ORRSTOWN FINANCIAL SERVICES INC (ORRF) Business

ITEM 1 – BUSINESS

Background

Orrstown Financial Services, Inc., a Pennsylvania corporation, is the financial holding company ("FHC") for its wholly-owned subsidiary Orrstown Bank. The Company’s principal executive offices are located at 4750 Lindle Road, Harrisburg, Pennsylvania, 17111. The Parent Company was organized on November 17, 1987 for the purpose of acquiring the Bank and such other banks and bank-related activities as are permitted by law. The Company provides banking and financial advisory services in south central Pennsylvania, principally in Berks, Cumberland, Dauphin, Franklin, Lancaster, Perry and York Counties, Pennsylvania, and in Anne Arundel, Baltimore, Harford, Howard and Washington Counties, Maryland, as well as Baltimore City, Maryland. The Company’s lending area also includes counties in Pennsylvania, Maryland, Delaware, Virginia and West Virginia within a 75-mile radius of the Company's executive and administrative offices as well as the District of Columbia.

Merger

The Company merged with Codorus Valley Bancorp, Inc. ("Codorus Valley") and the Bank merged with its wholly-owned bank subsidiary, PeoplesBank, A Codorus Valley Company, with the Company and the Bank as the surviving entities in the Merger on July 1, 2024 (the "Codorus Valley Merger"). The merger and acquisition method of accounting was used to account for the transaction with the Company as the acquirer. The Company recorded the assets and liabilities of Codorus Valley at their respective fair values as of July 1, 2024. The transaction was valued at $233.4 million and expanded the Bank’s footprint into the York, Pennsylvania market while increasing its market penetration in its existing markets.

Business

The Bank was organized in 1919 as a state-chartered bank. On March 8, 1988, in a bank holding company reorganization transaction, the Parent Company acquired 100% ownership of the Bank.

The Parent Company’s primary activity consists of owning and supervising its subsidiary, the Bank. Day-to-day management is conducted by its officers, who are also Bank officers. The Parent Company has historically derived most of its income through dividends from the Bank. At December 31, 2025, the Company had total assets of $5.5 billion, total deposits of $4.5 billion and total shareholders’ equity of $591.5 million.

The Bank operates in the community banking segment and engages in lending activities, including commercial, residential, commercial mortgages, construction, municipal, and various forms of consumer lending and deposit services, including checking, savings, time and money market deposits. The Bank also provides fiduciary, investment advisory, insurance and brokerage services. These activities engaged in by the Bank are authorized by the Pennsylvania Banking Code of 1965. The Company and the Bank are subject to regulation by certain federal and state agencies and undergo periodic examinations by such regulatory authorities. The concentrations of credit by type of loan are included in Note 4, Loans and Allowance for Credit Losses, to the Consolidated Financial Statements under Part II, Item 8, "Financial Statements and Supplementary Data."

Human Capital

At December 31, 2025, the Bank had 627 full-time and 25 part-time employees. At December 31, 2025, approximately 67% of our workforce was female and 33% was male. Our average tenure is approximately seven years. The Parent Company has no employees. Its 17 executive officers are employees of the Bank, who represent a mix of newer and more seasoned employees with significant and diverse experience and have an average tenure of 11 years with the Company.

We encourage and support the growth and development of our employees. Continuous learning and career development is advanced through ongoing performance and development conversations with employees, internally created training programs, including development and advancement training offered through our in house training program called Orrstown University, customized corporate training engagements and educational reimbursement and certification programs. Training opportunities are available both online and in-person, and all employees have online access to courses for professional development provided by a third party. We have a Management Associate Program, which had three employees in 2025. This program provides a structured learning experience, which ranges from one to two years, that focuses on the commercial line of business and credit administration, and then progresses into rotations within other lines of business.

Employee evaluations are conducted on at least an annual basis. Those evaluations focus on job performance, achievement of goals and employee and career development. In addition, we monitor employee satisfaction and engagement through periodic employee surveys.

4

Table of Contents

The safety, health and wellness of our employees is a top priority. Through teamwork and the adaptability of our management and staff, our remote work options evolved as many of our employees effectively work a hybrid schedule from our office and remote locations. We continue to highlight the importance of the safety, health and wellness of our employees. We also introduced a number of new initiatives that focus on both physical and mental health. We take every opportunity to provide our employees with the tools and resources to assist them to navigate their work environment in a more positive and thoughtful manner.

We offer competitive compensation to attract and further strengthen employee engagement and encourage retention. Compensation packages include a market-competitive salary, healthcare and retirement benefits, paid time off, and may also include bonuses or sales commissions and short-term and long-term equity incentives.

We deploy numerous methods to foster employee engagement, including regular company-wide calls, weekly communication through our Orrstown Connections publications, new employee engagement event with the CEO, employee recognitions and service anniversaries including an event for Employee Appreciation Day, community service and leadership programs, annual events for all employees and off-site events with family and friends.

Lending

Federal bank regulatory agencies have adopted uniform regulations prescribing standards for extensions of credit that are secured by liens or interests in real estate or made for the purpose of financing permanent improvements to real estate. Under these regulations, all insured depository institutions, such as the Bank, must adopt and maintain written policies establishing appropriate limits and standards for extensions of credit that are secured by liens or interests in real estate or are made for the purpose of financing permanent improvements to real estate. These policies must establish loan portfolio diversification standards, prudent underwriting standards (including loan-to-value limits) that are clear and measurable, loan administration procedures and documentation, and approval and reporting requirements. The real estate lending policies must reflect consideration of the federal bank regulatory agencies’ Interagency Guidelines for Real Estate Lending Policies.

All secured loans are supported with appraisals or evaluations of collateral. Business equipment and machinery, inventories, accounts receivable, and farm equipment are considered appropriate security, provided borrowers meet acceptable standards for liquidity and marketability. Loans secured by real estate generally do not exceed 85% of the appraised value of the property. Loan to collateral values are monitored as part of the loan review process, and appraisals are updated as deemed appropriate under the circumstances.

Commercial Lending

The Bank originates commercial real estate, equipment, construction, working capital and other commercial purpose loans to commercial clients throughout the Bank’s various markets. The Bank has significant market share in south central Pennsylvania and has been expanding its presence geographically in recent years. Currently, growth markets include the Harrisburg region, Lancaster County and Maryland markets, while the Bank's commercial lending is primarily focused in these geographic regions or with borrowers headquartered in these geographic regions. The Company’s lending area also includes counties in Pennsylvania, Maryland, Delaware, Virginia and West Virginia within a 75-mile radius of the Company's executive and administrative offices, as well as the District of Columbia.

The Bank’s credit policy dictates the underwriting requirements for the various types of commercial loans the Bank makes available to borrowers. The policy covers such requirements as debt coverage ratios, advance rates against different forms of collateral, loan-to-value ratios and maximum term.

A majority of the Company’s loans are for business purposes. At December 31, 2025, approximately 75% of the loan portfolio was comprised of commercial loans compared to 76% at December 31, 2024.

Consumer Lending

The Bank originates home equity loans, home equity lines of credit and other consumer loans, primarily through its branch network and client service center. A large majority of the consumer loans are secured by either a first or second lien position on the borrower’s primary residential real estate. The Bank requires a home equity loan borrower to have a credit score of 710 for a loan-to-value ratio of 85% of the value of the real estate being taken as collateral. Home equity loan borrowers with a credit score under 710 require additional real estate collateral for a loan-to value ratio less than 85%. The Bank also, at times, purchases consumer loans to help diversify credit risk in our loan portfolio.

5

Table of Contents

Residential Lending

The Bank originates residential mortgages throughout its various markets referred from retail branches and through a network of mortgage loan officers. Residential mortgages originated by the Bank may be sold to secondary market investors, which include both GSE and non-GSE investors. All mortgages, regardless of being sold or held in the Bank’s portfolio, are generally underwritten to secondary market industry standards for prime mortgages. For loans originated for investment, the Bank requires pricing adjustments commensurate with the risk and the real estate taken as collateral results in the Bank holding a first lien on the property. The loan-to-value ratio requirements of the real estate being taken as collateral varies per the Credit Policy, and may require the borrower to obtain private mortgage insurance. The Bank also, at times, purchases residential mortgage loans to help diversify credit risk in our loan portfolio and to continue meeting the credit needs of the communities in which the Bank operates.

Loan Review

The Company has a loan review policy and program, which is designed to identify and monitor risk, evaluate the adequacy and adherence to internal credit policies and loan administration procedures, verify the quality of loan approval, monitoring and risk assessments, and assess the overall quality of the loan portfolio. The Management ERM Committee, comprised of executive and senior officers and loan department personnel, is charged with the oversight of overall credit quality and risk exposure of the Company's loan portfolio. This includes the monitoring of the lending activities of all Company personnel with respect to underwriting and processing new loans and the timely follow-up and corrective action for loans showing signs of deterioration in quality. A loan review program provides the Company with an independent review of the commercial loan portfolio on an ongoing basis. Generally, consumer and residential mortgage loans are included in the Pass categories unless a specific action, such as extended delinquencies, bankruptcy, repossession or death of the borrower occurs, which increases the possibility of a credit loss.

Internal loan reviews are completed annually on all commercial relationships with a committed loan balance in excess of $2.0 million. In addition, all commercial relationships greater than $500 thousand rated special mention, substandard, doubtful or loss are reviewed quarterly and corresponding risk ratings are changed or reaffirmed by the Company's Problem Loan Committee, with subsequent reporting to the Management ERM Committee and the Board ERM Committee.

The Bank outsources its independent loan review to a third-party provider, who monitors and evaluates commercial borrowers on a quarterly basis utilizing risk-rating criteria established in the credit policy in order to identify deteriorating trends and detect conditions which might indicate potential problem loans. The results of the third-party loan review are reported quarterly to the Management and Board ERM Committees for review. The loan ratings are a data component evaluated within the qualitative factors of the ACL calculation.

Deposit Products

The Bank offers deposit products to retail, commercial, non-profit and government clients through its retail branch network, its website and commercial team. Product offerings for retail clients include checking accounts, money markets, savings and certificates of deposit. The Bank offers a suite of treasury management solutions for businesses that help them to forecast and manage their cash and receivables. The Bank is committed to advancing digital capabilities for all clients, to ensure scalability and optimization of financial performance within the organizations. A robust treasury management online banking platform allows clients to send and collect money electronically using ACH and wire transfer origination services, deposit checks via mobile or desktop capture, and mitigate fraud through check and ACH positive pay services. Wire transfers may be sent and also received domestically, as well as internationally in most currencies. Online bill-pay services allow check and electronic payments, with same day, next day and future dated payments. Additionally, business clients can automatically move money between Bank accounts using various automated sweep services. Using strategic partnerships, the Bank is able to offer best-in-class lockbox services, armored cash logistic solutions, credit cards, purchasing cards, and merchant card processing services.

Digital capability for consumers includes person-to-person (P2P) payment, bill pay, mobile deposit capture and domestic money transfer services. Traditional domestic and international wire transfer services are also offered via the Bank's branches. In addition to opening accounts and communicating with employees via traditional branch or call-center engagement, digital online account opening, online loan and credit card application processing, online mortgage pre-qualification and mortgage application processing, automated telephone services, and online chat features provide consumers with convenient digital alternatives to more traditional products and services.

Investment Services

The Bank renders services as trustee, executor, administrator, guardian, managing agent, custodian, investment advisor, and other fiduciary activities authorized by law under the trade name Orrstown Financial Advisors, or OFA. OFA offers retail

6

Table of Contents

brokerage services through a third-party broker/dealer arrangement with Cetera Wealth Services LLC. At December 31, 2025 and 2024, assets under management by OFA totaled $3.1 billion and $3.2 billion, respectively.

Competition

The Bank’s principal market area consists of south central Pennsylvania, the greater Baltimore region, and Washington County, Maryland. The Bank serves a substantial number of depositors in this market area and its contiguous counties. The Bank also competes for loans in counties in Pennsylvania, Maryland, Delaware, Virginia and West Virginia within a 75-mile radius of the Bank's executive and administrative officers as well as the District of Columbia.

The Bank competes with other banks and less heavily regulated financial services companies, such as credit unions and finance and trust companies, as well as mortgage banking companies, mutual funds, investment advisors, and brokerage firms, both within and outside of its primary market areas. Financial technology companies, or Fintechs, are also providing nontraditional, but increasingly strong competition for the acquisition and retention of clients.

The Bank competes for loans primarily on the basis of a combination of value and service by building client relationships as a result of addressing its clients’ banking needs, demonstrating expertise, and providing convenience to its clients.

The Bank competes for deposits similarly on the basis of a combination of value and service and by providing convenience through a banking network of branches and ATMs within its markets and digital service channels such as mobile banking.

The Company implements strategic initiatives focused on expanding its core businesses and exploring opportunities for acquisition and divestiture to the extent permitted by its regulators. The Company's management believes its market area will support further growth in the future.

Regulation and Supervision

The Parent Company is a bank holding company registered with the FRB and has elected status as an FHC. The Bank is a Pennsylvania-chartered commercial bank and a member bank of the Federal Reserve System.

Regulatory Environment

The banking industry is highly regulated, and Orrstown is subject to supervision, regulation, and examination by the FRB, as its primary federal regulator, and the Pennsylvania Department of Banking and Securities. The statutory and regulatory framework that governs the Company is generally intended to protect depositors and clients, the FDIC's Deposit Insurance Fund, the U.S. banking and financial system, and financial markets as a whole by ensuring the safety and soundness of bank holding companies ("BHCs") and banks. Bank regulators regularly examine the operations of BHCs and banks. Regulators have broad supervisory and enforcement authority over BHCs and banks, including the power to impose nonpublic supervisory agreements, issue cease and desist orders, impose fines and other civil penalties, terminate deposit insurance, and appoint a conservator or receiver. Engaging in unsafe or unsound practices or failing to comply with applicable laws, regulations, and supervisory agreements could subject the Company and its respective officers, directors, and institution-affiliated parties to the remedies described above, and other sanctions.

Banking statutes, regulations, and policies are continually under review, as applicable, by Congress, state legislatures, and federal and state regulatory agencies. In addition to laws and regulations, state and federal bank regulatory agencies may issue policy statements, interpretive letters, and similar written guidance applicable to Orrstown. Any change in statutes, regulations, or regulatory policies applicable to us, including changes in their interpretation or implementation, could have a material effect on our business or organization.

The Parent Company is also subject to the disclosure and regulatory requirements of the Securities Act and the Exchange Act, both as administered by the SEC, as well as the rules of Nasdaq that apply to companies with securities listed on the Nasdaq Capital Market.

Several of the more significant regulatory provisions applicable to BHCs and banks to which the Company and the Bank are subject are discussed below, along with certain regulatory matters concerning the Parent Company and the Bank. To the extent that the following information describes statutory or regulatory provisions, such information is qualified in its entirety by reference to the particular statutes or regulations. Any change in applicable law or regulation may have a material effect on the business and prospects of the Parent Company and the Bank.

7

Table of Contents

Financial and Bank Holding Company Activities

As a FHC, the Parent Company is permitted to engage, directly or through subsidiaries, in a wide variety of activities that are financial in nature or are incidental or complementary to a financial activity, in addition to the activities otherwise permitted for bank holding companies that are not FHCs.

As a FHC, the Parent Company is generally subject to the same regulation as other BHCs, including the reporting, examination, supervision and consolidated capital requirements of the FRB. To preserve its FHC status, the Parent Company must remain well-capitalized and well-managed and ensure that the Bank remains well-capitalized and well-managed for regulatory purposes and earns “satisfactory” or better ratings on its periodic CRA examinations. An FHC ceasing to meet these standards is subject to a variety of restrictions, depending on the circumstances.

If the FRB finds that the Parent Company or the Bank are either not well-capitalized or not well-managed, the FRB will notify the Parent Company of its non-compliance, and if the Bank is not well-capitalized, the Parent Company or the Bank must promptly notify the FRB. Until compliance is restored, the FRB has broad discretion to impose appropriate limitations on a FHC’s activities. If compliance is not restored within 180 days, the FRB may ultimately require the FHC to divest its depository institutions or in the alternative, to discontinue or divest any activities that are not permitted for non-FHC bank holding companies.

If the FRB determines that a FHC or its subsidiaries do not satisfy the CRA requirements, the potential restrictions are different. In that case, until all of the subsidiary institutions are restored to at least “satisfactory” CRA rating status, the FHC may not engage, directly or through a subsidiary, in any of the additional financial in nature activities permissible for FHCs under the BHC Act nor make additional acquisitions of companies engaged in such additional activities. However, completed acquisitions and additional activities and affiliations previously begun are left undisturbed, as the BHC Act does not require divestiture for this type of situation.

Federal Deposit Insurance

The FDIC's Deposit Insurance Fund provides insurance coverage for certain deposits, up to a standard maximum deposit insurance amount of $250 thousand per depositor for deposits held in the same right and capacity at an insured depository institution and is funded through assessments on insured depository institutions, based on a methodology designed to take into account the risk each institution poses to the Deposit Insurance Fund. The Bank accepts client deposits that are insured by the Deposit Insurance Fund and, therefore, must pay insurance premiums. The FDIC may increase the Bank’s insurance premiums based on various factors, including changes in the Bank's risk profile. Beginning with the first quarterly assessment period of 2023, the FDIC increased the initial base deposit insurance assessment rate by two basis points, which was intended to increase the Deposit Insurance Fund ("DIF") reserve ratio to the statutory minimum of 1.35%. For 2025 and 2024, the FDIC insurance expense for the Bank was $2.8 million and $2.7 million; respectively.

If the FDIC is appointed conservator or receiver of a bank upon that bank’s insolvency or the occurrence of other events, the FDIC may sell some, part, or all of a bank’s assets and liabilities to another bank or repudiate or disaffirm most types of contracts to which that bank was a party if the FDIC believes such contracts are burdensome. In resolving the estate of a failed bank, the FDIC as receiver will first satisfy its own administrative expenses, and the claims of holders of U.S. deposit liabilities also have priority over those of other general unsecured creditors.

Liability for Banking Subsidiaries

The Parent Company is required to serve as a source of financial and managerial strength to the Bank and, under appropriate conditions, to commit resources to support the Bank. This support may be required by the FRB at times when the Bank might otherwise determine not to provide it or when doing so is not otherwise in the interests of the Parent Company or its shareholders or creditors. The FRB may require a BHC to make capital injections into a troubled subsidiary bank and may charge the BHC with engaging in unsafe and unsound practices if the BHC fails to commit resources to such a subsidiary bank or if it undertakes actions that the FRB believes might jeopardize the BHC’s ability to commit resources to such subsidiary bank.

Under these requirements, the Parent Company may in the future be required to provide financial assistance to the Bank should it experience financial distress. Any loans by a holding company to its subsidiary bank are subordinate in right of payment to deposits and to certain other indebtedness of such subsidiary bank. In the event of the Parent Company's bankruptcy, any commitment by the Parent Company to a federal bank regulatory agency to maintain the capital of the Bank would be assumed by the bankruptcy trustee and entitled to a priority of payment.

8

Table of Contents

Pennsylvania Banking Law

The Pennsylvania Banking Code contains detailed provisions governing the organization, location of offices, rights and responsibilities of directors, officers, and employees, as well as corporate powers, savings and investment operations and other aspects of the Bank and its affairs. The Pennsylvania Banking Code delegates extensive rule-making power and administrative discretion to the Pennsylvania Department of Banking and Securities so that the supervision and regulation of state-chartered banks may be flexible and readily responsive to changes in economic conditions and in savings and lending practices.

The Federal Deposit Insurance Act, however, prohibits state-chartered banks from making new investments, loans, or becoming involved in activities as principal and equity investments which are not permitted for national banks unless the FDIC determines the activity or investment does not pose a significant risk of loss to the Deposit Insurance Fund, and a bank meets all applicable capital requirements. Accordingly, additional operating authority provided to the Bank by the Pennsylvania Banking Code may be significantly restricted by the Federal Deposit Insurance Act.

Dividend Restrictions

The Parent Company is a legal entity separate and distinct from its banking and non-banking subsidiaries. Since the Parent Company's consolidated net income consists largely of net income of its subsidiaries, its ability to make capital distributions, including paying dividends and repurchasing shares, depends upon its receipt of dividends from these subsidiaries. Under federal law, there are various limitations on the extent to which the Bank can declare and pay dividends to the Parent Company, including those related to regulatory capital requirements, general regulatory oversight to prevent unsafe or unsound practices, and federal banking law requirements concerning the payment of dividends out of net profits, surplus, and available earnings. The Bank must maintain the CET1 Capital Conservation Buffer requirement of more than 2.5% above the minimum risk based on capital requirements to avoid becoming subject to restrictions on capital distributions, including dividends. Certain contractual restrictions also may limit the ability of the Bank to pay dividends to the Parent Company. No assurances can be given that the Bank will, in any circumstances, pay dividends to the Parent Company.

The Parent Company's ability to declare and pay dividends to its shareholders is similarly limited by federal banking law and FRB regulations and policy.

FRB policy provides that a BHC should not pay dividends unless (1) the BHC’s net income over the last four quarters (net of dividends paid) is sufficient to fully fund the dividends, (2) the prospective rate of earnings retention appears consistent with the capital needs, asset quality, and overall financial condition of the BHC and its subsidiaries, and (3) the BHC will continue to meet minimum required capital adequacy ratios. Accordingly, a BHC should not pay cash dividends that can only be funded in ways that weaken the BHC’s financial health, such as by borrowing. The policy also provides that a BHC should inform the FRB reasonably in advance of declaring or paying a dividend that exceeds earnings for the period for which the dividend is being paid or that could result in a material adverse change to the BHC’s capital structure. BHCs also are expected to consult with the FRB before increasing dividends or redeeming or repurchasing capital instruments. Additionally, the FRB could prohibit or limit the payment of dividends by a BHC if it determines that payment of the dividend would constitute an unsafe or unsound practice.

Transactions between a Bank and its Affiliates

Federal banking laws and regulations impose qualitative standards and quantitative limitations upon certain transactions between a bank and its affiliates, including between a bank and its holding company and companies that the BHC may be deemed to control for these purposes. Transactions covered by these provisions must be on arm’s-length terms, and cannot be offered on terms more favorable than would be offered to non-related borrowers of similar creditworthiness, and cannot exceed certain amounts which are determined with reference to that bank’s regulatory capital. Moreover, if the transaction is a loan or other extension of credit, it must be secured by collateral in an amount and quality expressly prescribed by statute, and if the affiliate is unable to pledge sufficient collateral, the BHC may be required to provide it. The Dodd-Frank Act expanded the coverage and scope of these restrictions and requirements, including by applying them to the credit exposure arising under derivative transactions, repurchase and reverse repurchase agreements, and securities borrowing and lending transactions. Federal banking laws also place similar restrictions on loans and other extensions of credit by FDIC-insured banks, such as the Bank, and their subsidiaries to their directors, executive officers, and principal shareholders.

Regulatory Capital Requirements

Compliance with respect to capital requirements is incorporated by reference from Note 17, Shareholders' Equity and Regulatory Capital, to the Consolidated Financial Statements under Part II, Item 8, "Financial Statements and Supplementary Data," and from the Capital Adequacy and Regulatory Matters section of Item 7, “Management’s Discussion and Analysis of Consolidated Financial Condition and Results of Operations.”

9

Table of Contents

The Bank is subject to certain risk-based capital and leverage ratio requirements under the U.S. Basel III capital rules adopted by the FRB. These rules implement the Basel III international regulatory capital standards in the U.S., as well as certain provisions of the Dodd-Frank Act. These quantitative calculations are minimums, and the FRB may determine that a banking organization, based on its size, complexity, or risk profile, must maintain a higher level of capital in order to operate in a safe and sound manner.

Under the U.S. Basel III capital rules, the Parent Company's and the Bank’s assets, exposures, and certain off-balance sheet items are subject to risk weights used to determine the institutions’ risk-weighted assets. These risk-weighted assets are used to calculate the following minimum capital ratios for the Parent Company and the Bank:

• CET1 Risk-Based Capital Ratio, equal to the ratio of CET1 capital to risk-weighted assets. CET1 capital primarily includes common shareholders’ equity subject to certain regulatory adjustments and deductions, including goodwill, intangible assets, certain deferred tax assets, and AOCI. The Company has elected to opt out of including AOCI components.

• Tier 1 Risk-Based Capital Ratio, equal to the ratio of Tier 1 capital to risk-weighted assets. Tier 1 capital is primarily comprised of CET1 capital, non-cumulative perpetual preferred stock, and certain qualifying capital instruments.

• Total Risk-Based Capital Ratio, equal to the ratio of total capital, including CET1 capital, Tier 1 capital, and Tier 2 capital, to risk-weighted assets. Tier 2 capital primarily includes qualifying subordinated debt and qualifying ACL.

• Tier 1 Leverage Ratio, equal to the ratio of Tier 1 capital to quarterly average assets (net of goodwill, certain other intangible assets, and certain other deductions).

Failure to be well-capitalized or to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators that, if undertaken, could have an adverse material effect on our operations or financial condition. Failure to be well-capitalized or to meet minimum capital requirements could also result in restrictions on the Bank’s ability to pay dividends or otherwise distribute capital or to receive regulatory approval of applications.

In addition to meeting the minimum capital requirements, under the U.S. Basel III capital rules, the Bank must also exceed a Capital Conservation Buffer of 2.5% over and above the minimum risk-based capital ratio requirements to avoid becoming subject to restrictions on capital distributions and certain discretionary bonus payments to management.

At December 31, 2025, the Parent Company's and the Bank’s regulatory capital ratios were above minimum requirements and applicable well-capitalized standards and exceeded the Capital Conservation Buffer requirement.

Bank Acquisitions by Orrstown

BHCs must obtain prior approval of the FRB in connection with any acquisition that results in the BHC owning or controlling 5% or more of any class of voting securities of a bank or another BHC.

Acquisitions of Ownership of Orrstown

Acquisitions of Orrstown's voting stock above certain thresholds are subject to prior regulatory notice or approval under federal banking laws, including the BHC Act and the Change in Bank Control Act of 1978. Under the Change in Bank Control Act, a person or entity generally must provide prior notice to, and receive the non-objection of, the FRB before acquiring the power to vote 10% or more of our outstanding common stock. Investors should be aware of these requirements when acquiring shares in the Company's stock.

Consumer Protection Regulation

The Company and the Bank are subject to federal and state laws designed to protect consumers and prohibit unfair, deceptive or abusive business practices, including the Equal Credit Opportunity Act, Fair Housing Act, Home Ownership Protection Act, Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactions Act of 2003 (the “FACT Act”), the Gramm-Leach-Bliley Act (“GLBA”), the Truth in Lending Act (“TILA”), the CRA, the Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, the National Flood Insurance Act, and various state law counterparts. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must interact with clients when taking deposits, making loans, collecting loans, and providing other services. Further, the CFPB also has a broad mandate to prohibit unfair, deceptive or abusive acts and practices and is specifically empowered to require certain disclosures to consumers and draft model disclosure forms. Failure to comply with consumer protection laws and regulations can subject financial institutions to enforcement actions, fines and other penalties. The FRB examines the Bank for compliance with CFPB rules and enforces CFPB rules with respect to the Bank.

10

Table of Contents

The Dodd-Frank Act prescribes certain standards that mortgage lenders must consider before making a residential mortgage loan, including verifying a borrower’s ability to repay such mortgage loan, and allows borrowers to assert violations of certain provisions of TILA as a defense to foreclosure proceedings. Additionally, the CFPB’s qualified mortgage rule requires creditors, such as the Bank, to make a reasonable, good faith determination of a consumer’s ability to repay any consumer credit transaction secured by a dwelling prior to making the loan. The Economic Growth, Regulatory Relief, and Consumer Protection Act included provisions that ease certain requirements related to mortgage transactions for certain institutions with less than $10 billion in total consolidated assets.

Data Privacy

Federal and state law contains extensive consumer privacy protection provisions. The GLBA requires financial institutions to periodically disclose their privacy policies and practices relating to sharing such information and enables retail clients to opt out of our ability to share information with unaffiliated third parties under certain circumstances. Other federal and state laws and regulations impact our ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes, or to contact clients with marketing offers. These security and privacy policies and procedures for the protection of personal and confidential information are in effect across all businesses and geographic locations as applicable. Federal law also makes it a criminal offense, except in limited circumstances, to obtain or attempt to obtain client information of a financial nature by fraudulent or deceptive means. Data privacy and data protection are areas of increasing federal and state legislative focus.

Like other lenders, the Bank uses credit bureau data in its underwriting activities. Use of such data is regulated under the Fair Credit Reporting Act, which also regulates reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information between affiliates, and using affiliate data for marketing purposes. Similar state laws may impose additional requirements on the Company.

Cybersecurity

Multiple federal laws contain provisions requiring regulated financial institutions to maintain cybersecurity programs incorporating specific elements. The GLBA requires financial institutions to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of client records and information.

The Cybersecurity Information Sharing Act is intended to improve cybersecurity in the U.S. by enhanced sharing of information about security threats among the U.S. government and private sector entities, including financial institutions. The Cybersecurity Information Sharing Act also authorizes companies to monitor their own systems notwithstanding any other provision of law and allows companies to carry out defensive measures on their own systems from cyber-attacks. The law includes liability protections for companies that share cyber threat information with third parties so long as such sharing activity is conducted in accordance with Cybersecurity Information Sharing Act.

A bank holding company and a state member bank are required to notify the FRB within 36 hours of a computer security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its client base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector.

Community Reinvestment Act

The CRA is intended to encourage banks to help meet the credit needs of their service areas, including low- and moderate-income neighborhoods, consistent with safe and sound business practices. The relevant federal bank regulatory agency, the FRB in the Bank’s case, examines each bank and assigns it a public CRA rating. A bank’s record of fair lending compliance is part of the resulting CRA examination report. The CRA requires the relevant federal bank regulatory agency to consider a bank’s CRA assessment when considering that bank’s application to conduct certain mergers or acquisitions or to open or relocate a branch office. The FRB also must consider the CRA record of each subsidiary bank of a BHC in connection with any acquisition or merger application filed by the BHC. An unsatisfactory CRA record could substantially delay or result in the denial of an approval or application by the Parent Company or the Bank. The Bank received a CRA rating of “Satisfactory” in its most recent examination prepared by the FRB on January 22, 2024.

Leaders of the federal banking agencies had indicated their support for modernizing the CRA regulatory framework to address changing delivery systems and consumer preferences, and on October 24, 2023, the agencies jointly issued a final rule to strengthen and modernize the CRA regulations by maintaining the existing CRA ratings, but modifying the evaluation framework to replace the existing tests generally applicable to banks with at least $2.0 billion in total assets (e.g., the lending, investment and service tests) with four new tests and associated performance metrics. The October 2023 final rule updated the CRA regulations with the goals of expanding access to credit, investment, and basic banking services in low- and moderate-

11

Table of Contents

income communities, adapting to changes in the banking industry, including the expanded role of mobile and online banking, and providing greater clarity and consistency. On July 16, 2025, the FRB Board, FDIC and the OCC issued a joint notice of proposed rulemaking to rescind the October 2023 final rule and reinstate the CRA framework that existed prior to the October 2023 final rule. The Bank’s most recent performance evaluation was conducted using the CRA framework that existed prior to the October 2023 final rule.

Anti-Money Laundering

The Bank Secrecy Act ("BSA"), the USA PATRIOT Act and the Anti-Money Laundering Act of 2020 (“AMLA”) contain anti-money laundering and financial transparency provisions intended to detect and prevent the use of the U.S. financial system for money laundering and terrorist financing activities. The Bank Secrecy Act, as amended by the PATRIOT Act, requires depository institutions and their holding companies to undertake activities including maintaining an anti-money laundering program, verifying the identity of clients, verifying the identity of certain beneficial owners for legal entity clients, monitoring for and reporting suspicious transactions, reporting on cash transactions exceeding specified thresholds, and responding to requests for information by regulatory authorities and law enforcement agencies.

The AMLA codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the U.S. Department of the Treasury ("Treasury") to promulgate priorities for anti-money laundering and countering the financing of terrorism policy; requires the development of standards by the Treasury for testing technology and internal processes for BSA compliance; expands enforcement- and investigation-related authority, including a significant expansion in the available sanctions for certain BSA violations; and expands BSA whistleblower incentives and protections. Many of the statutory provisions in the AMLA required additional rulemaking, reports and other measures, and the impact of the AMLA will depend on, among other things, rulemaking and implementation guidance.

The Bank is subject to the Bank Secrecy Act and, therefore, is required to maintain an effective, risk-based anti-money laundering ("AML") and countering the financing of terrorism within the CFT program. Our program includes internal policies, procedures and controls; designation of a qualified BSA/AML Officer; ongoing employee training and independent testing to ensure compliance. The Bank has implemented policies, procedures, and internal controls that are designed to comply with these anti-money laundering requirements. The program is tailored to our risk profile and incorporates the AML/CFT National Priorities issued by the U.S. Department of the Treasury. Our Board of Directors oversees the AML/CFT program and receives regular reports on risk assessments, audit results and, when applicable, remediation efforts.

We recognize that bank regulators place significant emphasis on AML compliance, and when reviewing for merger, acquisitions and other transactions, to consider the effectiveness of the AML activities of the applicant. Accordingly, we continuously monitor our program and make enhancements as necessary to address emerging risks, regulatory changes, and technological developments and ensure that our controls remain effective and aligned with industry best practices.

Office of Foreign Assets Control Regulation

The Office of Foreign Assets Control ("OFAC") administers and enforces economic and trade sanctions that affect transactions with designated foreign countries, entities, and individuals, as authorized by various laws and Executive Orders. OFAC-administered sanctions take many different forms. For example, sanctions may include: (1) restrictions on trade with or investment in a sanctioned jurisdictions, including prohibitions against direct or indirect imports and exports to a sanctioned country and prohibitions on U.S. persons engaging in financial transactions relating to, making investments in, or providing investment-related advice or assistance to, a sanctioned party; and (2) a blocking of assets in which the government or “specially designated nationals” of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction, including property in the possession or control of U.S. persons. OFAC also publishes lists of persons, organizations, and countries suspected of aiding, harboring, or engaging in terrorist acts, narcotics trafficking and other illicit activities known as the Specially Designated Nationals and Blocked Persons ("SDN") List. Blocked assets, such as property and bank deposits, cannot be paid out, withdrawn, or transferred in any manner without a license from OFAC. Failure to comply with OFAC regulations can result in significant civil and criminal penalties.

Transaction Account Reserves

FRB regulations require depository institutions to maintain cash reserves against specified deposit liabilities. The dollar amount of a depository institution's reserve requirement is determined by applying the reserve ratios specified in Regulation D to an institution's transaction accounts (primarily NOW and regular checking accounts). Effective January 1, 2025, the FRB established a new reserve requirement exemption amount and low reserve tranche, but did not elevate the current reserve percentage from zero for depository institutions.

12

Table of Contents

Nasdaq Stock Market

The Company’s common stock is listed on the Nasdaq Capital Market under the trading symbol “ORRF” and is subject to Nasdaq’s rules for listed companies.

Available Information

The Company is subject to the informational requirements of the Exchange Act and, in accordance with the Exchange Act, it files annual, quarterly, and current reports, proxy statements, and other information with the SEC. The SEC maintains an Internet web site that contains reports, proxy statements, and other information about issuers, like us, who file electronically with the SEC. The address of the site is www.sec.gov. The reports and other information, including any related amendments, filed by us with, or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act, by the Company to, the SEC are also available free of charge at our Internet web site as soon as reasonably practicable after such material is electronically filed with, or furnished to, the SEC. The address of the site is www.orrstown.com. Except as specifically incorporated by reference into this Annual Report on Form 10-K, information on those web sites is not part of this report.