which include, among others, the Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, the Truth in Lending Act, the Electronic Fund Transfer Act, the Truth in Savings Act, the Fair Credit Reporting Act, and the Dodd-Frank Act’s prohibition on unfair, deceptive or abusive acts or practices.

The Bank’s consumer financial products and services are subject to examination by the Federal Reserve for compliance with these and other CFPB regulations and standards.

In addition, customer privacy statutes and regulations limit the ability of the Bank to disclose nonpublic consumer information to non-affiliated third parties.

These laws require us to provide notice to our customers regarding privacy policies and practices and to give our customers an option to prevent their non-public personal information from being shared with non-affiliated third parties or with our affiliates.

Cybersecurity.

The federal bank regulatory agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a banking organization’s board of directors.

This guidance, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services.

The federal bank regulatory agencies expect financial institutions to establish appropriate security controls and to ensure that their risk management processes address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption and maintenance of the institution’s operations after a cyberattack.

If we fail to meet the expectations set forth in such regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.

In November 2021, the federal bank regulatory agencies issued a final rule to improve the sharing of information about cyber incidents that may affect the U.S.

banking system.

The rule, which became effective on May 1, 2022, requires a banking organization to notify its primary federal regulator within 36 hours of determining that a “computer-security incident” has materially affected – or is reasonably likely to materially affect – the viability of the banking organization’s operations, its ability to deliver banking products and services, or the stability of the financial sector.

In addition, the rule requires a bank service provider to notify affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has materially affected or is reasonably likely to materially affect banking organization customers for four or more hours.

To date, neither the Company nor the Bank has experienced a significant compromise, significant data loss, or material financial losses related to cybersecurity attacks, but its systems and those of its customers and third-party service providers are under constant threat, and it is possible that the Company or the Bank could experience a significant event in the future.

Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expending use of Internet banking, mobile banking, and other technology-based products and services by the Company and the Bank and their customers.

Bank Secrecy Act / Anti-Money Laundering Laws .

The Bank is subject to the Bank Secrecy Act and other anti-money laundering laws and regulations, including the USA PATRIOT Act of 2001 and the Anti-Money Laundering Act of 2020.

These laws and regulations require the Bank to implement policies, procedures, and controls to detect, prevent, and report money laundering and terrorist financing and to verify the identity of their customers.

Violations of these requirements can result in substantial civil and criminal sanctions.

In addition, provisions of the USA PATRIOT Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution's anti-money laundering activities when reviewing mergers and acquisitions.

Loans and Investments .

State commercial banks have authority to originate and purchase any type of loan, including commercial, commercial real estate, residential mortgage or consumer loans.

Aggregate loans by a state commercial bank to any single borrower or group of related borrowers are generally limited to 15% of the Bank’s capital stock, surplus and loan loss reserve.

Federal and state laws and regulations limit the Bank’s investment authority.

Generally, a state member bank is prohibited from investing in corporate equity securities for its own account other than the equity securities of companies through which the bank conducts its business.

Under federal and state regulations, a state member bank may invest in investment securities for its own account up to specified limits depending upon the type of security.

“Investment securities” are generally defined as marketable obligations that are rated investment grade and not predominantly speculative in nature.

Commercial Real Estate Lending Concentrations .

The federal banking agencies have issued guidance on sound risk management practices for concentrations in commercial real estate lending.

The particular focus is on exposure to commercial real estate loans that are dependent on the cash flow from the real estate held as collateral and that are likely to be sensitive to conditions in the commercial real estate market (as opposed to real estate collateral held as a secondary source of repayment or as an abundance of caution).

The purpose of the guidance is not to limit a bank’s commercial real estate lending but to guide banks in developing risk management practices and capital levels commensurate with the level and nature of real estate concentrations.

The guidance directs the federal banking agencies to focus their supervisory resources on institutions that may have significant commercial real estate loan concentration risk.

A bank that has experienced rapid growth in commercial real estate lending, has notable exposure to a specific type of commercial real estate loan, or is approaching or exceeding the following supervisory criteria may be identified for further supervisory analysis with respect to real estate concentration risk:

Total reported loans for construction, land development and other land represent 100% or more of the bank’s total regulatory capital;

Total commercial real estate loans (as defined in the guidance) represent 300% or more of the bank’s total regulatory capital and the outstanding balance of the bank’s commercial real estate loan portfolio has increased 50% or more during the prior 36 months.

