FIRST NATIONAL CORP /VA/ (FXNC) Business

Item 1. Business

General

First National Corporation (the Company) is a bank holding company incorporated under Virginia law on September 7, 1983. The Company owns all of the stock of its primary operating subsidiary, First Bank (the Bank), which is a commercial bank chartered under Virginia law. The Company’s subsidiaries are:

First Bank Financial Services, Inc. owns an interest in an entity that provides title insurance services. Shen-Valley Land Holdings, LLC was formed to hold other real estate owned and future office sites. McKenney Group, LLC owns an interest in a now inactive entity that previously provided insurance services. The Trusts were formed for the purpose of issuing redeemable capital securities, commonly known as trust preferred securities and are not included in the Company’s consolidated financial statements in accordance with authoritative accounting guidance because management has determined that the Trusts qualify as variable interest entities.

The Bank first opened for business on July 1, 1907, under the name The Peoples National Bank of Strasburg. On January 10, 1928, the Bank changed its name to The First National Bank of Strasburg. On April 12, 1994, the Bank received approval from the Federal Reserve Bank of Richmond and the Virginia State Corporation Commission’s Bureau of Financial Institutions to convert to a state chartered bank with membership in the Federal Reserve System. On June 1, 1994, the Bank consummated such conversion and changed its name to First Bank.

In March of 2025 two previously held subsidiaries of the Company, Bank of Fincastle Services, Inc. and ESF, LLC, were closed with no material impact to the financials related to the closures.

Revenue Sources and Expense Factors

The primary source of revenue is from net interest income earned by the Bank. Net interest income is the difference between interest income and interest expense and currently represents the largest component of the Company’s total revenue. Interest income is determined by the amount of interest-earning assets outstanding during the period and the interest rates earned on those assets. The Bank’s interest expense is a function of the amount of interest-bearing liabilities outstanding during the period and the interest rates paid. In addition to net interest income, noninterest income is the other source of revenue for the Company. Noninterest income is derived primarily from service charges on deposits, fee income from wealth management services, and ATM and check card fees.

Primary expense categories are salaries and employee benefits, which comprised 51% of noninterest expenses during 2025, followed by other operating expenses, which comprised 12% of noninterest expenses. The provision for credit losses is also a primary expense of the Bank. The provision is determined by factors that include net charge-offs, asset quality, loan growth, evaluation of the size and current risk characteristics of the loan portfolio, past events, current conditions, reasonable and supportable forecasts of future economic conditions, and prepayment experience. Changing economic conditions caused by inflation, recession, unemployment, or other factors beyond the Company’s control have a direct correlation with asset quality, net charge-offs, and ultimately the required provision for credit losses.

Products and Services

The Bank offers loan, deposit, and wealth management products and services. Loan products and services include consumer loans, residential mortgages, home equity loans, and commercial loans. Deposit products and services include checking accounts, treasury management solutions, savings accounts, money market accounts, certificates of deposit, and individual retirement accounts. Wealth management services include estate planning, investment management of assets, trustee under an agreement, trustee under a will, individual retirement accounts, and estate settlement. Customers include small and medium-sized businesses, individuals, estates, local governmental entities, and non-profit organizations. The Bank’s office locations are well-positioned in attractive markets along the Interstate 81, Interstate 66, and Interstate 64 corridors in the Shenandoah Valley, the Roanoke Valley, and the south-central region of Virginia, including the Richmond MSA and northern North Carolina. Within this market area, there are diverse types of industry including medical and professional services, manufacturing, retail, warehousing, government, hospitality, and higher education.  The Bank’s products and services are delivered through 33 bank branch offices, one loan production office, and a customer service center in a retirement community.  For the location and general character of each of these offices, see Item 2 of this Form 10-K. Many of the Bank’s services are also delivered through the Bank’s mobile banking platform, its website, www.fbvirginia.com, and a network of ATMs located throughout its market area.

4

Table of Contents

Competition

The financial services industry remains highly competitive and is constantly evolving. The Company experiences strong competition in all aspects of its business. In its market areas, the Company competes with large national and regional financial institutions, credit unions, other community banks, as well as consumer finance companies, mortgage companies, marketplace lenders and other financial technology firms, mutual funds and life insurance companies. Competition for deposits and loans is affected by various factors including interest rates offered, the number and location of branches and types of products offered, and the reputation of the institution. Credit unions have been allowed to increasingly expand their membership definitions and, because they enjoy a favorable tax status, may be able to offer more attractive loan and deposit pricing.

In addition, the financial services industry continues to undergo rapid technological change with introductions of new technologies and services, including new ways that customers can make payments or manage their accounts, including through use of stablecoins and other forms of cryptocurrency, tokens, and other digital assets or alternative payment systems.

The Company's primary operating subsidiary, First Bank, believes its competitive advantages include long-term customer relationships, a commitment to excellent customer service, dedicated and loyal employees, and the support of and involvement in the communities that the Company serves. The Company focuses on providing products and services to individuals, small to medium-sized businesses, non-profit organizations, and local governmental entities within its communities.

No material part of the business of the Company is dependent upon a single or a few customers, and the loss of any single customer would not have a materially adverse effect upon the business of the Company.

Employees

At December 31, 2025, the Bank employed a total of 308 full-time equivalent employees. The Company considers relations with its employees to be excellent.

SUPERVISION AND REGULATION

Bank holding companies and banks are extensively and increasingly regulated under both federal and state laws. The following description briefly addresses certain historic and current provisions of federal and state laws and regulations, proposed regulations, and the potential impacts on the Company and the Bank. To the extent statutory or regulatory provisions or proposals are described in this report, the description is qualified in its entirety by reference to the particular statutory or regulatory provisions or proposals.

5

Table of Contents

The Company

General. As a bank holding company registered under the Bank Holding Company Act of 1956 (the BHCA), the Company is subject to supervision, regulation, and examination by the Board of Governors of the Federal Reserve System (the Federal Reserve). The Company is also registered under the bank holding company laws of Virginia and is subject to supervision, regulation, and examination by the Virginia State Corporation Commission (the SCC).

Permitted Activities. A bank holding company is limited to managing or controlling banks, furnishing services to or performing services for its subsidiaries, and engaging in other activities that the Federal Reserve determines by regulation or order to be so closely related to banking or managing or controlling banks as to be a proper incident thereto. In determining whether a particular activity is permissible, the Federal Reserve must consider whether the performance of such an activity reasonably can be expected to produce benefits to the public that outweigh possible adverse effects. Possible benefits include greater convenience, increased competition, and gains in efficiency. Possible adverse effects include undue concentration of resources, decreased or unfair competition, conflicts of interest, and unsound banking practices. Despite prior approval, the Federal Reserve may order a bank holding company or its subsidiaries to terminate any activity or to terminate ownership or control of any subsidiary when the Federal Reserve has reasonable cause to believe that a serious risk to the financial safety, soundness or stability of any bank subsidiary of that bank holding company may result from such an activity.

Banking Acquisitions; Changes in Control. The BHCA requires, among other things, the prior approval of the Federal Reserve in any case where a bank holding company proposes to (i) acquire direct or indirect ownership or control of more than 5% of the outstanding voting stock of any bank or bank holding company (unless it already owns a majority of such voting shares), (ii) acquire all or substantially all of the assets of another bank or bank holding company, or (iii) merge or consolidate with any other bank holding company. In determining whether to approve a proposed bank acquisition, the Federal Reserve will consider, among other factors, the effect of the acquisition on competition, the public benefits expected to be received from the acquisition, the projected capital ratios and levels on a post-acquisition basis, and the acquiring institution’s performance under the Community Reinvestment Act of 1977 (the CRA).

Subject to certain exceptions, the BHCA and the Change in Bank Control Act, together with the applicable regulations, require Federal Reserve approval (or, depending on the circumstances, no notice of disapproval) prior to any person or company’s acquiring “control” of a bank or bank holding company. A conclusive presumption of control exists if an individual or company acquires the power, directly or indirectly, to direct the management or policies of an insured depository institution or to vote 25% or more of any class of voting securities of any insured depository institution. A rebuttable presumption of control exists if a person or company acquires 10% or more but less than 25% of any class of voting securities of an insured depository institution and either the institution has registered securities under Section 12 of the Securities Exchange Act of 1934 (the Exchange Act) or no other person will own a greater percentage of that class of voting securities immediately after the acquisition. The Company’s common stock is registered under Section 12 of the Exchange Act.

Source of Strength. Federal Reserve policy has historically required bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. The Dodd-Frank Wall Street Reform and Consumer Protection Act (the Dodd-Frank Act) codified this policy as a statutory requirement. Under this requirement, the Company is expected to commit resources to support the Bank, including at times when the Company may not be in a financial position to provide such resources. Any capital loans by a bank holding company to any of its subsidiary banks are subordinate in right of payment to depositors and to certain other indebtedness of such subsidiary banks. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Safety and Soundness. There are a number of obligations and restrictions imposed on bank holding companies and their subsidiary banks by law and regulatory policy that are designed to minimize potential loss to the depositors of such depository institutions and the Federal Deposit Insurance Corporation (FDIC) insurance fund in the event of a depository institution default. For example, under the Federal Deposit Insurance Company Improvement Act of 1991 (FDICIA), to avoid receivership of an insured depository institution subsidiary, a bank holding company is required to guarantee the compliance of any subsidiary bank that may become “undercapitalized” with the terms of any capital restoration plan filed by such subsidiary with its appropriate federal bank regulatory agency up to the lesser of (i) an amount equal to 5% of the institution’s total assets at the time the institution became undercapitalized, or (ii) the amount that is necessary (or would have been necessary) to bring the institution into compliance with all applicable capital standards as of the time the institution fails to comply with such capital restoration plan.

6

Table of Contents

Under the Federal Deposit Insurance Act (the FDIA), the federal bank regulatory agencies have adopted guidelines prescribing safety and soundness standards. These guidelines establish general standards relating to internal controls and information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth and compensation, fees and benefits. In general, the guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines.

FDICIA, implemented through FDIC regulations (12 CFR Part 363), imposes annual audit and reporting requirements on insured depository institutions with total assets above certain thresholds to promote early identification of financial management issues. These requirements focus on audited financial statements, management’s responsibilities, and Internal Control over Financial Reporting (ICFR) assessments. On November 25, 2025, the FDIC officially adopted amendments to 12 CFR Part 363, effective January 1, 2026, to update certain regulatory thresholds that govern audit and reporting requirements. The Company will continue to provide management's attestation of effectiveness of FDICIA controls at the increased asset threshold of greater than $1 billion. Independent external auditor attestation on ICFR increased from $1 billion to $5 billion or more in assets.

Capital Requirements. Pursuant to the Small Bank Holding Company and Savings and Loan Holding Company Policy Statement, qualifying bank holding companies with total consolidated assets of less than $3 billion, such as the Company, are not subject to consolidated regulatory capital requirements. Certain capital requirements applicable to the Bank are described below under “The Bank-Capital Requirements”. Subject to its capital requirements and certain other restrictions, the Company is able to borrow money to make a capital contribution to the Bank, and such loans may be repaid from dividends paid by the Bank to the Company.

Limits on Dividends and Other Payments. The Company is a legal entity, separate and distinct from its subsidiaries. A significant portion of the revenues of the Company result from dividends paid to it by the Bank. There are various legal limitations applicable to the payment of dividends by the Bank to the Company and to the payment of dividends by the Company to its shareholders. The Bank is subject to various statutory restrictions on its ability to pay dividends to the Company. Under the current supervisory practices of the Bank’s regulatory agencies, prior approval from those agencies is required if cash dividends declared in any given year exceed net income for that year, plus retained net profits of the two preceding years. The payment of dividends by the Bank or the Company may be limited by other factors, such as requirements to maintain capital above regulatory guidelines. Bank regulatory agencies have the authority to prohibit the Bank or the Company from engaging in an unsafe or unsound practice in conducting their business. The payment of dividends, depending on the financial condition of the Bank, or the Company, could be deemed to constitute such an unsafe or unsound practice. In addition, under the current supervisory practices of the Federal Reserve, the Company should inform and consult with its regulators reasonably in advance of declaring or paying a dividend that exceeds earnings for the period (e.g., quarter) for which the dividend is being paid or that could result in a material adverse change to the Company's capital structure.

The Company’s subordinated debt is senior in right of payment compared to its common stock and all current and future junior subordinated debt obligations. Following the occurrence of any event of default on its subordinated debt, the Company may not make any payments on its junior subordinated debt; declare or pay any dividends on its common stock; redeem or otherwise acquire any of its common stock; or make any other distributions with respect to its common stock or set aside any monies or properties for such purposes. The Company is current in its interest payments on subordinated debt.

The Company's ability to pay dividends on common stock is also limited by contractual restrictions under its junior subordinated debt. Interest must be paid on the junior subordinated debt before dividends may be paid to common shareholders. The Company is current in its interest payments on junior subordinated debt; however, it has the right to defer distributions on its junior subordinated debt, during which time no dividends may be paid on its common stock. If the Company does not have sufficient earnings in the future and begins to defer distributions on the junior subordinated debt, it will be unable to pay dividends on its common stock until it becomes current on those distributions.

The Bank

General. The Bank is supervised and regularly examined by the Federal Reserve Bank of Richmond and the Virginia State Corporation Commissions's Bureau of Financial Institutions. The various laws and regulations administered by the regulatory agencies affect corporate practices, such as the payment of dividends, incurrence of debt, and acquisition of financial institutions and other companies; they also affect business practices, such as the payment of interest on deposits, the charging of interest on loans, types of business conducted, and location of offices. Certain of these law and regulations are referenced above under “The Company.”

Capital Requirements. The Federal Reserve and the other federal banking agencies have issued risk-based and leverage capital guidelines applicable to U.S. banking organizations. In addition, those regulatory agencies may from time to time require that a banking organization maintain capital above the minimum levels because of its financial condition or actual or anticipated growth.

7

Table of Contents

The minimum capital level requirements applicable to the Bank under the rules are as follows: a common equity Tier 1 capital ratio of 4.5%; a Tier 1 capital ratio of 6%; a total capital ratio of 8%; and a Tier 1 leverage ratio of 4% for all institutions. The final rules also established a “capital conservation buffer” above the new regulatory minimum capital requirements of 2.5% of risk-weighted assets. This resulted in the following minimum capital ratios beginning in 2019: a common equity Tier 1 capital ratio of 7.0%, a Tier 1 capital ratio of 8.5%, and a total capital ratio of 10.5%. Under the rules, institutions are subject to limitations on paying dividends, engaging in share repurchases, and paying discretionary bonuses if its capital level falls below the buffer amount. These limitations establish a maximum percentage of eligible retained income that could be utilized for such actions. Management believes, as of December 31, 2025 and December 31, 2024, that the Bank met all capital adequacy requirements to which it is subject, including the capital conservation buffer.

The following table shows the Bank’s regulatory capital ratios at December 31, 2025:

The rules also contain revisions to the prompt corrective action framework, which is designed to place restrictions on insured depository institutions if their capital levels begin to show signs of weakness. Under the prompt corrective action requirements, which are designed to complement the capital conservation buffer, insured depository institutions are required to meet the following capital level requirements in order to qualify as “well capitalized:” a common equity Tier 1 capital ratio of 6.5%; a Tier 1 capital ratio of 8%; a total capital ratio of 10%; and a Tier 1 leverage ratio of 5%. The Bank met the requirements to qualify as "well capitalized" as of December 31, 2025 and December 31, 2024.

On September 17, 2019 the FDIC finalized a rule that introduced an optional simplified measure of capital adequacy for qualifying community banking organizations (i.e., the community bank leverage ratio (CBLR) framework), as required by the Economic Growth, Regulatory Relief and Consumer Protection Act (the Economic Growth Act). The CBLR framework is designed to reduce burden by removing the requirements for calculating and reporting risk-based capital ratios for qualifying community banking organizations that opt into the framework.

In order to qualify for the CBLR framework, a community banking organization must have a tier 1 leverage ratio greater than 9%, have less than $10 billion in total consolidated assets, and limited amounts of off-balance sheet exposures and trading assets and liabilities.  A qualifying community banking organization that opts into the CBLR framework and meets all requirements under the framework will be considered to have met the "well-capitalized" ratio requirements under the prompt corrective action regulations and will not be required to report or calculate risk-based capital. Although the Bank has not opted into the CBLR framework, it may opt into the CBLR framework in a future quarterly period.

On November 25, 2025 the Federal Reserve, the FDIC, and the Office of the Comptroller of the Currency proposed to lower the CBLR requirement from 9% to 8% and extend the length of time that a community banking organization can remain in the CBLR framework while not meeting all of the qualifying criteria from two quarters to four quarters. As the Bank has not opted into the CBLR framework, it does not expect any changes due to the proposal.

Deposit Insurance. Substantially all of the deposits of the Bank are insured up to applicable limits by the Deposit Insurance Fund (the DIF) of the FDIC and are subject to deposit insurance assessments to maintain the DIF. The deposit insurance assessment base is based on average total assets minus average tangible equity, pursuant to a rule issued by the FDIC as required by the Dodd-Frank Act.

The FDIA, as amended by the Federal Deposit Insurance Reform Act and the Dodd-Frank Act, requires the FDIC to set a ratio of deposit insurance reserves to estimated insured deposits of at least 1.35%.  On October 18, 2022, the FDIC adopted a final rule that increased base deposit insurance assessment rate schedules uniformly by 2 basis points beginning in the first quarterly assessment period of 2023. The increase was instituted to account for extraordinary growth in insured deposits during the first and second quarters of 2020, which caused a substantial decrease in the “reserve ratio” of the DIF to total industry deposits. The FDIC has indicated that the new assessment rate schedules will remain in effect until the DIF reserve ratio meets or exceeds 2 percent.

8

Table of Contents

FDIC deposit insurance assessments for insured institutions with less than $10 billion in assets that have been FDIC insured for at least five years (established small banks) are calculated based on risk-based assessments using examination rulings and financial modeling to better capture the risk that an established small bank poses to the DIF and to ensure that institutions that take on greater risks have higher assessments.

Transactions with Affiliates. Pursuant to Sections 23A and 23B of the Federal Reserve Act and Regulation W, the authority of the Bank to engage in transactions with related parties or “affiliates” or to make loans to insiders is limited. Loan transactions with an affiliate generally must be collateralized and certain transactions between the Bank and its affiliates, including the sale of assets, the payment of money or the provision of services, must be on terms and conditions that are substantially the same, or at least as favorable to the Bank, as those prevailing for comparable nonaffiliated transactions. In addition, the Bank generally may not purchase securities issued or underwritten by affiliates.

Loans to executive officers, directors or to any person who directly or indirectly, or acting through or in concert with one or more persons, owns, controls or has the power to vote more than 10% of any class of voting securities of a bank (a “10% Shareholder”), are subject to Sections 22(g) and 22(h) of the Federal Reserve Act and their corresponding regulations (Regulation O) and Section 13(k) of the Exchange Act relating to the prohibition on personal loans to executives (which exempts financial institutions in compliance with the insider lending restrictions of Section 22(h) of the Federal Reserve Act). Among other things, these loans must be made on terms substantially the same as those prevailing on transactions made to unaffiliated individuals and certain extensions of credit to those persons must first be approved in advance by a disinterested majority of the entire board of directors. Section 22(h) of the Federal Reserve Act prohibits loans to any of those individuals where the aggregate amount exceeds an amount equal to 15% of an institution’s unimpaired capital and surplus plus an additional 10% of unimpaired capital and surplus in the case of loans that are fully secured by readily marketable collateral, or when the aggregate amount on all of the extensions of credit outstanding to all of these persons would exceed the Bank’s unimpaired capital and unimpaired surplus. Section 22(g) of the Federal Reserve Act identifies limited circumstances in which the Bank is permitted to extend credit to executive officers.

Prompt Corrective Action. Immediately upon becoming “undercapitalized,” a depository institution becomes subject to the provisions of Section 38 of the FDIA, which: (i) restrict payment of capital distributions and management fees; (ii) require that the appropriate federal banking agency monitor the condition of the institution and its efforts to restore its capital; (iii) require submission of a capital restoration plan; (iv) restrict the growth of the institution’s assets; and (v) require prior approval of certain expansion proposals. The appropriate federal banking agency for an undercapitalized institution also may take any number of discretionary supervisory actions if the agency determines that any of these actions is necessary to resolve the problems of the institution at the least possible long-term cost to the DIF, subject in certain cases to specified procedures. These discretionary supervisory actions include: (i) requiring the institution to raise additional capital; (ii) restricting transactions with affiliates; (iii) requiring divestiture of the institution or the sale of the institution to a willing purchaser; and (iv) any other supervisory action that the agency deems appropriate. These and additional mandatory and permissive supervisory actions may be taken with respect to significantly undercapitalized and critically undercapitalized institutions. The Bank met the definition of “well capitalized” as of December 31, 2025.

Community Reinvestment Act. The Bank is subject to the requirements of the CRA. The CRA imposes on financial institutions an affirmative and ongoing obligation to meet the credit needs of the local communities, including low and moderate income neighborhoods. If the Bank receives a rating from the Federal Reserve of less than "satisfactory" under the CRA, restrictions on operating activities could be imposed.  The Federal Reserve assigned the Bank the rating of "satisfactory" at the most recent CRA examination.

Privacy Legislation. Several regulations issued by federal banking agencies also provide new protections against the transfer and use of customer information by financial institutions. A financial institution must provide to its customers information regarding its policies and procedures with respect to the handling of customers’ personal information. Each institution must conduct an internal risk assessment of its ability to protect customer information. These privacy provisions generally prohibit a financial institution from providing a customer’s personal financial information to unaffiliated parties without prior notice and approval from the customer.

9

Table of Contents

Anti-Money Laundering Laws and Regulations.  The Bank is subject to several federal laws that are designed to combat money laundering, terrorist financing, and transactions with persons, companies or foreign governments designated by U.S. authorities (AML laws). This category of laws includes the Bank Secrecy Act of 1970, the Money Laundering Control Act of 1986, the USA PATRIOT Act of 2001, and the Anti-Money Laundering Act of 2020.  The Anti-Money Laundering Act of 2020, the most sweeping anti-money laundering legislation in 20 years, requires various federal agencies to promulgate regulations implementing a number of its provisions.

The AML laws and their implementing regulations require insured depository institutions, broker-dealers, and certain other financial institutions to have policies, procedures, and controls to detect, prevent, and report money laundering and terrorist financing. The AML laws and their regulations also provide for information sharing, subject to conditions, between federal law enforcement agencies and financial institutions, as well as among financial institutions, for counter-terrorism purposes. Federal banking regulators are required, when reviewing bank holding company acquisition and bank merger applications, to take into account the effectiveness of the anti-money laundering activities of the applicants. To comply with these obligations, the Company has implemented appropriate internal practices, procedures, and controls.

Cybersecurity. The federal banking agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a financial institution’s board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services. The federal banking agencies expect financial institutions to establish lines of defense and ensure that their risk management processes also address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack. If the Bank fails to meet the expectations set forth in this regulatory guidance, it could be subject to various regulatory actions and any remediation efforts may require significant resources of the Bank. In addition, all federal and state bank regulatory agencies continue to increase focus on cybersecurity programs and risks as part of regular supervisory exams.

In November 2021, the federal banking agencies approved a final rule that requires banking organizations to notify their primary regulator within 36 hours of becoming aware of a “computer-security incident” that rises to the level of a “notification incident”, among other things, the rule also requires bank service providers to notify their banking organization customers as soon as possible after becoming aware of similar incidents.

Digital Assets. In July 2025, President Trump signed into law the Guiding and Establishing National Innovation for U.S. Stablecoins Act (the “GENIUS Act”), which establishes a regulatory framework for “payment stablecoins” and their issuers. The GENIUS Act permits payment stablecoins to be issued in the United States only by “permitted payment stablecoin issuers”, including the subsidiary of an insured depository institution such as the Bank. The GENIUS Act requires federal and state regulators to issue regulations on numerous topics to interpret and implement the act. The effect of the GENIUS Act on the Company and the Bank will depend on the final form of any regulations and cannot be predicted at this time. Digital assets activities are an area of significant focus for Congress, the current Presidential administration, and federal banking regulators. Any changes in law or in the Company’s or the Bank’s supervisory frameworks relating to digital assets cannot be predicted but may have a significant effect on the Company’s business.

Consumer Laws and Regulations. The Bank is also subject to certain consumer laws and regulations issued thereunder that are designed to protect consumers in transactions with banks. These laws include the Truth in Lending Act, the Truth in Savings Act, the Electronic Funds Transfer Act, the Expedited Funds Availability Act, the Equal Credit Opportunity Act, Real Estate Settlement Procedures Act, Home Mortgage Disclosure Act, the Fair Credit Reporting Act, the Fair Housing Act and the Dodd-Frank Act, among others. The laws and related regulations mandate certain disclosure requirements and regulate the manner in which financial institutions transact business with customers. The Bank must comply with the applicable provisions of these consumer protection laws and regulations as part of its ongoing customer relations.

Incentive Compensation. In June 2010, the federal banking agencies issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of financial institutions do not undermine the safety and soundness of such institutions by encouraging excessive risk-taking. The Interagency Guidance on Sound Incentive Compensation Policies, which covers all employees that have the ability to materially affect the risk profile of a financial institution, either individually or as part of a group, is based upon the key principles that a financial institution’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the institution’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by good corporate governance, including active and effective oversight by the financial institution’s board of directors.

The Federal Reserve will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of financial institutions, such as the Company, that are not “large, complex banking organizations.” These reviews will be tailored to each financial institution based on the scope and complexity of the institution’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the institution’s supervisory ratings, which can affect the institution’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a financial institution if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the institution’s safety and soundness and the financial institution is not taking prompt and effective measures to correct the deficiencies. At December 31, 2025, the Company had not been made aware of any instances of non-compliance with the guidance.

10

Table of Contents

Effect of Governmental Monetary Policies

The Company’s operations are affected not only by general economic conditions but also by the policies of various regulatory authorities. In particular, the Federal Reserve regulates money and credit conditions and interest rates to influence general economic conditions. These policies have a significant impact on overall growth and distribution of loans, investments and deposits; they affect interest rates charged on loans or paid for time and savings deposits. Federal Reserve monetary policies have had a significant effect on the operating results of commercial banks, including the Company, in the past and are expected to do so in the future.

Future Legislation and Regulation

Congress may enact legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of any proposed legislation could impact the regulatory structure under which the Company and the Bank operate and may significantly increase costs, impede the efficiency of internal business processes, require an increase in regulatory capital, require modifications to business strategy, and limit the ability to pursue business opportunities in an efficient manner. A change in statutes, regulations or regulatory policies applicable to the Company or the Bank are difficult to predict, and could have a material, adverse effect on the business, financial condition and results of operations of the Company and the Bank.

Filings with the SEC

The Company’s internet address is www.fbvirginia.com. The Company’s Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q and Current Reports on Form 8-K, and amendments to those reports, as filed with or furnished to the Securities and Exchange Commission (the SEC), are available free of charge at www.fbvirginia.com as soon as reasonably practicable after being filed with or furnished to the SEC. A copy of any of the Company’s filings will be sent, without charge, to any shareholder upon written request to: Brad E. Schwartz, Chief Financial Officer, at 112 West King Street, Strasburg, Virginia 22657. The information on the Company's website is not a part of, and is not incorporated into, this Annual Report on Form 10-K.