LCNB CORP (LCNB) Business

Item 1.  Business

FORWARD-LOOKING STATEMENTS

Certain statements made in this document regarding LCNB’s financial condition, results of operations, plans, objectives, future performance and business, are “forward-looking statements” within the meaning of Section 27A of the Securities Act of 1933, as amended, Section 21E of the Securities Exchange Act of 1934, as amended, and the Private Securities Litigation Reform Act of 1995.  These forward-looking statements are identified by the fact they are not historical facts and include words such as “anticipate”, “could”, “may”, “feel”, “expect”, “believe”, “might”, “plan”, and similar expressions.

These forward-looking statements reflect management's current expectations based on all information available to management and its knowledge of LCNB’s business and operations.  Additionally, LCNB’s financial condition, results of operations, plans, objectives, future performance and business are subject to risks and uncertainties that may cause actual results to differ materially.  These factors include, but are not limited to:

Forward-looking statements made herein reflect management's expectations as of the date such statements are made. Such information is provided to assist shareholders and potential investors in understanding current and anticipated financial operations of LCNB and is included pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995.  LCNB undertakes no obligation to update any forward-looking statement to reflect events or circumstances that arise after the date such statements are made.

-5-

Table of Contents

LCNB CORP. AND SUBSIDIARIES

DESCRIPTION OF LCNB'S BUSINESS

General Description

LCNB Corp., an Ohio corporation formed in December 1998, is a financial holding company headquartered in Lebanon, Ohio.  Substantially all of the assets, liabilities and operations of LCNB Corp. are attributable to its wholly-owned subsidiary, LCNB National Bank.  The predecessor of LCNB Corp., the Bank, was formed as a national banking association in 1877.  On May 19, 1999, the Bank became a wholly-owned subsidiary of LCNB Corp.  LCNB Risk Management, Inc., a captive insurance agency, was incorporated in Nevada by LCNB Corp. during the second quarter of 2017.

Loan products offered include commercial and industrial loans, commercial and residential real estate loans, agricultural loans, construction loans, various types of consumer loans, and Small Business Administration loans.  The Bank's residential mortgage lending activities consist primarily of loans for purchasing or refinancing personal residences, home equity lines of credit, and loans for commercial or consumer purposes secured by residential mortgages.  Consumer lending activities include automobile, boat, home improvement, and personal loans.

The Wealth Management Division of the Bank provides complete trust administration, estate settlement, and fiduciary services and also offers investment management of trusts, agency accounts, individual retirement accounts, and foundations/endowments.

Security brokerage services are offered by the Bank through arrangements with LPL Financial LLC, a registered broker/dealer.  Licensed brokers offer a full range of investment services and products, including financial needs analysis, mutual funds, securities trading, annuities, and life insurance.

Other services offered include safe deposit boxes, night depositories, cashier's checks, bank-by-mail, ATMs, cash and transaction services, debit cards, wire transfers, electronic funds transfer, utility bill collections, notary public service, cash management services, 24-hour telephone banking, PC Internet banking, mobile banking, and other services tailored for both individuals and businesses.

The Bank is not dependent upon any one significant customer or specific industry.  Business is not seasonal to any material degree.

The address of the main office of the Bank is 2 North Broadway, Lebanon, Ohio 45036; telephone (513) 932-1414.

Primary Market Area

The Bank considers its primary market area to consist of counties where it has a physical presence and neighboring counties, which includes Southwestern and South Central Ohio and Northern Kentucky. At December 31, 2025, the Bank had:

Competition

The Bank faces strong competition both in making loans and attracting deposits.  The deregulation of the banking industry and the widespread enactment of state laws that permit multi-bank holding companies as well as the availability of nationwide interstate banking has created a highly competitive environment for financial services providers. The Bank competes with other national and state banks, savings and loan associations, credit unions, finance companies, mortgage brokerage firms, realty companies with captive mortgage brokerage firms, mutual funds, insurance companies, cryptocurrency companies, brokerage and investment banking companies, Financial Technology or "FinTech" companies including decentralized finance and cryptocurrency, and other financial intermediaries operating in its market and elsewhere, many of whom have substantially larger financial and managerial resources.

The Bank seeks to minimize the competitive effect of other financial institutions through a community banking approach that emphasizes direct customer access to the Bank's CEO, President, and other officers in an environment conducive to friendly, informed, and courteous personal services.  Management believes that the Bank is well-positioned to compete successfully in its primary market area.  Competition among financial institutions is based upon interest rates offered on deposit accounts, interest rates charged on loans and other credit and service charges, availability of electronic banking services, the quality and scope of the services rendered, and the convenience of banking facilities and electronic banking technologies.

The ability to access and use technology, including the use of artificial intelligence, is an increasingly competitive factor in the financial services industry. Technology relating to the delivery of financial services, the security and privacy of customer information, and the processing of information is evolving rapidly. LCNB continually makes technology investments to remain competitive in the financial services industry.

