John Marshall Bancorp, Inc. (JMSB) Business

Item 1.Business

General Overview

John Marshall Bancorp, Inc. was organized as a Virginia corporation in 2016 to serve as the holding company for John Marshall Bank. The Company and the Bank are each headquartered in Reston, Virginia (approximately 20 miles west of Washington, D.C.). The Company commenced operations as a bank holding company on March 1, 2017 following a reorganization transaction in which it became the Bank’s holding company. This transaction was treated as an internal reorganization as all shareholders of the Bank became shareholders of the Company. As a bank holding company, the Company is subject to regulation and supervision by the Federal Reserve. The Company has no material operations other than its sole ownership of the Bank. The Bank is a Virginia chartered commercial bank that commenced operations in 2006. The Bank is supervised and regulated by the Federal Reserve and the Bureau of Financial Institutions of the Virginia State Corporation Commission (the “Virginia BFI”).

We primarily serve small to medium-sized businesses, their owners and employees, professional corporations, non-profits and individuals with a broad range of banking products and financial services. Some of the products and services that we offer include commercial checking, savings and money market accounts, certificates of deposit, treasury and cash management services, commercial and industrial loans, commercial real estate loans, residential and commercial construction and development loans, U.S. Small Business Administration (“SBA”) 7(a) loans, consumer mortgages, online banking, and mobile banking. As of December 31, 2025, we had total consolidated assets of $2.33 billion, gross loans of $1.97 billion, total deposits of $1.97 billion and total shareholders’ equity of $265.6 million.

Market Area

A key factor in our ability to achieve our strategic goals and create shareholder value is the attractiveness of our market area. The market area in which we operate has seen considerable population and economic growth over the past several decades. Recent economic data suggest that the relative economic strength of our market area will continue, enabling us to grow our customer base and find opportunities to grow our market share.

The Bank’s primary service area includes Arlington, Fairfax, Loudoun and Prince William counties in Virginia, Montgomery County in Maryland and the District of Columbia. The Bank has eight full service branch offices located in these contiguous cities or counties.

Our primary service area comprises the majority of the population and household income of the Washington-Arlington-Alexandria, DC-VA-MD-WV (“Washington, D.C.”) Metropolitan Statistical Area (“MSA”). The Washington, D.C. MSA, according to U.S. Bureau of Economic Analysis data, ranked sixth among all MSAs for 2023 gross domestic product. According to data sourced from S&P Global Market Intelligence, among the largest MSAs ranked by gross domestic product (New York, Los Angeles, Chicago, San Francisco, Dallas and Washington), the Washington, D.C. MSA ranked second for 2025 median household income at $123,209, second in 2026 to 2031 projected population growth at 2.8% and first in the percentage of inhabitants 25 or older with a bachelor’s degree or higher educational attainment at 55.4%. According to the U.S. Bureau of Labor Statistics, the Washington, D.C. MSA’s December 2025 unemployment rate was 4.5%, less than the average of six largest MSAs.

Based upon Federal Deposit Insurance Corporation (the “FDIC”) data as of June 30, 2025, the Washington D.C. MSA housed $315 billion of deposits, with the top five financial institutions controlling 68%. At June 30, 2025, our deposits were $1.90 billion, ranked 17th in the MSA and represented a 0.6% market share. Nine of the sixteen banks ranked ahead of the Company are headquartered outside of the Washington, D.C. MSA. Our market area has experienced a significant degree of banking consolidation over the last several decades. Since the Company’s inception, banking assets in excess of $55 billion have been acquired. We believe that as financial institutions are merged with or acquired by remote, larger institutions, their customers can become further removed from the point of decision making. The consolidation trend provides an opportunity for the Company to execute a focused strategy of offering personalized services to attract potential customers who are underserved or dissatisfied.

4

Table of Contents

Given the Company’s proximity to Washington, D.C., the federal government has contributed to the growth and generally played a stabilizing role in our market area’s economy. In recent years, local governments have made great strides in diversifying their local economies. Virginia Tech selected the City of Alexandria as the site for its innovation campus which aims to graduate 25,000 new bachelor’s and master’s students in computer science and related fields over the next 20 years.  The innovation campus opened February 28, 2025.  The $1 billion, 600,000 square foot campus is expected to confer over 600 graduate degrees annually and provide talent to spur further technological growth. By 2030, Amazon’s headquarters in Arlington County is expected to occupy at least four million square feet of office space. Phase one of Amazon’s HQ2 was completed in the spring 2023.  Amazon will invest more than $2 billion to establish its new headquarters, which will create at least 25,000 high-wage jobs by 2030.  Fairfax County is home to ten Fortune 500 company headquarters and 17 Fortune 1000 company headquarters. Loudoun County is known as “data center alley” as it has the world’s highest concentration of data centers with more than 30 million square feet of data center space. Loudoun County is home to more than 3,500 technology companies.  Prince William County has partnered with George Mason University to found the Prince William Science Accelerator, a fast-growing biotechnology cluster to foster the study of life sciences.

​

We believe the size, growth, economic diversity and banking consolidation within the Washington, D.C. MSA, when combined with our business strategy, provide us with excellent opportunities for long-term, sustainable growth.

Strengths

We believe that we are well-positioned to execute our banking strategy as a result of our competitive strengths:

5

Table of Contents

Business Strategy

The Company’s goal is to enhance its franchise and shareholder value by achieving significant growth in assets and profitability while maintaining strong asset quality and providing exceptional customer experiences. We embrace innovation and provide value-added solutions our customers need and expect. We intend to execute on this goal by focusing on the following objectives:

6

Table of Contents

Competition

The banking business is highly competitive, and we face competition in our market area from many other local, regional, and national financial institutions. Competition among financial institutions is based on interest rates offered on deposit accounts, interest rates charged on loans, other credit and service charges relating to loans, the quality and scope of the services rendered, the convenience of banking services, and, in the case of loans to commercial borrowers, relative lending limits. We compete with commercial banks, credit unions, savings institutions, mortgage banking firms, finance companies, including “fintech” companies, securities brokerage firms, insurance companies, money market funds and other mutual funds, as well as regional and national financial institutions that operate offices in our market area and elsewhere. The competing major commercial banks have greater resources that may provide them a competitive advantage by enabling them to maintain numerous branch offices, mount extensive advertising campaigns and invest in new technologies. The increasingly competitive environment is the result of changes in regulation, changes in technology and product delivery systems, additional financial service providers, and the accelerating pace of consolidation among financial services providers.

The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. Banks, securities firms and insurance companies can merge under the umbrella of a financial holding company, which can offer most types of financial services, including banking, securities underwriting and insurance. Also, technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems.

Some of our non-banking competitors, such as fintech companies, have fewer regulatory constraints and may have lower cost structures. In addition, some of our competitors have assets, capital and lending limits greater than that of the Bank, have greater access to capital markets and can offer a broader range of products and services than the Bank. These institutions may have the ability to finance wide-ranging advertising campaigns and may also be able to offer lower rates on loans and higher rates on deposits than we can offer.

We compete with these institutions by focusing on our position as an independent, commercial business bank and rely upon relationships established by our officers, directors, and employees with our customers, promotional activities and specialized services tailored to meet the needs of the customers we serve. We strive to provide innovative products to our

7

Table of Contents

customers that are value-driven. We actively cultivate relationships with our customers that extend beyond a single loan to a full suite of products that serve the needs of our commercial customers. Our goal is to develop long-standing connections with our customers and the communities that we serve. Our management believes that we can compete effectively as a result of local market knowledge, local decision making, awareness of customer needs, and by providing exceptional customer experiences.

Our Products and Services

We emphasize providing commercial banking services. Our dedicated relationship managers serve as direct points of contact for owners, management and employees of small and medium-sized businesses. We provide subject matter expertise in a variety of niche industries including charter and private schools, government contractors, trade contractors, health services, nonprofits and associations, professional services, property management companies, and title companies. We focus on customers living and working in and near our service area. We offer retail banking services to accommodate the needs of both corporate customers as well as individuals residing and working in the communities we serve. We also offer online banking, mobile banking and a remote deposit service, which allows customers to facilitate and expedite deposit transactions through the use of electronic devices. A sophisticated suite of treasury management products is a key feature of our customer focused, relationship driven marketing. We have partnered with experienced service providers in both insurance and merchant services to further augment the products available to our customers.

Lending Services

We provide a range of commercial lending services, including commercial real estate loans, residential and commercial construction and development loans, commercial and industrial loans, and residential mortgage loans to customers generally located or conducting business in our market area. Loan terms, including interest rates, loan-to-value ratios, and maturities, are tailored as much as possible to meet the needs of the borrower. A special effort is made to keep loan products as flexible as possible within the guidelines of prudent banking practices in terms of interest rate risk and credit risk.

When considering loan requests, the primary factors taken into consideration are the cash flow and financial condition of the borrower, the value of the underlying collateral, if applicable, and the character and integrity of the borrower. These factors are evaluated in a number of ways including an analysis of financial statements, credit reviews, trade reviews, and visits to the borrower’s place of business. We have implemented comprehensive loan policies and procedures to provide our loan officers with term, collateral, loan-to-value and pricing guidelines. The policy and sound credit analysis, together with independent, third-party loan review, have resulted in a profitable loan portfolio with minimal delinquencies or problem loans.

Our lending activities are subject to risks, with the most significant risks associated with higher credit risk related to our commercial and real estate lending focus, a high concentration of loans to a small number of borrowers, and lack of seasoning in the portfolio.

Commercial business and commercial real estate loans may involve relatively large loan balances to individual or groups of related borrowers. The repayment of commercial business and commercial real estate loans depends on the successful management and operation of the borrower’s business or properties. The creditworthiness of a borrower is affected by many outside factors, including local market conditions and general economic conditions. If the overall economic climate in the United States, generally, or our market area, specifically, experiences material disruption, our borrowers may experience difficulties in repaying their loans, the collateral we hold may decrease or fluctuate in value, or become illiquid or more difficult to appraise, and the level of nonperforming loans, charge-offs and delinquencies could rise and require additional provisions for credit losses.

Our 10 largest borrowing relationships by outstanding borrowings accounted for approximately 11.7% of our loans as of December 31, 2025. With this concentration of credit risk among a limited number of borrowers, we may face a greater risk of material credit losses if any one or several of these borrowers fail to perform in accordance with their loans, compared to a bank with a more diversified loan portfolio.

In addition, approximately 37.5% of the loans in our loan portfolio were first originated during the past three years. While we believe our underwriting standards are designed to manage normal lending risks, it is difficult to assess the future

8

Table of Contents

performance of our loan portfolio due to the recent origination of many of our loans. As a result, it is difficult to determine whether these loans will become non-performing or delinquent, or whether we will hold non-performing or delinquent loans that may adversely affect our future performance.

Refer to the Loan Portfolio section within Item 7 – Management’s Discussion and Analysis of Financial Condition and Results of Operations for further information regarding the composition of our loan portfolio as of December 31, 2025 and 2024.

Our aim is to build and maintain a commercial loan portfolio consisting of term loans, demand loans, lines of credit and commercial real estate loans provided to primarily locally based borrowers. These types of loans are generally considered to have a higher degree of risk of default or loss than other types of loans, such as well underwritten, prime residential real estate loans, because repayment may be affected by general economic conditions, interest rates, the quality of management of the business and other factors which may cause a borrower to be unable to repay its obligations. Traditional installment loans and personal lines of credit are available on a selective basis. General economic conditions can directly affect the quality of a small and mid-sized business loan portfolio.

Loan business is generated primarily through direct-calling efforts and referrals. Referrals of loan business come from directors, current customers and professionals such as lawyers, accountants and financial intermediaries.

At December 31, 2025, the Bank’s statutory lending limit to any single borrower was approximately $46.7 million, subject to certain exceptions provided under applicable law. As of December 31, 2025, the Bank’s credit exposure to its largest borrower was $30.0 million.

Commercial Loans. Commercial loans are written for any prudent business purpose, including the financing of plant and equipment, the carrying of accounts receivable, contract administration, and the acquisition and construction of real estate projects. Special attention is paid to the commercial real estate market, which is particularly active in the Washington, D.C. MSA. The Bank’s commercial loan portfolio reflects a diverse group of borrowers with no concentration in any borrower, or group of borrowers.

The lending activities in which we engage carry the risk that the borrowers will be unable to perform on their obligations. As such, interest rate policies of the Federal Reserve and general economic conditions, nationally and in our primary market area, will have a significant impact on our results of operations. To the extent that economic conditions deteriorate, business and individual borrowers may be less able to meet their obligations to the Bank in full, in a timely manner, resulting in decreased earnings or losses to the Bank. To the extent that loans are secured by real estate, adverse conditions in the real estate market may reduce the ability of the borrower to generate the necessary cash flow for repayment of the loan, and reduce our ability to collect the full amount of the loan upon a default. To the extent that the Bank makes fixed rate loans, general increases in interest rates will tend to reduce our spread as the interest rates we must pay for deposits increase while interest income is flat. Economic conditions and interest rates may also adversely affect the value of property pledged as security for loans.

We constantly strive to mitigate risks in the event of unforeseen threats to the loan portfolio as a result of an economic downturn or other negative influences. Plans for mitigating inherent risks in managing loan assets include carefully enforcing loan policies and procedures, evaluating each borrower’s industry and business plan during the underwriting process, identifying and monitoring primary and alternative sources for repayment, and obtaining collateral that is margined to minimize loss in the event of liquidation.

Commercial real estate loans will generally be owner occupied or managed investment transactions with a principal reliance on the borrower’s ability to repay, as well as prudent guidelines for assessing real estate values. Risks inherent in managing a commercial real estate portfolio primarily relate to either sudden or gradual drops in property values as a result of a general or local economic downturn. A decline in real estate values can cause loan-to-value margins to increase and diminish the Bank’s equity cushion on both an individual and portfolio basis. The Bank attempts to mitigate commercial real estate lending risks by carefully underwriting each loan of this type to address the perceived risks in the individual transaction. Generally, the Bank requires a loan-to-value ratio of 75% of the lower of an appraisal or cost. A borrower’s ability to repay is carefully analyzed and policy generally calls for an ongoing cash flow to debt service requirement of at

9

Table of Contents

least 1.10:1.0. An approved list of commercial real estate appraisers selected on the basis of consistent standards has been established. Each appraisal is scrutinized in an effort to ensure current comparable market values.

As noted above, commercial real estate loans are generally made on owner occupied or managed investment properties where there is both a reliance on the borrower’s financial health and the ability of the borrower and the business to repay. The Bank generally requires personal guarantees on all commercial loans as a matter of policy; exceptions to policy are documented. Most borrowers are required to forward annual corporate, partnership and personal financial statements to comply with Bank policy and enforced through loan covenants. Interest rate risks to the Bank are mitigated by using either floating interest rates or by fixing rates, generally less than 10 years. While loan amortizations may be approved for up to 360 months, loans generally have a call provision (maturity date) of 10 years or less. Specific and non-specific provisions for loan credit loss reserves are generally set based upon a methodology developed by management and approved by the board of directors and described more fully under “Critical Accounting Policies and Estimates” in Item 2, Management’s Discussion and Analysis of Financial Condition and Results of Operations, of this Form 10-K. At December 31, 2025, approximately 16.4% of our loan portfolio related to owner occupied commercial real estate loans, and approximately 38.5% of our loan portfolio related to managed investment commercial real estate.

Stress testing remains an important component of our organization, including oversight of commercial real estate loans. We have incorporated stress testing into our traditional risk management procedures, which examine the commercial real estate portfolio for expected losses, provision levels, criticized or classified loans, and loan concentrations. Our loan level stress tests are conducted quarterly and assess the impact to capital, if any, resulting from decreased collateral value or debt service coverage under various economic scenarios.

Construction and Development Loans. We offer fixed and adjustable rate residential and commercial construction loan financing to builders and developers and to consumers who wish to build their own home. The term of construction and development loans generally is limited to maximum of 24 months, although payments may be structured on a longer amortization basis. Most loans will mature and require payment in full upon the sale of the property. We believe that construction and development loans generally carry a higher degree of risk than long-term financing of stabilized, rented, and owner-occupied properties because repayment depends on the ultimate completion of the project and usually on the subsequent sale of the property. Specific risks include:

We attempt to reduce risk associated with construction and development loans by obtaining personal guaranties and by keeping the maximum loan-to-value ratio at or below 75% of the appraised value and maximum loan-to-cost ratio at or below 85%, depending on the project type. All construction loans are administered by a centralized department within the Bank that is comprised of experienced loan administrators that specialize in residential, commercial and consumer construction project oversight.  Further, all construction loans are loaded into, and managed on, a third party, nationally recognized construction loan administration platform, which is a fintech solution that provides a unique customer experience, consistency in loan administration, and risk management through portfolio monitoring, market/asset type/borrower concentration analysis, and disbursement efficiency. Finally, the Bank works with highly sophisticated sponsors that are experienced, well capitalized, and positioned to manage through a downturn. As of December 31, 2025, construction and development loans made up approximately 11.3% of our loan portfolio.

10

Table of Contents

Commercial Term Loans. We provide funds for equipment and general corporate needs. This loan category is designed to support borrowers who have a proven ability to service debt over a term generally not to exceed 60 months. The Bank generally requires a first lien position on all collateral and guarantees from owners having at least a 20% interest in the involved business. Interest rates on commercial term loans are generally floating or are fixed for a term not to exceed five years. Management carefully monitors industry and collateral concentrations to avoid loan exposures to a large group of similar industries and/or similar collateral. Commercial loans are evaluated for historical and projected cash flow attributes, balance sheet strength, and primary and alternate resources of personal guarantors. Commercial term loan documents require borrowers to forward regular financial information on both the business and on personal guarantors. Loan covenants require at least annual submission of complete financial information and in certain cases this information is required more frequently, depending on the degree to which the Bank requires information for monitoring a borrower’s financial condition and compliance with loan covenants. Collateral borrowing certificates may be required to monitor certain collateral categories on a monthly or quarterly basis. Key person life insurance is required as appropriate and as necessary to mitigate the risk of loss of a primary owner or manager.

Commercial Lines of Credit. We finance a business borrower’s short-term credit needs and/or to finance a percentage of eligible receivables and inventory. In addition to the risks inherent in term loan facilities, line of credit borrowers typically require additional monitoring to protect the lender against increasing loan volumes and diminishing collateral values. Commercial lines of credit are generally revolving in nature and require close scrutiny. The Bank usually requires an annual out of debt period (for seasonal borrowers) or regular financial information (monthly or quarterly financial statements, borrowing base certificates, etc.) for borrowers with more growth and greater permanent working capital financing needs. Advances against collateral are generally in the same percentages as in term loan lending. Lines of credit and term loans to the same borrowers are typically cross-defaulted and cross-collateralized. Industry and collateral concentration, general and specific reserve allocation and risk rating disciplines are the same as those used in managing the commercial term loan portfolio. Interest rate charges on this group of loans generally float at a factor at or above the prime lending rate, subject in many cases to a minimum rate. Generally, personal guarantees are required on these loans.

Combined, commercial term loans and lines of credit represent approximately 2.5% of our loan portfolio as of December 31, 2025.

Mortgage Lending. The Bank originates, funds and services non-conforming 1-4 family residential mortgage loans for its own portfolio. Such loans are generally made at no more than the lesser of 80% loan to collateral value or cost. Mortgage loans are underwritten with full documentation, including verification of income and assets. Although the mortgage loans the Bank originates often carry amortization periods of up to 30 years, interest rate risk is controlled through balloon payments or interest rate adjustments of generally six years or less. At December 31, 2025, Bank originated 1-4 residential mortgage loans represented 8.1% of our loan portfolio.

The Bank also purchases and services 5/1, 7/1 and 10/1 adjustable-rate mortgages. These mortgages are made on primary residences within our market area and are subject to a strict, uniform set of underwriting criteria. Management views purchased mortgages as a managed risk means of diversifying our earning asset portfolio and achieving a yield, net of the amortized premium, superior to that which may be available in the fixed income market. At December 31, 2025, approximately 17.1% of our loan portfolio related to purchased mortgages.

Other Loans. Loans are considered for any worthwhile personal or business purpose on a case-by-case basis, such as the financing of equipment, receivables, contract administration expenses, and automobile financing. Consumer credit facilities are underwritten to focus on the borrower’s credit record, length of employment and cash flow to debt service. Car, residential real estate and similar loans generally require advances of the lesser of 80% loan to collateral value or cost.

Investment Activities

We manage our securities portfolio and cash to, in order of priority, ensure the safety and preservation of invested principal, maintain adequate liquidity and focus on yield and returns. Specific goals of our investment portfolio are as follows:

11

Table of Contents

The securities in which the Company may invest are subject to regulation and are limited to securities which are considered investment grade securities. Our investment portfolio is comprised primarily of U.S. Treasury bonds, U.S. government agency securities and mortgage-backed or collateralized mortgage obligation securities issued by government-sponsored entities, though we may hold other securities, such as municipal bonds, certificates of deposit and corporate debt securities.

Our investment policy is reviewed annually by our board of directors. The Company’s board of directors has delegated the responsibility of monitoring our investment activities to management consistent with the requirements of the Bank’s Asset Liability Management policy. Day-to-day activities pertaining to the securities portfolio are conducted under the supervision of our Chief Financial Officer and Chief Executive Officer. We actively monitor our investments on an ongoing basis to identify any material changes in the securities. We also review our securities for potential credit impairment at least quarterly.

Deposit Activities

Deposits sourced through our relationship managers and obtained through bank offices have traditionally been the principal source of the Bank’s funds for use in lending and for other general business purposes. In order to serve the needs of its customers, the Bank offers several types of deposit accounts including demand, NOW, money market and savings accounts as well as certificates of deposit. The Bank typically pays a competitive rate on the interest-bearing deposits. As a relationship-oriented organization, we seek to obtain deposit relationships with our loan customers. We offer a full range of consumer and commercial deposit products, including online banking with free bill pay, cash management with the means to detect and prevent fraud, sweep accounts, wire transfer, real time payments, check imaging and remote deposit capture. Through our membership in the IntraFi Network®, we can arrange FDIC insurance of up to $285 million of transaction deposits, certificates of deposits or some combination of the two.

As the Bank’s overall balance sheet positions dictate, we may become more or less competitive in our interest rate structure as our liquidity position changes. Additionally, we may use wholesale or municipal deposits to augment our funding position or achieve a desired interest rate risk management position.

Refer to Risks Related to Funding and Liquidity – “Our deposit portfolio includes significant concentrations and a large percentage of our deposits are attributable to a relatively small number of customers” for discussion of the concentration risk in our deposit portfolio.

Other Services

The Bank has an ownership interest in one of the nation’s largest privately-owned insurance agencies. Through this investment we are able to offer our customers a broad array of business and personal insurance. Also, through third- party networks, we offer our customers access credit and purchase card products.

Our technology products include, among other things, remote deposit capture, sophisticated online internet-based cash management systems, mobile banking, and deposit sweep services that allow businesses to earn interest on their excess funds. Typically, we provide our remote deposit capture hardware and software to our commercial customers free of charge, which provides current and potential customers with a convenient means to bank with us.

Community Reinvestment Act

The Company is committed to serving the banking needs of the communities in which we are located, including low and moderate income areas, and is a supporter of the Community Reinvestment Act (“CRA”). There are several ways in which the Company attempts to fulfill this commitment, including funding no-fee checking accounts, free ATM usage worldwide, mortgage products subject to maximum income limit, small business loans, financing of affordable housing projects, and becoming involved with local groups that support community outreach programs.

12

Table of Contents

The Company encourages its directors and officers to participate in community, civic and charitable organizations. Management and members of our board of directors periodically review the various CRA activities of the Company, including its credit granting process and its involvement with community leaders on a personal level.

Risk Management

We believe that effective risk management is of primary importance. Risk management refers to the activities by which we identify, measure, monitor, evaluate and manage the risks we face in the course of our banking activities. These include liquidity, interest rate, credit, operational, compliance, cybersecurity, regulatory, strategic, financial and reputational risk exposures. Our board of directors, both directly and through its committees, is responsible for overseeing our risk management processes, including quarterly enterprise risk management assessments and annual cyber, Bank Secrecy Act (“BSA”)/anti-money laundering and third-party risk assessments, with each of the committees of our board of directors assuming a different and important role in overseeing the management of the risks we face.

The Audit Committee of our board of directors is responsible for overseeing risks associated with financial matters (particularly financial reporting, accounting practices and policies, disclosure controls and procedures and internal control over financial reporting). The Compensation Committee of our board of directors has primary responsibility for risks and exposures associated with our compensation policies, plans and practices, regarding both executive compensation and our compensation structure generally. In particular, our Compensation Committee, in conjunction with our President and Chief Executive Officer, as appropriate, reviews our incentive compensation arrangements to ensure these programs are consistent with applicable laws and regulations, including safety and soundness requirements, and do not encourage imprudent or excessive risk-taking by our employees. The Governance and Nominating Committee of our board of directors oversees risks associated with the independence of our board of directors and potential conflicts of interest.

Our senior management is responsible for implementing our risk management processes, including by assessing and managing the risks we face, including strategic, operational, regulatory, investment and execution risks, on a day-to-day basis, and reporting to our board of directors regarding our risk management processes. Our senior management is also responsible for creating and recommending to our board of directors for approval appropriate risk appetite metrics reflecting the aggregate levels and types of risk we are willing to accept in connection with the operation of our business and pursuit of our business objectives.

The role of our board of directors in our risk oversight is consistent with our leadership structure, with our President and Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, Chief Banking Officer and the other members of senior management having responsibility for assessing and managing our risk exposure, and our board of directors and its committees providing oversight in connection with those efforts. We believe this division of risk management responsibilities presents a consistent, systemic and effective approach for identifying, managing and mitigating risks throughout our operations.

We believe a disciplined and conservative underwriting approach has been the key to our strong asset quality. Credit risk is the risk that borrowers or counterparties will be unable or unwilling to repay their obligations in accordance with the underlying contractual terms and the risk that credit assets will suffer significant deterioration in market value. We manage and control credit risk in our loan portfolio by adhering to well-defined underwriting criteria and account administration standards established by management, and approved by the board of directors. Our written loan policies document underwriting standards, approval levels, exposure limits and other limits or standards deemed necessary and prudent. Portfolio diversification is actively managed to mitigate concentration risk. In addition, credit risk management includes an independent credit review process that assesses compliance with policies, risk rating standards and other critical credit information. In addition to implementing risk management practices that are based upon established and sound lending practices, we adhere to sound credit principles. We evaluate our customers’ borrowing needs and capacity to repay, in conjunction with their character and history. Our management and board of directors place significant focus on maintaining a healthy risk profile and ensuring sustainable growth. Our risk appetite seeks to balance the risks necessary to achieve our strategic goals while ensuring that our risks are appropriately managed and remain within our defined limits.

Our management of interest rate and liquidity risk is overseen by our Asset and Liability Committee, based on a risk management infrastructure approved by our board of directors that outlines reporting and measurement requirements. In particular, this infrastructure reviews financial performance, trends and significant variances to budget; reviews and

13

Table of Contents

recommends for board approval risk limits and tolerances; reviews ongoing monitoring and reporting regarding our performance with respect to these areas of risk, including compliance with board-approved risk limits and stress-testing; ensures annual back-testing and independent validation of models at a frequency commensurate with risk level; reviews and recommends our contingency funding plan; establishes wholesale borrowing limits to be submitted to the board of directors; and reviews information and reports submitted for the purpose of identifying, investigating, and assuring remediation, to its satisfaction, of errors or irregularities, if any.

Emerging Growth Company Status

We qualify as an “emerging growth company” under the JOBS Act and as defined in Section 2(a) of the Securities Act. For as long as we are an emerging growth company, we may choose to take advantage of exemptions from various reporting requirements applicable to other public companies but not to emerging growth companies.

As an emerging growth company:

We could remain an emerging growth company for up to five years, or until the earliest of (i) the end of the first fiscal year during which we have total annual gross revenues of $1.235 billion or more, (ii) the date on which we have, during the previous three-year period, issued more than $1.0 billion in non-convertible debt and (iii) the date on which we are deemed to be a “large accelerated filer” as defined in Rule 12b-2 under the Securities Exchange Act of 1934, as amended (the “Exchange Act”).

In addition to the relief described above, the JOBS Act permits us an extended transition period for complying with new or revised accounting standards affecting public companies. We have elected not to take advantage of this extended transition period, which means that the financial statements included in this Form 10-K, as well as any financial statements that we file in the future, will be subject to all new or revised accounting standards generally applicable to public companies.

See Item 1A, Risk Factors, of this Form 10-K for more information on emerging growth companies.

Employees

As of December 31, 2025, we had 138 full-time employees and 2 part-time employees. None of our employees are covered by a collective bargaining agreement. We consider our relationship with our employees to be good and have not experienced interruptions of operations due to labor disagreements.

We provide a competitive compensation and benefits program to our employees. In addition to salaries, these programs include annual bonus opportunities, a 401(k) plan with an employer matching contribution, healthcare and insurance benefits, profit sharing, flexible spending accounts, paid time off and an employee assistance program.

General Corporate Information

Our principal executive offices are located at 1943 Isaac Newton Square, Suite 100, Reston, Virginia 20190 and our telephone number at that address is (703) 584-0840. Additional information can be found on our website:

14

Table of Contents

www.johnmarshallbank.com. Information on our website or any other website is not incorporated by reference herein and does not constitute a part of this Form 10-K.

Public Information

Our Securities and Exchange Commission (“SEC”) filings are available to the public on the SEC’s Internet site at http://www.sec.gov. You may also obtain these documents, free of charge, from the investor relations section of our website at http://www.johnmarshallbank.com.

Supervision and Regulation

The Company and the Bank are highly regulated under both federal and state laws. The following description briefly addresses certain provisions of federal and state laws and regulations, and their potential effects on the Company and the Bank. To the extent statutory or regulatory provisions or proposals are described in this Form 10-K, the description is qualified in its entirety by reference to the particular statutory or regulatory provisions or proposals.

The Company

General. As a bank holding company registered under the Bank Holding Company Act of 1956 (the “BHCA”), the Company is subject to supervision, regulation and examination by the Federal Reserve. The Company is also registered under the bank holding company laws of Virginia and is subject to supervision, regulation and examination by the Virginia BFI.

Permitted Activities. The permitted activities of a bank holding company are limited to managing or controlling banks, furnishing services to or performing services for its subsidiaries, and engaging in other activities that the Federal Reserve determines by regulation or order to be closely related to banking or managing or controlling banks. In determining whether a particular activity is permissible, the Federal Reserve must consider whether the performance of such an activity reasonably can be expected to produce benefits to the public that outweigh possible adverse effects. Possible benefits include greater convenience, increased competition, and gains in efficiency. Possible adverse effects include undue concentration of resources, decreased or unfair competition, conflicts of interest, and unsound banking practices. Despite prior approval, the Federal Reserve may order a bank holding company or its subsidiaries to terminate any activity or to terminate ownership or control of any subsidiary when the Federal Reserve has reasonable cause to believe that a serious risk to the financial safety, soundness, or stability of any bank subsidiary of that bank holding company may result from such an activity.

Banking Acquisitions; Changes in Control. The BHCA and related regulations require, among other things, the prior approval of the Federal Reserve in any case where a bank holding company proposes to (i) acquire direct or indirect ownership or control of more than 5% of the outstanding voting stock of any bank or bank holding company (unless it already owns a majority of such voting shares), (ii) acquire all or substantially all of the assets of another bank or bank holding company, or (iii) merge or consolidate with any other bank holding company. In determining whether to approve a proposed bank acquisition, the Federal Reserve will consider, among other factors, the effect of the acquisition on competition, the public benefits expected to be received from the acquisition, any outstanding regulatory compliance issues of any institution that is a party to the transaction, the projected capital ratios and levels on a post-acquisition basis, the financial condition of each institution that is a party to the transaction and of the combined institution after the transaction, the parties’ managerial resources and risk management and governance processes and systems, the parties’ compliance with the BSA and anti-money laundering requirements, and the acquiring institution’s performance under the Community Reinvestment Act of 1977 and compliance with fair housing and other consumer protection laws.

Subject to certain exceptions, the BHCA and the Change in Bank Control Act, together with the applicable regulations, require Federal Reserve approval (or, depending on the circumstances, no notice of disapproval) prior to any person or company’s acquiring “control” of a bank or bank holding company. A conclusive presumption of control exists if an individual or company acquires the power, directly or indirectly, to direct the management or policies of an insured depository institution or to vote 25% or more of any class of voting securities of any insured depository institution. A rebuttable presumption of control exists if a person or company acquires 10% or more but less than 25% of any class of voting securities of an insured depository institution and either the institution has registered its securities with the SEC

15

Table of Contents

under Section 12 of the Exchange Act or no other person will own a greater percentage of that class of voting securities immediately after the acquisition.

In addition, Virginia law requires prior approval from the Virginia BFI for (i) the acquisition by a Virginia bank holding company of more than 5% of the voting shares of a Virginia bank or any holding company that controls a Virginia bank, or (ii) the acquisition by a Virginia bank holding company of a bank or its holding company domiciled outside Virginia.

Source of Strength. Federal Reserve policy has historically required bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. The Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) codified this policy as a statutory requirement. Under this requirement, the Company is expected to commit resources to support the Bank, including at times when the Company may not be in a financial position to provide such resources. Any capital loans by a bank holding company to any of its subsidiary banks are subordinate in right of payment to depositors and to certain other indebtedness of such subsidiary banks. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Safety and Soundness. There are a number of obligations and restrictions imposed on bank holding companies and their subsidiary banks by law and regulatory policy that are designed to minimize potential loss to the depositors of such depository institutions and the FDIC insurance fund in the event of a depository institution insolvency, receivership, or default. For example, under the Federal Deposit Insurance Corporation Improvement Act of 1991, to avoid receivership of an insured depository institution subsidiary, a bank holding company is required to guarantee the compliance of any subsidiary bank that may become “undercapitalized” with the terms of any capital restoration plan filed by such subsidiary with its appropriate federal bank regulatory agency up to the lesser of (i) an amount equal to 5% of the institution’s total assets at the time the institution became undercapitalized, or (ii) the amount that is necessary (or would have been necessary) to bring the institution into compliance with all applicable capital standards as of the time the institution fails to comply with such capital restoration plan.

Under the Federal Deposit Insurance Act (“FDIA”), federal bank regulatory agencies have adopted guidelines prescribing safety and soundness standards. These guidelines establish general standards relating to capital management, internal controls and information systems, data security, loan documentation, credit underwriting, interest rate exposure, risk management, vendor management, corporate governance, asset growth, and compensation, fees and benefits. In general, the guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines.

Capital Requirements. Pursuant to the Federal Reserve’s Small Bank Holding Company Policy Statement, qualifying bank holding companies with total consolidated assets of less than $3 billion, such as the Company, are not subject to consolidated regulatory capital requirements. Certain capital requirements applicable to the Bank are described below under “The Bank – Capital Requirements.” Subject to capital requirements and certain other restrictions, the Company is able to borrow money to make a capital contribution to the Bank, and such loans may be repaid from dividends paid by the Bank to the Company.

Limits on Dividends and Other Payments. The Company is a legal entity, separate and distinct from its subsidiary. A significant portion of the revenues of the Company result from dividends paid to it by the Bank. There are various legal limitations applicable to the payment of dividends by the Bank to the Company and to the payment of dividends by the Company to its shareholders. The Bank is subject to various statutory and regulatory restrictions on its ability to pay dividends to the Company. Under current regulations, prior approval from the Federal Reserve is required if cash dividends declared by the Bank in any given year exceed net income for that year plus retained net profits of the two preceding years. The payment of dividends by the Bank or the Company may be limited by other factors, such as requirements to maintain capital above regulatory guidelines. Bank regulatory agencies have the authority to prohibit the Bank and the Company from engaging in unsafe or unsound practices in conducting their respective businesses. The payment of dividends, depending on the financial condition of the Bank or the Company, could be deemed to constitute such an unsafe or unsound practice.

Under the FDIA, insured depository institutions, such as the Bank, are prohibited from making capital distributions, including the payment of dividends, if after making such distributions the institution would become “undercapitalized” (as

16

Table of Contents

such term is used in the statute). Any non-bank subsidiaries of the Company may pay dividends to the Company periodically, subject to certain statutory restrictions.

The Company may receive fees from or pay fees to its affiliated companies for expenses incurred related to certain activities performed by or for the Company for the benefit of its affiliated companies or for its benefit. These fees are charged to/received from each affiliated company based upon various specific allocation methods measuring the estimated usage of such services by that company. The fees are eliminated from reported financial statements in the consolidation process.

The Bank

General. The Bank is supervised and regularly examined by the Federal Reserve and the Virginia BFI. The various laws and regulations administered by the bank regulatory agencies affect corporate practices, such as the payment of dividends, incurrence of debt, and the acquisition of financial institutions and other companies. These laws and regulations also affect business practices, such as the payment of interest on deposits, the charging of interest on loans, credit policies, the types of business conducted, and the location of offices. Certain of these laws and regulations are referenced above under “The Company.”

Capital Requirements. The Federal Reserve and the other federal banking agencies have issued risk-based and leverage capital guidelines applicable to U.S. banking organizations. Those regulatory agencies may from time to time require that a banking organization maintain capital above the minimum levels because of its financial condition or actual or anticipated growth.

The Federal Reserve has adopted final rules regarding capital requirements and calculations of risk-weighted assets to implement the Basel III regulatory capital reforms from the Basel Committee on Banking Supervision and certain provisions of the Dodd-Frank Act. These rules require the Bank to comply with the following minimum capital ratios: (i) a minimum ratio of common equity Tier 1 to risk-weighted assets of 4.5%, plus a 2.5% capital conservation buffer, resulting in a minimum ratio of common equity Tier 1 to risk-weighted assets of 7.0%, (ii) a minimum ratio of Tier 1 capital to risk-weighted assets of 6.0%, plus the 2.5% capital conservation buffer, resulting in a minimum Tier 1 capital ratio of 8.5%, (iii) a minimum ratio of total risk-based capital to risk-weighted assets of 8.0%, plus the 2.5% capital conservation buffer, resulting in a minimum total risk-based capital ratio of 10.5%, and (iv) a minimum leverage ratio of 4.0%, calculated as the ratio of Tier 1 capital to average assets. The capital conservation buffer, is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of common equity Tier 1 to risk-weighted assets above the minimum but below the conservation buffer will face constraints on dividends, equity repurchases, and discretionary compensation paid to certain officers, based on the amount of the shortfall. As of December 31, 2025 and 2024, the capital ratios of the Bank were in excess of the requirements.

As discussed below, the Basel III capital reforms also integrated the new capital requirements into the prompt corrective action provisions under Section 38 of the FDIA. The Federal Reserve’s final rules (i) introduced a common equity Tier 1 capital ratio requirement at each level (other than critically undercapitalized), with the required ratio being 6.5% for well capitalized status, (ii) increased the minimum Tier 1 capital ratio requirement for each category, with the minimum ratio for well capitalized status being 8.0%, and (iii) eliminated the provision that provided that a bank with a composite supervisory rating of 1 may have a 3.0% Tier 1 leverage ratio and still be well capitalized. The minimum total capital to risk-weighted assets ratio (10.0%) and minimum leverage ratio (5.0%) for well capitalized status were unchanged by the final rules.

Prompt Corrective Action. Federal banking regulators are authorized and, under certain circumstances, required to take certain actions against banks that fail to meet their capital requirements. The federal bank regulatory agencies have additional enforcement authority with respect to undercapitalized depository institutions. As described above, the final rules to implement the Basel III regulatory capital framework also integrated new requirements into the prompt corrective action framework. “Well capitalized” institutions may generally operate without additional supervisory restriction. With respect to “adequately capitalized” institutions, such banks cannot normally pay dividends or make any capital contributions that would leave the bank undercapitalized; they cannot pay a management fee to a controlling person if after paying the fee, it would be undercapitalized; and they cannot accept, renew, or rollover any brokered deposit unless the bank has applied for and been granted a waiver by the FDIC.

17

Table of Contents

Immediately upon becoming “undercapitalized,” a depository institution becomes subject to the provisions of Section 38 of the FDIA, which: (i) restrict payment of capital distributions and management fees; (ii) require that the appropriate federal banking agency monitor the condition of the institution and its efforts to restore its capital; (iii) require submission of a capital restoration plan; (iv) restrict the growth of the institution’s assets; and (v) require prior approval of certain expansion proposals. The appropriate federal banking agency for an undercapitalized institution also may take any number of discretionary supervisory actions if the agency determines that any of these actions is necessary to resolve the problems of the institution at the least possible long-term cost to the Deposit Insurance Fund of the FDIC (“DIF”), subject in certain cases to specified procedures. These discretionary supervisory actions include: (i) requiring the institution to raise additional capital; (ii) restricting transactions with affiliates; (iii) requiring divestiture of the institution or the sale of the institution to a willing purchaser; and (iv) any other supervisory action that the agency deems appropriate. These and additional mandatory and permissive supervisory actions may be taken with respect to significantly undercapitalized and critically undercapitalized institutions. The Bank met the definition of being “well capitalized” as of December 31, 2025 and 2024.

Deposit Insurance. The deposits of the Bank are insured up to applicable limits by the DIF. The basic limit on FDIC deposit insurance coverage is $250,000 per depositor. Under the FDIA, the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations as an insured depository institution, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, subject to administrative and potential judicial hearing and review processes.

The Bank is subject to deposit insurance assessments to maintain the DIF. Deposit insurance pricing is based on CAMELS composite ratings and certain other financial ratios to determine assessment rates for small-established institutions with less than $10 billion in assets. The CAMELS rating system is a supervisory rating system designed to take into account and reflect all financial and operational risks that a bank may face, including capital adequacy, asset quality, management capability, earnings, liquidity, and sensitivity to market risk (“CAMELS”). CAMELS composite ratings set a maximum insurance assessment for CAMELS 1 and 2 rated banks and set minimum assessments for lower rated institutions.

The Company recorded an expense of $1.0 million for FDIC insurance premiums for each of the years ended December 31, 2025 and 2024.

Transactions with Affiliates. Pursuant to Sections 23A and 23B of the Federal Reserve Act and Regulation W, the authority of the Bank to engage in transactions with related parties or “affiliates,” or to make loans to insiders, is limited. Loan transactions with an affiliate generally must be collateralized and certain transactions between the Bank and its affiliates, including the sale of assets, the payment of money or the provision of services, must be on terms and conditions that are substantially the same, or at least as favorable to the Bank, as those prevailing for comparable nonaffiliated transactions. In addition, the Bank generally may not purchase securities issued or underwritten by affiliates.

Loans to executive officers, directors, or to any person who directly or indirectly, or acting through or in concert with one or more persons, owns, controls, or has the power to vote more than 10% of any class of voting securities of a bank are subject to Sections 22(g) and 22(h) of the Federal Reserve Act and their corresponding regulations (Regulation O) and Section 13(k) of the Exchange Act, relating to the prohibition on personal loans to executives (which exempts financial institutions in compliance with the insider lending restrictions of Section 22(h) of the Federal Reserve Act). Among other things, these loans must be made on terms substantially the same as those prevailing on transactions made to unaffiliated individuals and certain extensions of credit to those persons must first be approved in advance by a disinterested majority of the entire board of directors. Section 22(h) of the Federal Reserve Act prohibits loans to any of those individuals where the aggregate amount exceeds an amount equal to 15% of an institution’s unimpaired capital and surplus plus an additional 10% of unimpaired capital and surplus in the case of loans that are fully secured by readily marketable collateral, or when the aggregate amount on all of the extensions of credit outstanding to all of these persons would exceed the bank’s unimpaired capital and unimpaired surplus. Section 22(g) of the Federal Reserve Act identifies limited circumstances in which a bank is permitted to extend credit to executive officers.

Community Reinvestment Act. The Bank is subject to the requirements of the Community Reinvestment Act of 1977. The CRA imposes on financial institutions an affirmative and ongoing obligation to meet the credit needs of the local communities they serve, including low and moderate income neighborhoods. The CRA requires the appropriate federal banking agency, in connection with its examination of a bank, to assess the bank’s record in meeting such credit needs.

18

Table of Contents

Furthermore, such assessment is also required of banks that have applied, among other things, to merge or consolidate with or acquire the assets or assume the liabilities of an insured depository institution, or to open or relocate a branch. In the case of a bank holding company applying for approval to acquire a bank or another bank holding company, the record of each subsidiary bank of the applicant bank holding company is subject to assessment in considering the application. Under the CRA, institutions are assigned a rating of “outstanding,” “satisfactory,” “needs to improve,” or “substantial non-compliance.” The Bank received a “satisfactory” CRA rating in its most recent examination.

On October 24, 2023, the federal bank regulatory agencies issued a final rule to modernize their respective CRA regulations. The revised rules would have substantially altered the methodology for assessing compliance with the CRA, and likely would have made it more challenging and/or costly for the Bank to maintain its “satisfactory” rating. Following its finalization on March 29, 2024, the 2023 modernization rule became subject to an ongoing injunction. On July 16, 2025, the federal bank regulatory agencies issued a joint proposal to rescind the 2023 modernization rule. The agencies continue to apply the CRA rules as they existed before the 2023 modernization, considering the injunction and pending finalization of the rescission of the modernization rule.

​

Anti-Money Laundering Laws and Regulations. The Bank is subject to several federal laws that are designed to combat money laundering, terrorist financing, and transactions with persons, companies or foreign governments designated by U.S. authorities (“AML laws”). This category of laws includes the BSA, the Money Laundering Control Act of 1986, the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA PATRIOT Act”), and the Anti-Money Laundering Act of 2020.

The AML laws and their implementing regulations require insured depository institutions, broker-dealers, and certain other financial institutions to have policies, procedures, and controls to detect, prevent, and report money laundering and terrorist financing. The AML laws and their regulations also provide for information sharing, subject to conditions, between federal law enforcement agencies and financial institutions, as well as among financial institutions, for counter-terrorism purposes. Federal banking regulators are required, when reviewing bank holding company acquisition and bank merger applications, to take into account the effectiveness of the anti-money laundering activities of the applicants. To comply with these obligations, the Bank has implemented appropriate internal practices, procedures, and controls.

Reporting Terrorist Activities. The Office of Foreign Assets Control (“OFAC”), which is a division of the Department of the Treasury, is responsible for helping to ensure that United States entities do not engage in transactions with “enemies” of the United States, as defined by various executive orders and acts of Congress. OFAC has sent, and will send, our bank regulatory agencies lists of names of persons and organizations suspected of aiding, harboring or engaging in terrorist acts. If the Bank finds a name on any transaction, account or wire transfer that is on an OFAC list, it must freeze such account, file a suspicious activity report and notify the Federal Bureau of Investigation. The Bank has appointed an OFAC compliance officer to oversee the inspection of its accounts and the filing of any notifications. The Bank actively checks high-risk OFAC areas such as new accounts, wire transfers and customer files. The Bank performs these checks utilizing software, which is updated each time a modification is made to the lists provided by OFAC and other agencies of Specially Designated Nationals and Blocked Persons.

Consumer Financial Protection. The Bank is subject to a number of federal and state consumer protection laws that extensively govern its relationship with its customers. These laws include the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Truth in Lending Act, the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Home Mortgage Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Fair Debt Collection Practices Act, the Service Members Civil Relief Act, laws governing flood insurance, federal and state laws prohibiting unfair and deceptive business practices, foreclosure laws, and various regulations that implement some or all of the foregoing. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must deal with customers when taking deposits, making loans, collecting loans, and providing other services. If the Bank fails to comply with these laws and regulations, it may be subject to various penalties. Failure to comply with consumer protection requirements may also result in failure to obtain any required bank regulatory approval for merger or acquisition transactions the Bank may wish to pursue or being prohibited from engaging in such transactions even if approval is not required.

The Dodd-Frank Act centralized responsibility for consumer financial protection by creating a new agency, the Consumer Financial Protection Bureau (the “CFPB”), and giving it responsibility for implementing, examining, and enforcing

19

Table of Contents

compliance with federal consumer protection laws. The CFPB focuses on (i) risks to consumers and compliance with the federal consumer financial laws, (ii) the markets in which firms operate and risks to consumers posed by activities in those markets, (iii) depository institutions that offer a wide variety of consumer financial products and services, and (iv) non-depository companies that offer one or more consumer financial products or services. The CFPB is responsible for implementing, examining, and enforcing compliance with federal consumer financial laws for institutions with more than $10 billion of assets. While the Bank, like all banks, is subject to federal consumer protection rules enacted by the CFPB, because the Company and the Bank have total consolidated assets of less than $10 billion, the Federal Reserve oversees most consumer protection aspects of the Dodd-Frank Act and other laws and regulations applicable to the Bank.

The CFPB has broad rulemaking authority for a wide range of consumer financial laws that apply to all banks, including, among other things, the authority to prohibit “unfair, deceptive or abusive” acts and practices. Abusive acts or practices are defined as those that materially interfere with a consumer’s ability to understand a term or condition of a consumer financial product or service or take unreasonable advantage of a consumer’s (i) lack of financial savvy, (ii) inability to protect himself in the selection or use of consumer financial products or services, or (iii) reasonable reliance on a covered entity to act in the consumer’s interests. The CFPB can issue cease-and-desist orders against banks and other entities that violate consumer financial laws. The CFPB may also institute a civil action against an entity in violation of federal consumer financial law in order to impose a civil penalty or injunction. Further regulatory positions taken by the CFPB may influence how other regulatory agencies may apply the subject consumer financial protection laws and regulations.

During 2025, the CFPB reduced its staff by over 80%. The reduction in force is the subject of litigation, and the staffing cuts are currently stayed pending the federal circuit court’s rehearing of the case. The impact of these developments on banking organizations is uncertain. States and state attorneys general may increase regulatory, investigative and enforcement activity with respect to consumer protection, in response to changes in regulation, supervision and enforcement of consumer protection laws by federal regulators.

Notwithstanding ongoing, legal, budgetary and structural challenges affecting the CFPB, the CFPB remains an active federal regulatory agency with continuing supervisory and enforcement authority and retains its broad authority to pursue enforcement actions, including investigations, civil actions and cease and desist proceedings. The Bank is also subject to other federal and state consumer protection laws and regulations that, among other things, prohibit unfair, deceptive and abusive, corrupt or fraudulent business practices, untrue or misleading advertising and unfair competition.

Privacy Legislation. Several laws, including the Right to Financial Privacy Act and the Gramm-Leach-Bliley Act (“GLB Act”), and related regulations issued by the federal bank regulatory agencies, provide protections against the transfer and use of customer information by financial institutions. A financial institution must provide its customers information regarding its policies and procedures with respect to the handling of customers’ personal information. Each institution must conduct an internal risk assessment of its ability to protect customer information. These privacy provisions generally prohibit a financial institution from providing a customer’s personal financial information to unaffiliated parties without prior notice to and approval from the customer.

In October 2024, the CFPB issued a final rule regarding personal financial data rights that is designed to promote “open banking.” The final rule requires, among other things, that data providers, including any financial institution, make available to consumers and certain authorized third parties, upon request, certain covered transaction, account, and payment information. Institutions with at least $1.5 billion but less than $3 billion in total assets, including the Company, are required to comply with the final rule by April 1, 2029. On the same day the final rule was released, certain industry participants filed a complaint against the CFPB challenging the final rule. This legal challenge has since been paused to allow time for the CFPB to assess the rule and determine whether it aligns with the agency’s current policy objectives. In September 2025, the CFPB solicited public comment to reconsider the implementation of “open banking.”

​

Cybersecurity. The federal bank regulatory agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a financial institution’s board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services. The federal bank regulatory agencies expect financial institutions to establish lines of defense and to ensure that their risk management processes address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption and maintenance of the

20

Table of Contents

institution’s operations after a cyberattack. If the Company or the Bank fails to meet the expectations set forth in this regulatory guidance, the Company or the Bank could be subject to various regulatory actions and any remediation efforts may require significant resources of the Company or the Bank.

​

On November 18, 2021, the federal bank regulatory agencies issued a final rule, effective April 1, 2022, imposing new notification requirements for cybersecurity incidents. The rule requires financial institutions to notify their primary federal regulator as soon as possible and no later than 36 hours after the institution determines that a cybersecurity incident has occurred that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the institution’s: (i) ability to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base, in the ordinary course of business, (ii) business line(s), including associated operations, services, functions, and support, that upon failure would result in a material loss of revenue, profit, or franchise value, or (iii) operations, including associated services, functions and support, as applicable, the failure or discontinuance of which would pose a threat to the financial stability of the United States.

In July 2023, the SEC issued a final rule to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and incident reporting by public companies that are subject to the reporting requirements of the Exchange Act. Specifically, the final rule requires current reporting about material cybersecurity incidents, periodic disclosures about a registrant’s policies and procedures to identify and manage cybersecurity risk, management’s role in implementing cybersecurity policies and procedures, and the board of directors’ cybersecurity expertise, if any, and its oversight of cybersecurity risk. See Item 1C. Cybersecurity of this Form 10-K for a discussion of the Company’s cybersecurity risk management, strategy and governance.

To date, neither the Company nor the Bank has experienced a significant compromise, significant data loss, or material financial losses related to cybersecurity attacks, but its systems and those of its customers and third-party service providers are under constant threat, and it is possible that the Company or the Bank could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking, and other technology-based products and services by the Company and the Bank and its customers.

Incentive Compensation. The federal bank regulatory agencies have issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of financial institutions do not undermine the safety and soundness of such institutions by encouraging excessive risk-taking. The Interagency Guidance on Sound Incentive Compensation Policies, which covers all employees that have the ability to materially affect the risk profile of financial institutions, either individually or as part of a group, is based upon the key principles that a financial institution’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the institution’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the financial institution’s board of directors.

The Federal Reserve will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of financial institutions, such as the Company and the Bank, that are not “large, complex banking organizations.” These reviews will be tailored to each financial institution based on the scope and complexity of the institution’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the institution’s supervisory ratings, which can affect the institution’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a financial institution if its incentive compensation arrangements or related risk-management control or governance processes pose a risk to the institution’s safety and soundness, and the financial institution is not taking prompt and effective measures to correct the deficiencies. At December 31, 2025, the Company and the Bank have not been made aware of any instances of noncompliance with this guidance.

The Nasdaq Stock Market, LLC, the exchange on which our common stock is listed, enacted a listing rule that became effective in 2023 requiring listed companies to adopt policies mandating the recovery or “clawback” of excess incentive compensation earned by a current or former executive officer during the three fiscal years preceding the date the listed company is required to prepare an accounting restatement, including to correct an error that would result in a material

21

Table of Contents

misstatement if the error were corrected in the current period or left uncorrected in the current period. A copy of our clawback policy is included as Exhibit 97 to this Annual Report on 10-K.

Mortgage Banking Regulation. In connection with making mortgage loans, the Bank is subject to rules and regulations that, among other things, establish standards for loan origination, prohibit discrimination, provide for inspections and appraisals of property, require credit reports on prospective borrowers, in some cases restrict certain loan features and fix maximum interest rates and fees, require the disclosure of certain basic information to mortgagors concerning credit and settlement costs, limit payment for settlement services to the reasonable value of the services rendered and require the maintenance and disclosure of information regarding the disposition of mortgage applications based on race, gender, geographical distribution and income level. The Bank is also subject to rules and regulations that require the collection and reporting of significant amounts of information with respect to mortgage loans and borrowers. The Bank’s mortgage origination activities are subject to Regulation Z, which implements the Truth in Lending Act. Certain provisions of Regulation Z require creditors to make a reasonable and good faith determination based on verified and documented information that a consumer applying for a mortgage loan has a reasonable ability to repay the loan according to its terms.

Fair Access to Financial Services. In August 2025, President Trump signed Executive Order 14331, “Guaranteeing Fair Banking Access for All Americans,” which states that it is the policy of the United States that no American should be denied access to financial services because of their constitutionally or statutorily protected beliefs, affiliations, or political views. The Executive Order directs the Treasury Secretary and federal banking regulators to address politicized or unlawful debanking activities. In recent years, certain states have also enacted, or have proposed to enact, statutes, regulations or policies that prohibit financial institutions from denying or canceling products or services to a person or business, or otherwise discriminating against a person or business in making available products or services, on the basis of certain social or political factors or other activities.

Artificial Intelligence. CFPB and other federal regulatory guidance reiterates that creditors are not excused from the adverse action notice requirements under the Equal Credit Opportunity Act if they rely on complex algorithmic underwriting models. States have also started to regulate the use of artificial intelligence technologies. In July 2024, the federal banking agencies issued a final rule that requires, among other things, financial institutions to ensure that their automated valuation models for property valuation follow certain quality control standards, including a requirement that such valuation models comply with nondiscrimination laws.

Effect of Governmental Monetary Policies

The Company’s operations are affected not only by general economic conditions but also by the policies of various regulatory authorities. In particular, the Federal Reserve regulates money and credit conditions and interest rates to influence general economic conditions. These policies have a significant effect on overall growth and distribution of loans, investments, and deposits, and they affect interest rates charged on loans or paid for deposits. Federal Reserve monetary policies have had significant effects on the operating results of commercial banks, including the Bank, in the past and are expected to do so in the future.

Future Legislation and Regulation

Congress may enact legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or effect of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of the proposed legislation could affect the regulatory structure under which the Company and the Bank operate and may significantly increase costs, impede the efficiency of internal business processes, require an increase in regulatory capital, require modifications to business strategies, and limit the ability to pursue business opportunities in an efficient manner. A change in statutes, regulations, or regulatory policies applicable to the Company or the Bank could have a material, adverse effect on the business, financial condition, and results of operations of the Company and the Bank.

22

Table of Contents

Reporting Obligations under Securities Laws

The Company is subject to the periodic and other reporting requirements of the Exchange Act, including the filing of annual, quarterly, and other reports with the SEC. The Company’s SEC filings are posted and available at no cost on its website as soon as reasonably practicable after the reports are filed electronically with the SEC. The Company’s website address is www.johnmarshallbank.com. The information on the Company’s website is not incorporated into this report or any other filing the Company makes with the SEC. The SEC maintains an Internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC at www.sec.gov.

​