The guidance provides that the strength of an institution’s lending and risk management practices with respect to such concentrations will be taken into account in supervisory guidance on evaluation of capital adequacy.

Regulation of the Company .

The Company is a bank holding company under the Bank Holding Company Act that has elected status as a financial holding company.

As such, we are subject to regulation, supervision, and examination by the Federal Reserve.

We are required to file quarterly reports with the Federal Reserve and provide such additional information as the Federal Reserve may require.

The Federal Reserve has extensive enforcement authority over bank holding companies, including, among other things, the ability to assess civil money penalties, to issue cease and desist or removal orders and to require that a holding company divest subsidiaries (including its bank subsidiaries).

In general, enforcement actions may be initiated for violations of law and regulations and unsafe or unsound practices.

We are also required to file certain reports with, and otherwise comply with the rules and regulations of, the SEC.

Regulatory Capital Requirements .

The federal regulatory capital rules apply to all depository institutions as well as to bank holding companies with consolidated assets of $3 billion or more.

However, the regulatory capital requirements generally do not apply on a consolidated basis to a bank holding company with total consolidated assets of less than $3 billion unless the holding company:

(1) is engaged in significant nonbanking activities either directly or through a nonbank subsidiary;

(2) conducts significant off-balance sheet activities (including securitization and asset management or administration) either directly or through a nonbank subsidiary;

or (3) has a material amount of debt or equity securities outstanding (other than trust preferred securities) that are registered with the SEC.

The Federal Reserve may apply the regulatory capital standards at its discretion to any bank holding company, regardless of asset size, if such action is warranted for supervisory purposes.

Because the Company has total consolidated assets of less than $3 billion and does not engage in activities that would trigger application of the federal regulatory capital rules, it is not at present subject to consolidated capital requirements under such rules.

Acquisitions .

Under the Bank Holding Company Act, we are required to obtain the prior approval of the Federal Reserve to acquire ownership or control of more than 5% of the voting shares or substantially all of the assets of any bank holding company or bank or merge or consolidate with another bank holding company.

Federal law authorizes bank holding companies to make interstate acquisitions of banks without geographic limitation.

Permissible Activities .

In general, the Bank Holding Company Act limits the activities of a bank holding company to those of banking, managing or controlling banks, or any other activity that the Federal Reserve has determined to be so closely related to banking or to managing or controlling banks that an exception is allowed for those activities.

A bank holding company that qualifies and elects to be treated as a “financial holding company” may engage in a broad range of additional activities that are (i) financial in nature or incidental to such financial activities or (ii) complementary to a financial activity and do not pose a substantial risk to the safety and soundness of depository institutions or the financial system generally.

These activities include securities underwriting and dealing, insurance agency and underwriting, and making merchant banking investments.

On October 12, 2021, the Company filed an election to be treated as a financial holding company.

To maintain financial holding company status, a financial holding company and all of its depository institution subsidiaries must be “well capitalized” and “well managed” as defined under applicable Federal Reserve requirements.

If a financial holding company ceases to meet these capital and management requirements, the Federal Reserve’s regulations provide that the financial holding company must enter into an agreement with the Federal Reserve to comply with all applicable capital and management requirements.

Until the financial holding company returns to compliance, the Federal Reserve may impose limitations or conditions on the conduct of its activities, and the company may not commence any of the broader financial activities permissible for financial holding companies or acquire a company engaged in such financial activities without prior approval of the Federal Reserve.

If the company does not return to compliance within 180 days, the Federal Reserve may require the financial holding company to divest its depository institution subsidiaries or to cease engaging in any activity that is financial in nature (or incident to such financial activity) or complementary to a financial activity.

In order for a financial holding company to commence any new activity permitted by the Bank Holding Company Act or to acquire a company engaged in any new activity permitted by the Bank Holding Company Act, each insured depository institution subsidiary of the financial holding company must have received a rating of at least “satisfactory” in its most recent examination under the CRA.

See “Regulation of the Bank-Community Reinvestment Act and Fair Lending Laws.”

Despite prior approval, the Federal Reserve may order a bank holding company or its subsidiaries to terminate any activity or to terminate ownership or control of any subsidiary when the Federal Reserve has reasonable cause to believe that a serious risk to the financial safety, soundness, or stability of any bank subsidiary of that bank holding company may result from such an activity.

Incentive Compensation.