Management believes the commitment of the Bank to personal service, innovation, and involvement in the communities and primary market areas it serves, as well as its commitment to quality community banking service, are factors that contribute to its competitive advantage.

-6-

Table of Contents

LCNB CORP. AND SUBSIDIARIES

Supervision and Regulation

Both federal and state laws extensively regulate bank holding companies, financial holding companies, and banks. These laws (and the regulations promulgated thereunder) are primarily intended to protect depositors and the DIF of the FDIC. The following information describes particular laws and regulatory provisions relating to financial holding companies and banks. This discussion is qualified in its entirety by reference to the particular laws and regulatory provisions. A change in any of these laws or regulations or in their enforcement may have a material effect on our business and the business of our subsidiaries.

Bank Holding Companies and Financial Holding Companies

LCNB elected to become a financial holding company on April 11, 2000. A financial holding company is essentially a bank holding company with significantly expanded powers. Under the Gramm-Leach-Bliley Act, in addition to traditional lending activities, the following activities are among those that are deemed “financial in nature” for financial holding companies: securities underwriting, dealing in or making a market in securities, sponsoring mutual funds and investment companies, insurance underwriting and agency activities, activities which the Federal Reserve Board determines to be closely related to banking, and certain merchant banking activities.

As a financial holding company, LCNB has very broad discretion to affiliate with securities firms and insurance companies, provide merchant banking services, and engage in other activities that the Federal Reserve Board has deemed financial in nature. In order to continue as a financial holding company, LCNB must continue to be well-capitalized, well-managed, and maintain compliance with the Community Reinvestment Act. Depending on the types of financial activities that LCNB may elect to engage in, under the Gramm-Leach-Bliley Act’s functional regulation principles, it may become subject to supervision by additional government agencies. The election to be treated as a financial holding company increases LCNB's ability to offer financial products and services that historically it was either unable to provide or was only able to provide on a limited basis. As a result, LCNB faces increased competition in the markets for any new financial products and services that it may offer. Likewise, an increased amount of consolidation among banks and securities firms or banks and insurance firms could result in a growing number of large financial institutions that could compete aggressively with LCNB.

The Bank is subject to the provisions of the National Bank Act.  The Bank is subject to primary supervision, regulation, and examination by the OCC. The Bank is also subject to the rules and regulations of the Board of Governors of the Federal Reserve System and the FDIC.

-7-

Table of Contents

LCNB CORP. AND SUBSIDIARIES

Banking Operations.

LCNB Corp. and the Bank are subject to an extensive array of banking laws and regulations that are intended primarily for the protection of the Bank’s customers and depositors.  These laws and regulations govern such areas as permissible activities, loans and investments, and rates of interest that can be charged on loans and reserves.  LCNB Corp. and the Bank also are subject to general U.S. federal laws and regulations and to the laws and regulations of the State of Ohio.  Set forth below are brief descriptions of selected laws and regulations applicable to LCNB Corp. and the Bank.

Safe and Sound Banking Practices.

Bank holding companies are not permitted to engage in unsafe and unsound banking practices. The Federal Reserve Board’s Regulation Y, for example, generally requires a holding company to give the Federal Reserve Board prior notice of any redemption or repurchase of its own equity securities, if the consideration to be paid, together with the consideration paid for any repurchases or redemptions in the preceding year, is equal to 10% or more of the bank holding company’s consolidated net worth. The Federal Reserve Board may oppose the transaction if it believes that the transaction would constitute an unsafe or unsound practice or would violate any law or regulation. Depending upon the circumstances, the Federal Reserve Board could take the position that paying a dividend would constitute an unsafe or unsound banking practice.

The Federal Reserve Board has broad authority to prohibit activities of bank holding companies and their nonbanking subsidiaries which represent unsafe and unsound banking practices or which constitute violations of laws or regulations, and can assess civil money penalties for certain activities conducted on a knowing and reckless basis, if those activities caused a substantial loss to a depository institution. The penalties can be as high as $1.0 million for each day the activity continues.

Deposit Insurance Coverage and Assessments

The Bank is FDIC insured. Through the DIF, the FDIC provides deposit insurance protection that covers all deposit accounts in FDIC-insured depository institutions up to applicable limits (currently $250 thousand per depositor).

The Bank must pay assessments to the FDIC under a risk-based assessment system for this federal deposit insurance protection. FDIC-insured depository institutions pay insurance premiums at rates based on their risk classification. Institutions assigned to higher risk classifications (i.e., institutions that pose a greater risk of loss to the DIF) pay assessments at higher rates than institutions assigned to lower risk classifications. An institution’s risk classification is assigned based on its capital levels and the level of supervisory concern the institution poses to bank regulators. In addition, the FDIC can impose special assessments to cover shortages in the DIF and has imposed special assessments in the past.

On October 18, 2022, the FDIC issued a final rule that increased the initial base deposit insurance assessment rate paid by insured depository institutions by two basis points, beginning with the first quarterly assessment period of 2023. According to the FDIC, the new assessment rate increases the likelihood that its designated reserve ratio will reach the required minimum level of 1.35% by the statutory deadline of September 30, 2028 and will support progress toward achieving the long-term goal of a 2% ratio. The increase will remain in effect until the long-term goal of a 2% FDIC designated reserve ratio is achieved. Progressively lower assessment rates will take effect when the reserve ratio reaches 2% and again when the reserve ratio reaches 2.5%.

Under the Financial Institutions Reform, Recovery, and Enforcement Act of 1989, an FDIC-insured depository institution can be held liable for any losses incurred by the FDIC in connection with (1) the “default” of one of its FDIC-insured subsidiaries or (2) any assistance provided by the FDIC to one of its FDIC-receivers. “In danger of default” is defined generally as the existence of certain conditions indicating that a default is likely to occur in the absence of regulatory assistance. LCNB has never received an "in danger of default" categorization.

-8-

Table of Contents

LCNB CORP. AND SUBSIDIARIES

Dividends

LCNB Corp. is a legal entity separate and distinct from the Bank. LCNB Corp. receives most of its revenue from dividends paid to it by the Bank. During the years ended December 31, 2025, 2024, and 2023, dividends paid by LCNB National Bank to LCNB Corp. totaled $15.1 million, $22.0 million, and $29.0 million, respectively.

Described below are some of the laws and regulations that apply when either LCNB Corp. or the Bank pay or are paid dividends.

The Federal Reserve Board and the OCC have issued policy statements that recommend that bank holding companies and insured banks should generally only pay dividends to the extent net income is sufficient to cover both cash dividends and a rate of earnings retention consistent with capital needs, asset quality, and overall financial condition. Further, the Federal Reserve Board’s policy provides that bank holding companies should not maintain a level of cash dividends that undermines the bank holding company’s ability to serve as a source of strength to its banking subsidiaries. In addition, the Federal Reserve Board has indicated that each bank holding company should carefully review its dividend policy and has discouraged payment ratios that are at maximum allowable levels, which is the maximum dividend amount that may be issued and allow the Company to still maintain its target tier 1 capital ratio, unless both asset quality and capital are very strong.

To pay dividends, the Bank must maintain adequate capital above regulatory guidelines. Under federal law, the Bank cannot pay a dividend if, after paying the dividend, the Bank would be “undercapitalized.” National banks are required by federal law to obtain the prior approval of the OCC in order to declare and pay dividends if the total of all dividends declared in any calendar year would exceed the total of (1) such bank’s net profits (as defined and interpreted by regulation) for that year plus (2) its retained net profits (as defined and interpreted by regulation) for the preceding two calendar years, less any required transfers to surplus. If dividends exceed net profit for a year, a bank is generally not required to carry forward the negative amount resulting from such excess if the bank can attribute the excess to the preceding two years. If the excess is greater than the bank's previously undistributed net income for the preceding two years, prior OCC approval of the dividend is required and a negative amount would be carried forward in future dividend calculations. In addition, these banks may only pay dividends to the extent that retained net profits (including the portion transferred to surplus) exceed bad debts (as defined by regulation).

Affiliate Transactions

The Company and the Bank and other subsidiaries are "affiliates" within the meaning of the Federal Reserve Act. The Federal Reserve Act imposes limitations on a bank with respect to extensions of credit to, investments in, and certain other transactions with, its parent bank holding company and the holding company’s other subsidiaries. Loans and extensions of credit from the Bank to its affiliates are also subject to various collateral requirements. Further, the Bank's authority to extend credit to the Company's directors, executive officers, and principal shareholders, including their immediate family members, corporations, and other entities that they control, is subject to the restrictions and additional requirements of the Federal Reserve Act and Regulation O promulgated thereafter. These statutes and regulations impose specific limits on the amount of loans the Bank may make to directors and other insiders and specify approval procedures that must be followed in making loans that exceed certain amounts.

Capital

LCNB and the Bank are each required to comply with applicable capital adequacy standards established by the Federal Reserve Board and the OCC, respectively. The current risk-based capital standards applicable to LCNB and the Bank are based on the December 2010 final capital framework for strengthening international capital standards, known as Basel III.

In July 2013, the federal bank regulators approved final rules (the “Basel III Rules”) implementing the Basel III framework as well as certain provisions of the Dodd-Frank Act. The Basel III Rules substantially revised the risk-based capital requirements applicable to bank holding companies and their depository institution subsidiaries. The Basel III Rules became effective for LCNB and the Bank on January 1, 2015 (subject to a phase-in period for certain provisions).

The Basel III Rules established three components of regulatory capital: (1) common equity tier 1 capital (“CET1”); (2) additional tier 1 capital; and (3) tier 2 capital. Tier 1 capital is the sum of CET1 and additional tier 1 capital instruments meeting certain revised requirements. Total capital is the sum of tier 1 capital and tier 2 capital. Under the Basel III Rules, for most banking organizations, the most common form of additional tier 1 capital is non-cumulative perpetual preferred stock and the most common form of tier 2 capital is subordinated notes and a portion of the allocation for loan and lease losses, in each case, subject to the Basel III Rules’ specific requirements. LCNB Corp. does not have any non-cumulative perpetual preferred stock or subordinated notes.

Under the Basel III Rules, the minimum capital ratios effective as of January 1, 2015 are: (i) 4.5% CET1 to risk-weighted assets; (ii) 6.0% tier 1 capital to risk-weighted assets; (iii) 8.0% total capital to risk-weighted assets; and (iv) 4.0% tier 1 capital to average consolidated assets as reported on consolidated financial statements (known as the “leverage ratio”). The Basel III Rules established a “capital conservation buffer” of 2.5% above the new regulatory minimum risk-based capital requirements. The conservation buffer, when added to the capital requirements, resulted in the following minimum ratios: (i) a CET1 risk-based capital ratio of 7.0%; (ii) a tier 1 risk-based capital ratio of 8.5% and (iii) a total risk-based capital ratio of 10.5%. An institution is subject to limitations on certain activities including payment of dividends, share repurchases, and discretionary bonuses to executive officers if its capital level is below the buffer amount. With respect to the Bank, the Basel III Rules also revised the “prompt corrective action” regulations pursuant to Section 38 of the Federal Deposit Insurance Act, as discussed below under “Prompt Corrective Action.”

See Note 15 - Regulatory Matters and Impact on Payment of Dividends of the consolidated financial statements for more information concerning LCNB's compliance with regulatory capital ratios.

In November 2019, the federal banking regulators published final rules implementing a simplified measure of capital adequacy for certain banking organizations that have less than $10 billion in total consolidated assets. Under the final rules, which went into effect on January 1, 2020, depository institutions and depository institution holding companies that have less than $10 billion in total consolidated assets and meet other qualifying criteria, including a leverage ratio of greater than 9%, off-balance-sheet exposures of 25% or less of total consolidated assets, and trading assets plus trading liabilities of 5% or less of total consolidated assets, are deemed “qualifying community banking organizations” and are eligible to opt into the “community bank leverage ratio framework.” A qualifying community banking organization that elects to use the community bank leverage ratio framework and that maintains a leverage ratio of greater than 9% is considered to have satisfied the generally applicable risk-based and leverage capital requirements under the Basel III Rules and, if applicable, is considered to have met the “well capitalized” ratio requirements for purposes of its primary federal regulator’s prompt corrective action rules, discussed below. LCNB Corp. and the Bank have not opted to use the community bank leverage ratio framework, but may make such an election in the future.

-9-

Table of Contents

LCNB CORP. AND SUBSIDIARIES

Prompt Corrective Action

A banking organization’s capital plays an important role in connection with regulatory enforcement as well. Federal law provides the federal banking regulators with broad power to take prompt corrective action to resolve the problems of undercapitalized institutions. The extent of the regulators’ powers depends on whether the institution in question is “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” or “critically undercapitalized,” in each case as defined by regulation. Depending upon the capital category to which an institution is assigned, the regulators’ corrective powers include: (i) requiring the institution to submit a capital restoration plan; (ii) limiting the institution’s asset growth and restricting its activities; (iii) requiring the institution to issue additional capital stock (including additional voting stock) or to be acquired; (iv) restricting transactions between the institution and its affiliates; (v) restricting the interest rate that the institution may pay on deposits; (vi) ordering a new election of directors of the institution; (vii) requiring that senior executive officers or directors be dismissed; (viii) prohibiting the institution from accepting deposits from correspondent banks; (ix) requiring the institution to divest certain subsidiaries; (x) prohibiting the payment of principal or interest on subordinated debt; and (xi) ultimately, appointing a receiver for the institution.

Under current regulations, the Bank was “well capitalized” as of December 31, 2025.

Community Reinvestment Act of 1977

The CRA subjects a bank to regulatory assessment to determine if the institution meets the credit needs of its entire community, including low-and moderate-income neighborhoods served by the bank, and to take that determination into account in its evaluation of any application made by such bank for, among other things, approval of the acquisition or establishment of a branch or other depository facility, an office relocation, a merger, or the acquisition of shares of capital stock of another financial institution. The regulatory authority prepares a written evaluation of an institution’s record of meeting the credit needs of its entire community and assigns a rating. These ratings are “Outstanding,” “Satisfactory,” “Needs Improvement,” and “Substantial Non-Compliance.” Institutions with ratings lower than “Satisfactory” may be restricted from engaging in the aforementioned activities. Management believes the Bank has taken and takes significant actions to comply with the CRA and it received a “Satisfactory” rating in its most recent review by federal regulators with respect to its compliance with the CRA.

On October 24, 2023, the OCC, the Board of Governors of the Federal Reserve System, and the FDIC released a final rule that significantly changes how all but the smallest banks will be evaluated for compliance with the CRA. Under the new regulations, banks with $2 billion or more in assets will be evaluated under a Retail Lending Test, a Retail Services and Products Test, a Community Development Financing Test, and a Community Development Services Test. Banks with total assets of $600 million or more and less than $2 billion will be evaluated under the Retail Lending Test and, at the bank's option, either the current Intermediate Bank Community Development Test or the new Community Development Financing Test. The final rule became effective on April 1, 2024 with staggered compliance dates of January 1, 2026 and January 1, 2027. On July 16, 2025, the OCC, the Board of Governors of the Federal Reserve System, and the FDIC issued a proposal to rescind the CRA final rule issued in October 2023 and to replace it with the prior CRA regulations. The prior CRA regulations currently remain in effect.

BSA and AML

Under the BSA, financial institutions are required to monitor and report unusual or suspicious account activity that might signify money laundering, tax evasion, or other criminal activities, as well as transactions involving the transfer or withdrawal of amounts in excess of prescribed limits. The BSA is sometimes referred to as an “anti-money laundering” law (“AML”). Several AML acts, including provisions in Title III of the USA PATRIOT Act of 2001, have been enacted to amend the BSA. Under the USA PATRIOT Act, financial institutions are subject to prohibitions against specified financial transactions and account relationships as well as enhanced due diligence and “know your customer” standards in their dealings with financial institutions and foreign customers.

In addition, under the USA PATRIOT Act, the Secretary of the U.S. Department of the Treasury ("Treasury") has adopted rules addressing a number of related issues, including increasing the cooperation and information sharing between financial institutions, regulators, and law enforcement authorities regarding individuals, entities, and organizations engaged in, or reasonably suspected based on credible evidence of engaging in, terrorist acts or money laundering activities. Any financial institution complying with these rules will not be deemed to violate the privacy provisions of the Gramm-Leach-Bliley Act that are discussed below. Finally, under the regulations of the Office of Foreign Asset Control ("OFAC") financial institutions are required to monitor and block transactions with certain “specially designated nationals” who OFAC has determined pose a risk to U.S. national security.

Incentive Compensation

LCNB is subject to regulatory rules and guidance regarding employee incentive compensation policies intended to ensure that incentive-based compensation does not undermine the safety and soundness of the institution by encouraging excess risk-taking. LCNB's incentive compensation arrangements must provide employees with incentives that appropriately balance risk and reward and do not encourage imprudent risk, be compatible with effective controls and risk managements, and be supported by strong corporate governance, including active and effective oversight by LCNB's board of directors.

-10-

Table of Contents

LCNB CORP. AND SUBSIDIARIES

Consumer Laws and Regulations

LCNB is also subject to certain consumer laws and regulations that are designed to protect consumers in transactions with banks. While the following list is not exhaustive, these laws and regulations include the Truth in Lending Act, the Truth in Savings Act, the Electronic Funds Transfer Act, the Expedited Funds Availability Act, the Equal Credit Opportunity Act, The Fair and Accurate Credit Transactions Act, The Real Estate Settlement Procedures Act, and the Fair Housing Act, among others. These laws and regulations, among other things, prohibit discrimination on the basis of race, gender, or other designated characteristics and mandate various disclosure requirements and regulate the manner in which financial institutions must deal with customers when taking deposits or making loans to such customers. These and other laws also limit finance charges or other fees or charges earned for offering various services. LCNB must comply with the applicable provisions of these consumer protection laws and regulations as part of its ongoing customer relations.

Consumer Privacy

State and federal banking regulators have issued various policy statements emphasizing the importance of technology risk management and supervision in evaluating the safety and soundness of depository institutions with respect to banks that contract with outside vendors to provide data processing and core banking functions. The use of technology-related products, services, delivery channels, and processes exposes a bank to various risks, particularly operational, privacy, security, strategic, reputation, and compliance risk. Banks are generally expected to prudently manage technology-related risks as part of their comprehensive risk management policies by identifying, measuring, monitoring, and controlling risks associated with the use of technology.

Under Section 501 of the Gramm-Leach-Bliley Act, the federal banking agencies have established appropriate standards for financial institutions regarding the implementation of safeguards to ensure the security and confidentiality of customer records and information, protection against any anticipated threats or hazards to the security or integrity of such records, and protection against unauthorized access to or use of such records or information in a way that could result in substantial harm or inconvenience to a customer. Among other matters, the rules require each bank to implement a comprehensive written information security program that includes administrative, technical, and physical safeguards relating to customer information.

Under the Gramm-Leach-Bliley Act, a financial institution must provide its customers with a notice of privacy policies and practices. Section 502 prohibits a financial institution from disclosing nonpublic personal information about a customer to nonaffiliated third parties unless the institution satisfies various notice and opt-out requirements and the customer has not elected to opt out of the disclosure. Under Section 504, the agencies are authorized to issue regulations as necessary to implement notice requirements and restrictions on a financial institution’s ability to disclose nonpublic personal information about customers to nonaffiliated third parties. Under the final rule the regulators adopted, all banks must develop initial and annual privacy notices which describe in general terms the bank’s information sharing practices. Banks that share nonpublic personal information about customers with nonaffiliated third parties must also provide customers with an opt-out notice and a reasonable period of time for the customer to opt out of any such disclosure, with certain exceptions. Limitations are placed on the extent to which a bank can disclose an account number or access code for credit card, deposit, or transaction accounts to any nonaffiliated third party for use in marketing.

Cybersecurity

In 2015, Federal regulators issued two statements regarding cybersecurity: (i) a statement indicating that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institutions; and (ii) a statement indicating the expectation of a financial institution's management to maintain a sufficient business continuity planning process to ensure rapid recovery, resumption and maintenance of the financial institution's operations after a cyber-attack involving destructive malware.  A financial institution is also expected to develop appropriate processes to: (a) enable recovery of data and business operations, (b) address rebuilding network capabilities, and (c) restore data if the financial institution or any of its critical service providers fall victim to this type of cyber-attack.  If the Company does not comply with this regulatory guidance, it could be subject to various regulatory sanctions, as well as financial penalties.

In November 2021, federal banking agencies approved a final rule requiring banking agencies to notify regulators of any “significant computer-security incident” as soon as possible and no later than 36 hours after a determination that such an incident occurred, with compliance required by May 2022. In addition, banks must notify at least one designated point of contact at any affected customer as soon as possible when the bank experiences any computer-security incident that has disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to such customer for four or more hours. The bank and holding company are required to determine whether an incident arises to the level of requiring notification.

In April 2005, federal regulators issued guidance requiring financial institutions to develop and implement a response program designed to address incidents of unauthorized access to sensitive customer information maintained by the financial institution or its service provider. The guidance requires several elements to be included in an institution’s response program including notifications to an institution’s primary federal regulator as soon as possible when the institution becomes aware of an incident involving unauthorized access to or use of sensitive customer information; and notification to its customers when, after a reasonable investigation, the financial institution determines that misuse of the information has occurred or it is reasonably possible that misuse will occur.

State regulators have also been increasingly active in implementing data privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. Many, but not all, state breach notification laws expressly exempt entities that are subject to federal regulatory breach notification mandates The Company continues to monitor developments in the states in which its customers are located.

The Cybersecurity Information Sharing Act (“CISA”) is intended to improve cybersecurity in the U.S. by enhanced sharing of information about security threats among the U.S. government and private sector entities, including financial institutions, and empowers the Cybersecurity and Infrastructure Security Agency (“CISA Agency”) to oversee this information-sharing process. The CISA also authorizes companies to monitor their own systems notwithstanding any other provision of law and allows companies to carry out defensive measures on their own systems from cyber-attacks or other information or security breaches. The law includes liability protections for companies that share cyber-threat information with third parties so long as such sharing activity is conducted in accordance with the CISA. Although the CISA originally expired on September 30, 2025 and was temporarily reauthorized to remain in effect through September 30, 2026, the long-term status of the CISA remains uncertain pending further action by the U.S. Congress. In addition, the enactment of the Cyber Incident Reporting for Critical Infrastructure Act (“CIRCIA”) in 2022, once rulemaking is complete, will require, among other things, certain companies to report significant cyber incidents to the CISA Agency within 72 hours from the time the company reasonably believes the incident occurred (and within 24 hours of making a ransom payment as a result of a ransomware attack). On April 4, 2024, the CISA Agency proposed a rule under the CIRCIA that would clarify the scope of cyber incidents to be reported and would further define covered entities subject to the CIRCIA to expressly include companies in the financial services industry that are required to report cyber incidents to their primary federal regulators. Final rulemaking for CIRCIA has been extended to May 2026.

On July 26, 2023, the SEC adopted final rules that require public companies to promptly disclose material cybersecurity incidents in a Current Report on Form 8-K and detailed information regarding their cybersecurity risk management, strategy, and governance on an annual basis in its Annual Reports on Form 10-K. Companies are required to report on Form 8-K any cybersecurity incident they determine to be material within four business days of making that determination. These SEC rules, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations.

See Item 1C for further discussion related to the Company's risk management, strategy, and governance of cybersecurity.

-11-

Table of Contents

LCNB CORP. AND SUBSIDIARIES

Dodd-Frank Act and Regulatory Relief Act

The Dodd-Frank Act, which was enacted in July 2010, effected a fundamental restructuring of federal banking regulation. In addition to those provisions discussed above, among the Dodd-Frank Act provisions that have affected LCNB are the following:

Management continues to review actively the provisions of the Dodd-Frank Act and assess its probable impact on its business, financial condition, and results of operations.

The Economic Growth, Regulatory Relief, and Consumer Protection Act (the "Regulatory Relief Act") was signed into law on May 24, 2018. The Regulatory Relief Act scales back certain aspects of the Dodd-Frank Act and provides other regulatory relief for financial institutions. Certain provisions affecting LCNB include:

-12-

Table of Contents

LCNB CORP. AND SUBSIDIARIES

Consumer Financial Protection Bureau

The Dodd-Frank Act created an independent federal agency called the Consumer Financial Protection Bureau, which is granted broad rulemaking, supervisory, and enforcement powers under various federal consumer financial protection laws, including the Equal Credit Opportunity Act, Truth in Lending Act, Real Estate Settlement Procedures Act, Fair Credit Reporting Act, Fair Debt Collection Act, the Consumer Financial Privacy provisions of the Gramm-Leach-Bliley Act, and certain other statutes. The CFPB has examination and primary enforcement authority with respect to depository institutions with $10 billion or more in assets. Smaller institutions are subject to rules promulgated by the CFPB but continue to be examined and supervised by federal banking regulators for consumer compliance purposes. The Dodd-Frank Act permits states to adopt consumer protection laws and standards that are more stringent than those adopted at the federal level and, in certain circumstances, permits the state attorney general to enforce compliance with both the state and federal laws and regulations.

The CFPB has finalized rules relating to, among other things, remittance transfers under the Electronic Fund Transfer Act, which requires companies to provide consumers with certain disclosures before the consumer pays for a remittance transfer. These rules became effective in October 2013. The CFPB has also amended certain rules under Regulation C relating to home mortgage disclosure to reflect a change in the asset-size exemption threshold for depository institutions based on the annual percentage change in the Consumer Price Index for Urban Wage Earners and Clerical Workers. In addition, on January 10, 2013, the CFPB released its final “Ability-to-Repay/Qualified Mortgage” rules, which amended the Truth in Lending Act (Regulation Z). Regulation Z prohibits a creditor from making a higher-priced mortgage loan without regard to the consumer’s ability to repay the loan. The final amended rule implemented sections 1411 and 1412 of the Dodd-Frank Act, which generally require creditors to make a reasonable, good faith determination of a consumer’s ability to repay any consumer credit transaction secured by a dwelling (excluding an open-end credit plan, timeshare plan, reverse mortgage, or temporary loan) and establishes certain protections from liability under this requirement for “qualified mortgages.” The final rule also implemented section 1414 of the Dodd-Frank Act, which limits prepayment penalties. Finally, the final rule requires creditors to retain evidence of compliance with the rule for three years after a covered loan is consummated. This rule became effective January 10, 2014.

Monetary Policy

Banks are affected by the credit policies of monetary authorities, including the Federal Reserve Board, that affect the national supply of credit. The Federal Reserve Board regulates the supply of credit in order to influence general economic conditions, primarily through open market operations in United States government obligations, varying the discount rate on financial institution borrowings, varying reserve requirements against financial institution deposits, and restricting certain borrowings by financial institutions and their subsidiaries. The monetary policies of the Federal Reserve Board have had a significant effect on the operating results of banks in the past and are expected to continue to do so in the future.

Regulatory Reform and Legislation

From time to time, various legislative and regulatory initiatives are introduced in Congress and state legislatures, as well as by regulatory agencies. Such initiatives may include proposals to expand or contract the powers of bank holding companies and depository institutions or proposals to substantially change the financial institution regulatory system. Such legislation could change banking statutes and the operating environment of LCNB and the Bank in substantial and unpredictable ways. If enacted, such legislation could increase or decrease the cost of doing business, limit or expand permissible activities, or affect the competitive balance among banks, savings associations, credit unions, and other financial institutions. LCNB and the Bank cannot predict whether any such legislation will be enacted, and, if enacted, the effect that it, or any implementing regulations, would have on the financial condition or results of operations of LCNB and the Bank. A change in statutes, regulations, or regulatory policies applicable to LCNB and the Bank could have a material effect on LCNB’s business, financial condition, and results of operations. At this time, LCNB and the Bank do not expect material costs and effects to result from any federal, state, or local environmental laws that may be enacted.

-13-

Table of Contents

LCNB CORP. AND SUBSIDIARIES

Human Capital

As of December 31, 2025, LCNB employed 328 full-time and 35 part-time employees working throughout the ten Ohio counties in which LCNB operates. LCNB considers these individuals the most important influence contributing to the Bank’s success and is committed to investing in their ongoing growth and development.

Through an ongoing collaboration with a local non-profit organization, LCNB's employee council is working to expand education and share experiences; to acknowledge, celebrate, and encourage various backgrounds, interests, and lifestyles; and to broaden recruitment efforts in order to source untapped potential.

LCNB places a high priority on training and development and has enjoyed a long history of promoting from within the organization, as evidenced by the executive management team. Through a blend of strong internal talent and new talent, the Bank has been able to successfully navigate the ongoing challenges related to talent depth. As LCNB grows and develops new products and services, the Bank continues to seek innovative, cost effective, and efficient ways to educate and develop its employees. Through a blend of online education, interactive training sessions, and experiential learning, LCNB provides opportunities for those who desire to fine-tune existing skills as well as those who desire to prepare for the next steps along their career path.

LCNB values and invests in overall employee well-being and satisfaction, providing compensation and benefits that are competitive with those provided by other financial institutions and major employers within LCNB's market area. In addition to traditional benefits, which include health, dental, life, vision, and long-term disability insurance, LCNB offers other voluntary coverages. Some of these benefits are paid by the Bank, others are shared cost, and some are employee-paid. LCNB also provides all employees access to a personal care advocate through the LCNB Care Center. Advocates provide independent, confidential support in navigating all aspects of health care benefits. Additional benefits include a matching 401(k) plan, a performance bonus plan, and tuition reimbursement plans.

LCNB has an active Wellness Committee comprised of employees from across the Bank. The committee promotes activities, education, and consultation that improve the health and lives of employees and their families. A no-cost Employee Assistance Program (EAP) offers benefits that are available to both full-time and part-time employees and members of their households. Services include 24/7 access to licensed mental health professionals, ongoing personal coaching sessions, and referrals to additional support resources based on needs. As part of evolving wellness efforts, LCNB provides employees with an interactive online Health and Wellness Portal, which offers employees access to personalized one-on-one sessions with a certified health coach, trainer, licensed dietician, or registered nurse.

Fostering and enhancing a culture of open and transparent communication remains extremely important to the Bank. In 2020, the Bank initiated quarterly Town Hall Meetings and weekly informational emails from senior management that allowed all employees to participate and receive information. The Bank will do the same in 2026 along with some smaller scheduled group meetings to further communicate important initiatives and information. In addition, senior management is available to participate in department and branch staff meetings upon request.

-14-

Table of Contents

LCNB CORP. AND SUBSIDIARIES

Availability of Financial Information

LCNB files unaudited quarterly financial reports on Form 10-Q, annual financial reports on Form 10-K, current reports on Form 8-K, and amendments to these reports are filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934 with the SEC.  Copies of these reports are available free of charge in the shareholder information section of the Bank's website, www.lcnb.com, as soon as reasonably practicable after they are electronically filed or furnished to the SEC, or by writing to:

Andrew M. Wallace

Executive Vice President, CFO

LCNB Corp.

2 North Broadway

P.O. Box 59

Lebanon, Ohio 45036

The SEC also maintains an internet site (www.sec.gov) that contains reports, proxy and information statements, and other information regarding registrants that file reports electronically, as LCNB does. LCNB's filings are available on the SEC's website under the ticker name "LCNB".

STATISTICAL INFORMATION

The following tables and certain tables appearing in Item 7, Management's Discussion and Analysis present additional statistical information about LCNB Corp. and its operations and financial condition. They should be read in conjunction with the consolidated financial statements and related notes and the discussion included in Item 7, Management's Discussion and Analysis of Financial Condition and Results of Operations, and Item 7A, Quantitative and Qualitative Disclosures about Market Risk.

Distribution of Assets, Liabilities and Shareholders' Equity; Interest Rates and Interest Differential

The table presenting an average balance sheet, interest income and expense, and the resultant average yield for average interest-earning assets and average interest-bearing liabilities is included in Item 7, Management's Discussion and Analysis of Financial Condition and Results of Operations.

The table analyzing changes in interest income and expense by volume and rate is included in Item 7, Management's Discussion and Analysis of Financial Condition and Results of Operations.

-15-

Table of Contents

LCNB CORP. AND SUBSIDIARIES

Contractual maturities of debt securities at December 31, 2025, were as follows.  Actual maturities may differ from contractual maturities when issuers have the right to call or prepay obligations. Weighted average yield is based on amortized cost.

(1) Yields on tax-exempt obligations are computed on a taxable-equivalent basis based upon a 21.0% statutory Federal income tax rate.

Excluding holdings in U.S. Treasury securities and U.S. Government Agencies, there were no investments in securities of any issuer that exceeded 10% of LCNB's consolidated shareholders' equity at December 31, 2025.

-16-

Table of Contents

LCNB CORP. AND SUBSIDIARIES

Loan Portfolio

The following table summarizes loan maturities and sensitivities to interest rate change at December 31, 2025 (in thousands):

Allocation of the Allowance for Credit Losses on Loans

The following table presents the allocation of the allowance for credit losses on loans:

Deposits

The statistical information regarding average amounts and average rates paid for the deposit categories is included in the "Distribution of Assets, Liabilities and Shareholders' Equity" table included in Item 7, Management's Discussion and Analysis of Financial Condition and Results of Operations.

The estimated amount of uninsured deposits including related interest accrued and unpaid was $304.1 million and $245.8 million at December 31, 2025 and 2024, respectively.

The following table presents an estimate of the contractual maturities of time deposits that exceed the FDIC insurance limit of $250 thousand at December 31, 2025: