EAGLE FINANCIAL SERVICES INC (EFSI) Business

Item 1. Business

General

Eagle Financial Services, Inc. is a bank holding company that was incorporated in 1991. The company is headquartered in Berryville, Virginia and conducts its operations through its subsidiary, Bank of Clarke (the “Bank”). The Bank is chartered under Virginia law. For purposes of this annual report on Form 10-K, the terms the "Company," "our," "us" and "we" refer to Eagle Financial Services, Inc. and our subsidiary as a combined entity, unless this report otherwise indicates or the context otherwise requires.

The Bank has fifteen full-service branches, one loan production office, one wealth management office and one drive-through only facility. The Bank’s main office is located at 2 East Main Street in Berryville, Virginia. The Bank opened for business on April 1, 1881. The Bank's market area is located in the Shenandoah Valley of Virginia, Northern Virginia and Frederick, Maryland. The Bank has Virginia offices located in Clarke County, Frederick County, Fauquier County, Loudoun County and Fairfax County, as well as the towns of Leesburg and Purcellville and the City of Winchester. The Bank has a Maryland office located in Frederick.

The Bank offers a wide range of retail and commercial banking services, including demand, savings and time deposits and consumer, mortgage and commercial loans. The Bank has fourteen ATM locations in its trade area and issues debit cards to deposit customers. These cards can be used to withdraw cash at most ATMs through the Bank’s membership in both regional and national networks. The Bank offers telephone banking, internet banking, and mobile banking to its customers. Internet banking also offers online bill payment to consumer and commercial customers. The Bank offers other commercial deposit account services such as ACH origination and remote deposit capture.

The Bank of Clarke Wealth Management Division, a division of the Bank, provides both a full-service trust department and a separate brokerage area. The trust department features a full range of fiduciary expertise, including service as trustee of personal trusts, service as guardian or conservator by court appointment, fiduciary investment management, estate settlement, and agency for trustees. The brokerage area offers advisory services and a broad selection of investment products, including individual retirement accounts, mutual funds, tax-deferred annuities, 529 college savings plans, life insurance, long term care insurance, brokerage certificates of deposit, among other brokerage services. Securities and other property held by the Bank of Clarke Wealth Management Division in a fiduciary or agency capacity are not assets of the Bank and are not included in the accompanying consolidated financial statements. Non-deposit investment products are offered through a third party provider.

The Bank is a member in Bankers Title Shenandoah, LLC, which sells title insurance and is an investor in Bearing Insurance Group, LLC, which serves as the broker for insurance sales through its member banks. The Bank invests in qualified affordable housing projects. The general purpose of these investments is to encourage and assist participants in investing in low-income residential rental properties located in the Commonwealth of Virginia, develop and implement strategies to maintain projects as low-income housing, provide tax credits and other tax benefits to investors, and to preserve and protect project assets.

Employees

The Company, including the Bank, has 254 full-time equivalent employees at December 31, 2025, representing 86 officers, 161 other, non-officer, full-time employees and 8 part-time employees. None of the Company’s employees are represented by a union or covered under a collective bargaining agreement. The Company considers relations with its employees to be excellent, and obtained its second a Great Place to Work® certified. designation for the annual period through June 2025.

Securities and Exchange Commission Filings

The Company maintains an internet website at www.bankofclarke.bank. Shareholders of the Company and the public may access, free of charge, the Company’s periodic and current reports (including annual reports on Form 10-K, quarterly reports on Form 10-Q and current reports on Form 8-K, and any amendments to those reports) filed with or furnished to the Securities and Exchange Commission (the "SEC"), through the “Investor Relations” section of the Company’s website. The reports are made available on this website as soon as practicable following the filing of the reports with the SEC. The information is free of charge and may be reviewed, downloaded and printed from the Company website or http://www.sec.gov at any time. In addition, certain committee charters and the Company's Code of Ethics are available on the Company's website. The information on the Company's website is not a part of, and is not incorporated into, this Annual Report on Form 10-K.

4

Competition

There is significant competition for both loans and deposits within the Company’s trade area. Competition for loans comes from other commercial banks, savings banks, credit unions, mortgage brokers, finance companies, financial technology firms, insurance companies, and other institutional lenders. Competition for deposits comes from other commercial banks, savings banks, credit unions, brokerage firms, and other financial institutions. Based on total deposits at June 30, 2025 as reported to the FDIC, the Bank has 11.94% of the total deposits in its primary deposit market area of Clarke County, Frederick County, Loudoun County, Fauquier County and the City of Winchester. During the third quarter of 2025, the Bank opened its first full-service branch in Fairfax County, providing an opportunity to expand strategically and deliver its distinctive brand of community banking to Fairfax County. Adding Fairfax County to the the Bank's primary deposit market area increases the number of competing banking offices by approximately 66%. Under the expanded market area, the Bank's has 1.29% of total deposits at June 30, 2025, as reported to the FDIC.

Supervision and Regulation

General. As a bank holding company, the Company is subject to regulation under the Bank Holding Company Act of 1956, as amended, and the examination and reporting requirements of the Board of Governors of the Federal Reserve System (the "Federal Reserve"). As a state-chartered commercial bank, the Bank is subject to regulation, supervision and examination by the Virginia State Corporation Commission’s Bureau of Financial Institutions. The Bank is also subject to regulation, supervision and examination by the Federal Reserve. Other federal and state laws, including various consumer and compliance laws, govern the activities of the Company and the Bank, the investments that they may make and the aggregate amount of loans that the Bank may grant to one borrower.

The following sections summarize some of the significant federal and state laws applicable to the Company and its subsidiary. To the extent that statutory or regulatory provisions are described, the description is qualified in its entirety by reference to that particular statutory or regulatory provision.

The Bank Holding Company Act. Under the Bank Holding Company Act, the Company is subject to periodic examination by the Federal Reserve and is required to file periodic reports regarding its operations and any additional information that the Federal Reserve may require. Activities at the bank holding company level are limited to the following:

•
banking, managing or controlling banks;

•
furnishing services to or performing services for its subsidiaries; and

•
engaging in other activities that the Federal Reserve has determined by regulation or order to be so closely related to banking as to be a proper incident to these activities.

Some of the activities that the Federal Reserve has determined by regulation to be closely related to the business of a banking include making or servicing loans and specific types of leases, performing specific data processing services and acting in some circumstances as a fiduciary or investment or financial adviser.

With some limited exceptions, the Bank Holding Company Act requires every bank holding company to obtain the prior approval of the Federal Reserve before:

•
acquiring substantially all the assets of any bank;

•
acquiring direct or indirect ownership or control of any voting shares of any bank if after such acquisition it would own or control more than 5% of the voting shares of such bank (unless it already owns or controls the majority of such shares); or

•
merging or consolidating with another bank holding company.

In addition, and subject to some exceptions, the Bank Holding Company Act and the Change in Bank Control Act, together with their regulations, require Federal Reserve approval prior to any person or company acquiring 25% or more of any class of voting securities of the bank holding company. Prior notice to the Federal Reserve is required if a person acquires 10% or more, but less than 25%, of any class of voting securities of a bank or bank holding company and either the institution has registered securities under Section 12 of the Securities Exchange Act of 1934 or no other person owns a greater percentage of that class of voting securities immediately after the transaction.

Under the Gramm-Leach-Bliley Act (“GLBA”), bank holding companies that are well-capitalized and well-managed and meet other conditions can elect to become “financial holding companies.” As financial holding companies, they and their subsidiaries are permitted to acquire or engage in additional activities such as insurance underwriting, securities underwriting and distribution, travel agency activities, insurance agency activities, merchant banking and other activities that the Federal Reserve determines to be financial in nature or complementary to these activities. Financial holding companies continue to be subject to the overall oversight and supervision of the Federal Reserve, but the GLBA applies the concept of

5

functional regulation to the activities conducted by subsidiaries. For example, insurance activities would be subject to supervision and regulation by state insurance authorities. Although the Company has not elected to become a financial holding company in order to exercise the broader activity powers provided by the GLBA, the Company may elect do so in the future.

Payment of Dividends. The Company is organized under the Virginia Stock Corporation Act, which prohibits the payment of a dividend if, after giving it effect, the corporation would not be able to pay its debts as they become due in the usual course of business or if the corporation’s total assets would be less than the sum of its total liabilities plus the amount that would be needed, if the corporation were to be dissolved, to satisfy the preferential rights upon dissolution of any preferred shareholders. In addition, the Federal Reserve has indicated that a bank holding company should generally pay dividends only if its current earnings are sufficient to fully fund the dividends, and the prospective rate of earnings retention appears consistent with the organization’s capital needs, asset quality and overall financial condition.

The Company is a legal entity separate and distinct from its subsidiary. Its ability to distribute cash dividends will depend primarily on the ability of the Bank to pay dividends to it, and the Bank is subject to laws and regulations that limit the amount of dividends that it can pay. As a state member bank, the Bank is subject to certain restrictions imposed by the reserve and capital requirements of federal and Virginia banking statutes and regulations. Under Virginia law, a bank may not declare a dividend in excess of its undivided profits. Additionally, the Bank may not declare a dividend if the total amount of all dividends, including the proposed dividend, declared by it in any calendar year exceeds the total of its retained net income of that year to date, combined with its retained net income of the two preceding years, unless the dividend is approved by the Federal Reserve.

The Federal Reserve, the FDIC and the state of Virginia have the general authority to limit the dividends paid by insured banks if the payment is deemed an unsafe and unsound practice. These regulators have indicated that paying dividends that deplete a bank’s capital base to an inadequate level would be an unsound and unsafe banking practice. The Bank may also not declare or pay a dividend without the approval of its board and two-thirds of its shareholders if the dividend would exceed its undivided profits, as reported to the Federal Reserve.

The Company does not expect that any of these laws, regulations or policies will materially affect the Bank's ability to pay dividends to the Company. During 2025, the Company paid total dividends of $6.1 million, including cash dividends that were reinvested in Company stock.

Insurance of Accounts, Assessments and Regulation by the FDIC. The Bank’s deposits are insured up to applicable limits by the FDIC. In July 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act (the "Dodd-Frank Act") permanently raised the standard maximum deposit insurance amount to $250,000. The FDIC has implemented a risk-based assessment system in which assessment rates for insured institutions with under $10 billion in assets are calculated based on supervisory evaluations and certain other financial measures. The assessment base is an institution’s average consolidated total assets less average tangible equity, and the initial base assessment rates are currently between 5 and 32 basis points depending on the institution's composite rating, and subject to potential adjustment based on certain long-term unsecured debt. Progressively lower assessment rate schedules will take effect once the FDIC’s reserve ratio reaches 2.0% or greater, and again once the reserve ratio reaches 2.5% or greater.

Capital Requirements. The Federal Reserve and the other federal banking agencies have issued risk-based and leverage capital guidelines applicable to U.S. banking organizations. Those regulatory agencies may from time to time require that a banking organization maintain capital above the minimum levels because of its financial condition or actual or anticipated growth. Pursuant to the Federal Reserve’s Small Bank Holding Company and Savings and Loan Holding Company Policy Statement, qualifying bank holding companies with total consolidated assets of less than $3 billion, such as the Company, are not subject to consolidated regulatory capital requirements.

The Federal Reserve has adopted capital rules implementing the Basel III regulatory capital reforms from the Basel Committee on Banking Supervision and certain provisions of the Dodd-Frank Act.

Under these risk-based capital requirements of the Federal Reserve, the Bank is required to maintain a minimum ratio of total capital (which is defined as core capital and supplementary capital less certain specified deductions from total capital such as reciprocal holdings of depository institution capital instruments and equity investments) to risk-weighted assets of at least 8.0%. At least 6.0% of risk-weighted assets is required to be “Tier 1 capital,” which consists principally of common and certain qualifying preferred shareholders’ equity (including grandfathered trust preferred securities) as well as retained earnings, less certain intangibles and other adjustments. The “Tier 2 capital” consists of cumulative preferred stock, long-term perpetual preferred stock, a limited amount of subordinated and other qualifying debt (including certain hybrid capital instruments), and a limited amount of the allowance for credit losses, including reserves for off-balance sheet commitments. A common equity Tier 1 capital ratio of 4.5% of risk-weighted assets also was added with the rules effective January 1, 2015.

6

Each of the federal bank regulatory agencies also has established a minimum leverage capital ratio of Tier 1 capital to average adjusted assets (“Tier 1 leverage ratio”). The guidelines require a minimum Tier 1 leverage ratio of 3.0% for financial holding companies and banking organizations with the highest supervisory rating. All other banking organizations are required to maintain a minimum Tier 1 leverage ratio of 4.0% unless a different minimum was specified by an appropriate regulatory authority. In addition, for a depository institution to be considered “well capitalized” under the regulatory framework for prompt corrective action, its Tier 1 leverage ratio must be at least 5.0%. Banking organizations that have experienced internal growth or made acquisitions are expected to maintain strong capital positions substantially above the minimum supervisory levels without significant reliance on intangible assets. The Federal Reserve has not advised the Company or the Bank of any specific minimum leverage ratio applicable to either entity.

Banks also are required to maintain additional capital known as the "capital conservation buffer." The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of common equity Tier 1 to risk-weighted assets above the minimum but below the conservation buffer will face constraints on dividends, equity repurchases, and compensation based on the amount of the shortfall.

The Basel III final rules and capital conservation buffer requires the Bank to maintain:

(i) a minimum ratio of common equity Tier 1 to risk-weighted assets of at least 4.5%, plus a 2.5% capital conservation buffer (which is added to the 4.5% common equity Tier 1 ratio, effectively resulting in a minimum ratio of common equity Tier 1 to risk-weighted assets of at least 7.0%);

(ii) a minimum ratio of Tier 1 capital to risk-weighted assets of at least 6.0%, plus the 2.5% capital conservation buffer (which is added to the 6.0% Tier 1 capital ratio, effectively resulting in a minimum Tier 1 capital ratio of 8.5%);

(iii) a minimum ratio of total capital to risk-weighted assets of at least 8.0%, plus the 2.5% capital conservation buffer (which is added to the 8.0% total capital ratio, effectively resulting in a minimum total capital ratio of 10.5%); and

(iv) a minimum leverage ratio of 4.0%, calculated as the ratio of Tier 1 capital to average assets.

The Federal Reserve’s final rules also revised the “prompt corrective action” regulations pursuant to Section 38 of the FDIA by (i) introducing a common equity Tier 1 capital ratio requirement at each level (other than critically undercapitalized), with the required ratio being 6.5% for well-capitalized status; (ii) increasing the minimum Tier 1 capital ratio requirement for each category, with the minimum ratio for well-capitalized status being 8.0%; and (iii) eliminating the provision that provided that a bank with a composite supervisory rating of 1 may have a 3.0% Tier 1 leverage ratio and still be well-capitalized. These thresholds were effective for the Bank as of January 1, 2015. The minimum total capital to risk-weighted assets ratio (10.0%) and minimum leverage ratio (5.0%) for well-capitalized status were unchanged by the final rules.

As directed by the Economic Growth, Regulatory Relief and Consumer Protection Act (the “Economic Growth Act”), the federal banking regulators jointly issued a final rule in 2019 that permits qualifying banks that have less than $10 billion in total consolidated assets to elect to be subject to a 9% “community bank leverage ratio ("

CBLR"). A qualifying bank that has chosen the proposed framework is not required to calculate the existing risk-based and leverage capital requirements and would be considered to have met the capital ratio requirements to be “well capitalized” under prompt corrective action rules, provided it has a community bank leverage ratio greater than 9%. In November 2025, the federal banking regulators issued a proposal that would lower the leverage ratio for purposes of the CBLR framework from 9% to 8%. As of December 31, 2025, the Bank has not opted into the CBLR framework.

Other Safety and Soundness Regulations. There are a number of obligations and restrictions imposed on bank holding companies and their depository institution subsidiaries by federal law and regulatory policy that are designed to reduce potential loss exposure to the depositors of such depository institutions and to the FDIC insurance funds in the event that the depository institution is insolvent or is in danger of becoming insolvent. For example, under the requirements of the Federal Reserve with respect to bank holding company operations, a bank holding company is required to serve as a source of financial strength to its subsidiary depository institutions and to commit resources to support such institutions in circumstances where it might not do so otherwise. In addition, the “cross-guarantee” provisions of federal law require insured depository institutions under common control to reimburse the FDIC for any loss suffered or reasonably anticipated by the FDIC as a result of the insolvency of commonly controlled insured depository institutions or for any assistance provided by the FDIC to commonly controlled insured depository institutions in danger of failure. The FDIC may decline to enforce the cross-guarantee provision if it determines that a waiver is in the best interests of the deposit insurance funds. The FDIC’s claim for reimbursement under the cross guarantee provisions is superior to claims of shareholders of the insured depository institution or its holding company but is subordinate to claims of depositors, secured creditors and nonaffiliated holders of subordinated debt of the commonly controlled insured depository institutions.

7

Federal Reserve System. In 1980, Congress enacted legislation that imposed reserve requirements on all depository institutions that maintain transaction accounts or nonpersonal time deposits. NOW accounts, money market deposit accounts and other types of accounts that permit payments or transfers to third parties fall within the definition of transaction accounts and are subject to these reserve requirements, as are any nonpersonal time deposits at an institution.

The reserve percentages are subject to adjustment by the Federal Reserve. Because required reserves must be maintained in the form of vault cash or in a non-interest-bearing account at, or on behalf of, a Federal Reserve Bank, the effect of the reserve requirement is to reduce the amount of the institution’s interest-earning assets.

However, in March 2020, in an unprecedented move, the Federal Reserve announced that the banking system had ample reserves, and, as reserve requirements no longer played a significant role in this regime, it reduced all reserve tranches to zero percent, thereby freeing banks from the reserve maintenance requirement. The action permits the Bank to loan or invest funds that were previously unavailable. The Federal Reserve has indicated that it expects to continue to operate in an ample reserves regime for the foreseeable future.

Transactions with Affiliates. Transactions between banks and their affiliates are governed by Sections 23A and 23B of the Federal Reserve Act. An affiliate of a bank is any bank or entity that controls, is controlled by or is under common control with such bank. Generally, Sections 23A and 23B (i) limit the extent to which the Bank or its subsidiaries may engage in “covered transactions” with any one affiliate to an amount equal to 10% of such institution’s capital stock and surplus, and maintain an aggregate limit on all such transactions with affiliates to an amount equal to 20% of such capital stock and surplus, and (ii) require that all such transactions be on terms substantially the same, or at least as favorable, to the association or subsidiary as those provided to a nonaffiliate. The term “covered transaction” includes the making of loans, purchase of assets, issuance of a guarantee and similar other types of transactions.

Transactions with Insiders. The Federal Reserve Act and related regulations impose specific restrictions on loans to directors, executive officers and principal shareholders of banks. Under Section 22(h) of the Federal Reserve Act, loans to a director, an executive officer and to a principal shareholder of a bank, and some affiliated entities of any of the foregoing, may not exceed, together with all other outstanding loans to such person and affiliated entities, the bank’s loan-to-one borrower limit. Loans in the aggregate to insiders and their related interests as a class may not exceed two times the bank’s unimpaired capital and unimpaired surplus until the bank’s total deposits equal or exceed $100,000,000, at which time the aggregate is limited to the bank’s unimpaired capital and unimpaired surplus. Section 22(h) also prohibits loans, above amounts prescribed by the appropriate federal banking agency, to directors, executive officers and principal shareholders of a bank or bank holding company, and their respective affiliates, unless such loan is approved in advance by a majority of the board of directors of the bank with any “interested” director not participating in the voting. The FDIC has prescribed the loan amount, which includes all other outstanding loans to such person, as to which such prior board of director approval is required, as being the greater of $25,000 or 5% of capital and surplus (up to $500,000). Section 22(h) requires that loans to directors, executive officers and principal shareholders be made on terms and underwriting standards substantially the same as offered in comparable transactions to other persons.

The Dodd-Frank Act also provides that banks may not “purchase an asset from, or sell an asset to” a bank insider (or their related interests) unless (i) the transaction is conducted on market terms between the parties, and (ii) if the proposed transaction represents more than 10 percent of the capital stock and surplus of the bank, it has been approved in advance by a majority of the bank’s non-interested directors.

Community Reinvestment Act. Under the Community Reinvestment Act and related regulations, depository institutions have an affirmative obligation to assist in meeting the credit needs of their market areas, including low and moderate-income areas, consistent with safe and sound banking practice. The Community Reinvestment Act directs each bank to maintain a public file containing specific information, including all written comments received from the public for the current year and each of the previous two calendar years that specifically relate to the bank’s performance in helping to meet community credit needs. Depository institutions are periodically examined for compliance with the Community Reinvestment Act and are periodically assigned ratings in this regard. Banking regulators consider a depository institution’s Community Reinvestment Act rating when reviewing applications to establish new branches, undertake new lines of business, and/or acquire part or all of another depository institution. An unsatisfactory rating can significantly delay or even prohibit regulatory approval of a proposed transaction by a bank holding company or its depository institution subsidiaries.

Fair Lending; Consumer Laws. In addition to the Community Reinvestment Act, other federal and state laws regulate various lending and consumer aspects of the banking business. Governmental agencies, including the Department of Housing and Urban Development, the Federal Trade Commission and the Department of Justice, have become concerned that prospective borrowers experience discrimination in their efforts to obtain loans from depository and other lending institutions.

8

These agencies have brought litigation against depository institutions alleging discrimination against borrowers. Many of these suits have been settled, in some cases for material sums, short of a full trial.

These governmental agencies have clarified what they consider to be lending discrimination and have specified various factors that they will use to determine the existence of lending discrimination under the Equal Credit Opportunity Act and the Fair Housing Act, including evidence that a lender discriminated on a prohibited basis, evidence that a lender treated applicants differently based on prohibited factors in the absence of evidence that the treatment was the result of prejudice or a conscious intention to discriminate, and evidence that a lender applied an otherwise neutral non-discriminatory policy uniformly to all applicants, but the practice had a discriminatory effect, unless the practice could be justified as a business necessity.

Banks and other depository institutions are also subject to numerous consumer-oriented laws and regulations. These laws, which include the Truth in Lending Act, the Truth in Savings Act, the Real Estate Settlement Procedures Act, the Electronic Funds Transfer Act, the Funds Availability Act, the Equal Credit Opportunity Act, and the Fair Housing Act, require compliance by depository institutions with various disclosure requirements and requirements regulating the availability of funds after deposit or the making of some loans to customers.

Privacy Regulations. The GLBA contains extensive customer privacy protection provisions. Under these provisions, a financial institution must provide to its customers, both at the inception of the customer relationship and on an annual basis, the institution’s policies and procedures regarding the handling of customers’ nonpublic personal financial information. The law provides that, except for specific limited exceptions, an institution may not provide such personal information to unaffiliated third parties unless the institution discloses to the customer that such information may be so provided and the customer is given the opportunity to opt out of such disclosure. An institution may not disclose to a non-affiliated third party, other than to a consumer reporting agency, customer account numbers or other similar account identifiers for marketing purposes. The GLBA also provides that the states may adopt customer privacy protections that are more strict than those contained in the act.

Regulation P provides an exception under which financial institutions that meet certain conditions are not required to provide annual privacy notices to customers. To qualify for this exception, a financial institution must not share nonpublic personal information about customers except as described in certain statutory exceptions. In addition, the rule requires that the financial institution must not have changed its policies and practices with regard to disclosing nonpublic personal information from those that the institution disclosed in the most recent privacy notice it sent. As part of its implementation, the CFPB also amended Regulation P to provide timing requirements for delivery of annual privacy notices in the event that a financial institution that qualified for this annual notice exception later changes its policies or practices in such a way that it no longer qualifies for the exception. The CFPB further removed the Regulation P provision that allowed for use of the alternative delivery method for annual privacy notices because the CFPB believes the alternative delivery method will no longer be used in light of the annual notice exception.

Anti-Money Laundering Laws and Regulations. The Bank is subject to several federal laws that are designed to combat money laundering, terrorist financing, and transactions with persons, companies or foreign governments designated by U.S. authorities (“AML laws”). This category of laws includes the Bank Secrecy Act of 1970, the Money Laundering Control Act of 1986, the USA PATRIOT Act of 2001, and the Anti-Money Laundering Act of 2020. The Anti-Money Laundering Act of 2020, the most sweeping anti-money laundering legislation in 20 years, requires various federal agencies to promulgate regulations implementing a number of its provisions.

The AML laws and their implementing regulations require insured depository institutions, broker-dealers, and certain other financial institutions to have policies, procedures, and controls to detect, prevent, and report money laundering and terrorist financing. The AML laws and their regulations also provide for information sharing, subject to conditions, between federal law enforcement agencies and financial institutions, as well as among financial institutions, for counter-terrorism purposes. Federal banking regulators are required, when reviewing bank holding company acquisition and bank merger applications, to take into account the effectiveness of the anti-money laundering activities of the applicants. To comply with these obligations, the Company has implemented appropriate internal practices, procedures, and controls.

Cybersecurity. The federal banking agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a financial institution’s board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services. The federal banking agencies expect financial institutions to establish lines of defense and ensure that their risk management processes also address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption and maintenance of the institution’s operations

9

after a cyber-attack. If the Bank fails to meet the expectations set forth in this regulatory guidance, it could be subject to various regulatory actions and any remediation efforts may require significant resources of the Bank. In addition, all federal and state bank regulatory agencies continue to increase focus on cybersecurity programs and risks as part of regular supervisory exams.

In November 2021, the federal banking agencies approved a final rule effective on April 1, 2022 that, among other things, requires banking organizations to notify their primary regulator within 36 hours of becoming aware of a “computer-security incident” that rises to the level of a “notification incident.” The rule also requires bank service providers to notify their banking organization customers as soon as possible after becoming aware of similar incidents.

Sarbanes-Oxley Act of 2002. The Sarbanes-Oxley Act implemented a number of laws affecting corporate governance, accounting obligations and corporate reporting. The Sarbanes-Oxley Act is applicable to all companies with equity securities registered or that file reports under the Securities Exchange Act of 1934. In particular, the Sarbanes-Oxley Act established: (i) requirements for audit committees, including independence, expertise, and responsibilities; (ii) responsibilities regarding financial statements for the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) standards for auditors and regulation of audits; (iv) disclosure and reporting obligations for reporting companies and their directors and executive officers; and (v) civil and criminal penalties for violations of the securities laws. Because the Company’s common stock is registered with the SEC, it is currently subject to these requirements.

Incentive Compensation. In June 2010, the Federal Reserve issued a final rule on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. Banking organizations are instructed to review their incentive compensation policies to ensure that they do not encourage excessive risk-taking and implement corrective programs as needed. The Federal Reserve will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Bank, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions.

Dodd-Frank Act. In July 2010, the Dodd-Frank Act was signed into law, incorporating numerous financial institution regulatory reforms. The Dodd-Frank Act implements far-reaching reforms of major elements of the financial landscape, particularly for larger financial institutions. Many of its provisions do not directly impact community-based institutions like the Bank. For instance, provisions that regulate derivative transactions and limit derivatives trading activity of federally-insured institutions, enhance supervision of “systemically significant” institutions, impose new regulatory authority over hedge funds, limit proprietary trading by banks, and phase-out the eligibility of trust preferred securities for Tier 1 capital are among the provisions that do not directly impact the Bank either because of exemptions for institutions below a certain asset size or because of the nature of the Bank’s operations.

In May 2018, the Economic Growth Act was enacted to modify or remove certain regulatory financial reform rules and regulations, including some of those implemented under the Dodd-Frank Act. While the Economic Growth Act maintains most of the regulatory structure established by the Dodd-Frank Act, it amends certain aspects of the regulatory framework for small depository institutions with assets of less than $10 billion, such as the Bank, and for large banks with assets of more than $50 billion.

Among other matters, the Economic Growth Act expands the definition of qualified mortgages which may be held by a financial institution with total consolidated assets of less than $10 billion, exempts community banks from the Volcker Rule, and includes additional regulatory relief regarding regulatory examination cycles, call reports, mortgage disclosures and risk weights for certain high-risk commercial real estate loans.

Future Legislation and Regulation. Congress may enact legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of the proposed legislation could impact the regulatory structure under which the Company and the Bank operate and may significantly increase costs, impede the efficiency of internal business processes, require an increase in regulatory capital, require modifications to business strategy, and limit the ability to pursue business opportunities in an efficient manner. A change in statutes, regulations or regulatory policies applicable to the Company or the Bank could have a material, adverse effect on the business, financial condition and results of operations of the Company and the Bank. Future legislation, regulation, and government policy could affect the banking industry as a whole, including the business and results of operations of the Company and the Bank, in ways

10

that are difficult to predict. The Company fully expects that the financial institution industry will remain heavily regulated in the near future and that additional laws or regulations may be adopted further regulating specific banking practices.