Bank of the James Financial Group Inc BOTJ US Equity☆

botj-20251231x10k

Table of Contents

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

For the fiscal year ended December 31, 2025 or

For the transition period from __________ to __________

______________________

BANK OF THE JAMES FINANCIAL GROUP, INC.

(Exact Name of Registrant as Specified in Its Charter)

Commission file number 001-35402

(434) 846-2000

(Issuer’s telephone number, including area code)

Securities registered under Section 12(b) of the Exchange Act:

Title of Each Class Trading Symbol(s) Name of Exchange on Which Registered

Common Stock, $2.14 par value BOTJ The NASDAQ Capital Markets

Securities registered under Section 12(g) of the Exchange Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.

 Yes þNo

Indicate by check mark if the registrant is not required to file reports pursuant to Section13 or Section 15(d) of the Act.  Yes þNo

Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Exchange Act during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.Yesþ No 

Indicate by check mark whether the registrant has submitted every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files).þYes  No

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or emerging growth company. See definition of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer ☐ Accelerated filer ☐

Non-accelerated filer ☒ Smaller reporting company ☒

Emerging growth company ☐

Table of Contents

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☐

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to § 240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined by Rule 12b-2 of the Exchange Act). ̈Yes þNo

The aggregate value of the voting common equity held by nonaffiliates as of June 30, 2025, the last business day of the registrant’s most recently completed second fiscal quarter, was approximately $55,854,000 based on the price at which the common stock last traded on such day. This price reflects inter-dealer prices without retail mark up, mark down, or commissions, and may not represent actual transactions.

The number of shares outstanding of Common Stock, $2.14 par value as of March 25, 2026 was approximately 4,543,338.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the 2026 Proxy Statement to be used in conjunction with the Annual Meeting of Shareholders, scheduled to be held on May 19, 2026, are incorporated by reference into Part III of this Form 10-K

Table of Contents

PART I 4

Item 1. Business 4

Item 1A. Risk Factors 18

Item 1B. Unresolved Staff Comments 33

Item 1.C. Cybersecurity 33

Item 2. Properties 35

Item 3. Legal Proceedings 37

Item 4. Mine Safety Disclosures 37

Item 6. [Reserved] 38

Item 7A. Quantitative and Qualitative Disclosure About Market Risk 70

Item 8. Financial Statements and Supplementary Data 70

Item 9A. Controls and Procedures 136

Item 9B. Other Information 137

Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections 137

Item 10. Directors, Executive Officers and Corporate Governance 137

Item 11. Executive Compensation 138

Item 14. Principal Accountant Fees and Services 138

Item 15. Exhibits, Financial Statement Schedules 138

Table of Contents

PART I

Item 1.Business

General

Bank of the James Financial Group, Inc. (“Financial” or the “Company”) is a bank holding company headquartered in Lynchburg, Virginia. Financial was incorporated on October 3, 2003 to serve as the bank holding company for Bank of the James (the “Bank” or “Bank of the James”) and acquired all of the outstanding shares of the Bank in a statutory share exchange on a one-for-one basis effective January 1, 2004.

The Bank is a Virginia banking corporation headquartered in Lynchburg, Virginia. It was incorporated under the laws of the Commonwealth of Virginia as a state-chartered bank in 1998 and began banking operations in July 1999. The Bank engages in general retail and commercial banking activities.

The Bank’s principal office is located at 828 Main Street, Lynchburg, Virginia 24504, and its telephone number is (434) 846-2000. The Bank’s website is www.bankofthejames.bank.

Financial conducts three principal activities: (1) general retail and commercial banking through Bank of the James; (2) mortgage brokerage services through Bank of the James Mortgage, a division of the Bank (the “Mortgage Division”); and (3) investment advisory (sometimes referred to as wealth management) services through its wholly-owned subsidiary, Pettyjohn, Wood & White, Inc. (“PWW”).

Financial also provides securities brokerage and other investment services through BOTJ Investment, a division of the Bank, and acts as an agent for insurance and annuity products through BOTJ Insurance, Inc., a wholly-owned subsidiary of the Bank. The operating results of these activities have not materially impacted the Company’s financial performance and are not considered principal activities.

The Bank, BOTJ Insurance, BOTJ Investment Group, Inc. (a non-operating subsidiary), and PWW are Financial’s only subsidiaries and primary assets.

Products and Services

Retail and Commercial Banking

The Bank currently conducts business within Virginia from 19 full-service offices, two limited service offices, and two residential mortgage loan production offices. The location of and services provided by each of our facilities are described in “Item 2. Properties” in this Form 10-K. The Bank established a mortgage loan origination division that conducts business under the name “Bank of the James Mortgage, a Division of Bank of the James” (the “Mortgage Division”). The Mortgage Division conducts business primarily from the division’s main office located in the Forest branch of the Bank and has opened several satellite offices throughout its market area.

In addition, the Bank expanded into Charlottesville in 2013 (opening a full-service branch in 2015), Harrisonburg in 2014 (opening a full-service branch in 2015), Appomattox in 2016 (opening a permanent full-service branch in 2017), Roanoke in 2013 (opening a permanent full-service branch in 2017), Blacksburg in 2018 (opening a mortgage origination office), Lexington in 2019 with a full-service branch, Rustburg in 2019 with a full-service branch, Buchanan in 2024 with a full-service branch, and Nellysford in 2024 (operating a temporary branch that we will replace with a full-service branch in the third quarter 2025). Our recent geographic expansions into surrounding markets such as Charlottesville, Roanoke, and Harrisonburg reflect our strategic initiative to diversify our geographic concentration, enhance growth opportunities, and mitigate economic risk inherent in our primary market.

4

Table of Contents

Deposit Services. Deposits are a major source of our funding. The Bank offers a full range of deposit services that are typically available in most banks and other financial institutions including checking accounts, savings accounts and other time deposits of various types, ranging from daily money market accounts to longer-term certificates of deposit. The transaction accounts and time certificates are tailored to our market areas and offered at rates competitive with other financial institutions in those areas. In addition, the Bank offers its customers Individual Retirement Accounts (IRAs) and Health Care Savings Accounts (HSAs). All deposit accounts are insured by the Federal Deposit Insurance Corporation (the “FDIC”) up to the maximum amount allowed by law (generally, $250,000 per depositor, subject to aggregation rules). The Bank solicits such accounts from individuals, businesses, associations and organizations, and governmental authorities.

Lending Services. The Bank offers a full range of short- to medium-term commercial and consumer loans. Our primary focus is on making loans to small and medium-sized businesses and consumers in the Region 2000 area (which includes Lynchburg, Amherst, Bedford, and Campbell) as well as in Charlottesville, Harrisonburg, Roanoke, Appomattox, Lexington, Blacksburg, Nellysford, and Buchanan. In addition, we also provide a wide range of real estate finance services. Commercial loans include both secured and unsecured loans for working capital (including inventory and receivables), business expansion (including acquisition of real estate and improvements), and purchase of equipment and machinery. Consumer loans include secured and unsecured loans for financing automobiles, home improvements, education and personal investments. Additionally, the Bank originates fixed and floating-rate mortgage loans and real estate construction and acquisition loans. Where appropriate, the Bank attempts to limit interest rate risk through the use of variable interest rates and terms of less than five years.

In general, the Bank offers the following lending services in our market areas:

Commercial Business Lending. We make loans to small- and medium-sized businesses for purposes such as purchases of equipment, facilities upgrades, inventory acquisition and various working capital purposes.

Real Estate Construction. We make commercial and residential construction and development loans.

Commercial Real Estate Mortgage. We make loans to borrowers secured by commercial real estate. In underwriting these types of loans we consider the historic and projected future cash flows of the real estate.

Residential Mortgage. We originate conforming and non-conforming closed-end residential mortgages. These loans are secured by liens on 1 to 4 family properties. We typically sell the conventional mortgage loans to correspondent financial institutions.

Consumer. We offer various types of secured and unsecured consumer loans, including personal loans, lines of credit, overdraft lines of credit, automobile loans, installment loans, demand loans, and home equity loans. We make consumer loans primarily for personal, family or household purposes.

We sell loan participations when a loan we originated exceeds our legal lending limit or when we choose to share risk with another bank. We also purchase loan participations from time to time from other banks in the ordinary course of business. Our loan participations are without recourse against the originating bank. Purchased loan participations are underwritten in accordance with our loan policy and represent a source of loan growth.

Other Banking Services. Other services offered by the Bank include safe deposit boxes, traveler’s checks, direct deposit of payroll and social security checks, automatic drafts for various accounts, treasury management services and credit card merchant services. The Bank also is associated with a shared network of automated teller machines (ATMs) that may be used by Bank customers throughout Virginia, the United States, and internationally.

The Bank intends to introduce new products and services desired by the public and as permitted by the regulatory authorities. The Bank remains committed to leveraging new technologies to meet evolving customer needs. The Bank provides its customers with access to the latest technological products, such as telephone banking and internet banking, including online bill pay. This service allows customers to handle routine transactions using a standard touch tone telephone or cell phone, applications for mobile devices, and via the internet at the Bank’s website.

5

Table of Contents

Mortgage Banking. The Bank, through the Mortgage Division, originates conforming and non-conforming home mortgages primarily in the Region 2000 area. Since 2013, we have operated the Mortgage Division using non-delegated correspondent relationships that allow the Bank to close loans in its name before an investor purchases the loan. By using the Bank’s funds to close the loan (as compared to a broker relationship in which loans are funded by the purchaser of the mortgage), the Bank is able to obtain better pricing due to the slight increase in risk. Management believes the risk associated with this arrangement is acceptable.

Investment Advisory Services. We provide investment advisory services through Financial’s wholly-owned subsidiary, Pettyjohn, Wood & White, Inc. (“PWW”), a Lynchburg, Virginia-based investment advisor registered with the Securities and Exchange Commission. Financial purchased the issued and outstanding shares of PWW on December 31, 2021. PWW generates revenue primarily through investment advisory fees.

Other Activities

We provide brokerage and investment services through the Bank’s Investment division (“Investment Division”). The Investment Division provides securities brokerage services to Bank customers and others through an agreement with Osaic Institutions, Inc. (“Osaic”), a registered broker-dealer. Under our agreement, Osaic operates a service center at the main office located at 828 Main Street, Lynchburg, Virginia. To date the operating results of the Investment Division have not materially impacted our financial performance.

We provide insurance and annuity products through BOTJ Insurance as an agent for national insurance companies. As of the date hereof, we offer the following insurance products: life insurance, fixed annuities, and disability insurance. We began providing these services in September 2008. To date, the operating results of BOTJ Insurance have not materially impacted our financial performance.

Employees

As of March 25, 2026, we had approximately 175 employees, 162 of which are full-time and 13 of which are part-time. Of these, 8 full-time and 2 part-time employees are employed by Pettyjohn, Wood & White, Inc., and 149 full-time and 11 part-time employees are employed by the Bank. None of our employees are represented by any collective bargaining agreements, and relations with employees are considered excellent. We maintain employee benefit programs that include health insurance, a health savings account, a 401(k) plan, and an employee stock purchase plan.

Location and Market Area

The Bank’s primary market area consists of Region 2000, which encompasses the Town of Altavista, Amherst County, Appomattox County, the Town of Bedford, Bedford County, Campbell County, and the City of Lynchburg. Region 2000 supports a diverse regional economy.

The Bank’s market area is served by major transportation corridors, including U.S. Routes 29, 60, 221, 460, and 501, as well as Virginia State Routes 24 and 40, providing access to other regions of the Commonwealth. Regional airport and rail services provide additional transportation options.

The total population of the Region 2000 market area is approximately 267,000. Based on publicly available information, population estimates for the principal localities are approximately as follows: City of Lynchburg – 82,000; Amherst County – 32,000; Appomattox County – 15,000; Bedford County (including the Town of Bedford) – 79,000; and Campbell County (including the Town of Altavista) – 55,000. The area is served by one daily newspaper and multiple radio and television stations. Median family income in Region 2000 has increased over the past decade.

Region 2000 includes a mix of service providers, light industry, and manufacturing operations. Principal employers include BWX Technologies, Inc.; Framatome; Centra Health, Inc.; Southern Air, Inc.; Shentel; Frito-Lay, Inc.;

6

Table of Contents

and U.S. Pipe, as well as several institutions of higher education, including Randolph College, Sweet Briar College, Liberty University, and the University of Lynchburg.

In recent years, the Bank has expanded beyond Region 2000 into additional markets, including Charlottesville, Roanoke, Harrisonburg, Lexington, Buchanan, Nellysford, Blacksburg, Appomattox, and Rustburg. Notwithstanding this expansion, the Bank continues to consider Region 2000 to be its primary market area.

SUPERVISION AND REGULATION OF THE COMPANY

General

Financial, as a bank holding company, and the Bank, as a state-chartered bank, are subject to extensive federal and state laws and regulations. These laws and regulations impose specific requirements or restrictions on and provide for general regulatory oversight of virtually all aspects of our operations. The following briefly summarizes the more significant provisions of applicable federal and state laws, certain regulations and the potential impact of such provisions on Financial and the Bank. These laws and regulations are generally intended to protect depositors, not shareholders. The following summary is qualified by reference to the statutory and regulatory provisions discussed. No assurance can be given that these statutes or regulations will not change.

Changes in applicable laws or regulations may have a material effect on our business and prospects. Our operations may be affected by legislative changes and the policies of various regulatory authorities. We cannot predict the effect that fiscal or monetary policies, economic control, or new federal or state legislation may have on our business and earnings in the future.

Regulation of Financial

General. Financial is subject to the periodic reporting requirements of the Securities and Exchange Act of 1934, as amended (the “Exchange Act”), including the filing with the Securities and Exchange Commission (the “SEC”) of annual, quarterly and other reports on the financial condition and performance of the organization. Financial is directly affected by the corporate responsibility and accounting reform legislation signed into law on July 30, 2002, known as the Sarbanes-Oxley Act of 2002 (the “SOx Act”), and the related rules and regulations. The SOx Act includes provisions that, among other things, require that periodic reports containing financial statements that are filed with the SEC be accompanied by chief executive officer and chief financial officer certifications as to the accuracy and compliance with law, additional disclosure requirements and corporate governance and other related rules. Although we are not required to receive an opinion from our external auditors regarding our internal controls over financial reporting under section 404 of the SOx Act because of our status as a smaller reporting company, our management’s report on internal control over financial reporting is set forth in Item 9A herein. Financial has expended considerable time and money in complying with the SOx Act and expects to continue to incur additional expenses in the future.

Bank Holding Company Act. As a bank holding company registered under the Bank Holding Company Act of 1956 (the “BHCA”), Financial is subject to regulation and examination by the Board of Governors of the Federal Reserve System (the “Federal Reserve Board”). Financial is required to file with the Federal Reserve Board an annual report and such other additional information as the Federal Reserve Board may require pursuant to the BHCA.

The Federal Reserve Board requires a bank holding company to act as a source of financial and managerial strength and to take measures to preserve and protect its bank subsidiaries. Financial would be compelled by the Federal Reserve Board to invest additional capital in the event the Bank experiences either significant credit losses or rapid growth of loans or deposits.

The Federal Reserve Board has jurisdiction under the BHCA to approve any bank or non-bank acquisition, merger or consolidation proposed by a bank holding company. The BHCA, and other applicable laws and regulations, generally limit the activities of a bank holding company and its subsidiaries to that of banking, managing or controlling

7

Table of Contents

banks, or any other activity that is so closely related to banking or to managing or controlling banks as to be a proper incident thereto.

Pursuant to the BHCA, the FRB has the power to order any bank holding company or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the FRB has reasonable grounds to believe that continuation of such activity or ownership constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company.

The FRB also has the authority to examine the Company and its subsidiaries, as well as any arrangements between the Company and its subsidiaries, with the cost of any such examinations to be borne by the Company. Banking subsidiaries of bank holding companies are also subject to certain restrictions imposed by federal law in dealings with their holding companies and other affiliates.

Gramm-Leach-Bliley Act of 1999. The Gramm-Leach-Bliley Act (the “GLB Act”) which was effective March 11, 2000, permits bank holding companies to become financial holding companies and thereby affiliate with securities firms and insurance companies and engage in other activities that are financial in nature. A bank holding company may become a financial holding company by filing a declaration that the bank holding company wishes to become a financial holding company if each of its subsidiary banks (i) is well-capitalized under regulatory prompt corrective action provisions, (ii) is well managed, and (iii) has at least a satisfactory rating under the Community Reinvestment Act (“CRA”). No regulatory approval will be required for a financial holding company to acquire a company, other than a bank or savings association, engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the Federal Reserve Board.

The GLB Act defines “financial in nature” to include securities underwriting, dealing and market making; sponsoring mutual funds and investment companies; insurance underwriting and agency; merchant banking activities; and activities that the Board has determined to be closely related to banking. Subsidiary banks of a financial holding company must continue to be well-capitalized and well-managed in order to continue to engage in activities that are financial in nature without regulatory actions or restrictions, which could include divestiture of the financial in nature subsidiary or subsidiaries. In addition, a financial holding company or a bank may not acquire a company that is engaged in activities that are financial in nature unless each of the subsidiary banks of the financial holding company or the bank has a CRA rating of satisfactory or better.

As discussed in more detail below under “Confidentiality and Required Disclosure of Consumer Information,” the GLB Act also imposes customer privacy requirements on financial institutions.

The cumulative effect of the GLB Act and other recent bank legislation has caused us to strengthen our staff to handle the procedures required by this additional regulation. The increased staff and operational costs have impacted our profitability. Although the above laws may have a significant impact on the banking industry by promoting, among other things, competition, it is not possible for the management of the Bank to determine, with any degree of certainty, the impact of such laws on the Bank.

Limits on the Payment of Dividends. Financial is a legal entity, separate and distinct from the Bank. Financial currently does not have any significant sources of revenue other than cash dividends paid to it by the Bank and PWW. Both Financial and the Bank are subject to laws and regulations that limit the payment of cash dividends, including requirements to maintain capital at or above regulatory minimums. As a bank that is a member of the Federal Reserve System (“state member bank”), the Bank must obtain prior written approval for any cash dividend if the total of all dividends declared in any calendar year would exceed the total of its net profits for that year combined with its retained net profits for the preceding two years.

Banking regulators have indicated that Virginia banking organizations should generally pay dividends only (1) from net undivided profits of the bank, after providing for all expenses, losses, interest and taxes accrued or due by the bank and (2) if the prospective rate of earnings retention appears consistent with the organization’s capital needs, asset

8

Table of Contents

quality and overall financial condition. In addition, the Federal Deposit Insurance Act (FDIA) prohibits insured depository institutions such as the Bank from making capital distributions, including the payment of dividends, if, after making such distribution, the institution would become undercapitalized as defined in the statute. In addition, the Federal Reserve is authorized to determine under certain circumstances relating to the financial condition of a bank that the payment of dividends would be an unsafe and unsound practice and to prohibit payment thereof. The payment of dividends that deplete a bank’s capital base could be deemed to constitute such an unsafe and unsound banking practice. The Federal Reserve has indicated that banking organizations generally pay dividends only out of current operating earnings. In addition, under Virginia law, no dividend may be declared or paid out of a Virginia bank’s paid-in capital. The Bank may be prohibited under Virginia law from the payment of dividends if the Virginia Bureau of Financial Institutions determines that a limitation of dividends is in the public interest and is intended to help ensure the Bank’s financial soundness, and may also permit the payment of dividends not otherwise allowed by Virginia law.

The Dodd-Frank Act

On July 21, 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Reform Act”) was signed into law. The Dodd-Frank Reform Act represents a significant overhaul of many aspects of the regulation of the financial services industry, although many of its provisions (e.g., the interchange and trust preferred capital limitations) apply to companies that are significantly larger than Financial. The Dodd-Frank Reform Act directs applicable regulatory authorities to promulgate regulations implementing its provisions, and its effect on Financial and on the financial services industry as a whole will be clarified as those regulations are issued. Major elements of the Dodd-Frank Reform Act include:

The Dodd-Frank Reform Act changed the assessment base for federal deposit insurance from the amount of insured deposits to consolidated assets less tangible capital, eliminated the ceiling on the size of the Deposit Insurance Fund (DIF) and increased the floor applicable to the size of the DIF. The Dodd-Frank Act also made permanent the $250,000 limit for federal deposit insurance and increased the cash limit of Securities Investor Protection Corporation protection from $100,000 to $250,000.

The Dodd-Frank Reform Act repealed the federal prohibitions on the payment of interest on demand deposits, thereby permitting depository institutions to pay interest on business transaction and other accounts.

The Dodd-Frank Reform Act required new disclosure relating to executive compensation and corporate governance.

The Dodd-Frank Reform Act implemented amendments to the Truth in Lending Act aimed at improving consumer protections with respect to mortgage originations, including originator compensation, minimum repayment standards, and prepayment considerations.

The Dodd-Frank Reform Act established the Financial Stability Oversight Council, which will be responsible for identifying and monitoring systemic risks posed by financial firms, activities, and practices.

The Dodd-Frank Reform Act amended the Electronic Fund Transfer Act (EFTA) to, among other things, require that debit card interchange fees must be reasonable and proportional to the actual cost incurred by the issuer with respect to the transaction. In June 2011, the Federal Reserve Board adopted regulations setting the maximum permissible interchange fee as the sum of 21 cents per transaction and 5 basis points multiplied by the value of the transaction, with an additional adjustment of up to one cent per transaction if the issuer implements additional fraud-prevention standards. Although issuers that have assets of less than $10 billion are exempt from the Federal Reserve Board’s regulations that set maximum interchange fees, these regulations are expected to significantly affect the interchange fees that financial institutions with less than $10 billion in assets are able to collect.

The Dodd-Frank Reform Act eliminated (over time) the inclusion of trust preferred securities as a permitted element of Tier 1 capital.

The Dodd-Frank Reform Act created a special regime to allow for the orderly liquidation of systemically important financial companies, including the establishment of an orderly liquidation fund.

9

Table of Contents

The Dodd-Frank Reform Act requires the development of regulations to address derivatives markets, including clearing and exchange trading requirements and a framework for regulating derivatives-market participants.

The Dodd-Frank Reform Act enhanced supervision of credit rating agencies through the Office of Credit Ratings within the SEC.

The Dodd-Frank Reform Act established the Consumer Financial Protection Bureau, within the Federal Reserve, to serve as a dedicated consumer-protection regulatory body. The Consumer Financial Protection Bureau is responsible for implementing, examining and enforcing compliance with federal consumer financial laws for institutions with more than $10 billion of assets and, to a lesser extent, small institutions. As a smaller institution, most consumer protection aspects of the Dodd-Frank Reform Act will continue to be overseen by the Federal Reserve.

The Dodd-Frank Act allows banks to engage in de novo interstate branching, a practice that was previously significantly limited.

Many aspects of the Dodd-Frank Reform Act are subject to rulemaking by numerous federal agencies to implement various parts of the legislation. While many rules have been finalized or issued in proposed form, additional rules have yet to be proposed or finalized. While it is not possible at this time to predict when all such additional rules will be issued or finalized, and what the content of such rules will be, Financial continues to evaluate the potential impact of the Dodd-Frank Reform Act.

Incentive Compensation

In June 2010, the Federal Reserve, the Office of the Comptroller of the Currency (“OCC”) and the FDIC issued comprehensive final guidance on incentive compensation intended to help ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

The Federal Reserve will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as Financial, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

The Dodd-Frank Reform Act requires the SEC and the federal bank regulatory agencies to establish joint regulations or guidelines that require financial institutions with assets of at least $1 billion to disclose the structure of their incentive compensation practices and prohibit such institutions from maintaining compensation arrangements that encourage inappropriate risk-taking by providing excessive compensation or that could lead to material financial loss to the financial institution.

The Regulatory Relief Act

The Regulatory Relief Act was enacted to modify or remove certain financial reform rules and regulations, including some of those implemented under the Dodd-Frank Act. While it maintains the majority of the regulatory

10

Table of Contents

structure established by the Dodd-Frank Act, the Regulatory Relief Act amends certain aspects for small depository institutions with less than $10 billion in assets, such as the Bank. Sections in the Regulatory Relief Act address access to mortgage credit; consumer access to credit; protections for veterans, consumers, and homeowners; rules for certain bank or financial holding companies; capital access; and protections for student borrowers. Financial and the Bank will focus on the implementing rules and guidance for the various provisions in each section of the Regulatory Relief Act that impact their operations and activities.

Pursuant to the Regulatory Relief Act, on September 17, 2019, the federal banking agencies adopted a final rule regarding a community bank leverage ratio. Under the final rule, which was effective on January 1, 2021, depository institutions and depository institution holding companies that have less than $10 billion in total consolidated assets and meet other qualifying criteria, including a leverage ratio (equal to Tier 1 capital divided by average total consolidated assets) of greater than 9 percent, will be eligible to opt into the community bank leverage ratio framework (qualifying community banking organizations). Qualifying community banking organizations that elect to use the community bank leverage ratio framework and that maintain a leverage ratio of greater than 9 percent will be considered to have satisfied the generally applicable risk-based and leverage capital requirements in the agencies’ capital rules (generally applicable rule) and, if applicable, will be considered to have met the well-capitalized ratio requirements for purposes of section 38 of the Federal Deposit Insurance Act.

The Regulatory Relief Act also expands the universe of holding companies that are permitted to rely on the “Small Bank Holding Company and Savings and Loan Holding Company Policy Statement.” The asset size of a qualifying holding company was increased from $1 billion to $3 billion on August 30, 2018, thus excluding holding companies in this category from consolidated capital requirements. However, subsidiary depository institutions continue to be subject to minimum capital requirements.

Further, the Regulatory Relief Act decreased the burden for community banks in regards to call reports, the Volcker Rule (which generally restricts banks from engaging in certain investment activities and limits involvement with hedge funds and private equity firms), mortgage disclosures, and risk weights for some high-risk commercial real estate loans. On December 28, 2018, the federal banking agencies issued a final rule increasing the asset threshold to qualify for an 18-month examination cycle from $1 billion to $3 billion for qualifying institutions that are well capitalized, well managed and meet certain other requirements.

Any number of the provisions of the Regulatory Relief Act may have the effect of increasing our expenses, decreasing our revenues, or changing the activities in which we choose to engage. The environment in which banking organizations operate, including legislative and regulatory changes affecting capital, liquidity, supervision, permissible activities, corporate governance and compensation, changes in fiscal policy and steps to eliminate government support for banking organizations, may have long-term effects on the profitability of banking organizations that cannot now be foreseen.

It is difficult at this time to determine the direct impact of the Regulatory Relief Act on Financial or the Bank. Implementing rules and regulations are required and many have not yet been written or finalized.

Regulation of the Bank

The Bank is a Virginia chartered commercial bank and a state member bank. The Bank’s deposit accounts are insured by the Deposit Insurance Fund (“DIF”) of the FDIC up to the maximum legal limits of the FDIC and it is subject to regulation, supervision and regular examination by the Virginia Bureau of Financial Institutions and the Federal Reserve. The regulations of these various agencies govern most aspects of the Bank’s business, including required reserves against deposits, loans, investments, mergers and acquisitions, borrowings, dividends and location and number of branch offices. The laws and regulations governing the Bank generally have been promulgated to protect depositors and the deposit insurance funds, and not for the purpose of protecting shareholders.

11

Table of Contents

General. As a state-chartered commercial bank, the Bank and its subsidiaries are subject to regulation, supervision and examination by the Federal Reserve and the Virginia State Corporation Commission’s Bureau of Financial Institutions (the “BFI”). As such, the Bank is subject to various statutes and regulations administered by these agencies that govern, among other things, required reserves, investments, loans, lending limits, acquisitions of fixed assets, interest rates payable on deposits, transactions among affiliates and the Bank, the payment of dividends, mergers and consolidations, and establishment of branch offices.

The earnings of the Bank are affected by general economic conditions, management policies and the legislative and governmental actions of the various regulatory authorities, including those referred to above.

FDIC Insurance Premiums. The FDIC’s DIF provides insurance coverage for certain deposits, which insurance is funded through assessments on banks, like the Bank. Pursuant to the Dodd-Frank Act, the amount of deposit insurance coverage for deposits increased to $250,000 per depositor, subject to aggregation rules. Pursuant to the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), the FDIC has established 2.0% as the designated reserve ratio (the “DRR”), that is, the ratio of the DIF to insured deposits. The Dodd-Frank Act directs the FDIC to amend its assessment regulations so that future assessments will generally be based upon a depository institution’s average total consolidated assets minus the average tangible equity of the insured depository institution during the assessment period, whereas assessments were previously based on the amount of an institution’s insured deposits. The minimum DIF rate has increased from 1.15% to 1.35%, and the cost of the increase will be borne by depository institutions with assets of $10 billion or more. At least semi-annually, the FDIC will update its loss and income projections for the DIF and, if needed, will increase or decrease assessment rates, following notice-and-comment rule making if required.

The Bank incurred $518,000 and $441,000 in FDIC assessments in 2025 and 2024, respectively. Future increases in FDIC insurance premiums may negatively impact the Bank’s profitability.

After giving primary regulators an opportunity to first take action, FDIC may initiate an enforcement action against any depository institution it determines is engaging in unsafe or unsound actions or which is in an unsound condition, and the FDIC may terminate that institution’s deposit insurance.

Capital Requirements. On June 7, 2012, the Federal Reserve issued a series of proposed rules that would revise and strengthen its risk-based and leverage capital requirements and its method for calculating risk-weighted assets. The rules were proposed to implement the Basel III regulatory capital reforms from the Basel Committee on Banking Supervision and certain provisions of the Dodd-Frank Reform Act. On July 2, 2013, the Federal Reserve approved certain revisions to the proposals and finalized new capital requirements for banking organizations.

Effective January 1, 2015, the final rules require the Bank to comply with the following minimum capital ratios: (i) a common equity Tier 1 capital ratio of 4.5% of risk-weighted assets; (ii) a Tier 1 capital ratio of 6.0% of risk-weighted assets; (iii) a total capital ratio of 8.0% of risk-weighted assets (unchanged from the previous requirement); and (iv) a leverage ratio of 4.0% of total assets. A capital conservation buffer requirement was phased in beginning January 1, 2016, at 0.625% of risk-weighted assets, increasing each year until fully implemented at 2.5% on January 1, 2019. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of common equity Tier 1 to risk-weighted assets above the minimum but below the conservation buffer will face constraints on dividends, equity repurchases, and compensation based on the amount of the shortfall.

Since January 1, 2019, the rules have required the Bank to maintain the following minimum capital ratios:

‎(i) Common Equity Tier 1 (CET1) capital ratio of at least 4.5% plus a capital conservation buffer of 2.5%, resulting in an effective CET1 minimum ratio of 7.0%; (ii) Tier 1 capital ratio of at least 6.0% plus the capital conservation buffer, resulting in an effective minimum Tier 1 ratio of 8.5%; (iii) Total capital ratio of at least 8.0% plus the capital conservation buffer, resulting in an effective total capital ratio of 10.5%; and (iv) Leverage ratio (Tier 1 capital to average consolidated total assets) of at least 4.0%. With respect to the Bank, the rules also revised the “prompt corrective action” (PCA) regulations pursuant to Section 38 of the FDIA, which establish thresholds that determine regulatory responses if capital levels decline.Under the revised PCA rules, the Bank must maintain the following ratios to be considered “well

12

Table of Contents

capitalized”: (i) CET1 ratio of at least 6.5%; (ii) Tier 1 capital ratio of at least 8.0%; (iii) Total capital ratio of at least 10.0%; and (iv) Tier 1 leverage ratio of at least 5.0%.

The Basel III capital rules modified asset risk-weightings to better reflect actual credit and market risks, including:

Increasing the risk weight for certain high-volatility commercial real estate (HVCRE) acquisition, development, and construction loans from 100% to 150%.

Assigning a 150% risk weight (previously 100%) to nonresidential mortgage loans that are 90 days past due or on non-accrual status.

Applying a 20% credit conversion factor (previously 0%) for commitments with original maturities of one year or less that are not unconditionally cancellable.

Increasing the risk weight for mortgage servicing rights and deferred tax assets not deducted from capital from 100% to 250%.

Introducing increased risk weights ranging from 0% up to 600% for certain equity exposures.

As discussed above under “Supervision and Regulation - The Regulatory Relief Act,” recently enacted legislation directed the federal bank regulatory agencies to develop a “Community Bank Leverage Ratio,” calculated by dividing tangible equity capital by average consolidated total assets, of not less than 8% and not more than 10%. On September 17, 2019, pursuant to the Regulatory Relief Act, the federal banking agencies adopted a final rule setting a community bank leverage ratio of 9%. If a “qualified community bank,” generally a depository institution or depository institution holding company with consolidated assets of less than $10 billion, has a leverage ratio which exceeds the Community Bank Leverage Ratio, then such bank will be considered to have met all generally applicable leverage and risk based capital requirements; the capital ratio requirements for “well capitalized” status under Section 38 of the FDIA, and any other leverage or capital requirements to which it is subject. Although eligible, as of December 31, 2025, the Bank has not elected to use the Community Bank Leverage Ratio framework.

The asset size of a qualifying holding company was increased from $1 billion to $3 billion on August 30, 2018, thus excluding holding companies in this category from consolidated capital requirements.

Because total assets on a consolidated basis are less than $3 billion, Financial is not subject to the consolidated capital requirements imposed by the Bank Holding Company Act. Although the Company’s subsidiary depository institution continues to be subject to minimum capital requirement, it is unlikely that the Company will be required to comply with the consolidated capital rules until well into the future.

Transactions with Affiliates. The Bank is subject to Sections 23A and 23B of the Federal Reserve Act and Regulation W issued by the Federal Reserve Board. These provisions limit the extent to which the Bank can lend or extend credit to, invest in, or engage in certain other transactions with its affiliates (entities controlled by or under common control with the Bank), as well as transactions involving third parties secured by securities or obligations of affiliates. Specifically, these regulations limit transactions with any individual affiliate to no more than 10% of the Bank’s capital and surplus and limit the aggregate amount of all affiliate transactions to no more than 20% of capital and surplus. Extensions of credit to affiliates must be secured by qualifying collateral, and purchases of low-quality assets from affiliates are generally prohibited. Additionally, transactions with affiliates must be conducted on terms at least as favorable as comparable transactions with non-affiliated parties, or, in the absence of comparable transactions, under terms and conditions, including credit standards, that would apply to non-affiliates.

Loans to Insiders. The Bank is subject to restrictions on loans to insiders under Section 22(h) of the Federal Reserve Act and Regulation O issued by the Federal Reserve Board. Regulation O limits loans to executive officers, directors, and principal stockholders (persons owning more than 10% of the Bank’s voting shares), and their related interests, to amounts not exceeding the loans-to-one-borrower limit applicable to national banks (generally 15% of unimpaired capital and surplus). Total loans to all insiders collectively must not exceed the Bank’s unimpaired capital and surplus.

13

Table of Contents

Regulation O also requires prior approval by a majority of the Bank’s board of directors (excluding any interested director) for any loan to an insider exceeding the greater of $25,000 or 5% of the Bank’s capital and surplus, with a maximum approval threshold of $500,000. Additionally, loans to insiders must be made on terms substantially similar to those offered to unrelated parties, except when made under widely available employee benefit programs that do not favor insiders. Regulation O also restricts the Bank from paying overdrafts in excess of $1,000 incurred by directors or executive officers unless pursuant to a pre-authorized credit or transfer plan.

As of December 31, 2025, all loans and extensions of credit to executive officers, directors, principal stockholders, and their affiliated interests comply with Sections 23A and 23B of the Federal Reserve Act, Regulation W, Section 22(h), and Regulation O.

Community Reinvestment Act. The Community Reinvestment Act (“CRA”) requires that, in connection with examinations of financial institutions, federal banking agencies – including the Federal Reserve Board, the Federal Deposit Insurance Corporation, or the Office of the Comptroller of the Currency or the Office – evaluate an institution’s performance in meeting the credit needs of its local communities, particularly low and moderate income neighborhoods, consistent with the safe and sound operation of those institutions. The CRA does not impose specific lending quotas or programs nor restrict an institution’s discretion in developing products and services suitable to its communities.

An institution’s CRA activities are considered in, among other things, evaluating mergers, acquisitions and applications to open a branch or facility, as well as determining whether the institution will be permitted to exercise certain of the powers allowed by the GLB Act. The CRA also requires all institutions to make public disclosure of their CRA ratings.

As of its most recent CRA evaluation, the Bank received a rating of “Satisfactory.”

Safety and Soundness. The federal banking agencies have broad powers under current federal law to take prompt corrective action to resolve problems of insured depository institutions. The extent of these powers depends upon whether the institutions in question are “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” or “critically undercapitalized,” all such terms are defined under uniform regulations defining such capital levels issued by each of the federal banking agencies. An insured depository institution which is less than adequately capitalized must adopt an acceptable capital restoration plan, is subject to increased regulatory oversight and is increasingly restricted in the scope of its permissible activities. As of December 31, 2025, the Bank was considered “well-capitalized.”

Regulatory Enforcement Authority. Applicable banking laws include substantial enforcement powers available to federal banking regulators. This enforcement authority includes, among other things, the ability to assess civil money penalties, to issue cease-and-desist or removal orders and to initiate injunctive actions against banking organizations and institution-affiliated parties. In general, these enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices. Other actions or inactions, including the filing of misleading or untimely reports with regulatory authorities, may provide the basis for enforcement action.

Cybersecurity. The federal bank regulatory agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a banking organization’s board of directors. This guidance, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services. The federal bank regulatory agencies expect financial institutions to establish appropriate security controls and to ensure that their risk management processes address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to help ensure rapid recovery, resumption and maintenance of the institution’s operations after a cyberattack. If we fail to meet the expectations set forth in such regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.

14

Table of Contents

In November 2021, the federal bank regulatory agencies issued a final rule to improve the sharing of information about cyber incidents that may affect the U.S. banking system. The rule, which became effective on May 1, 2022, requires a banking organization to notify its primary federal regulator within 36 hours of determining that a “computer-security incident” has materially affected - or is reasonably likely to materially affect - the viability of the banking organization’s operations, its ability to deliver banking products and services, or the stability of the financial sector. In addition, the rule requires a bank service provider to notify affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has materially affected or is reasonably likely to materially affect banking organization customers for four or more hours.

Confidentiality and Required Disclosures of Consumer Information. The Bank is subject to various laws and regulations that address the privacy of nonpublic personal financial information of consumers. The Gramm-Leach-Bliley Act and certain regulations issued thereunder protect against the transfer and use by financial institutions of consumer nonpublic personal information. A financial institution must provide to its customers, at the beginning of the customer relationship and annually thereafter, the institution’s policies and procedures regarding the handling of customers’ nonpublic personal financial information. These privacy provisions generally prohibit a financial institution from providing a customer’s personal financial information to unaffiliated third parties unless the institution discloses to the customer that the information may be so provided and the customer is given the opportunity to opt out of such disclosure.

In August, 2018, the CFPB published its final rule to update Regulation P pursuant to the amended GLB Act. Under this rule, certain qualifying financial institutions are not required to provide annual privacy notices to customers. To qualify, a financial institution must not share nonpublic personal information about customers except as described in certain statutory exceptions which do not trigger a customer’s statutory opt-out. In addition, the financial institution must not have changed its disclosure policies and practices from those disclosed in its most recent privacy notice. The rule sets forth timing requirements for delivery of annual privacy notices in the event that a financial institution that qualified for the annual notice exemption later changes its policies or practices in such a way that it no longer qualifies for the exemption.

The Bank is also subject to various laws and regulations that attempt to combat money laundering and terrorist financing. The Bank Secrecy Act requires all financial institutions to, among other things, create a system of controls designed to prevent money laundering and the financing of terrorism, and imposes recordkeeping and reporting requirements. The USA Patriot Act facilitates information sharing among governmental entities and financial institutions for the purpose of combating terrorism and money laundering, and requires financial institutions to establish anti-money laundering programs. The Office of Foreign Assets Control (“OFAC”), which is a division of the U.S. Department of the Treasury, is responsible for helping to ensure that United States entities do not engage in transactions with “enemies” of the United States, as defined by various Executive Orders and Acts of Congress. If the Bank finds a name of an “enemy” of the United States on any transaction, account or wire transfer that is on an OFAC list, it must freeze such account or place transferred funds into a blocked account, file a suspicious activity report with the Treasury and notify the FBI.

Mortgage Banking Regulation. The Bank’s Mortgage Division is subject to the rules and regulations by the Department of Housing and Urban Development (“HUD”), the Federal Housing Administration (the “FHA”), the Department of Veteran Affairs and state regulatory authorities with respect to originating, processing, servicing and selling mortgage loans.

Among other provisions, these rules and regulations, establish standards for loan origination, prohibit discrimination, provide for inspections and appraisals of property, require credit reports on prospective borrowers and, in some cases, restrict certain loan features, and fix maximum interest rates and fees.

In addition to other federal laws, mortgage origination activities are subject to the Equal Credit Opportunity Act, Truth-in-Lending Act, Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, and the Home Ownership Equity Protection Act, and the regulations promulgated thereunder. These laws prohibit discrimination, require the disclosure of certain basic information to mortgagors concerning credit and settlement costs, limit payment for settlement services to the reasonable value of the services rendered and require the maintenance and disclosure of

15

Table of Contents

information regarding the disposition of mortgage applications based on race, gender, geographical distribution and income level.

Effect of Governmental Monetary Policies

Our earnings are affected by domestic economic conditions and the monetary and fiscal policies of the United States government and its agencies. The Federal Reserve Board, through its Federal Open Market Committee (FOMC), exerts considerable influence over commercial banks’ operating results through monetary policy decisions. These policy actions—including open market operations, adjustments to the federal funds target rate, changes in the discount rate on bank borrowings, and alterations in reserve requirements—directly impact the levels of bank loans, investments, and deposits, and are designed to promote maximum employment, stable prices, and moderate long-term interest rates.

Changes in interest rates significantly affect our financial performance and condition. Rising interest rates typically pressure our net interest margin if deposit costs increase faster than loan yields, reduce the fair value of our fixed-rate investment securities and loans, and may decrease loan demand and slow economic activity. Declining interest rates typically compress our net interest margin as loan yields reprice downward faster than deposit costs, though they increase the fair value of our fixed-rate assets and may stimulate loan demand. The actual impact depends on the speed and magnitude of rate changes, competitive dynamics in our markets, and our ability to manage deposit pricing and loan portfolio composition.

Following a period of aggressive rate increases from 2022 to mid-2023 that pushed the federal funds rate to a peak range of 5.00%-5.25%, the Federal Reserve shifted to an easing cycle beginning in September 2024. The FOMC reduced rates by 1.00 percentage point in the second half of 2024 through three cuts, followed by three additional 0.25 percentage point cuts during 2025, bringing the federal funds rate to a range of 3.50%-3.75% by year-end 2025. The rate reductions reflected progress in reducing inflation from peak levels, though inflation has remained persistently above the Fed’s 2% target throughout this period. The future direction and pace of monetary policy remains uncertain and highly data-dependent. The FOMC has signaled a more cautious approach to further rate adjustments given elevated inflation readings, labor market stabilization, and economic uncertainties including the potential effects of tariff policies and other fiscal measures. Whether interest rates rise, fall, or remain stable in 2026 and beyond, such changes could have a material impact on our results of operations and financial condition.

Future Regulatory Uncertainty

The federal and state regulatory environment governing financial institutions continues to evolve in response to economic conditions, political priorities, and policy concerns. Legislative and regulatory proposals that could materially affect banking operations, capital requirements, permissible activities, and competitive dynamics are regularly considered by Congress, federal banking agencies, and state governments.

The banking industry failures of 2023—including Silicon Valley Bank, Signature Bank, and First Republic Bank—prompted heightened regulatory scrutiny that has continued through 2025. Federal banking agencies have increased their focus on interest rate risk management, liquidity stress testing, uninsured deposit concentrations, and supervision of banks below the $250 billion asset threshold. While comprehensive new regulations have not been finalized, regulators have signaled ongoing attention to bank governance, risk management practices, and capital adequacy, particularly for institutions experiencing rapid growth or concentrated funding sources.

The current presidential administration has indicated a preference for regulatory relief and reducing regulatory burden on financial institutions. In addition, federal banking regulators have recently proposed or implemented certain regulatory adjustments intended to tailor regulatory requirements and reduce compliance burden for community banks. These efforts have included, among other initiatives, proposed or finalized changes to capital requirements, refinements to the community bank leverage ratio framework, and updates to examination and supervisory practices. However, the regulatory environment ultimately depends on actions by independent federal banking agencies, Congressional legislation, and state regulatory authorities, and the direction, timing, and scope of future regulatory changes remain uncertain.

16

Table of Contents

Regulatory reform efforts could include further modifications to capital requirements, additional adjustments to the community bank leverage ratio framework, changes to examination practices, or alterations to compliance obligations under various banking statutes.

The evolving regulatory landscape presents both risks and potential opportunities. Increased capital or liquidity requirements, enhanced examination standards, or expanded compliance obligations could increase our operating costs, limit business activities, or require additional investment in risk management infrastructure. Conversely, regulatory relief tailored to community banks could reduce compliance burden and enhance operational flexibility. Given the uncertain legislative and regulatory environment, we cannot predict with confidence which proposals will be adopted or how they will ultimately affect our operations.

We remain subject to comprehensive supervision and regulation by federal and state banking authorities and expect this oversight to continue regardless of broader policy shifts. Our ability to manage regulatory compliance effectively while maintaining profitability will continue to be important to our financial performance.

Regulation of PWW

Pettyjohn, Wood & White, Inc. (PWW) is a registered investment adviser under the Investment Advisers Act of 1940, as amended (the “Advisers Act”), and is regulated by the Securities and Exchange Commission (SEC). As a federally registered investment adviser, PWW is subject to comprehensive regulatory requirements governing its operations, including fiduciary duties to clients, disclosure obligations, custody and safekeeping of client assets, compliance policies and procedures, and advertising and marketing practices.

The SEC conducts periodic examinations of registered investment advisers to assess compliance with the Advisers Act and related regulations. PWW maintains policies, procedures, and internal controls designed to help ensure compliance with applicable securities laws and regulations. However, the investment advisory industry is subject to extensive and evolving regulation, and changes in regulatory requirements or interpretations could increase PWW’s compliance costs, limit certain advisory services or fee structures, or require modifications to its business practices.

The Advisers Act grants the SEC broad administrative and enforcement powers, including the authority to impose sanctions, censure firms and individuals, suspend or revoke registration, or seek injunctive relief for violations of securities laws. Regulatory action against PWW, whether resulting from actual violations or alleged non-compliance, could result in fines, reputational harm, loss of clients, or restrictions on business activities, any of which could materially adversely affect PWW’s operations and the Company’s consolidated financial results.

As of December 31, 2025, PWW had approximately $1,028,928,000 in assets under management. PWW’s investment advisory fees, which constituted approximately 11.0% of the Company’s total revenue in 2025, are an important component of the Company’s noninterest income and overall profitability.

Item 1A.Risk Factors

RISK FACTORS

In addition to the other information included in this Annual Report on Form 10-K, the following risk factors should be carefully considered in connection with evaluating our business and any forward-looking statements contained herein. Our business, financial condition, results of operations and cash flows could be harmed by any of the risk factors described below, or other risks that have not been identified or which we believe are immaterial or unlikely. If one or more of these or other risks or uncertainties materialize, or if our underlying assumptions prove to be incorrect, our business, financial condition, operating results and cash flows could be materially adversely affected.

‎

17

Table of Contents

RISKS RELATED TO OUR BUSINESS

Our profitability depends significantly on local economic conditions.

Our success depends primarily on the general economic conditions of the primary markets in Virginia in which we operate and where our loans are concentrated. Unlike nationwide banks that are more geographically diversified, we provide banking and financial services to customers primarily in the Lynchburg metropolitan statistical area (“MSA”), often referred to as Region 2000, which includes the City of Lynchburg and the Counties of Bedford, Campbell, Amherst, and Appomattox. To a lesser extent, our lending market includes the Roanoke, Charlottesville, Harrisonburg, Blacksburg, and Wytheville MSAs. As of December 2025, the Lynchburg MSA had an unemployment rate (not seasonally adjusted) of approximately 3.6%, compared to a statewide average unemployment rate of approximately 3.5%, reflecting a modest increase from approximately 3.3% at the end of 2024.

The local economic conditions in these areas have a significant impact on our commercial and industrial, real estate and construction loans, the ability of our borrowers to repay their loans and the value of the collateral securing these loans. If population or income growth in our market areas is slower than projected, income levels, deposits and housing starts could be adversely affected and could result in a reduction in our growth and profitability. If our market areas experience a downturn or recession for a prolonged period, we could experience significant increases in nonperforming loans, which could lead to operating losses, impaired liquidity and eroding capital. A significant decline in general economic conditions, caused by inflation, recession, acts of terrorism, outbreaks of hostilities or other calamities, unemployment, or monetary and fiscal policies of the federal government could negatively affect our financial condition, results of operations and cash flows.

Future public health emergencies could adversely affect our business, financial condition, and results of operations.

A widespread public health crisis, such as a pandemic or epidemic, could adversely affect economic conditions in our markets, disrupt our operations, increase loan delinquencies and defaults, reduce the value of loan collateral, and negatively impact our financial condition and results of operations. The extent of any impact would depend on the severity and duration of the crisis and related governmental and economic responses.

A significant portion of our loan portfolio is secured by real estate, and events that negatively impact the real estate market could hurt our business.

A substantial majority of our loans have real estate as a primary or secondary component of collateral. The real estate collateral provides an alternate source of repayment in the event of default but may deteriorate in value during the time the credit is extended. Because most of our loans are concentrated in the Region 2000 area in and surrounding the City of Lynchburg, a decline in local economic conditions may have a greater effect on our earnings and capital than on larger financial institutions whose real estate loan portfolios are more geographically diverse.

A weakening of the real estate market in our primary market areas could increase borrower defaults and reduce the value of collateral securing our loans, which could adversely affect our profitability and asset quality. If we are required to liquidate collateral during a period of reduced real estate values, our earnings and capital could be adversely affected. Additionally, acts of nature, including hurricanes, tornadoes, earthquakes, fires and floods, may cause uninsured damage to real estate that secures our loans and negatively impact our financial condition.

Our loan portfolio contains a number of real estate loans with relatively large balances.

A significant portion of our loan portfolio consists of real estate loans with balances in excess of $1,000,000. The deterioration of one or a few of these loans could significantly increase nonperforming loans, loan charge-offs, and the provision for credit losses, which could have a material adverse effect on our financial condition and results of operations.

18

Table of Contents

Commercial real estate loans increase our exposure to credit risk.

A majority of our loan portfolio is secured by commercial real estate. Commercial real estate loans generally have higher default risk than residential real estate or consumer loans because repayment often depends on the successful operation of the property, the borrower’s income stream, and the accuracy of property valuations and construction cost estimates. An adverse development with respect to one lending relationship can expose us to significantly greater risk of loss compared with single-family residential mortgage loans because we typically have multiple loans with such borrowers. Additionally, these loans typically involve larger loan balances to single borrowers or groups of related borrowers.

The deterioration of one or a few of these loans could cause a significant decline in asset quality, a sharp increase in loan charge-offs, and could require us to significantly increase our allowance for credit losses, which could have a material adverse impact on our business, financial condition, results of operations and cash flows.

A percentage of the loans in our portfolio currently include exceptions to our loan policies and supervisory guidelines.

All loans we make are subject to written loan policies adopted by our board of directors and supervisory guidelines imposed by our regulators. Our loan policies are designed to reduce risks by requiring loan officers to take certain steps prior to closing, including documenting and perfecting liens on collateral and requiring proof of adequate insurance coverage.

Loans that do not fully comply with our loan policies are known as “exceptions,” which we categorize as policy exceptions, financial statement exceptions, and document exceptions. As a result of these exceptions, such loans may have a higher risk of loan loss than loans that fully comply with our loan policies. In addition, we may be subject to regulatory action by federal or state banking authorities if they believe the number of exceptions in our loan portfolio represents an unsafe banking practice.

As a community bank, we have different lending risks than larger banks due to our focus on individuals and small to medium-sized businesses.

Our ability to diversify our economic risks is limited by our local markets and economies. We lend primarily to small to medium-sized businesses, professionals and individuals, which may expose us to greater lending risks than banks lending to larger, better-capitalized businesses with longer operating histories. Small to medium-sized businesses frequently have smaller market share than their competition, may be more vulnerable to economic downturns, have fewer financial resources and borrowing capacity, often need substantial additional capital to expand or compete, and may experience significant volatility in operating results. Any one or more of these factors may impair a borrower’s ability to repay a loan.

In addition, the success of a small to medium-sized business often depends on the management talents and efforts of one or two persons or a small group of persons, and the death, disability or resignation of one or more of these persons could have a material adverse impact on the business and its ability to repay. Economic downturns and other events that negatively impact our market areas could cause us to incur substantial credit losses that could negatively affect our results of operations and financial condition.

We depend on the accuracy of information provided by clients and counterparties.

In deciding whether to extend credit or enter into other transactions, we rely on information furnished by or on behalf of clients and counterparties, including financial statements and other financial information, which we do not independently verify as a matter of course. We also rely on representations of clients and counterparties as to the accuracy and completeness of that information and, with respect to financial statements, on reports of independent auditors. For example, in deciding whether to extend credit, we may assume that a customer’s audited financial statements conform

19

Table of Contents

with U.S. Generally Accepted Accounting Principles (“GAAP”) and fairly present the customer’s financial condition, results of operations and cash flows. Our financial condition and results of operations could be negatively impacted if we rely on financial statements that do not comply with GAAP or are materially misleading.

Credit losses could adversely affect our earnings and financial condition.

We could sustain losses if borrowers, guarantors or related parties fail to perform in accordance with the terms of their loans. We have adopted underwriting and credit monitoring procedures and policies, including the establishment and review of the allowance for credit losses, that we believe are appropriate to minimize this risk by assessing the likelihood of nonperformance, tracking loan performance and diversifying our credit portfolio. These policies and procedures, however, may not prevent unexpected losses that could materially adversely affect our results of operations.

These policies and procedures necessarily rely on our making various assumptions and judgments about the collectability of our loan portfolio, including the creditworthiness of our borrowers and the value of real estate and other assets serving as collateral. In determining the amount of the allowance for credit losses, we review our loans, our loss and delinquency experience, and economic conditions. If our assumptions are incorrect, our allowance for credit losses may not be sufficient to cover losses in our loan portfolio, resulting in additions to our allowance. Any future additions to our allowance could materially decrease our net income.

In addition, the Federal Reserve Bank of Richmond and the Virginia Bureau of Financial Institutions periodically review our allowance for credit losses and may require us to increase our provision for credit losses or recognize further loan charge-offs. Any increase in our allowance for credit losses or loan charge-offs as required by regulatory authorities could have a material adverse effect on our financial condition and results of operations.

Our allowance for credit losses may not be adequate to cover actual losses.

A significant source of risk arises from the possibility that we could sustain losses due to loan defaults and nonperformance. We maintain an allowance for credit losses in accordance with GAAP to provide for such defaults and other nonperformance. As of December 31, 2025, our allowance as a percentage of total loans was 0.97% and our allowance as a percentage of nonperforming loans was 379%. The determination of the appropriate level of allowance is an inherently difficult process based on numerous assumptions and judgments, and the amount of future losses is susceptible to changes in economic, operating and other conditions, including changes in interest rates, many of which are beyond our control. In addition, our underwriting policies, credit monitoring processes and risk management systems may not prevent unexpected losses. Our allowance may not be adequate to cover actual credit losses, and any increase in our allowance will adversely affect our earnings.

We adopted the Current Expected Credit Losses (“CECL”) accounting standard on January 1, 2023. The CECL methodology requires a forward-looking approach that reflects expected credit losses over the lives of financial assets, starting when such assets are first originated or acquired. CECL requires us to record, at the time of origination, the credit losses expected throughout the life of our loans, as opposed to the previous incurred-loss method, which recorded losses only when it was probable that a loss event had already occurred. CECL necessitates the use of quantitative models, forecasts, and significant assumptions and judgment, and it relies on historical data and estimated relationships that may not accurately predict future losses, particularly during periods of economic stress or rapid changes in interest rates or the composition of our loan portfolio. In addition, we may rely on third-party vendors, models, software, or data in developing or operating our CECL methodology and forecasts, and any limitations, errors, or deficiencies in such tools or inputs, or in our model governance, validation, and monitoring processes, could result in inaccurate loss estimates. CECL can also result in greater volatility in our allowance and provision for credit losses. If our assumptions prove incorrect, if actual credit losses differ materially from our estimates, or if regulators, auditors, or standard setters require changes to our methodology, assumptions, or inputs, we could be required to increase our allowance or otherwise modify our estimates, which could materially adversely affect our financial condition and operating results.

20

Table of Contents

We face substantial competition in our markets.

The banking and financial services industry is highly competitive. We compete with other commercial banks, savings banks, credit unions, finance companies, mutual funds, insurance companies and brokerage and investment banking firms in the Virginia localities where we operate and surrounding areas. Many of these competing institutions have nationwide or regional operations and greater resources than we have, while we also face competition from local community institutions. Many of our competitors enjoy competitive advantages, including greater name recognition and financial resources, a wider geographic presence, more accessible branch locations, the ability to offer additional services, greater marketing resources, more favorable pricing for loans and deposits, and lower origination and operating costs. We are also subject to lower lending limits than our larger competitors.

Our profitability depends upon our continued ability to successfully compete in our market areas. Increased deposit competition could increase our cost of funds and adversely affect our ability to generate funds necessary for our lending operations. If we must raise interest rates paid on deposits or lower interest rates charged on loans, our net interest margin and profitability could be adversely affected. Competition could result in a decrease in loans we originate and could negatively affect our ability to grow and our results of operations.

Technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and payment systems. Many of our competitors have fewer regulatory constraints and may have lower cost structures. Additionally, due to their size, many competitors may achieve economies of scale and, as a result, may offer a broader range of products and services as well as better pricing.

We have increased and plan to continue to increase our levels of commercial and industrial loans. We may not be successful in continuing to penetrate this market segment, which has helped to drive some of our recent earnings.

A significant percentage of our loans are commercial and industrial loans, and we continue to focus on this market segment. While we intend to originate these loans in a manner consistent with safety and soundness, commercial and industrial loans generally expose us to greater risk of loss than one- to four-family residential mortgage loans because repayment generally depends, in large part, on the borrower’s business performance and ability to cover operating expenses and debt service. In addition, these loans typically involve larger loan balances to single borrowers or groups of related borrowers compared to residential mortgage loans. Changes in economic conditions beyond our or the borrower’s control could adversely affect the value of the loan collateral and the future cash flow of the affected business. As we continue to originate these loans, we may experience higher levels of non-performing assets or credit losses, or both.

Our plans for future expansion depend, in some instances, on factors beyond our control, and an unsuccessful attempt to achieve growth could have a material adverse effect on our business, financial condition, results of operations and future prospects.

We may engage in branch expansion or seek to acquire other financial institutions or parts of those institutions in the future, though we have no present acquisition plans. Expansion involves a number of risks, including:

the time and costs of evaluating new markets, hiring experienced local management and opening new offices;

time lags between expansion activities and the generation of sufficient assets and deposits to support the costs;

entrance into new markets where we lack experience;

introduction of new products and services with which we have no prior experience;

failure to culturally integrate an acquisition target or new branches; and

failure to identify and retain experienced key management with local expertise and relationships in new markets.

21

Table of Contents

Foreclosed properties could lead to increased operating expenses and losses.

From time to time, we foreclose upon and take title to real estate serving as collateral for our loans. If our other real estate owned (OREO) balance increases, our earnings will be negatively affected by various expenses associated with OREO, including personnel costs, insurance and taxes, completion and repair costs, valuation adjustments and other expenses associated with property ownership.

At the time we foreclose upon a loan and take possession of a property, we estimate the property’s value using third-party appraisals and internal judgments. OREO property is valued on our books at the estimated market value of the property, less estimated costs to sell. Upon foreclosure, a charge-off to the allowance for credit losses is recorded for any excess of the loan balance over fair value. Thereafter, we periodically reassess fair value based on updated appraisals or other factors. Any declines in our estimate of fair value will result in valuation adjustments that negatively impact our earnings. As a result, our results of operations are vulnerable to declines in the residential and commercial real estate markets in the areas in which we operate. Any increase in non-accrual loans may lead to increases in our OREO balance.

We may need to raise additional capital in the future, which may not be available on acceptable terms.

We are required by federal and state regulatory authorities to maintain adequate levels of capital to support our operations. We may need to raise additional capital to support future growth or to meet regulatory capital requirements. Our ability to raise additional capital will depend on conditions in the capital markets at that time, which are outside of our control, and on our financial performance. We cannot assure that we will be able to raise additional capital on terms acceptable to us. If we cannot raise additional capital when needed, our ability to expand our operations could be materially impaired, and our financial condition and results of operations could be adversely affected.

Our corporate culture has contributed to our success, and if we cannot maintain this culture as we grow, we could lose the teamwork and increased productivity fostered by our culture, which could harm our business.

We believe that a critical contributor to our success has been our corporate culture, which we believe fosters teamwork and increased productivity. As our organization grows and we are required to implement more complex organizational management structures, we may find it increasingly difficult to maintain the beneficial aspects of our corporate culture. This could negatively impact our future success.

Loss of key employees could adversely affect our business.

Our success is highly dependent on our executive management team and other key personnel. As a community bank, we depend on our management team’s ties to the community to generate business and on our executives’ expertise to implement our business strategy. Our executive management and other key personnel have not signed non-competition covenants.

Competition for personnel is intense, and we may not be successful in attracting or retaining qualified personnel. The loss of several key personnel could adversely affect our growth strategy and seriously harm our business, results of operations and financial condition.

Severe weather, natural disasters, acts of war or terrorism or other adverse external events could significantly impact our business.

Severe weather, natural disasters, acts of war or terrorism or other adverse external events could have a significant impact on our ability to conduct business. Such events could affect the stability of our deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue or cause us to incur additional expenses, any of which could have a material adverse effect on our business, financial condition and results of operations.

22

Table of Contents

As a community bank, our ability to maintain our reputation is critical to the success of our business, and our failure to do so may materially adversely affect our performance.

Our reputation is one of the most valuable components of our business. Negative publicity can result from our actual or alleged conduct in any number of activities, including lending practices, corporate governance, acquisitions and actions taken or threatened by government regulators and community organizations in response to those activities. If our reputation is negatively affected by the actions of our employees or otherwise, there may be an adverse effect on our ability to keep and attract customers, and we might be exposed to litigation and regulatory action, any of which could materially adversely affect our business and operating results.

Our decisions regarding how we manage our credit exposure may materially and adversely affect our business.

We manage our credit exposure through careful monitoring of lending relationships and loan concentrations in particular industries, and through loan approval and review procedures. The adequacy of our allowance for credit losses is crucial in monitoring credit exposure. While our board and senior management are continuing to improve the Bank’s risk management framework and align the Bank’s risk philosophy with its capital and strategic plans, failure to continue to improve such risk management framework could have a material adverse effect on our financial condition and results of operations. We can make no assurances that our credit loss reserves will be sufficient to absorb future credit losses or prevent a material adverse effect on our business, financial condition or results of operations.

Our profitability is vulnerable to interest rate fluctuations and changes in monetary policies.

Our profitability depends substantially upon our net interest income, which is the difference between the interest earned on interest-earning assets, such as loans and investment securities, and the interest expense paid on interest-bearing liabilities, such as deposits and other borrowings. Market interest rates are highly sensitive to many factors beyond our control, including market conditions, policies of monetary and fiscal authorities, particularly the Federal Reserve, and competitive pricing pressures. Changes in interest rates may cause significant changes in our net interest income and net interest margin. Depending on our portfolio of loans and investments, our results of operations may be adversely affected by changes in interest rates.

Our financial condition and results of operations are affected by credit policies of monetary authorities, particularly the Federal Reserve Board. Actions by monetary and fiscal authorities, including the Federal Reserve Board, could have an adverse effect on our deposit levels, loan demand or business and earnings.

Inflation could adversely impact our customers’ ability to repay loans.

Inflation decreases the purchasing power of money and can reduce the value of assets and income from investments. Our customers may be adversely affected by inflation and the rising costs of goods and services used in their households and businesses, which could negatively impact their ability to repay their loans.

Cybersecurity threats and operational system failures could disrupt our business and result in financial losses.

Cybersecurity threats, including attacks on us or our third-party service providers, and operational system failures could disrupt our business, result in financial losses, increase compliance and remediation costs, and harm our reputation.

We rely on communications, information systems, and third-party service providers to operate our business and to deliver products and services to customers. These systems and relationships expose us to the risk of cyber incidents and operational disruptions, including unauthorized access, loss or destruction of data (including nonpublic personal information), account takeovers, unavailability of service, ransomware or other malware, and other attacks.

23

Table of Contents

Cyber threats are continually evolving, and threat actors may use increasingly sophisticated methods, including social engineering, credential theft, deepfake-enabled fraud, supply-chain compromise, and exploitation of vulnerabilities in vendor systems. In addition, our customers access our services through devices and networks we do not control, which may increase the risk of compromise of customer credentials.

Cyber incidents or operational disruptions could:

impair our ability to conduct business, process transactions, or provide customer service;

result in the disclosure, misuse, or loss of confidential information;

subject us to regulatory scrutiny, supervisory actions, investigations, or litigation;

require significant expenditures for remediation, forensic investigation, notification, system enhancements, and business continuity measures;

increase our cyber insurance costs or reduce the availability of coverage on acceptable terms; and

damage our reputation and adversely affect customer relationships.

While we maintain policies, procedures, and controls designed to prevent, detect, and respond to cyber incidents and operational disruptions, no system can provide absolute security. We have experienced cybersecurity incidents and other technology-related events in the past that resulted in costs and/or operational impacts, and we may experience additional incidents in the future. Any such incident, whether arising from our systems or those of third parties, could materially adversely affect our business, financial condition, and results of operations.

We have suffered non-material losses in the past from such events and there can be no assurance that such events will not have a material effect on the Bank.

Emerging Technological Threats

The pace of technological change continues to increase the operational, fraud, and cybersecurity risks faced by financial institutions. In particular, malicious actors are increasingly using artificial intelligence and other tools to conduct more sophisticated attacks, including highly targeted phishing and social‐engineering campaigns, business email compromise, deepfake or voice‐spoofing fraud, and account takeover attempts. These evolving tactics may be difficult to detect and prevent and could result in customer losses, theft or diversion of funds, unauthorized transactions, operational disruption, reputational harm, litigation, and increased compliance and remediation costs.

We also rely on third‐party service providers for critical technology systems and services, including core processing, online and mobile banking, payment processing, information security tools, cloud-based services, and other outsourced functions. A failure, disruption, security breach, or other compromise of our systems or those of our service providers—whether due to cyberattack, human error, system failure, or other cause—could impair our ability to deliver products and services, expose sensitive customer or Company information, or otherwise adversely affect our operations and financial condition. In addition, changes in the threat landscape and technology environment may require us to make significant ongoing investments in technology infrastructure, cybersecurity controls, fraud prevention, vendor oversight, and employee training; if we are unable to implement these enhancements effectively or on a timely basis, our risk exposure may increase.

Customer expectations regarding digital banking capabilities, convenience, and availability continue to evolve. If we do not successfully maintain and enhance our digital delivery channels and technology-enabled services, or if customers perceive our capabilities to be less competitive than alternatives offered by other banks, credit unions, or financial technology companies, we could lose customers, deposits, and related relationships, which could adversely affect our liquidity, net interest income, fee income, and overall profitability.

‎

24

Table of Contents

Alternative financial products, digital banking trends, and technological change could affect our deposit base and competitive position.

Our traditional banking model depends heavily on stable customer deposits as a primary source of funding. The rising popularity of alternative financial products and services—including fintech platforms, cryptocurrencies, money market funds, and digital wallets—may lead to increased volatility in our deposit base as customers seek different ways to save and invest their funds. This shift in customer preferences could challenge our ability to maintain stable deposits and attract and retain customers.

The financial services industry is increasingly affected by advances in technology, including Internet-based banking, mobile banking, and new technology-driven products and services. Financial technology companies that rely on technology to provide financial services such as peer-to-peer platforms have the potential to disrupt the financial services industry. Our ability to compete successfully may depend on the extent to which we are able to adapt to and implement such technological changes and properly train our staff to use such technologies. We may not be able to effectively implement new technology-driven products and services or compete successfully against these products.

Increasing customer demand for digital banking capabilities also requires ongoing investments in technology infrastructure, cybersecurity, and regulatory compliance. Significant fluctuations in deposits could adversely affect our liquidity position, funding costs, and overall financial stability. Although we actively manage our liquidity and funding sources, a substantial shift of customer deposits to alternative products or failure to adapt to technological changes could negatively impact our operations, profitability, and competitive position.

Changes in consumers’ use of banks and changes in consumers’ spending and saving habits could adversely affect our financial results.

Technology and other changes now allow many consumers to complete financial transactions without using banks. For example, consumers can pay bills and transfer funds directly without going through a bank. This disintermediation could result in the loss of fee income, as well as the loss of customer deposits and income generated from those deposits. In addition, changes in consumer spending and saving habits could adversely affect our operations, and we may be unable to timely develop competitive new products and services in response to these changes that are accepted by new and existing customers.

We are subject to operational risks.

The Company may also be subject to disruptions of its systems arising from events that are wholly or partially beyond our control (including, for example, computer viruses or electrical or telecommunications outages), which may give rise to losses in service to customers and to financial loss or liability. The Company is further exposed to the risk that its external vendors may be unable to fulfill their contractual obligations (or will be subject to the same risk of fraud or operational errors by their respective employees as is the Company) and to the risk that the Company’s (or its vendors’) business continuity and data security systems prove to be inadequate.

Liquidity risk could adversely affect our business and financial condition.

Liquidity risk is the potential that we will be unable to meet our obligations as they become due, capitalize on growth opportunities as they arise, or pay regular cash dividends because of an inability to liquidate assets or obtain adequate funding on a timely basis, at a reasonable cost and within acceptable risk tolerances. A failure to adequately manage our liquidity risk could adversely affect our business, financial condition and operating results. In addition, the Federal Reserve could impose additional requirements on us if the agency determines that our liquidity risk management practices do not adequately manage our liquidity risk.

25

Table of Contents

Our liquidity could be reduced by a decrease in the value of certain assets, including loans and investment securities, caused by increases in interest rates, which could reduce the amount that we are able to borrow or reduce the proceeds from the sale of securities in our portfolio. Our ability to borrow could also be impaired by factors that are not specific to us, such as a disruption in the financial markets or negative views about the prospects for the financial services industry.

We may lose lower-cost funding sources.

Checking, savings and money market deposit account balances can decrease when customers perceive alternatives such as other financial institutions or investments as providing a better risk/return tradeoff. If customers move money out of bank deposits and into other investments or to other financial institutions, we could lose a relatively low-cost source of funds, thereby increasing our funding costs and reducing our net interest income and net income.

Failure to maintain effective internal and disclosure controls could adversely affect our financial reporting and stock price.

We face the risk that the design of our internal controls and procedures, including those to mitigate the risk of fraud by employees or outsiders, may prove to be inadequate or circumvented, thereby causing delays in detection of errors or inaccuracies. We regularly review and update our internal controls, disclosure controls and procedures, and corporate governance policies. Any system of controls, however well designed and operated, is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met. Any failure or circumvention of our controls and procedures or failure to comply with regulations related to controls and procedures could have a material adverse effect on our business, results of operations and financial condition.

Any failure to maintain effective controls or timely effect any necessary improvements could hinder our ability to accurately report our operating results or cause us to fail to meet our reporting obligations, which could affect our ability to remain listed with The NASDAQ Capital Market. Ineffective internal and disclosure controls could also harm our reputation, negatively impact our operating results or cause investors to lose confidence in our reported financial information, which could have a negative effect on the trading price of our securities.

Changes in the financial markets could impair the value of our investment portfolio.

Our investment securities portfolio represents a significant component of our total earning assets. Market volatility, fluctuations in interest rates, and broader economic uncertainties could adversely affect the market value of our investment portfolio, potentially negatively impacting our net income and capital levels.

As of December 31, 2024, and December 31, 2025, we had unrealized losses, net of taxes, in our investment securities portfolio of $22,915,000 and $14,937,000, respectively. While we maintain sufficient liquidity to support our intent and ability to hold these securities until maturity or market recovery, if future conditions impair our liquidity or alter our intent or ability to hold these investments to maturity, we could incur losses that negatively impact our net income and potentially our capital position.

Our deposit insurance premiums could be substantially higher in the future, which could have a material adverse effect on our future earnings.

The FDIC insures deposits at FDIC-insured depository institutions up to applicable limits. The amount of a particular institution’s deposit insurance assessment is based on that institution’s risk classification under an FDIC risk-based assessment system, which considers the institution’s capital levels and the level of supervisory concern the institution poses to its regulators. Banks are assessed deposit insurance premiums based on the bank’s average consolidated total assets, and the FDIC may modify risk-based adjustments, which increase or decrease a bank’s overall assessment rate.

26

Table of Contents

Bank failures can significantly deplete the FDIC’s Deposit Insurance Fund and reduce the ratio of reserves to insured deposits. If increases in assessment rates are insufficient for the Deposit Insurance Fund to meet its funding requirements, further special assessments or increases in deposit insurance premiums may be required. We are generally unable to control the amount of premiums that we are required to pay for FDIC insurance. If there are additional bank or financial institution failures, we may be required to pay higher FDIC premiums. Any future additional assessments, increases or required prepayments in FDIC insurance premiums could reduce our profitability or otherwise negatively impact our operations.

Declines in assets under management could adversely affect our investment advisory business.

PWW, our investment advisory business, derives revenue primarily from investment advisory fees based on the market value of assets under management. Assets under management may decline for various reasons including declines in the market value of the assets due to price declines in the securities markets, redemptions and other withdrawals by clients, or termination of contracts in response to adverse market conditions or pursuit of other investment opportunities. If the assets under management decline, the related decrease in fees will negatively affect our results of operations.

We may not be able to attract and retain investment advisory clients.

Our investment advisory business faces strong competition from numerous well-established investment management and wealth advisory firms including commercial banks and trust companies, investment advisory firms, mutual fund companies, stock brokerage firms, and other financial companies. Many of our competitors have greater resources than we have. Our ability to attract and retain investment advisory clients depends upon our ability to compete with competitors’ investment products, level of investment performance, client services, and marketing and distribution capabilities. If we are not successful, our results of operations and financial condition may be negatively impacted.

The investment advisory industry is subject to extensive regulation, and any enforcement action or adverse regulatory changes could decrease our revenues and profitability.

As an investment advisor registered with the Securities and Exchange Commission, PWW is subject to regulation by a number of regulatory agencies. In the event of non-compliance with regulation, governmental regulators, including the SEC and the Financial Industry Regulatory Authority, may institute administrative or judicial proceedings that could result in censure, fines, civil penalties, cease-and-desist orders, deregistration or suspension, or other adverse consequences. The imposition of any such penalties or orders could have a material adverse effect on our operating results and financial condition. New or revised legislation or regulations could also impose additional costs that adversely impact our profitability.

Loss of PWW’s key employees could adversely affect our investment advisory business.

PWW’s success is highly dependent on its executive management team and other key personnel who make investment decisions for PWW clients and manage client relations. Although they are subject to non-compete agreements, there is no assurance that these key personnel will remain employees of PWW.

Competition for investment advisory personnel is intense, and we may not be successful in attracting or retaining qualified personnel. The loss of several key personnel could adversely affect our growth strategy and seriously harm our business, results of operations and financial condition.

‎

27

Table of Contents

REGULATORY AND LEGAL RISKS

We are subject to extensive regulation that could limit or restrict our activities and adversely affect our profitability.

As a bank holding company, we are primarily regulated by the Federal Reserve. The Bank is primarily regulated by the Virginia Bureau of Financial Institutions and the Federal Reserve. These regulatory authorities have extensive discretion in connection with their supervisory and enforcement activities, including the imposition of restrictions on the operation of a financial institution, the classification of assets and the adequacy of a financial institution’s allowance for credit losses. Any change in such regulation and regulatory oversight, whether in the form of regulatory policy, regulations or legislation, could have a material impact on us and our operations.

Because our business is highly regulated, the applicable laws, rules and regulations are subject to regular modification and change. Laws, rules and regulations may be adopted in the future that could make compliance more difficult or expensive or otherwise adversely affect our business, financial condition or prospects. Such changes may limit our growth and restrict certain of our activities, including payment of dividends, mergers and acquisitions, investments, loans and interest rates charged, interest rates paid on deposits and locations of offices. We are also subject to capital requirements by our regulators. Our compliance with regulatory requirements is costly, and the increased scope, complexity and cost of compliance affect our profitability more than some of our larger competitors.

The laws and regulations applicable to the banking industry could change at any time, and these changes may adversely affect our business and profitability.

Although many provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 have been fully integrated into our operations, ongoing regulatory interpretations, enforcement activities, or amendments to existing regulations may continue to impact our business, financial condition and profitability. While initial implementation costs have stabilized, any future changes in regulatory expectations, especially regarding capital requirements, consumer protection, stress-testing, cybersecurity and liquidity, could result in increased compliance costs, operational complexity and reduced flexibility in managing our business operations. We cannot predict the precise nature, extent or timing of any additional regulatory requirements, but such developments could materially affect our operations, increase operational expenses, reduce profitability, or restrict our ability to pursue strategic opportunities or pay dividends.

Consumer financial protection regulations could impact our compliance obligations and business practices.

We are subject to extensive federal and state consumer financial protection laws and regulations governing our lending and deposit activities, including fair lending, UDAAP, privacy and data security, and residential mortgage origination and servicing requirements, which are administered and enforced by multiple regulators, including the Consumer Financial Protection Bureau (“CFPB”) and the federal banking agencies. We originate residential mortgage loans subject to applicable mortgage-related requirements, including the Qualified Mortgage (“QM”) rules. Changes in applicable laws or regulations, supervisory expectations or interpretations, or enforcement priorities, or any failure or alleged failure by us or our third-party service providers to comply with these requirements, could increase compliance and operating costs, restrict or delay our ability to offer certain products or services, require remediation or other payments, and result in litigation, regulatory actions, penalties, or reputational harm, which could materially adversely affect our business, financial condition, and results of operations.

Regulatory capital requirements could adversely affect our operations and profitability.

Under current capital standards, in order to be well-capitalized, the Bank is required to have a common equity Tier 1 capital ratio of 6.5% and a Tier 1 capital ratio of 8.0%. The application of more stringent capital requirements could result in lower returns on invested capital, require the raising of additional capital and result in regulatory actions if we were unable to comply with such requirements. Furthermore, the imposition of liquidity requirements could result in our

28

Table of Contents

having to lengthen the term of our funding, restructure our business models or increase our holdings of liquid assets. Implementation of changes to asset risk weightings for risk-based capital calculations, items included or deducted in calculating regulatory capital or additional capital conservation buffers could result in management modifying its business strategy and could limit our ability to make distributions, including paying dividends or buying back shares.

Under the community bank leverage ratio framework, depository institutions and depository institution holding companies that have less than $10 billion in total consolidated assets and meet other qualifying criteria, including a leverage ratio of greater than 9 percent, are eligible to opt into the framework. Qualifying community banking organizations that elect to use the community bank leverage ratio framework and that maintain a leverage ratio of greater than 9 percent are considered to have satisfied the generally applicable risk-based and leverage capital requirements. The Bank has chosen not to opt into the community bank leverage ratio framework at this time.

RISKS RELATED TO OUR STOCK

Our ability to pay cash dividends is limited, and we may be unable to pay future dividends even if we desire to do so.

The Company is a legal entity separate and distinct from the Bank and PWW. The Company currently does not have any significant sources of revenue other than cash dividends paid to it by the Bank and PWW. Both the Company and the Bank are subject to laws and regulations that limit the payment of cash dividends, including requirements to maintain capital at or above regulatory minimums. As a bank that is a member of the Federal Reserve System, the Bank must obtain prior written approval for any cash dividend if the total of all dividends declared in any calendar year would exceed the total of its net profits for that year combined with its retained net profits for the preceding two years. PWW’s ability to pay dividends is likewise subject to certain limits imposed by state law.

Banking regulators have indicated that Virginia banking organizations should generally pay dividends only from net undivided profits and if the prospective rate of earnings retention appears consistent with the organization’s capital needs, asset quality and overall financial condition. In addition, the Federal Deposit Insurance Act prohibits insured depository institutions from making capital distributions, including the payment of dividends, if, after making such distribution, the institution would become undercapitalized. Moreover, the Federal Reserve is authorized to determine under certain circumstances relating to the financial condition of a bank that the payment of dividends would be an unsafe and unsound practice and to prohibit payment thereof. The Federal Reserve has indicated that banking organizations generally pay dividends only out of current operating earnings. The Bank may be prohibited under Virginia law from the payment of dividends if the Virginia Bureau of Financial Institutions determines that a limitation of dividends is in the public interest and is necessary to help ensure the Bank’s financial soundness.

In addition, the Bank’s ability to pay dividends will be limited if the Bank does not have the capital conservation buffer required by the capital rules, which may limit the Company’s ability to pay dividends to stockholders.

If the Bank is not permitted to pay cash dividends to the Company, it is unlikely that the Company would be able to pay cash dividends on our common stock. Moreover, holders of our common stock are entitled to receive dividends only when and if declared by our board of directors. Although we currently pay cash dividends on our common stock, we are not required to do so and our board of directors could reduce or eliminate the amount of our common stock dividends in the future.

A limited market exists for our common stock.

Our common stock commenced trading on The NASDAQ Capital Market on January 25, 2012, and trading volumes have been relatively low compared to larger financial services companies. The limited trading market for our common stock may cause fluctuations in the market value of our common stock to be exaggerated, leading to price volatility in excess of that which would occur in a more active trading market. Accordingly, holders of our common stock

29

Table of Contents

may have difficulty selling our common stock at prices they find acceptable or which accurately reflect the value of the Company.

Future offerings of debt or other securities may adversely affect the market price of our stock.

In the future, we may attempt to increase our capital resources or, if our or the Bank’s capital ratios fall below the required minimums, we or the Bank could be forced to raise additional capital by making additional offerings of debt or preferred equity securities, including medium-term notes, trust preferred securities, senior or subordinated notes and preferred stock. Upon liquidation, holders of any debt securities and shares of preferred stock and lenders with respect to other borrowings will receive distributions of our available assets prior to the holders of our common stock.

Our stockholders may experience dilution due to issuances of additional securities.

We may in the future issue additional shares of our common stock to raise cash for operations or to fund acquisitions, to provide equity-based incentives to our management and employees, to permit our stockholders to invest cash dividends and optional cash payments in shares of our common stock, or as consideration in acquisition transactions. Additional equity offerings and issuances of additional shares of our common stock may dilute the holdings of our existing stockholders or reduce the market price of our common stock, or both. Holders of our common stock are not entitled to preemptive rights or other protections against dilution.

Virginia law and the provisions of our articles of incorporation and bylaws could deter or prevent takeover attempts.

Our articles of incorporation and bylaws contain provisions that may discourage or delay uninvited attempts by third parties to gain control of us. These provisions include the division of our board of directors into classes with staggered terms, the ability of our board of directors to set the price, terms and rights of, and to issue, one or more series of our preferred stock, and the ability of our board of directors, in evaluating a proposed business combination or other fundamental change transaction, to consider the effect of the business combination on us and our stockholders, employees, customers and the communities we serve. Similarly, the Virginia Stock Corporation Act contains provisions designed to protect Virginia corporations and employees from the adverse effects of hostile corporate takeovers. These provisions reduce the possibility that a third party could effect a change in control without the support of our incumbent directors. These provisions may also strengthen the position of current management by restricting the ability of stockholders to change the composition of the board of directors, to affect its policies.

Item 1B.Unresolved Staff Comments

None.

Item 1C.Cybersecurity

As a publicly-traded financial institution, we are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations and reputation, including, but not limited to, cyber-attacks against us or our service providers focused on gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data or causing operational disruption. As described below, we have risk management and governance practices and processes designed to address these risks.

The Company has established an enterprise risk management framework that outlines the processes and procedures the Company uses to identify, assess, mitigate, and monitor the risks faced by the Company, including cybersecurity risk. Within the overarching enterprise risk management framework, we maintain an information security program (“ISP”) designed to preserve the confidentiality, integrity, and availability of information or data on our systems and those of our service providers, as documented in our information security policy. The ISP encompasses the Company’s cybersecurity policies and practices and procedures that we use to identify, assess, mitigate, and monitor

30

Table of Contents

cybersecurity risks. The ISP follows relevant industry frameworks and standards set by the relevant legal and regulatory authorities and has been updated to align with the NIST Cybersecurity Framework 2.0.

As part of the ISP, the Company has a Cybersecurity Incident Response Plan (“CIRP”) and Incident Response Team (“IRT”). The IRT includes members of executive and senior management and other employees, including representatives from audit, compliance, human resources, finance, credit, information technology, information security, and legal. The IRT manages how incidents are defined, identified, and classified and ensures that procedures are in place to properly escalate, report and respond to incidents, as they are defined in the policy. The CIRP covers incident preparation, detection, analysis, and declaration, as well as plan execution and process guides for specific scenarios. Post incident activity, which covers incident termination, metrics, lessons learned, evidence retention, and plan maintenance is also included.

The Company maintains ongoing cybersecurity awareness training programs for employees to help prevent social engineering, phishing attacks, and other cyber threats. Additionally, the Company maintains cybersecurity insurance coverage as part of its overall risk mitigation strategy.

The Board is responsible for the oversight of cybersecurity risk management. In 2022, we elevated the Enterprise Risk Committee to a “committee of the whole” of the Bank’s board of directors. At the second board meeting of each calendar quarter, a significant portion of the meeting is dedicated to enterprise risk management. At that board meeting, management presents the enterprise risk management matrix, including the portions related to cybersecurity, to the board. In addition, the board receives regular reports from management on our cybersecurity threat risk management and strategic processes on topics including information on any cybersecurity incidents (including any remedial actions), including, for example, results of our EDR and XDR programs.

At the management level, the Company has designated an information security officer (“ISO”). Our ISO is responsible for the overall administration and execution of the ISP and reports to our EVP-CFO. Our ISO has over twenty years of experience working in information security. The ISO monitors the security of, among other things, systems, applications, tools, databases, computers, websites, cloud infrastructure, vendor tools, and user access systems. The ISO also works with and oversees third-party vendors that provide us with information security services and products. The ISO performs an annual information security risk assessment, which, among other things, documents inherent risk levels and controls in place to manage those risks. The information security risk assessment is presented to the Board annually. The ISO has various professional certifications in relevant fields. The ISO is responsible for administering and executing the ISP and formulating a risk-based approach for evaluating and managing technology and cybersecurity threats.

Management determines and prioritizes appropriate risk responses for each identified enterprise risk. In doing so, executive and senior management work directly with our information technology team and our ISO. Management is accountable for our day-to-day risk management activities.

We strive to minimize the occurrence of cybersecurity incidents and the risks resulting from such incidents. However, when a cybersecurity incident does occur, the Company has in place an incident response program to guide our assessment of and response to the incident. The ISO coordinates the Company’s response to a cybersecurity incident, including investigating, recording and evaluating any potential, suspected or confirmed incidents involving non-public customer information or Company confidential information.

On a quarterly basis, the ISO reports to executive management and the Board information security risk issues, risk mitigation progress and developments, and information security enhancement initiatives. The ISO also reports the status of information security-related key risk indicators to executive management.

The Company employs third parties in certain aspects of its information security and cybersecurity risk management. For example, we engage third parties to assess the information security risks related to our ISP as well as information security products, services, and security infrastructure. We have adopted a Third-Party Relationship Risk Management Program to help us effectively assess, measure, monitor and control the risks associated with third party

31

Table of Contents

relationships, including those related to information security. The board and senior management are responsible for all vendor relationships. The ISO assesses and monitors information risks posed by third parties and any non-compliance with the controls created to address such risks. With respect to cybersecurity incidents affecting our third-party service providers, the ISO works with our service providers to understand and document any incidents, along with managing the impact to us and reporting such incidents to executive management, and, if applicable, the Board. We utilize endpoint detection and response (EDR) and extended detection and response (XDR) platforms which both align to the MITRE ATT&CK® knowledge base for threat modeling and methodologies. These assist us in detecting, investigating, and responding to actual and potential security incidents.

Additionally, the Company utilizes a third-party online brand protection service to identify, analyze, and facilitate the takedown of malicious mobile applications, social media accounts, and websites attempting to impersonate the Bank. While we cannot guarantee that all impersonation attempts will be successfully removed, this continuous monitoring service helps protect our customers and reputation from fraudulent actors.

Based on information known to us, we have not incurred material costs or losses related to cybersecurity incidents. However, like other financial institutions, we have experienced cybersecurity incidents and other technology-related events in the past that resulted in costs and/or operational impacts, and we may experience additional incidents in the future. However, the risk management and governance processes described above may not be sufficient to prevent cybersecurity incidents, and we could incur substantial costs and suffer other negative consequences from cybersecurity incidents. We can give no assurance that we have detected or protected against all cybersecurity threats or incidents. Please refer to “Emerging Technological Threats” included “Item 1A, Risk Factors” of this Annual Report on Form 10-K for additional information about material risks related to cybersecurity threats.

Item 2.Properties

Current Locations and Property

Depending on such factors as cost, availability, and location, we may either lease or purchase our operating facilities. The existing facilities that we have purchased typically have been former branches of other financial institutions. As of March 25, 2026 the Bank conducts its operations from 23 locations, of which we own 15 and lease 8. In addition, PWW operates from 1925 Atherholt Road, Lynchburg, Virginia, which it leases from the Bank.

The following table describes the location and general character of the Bank’s primary operating facilities:

Address Type of Facility Year Opened Owned/Leased

32

Table of Contents

501 VES RoadLynchburg, Virginia Limited-service branch 2010 Leased (3)

3562 Electric RoadRoanoke, Virginia Full-service branch with ATM 2017 Leased (6)

45 South Main StreetLexington, Virginia Full-service branch with ATM 2019 Owned

(1)The current term of the amended and restated lease expires in three years and the Bank has three five-year renewal options (subject to the terms and conditions outlined in the lease). The Bank leases this property from Jamesview Investment, LLC, which is wholly-owned by William C. Bryant III, a member of the Board of Directors of both Financial and the Bank.

33

Table of Contents

(2)Base lease expires March 31, 2028. We have one or more renewal options that we may exercise at our discretion subject to the terms and conditions outlined in the lease.

(3)Base lease expired May 31, 2025. The Bank currently leases the property on a month-to-month basis.

(4)Base lease expires April 30, 2030. We have one or more renewal options that we may exercise at our discretion subject to the terms and conditions outlined in the lease.

(5)Base lease expires October 31, 2026. We have one or more renewal options that we may exercise at our discretion subject to the terms and conditions outlined in the lease.

(6)Base lease expires January 31, 2027.

(7)Base lease expired February 28, 2021. The Bank currently leases on a month-to-month basis.

(8)Base lease expires February 28, 2029. We have one or more renewal options that we may exercise at our discretion subject to the terms and conditions outlined in the lease.

We believe that each of these operating facilities is maintained in good operating condition and is suitable for our operational needs.

Interest in Additional Properties

1925 Atherholt Road, Lynchburg, Virginia currently serves as the office for the Company’s wholly-owned subsidiary, PWW, which leases the space from the Bank on a month-to-month basis. The property is held for possible future branch expansion, although the Bank does not currently have a timeline for opening a branch at this location.

The Bank also owns two additional properties in its market area, one held for possible future expansion or sale and one under contract for sale, subject to due diligence and other customary closing conditions.

The opening of any additional branches is contingent upon receipt of applicable regulatory approvals.

Item 3.Legal Proceedings

There are no material pending legal proceedings to which the Company is a party or to which the property of the Company is subject.

Item 4.Mine Safety Disclosures

Not applicable.

PART II

Item 5.Market For Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities

Market Prices and Dividends

Since January 25, 2012, the Common Stock of Financial is listed and has been trading on the NASDAQ Capital Market LLC (NASDAQ) under the symbol “BOTJ.” Prior to this time, the Common Stock of Financial was quoted on the Over the Counter Bulletin Board (OTCBB) under the symbol “BOJF” (“BOJF.OB” on some systems) and transactions generally involved a small number of shares.

34

Table of Contents

As of March 25, 2026, there were approximately 4,543,338 shares of Common Stock outstanding, which shares are held by approximately 1,700 active shareholders of record.

Dividend Policy

The Company’s future dividend policy is subject to the discretion of its Board of Directors and will depend upon a number of factors, including future earnings, financial condition, liquidity and capital requirements of both the Company and the Bank, applicable governmental regulations and policies and other factors deemed relevant by its Board of Directors.

The Company is organized under the Virginia Stock Corporation Act, which prohibits the payment of a dividend if, after giving it effect, the corporation would not be able to pay its debts as they become due in the normal course of business or if the corporation’s total assets would be less than the sum of its total liabilities plus the amount that would be needed, if the corporation were to be dissolved, to satisfy the preferential rights upon dissolution of any preferred shareholders.

The Company is a legal entity separate and distinct from its subsidiaries. Its ability to distribute cash dividends will depend primarily on the ability of the Bank and PWW to pay dividends to it, and the Bank is subject to laws and regulations that limit the amount of dividends that it can pay. As a state member bank, the Bank is subject to certain restrictions imposed by the reserve and capital requirements of federal and Virginia banking statutes and regulations. For a discussion of these restrictions, see “Supervision and Regulation of Financial – Limits on the Payment of Dividends” in Item 1 of this Report on Form 10-K. PWW’s ability to pay dividends is subject to certain limits imposed by state law.

On January 27, 2026, Financial declared a cash dividend for the fourth quarter of 2025 of $0.11 per common share. The dividend was paid on March 6, 2026, to shareholders of record at the close of business on February 17, 2026. Financial will evaluate the factors set forth above in determining whether to continue paying cash dividends in 2026.

Financial does not have an active stock repurchase plan. During the quarter ended December 31, 2025, Financial repurchased no shares of common stock.

Item 6.[Reserved]

Item 7.Management’s Discussion and Analysis of Financial Condition and Results of Operations

The following discussion is intended to assist readers in understanding and evaluating our financial condition and results of operations. You should read this discussion in conjunction with our financial statements and accompanying notes included elsewhere in this report. Bank of the James Financial Group, Inc. (“Financial”) has no material operations and conducts no business other than the ownership of its operating subsidiaries, Bank of the James (and its divisions and subsidiary), and Pettyjohn, Wood & White, Inc., which was acquired on December 31, 2021. However, for ease of reading and because our financial statements are presented on a consolidated basis, references to “we,” “us,” or “our” refer to Financial, Bank of the James, and their divisions and subsidiaries as appropriate.

Cautionary Statement Regarding Forward-Looking Statements

This report contains statements that constitute “forward-looking statements” within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended, and the Private Securities Litigation Reform Act of 1995. Statements made in this document and in any documents that are incorporated by reference which are not purely historical are forward-looking statements, including any statements regarding descriptions of management’s plans, objectives, or goals for future operations, products or services, and forecasts of its revenues, earnings, or other measures of performance. Forward-looking statements are based on current management expectations and, by their nature, are subject to risks and uncertainties. These statements generally may be

35

Table of Contents

identified by the use of words such as “believe,” “expect,” “anticipate,” “plan,” “estimate,” “should,” “will,” “intend,” or similar expressions. Shareholders should note that many factors, some of which are discussed elsewhere in this document, could affect the future financial results of Financial and could cause those results to differ materially from those expressed in forward-looking statements contained in this document. These factors, many of which are beyond Financial’s control, include, but are not necessarily limited to the following:

the effects of widespread health emergencies or public health crises on the business, customers, employees and third-party service providers of Financial or any of its acquisition targets;

problems with technology utilized by us;

potential exposure to fraud, negligence, computer theft and cyber-crime, and the Company’s ability to maintain the security of its data processing and information technology systems;

operating, legal and regulatory risks, including the effects of legislative or regulatory developments affecting the financial industry generally or Financial specifically;

government legislation and policies, including the impact of the Dodd-Frank Wall Street Reform and Consumer Protection Act and its related regulations;

economic, market, political and competitive forces affecting Financial’s banking and other businesses;

competition for our customers from other providers of financial services;

reliance on our management team, including our ability to attract and retain key personnel;

changes in interest rates, monetary policy and general economic conditions, which may impact Financial’s net interest income;

changes in the value of real estate securing loans made by the Bank;

adoption of new accounting standards or changes in existing standards;

compliance or operational risks related to new products, services, ventures, or lines of business, if any, that Financial may pursue or implement;

the risk that Financial’s analysis of these risks and forces could be incorrect and/or that the strategies developed to address them could be unsuccessful;

the stability of the overall banking industry in the United States;

liquidity and perceived liquidity in the banking industry in the United States;

geopolitical conflicts, international tensions, and related economic sanctions, which may have a destabilizing effect on financial markets and economic activity; and

other risks and uncertainties set forth in this Annual Report on Form 10-K and, from time to time, in our other filings with the Securities and Exchanges Commission (“SEC”).

Other risks, uncertainties and factors could cause our actual results to differ materially from those projected in any forward-looking statements we make.

These factors should be considered in evaluating the forward-looking statements, and you should not place undue reliance on such statements. Financial specifically disclaims any obligation to update factors or to publicly announce the results of revisions to any of the forward-looking statements or comments included herein to reflect future events or developments.

Overview

Financial is a bank holding company headquartered in Lynchburg, Virginia. Our primary business is retail banking which we conduct through our wholly-owned subsidiary, Bank of the James (which we refer to as the “Bank”). We conduct four other business activities: mortgage banking through the Bank’s Mortgage Division (which we refer to as “Mortgage”), investment services through the Bank’s Investment division (which we refer to as “Investment Division”), certain insurance activities through BOTJ Insurance, Inc., a subsidiary of the Bank, (which we refer to as “Insurance”), and investment advisory services through the Company’s wholly-owned subsidiary, Pettyjohn, Wood & White, Inc. (which we refer to as “PWW”).

36

Table of Contents

Although we intend to increase other sources of revenue, our operating results depend primarily upon the Bank’s net interest income, which is determined by the difference between (i) interest and dividend income on earning assets, which consist primarily of loans, investment securities and other investments, and (ii) interest expense on interest-bearing liabilities, which consist principally of deposits and other borrowings. The Bank’s net income also is affected by its provision for credit losses, as well as the level of its noninterest income, including deposit fees and service charges, gains on sales of mortgage loans, and its noninterest expenses, including salaries and employee benefits, occupancy expense, data processing expenses, miscellaneous other expenses, franchise taxes, and income taxes. We expect PWW to continue enhancing our operating results through investment advisory fee income.

As discussed in more detail below,

For the year ended December 31, 2025, Financial had net income of $9,022,000, an increase of $1,078,000 from net income of $7,944,000 for the year ended December 31, 2024.

For the year ended December 31, 2025, earnings per basic and diluted common share were $1.99, as compared to earnings of $1.75 per basic and diluted common share for the year ended December 31, 2024.

Net interest income increased to $32,807,000 for the current year from $29,236,000 for the year ended December 31, 2024.

Noninterest income increased to $15,852,000 for the year ended December 31, 2025, from $15,137,000 for the year ended December 31, 2024.

Total assets as of December 31, 2025, were $1,039,024,000 compared to $979,244,000 at the end of 2024, an increase of $59,780,000 or 6.10%.

Net loans (excluding loans held for sale), net of unearned income and the allowance for credit losses, increased to $661,357,000 as of December 31, 2025 from $636,552,000 as of December 31, 2024.

The net interest margin increased by 28 basis points to 3.39% for 2025, compared to 3.11% for 2024. The following table sets forth select financial ratios:

For the Year Ended

December 31,

Return on average assets 0.88% 0.80%

Average equity to total average assets 6.97% 6.28%

Effect of Economic Trends

A variety and wide scope of economic factors affect Financial’s success and earnings. Although interest rate trends are one of the most important of these factors, Financial believes that interest rates cannot be predicted with a reasonable level of confidence and therefore does not attempt to do so with complicated economic models. Rather than focusing on any single interest rate scenario, Financial prepares for multiple outcomes, including unexpected ones, in order to safeguard its margins against wide swings in interest rates.

Following the COVID-19 pandemic, the Federal Reserve maintained the target range for federal funds (“fed funds”) at 0% to 0.25% through early 2022. However, in response to elevated inflation and supply chain disruptions exacerbated by geopolitical tensions, the FOMC began an aggressive rate-hiking cycle in March 2022. Through a series of increases throughout 2022 and into 2023, including multiple 75 basis point increases, the FOMC raised the target rate from near zero to a peak range of 5.25% to 5.50% by July 2023 - the highest level in over two decades.

The FOMC maintained this restrictive monetary policy stance throughout the second half of 2023 and the first half of 2024, as inflation gradually moderated toward the Federal Reserve’s 2.0% target. In September 2024, with

37

Table of Contents

inflation showing sustained progress and labor market conditions normalizing, the FOMC initiated a rate-cutting cycle with a 50 basis point reduction, followed by additional 25 basis point cuts in November and December 2024, bringing the target range to 4.25% to 4.50% by year-end 2024.

During 2025, the FOMC continued its gradual easing cycle with three 25 basis point rate cuts at its September, October, and December meetings, bringing the target rate to a range of 3.50% to 3.75% as of December 31, 2025. These cuts totaled 75 basis points and brought the cumulative rate reduction since the peak in July 2023 to 175 basis points. At its January 2026 meeting, the FOMC voted to hold rates steady at 3.50% to 3.75%, pausing after three consecutive cuts to assess incoming economic data. As of mid-March 2026, the target rate remains at 3.50% to 3.75%.

The FOMC has indicated that further rate adjustments will depend on incoming economic data, particularly inflation metrics, labor market conditions, and overall economic growth. The Federal Reserve has emphasized its commitment to achieving maximum employment and returning inflation sustainably to its 2.0% target. The December 2025 Summary of Economic Projections indicated significant division among FOMC participants, with the median projection showing only one additional 25 basis point cut in 2026 and another in 2027, reflecting the Committee’s view that the fed funds rate is now approaching neutral levels.

Critical Accounting Policies

The Company’s financial statements are prepared in accordance with accounting principles generally accepted in the United States (GAAP). The financial information contained within our statements is, to a significant extent, based on measures of the financial effects of transactions and events that have already occurred. A variety of factors could affect the ultimate value obtained when earning income, recognizing an expense, recovering an asset, or relieving a liability. The following critical accounting policies involve significant management judgment and have a material impact on our financial statements.

The allowance for credit losses (“ACL”) on loans represents management’s best estimate of lifetime expected losses in the loan portfolio as of the reporting date. The ACL is initially recognized upon origination or acquisition of loans and reflects management’s ongoing evaluation based on current conditions, past events, and reasonable and supportable forecasts of future economic conditions, including anticipated prepayments. The allowance is reduced by charge-offs, net of recoveries of previous losses, and is increased or decreased by a provision for (or recovery of) credit losses, which is recorded in the Consolidated Statements of Income.

The Company utilizes a discounted cash flow model to estimate its current expected credit losses. For purposes of calculating quantitative reserves, the Company has segmented its loan portfolio based on loans that share similar risk characteristics. Within the quantitative portion of the calculation, the Company utilizes at least one or more loss drivers, which may include unemployment rates and/or gross domestic product (“GDP”), to adjust its loss rates over a reasonable and supportable forecast period of one year. A straight-line reversion technique is used for the following four quarters, at which time the Company reverts to historical averages. To further adjust the allowance for credit losses for expected losses not already included within the quantitative component of the calculation, the Company may consider qualitative factors, including but not limited to: variability in the economic forecast, changes in volume and severity of adversely classified loans, changes in concentrations of credit, changes in the nature and volume of the loan segments, factors related to credit administration, and other idiosyncratic risks not embedded in the data used in the model. Additional analysis and detailed information on the ACL and loan portfolio quality can be found in “Management’s Discussion and Analysis – Analysis of Financial Condition – Asset Quality.”

Goodwill resulting from business combinations represents the excess of consideration transferred over the fair value of net identifiable assets acquired and is assigned to the applicable reporting unit. Goodwill is tested for impairment annually as of September 1, or more frequently if events or changes in circumstances indicate that it may be impaired. The impairment evaluation begins with a qualitative assessment to determine whether it is more likely than not that the fair value of a reporting unit is less than its carrying amount. If necessary, a quantitative test is performed by comparing the

38

Table of Contents

reporting unit’s carrying amount to its estimated fair value. Fair value is determined using discounted cash flow analyses, market-based approaches, or a combination of valuation methodologies, as appropriate. An impairment charge is recognized for the amount by which the carrying value exceeds fair value. Determining fair value requires significant management judgment, including assumptions related to projected future cash flows, discount rates, growth rates, and prevailing market conditions.

RESULTS OF OPERATIONS

Year Ended December 31, 2025 compared to year ended December 31, 2024

Net Income

The net income for Financial for the year ended December 31, 2025, was $9,022,000 or $1.99 per basic and diluted share compared with net income of $7,944,000 or $1.75 per basic and diluted share for the year ended December 31, 2024. Note 13 of the consolidated financial statements provides additional information with respect to the calculation of Financial’s earnings per share.