Federal banking agencies have issued guidance on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking.

The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

In accordance with federal statute, the federal banking agencies prohibit incentive-based compensation arrangements that encourage inappropriate risk taking by covered financial institutions (generally institutions that have over $1 billion in assets) and are deemed to be excessive, or that may lead to material losses.

The Federal Reserve reviews, as part of its standard, risk-focused examination process, the incentive compensation arrangements of banking organizations (such as the Company) that are not “large, complex banking organizations.” These reviews are tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements.

The findings of the supervisory initiatives will be included in reports of examination.

Deficiencies are incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions.

Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

Banks that are adequately capitalized, but not well-capitalized, may not accept, renew, or rollover brokered deposits without a waiver from the FDIC and are subject to restrictions on the interest rates that can be paid on deposits.

The prompt corrective action regulations also generally prohibit a bank from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the bank would thereafter be undercapitalized.

Undercapitalized banks are also subject to growth limitations, may not accept, renew, or rollover brokered deposits, and are required to submit a capital restoration plan.

The Federal Reserve may not accept such a plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the bank’s capital.

Significantly undercapitalized banks may be subject to requirements and restrictions, including orders to sell sufficient shares or obligations to become adequately capitalized, limitations on asset growth, and cessation of receipt of deposits from correspondent banks.

Generally, subject to a narrow exception, the Federal Reserve must appoint a receiver or conservator for an institution that is critically undercapitalized.

The capital classification of a bank also affects the bank’s ability to engage in certain activities and the deposit insurance premiums paid by the bank.

Bank Mergers .

Section 18(c) of the FDIA, known as the “Bank Merger Act,” requires the written approval of a bank’s primary federal regulator before the bank may acquire through merger or consolidation, purchase or otherwise acquire the assets of, or assume the deposit liabilities of, another bank.

The Bank Merger Act prohibits the reviewing agency from approving any proposed merger transaction that would result in certain significant anti-competitive effects.

In every proposed merger transaction, the reviewing agency must also consider the financial and managerial resources and prospects of the existing and proposed institutions, the convenience and needs of the community to be served, the bank’s CRA performance, and the effectiveness of each insured depository institution involved in the proposed merger transaction in combating money-laundering activities.

In addition to Federal Reserve approval, the Bank must also obtain the prior approval of the Bureau before acquiring or merging with another bank.

The Bureau will consider similar criteria when reviewing an application.

Under Virginia law, the Bank is permitted to establish additional branch offices within Virginia, subject to the approval of the Bureau.

As a result of the Dodd-Frank Act, the Bank may also establish additional branch offices outside of Virginia, subject to prior regulatory approval, provided that the laws of the state where the branch is to be located would permit a state bank chartered in that state to establish a branch.

Any new branch, whether located inside or outside of Virginia, must also be approved by the Federal Reserve, as the Bank’s primary federal regulator.

The Bank may also establish offices in other states by merging with banks or by purchasing branches of banks in other states, subject to certain restrictions (including obtaining the prior approval of the Bureau and Federal Reserve).

Restrictions on Transactions with Affiliates and Insiders .

Federal law strictly limits the ability of banks to engage in transactions with their affiliates, including their parent bank holding companies.

Sections 23A and 23B of the Federal Reserve Act, and the Federal Reserve’s Regulation W, impose quantitative limits, qualitative standards, and collateral requirements on certain transactions by a bank with, or for the benefit of, its affiliates.

Generally, Sections 23A and 23B limit the extent to which the bank or its subsidiaries may engage in “covered transactions” with any one affiliate to an amount equal to 10% of such bank’s capital stock and surplus, and limit the aggregate of all such transactions with all affiliates to an amount equal to 20% of such capital stock and surplus, and require that all such transactions be on terms substantially the same, or at least as favorable, to the bank or subsidiary as those that would be provided to a non-affiliate.

The term “covered transaction” includes the making of loans to the affiliate, purchase of assets from the affiliate, issuance of a guarantee on behalf of the affiliate, and several other types of transactions.

The Dodd-Frank Act expanded the coverage and scope of the limitations on affiliate transactions within a banking organization, including an expansion of what types of transactions are covered transactions to include credit exposures related to derivatives, repurchase agreements, and securities lending arrangements, and an increase in the amount of time for which collateral requirements regarding covered transactions must be satisfied.

Federal law also limits a bank’s authority to extend credit to its directors, executive officers, and 10% or greater shareholders, as well as to entities controlled by such persons.

Among other things, extensions of credit to insiders are required to be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with unaffiliated persons.

Also, the terms of such extensions of credit may not involve more than the normal risk of repayment or present other unfavorable features and may not exceed certain limitations on the amount of credit extended to such persons, individually and in the aggregate, which limits are based, in part, on the amount of the bank’s capital.

Insiders, as well as the bank, may be subject to enforcement actions, including civil money penalties, for loans in violation of applicable restrictions.

Regulatory Restrictions on Bank Dividends .

The Bank is subject to certain restrictions on dividends under federal and state laws, regulations, and policies.

The board of directors of a Virginia state bank may not declare a dividend in excess of the net undivided profits of the bank without regulatory approval.

The Virginia State Corporation Commission may limit or approve payment of dividends by the directors of any bank if it determines that such action is warranted by the bank’s financial condition.

Prior Federal Reserve approval is required if cash dividends declared by a bank exceed its net income for the current calendar year, plus retained net income from the two preceding years.

In addition, under federal law, the Bank may not pay any dividend to the Company if it is undercapitalized, or the payment of the dividend would cause it to become undercapitalized.

The Federal Reserve and the Bureau may further restrict the payment of dividends by engaging in supervisory action to restrict dividends or by requiring the Bank to maintain a higher level of capital than would otherwise be required to be adequately capitalized for regulatory purposes.

Under the Basel III regulatory capital framework, the failure to maintain an adequate CCB, as discussed above, may also result in dividend restrictions.

Moreover, if, in the opinion of the Federal Reserve and the Bureau, the Bank is engaged in an unsafe or unsound practice (which could include the payment of dividends), they may require, generally after notice and hearing, the Bank to cease such practice.

The Federal Reserve has indicated that paying dividends that deplete a depository institution’s capital base to an inadequate level would be an unsafe banking practice.

Incentive Compensation Guidance .

In 2016, the federal banking agencies issued comprehensive guidance on incentive compensation policies intended to ensure that such policies of banking organizations do not undermine the safety and soundness of those organizations by encouraging excessive risk-taking.

The incentive compensation guidance sets expectations for banking organizations concerning their incentive compensation arrangements and related risk-management, control, and governance processes.

The incentive compensation guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon three primary principles:

balanced risk-taking incentives, compatibility with effective controls and risk management, and strong corporate governance.

Any deficiencies in compensation practices that are identified may be incorporated into the organization’s supervisory ratings, which can affect its ability to make acquisitions or take other actions.

In addition, under the incentive compensation guidance, a banking organization’s primary federal regulator may initiate enforcement action if the organization’s incentive compensation arrangements pose a risk to the safety and soundness of the organization.

Further, the CCB described above would limit discretionary bonus payments to bank executives if the institution’s regulatory capital ratios fail to exceed certain thresholds.

The scope and content of the U.S.

banking regulators’ policies on executive compensation is likely to continue to evolve.

It cannot be determined at this time whether compliance with such policies will adversely affect the Company’s ability to hire, retain and motivate its key employees.

In 2022, the SEC adopted a final rule directing national securities exchanges, including Nasdaq, to establish listing standards requiring listed companies to adopt policies providing for the recovery or “clawback” of excess incentive-based compensation earned by current or former executive officers during the three fiscal years preceding the date the listed company determines an accounting restatement is required.

In June 2023, the SEC approved new listing standards for public companies, such as the Company, listed on Nasdaq.

The new standards took effect on October 2, 2023, and require listed companies to adopt written clawback policies by December 1, 2023.

On November 15, 2023, the Board of Directors of the Company adopted a Policy for Recovery of Erroneously Awarded Compensation (“Clawback Policy”), effective as of October 2, 2023.

The Clawback Policy would be triggered by both “Big R” and “little r” restatements and apply to any incentive-based compensation that is granted, earned or vested based wholly or in part upon the attainment of a financial reporting measure.

The Clawback Policy is filed as Exhibit 97.1 to this Annual Report on Form 10-K and is incorporated herein by reference.

Source of Strength .

Under the Bank Holding Company Act, a bank holding company is required to act as a source of financial and managerial strength to each of its subsidiary banks and to commit resources to support each subsidiary bank.

Under this source of strength doctrine, the Federal Reserve may require a bank holding company to make capital injections into a troubled subsidiary bank.

The Federal Reserve may charge the bank holding company with engaging in unsafe and unsound practices if it fails to commit resources to such a subsidiary bank or if it undertakes actions that the Federal Reserve believes might jeopardize its ability to commit resources to such subsidiary bank.

A capital injection may be required at times when the holding company does not have the resources to provide it.

In addition, any loans by a holding company to a subsidiary bank are subordinate in right of payment to deposits and to certain other indebtedness of such subsidiary bank.

In the event of a bank holding company’s bankruptcy, the bankruptcy trustee will assume any commitment by the holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank.

Moreover, the bankruptcy law provides that claims based on any such commitment will be entitled to a priority of payment over the claims of the institution’s general unsecured creditors, including the holders of its note obligations.

Dividends, Capital Distributions and Other Payments .

There are various legal limitations applicable to the payment of dividends by the Bank to the Company, to the payment of dividends on capital stock and other distributions by the Company, and to the repurchase by the Company of its outstanding shares of capital stock.

The Federal Reserve has issued guidance indicating that bank holding companies should generally pay dividends only if the company’s net income available to common shareholders over the past year has been sufficient to fully fund the dividends, and the prospective rate of earnings retention appears consistent with the company’s capital needs, asset quality and overall financial condition.

The Federal Reserve’s guidance also states that a bank holding company should inform and consult with its regional Federal Reserve Bank in advance of declaring or paying a dividend that exceeds earnings for the period for which the dividend is being paid or that could result in a material adverse change to the organization’s capital structure.

In addition, under Virginia law, the Company generally may not pay dividends or distributions to holders of common stock if it would be unable to pay its debts as they become due in the ordinary course of business or if its total assets would be less than the sum of its total liabilities plus the amount of the liquidation preference of any class of shares with superior rights than common stock.

As the majority of the Company’s revenues result from dividends paid to the Company by the Bank, the Company’s ability to pay dividends to our shareholders largely depends on the receipt of such dividends from the Bank.

The Bank is subject to various laws and regulations limiting the amount of dividends that it can pay.

Under Virginia law, without the permission of the Virginia State Corporation Commission, a state bank may not pay dividends, except from retained earnings.

Under federal law applicable to state-chartered Federal Reserve member banks, a bank may not declare or pay a dividend without prior Federal Reserve approval if the total of all dividends declared during the calendar year, including the proposed dividend, exceeds the sum of the bank’s net income during the current calendar year and the retained net income of the prior two calendar years.

Bank regulatory agencies have the authority to prohibit the Bank or the Company from engaging in an unsafe or unsound practice in the conduct of their respective business.

The payment of dividends, other capital distributions, or the repurchase of capital stock, depending on the financial condition of the Bank and/or the Company, could be deemed an unsafe or unsound practice.

No insured depository institution may pay a dividend if, after paying the dividend, the institution would be undercapitalized.

In addition, as noted above, if the Bank does not maintain the capital conservation buffer required by applicable regulatory capital rules, its ability to pay dividends to the Company will be limited.

Future Regulation .

From time to time, various legislative and regulatory initiatives are introduced in Congress and state legislatures, as well as by federal and state regulatory agencies.

Such initiatives may include proposals to expand or contract the powers of bank holding companies and financial institutions or proposals to substantially change the regulatory system.

Such initiatives could change banking statutes and our operating environment.

If enacted or adopted, such initiatives could increase or decrease our cost of conducting business, limit or expand our permissible activities, or affect our competitive position.

We cannot predict whether any such initiatives will be approved, and, if approved, the effect that they could have on our financial condition or results of operations.

Government Monetary Policies .

Our results of operations are influenced by the monetary policies of regulatory authorities.

Actions by the Federal Reserve impact market and general economic conditions.

Federal Reserve policies can significantly affect market interest rates charged on loans or paid for deposits, as well as employment and inflation rates and investments.

Federal Reserve monetary policies have had, and can be expected to continue to have, significant effects on financial institution results of operations.

banking regulators’ policies on executive compensation are continuing to develop and evolve.

In May 2024, four federal financial agencies re-proposed the regulatory text from the 2016 proposal without change, while seeking public comment on alternative approaches to certain regulatory provisions.

The Dodd-Frank Act requires incentive compensation rules to be issued jointly by six federal agencies.

The original proposal is still pending.

Deposit Insurance Assessments .

FDIC-insured banks are required to pay deposit insurance assessments to the FDIC.

The amount of the assessment is based on the size of the bank’s assessment base, which is equal to its average consolidated total assets less its average tangible equity, and its risk classification under an FDIC risk-based assessment system.

Institutions assigned to higher risk classifications (that is, institutions that pose a higher risk of loss to the Deposit Insurance Fund) pay assessments at higher rates than institutions that pose a lower risk.

An institution’s risk classification is assigned based on its capital levels and the level of supervisory concern that the institution poses to the regulators.

At least semi-annually, the FDIC updates its loss and income projections for the Deposit Insurance Fund and, if needed, increases or decreases assessment rates, following notice-and-comment rulemaking, if required.

The FDIC issued a final rule in October 2022 increasing deposit insurance assessments on all financial institutions beginning in the first quarterly assessment period of 2023.

The FDIC can also impose special assessments in certain instances.

For example, the Bank may be required to pay higher FDIC insurance premiums if there are bank or financial institution failures or if the FDIC otherwise determines to increase assessment rates in order to replenish the Deposit Insurance Fund.

Concentrated Commercial Real Estate ( “ CRE ” ) Lending Regulations .

The federal banking regulatory agencies have promulgated guidance governing financial institutions with concentrations in CRE lending.

The guidance provides that a bank may have a concentration in CRE lending if total reported loans for construction, land development, and other land represent 100% or more of total risk-based capital, or total non-owner occupied CRE loans, excluding owner occupied properties, represent 300% or more of the bank’s total risk-based capital and the outstanding balance of the bank’s CRE loan portfolio has increased 50% or more during the prior 36 months.

If a concentration is present, the bank will be subject to further regulatory scrutiny with respect to its risk management practices for CRE lending.

As of December 31, 2024, the Bank’s total reported loans for construction, land development, and other land represented more than 100% of the Bank’s total risk-based capital, and its total CRE loans, excluding owner occupied properties, represented more than 300% of the Bank’s total risk-based capital.

As a result, the Bank has a concentration in CRE lending.

For information regarding underwriting analysis, risk rating and stress testing of our loan portfolio, including our CRE loans, see Item 7.

“Management’s Discussion and Analysis of Financial Condition and Results of Operations”.

Community Reinvestment Act .

The Community Reinvestment Act of 1977, as amended (“CRA”), and the related regulations are intended to encourage banks to help meet the credit needs of their entire assessment area, including low and moderate income neighborhoods, consistent with the safe and sound operations of such banks.

These regulations also provide for regulatory assessment of a bank’s CRA performance record when considering applications to establish branches, merger applications, and applications to acquire the assets and assume the liabilities of another bank.

The CRA requires federal banking agencies to make public their ratings of banks’ performance under the CRA.

In the case of a bank holding company transaction, the CRA performance record of the subsidiary banks of the bank holding companies involved in the transaction are reviewed in connection with the filing of an application to acquire ownership or control of shares or assets of a bank or to merge with any other bank holding company.

An unsatisfactory CRA record could substantially delay approval or result in denial of an application.

The Bank received an “Outstanding” rating in its most recent CRA examination in 2022.

On October 24, 2023, the federal banking agencies adopted a final rule to modernize the CRA regulations.

Under the final rule, the federal banking agencies will evaluate bank performance across the varied activities they conduct and communities in which they operate in order to encourage banks to expand access to credit, investment, and banking services in low- and moderate-income communities, the CRA regulations are updated to evaluate lending outside traditional assessment areas generated by the growth of non-branch delivery systems, such as online and mobile banking, branchless banking, and hybrid models, a new metrics-based approach was adopted to evaluate bank retail lending and community development financing, using benchmarks based on peer and demographic data, and CRA evaluations and data collection are tailored according to bank size and type.

In addition, the final rule also exempts small and intermediate sized banks from new data requirements that apply to banks with assets of at least $2 billion and limits certain new data requirements to large banks with assets greater than $10 billion.

Asset size is determined based on assets being at or above the specified thresholds as of December 31 in both of the prior two calendar years and are indexed for inflation.

Most of the rule's requirements will be applicable beginning January 1, 2026.

The remaining requirements, including the data reporting requirements, will be applicable on January 1, 2027.

We continue to evaluate the new rule and its effects on our operations going forward.

Consumer Laws and Regulations .

The Bank is subject to numerous laws and regulations intended to protect consumers in transactions with the Bank.

These laws include, among others, laws regarding unfair, deceptive, and abusive acts and practices, and other federal consumer protection statutes.

These federal laws include the Electronic Fund Transfer Act, the Equal Credit Opportunity Act, the Fair Housing Act, the Fair Credit Reporting Act, the Fair Debt Collection Practices Act, RESPA, the S.A.F.E.

Mortgage Licensing Act of 2008, TILA, and the Truth in Savings Act, among others.

Many states and local jurisdictions have consumer protection laws analogous, and in addition, to those enacted under federal law.

These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must deal with customers when taking deposits, making loans, and conducting other types of transactions.

Failure to comply with these laws and regulations could give rise to regulatory sanctions, customer rescission rights, action by state and local attorneys general, and civil or criminal liability.

There has been an enhanced focus by certain bank regulatory agencies with respect to industry practices relating to overdraft fees and non-sufficient funds fees.

For example, the CFPB issued a Request for Information in January 2022 seeking public input with respect to financial institution practices relating to, among other areas, credit card fees, overdraft fees and non-sufficient funds fees and stated its intent to reduce these types of fees through crafting rules, issuing industry guidance, and focusing supervision and enforcement resources to achieve this goal.

In August 2022, the FDIC issued guidance with respect to banking practices involving charging multiple non-sufficient funds fees on the representment of the same unpaid transaction on a deposit account.

In October 2022, the CFPB issued guidance with respect to certain practices relating to overdraft fees, and it included overdraft fees in its fall 2023 rulemaking agenda.

In March 2024, the CFPB finalized a rule imposing certain restrictions on credit card late fee practices.

This final rule is currently stayed pending litigation over the rule.

In December 2024, the CFPB issued a final rule generally requiring financial institutions with over $10 billion in assets to either cap overdraft fees at $5.00 or otherwise follow TILA requirements when providing deposit account overdraft services.

The Dodd-Frank Act created the CFPB, which has broad authority to regulate the offering and provision of consumer financial products.

The CFPB has authority to promulgate regulations;

issue orders, guidance, interpretations, and policy statements;

conduct examinations;

and bring enforcement actions regarding consumer financial products and services.

In general, banks with assets of $10 billion or less, such as the Bank, will continue to be examined for consumer compliance, and subject to enforcement actions, by their primary federal regulator.

However, the CFPB may participate in examinations of these smaller institutions on a “sampling basis” and may refer potential enforcement actions against such institutions to their primary federal regulators.

In addition, the Dodd-Frank Act permits states to adopt consumer protection laws and regulations that are stricter than those regulations promulgated by the CFPB, and state attorneys general are permitted to enforce certain consumer protection rules adopted by the CFPB against certain institutions.

As previously referenced in “Bank Holding Company Regulation – Financial Services Industry Reform”, the future of the CFPB is presently uncertain.

Mortgage Lending Rules .

The Dodd-Frank Act authorized the CFPB to establish certain minimum standards for the origination of residential mortgages, including a determination of the borrower’s ability to repay.

Under the Dodd-Frank Act, financial institutions may not make a residential mortgage loan unless they make a “reasonable and good faith determination” that the consumer has a “reasonable ability” to repay the loan.

The Dodd-Frank Act allows borrowers to raise certain defenses to foreclosure but provides a presumption or rebuttable presumption of compliance for loans that are “qualified mortgages.” The CFPB has also issued regulations that, among other things, specify the types of income and assets that may be considered in the ability-to-repay determination, the permissible sources for income verification, and the required methods of calculating the loan’s monthly payments.

These regulations extend the requirement that creditors verify and document a borrower’s income and assets to include a requirement to verify all information that creditors rely on in determining repayment ability.

The rules also define “qualified mortgages” based on adherence to certain underwriting standards and certain restrictions on loan terms.

Points and fees are subject to a relatively stringent cap, and the terms include a wide array of payments that may be made while closing a loan.

Certain loans, including interest-only loans and negative amortization loans, cannot be “qualified mortgages.” Also, the Dodd-Frank Act and the CFPB’s final rule on loan originator compensation prohibit certain compensation payments to loan originators and the steering of consumers to loans not in their interest, particularly if the loans will result in greater compensation for a loan originator.

The Dodd-Frank Act and the CFPB’s implementing regulations, including the TILA-RESPA integrated disclosure rules, also impose disclosure requirements with respect to the origination and sale of residential mortgages.

Anti-Money Laundering and OFAC .

Under federal law, financial institutions are required to maintain anti-money laundering programs that include established internal policies, procedures, and controls;

a designated compliance officer;

an ongoing employee training program;

testing of the program by an independent audit function;

and a customer due diligence program.

Financial institutions are also prohibited from entering into specified financial transactions and account relationships and must meet enhanced standards for due diligence and customer identification, especially in their dealings with foreign financial institutions and foreign customers.

Financial institutions must take reasonable steps to conduct enhanced scrutiny of account relationships to guard against money laundering and to report any suspicious transactions, and law enforcement authorities have been granted increased access to financial information maintained by financial institutions.

OFAC administers laws and Executive Orders that prohibit U.S.

entities from engaging in transactions with certain prohibited parties.

OFAC publishes lists of persons and organizations suspected of aiding, harboring, or engaging in terrorist acts, known as Specially Designated Nationals and Blocked Persons.

Generally, if a bank identifies a transaction, account, or wire transfer relating to a person or entity on an OFAC list, it must freeze the account or block the transaction, file a suspicious activity report, and notify the appropriate authorities.

Bank regulators routinely examine institutions for compliance with these obligations, and they must consider an institution’s compliance in connection with the regulatory review of applications, including applications for bank mergers and acquisitions.

Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing and comply with OFAC sanctions, or to comply with relevant laws and regulations, could have serious legal, reputational, and financial consequences for the institution.

Federal laws and regulations limit the ability of banks and other financial institutions to disclose non-public information about consumers to non-affiliated third parties.

These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a non-affiliated third party.

These regulations affect how consumer information is transmitted through financial services companies and conveyed to outside vendors.

In addition, consumers may also prevent disclosure of certain information among affiliated companies that is assembled or used to determine eligibility for a product or service, such as that shown on consumer credit reports and asset and income information from applications.

Consumers also have the option to direct banks and other financial institutions not to share information about transactions and experiences with affiliated companies for the purpose of marketing products or services.

In addition to applicable federal privacy regulations, the Bank is subject to certain state privacy laws.

Federal laws and regulations also include certain information security guidelines that require a bank, under the supervision and ongoing oversight of its board of directors or an appropriate committee of the board, to develop, implement, and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, to protect against anticipated threats or hazards to the security or integrity of such information, and to protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer.

Federal banking regulators regularly issue guidance regarding cybersecurity intended to enhance cybersecurity risk management.

A financial institution is expected to implement multiple lines of defense against cyber-attacks.

Under Federal guidance, banks are required to provide notice to affected customers of a data breach under certain circumstances, and the agencies recently adopted a rule requiring notice to the primary federal regulator within certain timeframes for certain data security incidents.

Enforcement Powers .

The bank regulatory agencies have broad enforcement powers, including the power to terminate deposit insurance and impose substantial fines and other civil and criminal penalties.

Failure to comply with applicable laws, regulations, and supervisory agreements, breaches of fiduciary duty, or the maintenance of unsafe and unsound conditions or practices, could subject us or our subsidiaries, including the Bank, as well as their respective officers, directors, and other institution-affiliated parties, to administrative sanctions, enforcement actions, and potentially substantial civil money penalties.

FDIC Conservatorship or Receivership .

The bank regulatory agencies may appoint the FDIC as conservator or receiver for a bank (or the FDIC may appoint itself, under certain circumstances) if any one or more of a number of circumstances exist, including, without limitation, the Bank becoming critically undercapitalized under prompt corrective action.

Effect of Governmental Monetary Policies.

The commercial banking business is affected not only by general economic conditions but also by U.S.

fiscal policy and the monetary policies of the Federal Reserve.

Some of the instruments of monetary policy available to the Federal Reserve include changes in the discount rate on member bank borrowings, the fluctuating availability of borrowings at the “discount window,” open market operations, and the imposition of, and changes in reserve requirements against member banks’ deposits and certain borrowings by banks and their affiliates and assets of foreign branches.

These policies have a significant influence on the overall growth of bank loans, investments, and deposits, and the interest rates charged on loans or paid on deposits.

We cannot predict the nature of future fiscal and monetary policies or the effect of these policies on our operations and activities, financial condition, results of operations, growth plans, or prospects.

Federal Securities Laws.

4 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business