UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, D.C. 20549

FORM 10-K

(Mark One)

For the fiscal year ended December 31, 2024

or

Commission File Number: 001-42512

EAGLE FINANCIAL SERVICES, INC.

(Exact name of registrant as specified in its charter)

(540) 955-2510

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act: None

(Title of class)

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☐ No ☒

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (232.405 of this Chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and "emerging growth company" in Rule 12b-2 of the Exchange Act.

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. □

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. □

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). □

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

The aggregate market value of the voting common equity held by non-affiliates of the registrant at June 28, 2024 was $101,801,103.

The number of shares of the registrant’s Common Stock ($2.50 par value) outstanding as of March 21, 2025 was 5,378,653.

DOCUMENTS INCORPORATED BY REFERENCE

EAGLE FINANCIAL SERVICES, INC.

INDEX TO FORM 10-K

PART I

Item 1. Business

General

Eagle Financial Services, Inc. is a bank holding company that was incorporated in 1991. The company is headquartered in Berryville, Virginia and conducts its operations through its subsidiary, Bank of Clarke (the “Bank”). The Bank is chartered under Virginia law. For purposes of this annual report on Form 10-K, the terms the "Company," "our," "us" and "we" refer to Eagle Financial Services, Inc. and our subsidiary as a combined entity, unless this report otherwise indicates or the context otherwise requires.

The Bank has thirteen full-service branches, two loan production offices, one wealth management office and one drive-through only facility. The Bank’s main office is located at 2 East Main Street in Berryville, Virginia. The Bank opened for business on April 1, 1881. The Bank has Virginia offices located in Clarke County, Frederick County, Fauquier County, Loudoun County and Fairfax County, as well as the Towns of Leesburg, Ashburn and Purcellville and the City of Winchester. The Bank has a Maryland office located in Frederick. This market area is located in the Shenandoah Valley of Virginia, Northern Virginia and Frederick, Maryland.

The Bank offers a wide range of retail and commercial banking services, including demand, savings and time deposits and consumer, mortgage and commercial loans. The Bank has thirteen ATM locations in its trade area and issues debit cards to deposit customers. These cards can be used to withdraw cash at most ATMs through the Bank’s membership in both regional and national networks. The Bank offers telephone banking, internet banking, and mobile banking to its customers. Internet banking also offers online bill payment to consumer and commercial customers. The Bank offers other commercial deposit account services such as ACH origination and remote deposit capture.

The Bank of Clarke Wealth Management Division, a division of the Bank, provides both a full-service trust department and a separate brokerage area. The trust department features a full range of fiduciary expertise, including service as trustee of personal trusts, service as guardian or conservator by court appointment, fiduciary investment management, estate settlement, and agency for trustees. The brokerage area offers advisory services and a broad selection of investment products, including individual retirement accounts, mutual funds, tax-deferred annuities, 529 college savings plans, life insurance, long term care insurance, brokerage certificates of deposit, among other brokerage services. Securities and other property held by the Bank of Clarke Wealth Management Division in a fiduciary or agency capacity are not assets of the Bank and are not included in the accompanying consolidated financial statements. Non-deposit investment products are offered through a third party provider.

The Bank is a member in Bankers Title Shenandoah, LLC, which sells title insurance and is an investor in Bearing Insurance Group, LLC, which serves as the broker for insurance sales through its member banks. The Bank invests in qualified affordable housing projects. The general purpose of these investments is to encourage and assist participants in investing in low-income residential rental properties located in the Commonwealth of Virginia, develop and implement strategies to maintain projects as low-income housing, provide tax credits and other tax benefits to investors, and to preserve and protect project assets.

Employees

The Company, including the Bank, has 231 full-time equivalent employees at December 31, 2024, representing 75 officers, 150 other, non-officer, full-time employees and 6 part-time employees. None of the Company’s employees are represented by a union or covered under a collective bargaining agreement. The Company considers relations with its employees to be excellent, and has obtained its second a Great Place to Work® certified. designation for the annual period through June 2025.

