FIRST COMMUNITY BANKSHARES INC /VA/ (FCBC) Business

Item 1. Business.

General

First Community Bankshares, Inc. (the “Company”), a financial holding company, was founded in 1989 and reincorporated under the laws of the Commonwealth of Virginia. The Company’s principal executive office is located in Bluefield, Virginia. The Company provides banking products and services to individual and commercial customers through its wholly owned subsidiary First Community Bank (the “Bank”), a Virginia-chartered banking institution founded in 1874. The Bank offers wealth management and investment advice through its Trust Division and wholly owned subsidiary First Community Wealth Management. Unless the context suggests otherwise, the terms “First Community,” “Company,” “we,” “our,” and “us” in this Annual Report on Form 10-K refer to First Community Bankshares, Inc. and its subsidiaries as a consolidated entity.

On January 23, 2026, the Company consummated its acquisition of Hometown Bancshares, Inc. ("Hometown"), the parent company of Union Bank, Inc., a West Virginia chartered bank, with eight branches in the state of West Virginia.  Following the acquisition, we operate 60 branches across the states of Virginia, West Virginia, North Carolina, and Tennessee.  We’re committed to the passionate pursuit of excellence in community banking and we’ve set our sights on being the bank of choice, employer of choice, and investment of choice in the communities in which we operate.

Our  mission is to:

Our operations are guided by a strategic plan that focuses on organic growth supplemented by strategic acquisitions of complementary financial institutions.

Employees and Human Capital Resources

As of December 31, 2025, we had 622 full-time employees and 28 part-time employees. The employees are not represented by a collective bargaining unit and we consider our relationship with our employees to be good.

We encourage and support the growth and development of our employees and, wherever possible, seek to fill positions by promotion and transfer from within the organization. Continual learning and career development is advanced through ongoing performance and development conversations with employees, internally developed training programs and customized corporate training engagements.

The safety, health and wellness of our employees is a top priority.  All employees are asked not to come to work when they experience signs or symptoms of a possible communicable illness. On an ongoing basis, we further promote the health and wellness of our employees by strongly encouraging work-life balance, minimizing increases in the employee portion of health care premiums and sponsoring various wellness programs.

Employee retention helps us operate efficiently and achieve one of our business objectives, which is building financial partnerships. We believe our commitment to living out our core values, actively prioritizing concern for our employees’ well-being, supporting our employees’ career goals, offering competitive wages and providing valuable fringe benefits aids in retention of our top-performing employees. In addition, nearly all of our employees are stockholders of the Company through participation in our current 401(k) plan and a former employee stock ownership plan, which aligns employee and stockholder interests by providing stock ownership on a tax-deferred basis at no investment cost to our employees.

Market Area

As of December 31, 2025, we operated 52 branch locations in Virginia, West Virginia, North Carolina, and Tennessee through our sole operating segment, Community Banking.  Economic indicators in our market areas show relatively stable employment and business conditions. We serve a diverse base of individuals and businesses across a variety of industries such as education; government and health services; retail trade; construction; manufacturing; tourism; coal mining and gas extraction; and transportation.

Competition

The financial services industry is highly competitive and constantly evolving. We encounter strong competition in attracting and retaining deposit, loan, and other financial relationships in our market areas. We compete with other commercial banks, thrifts, savings and loan associations, untaxed and lesser regulated credit unions, consumer finance companies, financial technology companies, mortgage banking firms, commercial finance and leasing companies, securities firms, brokerage firms, and insurance companies. We have positioned ourselves as a regional community bank that provides an alternative to larger banks, which often place less emphasis on personal relationships, and smaller community banks, which lack the capital and resources to efficiently serve customer needs. Factors that influence our ability to remain competitive include the ability to develop, maintain, and build long-term customer relationships; the quality, variety, and pricing of products and services; the convenience of banking locations and office hours; technological developments; and industry and general economic conditions. We seek to mitigate competitive pressures with our relationship style of banking, competitive pricing, and cost efficiencies.

4

Table of Contents

Supervision and Regulation

Overview

We are subject to extensive examination, supervision, and regulation under applicable federal and state laws by various regulatory agencies. These regulations are intended to protect consumers, depositors, borrowers, deposit insurance funds, and the stability of the financial system and are not for the protection of stockholders or creditors.

Applicable laws and regulations restrict our permissible activities and investments and impose conditions and requirements on the products and services we offer and the manner in which they are offered and sold. They also restrict our ability to repurchase stock or pay dividends, or to receive dividends from our banking subsidiary, and impose capital adequacy requirements on the Company and the Bank. The consequences of noncompliance with these laws and regulations can include substantial monetary and nonmonetary sanctions.

The following discussion summarizes significant laws and regulations applicable to the Company and the Bank. These summaries are not intended to be complete and are qualified in their entirety by reference to the applicable statute or regulation. Changes in laws and regulations may have a material effect on our business, financial condition, or results of operations.

First Community Bankshares, Inc.

The Company is a bank holding company registered under the Bank Holding Company Act of 1956, as amended, (“BHC Act”) and a financial holding company under the Gramm-Leach-Bliley Act of 1999 (“GLB Act”). The Company elected financial holding company status in December 2006. The Company and its subsidiaries are subject to supervision, regulation, and examination by the Board of Governors of the Federal Reserve System (“Federal Reserve”). The BHC Act generally provides for umbrella regulation of financial holding companies, such as the Company, by the Federal Reserve, as well as functional regulation of financial holding company subsidiaries by applicable regulatory agencies. The Federal Reserve is granted the authority, in certain circumstances, to require reports of, examine, and adopt rules applicable to any bank holding company subsidiary.

The Company is also subject to the disclosure and regulatory requirements of the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended, (“Exchange Act”), as administered by the Securities and Exchange Commission (“SEC”). The Company’s common stock is listed on the NASDAQ Global Select Market under the trading symbol FCBC and is subject to NASDAQ’s rules for listed companies.

First Community Bank

The Bank is a Virginia chartered bank and a member of the Federal Reserve subject to supervision, regulation, and examination by the Virginia Bureau of Financial Institutions and the Federal Reserve Board. The Bank is a member of the Federal Deposit Insurance Corporation (“FDIC”), and its deposits are insured by the FDIC to the extent provided by law. The regulations of these agencies govern most aspects of the Bank’s business, including requirements concerning the allowance for loan losses, lending and mortgage operations, interest rates received on loans and paid on deposits, the payment of dividends, loans to affiliates, mergers and acquisitions, capital, and the establishment of branches. Various consumer and compliance laws and regulations also affect the Bank’s operations.

As a member bank, the Bank is required to hold stock in the Federal Reserve Bank of Richmond ("FRB") in an amount equal to 6% of its capital stock and surplus (half paid to acquire the stock with the remainder held as a cash reserve). Member banks do not have any control over the Federal Reserve as a result of owning the stock and the stock cannot be sold or traded.

Permitted Activities under the BHC Act

The BHC Act limits the activities of bank holding companies, such as the Company, to the business of banking, managing or controlling banks and other activities the Federal Reserve determines to be closely related to banking. A bank holding company that elects treatment as a financial holding company under the GLB Act, such as the Company, may engage in a broader range of activities that are financial in nature or complementary to a financial activity and do not pose a substantial risk to the safety and soundness of depository institutions or the financial system. These activities include securities underwriting, dealing, and market making; sponsoring mutual funds and investment companies; insurance underwriting and agency; merchant banking activities; and other activities that the Federal Reserve determines to be closely related to banking.

In order to maintain financial holding company status, the Company and the Bank must be well-capitalized and well-managed under applicable Federal Reserve regulations and have received at least a satisfactory rating under the Community Reinvestment Act of 1977 (“CRA”). See “Prompt Corrective Action” and “Community Reinvestment Act” below. If we fail to meet these requirements, the Federal Reserve may impose corrective capital and managerial requirements and place limitations or conditions on our ability to conduct activities permissible for financial holding companies. If the deficiencies persist, the Federal Reserve may require the Company to divest the Bank or divest investments in companies engaged in activities permissible only for financial holding companies.

5

Table of Contents

The Company is required to give the Federal Reserve prior notice of any redemption or repurchase of its own equity securities, subject to certain exemptions, if the consideration to be paid, together with the consideration paid for any repurchases or redemptions in the preceding 12 months, is equal to 10% or more of the Company’s consolidated net worth. The Federal Reserve may oppose the transaction if it believes that the transaction would constitute an unsafe or unsound practice or would violate any law or regulation. Any redemption or repurchase of preferred stock or subordinated debt remains subject to the prior approval of the Federal Reserve Board.

The Inflation Reduction Act of 2022 (the “IRA”) imposed a 1% excise tax on the fair market value of stock repurchased after December 31, 2022, by publicly traded U.S. corporations. With certain exceptions, the value of stock repurchased is determined net of stock issued in the year, including shares issued pursuant to compensatory arrangements.

The BHC Act requires that bank holding companies obtain the Federal Reserve’s approval before acquiring direct or indirect ownership or control of more than 5% of the voting shares or all, or substantially all, of the assets of a bank. The regulatory authorities are required to consider the financial and managerial resources and future prospects of the bank holding company and the target bank, the convenience and needs of the communities to be served, and various competitive factors when approving acquisitions. The BHC Act also prohibits a bank holding company from acquiring direct or indirect control of more than 5% of the outstanding voting stock of any company engaged in a non-banking business unless the Federal Reserve determines it to be closely related to banking.

Capital Requirements

We are subject to various regulatory capital requirements administered by the Federal Reserve (the "Basel III Capital Rules").  The Basel III Capital Rules define qualifying capital instruments and specify minimum amounts of capital as a percentage of assets that banking organizations are required to maintain.  Under the Basel III Capital Rules, risk-based capital ratios are calculated by dividing Common Equity Tier I ("CET1") capital, Tier 1 capital and total capital, respectively, by risk-weighted assets.  Assets and off-balance sheet credit equivalents are assigned a risk weight based primarily on supervisory assessments of relative credit risk.  The Basel Capital Rules require the Company and the Bank to maintain the following:

The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions that fail to meet the effective minimum ratios once the capital conservation buffer is taken into account, as detailed above, will be subject to constraints on capital distributions, including dividends and share repurchases, and certain discretionary executive compensation. The severity of the constraints depends on the amount of the shortfall and the institution’s “eligible retained income” (that is, the greater of (i) net income for the preceding four quarters, net of distributions and associated tax effects not reflected in net income and (ii) average net income over the preceding four quarters).

Basel III Capital Rules provide for a number of deductions from and adjustments to CET1.  As non-advanced approaches organizations under the Basel III Capital Rules, the Company and the Bank are subject to rules that provide for simplified capital requirements relating to the threshold deductions.  These include, for example, the requirement that certain deferred tax assets and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 25% of CET1.

6

Table of Contents

Basel III Capital Rules prescribe a standardized approach for risk weightings that expand the risk-weighting categories from the four Basel I categories (0%, 20%, 50% and 100%) to a larger and more risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. government and agency securities, to 600% for certain equity exposures, and resulting in higher risk weights for a variety of asset categories. In November 2019, the federal banking agencies adopted a rule revising the scope of commercial real estate mortgages subject to a 150% risk weight.

Management believes that the Company and the Bank's current capital levels exceed the required capital amounts to the considered well-capitalized and also meet the fully phased-in minimum capital requirements, including the related capital conservation buffers, as required by the Basel III Capital Rules as of December 31, 2025. For additional information, see Note 20, "Regulatory Requirements and Restrictions," to the Consolidated Financial Statements in Part II, Item 8 of this report.

Prompt Corrective Action

The federal banking regulators are required to take prompt corrective action with respect to capital-deficient institutions. Agency regulations define, for each capital category, the levels at which institutions are well-capitalized, adequately capitalized, undercapitalized, significantly undercapitalized, or critically undercapitalized. An institution may be downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios if the appropriate federal regulators determine that it is engaging in an unsafe or unsound practice or is in an unsafe or unsound condition. A bank’s capital category is determined solely for applying prompt corrective action regulations, and the capital category may not constitute an accurate representation of the bank’s financial condition or prospects for other purposes.

The Bank was classified as well-capitalized under prompt corrective action regulations as of December 31, 2025. In order to be considered a well-capitalized institution under Basel III Capital Rules, an organization must not be subject to any written agreement, order, capital directive, or prompt corrective action directive and must maintain the following minimum capital ratios:

Undercapitalized institutions are required to submit a capital restoration plan to federal banking regulators. Under the Federal Deposit Insurance Act, as amended (“FDIA”), in order for the capital restoration plan to be accepted by the appropriate federal banking agency, a bank holding company must provide appropriate assurances of performance and guarantee that its subsidiary bank will comply with its capital restoration plan, subject to certain limitations. Agency regulations contain broad restrictions on certain activities of undercapitalized institutions, including asset growth, acquisitions, establishing branches, and engaging in new lines of business. With certain exceptions, a depository institution is prohibited from making capital distributions, including dividends, and is prohibited from paying management fees to its parent holding company if the institution would be undercapitalized after such distribution or payment.

A significantly undercapitalized institution is subject to various requirements and restrictions, including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets, and ending deposits from correspondent banks. The FDIC has limited discretion in dealing with a critically undercapitalized institution and is generally required to appoint a receiver or conservator.

7

Table of Contents

Safety and Soundness Standards

Guidelines adopted by federal bank regulatory agencies establish general standards relating to internal controls and information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, and compensation. In general, the guidelines require, among other things, appropriate systems and practices to identify and manage risks and exposures. If an institution fails to meet safety and soundness standards, the regulatory agencies may require the institution to submit a written compliance plan describing the steps they would take to correct the situation and the time that such steps would be taken. If an institution fails to submit or implement an acceptable compliance plan, after being notified, the agency must issue an order directing action to correct the deficiency and may issue an order directing other actions, such as those applicable to undercapitalized institutions under the prompt corrective action provisions of the FDIA. An institution may be subject to judicial proceedings and civil money penalties if it fails to follow such an order.

Payment of Dividends

The Company is a legal entity that is separate and distinct from its subsidiaries. The Company’s principal source of cash flow is derived from dividends paid by the Bank. There are various restrictions by regulatory agencies related to dividends paid by the Bank to the Company and dividends paid by the Company to its shareholders. The payment of dividends by the Company and the Bank may be limited by certain factors, such as requirements to maintain capital above regulatory guideline minimums.

Prior FRB approval is required for the Bank to declare or pay a dividend to the Company if the total of all dividends declared in any given year exceed the total of the Bank’s net profits for that year and its retained profits for the preceding two years, less any required transfers to surplus or to fund the retirement of preferred stock. Dividends paid by the Company to shareholders are subject to oversight by the Federal Reserve. Federal Reserve policy states that bank holding companies generally should pay dividends on common stock only from income available over the past year if prospective earnings retention is consistent with the organization’s expected future needs, asset quality, and financial condition.

Regulatory agencies have the authority to limit or prohibit the Company and the Bank from paying dividends if the payments are deemed to constitute an unsafe or unsound practice. The appropriate regulatory authorities have stated that paying dividends that deplete a bank’s capital base to an inadequate level would be an unsafe and unsound banking practice and that banking organizations should generally pay dividends only from current operating earnings. In addition, the Bank may not declare or pay a dividend if, after paying the dividend, the Bank would be classified as undercapitalized. In the current financial and economic environment, the Federal Reserve has discouraged payout ratios that are at maximum allowable levels, unless both asset quality and capital are very strong, and has noted that bank holding companies should carefully review their dividend policy. Bank holding companies should not maintain dividend levels that undermine their ability to be a source of strength to their banking subsidiaries.

Source of Strength

Federal Reserve policy and federal law require the Company to act as a source of financial and managerial strength to the Bank. Under this requirement, the Company is expected to commit resources to support the Bank even when it may not be in a financial position to provide such resources. Because the Company is a legal entity separate and distinct from its subsidiaries, any capital loans it makes to the Bank are subordinate in right of payment to depositors and to certain other indebtedness of the Bank. In the event of the Company’s bankruptcy, any commitment by the Company to a federal bank regulatory agency to maintain the capital of the Bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Transactions with Affiliates

The Federal Reserve Act (“FRA”) and Federal Reserve Regulation W place restrictions on “covered transactions” between the Bank and its affiliates, including the Company. The term “covered transactions” includes making loans, purchasing assets, issuing guarantees, and other similar transactions. The Dodd-Frank Act expanded the definition of “covered transactions” to include derivative activities, repurchase agreements, and securities lending or borrowing activities. These restrictions limit the number of transactions with affiliates, require certain levels of collateral for loans to affiliates, and require that all transactions with affiliates be on terms that are consistent with safe and sound banking practices. In addition, these transactions must be on terms that are substantially the same, or at least as favorable to the Bank, as those prevailing at the time for similar transactions with non-affiliates.

The FRA and Federal Reserve Regulation O place restrictions on loans between the Company and the Bank and their directors, executive officers, principal shareholders, affiliates, and interests of those directors, executive officers, and principal shareholders. These restrictions limit the amount of loans to one borrower and require that loans are on terms that are substantially the same as and follow underwriting procedures that are not less stringent than, those prevailing at the time for similar loans with non-insiders. In addition, the aggregate limit of loans to all insiders, as a group, cannot exceed the Bank’s total unimpaired capital and surplus.

8

Table of Contents

Deposit Insurance and Assessments

Substantially all of the Bank’s deposits are insured up to applicable limits by the Deposit Insurance Fund (“DIF”) of the FDIC and are subject to quarterly deposit insurance assessments to maintain the DIF. Deposit insurance premiums are assessed using a risk-based system that places FDIC-insured institutions into one of four risk categories based on capital, supervisory ratings and other factors. The assessment rate determined by considering such information is then applied to the institution's average assets minus average tangible equity to determine the institution's insurance premium. The FDIC may change assessment rates or revise its risk-based assessment system if deemed necessary to maintain an adequate reserve ratio for the DIF. The Dodd-Frank Act required that the minimum reserve ratio for the DIF increase from 1.15% to 1.35% by September 30, 2020. Under the FDIA, the FDIC may terminate deposit insurance if it determines that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order, or condition imposed by the FDIC.  In October 2022, the FDIC adopted a final rule to increase the initial base deposit insurance assessment rate schedules uniformly by 2 basis points beginning with the first quarterly assessment period of 2023. The increased assessment is expected to improve the likelihood that the DIF reserve ratio would reach the statutory minimum of 1.35% by the statutory deadline prescribed under the FDIC's amended restoration plan.

In November 2023, the FDIC issued a final rule to implement a special assessment to recover losses to the DIF incurred as a result of bank failures earlier that year and the FDIC’s use of the systemic risk exception to cover certain deposits that were otherwise uninsured. The special assessment was based on estimated uninsured deposits as of December 31, 2022 (excluding the first $5.0 billion) and was assessed at a quarterly rate of 3.36 basis points, over eight quarterly assessment periods, that began in the first quarter of 2024. In June 2024, due to the increased estimate of losses, the FDIC announced that it projected that the special assessment would be collected for an additional two quarters beyond the initial eight-quarter collection period, at a lower rate. In December 2025, the FDIC adopted an interim rule to adjust the special assessment, as initial estimates showed the original eight-quarter plan might slightly over-collect compared to actual losses.  The rate for the final quarter (the first quarter of 2026) was reduced from 3.36 basis points to 2.97 basis points to align with the revised loss estimates.  Because the cumulative amount collected through the initial eight-quarter special assessment period is projected to equal the FDIC's loss estimate, the additional two quarters of extended assessment was removed.

The interim final rule also requires the FDIC to provide an offset to regular quarterly deposit insurance assessments for institutions subject to the special assessment if the aggregate amount collected exceeds estimated losses following the resolution of pending litigation and again following the termination of the receiverships.  As provided for in the special assessment rules, if losses at the termination of the receiverships exceed the amount collected, the FDIC will implement a one-time final shortfall special assessment to ensure the full amount of actual losses is recovered as required by law.  This updated assessment was made under the FDIC’s final rule whereby the estimated loss pursuant to the systemic risk determination can be periodically adjusted.  The special assessments are tax deductible. The extent to which any such additional future assessments will impact our future deposit insurance expense is currently uncertain

The Volcker Rule

A provision in the Dodd-Frank Act, known as the Volker Rule, amended the BHC Act to prohibit depository institutions and their affiliates from engaging in proprietary trading and from investing in, sponsoring, or having certain relationships with hedge funds or private equity funds. The Volcker Rule, which became effective in July 2015 and the implementing regulations of which were amended in 2019 and were subject to further amendment in 2020, does not significantly impact the operations of the Company and its subsidiaries, as we do not have any engagement in the businesses prohibited by the Volcker Rule.

Community Reinvestment Act

The CRA, as amended, requires depository institutions to help meet the credit needs of their market areas, including low-and moderate-income individuals and communities, consistent with safe and sound banking practices. Federal banking regulators periodically examine depository institutions and assign ratings based on CRA compliance. A rating of less than satisfactory may restrict certain operating activities, delay or deny certain transactions, or result in an institution losing its financial holding company status. The Bank received a rating of satisfactory in its most recent CRA examination.

On October 24, 2023, the FDIC, the Federal Reserve, and the Office of the Comptroller of the Currency ("OCC") issued a final rule to strengthen and modernize the CRA regulations (the "2023 modernization rule").  The final rule intended, among other things, to adapt to changes in the banking industry, including the expanded role of mobile and online banking, and to tailor performance standards to account for differences in bank size and business models.  Following its finalization on March 29, 2024, the 2023 modernization rule became subject to an ongoing injunction.  On July 16, 2025, the FDIC, Federal Reserve and the OCC issued a joint proposal to rescind the 2023 modernization rule.  The agencies continue to apply the CRA rules as they existed before the 2023 modernization, considering the injunction and pending finalization of the rescission of the 2023 modernization rule.

Incentive Compensation

Federal regulatory agencies have issued comprehensive guidance intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance is based on the key principles that a banking organization’s incentive compensation arrangements should (1) provide incentives that do not encourage risk taking beyond the organization’s ability to effectively identify and manage risks, (2) be compatible with effective internal controls and risk management, and (3) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

Federal banking regulators periodically examine the incentive compensation arrangements of banking organizations and incorporate any deficiencies in the organization’s supervisory ratings, which can affect certain operating activities. The FRB may initiate enforcement actions if the organization’s incentive compensation arrangements or related risk management, control, or governance processes pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies. The scope and content of the U.S. banking regulators’ policies on incentive compensation are continuing to develop. It cannot be determined at this time if or when a final rule will be adopted or if compliance with such a final rule will adversely affect the ability of the Company and its subsidiaries to hire, retain and motivate their key employees.

In October 2022, the SEC adopted a final rule directing national securities exchanges and associations, including NASDAQ, to implement listing standards that require listed companies to adopt policies mandating the recovery or “clawback” of excess incentive-based compensation earned by a current or former executive officer during the three fiscal years preceding the date the listed company is required to prepare an accounting restatement, including to correct an error that would result in a material misstatement if the error were corrected in the current period or left uncorrected in the current period.  The NASDAQ's listing standards pursuant to the SEC's rule became effective on October 2, 2023. The Company adopted a compensation recovery policy pursuant to the NASDAQ listing standards on October 24, 2023, and was included as Exhibit 97.1 to Form 10-K for the year ended December 31, 2023.

Anti-Tying Restrictions

The Bank and its affiliates are prohibited from tying the provision of certain services, such as extensions of credit, to other services offered by the Company.

9

Table of Contents

Consumer Protection and Privacy

We are subject to certain consumer laws and regulations that are designed to protect consumers in transactions with banks. These laws and regulations include the Mortgage Reform and Anti-Predatory Lending Act, the Truth in Lending Act, the Truth in Savings Act, the Home Mortgage Disclosure Act, the Electronic Funds Transfer Act, the Expedited Funds Availability Act, the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Fair Debt Collections Practices Act, the Right to Financial Privacy Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Service Members Civil Relief Act, and various state law counterparts. These laws and regulations contain extensive customer privacy protection provisions that limit the ability of financial institutions to disclose non-public information about consumers to non-affiliated third parties and require financial institutions to disclose certain policies to consumers.

Cybersecurity

Various federal and state laws and regulations contain extensive data privacy and cybersecurity provisions, and the regulatory framework for data privacy and cybersecurity is rapidly evolving. The FRB, FDIC, and other bank regulatory agencies have adopted guidelines for safeguarding confidential, personal customer information. These guidelines require each financial institution, under the supervision and ongoing oversight of its board of directors or an appropriate committee thereof, to create, implement, and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazards to the security or integrity of such information and protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. In addition, various U.S. regulators, including the FRB and the SEC, have increased their focus on cyber security through guidance, examinations, and regulations.

At the federal level, the GLB Act requires financial institutions to implement policies and procedures regarding the disclosure of nonpublic personal information about consumers to non-affiliated third parties. In general, the statute requires explanations to consumers on policies and procedures regarding the disclosure of such nonpublic personal information and, except as otherwise required by law, prohibits disclosing such personal information except as provided in the financial institution’s policies and procedures.

Banking organizations are required to notify their primary federal regulators within 36 hours after identifying a “computer-security incident” that the banking organization believes in good faith could materially disrupt or degrade its business or operations in a manner that would, among other things, jeopardize the viability of its operations, result in customers being unable to access their deposit and other accounts, result in a material loss of revenue, profit or franchise value, or pose a threat to the financial stability of the U.S.

In 2023, the SEC issued a final rule that requires disclosure of material cybersecurity incidents, as well as cybersecurity risk management, strategy and governance. Under this rule, banking organizations that are SEC registrants must generally disclose information about a material cybersecurity incident within four business days of determining it is material with periodic updates as to the status of the incident in subsequent filings as necessary.

See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity and Item 1C. Cybersecurity for a further discussion of risk management strategies and governance processes related to cybersecurity.

Bank Secrecy Act and Anti-Money Laundering

The Bank is subject to the requirements of the Bank Secrecy Act of 1970 ("BSA") and the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (“USA PATRIOT Act”) of 2001. The USA PATRIOT Act broadened existing anti-money laundering legislation by imposing new compliance and due diligence obligations focused on detecting and reporting money laundering transactions. These laws and regulations require the Bank to implement policies, procedures, and controls to detect, prevent, and report money laundering and terrorist financing and to verify the identity of our customers. Violations can result in substantial civil and criminal sanctions. In addition, provisions of the USA PATRIOT Act require the federal financial regulatory agencies to consider the effectiveness of a financial institution's anti-money laundering activities when reviewing mergers and acquisitions.

The Anti-Money Laundering Act of 2020 (“AMLA”), which amends BSA, was enacted in January 2021. The AMLA is intended to be a comprehensive reform and modernization to U.S. bank secrecy and anti-money laundering laws. Among other things, it codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the development of standards for evaluating technology and internal processes for BSA compliance; expands enforcement- and investigation-related authority, including increasing available sanctions for certain BSA violations and instituting BSA whistleblower incentives and protections.

Office of Foreign Assets Control Regulation

The U.S. Department of the Treasury’s (“Treasury”) Office of Foreign Assets Control (“OFAC”) administers and enforces economic and trade sanctions against targeted foreign countries and regimes, under authority of various laws, including designated foreign countries, nationals, and others. OFAC publishes lists of specially designated targets and countries. We are responsible for, among other things, blocking accounts of, and transactions with, such targets and countries, prohibiting unlicensed trade and financial transactions with them, and reporting blocked transactions after their occurrence. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences, including causing applicable bank regulatory authorities to not approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required.

Sarbanes-Oxley Act

The Sarbanes-Oxley Act (“SOX Act”) of 2002 addresses a broad range of corporate governance, auditing and accounting, executive compensation, and disclosure requirements for public companies and their directors and officers. The SOX Act requires our Chief Executive Officer and Chief Financial Officer to certify the accuracy of certain information included in our quarterly and annual reports. The rules require these officers to certify that they are responsible for establishing, maintaining, and regularly evaluating the effectiveness of our financial reporting and disclosure controls and procedures; that they have made certain disclosures to the auditors and to the Audit Committee of the Board of Directors about our controls and procedures; and that they have included information in their quarterly and annual filings about their evaluation and whether there have been significant changes to the controls and procedures or other factors which would significantly impact these controls subsequent to their evaluation. Section 404 of the SOX Act requires management to undertake an assessment of the adequacy and effectiveness of our internal controls over financial reporting and requires our auditors to attest to and report on the effectiveness of these controls.

10

Table of Contents

Fair Access to Financial Services

In recent years, certain states have enacted, or have proposed to enact, statues, regulations or policies that prohibit financial institutions from denying or canceling products or services to a person or business, or otherwise discriminating against a person or business in making available products or services, on the basis of certain social or political factors or other activities.  In August 2025, President Trump signed Executive Order 14331, "Guaranteeing Fair Banking Access for All Americans," which states that it is the policy of the United States that no American should be denied access to financial services because of their constitutionally or statutorily protected beliefs, affiliations, or political views.  The Executive Order directs the Treasury Secretary and federal banking regulators to address politicized or unlawful debanking activities.

Future Legislation and Regulation

Congress may enact legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although any change could impact the regulatory structure under which we or our competitors operate and may significantly increase costs, impede the efficiency of internal business processes, require an increase in regulatory capital, require modifications to our business strategy, and limit our ability to pursue business opportunities in an efficient manner. It could also affect our competitors differently than us, including in a manner that would make them more competitive. A change in statutes, regulations or regulatory policies applicable to the Company or the Bank could have a material, adverse effect on our business, financial condition and results of operations.

Available Information

We file annual, quarterly, and current reports; proxy statements; and other information with the SEC. You may read and copy any document we file with the SEC at the SEC’s website at www.sec.gov that contains reports, proxy and information statements, and other information that issuers file electronically with the SEC. We maintain a website at www.firstcommunitybank.com that makes available, free of charge, our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and other information, including any amendments to those reports as soon as reasonably practicable after such reports are filed with, or furnished to, the SEC. You are encouraged to access these reports and other information about our business from the Investor Relations section of our website. The Investor Relations section contains information about our Board of Directors, executive officers, and corporate governance policies and principles, which include the charters of the standing committees of the Board of Directors, the Insider Trading Policy, and the Standards of Conduct governing our directors, officers, and employees. Information on our website is not incorporated by reference in this report.