Virginia National Bankshares Corp (VABK) Business

Item 1. BUSINESS.

General

The Company was incorporated under the laws of the Commonwealth of Virginia on February 21, 2013 at the direction of the Board of Directors of the Bank for the purpose of acquiring all of the outstanding shares of the Bank and becoming the holding company of the Bank. On June 19, 2013, the shareholders of the Bank approved the Reorganization Agreement and Plan of Share Exchange, dated March 6, 2013, whereby the Bank would reorganize into a holding company structure. On December 16, 2013, when the Reorganization became effective, the Bank became a wholly-owned subsidiary of the Company, and each share of the Bank’s common stock was exchanged for one share of the Company’s common stock.

The Company is regulated under the BHCA and is subject to inspection, examination and supervision by the Federal Reserve. The Company is also under the jurisdiction of the SEC and is subject to the disclosure and regulatory requirements of the Exchange Act as administered by the SEC.

Virginia National Bank, the principal operating subsidiary of the Company, was organized in 1998 under federal law as a national banking association to engage in a general commercial and retail banking business. The Bank received its charter from the OCC and commenced operations on July 29, 1998. The Bank received fiduciary powers in January 2000. The Bank’s deposits are insured up to the maximum amount provided by the FDIC.

Prior to July 2018, the Bank had one wholly owned subsidiary, VNBTrust, a national trust bank formed in 2007. Effective July 1, 2018, VNBTrust was merged into the Bank. The Bank continues to offer trust and estate administration services under the name of VNB Trust and Estate Services.

The Bank, through its financial subsidiary Fauquier Bank Services, Inc., has equity ownership interests in Bankers Insurance, LLC, a Virginia independent insurance company, and Bankers Title Shenandoah, LLC, a title insurance company, both of which are owned by a consortium of Virginia community banks.

The Bank has another subsidiary, Special Properties Acquisition - VA, LLC, which was originally formed by Fauquier to hold other real estate owned; however, there are no assets currently held by this subsidiary.

The Bank is subject to the supervision, examination and regulations of the OCC and is also subject to regulations of the FDIC, the Federal Reserve and the CFPB.

During 2018, the Company formed Masonry Capital Management, LLC, a registered investment advisor, which offers investment advisory and management services to clients through separately managed accounts and a private investment fund. The membership interests in this business line were sold to an officer of the Company effective April 1, 2024. Per the terms of the sale agreement, the Company will receive an annual revenue-share amount for a period of six years. No expenses have been or will be incurred by the Company related to Masonry Capital subsequent to April 1, 2024.

In addition, the Company owns Fauquier Statutory Trust II (“Trust II”), which is an unconsolidated subsidiary. The subordinated debt owed to Trust II is reported as a liability of the Company.

The main offices of the Company, the Bank and VNB Trust and Estate Services, as well as corporate and Bank operations, are located in Charlottesville, Virginia.

Products and Services

The Bank offers a full range of banking and related financial services, including checking accounts, NOW accounts, money market deposit accounts, certificates of deposit, individual retirement accounts, CDARS™, ICS® and other depository services. The Bank actively solicits such accounts from individuals, businesses and charitable organizations within its trade areas. Other services offered by the Bank include ATMs, internet banking, treasury and cash management services and merchant card services. In addition, the Bank is affiliated with Visa®, which is accepted worldwide, and offers debit cards to consumer and business customers.

The Bank also offers short-to long-term commercial, real estate and consumer loans. The Bank is committed to being a reliable and consistent source of credit, providing loans that are priced based upon an overall banking relationship, easy access to the Bank’s local decision makers who possess strong local market knowledge, local delivery, fast response, and continuity in the banking relationship.

7

Trust and estate administration services are offered through VNB Trust and Estate Services.

The Company primarily serves the Virginia communities in and around the cities of Charlottesville, Winchester, Manassas and Richmond, and the counties of Albemarle, Fauquier, Frederick and Prince William. Refer to Item 2. Properties for additional information regarding locations. The Bank’s locations are well-positioned in attractive markets. Within its market areas, there are various types of industry including higher education, medical and professional services, research and development companies and retail.

Competition

The Company engages in highly competitive activities. Each activity involves competition with other banks, as well as with non-banking enterprises that offer financial products and services that compete directly with the Company’s product and service offerings. The Company actively competes with other banks in its efforts to obtain deposits and make loans, in the scope and types of services offered, in interest rates paid on time deposits and charged on loans, and in other aspects of banking.

In addition to competing with other community and commercial banks within and outside its primary service areas, the Company competes with other institutions engaged in the business of making loans or accepting deposits, such as credit unions, insurance companies, small loan companies, finance companies, fintech companies, certain governmental agencies and other enterprises. Competition for deposits and loans is affected by various factors including, without limitation, interest rates offered, the number and location of branches and types of products offered, digital capabilities, and the reputation of the institution. Credit unions increasingly have been allowed to expand their membership definitions, yet they continue to enjoy a favorable tax status.

The market areas served by the Company are highly competitive with respect to banking. Many of the Company’s competitors have substantially greater resources and lending limits than the Company and offer certain services such as extensive and established branch networks that the Company does not expect to match. Deposit competition is also very strong. Management believes, however, that a market exists for the personal and customized financial services an independent, community bank can offer.

Social

To develop young talent in the financial industry, the Company has created the Finance Career & Leadership Academy ("FCLA"), which is an instructional program designed to not only provide advanced personal finance and employment readiness training, but also a path to career opportunities in banking for high school juniors and seniors within the Company's communities. Currently held in Charlottesville, Virginia, the FCLA runs as an in-person series of classroom meetings.

This program is offered free-of-charge to those students accepted into the FCLA. Up to ten students are accepted into each session. The program provides quality financial training that gives young people the perspective and tools necessary to level the economic playing field and make responsible financial decisions. Also, included in the curriculum is a comprehensive study of employment readiness and professionalism concepts and strategies aimed to increase the marketability and employability of the participants. In order to begin a successful career and have a successful financial future, these young adults must be prepared to effectively communicate with a multi-generational workforce and have the skills necessary to manage their own finances intelligently and productively.

This program also offers the potential opportunity for training necessary to enter a lucrative career without incurring six-figure debt and four lost years of earning potential, as the most promising and top performing students from the Academy are considered for VNB’s College Program (the Commercial Banking/Staff Development Program). The Company's partnership with the Center for Financial Training and Education Alliance (CFTEA) has allowed the Company to create a credentialing program specifically designed to prepare students to meet the demands of the industry, and to do so without the prohibitive cost of a four-year degree. This bank-sponsored, comprehensive, free training program consists of 16 courses of which 13 are accredited college/university courses (39 credit hours that are transferable to a 2 or 4-year college/university) and work projects. Participants receive full-time pay with full fringe benefits (includes 401k with company match) while completing the program and, if successful in the program, have the potential opportunity for a career with VNB. Also, once employed, should they choose, they may go on to complete a 2 or 4-year degree at the Company’s expense.

Employees

The Company has a shared vision of guiding principles, core values and strategies that work and have guided the Company through both good and challenging times. The Company strives to ensure that its constituents, including its shareholders,

8

customers, Board of Directors ("Board"), executive management and high performing employees, believe in it as well. The Company believes that the shared vision, when properly aligned and communicated to all constituents, will produce more than above average performance in key metrics. As part of the shared vision, the Company is committed to its shareholders, customers, employees and communities. A critical part of this commitment is attracting and retaining high performing employees. To attract and retain high performing employees, the Company provides a competitive compensation and benefits program, including wellness benefits.

At December 31, 2025, the Company had 140 full-time employees and 8 part-time employees. None of its employees are represented by any collective bargaining unit. The Company considers relations with its employees to be good. We strive for the Company's workforce to reflect the diversity of the customers and communities we serve. The Company's selection and promotion process are without bias and include the active recruitment of minorities and women. At December 31, 2025, women represented 75% of the Company's employees and racial and ethnic minorities represented 22% of the Company's employees. At December 31, 2025, 35% of the Company's employees have been employed by the Company or its subsidiaries for at least 10 years.

The Company owns BOLI policies on each executive officer and certain other senior officers of the Company. BOLI is a bank-eligible asset designed to recover costs of providing pre- and post-retirement benefits and/or to finance general employee benefit expenses. Under BOLI policies, each executive officer and certain other senior officers of the Company are the insured, and the Company is the owner and beneficiary of the policies. The insured has no claim to the insurance policy or to the policy’s cash value. Under separate split dollar agreements, a portion of any death benefit may be paid to the beneficiaries of the insured officer, subject to the terms and restrictions of the split dollar endorsement agreement between the insured officer and the Company.

Supervision and Regulation

The Company and the Bank are extensively regulated under both federal and state laws. The following description briefly addresses certain historic and current provisions of federal and state laws and certain regulations, proposed regulations and the potential impacts on the Company and the Bank. To the extent statutory or regulatory provisions or proposals are described in this report, the description is qualified in its entirety by reference to the particular statutory or regulatory provisions or proposals.

The Company

General. As a bank holding company registered under the BHCA, the Company is subject to supervision, regulation, and examination by the Federal Reserve. The Company is also registered under the bank holding company laws of Virginia and is subject to supervision, regulation, and examination by the Bureau of Financial Institutions of the Virginia State Corporation Commission.

Regulatory Environment. Banking and other financial services statutes, regulations and policies are continually under review by Congress, state legislatures and federal and state regulatory agencies. The scope of the laws and regulations, and the intensity of the supervision to which the Company and its subsidiaries are subject, have increased in recent years, initially in response to the 2008 financial crisis, and more recently in light of other factors, including continued turmoil and stress in the financial markets, technological factors and market changes.

Proposals to change the laws, regulations and policies governing the banking industry are frequently raised at both the state and federal levels. The second Trump administration has implemented significantly different policies from the Biden administration, including new proposed regulations and rescissions or withdrawals of previous guidance, and sharply reduced the workforce at the federal banking agencies.

These regulatory changes could have significant effects on how the Company and the Bank conduct business. The specific impacts of regulatory reforms, and whether they will last, cannot yet be fully predicted. Further, a change in the manner in which laws, regulations and regulatory guidance are interpreted by regulatory agencies or courts may have a material impact on the Company’s business, operations and earnings.

Permitted Activities. The permitted activities of a bank holding company are limited to managing or controlling banks, furnishing services to or performing services for its subsidiaries, and engaging in other activities that the Federal Reserve determines by regulation or order to be so closely related to banking, or managing or controlling banks, as to be a proper incident thereto. In determining whether a particular activity is permissible, the Federal Reserve must consider whether the performance of such an activity reasonably can be expected to produce benefits to the public that outweigh possible adverse

9

effects. Possible benefits include greater convenience, increased competition, and gains in efficiency. Possible adverse effects include undue concentration of resources, decreased or unfair competition, conflicts of interest, and unsound banking practices. Despite prior approval, the Federal Reserve may order a bank holding company or its subsidiaries to terminate any activity or to terminate ownership or control of any subsidiary when the Federal Reserve has reasonable cause to believe that a serious risk to the financial safety, soundness or stability of any bank subsidiary of that bank holding company may result from such an activity.

Banking Acquisitions; Changes in Control. The BHCA and related regulations require, among other things, the prior approval of the Federal Reserve in any case where a bank holding company proposes to (i) acquire direct or indirect ownership or control more than 5% of the outstanding voting stock of any bank or bank holding company (unless it already owns a majority of such voting shares), (ii) acquire all or substantially all of the assets of another bank or bank holding company, or (iii) merge or consolidate with any other bank holding company. In determining whether to approve a proposed acquisition, the Federal Reserve will consider, among other factors, the following: the effect of the acquisition on competition; the public benefits expected to be received from the acquisition; any outstanding regulatory compliance issues of any institution that is a party to the transaction; the projected capital ratios and levels on a post-acquisition basis; the financial condition of each institution that is a party to the transaction and of the combined institution after the transaction; the parties’ managerial resources, as well as risk management and governance processes and systems; the parties’ compliance with the Bank Secrecy Act and anti-money laundering requirements; the acquiring institution’s performance under the CRA and its compliance with fair housing and other consumer protection laws; and the data security and cybersecurity infrastructure of the constituent organizations and the combined organization.

Subject to certain exceptions, the BHCA and the Change in Bank Control Act, together with the applicable regulations, require Federal Reserve approval (or, depending on the circumstances, no notice of disapproval) prior to any person or company’s acquiring “control” of a bank or bank holding company. A conclusive presumption of control exists if an individual or company acquires the power, directly or indirectly, to direct the management or policies of an insured depository institution or to vote 25% or more of any class of voting securities of any insured depository institution. A rebuttable presumption of control may exist if a person or company acquires 5% or more but less than 25% of any class of voting securities and certain other relationships are present between the investor and the bank holding company, or if certain other ownership thresholds for voting or total equity have been exceeded.

In addition, Virginia law requires the prior approval of the SCC for (i) the acquisition by a Virginia bank holding company of more than 5% of the voting shares of a Virginia bank or a Virginia bank holding company, or (ii) the acquisition by any other person of control of a Virginia bank holding company or a Virginia bank.

Source of Strength. Federal Reserve policy has historically required bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. The Dodd-Frank Act codified this policy as a statutory requirement. Under this requirement, the Company is expected to commit resources to support the Bank, including at times when the Company may not be in a financial position to provide such resources. Any capital loans by a bank holding company to any of its subsidiary banks are subordinate in right of payment to depositors and to certain other indebtedness of such subsidiary banks. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Safety and Soundness. There are a number of obligations and restrictions imposed on bank holding companies and their subsidiary banks by law and regulatory policy that are designed to minimize potential loss to the depositors of such depository institutions and the FDIC insurance fund in the event of a depository institution insolvency, receivership, or default. For example, under FDICIA, to avoid receivership of an insured depository institution subsidiary, a bank holding company is required to guarantee the compliance of any subsidiary bank that may become “undercapitalized” with the terms of any capital restoration plan filed by such subsidiary with its appropriate federal bank regulatory agency up to the lesser of (i) an amount equal to 5% of the institution’s total assets at the time the institution became undercapitalized, or (ii) the amount that is necessary (or would have been necessary) to bring the institution into compliance with all applicable capital standards as of the time the institution fails to comply with such capital restoration plan.

Under the FDIA, the federal bank regulatory agencies have adopted guidelines prescribing safety and soundness standards. These guidelines establish general standards relating to capital management, internal controls and information systems, internal audit systems, information systems, data security, loan documentation, credit underwriting, interest rate exposure and risk management, vendor management, corporate governance, and asset growth, as well as compensation, fees, and benefits. In general, the guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines.

10

Capital Requirements. The Federal Reserve imposes certain capital requirements on bank holding companies under the BHCA, including a minimum leverage ratio and a minimum ratio of “qualifying” capital to risk-weighted assets. These requirements are described below under “The Bank – Capital Requirements.” Subject to its capital requirements and certain other restrictions, the Company is able to borrow money to make a capital contribution to the Bank, and such loans may be repaid from dividends paid by the Bank to the Company.

Limits on Dividends and Other Payments. The Company is a legal entity, separate and distinct from its subsidiaries. A significant portion of the revenues of the Company result from dividends paid to it by the Bank. There are various legal limitations applicable to the payment of dividends by the Bank to the Company and to the payment of dividends by the Company to its shareholders. The Bank is subject to various statutory and regulatory restrictions on its ability to pay dividends to the Company. The OCC has advised that a national bank should generally pay dividends only out of current operating earnings. Under current regulations, prior regulatory approval is required if cash dividends declared by the Bank in any given year exceed net income for that year, plus retained net profits of the two preceding years. The payment of dividends by the Bank or the Company may be limited by other factors, such as requirements to maintain capital above regulatory guidelines. Bank regulatory agencies have the authority to prohibit the Bank or the Company from engaging in an unsafe or unsound practice in conducting its respective business. The payment of dividends, depending on the financial condition of the Bank or the Company, could be deemed to constitute such an unsafe or unsound practice.

Under the FDIA, insured depository institutions, such as the Bank, are prohibited from making capital distributions, including the payment of dividends, if, after making such distributions, the institution would become “undercapitalized” (as such term is used in the statute). Based on the Bank’s current financial condition, the Company does not expect that this provision will have any impact on its ability to receive dividends from the Bank.

In addition, the Company’s ability to pay dividends is limited by restrictions imposed by the Virginia Stock Corporation Act on Virginia corporations. In general, dividends paid by a Virginia corporation may be paid only if, after giving effect to the distribution, (i) the corporation is still able to pay its debts as they become due in the usual course of business, or (ii) the corporation’s total assets are greater than or equal to the sum of its total liabilities plus (unless the corporation’s articles of incorporation permit otherwise) the amount that would be needed, if the corporation were to be dissolved at the time of the distribution, to satisfy the preferential rights, upon the dissolution, of shareholders whose preferential rights are superior to those receiving the distribution.

The Bank

General. The Bank is supervised and regularly examined by the OCC. The various laws and regulations administered by the OCC and the other bank regulatory agencies affect corporate practices, such as the payment of dividends, incurrence of debt, and acquisition of financial institutions and other companies; they also affect business practices, such as the payment of interest on deposits, the charging of interest on loans, types of business conducted and location of offices. Certain of these laws and regulations are referenced above under “The Company.”

Regulatory Capital Requirements. The OCC and the other federal bank regulatory agencies have issued risk-based and leverage capital guidelines applicable to U.S. banking organizations. Those regulatory agencies may from time-to-time require that a banking organization maintain capital above the minimum levels because of its financial condition or actual or anticipated growth.

The OCC and the other federal bank regulatory agencies have adopted rules to implement the Basel III capital framework as outlined by the Basel Committee on Banking Supervision and standards for calculating risk-weighted assets and risk-based capital measurements (collectively, the Basel III Final Rules) that apply to banking institutions they supervise. For the purposes of these capital rules, (i) CET1 capital consists principally of common stock (including surplus) and retained earnings; (ii) Tier 1 capital consists principally of CET1 plus non-cumulative preferred stock and related surplus, and certain grandfathered cumulative preferred stocks and trust preferred securities; and (iii) Tier 2 capital consists of other capital instruments, principally qualifying subordinated debt and preferred stock, and limited amounts of an institution’s ACL. Each regulatory capital classification is subject to certain adjustments and limitations, as implemented by the Basel III Final Rules. The Basel III Final Rules also establish risk weightings that are applied to many classes of assets held by community banks, importantly including applying higher risk weightings to certain commercial real estate loans. The Basel III Final Rules also include a requirement that banks maintain additional capital known as the “capital conservation buffer.”

The Basel III Final Rules and capital conservation buffer require banks and bank holding companies to maintain:

11

i.
a minimum ratio of CET1 to risk-weighted assets of at least 4.5%, plus a 2.5% capital conservation buffer (which is added to the minimum CET1 ratio, effectively resulting in a required ratio of CET1 to risk-weighted assets of at least 7.0%);

ii.
a minimum ratio of Tier 1 capital to risk-weighted assets of at least 6.0%, plus the 2.5% capital conservation buffer (effectively resulting in a required Tier 1 capital ratio of 8.5%);

iii.
a minimum ratio of total (that is, Tier 1 plus Tier 2) capital to risk-weighted assets of at least 8.0%, plus the 2.5% capital conservation buffer (effectively resulting in a required total capital ratio of 10.5%), and

iv.
a minimum leverage ratio of 4.0%, calculated as the ratio of Tier 1 capital to average total assets, subject to certain adjustments and limitations.

The Basel III Final Rules provide deductions from and adjustments to regulatory capital measures, primarily to CET1, including deductions and adjustments that were not applied to reduce CET1 under historical regulatory capital rules. For example, mortgage servicing rights, deferred tax assets dependent upon future taxable income, and significant investments in non-consolidated financial entities must be deducted from CET1 to the extent that any one such category exceeds 25% of CET1.

The Basel III Final Rules permanently include in Tier 1 capital trust preferred securities issued prior to May 19, 2010 by bank holding companies with less than $15 billion in total assets, subject to a limit of 25% of Tier 1 capital. The Company expects that its trust preferred securities will be included in the Company’s regulatory capital as Tier 1 capital instruments until their maturity.

The Tier 1, CET1, total capital to risk-weighted assets, and leverage ratios of the Company were 19.60%, 19.60%, 20.42% and 12.52%, respectively, as of December 31, 2025, thus exceeding the minimum requirements. The Tier 1, CET1, total capital to risk-weighted assets, and leverage ratios of the Bank were 19.36%, 19.36%, 20.19% and 12.36%, respectively, as of December 31, 2025, also exceeding the minimum requirements.

With respect to the Bank, to be “well capitalized” under the revised “prompt corrective action” regulations, a bank must have the following minimum capital ratios: (i) a CET1 capital ratio of at least 6.5%; (ii) a Tier 1 capital to risk-weighted assets ratio of at least 8.0%; (iii) a total capital to risk-weighted assets ratio of at least 10.0%; and (iv) a leverage ratio of at least 5.0%. The Bank exceeds the thresholds to be considered well capitalized as of December 31, 2025. See “Prompt Corrective Action” below.

In July 2023, the Federal Reserve and the FDIC issued proposed rules to implement the final components of the Basel III agreement, often known as the “Basel III endgame.” These proposed rules contain provisions that apply to banks with $100 billion or more in total assets and that would significantly alter how those banks calculate risk-based assets. In light of the adverse reaction to the proposal, the Federal Reserve announced that it would publish a re-proposal of its regulations finalizing the Basel III standards. That re-proposal is expected in early 2026. The extent to which the re-proposal would impact institutions of the Company’s size is unknown since the original proposal applied to bank holding companies with assets of $100 billion or more.

Community Bank Leverage Ratio. As required by the EGRRCPA, qualifying banks with less than $10 billion in consolidated assets could elect to be subject to a 9% leverage ratio applied using less complex leverage calculations commonly referred to as the community bank leverage ratio CBLR. Banks that opt into the CBLR framework and maintain a leverage ratio of greater than 9% are not subject to other risk-based and leverage capital requirements and are deemed to meet Basel III Final Rules’ well capitalized ratio requirements. As of December 31, 2025, the Bank has not elected to apply the CBLR framework, but the Bank continues to assess the potential impact of opting in to the CBLR framework as part of its ongoing capital management and planning processes.

Small Bank Holding Company Policy Statement. Bank holding companies with less than $3 billion in assets may rely on the Federal Reserve Board’s Small Bank Holding Company Policy Statement. In addition to meeting the asset threshold, a bank holding company must not engage in significant nonbanking activities, not conduct significant off-balance sheet activities, and not have a material amount of debt or equity securities outstanding and registered with the SEC (subject to certain exceptions). The Federal Reserve Board may, in its discretion, exclude any bank holding company from the application of the Small Bank Holding Company Policy Statement if such action is warranted for supervisory purposes.

The policy statement, among other things, exempts certain bank holding companies from minimum consolidated regulatory capital ratios that apply to other bank holding companies. The Company expects that it will continue to be treated as a small bank holding company under the policy statement and will not be subject to regulatory capital requirements. The Bank remains subject to the regulatory capital requirements described above.

12

Prompt Corrective Action. Federal banking regulators are authorized, and under certain circumstances required, to take certain actions against banks that fail to meet their capital requirements. The federal bank regulatory agencies have additional enforcement authority with respect to undercapitalized depository institutions. “Well capitalized” institutions may generally operate without additional supervisory restriction. With respect to “adequately capitalized” institutions, such banks (i) cannot normally pay dividends or make any capital contributions that would leave them undercapitalized, (ii) cannot pay management fees to a controlling person if, after paying the fee, they would be undercapitalized, and (iii) cannot accept, renew, or roll over any brokered deposit unless they have applied for and been granted a waiver by the FDIC.

Immediately upon becoming “undercapitalized,” a depository institution becomes subject to the provisions of Section 38 of the FDIA, which: (i) restrict payment of capital distributions and management fees; (ii) require that the appropriate federal banking agency monitor the condition of the institution and its efforts to restore its capital; (iii) require submission of a capital restoration plan; (iv) restrict the growth of the institution’s assets; and (v) require prior approval of certain expansion proposals. The appropriate federal banking agency for an undercapitalized institution also may take any number of discretionary supervisory actions if the agency determines that any of these actions is necessary to resolve the problems of the institution at the least possible long-term cost to the DIF, subject in certain cases to specified procedures. These discretionary supervisory actions include: (i) requiring the institution to raise additional capital; (ii) restricting transactions with affiliates; (iii) requiring divestiture of the institution or the sale of the institution to a willing purchaser; and (iv) any other supervisory action that the agency deems appropriate. These and additional mandatory and permissive supervisory actions may be taken with respect to significantly undercapitalized and critically undercapitalized institutions. The Bank met the definition of being “well capitalized” as of December 31, 2025.

As described above in “The Bank – Regulatory Capital Requirements,” the capital rules issued by the OCC incorporate new requirements into the prompt corrective action framework.

Deposit Insurance. The deposits of the Bank are insured up to applicable limits by the Deposit Insurance Fund of the FDIC and are subject to deposit insurance assessments based on average total assets minus average tangible equity to maintain the DIF. The basic limit on FDIC deposit insurance coverage is $250 thousand per depositor. Under the FDIA, the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations as an insured depository institution, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, subject to administrative and potential judicial hearing and review processes. The FDIC may also suspend deposit insurance temporarily during the hearing process for the permanent termination of insurance if the institution has no tangible capital. If deposit insurance is terminated, the deposits at the institution at the time of termination, less subsequent withdrawals, shall continue to be insured for a period from six months to two years, as determined by the FDIC. Management is aware of no existing circumstances that could result in termination of the Bank’s deposit insurance.

Deposit Insurance Assessments. The DIF is funded by assessments on banks and other depository institutions calculated based on average consolidated total assets minus average tangible equity (defined as Tier 1 capital). As required by the Dodd-Frank Act, the FDIC has adopted a large-bank pricing assessment scheme, set a target “designated reserve ratio” (described in more detail below) of 2% for the DIF and, in lieu of dividends, provides for a lower assessment rate schedule when the reserve ratio reaches 2% and 2.5%. An institution's assessment rate is based on a statistical analysis of financial ratios that estimates the likelihood of failure over a three-year period, which considers the institution’s weighted average CAMELS composite rating, and is subject to further adjustments including those related to levels of unsecured debt and brokered deposits.

The Dodd-Frank Act transferred to the FDIC increased discretion with regard to managing the required amount of reserves for the DIF, or the “designated reserve ratio.” The FDIA requires that the FDIC consider the appropriate level for the designated reserve ratio on at least an annual basis. On October 18, 2022, the FDIC adopted a final rule to increase initial base deposit insurance assessment rate schedules uniformly by 2 basis points, beginning in the first quarterly assessment period of 2023. As a result of this final rule, the total base assessment rates beginning with the first quarter of 2023 for institutions with less than $10 billion in assets that have been insured for at least five years range from 2.5 bps to 32 bps. This increase in assessment rate schedules is intended to increase the likelihood that the reserve ratio reaches 1.35% by the statutory deadline of September 30, 2028. The new assessment rate schedules will remain in effect unless and until the reserve ratio meets or exceeds 2%. Progressively lower assessment rate schedules will take effect when the reserve ratio reaches 2%, and again when it reaches 2.5%

.

In November 2023, the FDIC issued a final rule to implement a special DIF assessment following the FDIC’s use of the “systemic risk” exception to the least-cost resolution test in connection with the failures and resolutions of Silicon Valley

13

Bank and Signature Bank. Banks with less than $5 billion of uninsured deposits, such as the Bank, are exempt from this special assessment.

In 2025 and 2024, the Company expensed $785 thousand and $700 thousand, respectively, in deposit insurance assessments.

Transactions with Affiliates. Pursuant to Sections 23A and 23B of the Federal Reserve Act and Regulation W, the authority of the Bank to engage in transactions with related parties or “affiliates” or to make loans to insiders is limited. Loan transactions with an affiliate generally must be collateralized and certain transactions between the Bank and its affiliates, including the sale of assets, the payment of money or the provision of services, must be on terms and conditions that are substantially the same, or at least as favorable to the Bank, as those prevailing for comparable nonaffiliated transactions. In addition, the Bank generally may not purchase securities issued or underwritten by affiliates.

Loans to executive officers, directors, or to any person who directly or indirectly, or acting through or in concert with one or more persons, owns, controls, or has the power to vote more than 10% of any class of voting securities of a bank, are subject to Sections 22(g) and 22(h) of the Federal Reserve Act and their corresponding regulations (Regulation O) and Section 13(k) of the Exchange Act relating to the prohibition on personal loans to executives (which exempts financial institutions in compliance with the insider lending restrictions of Section 22(h) of the Federal Reserve Act). Among other things, these loans must be made on terms substantially the same as those prevailing on transactions made to unaffiliated individuals and certain extensions of credit to those persons must first be approved in advance by a disinterested majority of the entire Board. Section 22(h) of the Federal Reserve Act prohibits loans to any of those individuals where the aggregate amount exceeds an amount equal to 15% of an institution’s unimpaired capital and surplus plus an additional 10% of unimpaired capital and surplus in the case of loans that are fully secured by readily marketable collateral, or when the aggregate amount on all of the extensions of credit outstanding to all of these persons would exceed the Bank’s unimpaired capital and unimpaired surplus. Section 22(g) of the Federal Reserve Act identifies limited circumstances in which the Bank is permitted to extend credit to executive officers.

Community Reinvestment Act. The Bank is subject to the requirements of the CRA. The CRA imposes on financial institutions an affirmative and ongoing obligation to meet the credit needs of the local communities, including low- and moderate-income neighborhoods. The CRA requires the appropriate federal banking agency, in connection with its examination of a bank, to assess the bank’s record in meeting such credit needs. In addition, in order for a bank holding company, like the Company, to commence any new activity permitted by the BHC Act, or to acquire any company engaged in any new activity permitted by the BHC Act, each insured depository institution subsidiary of the bank holding company must have received a rating of at least “satisfactory” in its most recent examination under the CRA. Under the CRA, institutions are assigned a rating of “outstanding,” “satisfactory,” “needs to improve,” or “substantial non-compliance.” The Bank received a “satisfactory” CRA rating in its most recent examination.

On October 24, 2023, the federal bank regulatory agencies issued a final rule to modernize their respective CRA regulations. The revised rules would have substantially altered the methodology for assessing compliance with the CRA, and likely would have made it more challenging and/or costly for the Bank to maintain its “satisfactory” rating. Following its finalization on March 29, 2024, the 2023 modernization rule became subject to an ongoing injunction. On July 16, 2025, the federal bank regulatory agencies issued a joint proposal to rescind the 2023 modernization rule. The agencies continue to apply the CRA rules as they existed before the 2023 modernization, considering the injunction and pending finalization of the rescission of the modernization rule.

Confidentiality of Customer Information. The Company and the Bank are subject to various laws and regulations that address the privacy of nonpublic personal financial information of customers. A financial institution must provide to its customers information regarding its policies and procedures with respect to the handling of customers’ personal information. Each institution must conduct an internal risk assessment of its ability to protect customer information. These privacy laws and regulations generally prohibit a financial institution from providing a customer’s personal financial information to unaffiliated parties without prior notice and approval from the customer.

The CFPB published its final rule to update Regulation P pursuant to the amended Gramm-Leach-Bliley Act in 2018. Under this rule, certain qualifying financial institutions are not required to provide annual privacy notices to customers. To qualify, a financial institution must not share nonpublic personal information about customers except as described in certain statutory exceptions which do not trigger a customer’s statutory opt-out right. In addition, the financial institution must not have changed its disclosure policies and practices from those disclosed in its most recent privacy notice. The rule sets forth timing requirements for delivery of annual privacy notices in the event that a financial institution that qualified for the annual notice exemption later changes its policies or practices in such a way that it no longer qualifies for the exemption.

14

Data privacy and data protection are areas of increasing state legislative focus. In March 2021, the Governor of Virginia signed into law the VCDPA, which went into effect on January 1, 2023. The VCDPA grants Virginia residents the right to access, correct, delete, know, and opt-out of the sale and processing for targeted advertising purposes of their personal information, similar to the protections provided by consumer data privacy laws in California and in Europe. The VCDPA also imposes data protection assessment requirements and authorizes the Attorney General of Virginia to enforce the VCDPA but does not provide a private right of action for consumers. The Bank is exempt from the VCDPA, but certain third-party vendors of the Company or the Bank are subject to the VCDPA, which could negatively impact the products or services that the Company obtains from those vendors.

In October 2023, the CFPB proposed a new rule that would require a provider of payment accounts or products, such as the Bank, to make certain data available to consumers upon request regarding the products or services they obtain from the provider. The proposed rule is intended to give consumers control over their financial data, including with whom it is shared, and encourage competition in the provision of consumer financial products and services. On the same day the final rule was released, certain industry participants filed a complaint against the CFPB challenging the final rule. The litigation is currently stayed while the CFPB considers revisions to the rule. Based on its expected asset size, the Company would have been required to comply with this rule in 2028 or 2029.

These laws and regulations impose compliance costs and create obligations and, in some cases, reporting obligations, and compliance with these laws, regulations, and obligations may require the Company to use significant resources.

Anti-Money Laundering Laws and Regulations. The Company is subject to several federal laws that are designed to combat money laundering, terrorist financing, and transactions with persons, companies or foreign governments designated by U.S. authorities (“AML laws”). This category of laws includes the Bank Secrecy Act of 1970, the Money Laundering Control Act of 1986, the USA PATRIOT Act of 2001, and the Anti-Money Laundering Act of 2020.

The AML laws and their implementing regulations require insured depository institutions, broker-dealers, and certain other financial institutions to have policies, procedures, and controls to detect, prevent, and report money laundering and terrorist financing. The AML laws and their regulations also provide for information sharing, subject to conditions, between federal law enforcement agencies and financial institutions, as well as among financial institutions, for counter-terrorism purposes. Federal banking regulators are required, when reviewing bank holding company acquisition and bank merger applications, to take into account the effectiveness of the anti-money laundering activities of the applicants. To comply with these obligations, the Company has implemented appropriate internal practices, procedures, and controls.

Office of Foreign Assets Control. OFAC, which is a division of the U.S. Treasury, is responsible for helping to ensure that United States entities do not engage in transactions with “enemies” of the United States, as defined by various Executive Orders and Acts of Congress. If the Bank finds a name of an “enemy” of the United States on any transaction, account, or wire transfer that is on an OFAC list, it must freeze such account or place transferred funds into a blocked account, and report it to OFAC. Failure to comply with OFAC requirements could have serious legal, financial and reputational consequences for the Company. To comply with these obligations, the Company has implemented appropriate internal practices, procedures, and controls.

Cybersecurity. The federal banking agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a financial institution’s board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services. The federal banking agencies expect financial institutions to establish lines of defense and ensure that their risk management processes also address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack. If the Company or the Bank fails to meet the expectations set forth in this regulatory guidance, the Company or the Bank could be subject to various regulatory actions and any remediation efforts may require significant resources of the Company or the Bank. In addition, all federal and state banking agencies continue to increase focus on cybersecurity programs and risks as part of regular supervisory exams.

On November 18, 2021, the federal bank regulatory agencies issued a final rule to improve the sharing of information about cybersecurity incidents that may affect the U.S. banking system. The rule requires a banking organization to notify its primary federal regulator of any significant computer-security incident as soon as possible and no later than 36 hours after the banking organization determines that a cybersecurity incident has occurred. Notification is required for incidents that have materially affected or are reasonably likely to materially affect the viability of a banking organization’s operations, its ability

15

to deliver banking products and services, or the stability of the financial sector. In addition, the rule requires a bank service provider to notify affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has materially affected or is reasonably likely to materially affect banking organization customers for four or more hours. The rule became effective on May 1, 2022.

Stress Testing. The federal banking agencies have implemented stress testing requirements for certain large or risky financial institutions, including bank holding companies and state-chartered banks and they emphasize that all banking organizations, regardless of size, should have the capacity to analyze the potential effect of adverse market conditions or outcomes on the organization’s financial condition. Based on existing regulatory guidance, the Company and the Bank are expected to consider the institution’s interest rate risk management, commercial real estate loan concentrations and other credit-related information, and funding and liquidity management during this analysis of adverse market conditions or outcomes.

Call Reports and Examination Cycle. All institutions, regardless of size, submit a quarterly call report that includes data used by federal banking agencies to monitor the condition, performance, and risk profile of individual institutions and the industry as a whole. The EGRRCPA contained provisions expanding the number of regulated institutions eligible to use streamlined call report forms. In June 2019, the federal banking agencies issued a final rule to permit insured depository institutions with total assets of less than $5 billion, such as the Bank, that do not engage in certain complex or international activities to file the most streamlined version of the quarterly call report, and to reduce data reportable on certain streamlined call report submissions.

Federal Home Loan Bank of Atlanta. The Bank is a member of the FHLB of Atlanta, which is one of 11 regional FHLBs that provide funding to their members for making housing loans as well as for affordable housing and community development loans. Each regional FHLB serves as a reserve, or central bank, for the members within its assigned region. Each FHLB makes loans to members in accordance with policies and procedures established by the Board of Directors of the FHLB. As a member, the Bank must purchase and maintain stock in the FHLB. At December 31, 2025, the Bank owned $2.1 million of FHLB stock.

Consumer Financial Protection. The CFPB is the federal regulatory agency that is responsible for implementing, examining and enforcing compliance with federal consumer financial laws for institutions with more than $10 billion of assets and, to a lesser extent, smaller institutions. The CFPB supervises and regulates providers of consumer financial products and services, and has rulemaking authority in connection with numerous federal consumer financial protection laws (for example, but not limited to, the Truth-in-Lending Act (TILA), the Real Estate Settlement Procedures Act (RESPA), the Electronic Funds Transfer Act (EFTA), the Equal Credit Opportunity Act (ECOA), the Home Ownership and Equity Protection Act (HOEPA), the Fair Credit and Reporting Act (FCRA), the Fair Debt Collection Practices Act (FDCPA) and the Home Mortgage Disclosure Act (HMDA)). To comply with these obligations, the Company has implemented appropriate internal practices, procedures, and controls.

Because the Company and the Bank are smaller institutions (i.e., with assets of $10 billion or less), most consumer protection aspects of the Dodd-Frank Act will continue to be applied to the Company by the Federal Reserve Board and to the Bank by the OCC. However, the CFPB may include its own examiners in regulatory examinations by a smaller institution’s principal regulators and may require smaller institutions to comply with certain CFPB reporting requirements. In addition, regulatory positions taken by the CFPB and administrative and legal precedents established by CFPB enforcement activities, including in connection with supervision of larger bank holding companies and banks, could influence how the Federal Reserve Board and OCC apply consumer protection laws and regulations to financial institutions that are not directly supervised by the CFPB. The precise effect of the CFPB’s consumer protection activities on the Company and the Bank cannot be determined with certainty.

During 2025, the CFPB reduced its staff by over 80%. The reduction in force is the subject of litigation, and the staffing cuts are currently stayed pending the federal circuit court’s rehearing of the case. The impact of these developments on banking organizations is uncertain. States and state attorneys general may increase regulatory, investigative and enforcement activity with respect to consumer protection, in response to changes in regulation, supervision and enforcement of consumer protection laws by federal regulators.

Notwithstanding ongoing, legal, budgetary and structural challenges affecting the CFPB, the CFPB remains an active federal regulatory agency with continuing supervisory and enforcement authority and retains its broad authority to pursue enforcement actions, including investigations, civil actions and cease and desist proceedings. The CFPB may also refer civil and criminal findings to the Department of Justice for prosecution. The Bank is also subject to other federal and state

16

consumer protection laws and regulations that, among other things, prohibit unfair, deceptive and abusive, corrupt or fraudulent business practices, untrue or misleading advertising and unfair competition.

Mortgage Banking Regulation. In connection with making mortgage loans, the Company and the Bank are subject to rules and regulations that, among other things, establish standards for loan origination, prohibit discrimination, provide for inspections and appraisals of property, require credit reports on prospective borrowers, in some cases restrict certain loan features and fix maximum interest rates and fees, require the disclosure of certain basic information to mortgagors concerning credit and settlement costs, limit payment for settlement services to the reasonable value of the services rendered, and require the maintenance and disclosure of information regarding the disposition of mortgage applications based on race, gender, geographical distribution and income level. The Company and the Bank are also subject to rules and regulations that require the collection and reporting of significant amounts of information with respect to mortgage loans and borrowers.

The Company’s and the Bank’s mortgage origination activities are subject to Regulation Z, which implements the TILA. Certain provisions of Regulation Z require creditors to make a reasonable and good faith determination based on verified and documented information that a consumer applying for a mortgage loan has a reasonable ability to repay the loan according to its terms. Creditors are required to determine consumers’ ability to repay in one of two ways. The first alternative requires the creditor to consider the following eight underwriting factors when making the credit decision: (i) current or reasonably expected income or assets; (ii) current employment status; (iii) the monthly payment on the covered transaction; (iv) the monthly payment on any simultaneous loan; (v) the monthly payment for mortgage-related obligations; (vi) current debt obligations, alimony, and child support; (vii) the monthly debt-to-income ratio or residual income; and (viii) credit history. Alternatively, the creditor can originate “qualified mortgages,” which are entitled to a presumption that the creditor making the loan satisfied the ability-to-repay requirements. In general, a “qualified mortgage” is a mortgage loan without negative amortization, interest-only payments, balloon payments, or terms exceeding 30 years. In addition, to be a qualified mortgage, the points and fees paid by a consumer cannot exceed 3% of the total loan amount, and the consumer’s debt-to-income ratio (“DTI”) must be below the prescribed threshold. Qualified mortgages that are “higher-priced” (e.g. subprime loans) garner a rebuttable presumption of compliance with the ability-to-repay rules, while qualified mortgages that are not “higher-priced” (e.g. prime loans) are given a safe harbor of compliance. Small creditors, as described below, may originate qualified mortgages that are not restricted by the specific DTI threshold (however, the DTI must still be considered). Small creditors are those financial institutions that meet the following requirements: (i) have assets below $2 billion (adjustable annually by CFPB); (ii) originated no more than 2 thousand first-lien, closed-end residential mortgages subject to the ability-to-repay requirements in the preceding calendar year; and (iii) hold the qualified mortgage loan in its portfolio after origination. The Company, as a small creditor, does comply with the “qualified mortgage rules” and the other applicable TILA requirements.

Incentive Compensation. The federal banking agencies have issued guidance on sound incentive compensation policies that applies to all banking organizations supervised by the agencies including the Company and the Bank. Pursuant to the guidance, to be consistent with safety and soundness principles, a banking organization’s incentive compensation arrangements should: (i) provide employees with incentives that appropriately balance risk and reward; (ii) be compatible with effective controls and risk management; and (iii) be supported by strong corporate governance including active and effective oversight by the banking organization’s board of directors. Monitoring methods and processes used by a banking organization should be commensurate with the size and complexity of the organization and its use of incentive compensation.

The Dodd-Frank Act required the federal banking agencies and the SEC to establish joint regulations or guidelines for financial institutions, such as the Bank, to prohibit incentive-based payment arrangements that encourage inappropriate risk taking by providing an executive officer, employee, director or principal shareholder with excessive compensation, fees, or benefits or that could lead to material financial loss to the entity. Despite numerous proposals, no regulation has been finalized.

Pursuant to SEC regulations, the Company adopted a “clawback” policy with respect to the recovery of incentive-based compensation paid to current or former executive officers in the event of material noncompliance with any financial reporting requirement under the securities laws. A copy of our clawback policy is included as Exhibit 97 to this Annual Report on 10-K.

The Federal Reserve will review, as part of its standard, risk-focused examination process, the incentive compensation arrangements of financial institutions, such as the Company. These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to

17

make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

Fair Access to Financial Services. In August 2025, President Trump signed Executive Order 14331, “Guaranteeing Fair Banking Access for All Americans,” which states that it is the policy of the United States that no American should be denied access to financial services because of their constitutionally or statutorily protected beliefs, affiliations, or political views. The Executive Order directs the Treasury Secretary and federal banking regulators to address politicized or unlawful debanking activities. In recent years, certain states have also enacted, or have proposed to enact, statutes, regulations or policies that prohibit financial institutions from denying or canceling products or services to a person or business, or otherwise discriminating against a person or business in making available products or services, on the basis of certain social or political factors or other activities.

Artificial Intelligence. The CFPB and other federal regulatory guidance reiterates that creditors are not excused from the adverse action notice requirements under the Equal Credit Opportunity Act if they rely on complex algorithmic underwriting models. States have also started to regulate the use of artificial intelligence technologies. In July 2024, the federal banking agencies, including the OCC, the Federal Reserve, and the FDIC, issued a final rule that requires, among other things, financial institutions to ensure that their automated valuation models for property valuation follow certain quality control standards, including a requirement that such valuation models comply with nondiscrimination laws.

Future Regulation

From time-to-time, various legislative and regulatory initiatives are introduced in Congress and state legislatures, as well as by regulatory agencies. Such initiatives may include proposals to expand or contract the powers of bank holding companies and depository institutions or proposals to substantially change the financial institution regulatory system. Such legislation could change banking statutes and the operating environment of the Company and the Bank in substantial and unpredictable ways. If enacted, such legislation could increase or decrease the cost of doing business, limit or expand permissible activities, or affect the competitive balance among banks, savings associations, credit unions, and other financial institutions. The Company cannot predict whether any such legislation will be enacted, and, if enacted, the effect that it, or any implementing regulations, would have on the financial condition or results of operations of the Company or the Bank.

Effect of Governmental Monetary Policies

The Company’s operations are affected not only by general economic conditions but also by the policies of various regulatory authorities. In particular, the Federal Reserve uses monetary policy tools to impact money market and credit market conditions and interest rates to influence general economic conditions. These policies have a significant impact on overall growth and distribution of loans, investments, and deposits; they affect market interest rates charged on loans or paid for time and savings deposits. Federal Reserve monetary policies have had a significant effect on the operating results of commercial banks, including the Company, in the past and are expected to do so in the future.

Reporting Obligations under Securities Laws; Availability of Information

The Company is subject to the periodic and other reporting requirements of the Exchange Act, including the filing of annual, quarterly and other reports with the SEC. Prior to the Reorganization in 2013, the Bank filed the periodic and annual reports required under the Exchange Act with the OCC. Annual reports on Form 10-K, quarterly reports on Form 10-Q and current reports on Form 8-K, plus any amendments to these reports, are available, free of charge, on the company's website at www.vnb.com. The Company’s SEC filings are posted and available as soon as reasonably practicable after the reports are filed electronically with the SEC. The information on the Company’s website is not incorporated into this report or any other filing the Company makes with the SEC. The SEC maintains an internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC at www.sec.gov.