Securities and Exchange Commission Filings

The Company maintains an internet website at www.bankofclarke.bank. Shareholders of the Company and the public may access, free of charge, the Company’s periodic and current reports (including annual reports on Form 10-K, quarterly reports on Form 10-Q and current reports on Form 8-K, and any amendments to those reports) filed with or furnished to the Securities and Exchange Commission (the "SEC"), through the “Investor Relations” section of the Company’s website. The reports are made available on this website as soon as practicable following the filing of the reports with the SEC. The information is free of charge and may be reviewed, downloaded and printed from the Company website or http://www.sec.gov at any time. In addition, certain committee charters and the Company's Code of Ethics are available on the Company's website. The information on the Company's website is not a part of, and is not incorporated into, this Annual Report on Form 10-K.

Competition

There is significant competition for both loans and deposits within the Company’s trade area. Competition for loans comes from other commercial banks, savings banks, credit unions, mortgage brokers, finance companies, financial technology firms, insurance companies, and other institutional lenders. Competition for deposits comes from other commercial banks, savings banks, credit unions, brokerage firms, and other financial institutions. Based on total deposits at June 30, 2024 as reported to the FDIC, the Bank has 9.60% of the total deposits in its market area. The Company’s primary deposit market area includes Clarke County, Frederick County, Loudoun County, Fauquier County and the City of Winchester.

Supervision and Regulation

General. As a bank holding company, the Company is subject to regulation under the Bank Holding Company Act of 1956, as amended, and the examination and reporting requirements of the Board of Governors of the Federal Reserve System (the "Federal Reserve"). As a state-chartered commercial bank, the Bank is subject to regulation, supervision and examination by the Virginia State Corporation Commission’s Bureau of Financial Institutions. It is also subject to regulation, supervision and examination by the Federal Reserve. Other federal and state laws, including various consumer and compliance laws, govern the activities of the Bank, the investments that it makes and the aggregate amount of loans that it may grant to one borrower.

The following sections summarize some of the significant federal and state laws applicable to the Company and its subsidiary. To the extent that statutory or regulatory provisions are described, the description is qualified in its entirety by reference to that particular statutory or regulatory provision.

The Bank Holding Company Act. Under the Bank Holding Company Act, the Company is subject to periodic examination by the Federal Reserve and is required to file periodic reports regarding its operations and any additional information that the Federal Reserve may require. Activities at the bank holding company level are limited to the following:

Some of the activities that the Federal Reserve has determined by regulation to be closely related to the business of a banking include making or servicing loans and specific types of leases, performing specific data processing services and acting in some circumstances as a fiduciary or investment or financial adviser.

With some limited exceptions, the Bank Holding Company Act requires every bank holding company to obtain the prior approval of the Federal Reserve before:

In addition, and subject to some exceptions, the Bank Holding Company Act and the Change in Bank Control Act, together with their regulations, require Federal Reserve approval prior to any person or company acquiring 25% or more of any class of voting securities of the bank holding company. Prior notice to the Federal Reserve is required if a person acquires 10% or more, but less than 25%, of any class of voting securities of a bank or bank holding company and either the institution has registered securities under Section 12 of the Securities Exchange Act of 1934 or no other person owns a greater percentage of that class of voting securities immediately after the transaction.

In November 1999, Congress enacted the Gramm-Leach-Bliley Act (“GLBA”), which made substantial revisions to the statutory restrictions separating banking activities from other financial activities. Under the GLBA, bank holding companies that are well-capitalized and well-managed and meet other conditions can elect to become “financial holding companies.” As financial holding companies, they and their subsidiaries are permitted to acquire or engage in previously impermissible activities such as insurance underwriting, securities underwriting and distribution, travel agency activities, insurance agency activities, merchant banking and other activities that the Federal Reserve determines to be financial in nature or complementary to these activities. Financial holding companies continue to be subject to the overall oversight and supervision of the Federal Reserve, but the GLBA applies the concept of functional regulation to the activities conducted by subsidiaries. For example, insurance activities would be subject to supervision and regulation by state insurance authorities. Although the Company has not elected to become a financial holding company in order to exercise the broader activity powers provided by the GLBA, the Company may elect do so in the future.

Payment of Dividends. The Company is organized under the Virginia Stock Corporation Act, which prohibits the payment of a dividend if, after giving it effect, the corporation would not be able to pay its debts as they become due in the usual course of business or if the corporation’s total assets would be less than the sum of its total liabilities plus the amount that would be needed, if the corporation were to be dissolved, to satisfy the preferential rights upon dissolution of any preferred shareholders. In addition, the Federal Reserve has indicated that a bank holding company should generally pay dividends only if its current earnings are sufficient to fully fund the dividends, and the prospective rate of earnings retention appears consistent with the organization’s capital needs, asset quality and overall financial condition.

The Company is a legal entity separate and distinct from its subsidiary. Its ability to distribute cash dividends will depend primarily on the ability of the Bank to pay dividends to it, and the Bank is subject to laws and regulations that limit the amount of dividends that it can pay. As a state member bank, the Bank is subject to certain restrictions imposed by the reserve and capital requirements of federal and Virginia banking statutes and regulations. Under Virginia law, a bank may not declare a dividend in excess of its undivided profits. Additionally, the Bank may not declare a dividend if the total amount of all dividends, including the proposed dividend, declared by it in any calendar year exceeds the total of its retained net income of that year to date, combined with its retained net income of the two preceding years, unless the dividend is approved by the Federal Reserve.

The Federal Reserve, the FDIC and the state of Virginia have the general authority to limit the dividends paid by insured banks if the payment is deemed an unsafe and unsound practice. These regulators have indicated that paying dividends that deplete a bank’s capital base to an inadequate level would be an unsound and unsafe banking practice. The Bank may also not declare or pay a dividend without the approval of its board and two-thirds of its shareholders if the dividend would exceed its undivided profits, as reported to the Federal Reserve.

The Company does not expect that any of these laws, regulations or policies will materially affect the Bank's ability to pay dividends to the Company. During 2024, the Company paid total dividends of $4.3 million, including cash dividends that were reinvested in Company stock.

Insurance of Accounts, Assessments and Regulation by the FDIC. The Bank’s deposits are insured up to applicable limits by the FDIC. In July 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act (the "Dodd-Frank Act") permanently raised the standard maximum deposit insurance amount to $250,000. The FDIC has implemented a risk-based assessment system in which assessment rates for insured institutions with under $10 billion in assets are calculated based on supervisory evaluations and certain other financial measures. The assessment base is an institution’s average consolidated total assets less average tangible equity, and the initial base assessment rates are currently between 5 and 32 basis points depending on the institution's composite rating, and subject to potential adjustment based on certain long-term unsecured debt. Progressively lower assessment rate schedules will take effect once the FDIC’s reserve ratio reaches 2.0% or greater, and again once the reserve ratio reaches 2.5% or greater.

Capital Requirements. The Federal Reserve and the other federal banking agencies have issued risk-based and leverage capital guidelines applicable to U.S. banking organizations. Those regulatory agencies may from time to time require that a banking organization maintain capital above the minimum levels because of its financial condition or actual or anticipated growth. Pursuant to the Federal Reserve’s Small Bank Holding Company and Savings and Loan Holding Company Policy Statement, qualifying bank holding companies with total consolidated assets of less than $3 billion, such as the Company, are not subject to consolidated regulatory capital requirements.

Effective January 1, 2015, the Federal Reserve adopted capital rules intended to revise and strengthen its risk-based and leverage capital requirements and its method for calculating risk-weighted assets. The rules implemented the Basel III regulatory capital reforms from the Basel Committee on Banking Supervision and certain provisions of the Dodd-Frank Act.

Under these risk-based capital requirements of the Federal Reserve, the Bank is required to maintain a minimum ratio of total capital (which is defined as core capital and supplementary capital less certain specified deductions from total capital such as reciprocal holdings of depository institution capital instruments and equity investments) to risk-weighted assets of at least 8.0%. At least 6.0% of risk-weighted assets is required to be “Tier 1 capital,” which consists principally of common and certain qualifying preferred shareholders’ equity (including grandfathered trust preferred securities) as well as retained earnings, less certain intangibles and other adjustments. The “Tier 2 capital” consists of cumulative preferred stock, long-term perpetual preferred stock, a limited amount of subordinated and other qualifying debt (including certain hybrid capital instruments), and a limited amount of the allowance for credit losses, including reserves for off-balance sheet commitments. A common equity Tier 1 capital ratio of 4.5% of risk-weighted assets also was added with the rules effective January 1, 2015.

Each of the federal bank regulatory agencies also has established a minimum leverage capital ratio of Tier 1 capital to average adjusted assets (“Tier 1 leverage ratio”). The guidelines require a minimum Tier 1 leverage ratio of 3.0% for financial holding companies and banking organizations with the highest supervisory rating. All other banking organizations are required to maintain a minimum Tier 1 leverage ratio of 4.0% unless a different minimum was specified by an appropriate regulatory authority. In addition, for a depository institution to be considered “well capitalized” under the regulatory framework for prompt corrective action, its Tier 1 leverage ratio must be at least 5.0%. Banking organizations that have experienced internal growth or made acquisitions are expected to maintain strong capital positions substantially above the minimum supervisory levels without significant reliance on intangible assets. The Federal Reserve has not advised the Company or the Bank of any specific minimum leverage ratio applicable to either entity.

The capital requirements that became effective January 1, 2015 were phased in over a four-year period. As fully phased in effective January 1, 2019, the rules require the Bank to maintain (i) a minimum ratio of common equity Tier 1 to risk-weighted assets of at least 4.5%, plus a 2.5% “capital conservation buffer” (which is added to the 4.5% common equity Tier 1 ratio, effectively resulting in a minimum ratio of common equity Tier 1 to risk-weighted assets of at least 7.0%); (ii) a minimum ratio of Tier 1 capital to risk-weighted assets of at least 6.0%, plus the 2.5% capital conservation buffer (which is added to the 6.0% Tier 1 capital ratio, effectively resulting in a minimum Tier 1 capital ratio of 8.5%); (iii) a minimum ratio of total capital to risk-weighted assets of at least 8.0%, plus the 2.5% capital conservation buffer (which is added to the 8.0% total capital ratio, effectively resulting in a minimum total capital ratio of 10.5%); and (iv) a minimum leverage ratio of 4.0%, calculated as the ratio of Tier 1 capital to average assets.

The capital conservation buffer requirement was phased in beginning January 1, 2016, at 0.625% of risk-weighted assets, increasing by the same amount each year until fully implemented at 2.5% effective January 1, 2019. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of common equity Tier 1 to risk-weighted assets above the minimum but below the conservation buffer will face constraints on dividends, equity repurchases, and compensation based on the amount of the shortfall.

The Federal Reserve’s final rules also revised the “prompt corrective action” regulations pursuant to Section 38 of the FDIA by (i) introducing a common equity Tier 1 capital ratio requirement at each level (other than critically undercapitalized), with the required ratio being 6.5% for well-capitalized status; (ii) increasing the minimum Tier 1 capital ratio requirement for each category, with the minimum ratio for well-capitalized status being 8.0%; and (iii) eliminating the provision that provided that a bank with a composite supervisory rating of 1 may have a 3.0% Tier 1 leverage ratio and still be well-capitalized. These thresholds were effective for the Bank as of January 1, 2015. The minimum total capital to risk-weighted assets ratio (10.0%) and minimum leverage ratio (5.0%) for well-capitalized status were unchanged by the final rules.

As directed by the Economic Growth, Regulatory Relief and Consumer Protection Act (the “Economic Growth Act”), the federal banking regulators jointly issued a final rule in 2019 that permits qualifying banks that have less than $10 billion in total consolidated assets to elect to be subject to a 9% “community bank leverage ratio.” A qualifying bank that has chosen the proposed framework is not required to calculate the existing risk-based and leverage capital requirements and would be considered to have met the capital ratio requirements to be “well capitalized” under prompt corrective action rules, provided it has a community bank leverage ratio greater than 9%. The Bank has not opted into the CBRL framework at December 31, 2024 as its leverage ratio was 8.79%.

Other Safety and Soundness Regulations. There are a number of obligations and restrictions imposed on bank holding companies and their depository institution subsidiaries by federal law and regulatory policy that are designed to reduce potential loss exposure to the depositors of such depository institutions and to the FDIC insurance funds in the event that the depository institution is insolvent or is in danger of becoming insolvent. For example, under the requirements of the Federal Reserve with respect to bank holding company operations, a bank holding company is required to serve as a source of financial strength to its subsidiary depository institutions and to commit resources to support such institutions in circumstances where it might not do so otherwise. In addition, the “cross-guarantee” provisions of federal law require insured depository institutions under common control to reimburse the FDIC for any loss suffered or reasonably anticipated by the FDIC as a result of the insolvency of commonly controlled insured depository institutions or for any assistance provided by the FDIC to commonly controlled insured depository institutions in danger of failure. The FDIC may decline to enforce the cross-guarantee provision if it determines that a waiver is in the best interests of the deposit insurance funds. The FDIC’s claim for reimbursement under the cross guarantee provisions is superior to claims of shareholders of the insured depository institution or its holding company but is subordinate to claims of depositors, secured creditors and nonaffiliated holders of subordinated debt of the commonly controlled insured depository institutions.

Federal Reserve System. In 1980, Congress enacted legislation that imposed reserve requirements on all depository institutions that maintain transaction accounts or nonpersonal time deposits. NOW accounts, money market deposit accounts

and other types of accounts that permit payments or transfers to third parties fall within the definition of transaction accounts and are subject to these reserve requirements, as are any nonpersonal time deposits at an institution.

The reserve percentages are subject to adjustment by the Federal Reserve. Because required reserves must be maintained in the form of vault cash or in a non-interest-bearing account at, or on behalf of, a Federal Reserve Bank, the effect of the reserve requirement is to reduce the amount of the institution’s interest-earning assets.

However, in March 2020, in an unprecedented move, the Federal Reserve announced that the banking system had ample reserves, and, as reserve requirements no longer played a significant role in this regime, it reduced all reserve tranches to zero percent, thereby freeing banks from the reserve maintenance requirement. The action permits the Bank to loan or invest funds that were previously unavailable. The Federal Reserve has indicated that it expects to continue to operate in an ample reserves regime for the foreseeable future.

Transactions with Affiliates. Transactions between banks and their affiliates are governed by Sections 23A and 23B of the Federal Reserve Act. An affiliate of a bank is any bank or entity that controls, is controlled by or is under common control with such bank. Generally, Sections 23A and 23B (i) limit the extent to which the Bank or its subsidiaries may engage in “covered transactions” with any one affiliate to an amount equal to 10% of such institution’s capital stock and surplus, and maintain an aggregate limit on all such transactions with affiliates to an amount equal to 20% of such capital stock and surplus, and (ii) require that all such transactions be on terms substantially the same, or at least as favorable, to the association or subsidiary as those provided to a nonaffiliate. The term “covered transaction” includes the making of loans, purchase of assets, issuance of a guarantee and similar other types of transactions.

Transactions with Insiders. The Federal Reserve Act and related regulations impose specific restrictions on loans to directors, executive officers and principal shareholders of banks. Under Section 22(h) of the Federal Reserve Act, loans to a director, an executive officer and to a principal shareholder of a bank, and some affiliated entities of any of the foregoing, may not exceed, together with all other outstanding loans to such person and affiliated entities, the bank’s loan-to-one borrower limit. Loans in the aggregate to insiders and their related interests as a class may not exceed two times the bank’s unimpaired capital and unimpaired surplus until the bank’s total deposits equal or exceed $100,000,000, at which time the aggregate is limited to the bank’s unimpaired capital and unimpaired surplus. Section 22(h) also prohibits loans, above amounts prescribed by the appropriate federal banking agency, to directors, executive officers and principal shareholders of a bank or bank holding company, and their respective affiliates, unless such loan is approved in advance by a majority of the board of directors of the bank with any “interested” director not participating in the voting. The FDIC has prescribed the loan amount, which includes all other outstanding loans to such person, as to which such prior board of director approval is required, as being the greater of $25,000 or 5% of capital and surplus (up to $500,000). Section 22(h) requires that loans to directors, executive officers and principal shareholders be made on terms and underwriting standards substantially the same as offered in comparable transactions to other persons.

The Dodd-Frank Act also provides that banks may not “purchase an asset from, or sell an asset to” a bank insider (or their related interests) unless (i) the transaction is conducted on market terms between the parties, and (ii) if the proposed transaction represents more than 10 percent of the capital stock and surplus of the bank, it has been approved in advance by a majority of the bank’s non-interested directors.

Community Reinvestment Act. Under the Community Reinvestment Act and related regulations, depository institutions have an affirmative obligation to assist in meeting the credit needs of their market areas, including low and moderate-income areas, consistent with safe and sound banking practice. The Community Reinvestment Act directs each bank to maintain a public file containing specific information, including all written comments received from the public for the current year and each of the previous two calendar years that specifically relate to the bank’s performance in helping to meet community credit needs. Depository institutions are periodically examined for compliance with the Community Reinvestment Act and are periodically assigned ratings in this regard. Banking regulators consider a depository institution’s Community Reinvestment Act rating when reviewing applications to establish new branches, undertake new lines of business, and/or acquire part or all of another depository institution. An unsatisfactory rating can significantly delay or even prohibit regulatory approval of a proposed transaction by a bank holding company or its depository institution subsidiaries.

In October 2023, the Office of the Comptroller of the Currency ("OCC"), the Federal Reserve System Board and the FDIC finalized comprehensive revisions to their CRA regulations. The objectives in issuing the final rule include strengthening the achievement of the core purpose of the statute, adapting to changes in the banking industry, including the expanded role of mobile and online banking, tailoring performance standards to account for differences in bank size and business models and local conditions, confirming that CRA and fair lending responsibilities are mutually reinforcing, and promoting a consistent regulatory approach that applies to banks regulated by all three agencies. The final rule is expected to go into effect on April 1, 2024, but most provisions of the rule, including the new tests, the need to define retail lending

assessment areas, and the data collection requirements, will become applicable on January 1, 2026. Reporting of the collected data will not be required until 2027. In addition to numerous technical revisions, the final rule introduces major changes to the CRA regulations in four key areas: (A) the delineation of assessment areas; (B) the overall evaluation framework and performance standards and metrics; (C) the definition of community development activities; and (D) data collection and reporting. The new evaluation framework is “tailored” based on the size of the bank.

Fair Lending; Consumer Laws. In addition to the Community Reinvestment Act, other federal and state laws regulate various lending and consumer aspects of the banking business. Governmental agencies, including the Department of Housing and Urban Development, the Federal Trade Commission and the Department of Justice, have become concerned that prospective borrowers experience discrimination in their efforts to obtain loans from depository and other lending institutions. These agencies have brought litigation against depository institutions alleging discrimination against borrowers. Many of these suits have been settled, in some cases for material sums, short of a full trial.

These governmental agencies have clarified what they consider to be lending discrimination and have specified various factors that they will use to determine the existence of lending discrimination under the Equal Credit Opportunity Act and the Fair Housing Act, including evidence that a lender discriminated on a prohibited basis, evidence that a lender treated applicants differently based on prohibited factors in the absence of evidence that the treatment was the result of prejudice or a conscious intention to discriminate, and evidence that a lender applied an otherwise neutral non-discriminatory policy uniformly to all applicants, but the practice had a discriminatory effect, unless the practice could be justified as a business necessity.

Banks and other depository institutions are also subject to numerous consumer-oriented laws and regulations. These laws, which include the Truth in Lending Act, the Truth in Savings Act, the Real Estate Settlement Procedures Act, the Electronic Funds Transfer Act, the Funds Availability Act, the Equal Credit Opportunity Act, and the Fair Housing Act, require compliance by depository institutions with various disclosure requirements and requirements regulating the availability of funds after deposit or the making of some loans to customers.

Privacy Regulations. The GLBA contains extensive customer privacy protection provisions. Under these provisions, a financial institution must provide to its customers, both at the inception of the customer relationship and on an annual basis, the institution’s policies and procedures regarding the handling of customers’ nonpublic personal financial information. The law provides that, except for specific limited exceptions, an institution may not provide such personal information to unaffiliated third parties unless the institution discloses to the customer that such information may be so provided and the customer is given the opportunity to opt out of such disclosure. An institution may not disclose to a non-affiliated third party, other than to a consumer reporting agency, customer account numbers or other similar account identifiers for marketing purposes. The GLBA also provides that the states may adopt customer privacy protections that are more strict than those contained in the act.

Regulation P provides an exception under which financial institutions that meet certain conditions are not required to provide annual privacy notices to customers. To qualify for this exception, a financial institution must not share nonpublic personal information about customers except as described in certain statutory exceptions. In addition, the rule requires that the financial institution must not have changed its policies and practices with regard to disclosing nonpublic personal information from those that the institution disclosed in the most recent privacy notice it sent. As part of its implementation, the CFPB also amended Regulation P to provide timing requirements for delivery of annual privacy notices in the event that a financial institution that qualified for this annual notice exception later changes its policies or practices in such a way that it no longer qualifies for the exception. The CFPB further removed the Regulation P provision that allowed for use of the alternative delivery method for annual privacy notices because the CFPB believes the alternative delivery method will no longer be used in light of the annual notice exception.

In October 2024, the CFPB adopted a new rule that requires financial service providers, such as the Bank, to make certain data available to consumers upon request regarding the products or services they obtain from the provider. The rule is intended to give consumers control over their financial data, including with whom it is shared, and encourage competition in the provision of consumer financial products and services. Compliance is required beginning April 1, 2028 for depository institutions with at least $3 billion in total assets and beginning April 1, 2029 for depository institutions with at least $1.5 billion in total assets.

Anti-Money Laundering Laws and Regulations. The Bank is subject to several federal laws that are designed to combat money laundering, terrorist financing, and transactions with persons, companies or foreign governments designated by U.S. authorities (“AML laws”). This category of laws includes the Bank Secrecy Act of 1970, the Money Laundering Control Act of 1986, the USA PATRIOT Act of 2001, and the Anti-Money Laundering Act of 2020. The Anti-Money Laundering Act

of 2020, the most sweeping anti-money laundering legislation in 20 years, requires various federal agencies to promulgate regulations implementing a number of its provisions.

The AML laws and their implementing regulations require insured depository institutions, broker-dealers, and certain other financial institutions to have policies, procedures, and controls to detect, prevent, and report money laundering and terrorist financing. The AML laws and their regulations also provide for information sharing, subject to conditions, between federal law enforcement agencies and financial institutions, as well as among financial institutions, for counter-terrorism purposes. Federal banking regulators are required, when reviewing bank holding company acquisition and bank merger applications, to take into account the effectiveness of the anti-money laundering activities of the applicants. To comply with these obligations, the Company has implemented appropriate internal practices, procedures, and controls.

Cybersecurity. The federal banking agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a financial institution’s board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services. The federal banking agencies expect financial institutions to establish lines of defense and ensure that their risk management processes also address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack. If the Bank fails to meet the expectations set forth in this regulatory guidance, it could be subject to various regulatory actions and any remediation efforts may require significant resources of the Bank. In addition, all federal and state bank regulatory agencies continue to increase focus on cybersecurity programs and risks as part of regular supervisory exams.

In November 2021, the federal banking agencies approved a final rule effective on April 1, 2022 that, among other things, requires banking organizations to notify their primary regulator within 36 hours of becoming aware of a “computer-security incident” that rises to the level of a “notification incident.” The rule also requires bank service providers to notify their banking organization customers as soon as possible after becoming aware of similar incidents.

In 2023, the SEC issued a final rule that requires disclosure of material cybersecurity incidents, as well as cybersecurity risk management, strategy and governance. Under this rule, banking organizations that are SEC registrants must generally disclose information about a material cybersecurity incident within four business days of determining it is material with periodic updates as to the status of the incident in subsequent filings as necessary.

Sarbanes-Oxley Act of 2002. The Sarbanes-Oxley Act implemented a number of laws affecting corporate governance, accounting obligations and corporate reporting. The Sarbanes-Oxley Act is applicable to all companies with equity securities registered or that file reports under the Securities Exchange Act of 1934. In particular, the Sarbanes-Oxley Act established: (i) requirements for audit committees, including independence, expertise, and responsibilities; (ii) responsibilities regarding financial statements for the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) standards for auditors and regulation of audits; (iv) disclosure and reporting obligations for reporting companies and their directors and executive officers; and (v) civil and criminal penalties for violations of the securities laws. Because the Company’s common stock is registered with the SEC, it is currently subject to these requirements.

Incentive Compensation. In June 2010, the Federal Reserve issued a final rule on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. Banking organizations are instructed to review their incentive compensation policies to ensure that they do not encourage excessive risk-taking and implement corrective programs as needed. The Federal Reserve will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Bank, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions.

Dodd-Frank Act. In July 2010, the Dodd-Frank Act was signed into law, incorporating numerous financial institution regulatory reforms. The Dodd-Frank Act implements far-reaching reforms of major elements of the financial landscape, particularly for larger financial institutions. Many of its provisions do not directly impact community-based institutions like the Bank. For instance, provisions that regulate derivative transactions and limit derivatives trading activity of federally-insured institutions, enhance supervision of “systemically significant” institutions, impose new regulatory authority over hedge funds, limit proprietary trading by banks, and phase-out the eligibility of trust preferred securities for Tier 1 capital are among the provisions that do not directly impact the Bank either because of exemptions for institutions below a certain asset size or because of the nature of the Bank’s operations. Certain aspects of the Dodd-Frank Act remain subject to rulemaking

and interpretation and will take effect over several years, and their impact on the Company or the financial industry is difficult to predict before such regulations or interpretations are adopted.

In May 2018, the Economic Growth Act was enacted to modify or remove certain regulatory financial reform rules and regulations, including some of those implemented under the Dodd-Frank Act. While the Economic Growth Act maintains most of the regulatory structure established by the Dodd-Frank Act, it amends certain aspects of the regulatory framework for small depository institutions with assets of less than $10 billion, such as the Bank, and for large banks with assets of more than $50 billion.

Among other matters, the Economic Growth Act expands the definition of qualified mortgages which may be held by a financial institution with total consolidated assets of less than $10 billion, exempts community banks from the Volcker Rule, and includes additional regulatory relief regarding regulatory examination cycles, call reports, mortgage disclosures and risk weights for certain high-risk commercial real estate loans.

Future Legislation and Regulation. Congress may enact legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of the proposed legislation could impact the regulatory structure under which the Company and the Bank operate and may significantly increase costs, impede the efficiency of internal business processes, require an increase in regulatory capital, require modifications to business strategy, and limit the ability to pursue business opportunities in an efficient manner. A change in statutes, regulations or regulatory policies applicable to the Company or the Bank could have a material, adverse effect on the business, financial condition and results of operations of the Company and the Bank. Future legislation, regulation, and government policy could affect the banking industry as a whole, including the business and results of operations of the Company and the Bank, in ways that are difficult to predict. The Company fully expects that the financial institution industry will remain heavily regulated in the near future and that additional laws or regulations may be adopted further regulating specific banking practices.

Item 1A. Risk Factors

The Company is subject to many risks that could adversely affect its future financial condition and performance and, therefore, the market value of its securities. The risk factors applicable to the Company include, but are not limited to the following:

Credit Risks

The Company’s concentration in loans secured by real estate may increase its credit losses, which would negatively affect our financial results.

At December 31, 2024, loans secured by real estate totaled $1.1 billion and represented 75.1% of the Company’s loan portfolio, net of net deferred loan costs and premiums. If we experience adverse changes in the local real estate market or in the local or national economy, borrowers’ ability to pay these loans may be impaired, which could impact the Company’s financial performance. The Company attempts to limit its exposure to this risk by applying good underwriting practices at origination, evaluating the appraisals used to establish property values, and routinely monitoring the financial condition of borrowers. If the value of real estate serving as collateral for the loan portfolio were to decline materially, a significant part of the loan portfolio could become under-collateralized. If the loans that are secured by real estate become troubled when real estate market conditions are declining or have declined, in the event of foreclosure, the Company may not be able to realize the amount of collateral that was anticipated at the time of originating the loan. In that event, the Company might have to increase the provision for credit losses, which could have a material adverse effect on its operating results and financial condition.

An inadequate allowance for credit losses would reduce our earnings.

Our earnings are significantly affected by our ability to properly originate, underwrite and service loans. We maintain an allowance for credit losses on loans based upon many factors, including the following: