FVCBankcorp, Inc. (FVCB) Business

Item 1. Business

Overview

The Company is a registered bank holding company headquartered in Fairfax, Virginia. We operate primarily through our sole subsidiary, FVCbank (the "Bank"), a community oriented, locally-owned and managed commercial bank organized under the laws of the Commonwealth of Virginia. We serve the banking needs of commercial businesses, nonprofit organizations, professional service entities, and their respective owners and employees located in the greater Washington, D.C. and Baltimore metropolitan areas. The Company was established as the holding company for the Bank in 2015.

Since the Bank began operations in November 2007, it has grown largely organically, through de novo branch expansion, banker and customer acquisition, and two whole-bank acquisitions. In 2012, we completed the acquisition of 1st Commonwealth Bank of Virginia ("1st Commonwealth"), a $58.9 million asset savings and loan association in Arlington, Virginia.

On October 12, 2018, we completed our acquisition of Colombo Bank ("Colombo"), which was headquartered in Rockville, Maryland, and which added banking locations in Washington, D.C., and Montgomery County and the City of Baltimore in Maryland.

On August 31, 2021, we announced that the Bank made an investment in Atlantic Coast Mortgage, LLC ("ACM") for $20.4 million to obtain a 28.7% ownership interest in ACM. The Bank provides a warehouse lending facility to ACM, which includes a construction-to-permanent financing line, and has developed portfolio mortgage products to diversify our held to investment loan portfolio.

Market Area

We operate in one of the most economically dynamic and wealthy regions of the Washington and Baltimore Metropolitan Statistical Areas ("MSA"), focusing primarily on the Virginia counties of Arlington, Fairfax, Loudoun and Prince William and the independent cities located within those counties, as well as Washington, D.C. and its Maryland suburbs and Baltimore, Maryland and its surrounding suburbs. As of June 30, 2025, the Washington MSA had total deposits of $314.7 billion and the Baltimore MSA had total deposits of $101.8 billion, based on Federal Deposit Insurance Corporation (the "FDIC") data.

Our market area's unemployment rate has generally remained below the national average for the last several years, as the region has the benefit of a highly trained and educated workforce concentrated in government and professional service businesses. These factors, along with the ability of the regional infrastructure to support remote working, have provided a greater amount of resiliency on the overall employment metrics for our market.

In addition to the presence of the federal government, the Washington MSA is defined by attractive market demographics, including strong household incomes, dense populations and the presence of a diverse group of large and small businesses. According to the U.S. Census Bureau, the region is home to four of the top ten most highly educated counties in the nation and four to the top ten most affluent counties, as measured by household income. As of December 31, 2025, the Washington MSA had a median household income of $126.2 thousand, which ranks as eighth highest among all MSAs nationally, and a population of 6.44 million. The Virginia and Maryland localities within the Washington MSA in which we primarily operate have higher median household incomes than the Washington MSA as a whole and have an unemployment rate of 3.8% as of December 31, 2025. The significant presence of national and international businesses make the Washington MSA one of the most economically vibrant and diverse markets in the country. The Washington MSA is currently home to 20 Fortune 500 companies, including eight based in Fairfax County.

The Baltimore MSA also has strong economic factors which enhance our business profile. As of December 31, 2025, the Baltimore MSA had a median household income of $98.7 thousand, which represented 2.0% growth over the previous year. The Baltimore MSA has an unemployment rate of 3.6% as of December 31, 2025. With a population of 2.9 million, the top industries of the Baltimore MSA include healthcare, education, and professional, scientific and technical services.The Baltimore MSA is currently home to three Fortune 500 companies.

5

Table of Contents

The local economies in which we operate that began to strengthen and improve during 2022 post pandemic, have recently showed signs of a mild recession. Payrolls have fallen in recent months as a result of workforce reductions within the federal government. The unemployment rate in our regional economy, while still below the national average, has climbed to its highest level in four years, and house prices are falling despite holding steady nationally. Our business opportunities in the future may be tempered by high interest rates, inflation, and contractionary monetary policy. Volatility in global economic markets, continued domestic political turmoil and various episodes of geopolitical unrest continue to provide a degree of uncertainty in financial markets. Aside from these challenges, we continue to be encouraged by the resiliency of the current economic environment and the prospects for continued growth of the Company.

Growth Strategy

Our approach features competitive customized financial services offered to customers and prospects in a personal relationship context by seasoned professionals. We provide a full range of banking services that become integral to our customers' business operations, which helps to enhance our ability to retain our relationships. We offer a better value proposition to our customers by providing high-touch service with few added fees. Our capabilities and reputation enable us to be selective in loan and customer selection, which contributes to our strong asset quality, and our ability to provide multiple services to customers.

We intend to continue expanding our market position through organic growth, through expansion of our relationships with existing customers, acquisition of new customers and acquisition of seasoned bankers with strong customer relationships, through selective branching, and potentially opportunistic acquisitions or other strategic transactions, while increasing profitability, maintaining strong asset quality and a high level of customer service.

Our success has been driven by our mission to help our clients, communities, and employees prosper. We strive to exceed our clients' expectations by delivering superior, personalized client service supported with high quality bank products and services. We invest in the growth of our employees and we give back to the communities in which we do business to foster a brighter future for everyone who lives there. Much of our early growth was the result of the active promotion by our organizing shareholders, our board of directors, and our shareholders as many of the aforementioned are customers. We receive referrals from existing customers and all employees are encouraged to promote the Company. We believe having such a large group of individuals who actively promote the Company has and will continue to augment our ability to generate both deposits and loans through staff and management led marketing and calling campaigns. As we have grown, we have increased our reliance on management originated customer relationships, but believe that our strong network of personal, customer, and shareholder relationships and referrals will continue to be a significant factor in our business development strategy.

Our vision is to be known as the number one community bank in experience and service in our community. Our passion is to provide the utmost banking experience for each of our clients, to create a positive and empowering work environment for our employees, to fulfill our obligation of corporate citizenship in the communities in which we operate, and to ensure that our Bank increases profitability and grows prudently, ensuring its strength and continuity, and increasing shareholder value.

Our Products and Services

We emphasize providing commercial banking services to small and medium-sized businesses, professionals, non-profit organizations and associations, and investors living and working in and near our service area. We offer retail banking services to accommodate the individual needs of both corporate customers as well as the communities we serve. We also offer digital banking, mobile banking and a remote deposit service, which allows clients to facilitate and expedite deposit transactions through the use of electronic devices. A sophisticated suite of treasury management products is a key feature of our client focused, relationship driven marketing. We have partnered with experienced service providers in both insurance and merchant services to further augment the products available to our customers.

Lending Products

We provide a variety of lending products to small and medium-sized businesses, including (i) commercial real estate loans; (ii) commercial construction loans; (ii) commercial loans for a variety of business purposes such as for working capital, equipment purchases, lines of credit, and government contract financing; (iii) Small Business Administration ("SBA") lending; (iv) asset based lending and accounts receivable financing; (v) home equity loans, or home equity lines of credit; and (vi) consumer loans for constructive purposes. Through our partnership with ACM, we

6

Table of Contents

purchase residential mortgage loans primarily originated in our market area that meet our product criteria and pricing, to help with the diversification of our loan portfolio. Although we do not generally actively originate them, we have acquired pools of other types of loans, student loans and other consumer loans, in order to diversify the loan portfolio, put capital to work before organic loan production requires it, and to increase margin. We may also purchase participations from other banks in our market. Any acquired loans must meet our standard underwriting requirements.

Commercial Real Estate Loans. Commercial real estate loans, which comprise the largest portion of our loan portfolio, are secured by both owner occupied and investor owned commercial properties, including multi-family residential real estate. Commercial real estate loans are structured using both variable and fixed rates and renegotiable rates which adjust in three to five years, with maturities of generally five to ten years. At December 31, 2025, owner occupied commercial real estate loans represented 14% of the loan portfolio. At December 31, 2025, non-owner occupied commercial real estate loans represented approximately 31% of the loan portfolio and multi-family residential real estate comprised 8% the portfolio. We seek to mitigate lending risks typical of these types of loans such as declines in real estate values, changes in borrower cash flow and general economic conditions. We typically require a maximum loan to value of 80% and minimum cash flow and debt service coverages, of at least 1.20 to 1.00. Personal guarantees are generally required, but may be limited. We generally require that interest rates adjust not less frequently than five years. For purposes of geographic diversification, we will also make commercial real estate loans outside of our primary and secondary markets, in an area extending south to Richmond, Virginia, and north of Baltimore, Maryland, and between Winchester, Virginia and the Eastern Shore of Maryland.

Construction Loans. Commercial construction loans for the acquisition, development and construction of commercial real estate comprise 8% of the loan portfolio at December 31, 2025. Our typical commercial construction loan involves property that will ultimately be leased to a non-owner occupant. We will finance construction projects of a speculative nature, which are well-conceived and structured with appropriate interest reserves and analyzed fully. In underwriting commercial construction loans, we consider the expected costs of the transaction, the loan to value ratio, the credit history, cash flows and liquidity of the borrower, the project and the guarantors, the debt service coverage ratios (which are stressed prior to approval), take out sources for the permanent loan or repayment of the construction loan, the reputation, experience and qualifications of the borrower, the general contractor and others involved with the project and other factors. Commercial construction loans are generally made on a variable rate basis, typically based on the Wall Street Journal Prime Rate and subject to rate floors, for terms of 12 - 24 months. Generally, we do not make commercial construction loans outside of our primary or secondary market areas.

Commercial Loans, Government Contracting. We originate commercial loans for a variety of business purposes, including working capital, equipment purchases, lines of credit, government contract financing, asset based lending and accounts receivable financing. These loans are a significant and growing portion of our portfolio, comprising approximately 23% of our loan portfolio at December 31, 2025. The warehouse facility provided to ACM is also included in this loan type. We make commercial loans on a secured or unsecured basis. We generally require the owners, managing members, general partners and principals of the borrowing entity that control more than 20% of the borrower to guaranty the loan, unless a combination of low leverage, significant income and debt service coverage ratios, and substantial experience in operating the business, strong management and internal controls and/or other factors are demonstrated. Commercial loans are typically made with variable or adjustable rates. The cash flow of the borrower/borrower's operating business is often the principal source of debt service, with a secondary emphasis on other collateral.

We have developed a special expertise in government contract financing. We lend to government contractors or subcontractors headquartered in the Washington, D.C. metropolitan area. This area of lending encompasses lines of credit for working capital, financing of government leases, mergers and acquisition financing, and, less frequently term loans, to operating companies that recognize over 50% of their total revenues from services provided to federal government agencies or rated state and municipal governments. Our borrowers are typically engaged in technology or service businesses, but may also include construction and equipment providers, or entities working on "classified" projects. A government contractor borrower must have an acceptable level of eligible accounts receivable, provide appropriate security instruments perfecting our rights in the accounts receivable or other collateral, and are subject to periodic review and monitoring of their receivables, contract backlog, and contract compliance. The contractor is typically required to have its primary deposit relationship with us. Advance rates will be up to 90% of prime eligible government receivables, and lower percentages depending on the nature of the receivables. At December 31, 2025, outstanding loans to government contractors represented 45% of our commercial and industrial segment. Total commitments to government contractors totaled $350.4 million at December 31, 2025. Government contract loans are typically made with variable or adjustable rates. Lines of credit typically have a one year term. As with other commercial loans, guarantees are typically required.

7

Table of Contents

Consumer Residential. We actively originate loans for residential 1-4 family trust investment purposes and HELOCs in the communities we serve in the Washington and Baltimore MSAs. In addition, we have portfolio mortgage products that we developed for use by ACM to help diversify our total loan portfolio. Our HELOCs generally have a maximum loan to value of up to 85%, however, due to the strong residential real estate market in these markets, actual loan to values are typically lower than the maximum. We provide HELOCs as a service to our customers and when we receive referrals from various mortgage brokers within our market area. As of December 31, 2025, HELOCs comprise 1% of total loans. While we do not typically originate residential first mortgages, we will occasionally originate a mortgage loan meeting our investment preferences presented by a mortgage broker. We have also purchased portfolios of 1-4 family residential first mortgage loans on properties primarily located in our market area for yield and diversification. At December 31, 2025, consumer residential loans represented 15% of the loan portfolio.

Other Loans. We occasionally originate consumer loans both on an unsecured basis and secured by non-real estate collateral. We have also purchased pools of unsecured consumer loans and student loans from a third party for yield and diversification.

The lending activities in which we engage carry the risk that the borrowers will be unable to perform on their obligations. As such, interest rate policies of the Federal Reserve and general economic conditions, nationally and in our market areas, could have a significant impact on our results of operations. To the extent that economic conditions deteriorate, business and individual borrowers may be less able to meet their obligations to us in full and in a timely manner, resulting in decreased earnings or losses. Economic conditions may also adversely affect the value and liquidity of the property pledged as security for loans.

Our goal is to mitigate risks in the event of unforeseen threats to the loan portfolio as a result of an economic downturn or other negative influences. Plans for mitigating inherent risks in managing loan assets include: carefully enforcing loan policies and procedures, evaluating each borrower's business plan during the underwriting process and throughout the loan term, identifying and monitoring primary and alternative sources for loan repayment, and obtaining collateral to mitigate economic loss in the event of liquidation. Reserves for individually assessed loans are established based upon credit and/or collateral risks on an individual loan basis. A risk rating system is employed to proactively estimate loss exposure and provide a measuring system for setting general and individually assessed reserve allocations.

Our lending activities are subject to a variety of lending limits imposed by state and federal law. These limits will increase or decrease in response to increases or decreases in our capital levels. At December 31, 2025, the Bank had a legal lending limit of $44.5 million. At December 31, 2025, our average funded loan size outstanding, for commercial real estate (including commercial construction) and commercial loans was $2.4 million and $756 thousand, respectively. In accordance with internal lending policies, we may sell participations of loans to other banks, which allows us to manage risk involved in these loans and to meet the lending needs of our clients.

Concentrations of Credit Risk. Most of our lending is conducted with businesses and individuals in the suburbs of Washington, D.C. Our loan portfolio consists primarily of commercial real estate loans, including construction and land loans, which totaled $1.19 billion and constituted 61% of total loans as of December 31, 2025, and commercial loans, including loans to government contractors and the ACM warehouse lending facility, which totaled $453.4 million and constituted 23% of total loans as of December 31, 2025. The geographic concentration of our loans subjects our business to the general economic conditions within our market area. The risks created by such concentrations have been considered by management in the determination of the adequacy of the allowance for credit losses. Management believes the allowance for credit losses is adequate to cover expected losses in our loan portfolio as of December 31, 2025.

Comprehensive risk management practices and appropriate capital levels are essential elements of a sound commercial real estate lending program. A concentration in commercial real estate adds a dimension of risk that compounds the risk inherent in individual loans. The federal banking agencies have issued guidance governing financial institutions with concentrations in commercial real estate lending. The guidance provides that institutions that have (i) total reported loans for construction, land development, and other land which represent 100% or more of an institution's total risk-based capital; or (ii) total reported commercial real estate loans, excluding loans secured by owner-occupied commercial real estate, representing 300% or more of the institution's total risk-based capital and the institution's commercial real estate loan portfolio has increased 50% or more during the prior 36 months, are identified as having potential commercial real estate concentration risk. Institutions which are deemed to have concentrations in commercial real estate lending are expected to employ heightened levels of risk management with respect to their commercial real estate portfolios, and may be required to hold higher levels of capital. We have a concentration in commercial real estate loans, and we have experienced growth in our commercial real estate portfolio in recent years. As of December 31, 2025,

8

Table of Contents

commercial real estate loans as defined for regulatory purposes represented 313% of our total risk-based capital. Of those loans, commercial construction, development and land loans represented 53% of our total risk based capital. Owner-occupied commercial real estate loans represented an additional 90% of our total risk based capital. Management has extensive experience in commercial real estate lending, and has implemented and continues to maintain heightened portfolio monitoring and reporting, and strong underwriting criteria with respect to our commercial real estate portfolio.

Deposit Products

We offer a wide array of deposit products for individuals, professionals, government contractors and other businesses, including interest and noninterest-bearing transaction accounts, certificates of deposit, savings, and money market accounts. We are a relationship based bank, and maintenance of significant deposit relationships is a factor in our decision to make loans and the pricing of our products.

Our sophisticated treasury management and digital banking platform allows commercial customers to view balances, initiate payments, pay bills (including positive pay), issue stop payments, reconcile accounts and set up custom alerts. Online wires, ACH (including positive authorization), remote capture, cash disbursement and cash concentration are additional payment options available to businesses. We provide customers with a sophisticated escrow management product which facilitates and simplifies management of multiple escrow balances. We also provide secure credit card processing and merchant services, with reporting tailored to customer needs. Additionally, we offer online and mobile banking products to our consumer depositors, to complement our branch network.

Other Services

Through third party networks, we offer our customers access to a full range of business insurance products and business and consumer credit card products.

Cannabis Related Banking Business

The Bank provides banking services to customers that are licensed to do business in the cannabis industry, primarily in Virginia, Maryland and the District of Columbia. These customers include multi-state operators, fully integrated state-wide operators, independent dispensary/cultivation licensees, as well as provisional cannabis licensees. The Bank maintains stringent written policies and procedures related to the on-boarding of such businesses and to the monitoring and maintenance of such business accounts.

In accordance with federal regulatory guidance and industry best practices, the Bank's cannabis banking business is conducted through a comprehensive, defined, and multi-department process, which includes extensive compliance and on-boarding due diligence with subsequent involvement by bank experts in cannabis within the Bank's operations, branch, treasury management, lending, and credit departments. The Bank performs a multilayered due diligence review of a cannabis business before the business is on-boarded, including site visits and confirmation that the business is properly licensed by the state in which it is conducting business. Throughout the relationship, the Bank continues to monitor the business, including additional site visits, to ensure that the cannabis business continues to meet strict requirements, including maintenance of required licenses. The Bank performs periodic financial reviews of the business and monitors the business in accordance with the Bank Secrecy Act of 1970 and other state requirements.

Competition

We are one of the few remaining locally owned and managed independent community banks headquartered in Northern Virginia. We believe that this is an advantageous position and valuable quality which positively differentiates us from our competitors and positions us for future growth from individuals and small and mid-sized business customers who value the attention and customized services which a locally owned and managed community bank can provide.

As of June 30, 2025, there were approximately $314.7 billion in total deposits shared between banking institutions located in the Washington MSA, according to the FDIC. Capital One, Bank of America Corporation, Truist Bank, Wells Fargo Bank, and PNC Bank hold the primary market shares. When excluding the deposits held by these institutions, as of the aforementioned date, our deposit market share was approximately 1.9% in the Washington MSA. In the Baltimore MSA, there were approximately $101.8 billion in total deposits shared between banking institutions as of June 30, 2025, and when excluding deposits held by the above named larger institutions, our deposit market share was approximately 0.08%. Our strategic goal is to increase our market share through selective new branch additions, opportunistic

9

Table of Contents

acquisitions, and acquisitions of customers from larger competitors. We believe these larger competitors generally cannot provide the same level of attention and customization of services to small businesses that we seek to provide. Through correspondents, referrals to third parties with whom we have partnered, and our own capabilities, we are a full service financial provider, able to compete in substantially all areas of banking, except trust services. Additionally, we believe we provide competitively priced products, superior customer service, flexibility, and responsiveness when compared to our larger competitors.

The banking business is highly competitive. We compete as a financial intermediary with other commercial banks, savings banks, credit unions, mortgage banking firms, consumer finance companies, securities brokerage firms, insurance companies, money market mutual funds, financial technology companies and other financial institutions operating in the Washington and Baltimore MSAs and elsewhere.

Our market area is a highly competitive, highly branched, banking market. Competition in our market area for loans to small and middle-market businesses and professionals, our target market, is intense and pricing is important. Several of our competitors have substantially greater resources and lending limits than we have, and offer certain services, such as extensive and established branch networks and trust services that we do not currently provide or currently expect to provide in the near future. Moreover, larger institutions operating in the Washington, D.C. metropolitan market have access to borrowed funds at a lower cost than may be available to us. Additionally, deposit competition among institutions in the market area is strong. As a result, it is possible that we may pay above market rates to attract deposits.

Risk Management

We believe that effective risk management is of primary importance. Risk management refers to the activities by which we identify, measure, monitor, evaluate and manage the risks we face in the course of our banking activities. These include liquidity, interest rate, credit, operational, compliance, regulatory, strategic, financial and reputational risk exposures. Our board of directors and management team have created a risk-conscious culture that is focused on quality growth, which starts with capable and experienced risk management teams and an infrastructure capable of addressing the evolving risks we face, as well as the changing regulatory and compliance landscape. Our risk management approach employs comprehensive policies and processes to establish robust governance. We believe a disciplined and conservative underwriting approach has been the key to our strong asset quality.

Our board of directors sets the tone at the top of our organization, adopting and overseeing the implementation of our risk management, establishing our overall risk appetite and risk management strategy. The board of directors approves our various operating policies, which include risk policies, procedures, limits, targets and reporting, structured to guide decisions regarding the appropriate balance between risk and return considerations in our business. Our board of directors receives periodic reporting on the risks and control environment effectiveness and monitors risk levels in relation to the approved risk appetite.

Credit risk is the risk that borrowers or counterparties will be unable or unwilling to repay their obligations in accordance with the underlying contractual terms and the risk that credit assets will suffer significant deterioration in market value. We manage and control credit risk in our loan portfolio by adhering to well-defined underwriting criteria and account administration standards established by management, and approved by the board of directors. Our written loan policies document underwriting standards, approval levels, exposure limits, and other limits or standards deemed necessary and prudent. Portfolio diversification at the obligor, product, and geographic levels is actively managed to mitigate concentration risk. In addition, credit risk management includes an independent credit review process that assesses compliance with policies, risk rating standards, and other critical credit information. In addition to implementing risk management practices that are based upon established and sound lending practices, we adhere to sound credit principles. We evaluate our customers' borrowing needs and capacity to repay, in conjunction with their character and history. Our management and board of directors place significant focus on maintaining a healthy risk profile and ensuring sustainable growth. Our risk appetite seeks to balance the risks necessary to achieve our strategic goals while ensuring that our risks are appropriately managed and remain within our defined limits.

Our management of interest rate and liquidity risk is overseen by our Asset and Liability Committee, based on a risk management infrastructure approved by our board of directors that outlines reporting and measurement requirements. In particular, this infrastructure reviews financial performance, trends, and significant variances to budget; reviews and recommends for board approval risk limits and tolerances; reviews ongoing monitoring and reporting regarding our performance with respect to these areas of risk, including compliance with board-approved risk limits and stress-testing; ensures annual back-testing and independent validation of models at a frequency commensurate with risk level; reviews all

10

Table of Contents

hedging strategies and recommends changes as appropriate; reviews and recommends our contingency funding plan; establishes wholesale borrowing limits to be submitted to the board of directors; and acts as a second line of defense in reviewing information and reports submitted to the committee for the purpose of identifying, investigating, and assuring remediation, to its satisfaction, of errors or irregularities, if any.

Investment Portfolio

Our investment securities portfolio is primarily maintained as an on-balance sheet contingent source of liquidity to fund loans and meet the demands of depositors, and provides additional interest income. We currently classify substantially all of our investment securities as available-for-sale. Our investment policy authorizes investment primarily in securities of the U.S. government and its agencies; mortgage backed securities and collateralized mortgage obligations issued and fully backed by U.S. government agencies, securities of municipalities and to a lesser extent corporate bonds and other obligations, in each case meeting identified credit standards. The securities portfolio, along with certain loans, may also be used to collateralize public deposits, Federal Home Loan Bank of Atlanta ("FHLB") borrowings, and Federal Reserve Bank of Richmond ("FRB") borrowings. We manage our investment portfolio according to written investment policies approved by our board of directors. Our investment strategy aims to maximize earnings while maintaining liquidity in securities with minimal credit risk and interest rate risk which is reflective in the yields obtained on those securities.

Employees

As of December 31, 2025, we had 119 full-time employees and six part-time employees. None of our employees are covered by a collective bargaining agreement. We consider our relationship with our employees to be good and have not experienced interruptions of operations due to labor disagreements.

Additional Information

Our common stock is currently listed on the Nasdaq Capital Market under the symbol "FVCB." We maintain a website at https://www.fvcbank.com.

We make available free of charge through our website all of our SEC filings, including our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and amendments to those reports, as soon as reasonably practicable after electronically filing or furnishing such material to the SEC at https://www.sec.gov. Information on our website does not constitute part of, and is not incorporated into, this report or any other filing we make with the SEC.

SUPERVISION AND REGULATION

Our business and operations are subject to extensive federal and state governmental regulation and supervision. The following is a brief summary of certain statutes and rules and regulations that affect or may affect us. This summary is not intended to be an exhaustive description of the statutes or regulations applicable to our business. Supervision, regulation, and examination of the Company by the regulatory agencies are intended primarily for the protection of depositors and the Deposit Insurance Fund, rather than our shareholders.

The Company. The Company is a bank holding company registered under the Bank Holding Company Act of 1956, as amended (the "Act"), and is subject to regulation and supervision by the Federal Reserve. The Act and other federal laws subject bank holding companies to restrictions on the types of activities in which they may engage, and to a range of supervisory requirements and actions, including regulatory enforcement actions for violations of laws and regulations and unsafe and unsound banking practices. As a bank holding company, the Company is required to file with the Federal Reserve an annual report and such other additional information as the Federal Reserve may require pursuant to the Act. The Federal Reserve may also examine the Company and each of its subsidiaries. As a small bank holding company under the Federal Reserve's Small Bank Holding Company Policy Statement, the Company is not subject to risk-based capital requirements adopted by the Federal Reserve, which are substantially identical to those applicable to the Bank, and which are described below.

The Act requires approval of the Federal Reserve for, among other things, a bank holding company's direct or indirect acquisition of control of more than five percent (5%) of the voting shares, or substantially all the assets, of any bank or the merger or consolidation by a bank holding company with another bank holding company. The Act also generally permits the acquisition by a bank holding company of control, or substantially all of the assets of, any bank

11

Table of Contents

located in a state other than the home state of the bank holding company, except where the bank has not been in existence for the minimum period of time required by state law; but if the bank is at least five years old, the Federal Reserve may approve the acquisition.

With certain limited exceptions, a bank holding company is prohibited from acquiring control of any voting shares of any company which is not a bank or bank holding company and from engaging directly or indirectly in any activity other than banking or managing or controlling banks or furnishing services to or performing service for its authorized subsidiaries. A bank holding company may, however, engage in, or acquire an interest in a company that engages in, activities which the Federal Reserve has determined by order or regulation to be so closely related to banking or managing or controlling banks as to be properly incident thereto. In making such a determination, the Federal Reserve is required to consider whether the performance of such activities can reasonably be expected to produce benefits to the public, such as convenience, increased competition or gains in efficiency, which outweigh possible adverse effects, such as undue concentration of resources, decreased or unfair competition, conflicts of interest or unsound banking practices. Some of the activities that the Federal Reserve has determined by regulation to be closely related to banking include making or servicing loans, performing certain data processing services, acting as a fiduciary or investment or financial advisor, and making investments in corporations or projects designed primarily to promote community welfare. The Federal Reserve may order a bank holding company or its subsidiaries to terminate any of these activities or to terminate its ownership or control of any subsidiary when it has reasonable cause to believe that the bank holding company's continued ownership, activity or control constitutes a serious risk to the financial safety, soundness, or stability of it or any of its bank subsidiaries.

The Gramm Leach-Bliley Act of 1999 ("GLB Act"), allows a bank holding company or other company to certify its status as a financial holding company, which would allow such company to engage in activities that are financial in nature, that are incidental to such activities, or are complementary to such activities. The GLB Act enumerates certain activities that are deemed financial in nature, such as underwriting insurance or acting as an insurance principal, agent or broker, underwriting, dealing in or making markets in securities, and engaging in merchant banking under certain restrictions. It also authorizes the Federal Reserve to determine by regulation what other activities are financial in nature, or incidental or complementary thereto. The Company has not elected financial holding company status.

The Act and the Federal Deposit Insurance Act ("FDIA"), require a bank holding company to serve as a source of financial and managerial strength to its bank subsidiaries. As a result of a bank holding company's source of strength obligation, a bank holding company may be required to provide funds to a bank subsidiary in the form of subordinated capital or other instruments which qualify as capital under bank regulatory rules. Any loans from the holding company to such subsidiary banks likely would be unsecured and subordinated to such bank's depositors and perhaps to other creditors of the Bank. In addition, where a bank holding company has more than one FDIC-insured bank or thrift subsidiary, each of the bank holding company's subsidiary FDIC-insured depository institutions is responsible for losses to the FDIC as a result of an affiliated depository institution's failure.

A bank holding company is generally required to give the Federal Reserve prior written notice of any purchase or redemption of its own then outstanding equity securities. The Federal Reserve may disapprove such a purchase or redemption if it determines that the proposal would constitute an unsafe and unsound practice, or would violate any law, regulation, Federal Reserve order or directive, or any condition imposed by, or written agreement with, the Federal Reserve.

As a Virginia corporation, the Company is subject to additional limitations and restrictions. For example, state law restrictions include limitations and restrictions relating to indemnification of directors, distributions to shareholders, transactions involving directors, officers or interested shareholders, maintenance of books, records, minutes, borrowing and the observance of corporate formalities.

The Bank. The Bank is a Virginia chartered commercial bank and a member of the Federal Reserve System, whose accounts are insured by the Deposit Insurance Fund of the FDIC up to the maximum legal limits of the FDIC. The Bank is subject to regulation, supervision and regular examination by the Virginia Bureau of Financial Institutions (the "VBFI") and the Federal Reserve. The regulations of these various agencies govern most aspects of the Bank's business, including required reserves against deposits, loans, investments, mergers and acquisitions, borrowing, dividends and location and number of branch offices.

The laws and regulations governing the Bank generally have been promulgated to protect depositors and the Deposit Insurance Fund, and not for the purpose of protecting shareholders.

12

Table of Contents

Commercial banks, savings and loan associations and credit unions are generally able to engage in interstate banking or acquisition activities. As a result, banks in the Washington, D.C. metropolitan area can, subject to limited restrictions, acquire or merge with a bank in another jurisdiction, and can branch de novo in any jurisdiction.

Banking is a business, which depends on interest rate differentials. In general, the difference between the interest paid by a bank on its deposits and its other borrowings and the interest received by a bank on loans extended to its customers and on securities held in its investment portfolio constitutes the major portion of the Bank's earnings. Thus, the earnings and growth of the Bank are subject to the influence of economic conditions generally, both domestic and foreign, and also to the monetary and fiscal policies of the United States and its agencies, particularly the Federal Reserve, which regulates the supply of money through various means including open market dealings in United States government securities. The nature and timing of changes in such policies and their impact on the Bank cannot be predicted.

Subsidiary banks of a bank holding company are subject to certain restrictions imposed by the Federal Reserve Act on any extensions of credit to the bank holding company or any of its subsidiaries, or investments in the stock or other securities thereof, and on the taking of such stock or securities as collateral for loans to any borrower. Further, a bank holding company and any subsidiary bank are prohibited from engaging in certain tying arrangements in connection with the extension of credit. A subsidiary bank may not extend credit, lease or sell property, or furnish any services, or fix or vary the consideration for any of the foregoing on the condition that: (i) the customer obtain or provide some additional credit, property or services from or to such bank other than a loan, discount, deposit or trust service; (ii) the customer obtain or provide some additional credit, property or service from or to the Company or any other subsidiary of the Company; or (iii) the customer not obtain some other credit, property or service from competitors, except for reasonable requirements to assure the soundness of credit extended.

Branching and Interstate Banking. The federal banking agencies are authorized to approve interstate bank merger transactions without regard to whether such transaction is prohibited by the law of any state, unless the home state of one of the banks has opted out of the interstate bank merger provisions of the Riegle-Neal Interstate Banking and Branching Efficiency Act of 1994 (the "Riegle-Neal Act"), by adopting a law after the date of enactment of the Riegle-Neal Act and prior to June 1, 1997 which applies equally to all out-of-state banks and expressly prohibits merger transactions involving out-of-state banks. Interstate acquisitions of branches are permitted only if the law of the state in which the branch is located permits such acquisitions. Such interstate bank mergers and branch acquisitions are also subject to the nationwide and statewide insured deposit concentration limitations described in the Riegle-Neal Act. Washington, D.C., Maryland and Virginia have each enacted laws, that permit interstate acquisitions of banks and bank branches. The Dodd-Frank Wall Street Reform and Consumer Protection Act (the "Dodd-Frank Act") authorizes national and state banks to establish de novo branches in other states to the same extent as a bank chartered by that state would be permitted to branch.

The GLB Act made substantial changes in the historic restrictions on non-bank activities of bank holding companies, and allows affiliations between types of companies that were previously prohibited. The GLB Act also allows banks to engage in a wider array of nonbanking activities through "financial subsidiaries."

Brokered Deposits. A "brokered deposit" is any deposit that is obtained from or through the mediation or assistance of a deposit broker. Deposit brokers may attract deposits from individuals and companies throughout the United States and internationally whose deposit decisions are based primarily on obtaining the highest interest rates. Certain reciprocal deposits of up to the lesser of $5 billion or 20% of an institution's deposits are excluded from the definition of brokered deposits, where the institution is "well-capitalized" and has a composite rating of 1 or 2. We have used brokered deposits in the past, and we intend to continue to use brokered deposits as one of our funding sources to support future growth. There are risks associated with using brokered deposits. In order to continue to maintain our level of brokered deposits, we may be forced to pay higher interest rates than those contemplated by our asset-liability pricing strategy. In addition, banks that become less than "well-capitalized" under applicable regulatory capital requirements may be restricted in their ability to accept or renew, or prohibited from accepting or renewing, brokered deposits. If this funding source becomes more difficult to access, we will have to seek alternative funding sources in order to continue to fund our growth. This may include increasing our reliance on FHLB borrowings, attempting to attract additional non-brokered deposits, and selling loans and securities. There can be no assurance that brokered deposits will be available, or if available, sufficient to support our continued growth. The unavailability of a sufficient volume of brokered deposits could have a material adverse effect on our business, financial condition, and results of operations.

Anti-Money Laundering Laws and Regulations. The Company is subject to several federal laws that are designed to combat money laundering, terrorist financing, and transactions with persons, companies or foreign governments

13

Table of Contents

designated by U.S. authorities ("AML laws"). This category of laws includes the Bank Secrecy Act of 1970, the Money Laundering Control Act of 1986, the USA PATRIOT Act of 2001, and the Anti-Money Laundering Act of 2020.

The AML laws and their implementing regulations require insured depository institutions, broker-dealers, and certain other financial institutions to have policies, procedures, and controls to detect, prevent, and report money laundering and terrorist financing. The AML laws and their regulations also provide for information sharing, subject to conditions, between federal law enforcement agencies and financial institutions, as well as among financial institutions, for counter-terrorism purposes. Federal banking regulators are required, when reviewing bank holding company acquisition and bank merger applications, to take into account the effectiveness of the anti-money laundering activities of the applicants. To comply with these obligations, the Company has implemented appropriate internal practices, procedures, and controls.

Office of Foreign Assets Control. The United States has imposed economic sanctions that affect transactions with designated foreign countries, foreign nationals and others, which are administered by the U.S. Treasury Department's Office of Foreign Assets Control ("OFAC"). The OFAC-administered sanctions targeting countries take many different forms. Generally, however, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on a "U.S. person" engaging in financial transactions relating to making investments in, or providing investment-related advice or assistance to, a sanctioned country; and (ii) a blocking of assets in which the government or specially designated nationals of a sanctioned country have an interest by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g. property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal and reputational consequences.

Capital Adequacy. The Federal Reserve and the FDIC have adopted risk-based and leverage capital adequacy requirements, pursuant to which they assess the adequacy of capital in examining and supervising banks and bank holding companies and in analyzing bank regulatory applications. Risk-based capital requirements determine the adequacy of capital based on the risk inherent in various classes of assets and off-balance sheet items. The Dodd-Frank Act additionally requires capital requirements to be countercyclical so that the required amount of capital increases in times of economic expansion and decreases in times of economic contraction, consistent with safety and soundness.

The federal banking agencies have adopted rules to implement the framework for strengthening international capital and liquidity regulation adopted by the Basel Committee on Banking Supervision ("Basel III"). The Basel III framework, among other things, (i) introduced the concept of common equity tier one capital ("CET1"), (ii) required that most adjustments to regulatory capital measures be made to CET1 and not to the other components of capital, (iii) expanded the scope of the adjustments to capital that may be made as compared to existing regulations, and (iv) specified that Tier 1 capital consists of CET1 and "Additional Tier 1 capital" instruments meeting specified requirements.

The Basel III rules require institutions to maintain: (i) a minimum ratio of CET1 to risk-weighted assets of 4.5%, plus a "capital conservation buffer" of 2.5%, or 7.0%; (ii) a minimum ratio of Tier 1 capital to risk-weighted assets of 6.0%, plus the capital conservation buffer, or 8.5%; (iii) a minimum ratio of Total (Tier 1 plus Tier 2) capital to risk-weighted assets of 8.0%, plus the capital conservation buffer, or 10.5%; and (iv) a minimum leverage ratio of 4%, calculated as the ratio of Tier 1 capital to balance sheet exposures plus certain off-balance sheet exposures (computed as the average of the month-end ratios each month during a calendar quarter).

Basel III also provides for a "countercyclical capital buffer," generally to be imposed when federal banking agencies determine that excess aggregate credit growth becomes associated with a buildup of systemic risk. This buffer would be a CET1 add-on to the capital conservation buffer of 2.5%. The current policy of the Federal Reserve is to maintain the countercyclical capital buffer at 0% in a normal risk environment.

Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the minimum plus the capital conservation buffer (or below the combined capital conservation buffer and countercyclical capital buffer, when the latter is applied) may face constraints on their ability to pay dividends, effect equity repurchases, and pay discretionary bonuses to executive officers, which constraints vary based on the amount of the shortfall.

We believe that the Bank met all capital adequacy requirements to which it was subject to as of December 31, 2025 and December 31, 2024.

14

Table of Contents

As discussed below, the Basel III rules also integrate the new capital requirements into the prompt corrective action provisions under Section 38 of the FDIA.

The capital ratios described above are the minimum levels that the federal banking agencies expect. Our state and federal regulators have the discretion to require us to maintain higher capital levels based upon our concentrations of loans, the risk of our lending or other activities, the performance of our loan and investment portfolios and other factors. Failure to maintain such higher capital expectations could result in a lower composite regulatory rating, which would impact our deposit insurance premiums and could affect our ability to borrow and costs of borrowing, and could result in additional or more severe enforcement actions. In respect of institutions with high concentrations of loans in areas deemed to be higher risk, or during periods of significant economic stress, regulators may require an institution to maintain a higher level of capital, and/or to maintain more stringent risk management measures, than those required by these regulations.

Prompt Corrective Action. Under Section 38 of the FDIA, each federal banking agency is required to implement a system of prompt corrective action for institutions that it regulates. The federal banking agencies have promulgated substantially similar regulations for this purpose. The following capital requirements currently apply to the Bank for purposes of Section 38.

An institution generally must file a written capital restoration plan which meets specified requirements with the appropriate federal banking agency within 45 days of the date the institution receives notice or is deemed to have notice that it is undercapitalized, significantly undercapitalized or critically undercapitalized. The appropriate federal banking agency must provide the institution with written notice of approval or disapproval within 60 days after receiving a capital restoration plan, subject to extensions by the applicable agency.

Immediately upon becoming undercapitalized, an institution will become subject to the provisions of Section 38 of the FDIA, which (i) restrict payment of capital distributions and management fees; (ii) require that the appropriate federal banking agency monitor the condition of the institution and its efforts to restore its capital; (iii) require submission of a capital restoration plan; (iv) restrict the growth of the institution's assets; and (v) require prior approval of certain expansion proposals. The appropriate federal banking agency for an undercapitalized institution also may take any number of discretionary supervisory actions if the agency determines that any of these actions is necessary to resolve the problems of the institution at the least possible long-term cost to the Deposit Insurance Fund, subject in certain cases to specified procedures. These discretionary supervisory actions include: requiring the institution to raise additional capital; restricting transactions with affiliates; requiring divestiture of the institution or the sale of the institution to a willing purchaser; and any other supervisory action that the agency deems appropriate. These and additional mandatory and permissive supervisory actions may be taken with respect to significantly undercapitalized and critically undercapitalized institutions.

Regulatory Enforcement Authority. Federal banking law grants substantial enforcement powers to the federal banking agencies. This enforcement authority includes, among other things, the ability to assess civil money penalties, to issue cease-and-desist or removal orders and to initiate injunctive actions against banking organizations and institution-affiliated parties. In general, these enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices. Other actions or inactions may provide the basis for enforcement action, including misleading or untimely reports filed with regulatory authorities.

The Dodd-Frank Act. The Dodd-Frank Act was signed into law on July 21, 2010. The Dodd-Frank Act significantly restructured the financial regulatory regime in the United States and has had a broad impact on the financial services industry as a result of the significant regulatory and compliance changes required under the act.

The Economic Growth, Regulatory Relief and Consumer Protection Act ("EGRRCPA"), which became effective May 24, 2018, amended the Dodd-Frank Act to provide regulatory relief for certain smaller and regional financial institutions, such as the Company and the Bank. The EGRRCPA, among other things, provides financial institutions with

15

Table of Contents

less than $10 billion in total consolidated assets with relief from certain capital requirements and exempts banks with less than $250 billion in total consolidated assets from the enhanced prudential standards and the company-run and supervisory stress tests required under the Dodd-Frank Act.

The Dodd-Frank Act has had, and may in the future have, a material impact on the Company’s operations, particularly through increased compliance costs resulting from new and possible future consumer and fair lending regulations. The future changes resulting from the Dodd-Frank Act may affect the profitability of business activities, require changes to certain business practices, impose more stringent regulatory requirements, or otherwise adversely affect the business and financial condition of the Company and the Bank. These changes may also require the Company to invest significant management attention and resources to evaluate and make necessary changes to comply with new statutory and regulatory requirements.

Consumer Financial Protection Bureau ("CFPB"). The Dodd-Frank Act created the CFPB, a new, independent federal agency with broad rulemaking, supervisory and enforcement powers under various federal consumer financial protection laws, including the Equal Credit Opportunity Act, Truth in Lending Act, Real Estate Settlement Procedures Act, Fair Credit Reporting Act, Fair Debt Collection Practices Act, the consumer financial privacy provisions of the GLB Act and certain other statutes. The CFPB has examination and primary enforcement authority with respect to depository institutions with over $10 billion in assets. Smaller institutions, including the Bank, are subject to rules promulgated by the CFPB but continue to be examined and supervised by federal banking agencies for compliance with federal consumer protection laws and regulations. The CFPB also has authority to prevent unfair, deceptive or abusive practices in connection with the offering of consumer financial products. The Dodd-Frank Act permits states to adopt consumer protection laws and standards that are more stringent than those adopted at the federal level and, in certain circumstances, permits state attorneys general to enforce compliance with both the state and federal laws and regulations.

The changes resulting from the Dodd-Frank Act and CFPB rulemakings and enforcement policies may impact the profitability of our business activities, limit our ability to make, or the desirability of making, certain types of loans, including non-qualified mortgage loans, require us to change our business practices, impose upon us more stringent capital, liquidity and leverage ratio requirements or otherwise adversely affect our business or profitability. The changes may also require us to dedicate significant management attention and resources to evaluate and make necessary changes to comply with the new statutory and regulatory requirements.

During 2025, the CFPB reduced its staff by over 80%. The reduction in force is the subject of litigation, and the staffing cuts are currently stayed pending the federal circuit court’s rehearing of the case. The impact of these developments on banking organizations is uncertain. States and state attorneys general may increase regulatory, investigative and enforcement activity with respect to consumer protection, in response to changes in regulation, supervision and enforcement of consumer protection laws by federal regulators.

Notwithstanding ongoing, legal, budgetary and structural challenges affecting the CFPB, the CFPB remains an active federal regulatory agency with continuing supervisory and enforcement authority and retains its broad authority to pursue enforcement actions, including investigations, civil actions and cease and desist proceedings. The Bank is also subject to other federal and state consumer protection laws and regulations that, among other things, prohibit unfair, deceptive and abusive, corrupt or fraudulent business practices, untrue or misleading advertising and unfair competition. In February 2025, the Trump administration halted the CFPB’s operations, and its employees were instructed to cease all supervision and examination activity. As a result, the future of the CFPB and its impact on our business are uncertain.

Mortgage Banking Regulation. The Bank is subject to rules and regulations related to mortgage loans that, among other things, establish standards for loan origination, prohibit discrimination, provide for inspections and appraisals of property, require credit reports on prospective borrowers, in some cases restrict certain loan features and fix maximum interest rates and fees, require the disclosure of certain basic information to mortgagors concerning credit and settlement costs, limit payment for settlement services to the reasonable value of the services rendered and require the maintenance and disclosure of information regarding the disposition of mortgage applications based on race, gender, geographical distribution and income level. The Bank is also subject to rules and regulations that require the collection and reporting of significant amounts of information with respect to mortgage loans and borrowers. The Bank’s mortgage origination activities are subject to the Federal Reserve’s Regulation Z, which implements the Truth in Lending Act. Certain provisions of Regulation Z require creditors to make a reasonable and good faith determination based on verified and documented information that a consumer applying for a mortgage loan has a reasonable ability to repay the loan according to its terms. To the extent that we make mortgage loans, we are required to comply with these rules, subject to available exceptions.

16

Table of Contents

Fair and Responsible Banking. Banks and other financial institutions are subject to numerous laws and regulations intended to promote fair and responsible banking and prohibit unlawful discrimination and unfair, deceptive or abusive practices in banking. These laws include, among others, the Dodd-Frank Act, Section 5 of the Federal Trade Commission Act, the Equal Credit Opportunity Act, and the Fair Housing Act. Many states and local jurisdictions have consumer protection laws analogous, and in addition, to those listed above. These federal, state and local laws regulate the manner in which financial institutions deal with customers taking deposits, making loans or conducting other types of transactions. Failure to comply with these laws and regulations could give rise to regulatory sanctions, and actions by the U.S. Department of Justice and state attorneys general.

Fair Access to Financial Services. In August 2025, President Trump signed Executive Order 14331, “Guaranteeing Fair Banking Access for All Americans,” which states that it is the policy of the United States that no American should be denied access to financial services because of their constitutionally or statutorily protected beliefs, affiliations, or political views. The Executive Order directs the Treasury Secretary and federal banking regulators to address politicized or unlawful debanking activities. In recent years, certain states have also enacted, or have proposed to enact, statutes, regulations or policies that prohibit financial institutions from denying or canceling products or services to a person or business, or otherwise discriminating against a person or business in making available products or services, on the basis of certain social or political factors or other activities.

Financial Privacy. Under the Federal Right to Privacy Act of 1978, which imposes a duty to maintain confidentiality of consumer financial records and prescribes procedures for complying with administrative subpoenas of financial records, financial institutions are required to disclose their policies for collecting and protecting confidential information. Consumers generally may prevent financial institutions from sharing personal financial information with nonaffiliated third parties except for third parties that market the institutions' own products and services. Additionally, financial institutions generally may not disclose consumer account numbers to any nonaffiliated third party for use in telemarketing, direct mail marketing or other marketing through electronic mail to consumers.

In October 2024, the CFPB issued a final rule regarding personal financial data rights that is designed to promote “open banking.” The final rule requires, among other things, that data providers, including any financial institution, make available to consumers and certain authorized third parties, upon request, certain covered transaction, account, and payment information. Institutions with at least $1.5 billion but less than $3 billion in total assets, including the Company, were required to comply with the final rule by April 1, 2029. On the same day the final rule was released, certain industry participants filed a complaint against the CFPB challenging the final rule. This legal challenge has since been paused to allow time for the CFPB to assess the rule and determine whether it aligns with the agency’s current policy objectives.

Community Reinvestment Act ("CRA"). The CRA requires that, in connection with examinations of insured depository institutions within their respective jurisdictions, the federal banking agencies evaluate the record of each financial institution in meeting the needs of its local community, including low- and moderate-income neighborhoods. The Bank's record of performance under the CRA is publicly available. A bank's CRA performance is also considered in evaluating applications seeking approval for mergers, acquisitions, and new offices or facilities. Failure to adequately meet these criteria could result in additional requirements and limitations being imposed on the Bank. Additionally, we must publicly disclose the terms of certain CRA-related agreements.

On October 24, 2023, the federal bank regulatory agencies issued a final rule to modernize their respective CRA regulations. The revised rules would have substantially altered the methodology for assessing compliance with the CRA, and likely would have made it more challenging and/or costly for the Bank to maintain its “satisfactory” rating. Following its finalization on March 29, 2024, the 2023 modernization rule became subject to an ongoing injunction. On July 16, 2025, the federal bank regulatory agencies issued a joint proposal to rescind the 2023 modernization rule. The agencies continue to apply the CRA rules as they existed before the 2023 modernization, considering the injunction and pending finalization of the rescission of the modernization rule.

Concentration and Risk Guidance. The federal bank regulatory agencies have issued guidance governing financial institutions with concentrations in commercial real estate lending. The guidance provides that institutions that have (i) total reported loans for construction, land development, and other land which represent 100% or more of an institution's total risk-based capital; or (ii) total reported commercial real estate loans, excluding loans secured by owner-occupied commercial real estate, representing 300% or more of the institution's total risk-based capital and the institution's commercial real estate loan portfolio has increased 50% or more during the prior 36 months, are identified as having potential commercial real estate concentration risk. Institutions that are deemed to have concentrations in commercial real estate lending are expected to employ heightened levels of risk management with respect to their commercial real estate portfolios, and may be required to hold higher levels of capital. We have determined that we have a concentration in

17

Table of Contents

commercial real estate lending, and while we believe we have implemented policies and procedures with respect to our commercial real estate lending consistent with the regulatory guidance, bank regulators could require us to implement additional policies and procedures consistent with their interpretation of the guidance that may result in additional costs to us.

FDIC Insurance Premiums. The deposits of the Bank are insured up to applicable limits by the FDIC’s Deposit Insurance Fund and are subject to deposit insurance assessments to maintain the Deposit Insurance Fund. The deposit insurance assessment base is based on average total assets minus average tangible equity, pursuant to a rule issued by the FDIC as required by the Dodd-Frank Act. Deposit insurance pricing is a “financial ratios method” based on “CAMELS” composite ratings to determine assessment rates for small established institutions with less than $10 billion in assets. The CAMELS rating system is a supervisory rating system designed to take into account and reflect all financial and operational risks that a bank may face, including capital adequacy, asset quality, management capability, earnings, liquidity, and sensitivity to market risk (“CAMELS”). CAMELS composite ratings set a maximum assessment for CAMELS 1 and 2 rated banks, and set minimum assessments for lower rated institutions. For the years ended December 31, 2025 and 2024, the Bank recorded $1.1 million and $1.3 million, respectively, for FDIC insurance premiums.

Limitations on Incentive Compensation. The federal bank regulatory agencies have issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of financial institutions do not undermine the safety and soundness of such institutions by encouraging excessive risk-taking. The Interagency Guidance on Sound Incentive Compensation Policies, which covers all employees that have the ability to materially affect the risk profile of financial institutions, either individually or as part of a group, is based upon the key principles that a financial institution’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the institution’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the financial institution’s board of directors.

The Federal Reserve will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of financial institutions, such as the Company and the Bank, that are not “large, complex banking organizations.” These reviews will be tailored to each financial institution based on the scope and complexity of the institution’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the institution’s supervisory ratings, which can affect the institution’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a financial institution if its incentive compensation arrangements or related risk-management control or governance processes pose a risk to the institution’s safety and soundness, and the financial institution is not taking prompt and effective measures to correct the deficiencies. At December 31, 2025, the Company and the Bank have not been made aware of any instances of noncompliance with this guidance.

The Nasdaq Stock Market, LLC, the exchange on which our common stock is listed, enacted a listing rule that became effective in 2023 requiring listed companies to adopt policies mandating the recovery or “clawback” of excess incentive compensation earned by a current or former executive officer during the three fiscal years preceding the date the listed company is required to prepare an accounting restatement, including to correct an error that would result in a material misstatement if the error were corrected in the current period or left uncorrected in the current period. The Company has adopted a clawback policy compliant with such rule. A copy of the Company’s clawback policy is included as Exhibit 97 to this Annual Report on 10 K.

Cybersecurity. In March 2015, federal regulators issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. The other statement indicates that a financial institution's management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption, and maintenance of the institution's operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties. On November 18, 2021, the federal bank regulatory agencies issued a final rule, effective April 1, 2022, imposing new notification requirements for cybersecurity incidents. The rule requires financial institutions to notify their primary federal regulator as soon as possible and no later than 36 hours after the institution determines that a cybersecurity incident has occurred that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the institution’s: (i) ability to carry out

18

Table of Contents

banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base in the ordinary course of business, (ii) business line(s), including associated operations, services, functions, and support, that upon failure would result in a material loss of revenue, profit, or franchise value, or (iii) operations, including associated services, functions and support, as applicable, the failure or discontinuance of which would pose a threat to the financial stability of the United States.

On July 26, 2023, the SEC issued a final rule requiring enhanced standardized disclosures regarding cybersecurity risk management, strategy, governance, and cybersecurity incident reporting by public companies, such as the Company, that are subject to the reporting requirements of the Securities Exchange Act of 1934 (the "Exchange Act"). The final rule requires current reporting about material cybersecurity incidents and periodic disclosures about policies and procedures to identify and manage cybersecurity risks, management’s role in implementing cybersecurity policies and procedures, and the board of directors’ cybersecurity expertise and its oversight of cybersecurity risk.

To date, we have not experienced a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, but our systems and those of our customers and third-party service providers are under constant threat and it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of digital banking, mobile banking and other technology-based products and services by us and our customers.

Artificial Intelligence. CFPB and other federal regulatory guidance reiterates that creditors are not excused from the adverse action notice requirements under the Equal Credit Opportunity Act if they rely on complex algorithmic underwriting models. States have also started to regulate the use of artificial intelligence technologies. In July 2024, the federal banking agencies issued a final rule that requires, among other things, financial institutions to ensure that their automated valuation models for property valuation follow certain quality control standards, including a requirement that such valuation models comply with nondiscrimination laws.