BOTJ · Read the filing

botj-20241231x10k

Table of Contents

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

For the fiscal year ended December 31, 2024 or

For the transition period from __________ to __________

______________________

BANK OF THE JAMES FINANCIAL GROUP, INC.

(Exact Name of Registrant as Specified in Its Charter)

Commission file number 001-35402

(434) 846-2000

(Issuer’s telephone number, including area code)

Securities registered under Section 12(b) of the Exchange Act:

Title of Each Class Trading Symbol(s) Name of Exchange on Which Registered

Common Stock, $2.14 par value BOTJ The NASDAQ Capital Markets

Securities registered under Section 12(g) of the Exchange Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.

 Yes þNo

Indicate by check mark if the registrant is not required to file reports pursuant to Section13 or Section 15(d) of the Act.  Yes þNo

Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Exchange Act during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.Yesþ No 

Indicate by check mark whether the registrant has submitted every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files).þYes  No

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or emerging growth company. See definition of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer ☐ Accelerated filer ☐

Non-accelerated filer ☒ Smaller reporting company ☒

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Table of Contents

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☐

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to § 240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined by Rule 12b-2 of the Exchange Act). ̈Yes þNo

The aggregate value of the voting common equity held by nonaffiliates as of June 28, 2024, the last business day of the registrant’s most recently completed second fiscal quarter, was approximately $43,312,040 based on the price at which the common stock last traded on such day. This price reflects inter-dealer prices without retail mark up, mark down, or commissions, and may not represent actual transactions.

The number of shares outstanding of Common Stock, $2.14 par value as of March 26, 2025 was approximately 4,543,338.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the 2025 Proxy Statement to be used in conjunction with the Annual Meeting of Shareholders, scheduled to be held on May 20, 2025, are incorporated by reference into Part III of this Form 10-K

Table of Contents

PART I 4

Item 1. Business 4

Item 1A. Risk Factors 17

Item 1B. Unresolved Staff Comments 31

Item 1.C. Cybersecurity 31

Item 2. Properties 33

Item 3. Legal Proceedings 35

Item 4. Mine Safety Disclosures 36

Item 6. [Reserved] 37

Item 7A. Quantitative and Qualitative Disclosure About Market Risk 65

Item 8. Financial Statements and Supplementary Data 65

Item 9A. Controls and Procedures 130

Item 9B. Other Information 131

Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections 131

Item 10. Directors, Executive Officers and Corporate Governance 131

Item 11. Executive Compensation 131

Item 14. Principal Accountant Fees and Services 132

Item 15. Exhibits, Financial Statement Schedules 132

Table of Contents

PART I

Item 1.Business

General

Bank of the James Financial Group, Inc. (“Financial” or the “Company”) is a bank holding company with its headquarters in Lynchburg, Virginia. Financial was incorporated at the direction of Bank of the James (the “Bank” or “Bank of the James”) on October 3, 2003 to serve as a bank holding company of the Bank. Financial acquired all of the shares of the Bank in a statutory share exchange on a one-for-one basis on January 1, 2004.

The Bank is a Virginia banking corporation headquartered in Lynchburg, Virginia. The Bank was incorporated under the laws of the Commonwealth of Virginia as a state-chartered bank in 1998 and began banking operations in July 1999. The Bank was organized to engage in general retail and commercial banking business.

The Bank’s principal office is located at 828 Main Street, Lynchburg, Virginia 24504 and its telephone number is (434) 846-2000. The Bank also maintains a website at www.bankofthejames.bank.

Financial conducts three principal activities: (1) general retail and commercial banking through Bank of the James; (2) mortgage brokerage services through Bank of the James Mortgage, a division of the Bank (the “Mortgage Division”); and (3) investment advisory (sometimes referred to as wealth management) services through its wholly-owned subsidiary, Pettyjohn, Wood & White, Inc. (“PWW”).

In addition, Financial provides securities brokerage and other investment services through BOTJ Investment, a division of the Bank, and acts as an agent for insurance and annuity products through BOTJ Insurance, Inc., a wholly-owned subsidiary of the Bank. The operating results of these activities have not materially impacted our financial performance and are not considered principal activities of Financial.

The Bank, BOTJ Insurance, BOTJ Investment Group, Inc., a non-operating subsidiary, and PWW are our only subsidiaries and primary assets.

Products and Services

Retail and Commercial Banking

The Bank currently conducts business within Virginia from 19 full-service offices, two limited service offices, and two residential mortgage loan production office. The location of and services provided by each of our facilities is described in “Item 2. Properties” in this Form 10-K. The Bank established a mortgage loan origination division that conducts business under the name “Bank of the James Mortgage, a Division of Bank of the James” (the “Mortgage Division”). The Mortgage Division conducts business primarily from the division’s main office located in the Forest branch of the Bank and has opened several satellite offices throughout our market area.

In addition, the Bank expanded into Charlottesville in 2013 (opening a full-service branch in 2015), Harrisonburg in 2014 (opening a full-service branch in 2015), Appomattox in 2016 (opening a permanent full-service branch in 2017), Roanoke in 2013 (opening a permanent full-service branch in 2017), Blacksburg in 2018 (opening a mortgage origination office), Lexington in 2019 with a full-service branch, Rustburg in 2019 with a full-service branch, Buchanan in 2024 with a full-service branch, and Nellysford in 2024 (operating a temporary branch that we will replace with a full-service branch in the third quarter 2025). Our recent geographic expansions into surrounding markets such as Charlottesville, Roanoke, and Harrisonburg reflect our strategic initiative to diversify our geographic concentration, enhance growth opportunities, and mitigate economic risk inherent in our primary market.

Table of Contents

Deposit Services. Deposits are a major source of our funding. The Bank offers a full range of deposit services that are typically available in most banks and other financial institutions including checking accounts, savings accounts and other time deposits of various types, ranging from daily money market accounts to longer-term certificates of deposit. The transaction accounts and time certificates are tailored to our market areas and offered at rates competitive with other financial institutions in those areas. In addition, the Bank offers its customers Individual Retirement Accounts (IRAs) and Health Care Savings Accounts (HSAs). All deposit accounts are insured by the Federal Deposit Insurance Corporation (the “FDIC”) up to the maximum amount allowed by law (generally, $250,000 per depositor, subject to aggregation rules). The Bank solicits such accounts from individuals, businesses, associations and organizations, and governmental authorities.

Lending Services. The Bank offers a full range of short- to medium-term commercial and consumer loans. Our primary focus is on making loans to small and medium-sized businesses and consumers in the Region 2000 area—which includes Lynchburg, Amherst, Bedford, and Campbell—as well as in Charlottesville, Harrisonburg, Roanoke, Appomattox, Lexington, Blacksburg, Nellysford, and Buchanan. In addition, we also provide a wide range of real estate finance services. Commercial loans include both secured and unsecured loans for working capital (including inventory and receivables), business expansion (including acquisition of real estate and improvements), and purchase of equipment and machinery. Consumer loans include secured and unsecured loans for financing automobiles, home improvements, education and personal investments. Additionally, the Bank originates fixed and floating-rate mortgage loans and real estate construction and acquisition loans. Where appropriate, the Bank attempts to limit interest rate risk through the use of variable interest rates and terms of less than five years.

In general, the Bank offers the following lending services in our market areas:

Commercial Business Lending. We make loans to small- and medium-sized businesses for purposes such as purchases of equipment, facilities upgrades, inventory acquisition and various working capital purposes.

Real Estate Construction. We make commercial and residential construction and development loans.

Commercial Real Estate Mortgage. We make loans to borrowers secured by commercial real estate. In underwriting these types of loans we consider the historic and projected future cash flows of the real estate.

Residential Mortgage. We originate conforming and non-conforming closed-end residential mortgages. These loans are secured by liens on 1 to 4 family properties. We typically sell the conventional mortgage loans to correspondent financial institutions.

Consumer. We offer various types of secured and unsecured consumer loans, including personal loans, lines of credit, overdraft lines of credit, automobile loans, installment loans, demand loans, and home equity loans. We make consumer loans primarily for personal, family or household purposes.

We sell loan participations when a loan we originated exceeds our legal lending limit or when we choose to share risk with another bank. We also purchase loan participations from time to time from other banks in the ordinary course of business. Our loan participations are without recourse against the originating bank. Purchased loan participations are underwritten in accordance with our loan policy and represent a source of loan growth.

Other Banking Services. Other services offered by the Bank include safe deposit boxes, traveler’s checks, direct deposit of payroll and social security checks, automatic drafts for various accounts, treasury management services and credit card merchant services. The Bank also is associated with a shared network of automated teller machines (ATMs) that may be used by Bank customers throughout Virginia, the United States, and internationally.

The Bank intends to introduce new products and services desired by the public and as permitted by the regulatory authorities. The Bank remains committed to leveraging new technologies to meet evolving customer needs. The Bank provides its customers with access to the latest technological products, such as telephone banking and internet banking, including online bill pay. This service allows customers to handle routine transactions using a standard touch tone telephone or cell phone, applications for mobile devices, and via the internet at the Bank’s website.

Table of Contents

Mortgage Banking. The Bank, through the Mortgage Division, originates conforming and non-conforming home mortgages primarily in the Region 2000 area. Since 2013, we have operated the Mortgage Division using hybrid correspondent relationships that allow the Bank to close loans in its name before an investor purchases the loan. By using the Bank’s funds to close the loan (as compared to a broker relationship in which loans are funded by the purchaser of the mortgage), the Bank is able to obtain better pricing due to the slight increase in risk. Management believes that there is acceptable risk associated with this arrangement.

Investment Advisory Services. We provide investment advisory services through Financial’s wholly-owned subsidiary, Pettyjohn, Wood & White, Inc. (“PWW”), a Lynchburg, Virginia-based investment advisor registered with the Securities and Exchange Commission. Financial purchased the issued and outstanding shares of PWW on December 31, 2021. PWW generates revenue primarily through investment advisory fees.

Other Activities

We provide brokerage and investment services through the Bank’s Investment division (“Investment Division”). The Investment Division provides securities brokerage services to Bank customers and others through an agreement with Osaic Institutions, Inc. (“Osaic”), a registered broker-dealer. Under our agreement, Osaic operates a service center at the main office located at 828 Main Street, Lynchburg, Virginia. To date the operating results of the Investment Division have not materially impacted our financial performance.

We provide insurance and annuity products through BOTJ Insurance as an agent for national insurance companies. As of the date hereof, we offer the following insurance products: life insurance, fixed annuities, and disability insurance. We began providing these services in September 2008. To date, the operating results of BOTJ Insurance have not materially impacted our financial performance.

Employees

As of March 5, 2025, we had approximately 175 employees, 162 of which are full-time and 13 of which are part-time. None of our employees are represented by any collective bargaining agreements, and relations with employees are considered excellent. We maintain employee benefit programs that include health insurance, a health savings account, a 401(k) plan, and an employee stock purchase plan.

Location and Market Area

The Bank’s market area primarily consists of Region 2000, which encompasses the seven jurisdictions of the Town of Altavista, Amherst County, Appomattox County, the Town of Bedford, Bedford County, Campbell County, and the City of Lynchburg. Region 2000 supports a diverse, well-rounded economy. U.S. Routes 29, 60, 221, 460 and 501 and State Routes 24 and 40 all pass through our market area and provide efficient access to other regions of the state. Regional airport and rail service provide additional transportation channels.

Total population in the market area equals approximately 267,000. According to publicly available information, the current populations of the localities in the Region 2000 market area were approximately as follows: City of Lynchburg – 82,000; Amherst County – 32,000; Appomattox County – 15,000; Bedford County (including the Town of Bedford) – 79,000; Campbell County (including the Town of Altavista) – 55,000. The area is serviced by one daily newspaper and a number of radio and television stations providing diverse media outlets. Median family income in Region 2000 has risen over the past ten years.

Region 2000 has a broad range of services, light industry, and manufacturing plants. Principal service, industrial, research and development employers include: BWX Technologies, Inc. (nuclear fuel); Framatome (nuclear services); Centra Health, Inc. (health care services); Southern Air, Inc. (mechanical and HVAC contractors); Shentel (telecommunications services); Frito-Lay, Inc. (snack foods); U.S. Pipe (ductile iron pipe); as well as six colleges and universities including Randolph College, Sweet Briar College, Liberty University, and the University of Lynchburg.

Table of Contents

Our recent expansion has taken us north into Charlottesville (north of Region 2000), west into Roanoke, and northwest into Harrisonburg, Lexington, Buchanan, and Nellysford. We have also grown east into Appomattox, southwest into Blacksburg, and south into Rustburg. Even with this expansion outside of Region 2000, the Bank continues to consider its primary market to be Region 2000.

SUPERVISION AND REGULATION OF THE COMPANY

General

Financial, as a bank holding company, and the Bank, as a state-chartered bank, are subject to extensive federal and state laws and regulations. These laws and regulations impose specific requirements or restrictions on and provide for general regulatory oversight of virtually all aspects of our operations. The following briefly summarizes the more significant provisions of applicable federal and state laws, certain regulations and the potential impact of such provisions on Financial and the Bank. These laws and regulations are generally intended to protect depositors, not shareholders. The following summary is qualified by reference to the statutory and regulatory provisions discussed. No assurance can be given that these statutes or regulations will not change.

Changes in applicable laws or regulations may have a material effect on our business and prospects. Our operations may be affected by legislative changes and the policies of various regulatory authorities. We cannot predict the effect that fiscal or monetary policies, economic control, or new federal or state legislation may have on our business and earnings in the future.

Regulation of Financial

General. Financial is subject to the periodic reporting requirements of the Securities and Exchange Act of 1934, as amended (the “Exchange Act”), including the filing with the Securities and Exchange Commission (the “SEC”) of annual, quarterly and other reports on the financial condition and performance of the organization. Financial is directly affected by the corporate responsibility and accounting reform legislation signed into law on July 30, 2002, known as the Sarbanes-Oxley Act of 2002 (the “SOx Act”), and the related rules and regulations. The SOx Act includes provisions that, among other things, require that periodic reports containing financial statements that are filed with the SEC be accompanied by chief executive officer and chief financial officer certifications as to the accuracy and compliance with law, additional disclosure requirements and corporate governance and other related rules. Although we are not required to receive an opinion from our external auditors regarding our internal controls over financial reporting under section 404 of the SOx Act because of our status as a smaller reporting company, our management’s report on internal control over financial reporting is set forth in Item 9A herein. Financial has expended considerable time and money in complying with the SOx Act and expects to continue to incur additional expenses in the future.

Bank Holding Company Act. As a bank holding company registered under the Bank Holding Company Act of 1956 (the “BHCA”), Financial is subject to regulation and examination by the Board of Governors of the Federal Reserve System (the “Federal Reserve Board”). Financial is required to file with the Federal Reserve Board an annual report and such other additional information as the Federal Reserve Board may require pursuant to the BHCA.

The Federal Reserve Board requires a bank holding company to act as a source of financial and managerial strength and to take measures to preserve and protect its bank subsidiaries. Financial would be compelled by the Federal Reserve Board to invest additional capital in the event the Bank experiences either significant credit losses or rapid growth of loans or deposits.

The Federal Reserve Board has jurisdiction under the BHCA to approve any bank or non-bank acquisition, merger or consolidation proposed by a bank holding company. The BHCA, and other applicable laws and regulations, generally limit the activities of a bank holding company and its subsidiaries to that of banking, managing or controlling banks, or any other activity that is so closely related to banking or to managing or controlling banks as to be a proper incident thereto.

Table of Contents

Pursuant to the BHCA, the FRB has the power to order any bank holding company or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the FRB has reasonable grounds to believe that continuation of such activity or ownership constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company.

The FRB also has the authority to examine the Company and its subsidiaries, as well as any arrangements between the Company and its subsidiaries, with the cost of any such examinations to be borne by the Company. Banking subsidiaries of bank holding companies are also subject to certain restrictions imposed by federal law in dealings with their holding companies and other affiliates.

Gramm-Leach-Bliley Act of 1999. The Gramm-Leach-Bliley Act (the “GLB Act”) which was effective March 11, 2000, permits bank holding companies to become financial holding companies and thereby affiliate with securities firms and insurance companies and engage in other activities that are financial in nature. A bank holding company may become a financial holding company by filing a declaration that the bank holding company wishes to become a financial holding company if each of its subsidiary banks (i) is well-capitalized under regulatory prompt corrective action provisions, (ii) is well managed, and (iii) has at least a satisfactory rating under the Community Reinvestment Act (“CRA”). No regulatory approval will be required for a financial holding company to acquire a company, other than a bank or savings association, engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the Federal Reserve Board.

The GLB Act defines “financial in nature” to include securities underwriting, dealing and market making; sponsoring mutual funds and investment companies; insurance underwriting and agency; merchant banking activities; and activities that the Board has determined to be closely related to banking. Subsidiary banks of a financial holding company must continue to be well-capitalized and well-managed in order to continue to engage in activities that are financial in nature without regulatory actions or restrictions, which could include divestiture of the financial in nature subsidiary or subsidiaries. In addition, a financial holding company or a bank may not acquire a company that is engaged in activities that are financial in nature unless each of the subsidiary banks of the financial holding company or the bank has a CRA rating of satisfactory or better.

As discussed in more detail below under “Confidentiality and Required Disclosure of Consumer Information,” the GLB Act also imposes customer privacy requirements on financial institutions.

The cumulative effect of the GLB Act and other recent bank legislation has caused us to strengthen our staff to handle the procedures required by this additional regulation. The increased staff and operational costs have impacted our profitability. Although the above laws may have a significant impact on the banking industry by promoting, among other things, competition, it is not possible for the management of the Bank to determine, with any degree of certainty, the impact of such laws on the Bank.

Limits on the Payment of Dividends. Financial is a legal entity, separate and distinct from the Bank. Financial currently does not have any significant sources of revenue other than cash dividends paid to it by the Bank and PWW. Both Financial and the Bank are subject to laws and regulations that limit the payment of cash dividends, including requirements to maintain capital at or above regulatory minimums. As a bank that is a member of the Federal Reserve System (“state member bank”), the Bank must obtain prior written approval for any cash dividend if the total of all dividends declared in any calendar year would exceed the total of its net profits for that year combined with its retained net profits for the preceding two years.

Table of Contents

authorized to determine under certain circumstances relating to the financial condition of a bank that the payment of dividends would be an unsafe and unsound practice and to prohibit payment thereof. The payment of dividends that deplete a bank’s capital base could be deemed to constitute such an unsafe and unsound banking practice. The Federal Reserve has indicated that banking organizations generally pay dividends only out of current operating earnings. In addition, under Virginia law, no dividend may be declared or paid out of a Virginia bank’s paid-in capital. The Bank may be prohibited under Virginia law from the payment of dividends if the Virginia Bureau of Financial Institutions determines that a limitation of dividends is in the public interest and is necessary to ensure the Bank’s financial soundness, and may also permit the payment of dividends not otherwise allowed by Virginia law.

The Dodd-Frank Act

On July 21, 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Reform Act”) was signed into law. The Dodd-Frank Reform Act represents a significant overhaul of many aspects of the regulation of the financial services industry, although many of its provisions (e.g., the interchange and trust preferred capital limitations) apply to companies that are significantly larger than Financial. The Dodd-Frank Reform Act directs applicable regulatory authorities to promulgate regulations implementing its provisions, and its effect on Financial and on the financial services industry as a whole will be clarified as those regulations are issued. Major elements of the Dodd-Frank Reform Act include:

The Dodd-Frank Reform Act changed the assessment base for federal deposit insurance from the amount of insured deposits to consolidated assets less tangible capital, eliminated the ceiling on the size of the Deposit Insurance Fund (DIF) and increased the floor applicable to the size of the DIF. The Dodd-Frank Act also made permanent the $250,000 limit for federal deposit insurance and increased the cash limit of Securities Investor Protection Corporation protection from $100,000 to $250,000.

The Dodd-Frank Reform Act repealed the federal prohibitions on the payment of interest on demand deposits, thereby permitting depository institutions to pay interest on business transaction and other accounts.

The Dodd-Frank Reform Act required new disclosure relating to executive compensation and corporate governance.

The Dodd-Frank Reform Act implemented amendments to the Truth in Lending Act aimed at improving consumer protections with respect to mortgage originations, including originator compensation, minimum repayment standards, and prepayment considerations.

The Dodd-Frank Reform Act established the Financial Stability Oversight Council, which will be responsible for identifying and monitoring systemic risks posed by financial firms, activities, and practices.

The Dodd-Frank Reform Act amended the Electronic Fund Transfer Act (EFTA) to, among other things, require that debit card interchange fees must be reasonable and proportional to the actual cost incurred by the issuer with respect to the transaction. In June 2011, the Federal Reserve Board adopted regulations setting the maximum permissible interchange fee as the sum of 21 cents per transaction and 5 basis points multiplied by the value of the transaction, with an additional adjustment of up to one cent per transaction if the issuer implements additional fraud-prevention standards. Although issuers that have assets of less than $10 billion are exempt from the Federal Reserve Board’s regulations that set maximum interchange fees, these regulations are expected to significantly affect the interchange fees that financial institutions with less than $10 billion in assets are able to collect.

The Dodd-Frank Reform Act eliminated (over time) the inclusion of trust preferred securities as a permitted element of Tier 1 capital.

The Dodd-Frank Reform Act created a special regime to allow for the orderly liquidation of systemically important financial companies, including the establishment of an orderly liquidation fund.

The Dodd-Frank Reform Act requires the development of regulations to address derivatives markets, including clearing and exchange trading requirements and a framework for regulating derivatives-market participants.

Table of Contents

The Dodd-Frank Reform Act enhanced supervision of credit rating agencies through the Office of Credit Ratings within the SEC.

The Dodd-Frank Reform Act established the Consumer Financial Protection Bureau, within the Federal Reserve, to serve as a dedicated consumer-protection regulatory body. The Consumer Financial Protection Bureau is responsible for implementing, examining and enforcing compliance with federal consumer financial laws for institutions with more than $10 billion of assets and, to a lesser extent, small institutions. As a smaller institution, most consumer protection aspects of the Dodd-Frank Reform Act will continue to be overseen by the Federal Reserve.

The Dodd-Frank Act allows banks to engage in de novo interstate branching, a practice that was previously significantly limited.

Many aspects of the Dodd-Frank Reform Act are subject to rulemaking by numerous federal agencies to implement various parts of the legislation. While many rules have been finalized or issued in proposed form, additional rules have yet to be proposed or finalized. While it is not possible at this time to predict when all such additional rules will be issued or finalized, and what the content of such rules will be, Financial continues to evaluate the potential impact of the Dodd-Frank Reform Act.

Incentive Compensation

In June 2010, the Federal Reserve, the Office of the Comptroller of the Currency (“OCC”) and the FDIC issued comprehensive final guidance on incentive compensation intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

The Federal Reserve will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as Financial, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

The Dodd-Frank Reform Act requires the SEC and the federal bank regulatory agencies to establish joint regulations or guidelines that require financial institutions with assets of at least $1 billion to disclose the structure of their incentive compensation practices and prohibit such institutions from maintaining compensation arrangements that encourage inappropriate risk-taking by providing excessive compensation or that could lead to material financial loss to the financial institution.

The Regulatory Relief Act

The Regulatory Relief Act was enacted to modify or remove certain financial reform rules and regulations, including some of those implemented under the Dodd-Frank Act. While it maintains the majority of the regulatory structure established by the Dodd-Frank Act, the Regulatory Relief Act amends certain aspects for small depository institutions with less than $10 billion in assets, such as the Bank. Sections in the Regulatory Relief Act address access to mortgage credit; consumer access to credit; protections for veterans, consumers, and homeowners; rules for certain bank

Table of Contents

or financial holding companies; capital access; and protections for student borrowers. Financial and the Bank will focus on the implementing rules and guidance for the various provisions in each section of the Regulatory Relief Act that impact their operations and activities.

Pursuant to the Regulatory Relief Act, on September 17, 2019, the federal banking agencies adopted a final rule regarding a community bank leverage ratio. Under the final rule, which was effective on January 1, 2021, depository institutions and depository institution holding companies that have less than $10 billion in total consolidated assets and meet other qualifying criteria, including a leverage ratio (equal to Tier 1 capital divided by average total consolidated assets) of greater than 9 percent, will be eligible to opt into the community bank leverage ratio framework (qualifying community banking organizations). Qualifying community banking organizations that elect to use the community bank leverage ratio framework and that maintain a leverage ratio of greater than 9 percent will be considered to have satisfied the generally applicable risk-based and leverage capital requirements in the agencies’ capital rules (generally applicable rule) and, if applicable, will be considered to have met the well-capitalized ratio requirements for purposes of section 38 of the Federal Deposit Insurance Act.

The Regulatory Relief Act also expands the universe of holding companies that are permitted to rely on the “Small Bank Holding Company and Savings and Loan Holding Company Policy Statement.” The asset size of a qualifying holding company was increased from $1 billion to $3 billion on August 30, 2018, thus excluding holding companies in this category from consolidated capital requirements. However, subsidiary depository institutions continue to be subject to minimum capital requirements.

Further, the Regulatory Relief Act decreased the burden for community banks in regards to call reports, the Volcker Rule (which generally restricts banks from engaging in certain investment activities and limits involvement with hedge funds and private equity firms), mortgage disclosures, and risk weights for some high-risk commercial real estate loans. On December 28, 2018, the federal banking agencies issued a final rule increasing the asset threshold to qualify for an 18-month examination cycle from $1 billion to $3 billion for qualifying institutions that are well capitalized, well managed and meet certain other requirements.

Any number of the provisions of the Regulatory Relief Act may have the effect of increasing our expenses, decreasing our revenues, or changing the activities in which we choose to engage. The environment in which banking organizations operate, including legislative and regulatory changes affecting capital, liquidity, supervision, permissible activities, corporate governance and compensation, changes in fiscal policy and steps to eliminate government support for banking organizations, may have long-term effects on the profitability of banking organizations that cannot now be foreseen.

It is difficult at this time to determine the direct impact of the Regulatory Relief Act on Financial or the Bank. Implementing rules and regulations are required and many have not yet been written or finalized.

Regulation of the Bank

The Bank is a Virginia chartered commercial bank and a state member bank. The Bank’s deposit accounts are insured by the Deposit Insurance Fund (“DIF”) of the FDIC up to the maximum legal limits of the FDIC and it is subject to regulation, supervision and regular examination by the Virginia Bureau of Financial Institutions and the Federal Reserve. The regulations of these various agencies govern most aspects of the Bank’s business, including required reserves against deposits, loans, investments, mergers and acquisitions, borrowings, dividends and location and number of branch offices. The laws and regulations governing the Bank generally have been promulgated to protect depositors and the deposit insurance funds, and not for the purpose of protecting shareholders.

General. As a state-chartered commercial bank, the Bank and its subsidiaries are subject to regulation, supervision and examination by the Federal Reserve and the Virginia State Corporation Commission’s Bureau of Financial Institutions (the “BFI”). As such, the Bank is subject to various statutes and regulations administered by these agencies that govern, among other things, required reserves, investments, loans, lending limits, acquisitions of fixed

Table of Contents

assets, interest rates payable on deposits, transactions among affiliates and the Bank, the payment of dividends, mergers and consolidations, and establishment of branch offices.

The earnings of the Bank are affected by general economic conditions, management policies and the legislative and governmental actions of the various regulatory authorities, including those referred to above.

FDIC Insurance Premiums. The FDIC’s DIF provides insurance coverage for certain deposits, which insurance is funded through assessments on banks, like the Bank. Pursuant to the Dodd-Frank Act, the amount of deposit insurance coverage for deposits increased to $250,000 per depositor, subject to aggregation rules. Pursuant to the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), the FDIC has established 2.0% as the designated reserve ratio (the “DRR”), that is, the ratio of the DIF to insured deposits. The Dodd-Frank Act directs the FDIC to amend its assessment regulations so that future assessments will generally be based upon a depository institution’s average total consolidated assets minus the average tangible equity of the insured depository institution during the assessment period, whereas assessments were previously based on the amount of an institution’s insured deposits. The minimum DIF rate has increased from 1.15% to 1.35%, and the cost of the increase will be borne by depository institutions with assets of $10 billion or more. At least semi-annually, the FDIC will update its loss and income projections for the DIF and, if needed, will increase or decrease assessment rates, following notice-and-comment rule making if required.

The Bank incurred $441,000 and $419,000 in FDIC assessments in 2024 and 2023, respectively. Future increases in FDIC insurance premiums may negatively impact the Bank’s profitability.

After giving primary regulators an opportunity to first take action, FDIC may initiate an enforcement action against any depository institution it determines is engaging in unsafe or unsound actions or which is in an unsound condition, and the FDIC may terminate that institution’s deposit insurance.

Capital Requirements. On June 7, 2012, the Federal Reserve issued a series of proposed rules that would revise and strengthen its risk-based and leverage capital requirements and its method for calculating risk-weighted assets. The rules were proposed to implement the Basel III regulatory capital reforms from the Basel Committee on Banking Supervision and certain provisions of the Dodd-Frank Reform Act. On July 2, 2013, the Federal Reserve approved certain revisions to the proposals and finalized new capital requirements for banking organizations.

Effective January 1, 2015, the final rules require the Bank to comply with the following minimum capital ratios: (i) a common equity Tier 1 capital ratio of 4.5% of risk-weighted assets; (ii) a Tier 1 capital ratio of 6.0% of risk-weighted assets; (iii) a total capital ratio of 8.0% of risk-weighted assets (unchanged from the previous requirement); and (iv) a leverage ratio of 4.0% of total assets. A capital conservation buffer requirement was phased in beginning January 1, 2016, at 0.625% of risk-weighted assets, increasing each year until fully implemented at 2.5% on January 1, 2019. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of common equity Tier 1 to risk-weighted assets above the minimum but below the conservation buffer will face constraints on dividends, equity repurchases, and compensation based on the amount of the shortfall.

Since January 1, 2019, the rules have required the Bank to maintain the following minimum capital ratios:

‎(i) Common Equity Tier 1 (CET1) capital ratio of at least 4.5% plus a capital conservation buffer of 2.5%, resulting in an effective CET1 minimum ratio of 7.0%; (ii) Tier 1 capital ratio of at least 6.0% plus the capital conservation buffer, resulting in an effective minimum Tier 1 ratio of 8.5%; (iii) Total capital ratio of at least 8.0% plus the capital conservation buffer, resulting in an effective total capital ratio of 10.5%; and (iv) Leverage ratio (Tier 1 capital to average consolidated total assets) of at least 4.0%. With respect to the Bank, the rules also revised the ‘prompt corrective action’ (PCA) regulations pursuant to Section 38 of the FDIA, which establish thresholds that determine regulatory responses if capital levels decline.Under the revised PCA rules, the Bank must maintain the following ratios to be considered ‘well capitalized’: (i) CET1 ratio of at least 6.5%; (ii) Tier 1 capital ratio of at least 8.0%; (iii) Total capital ratio of at least 10.0%; and (iv) Tier 1 leverage ratio of at least 5.0%.

The Basel III capital rules modified asset risk-weightings to better reflect actual credit and market risks, including:

Table of Contents

Increasing the risk weight for certain high-volatility commercial real estate (HVCRE) acquisition, development, and construction loans from 100% to 150%.

Assigning a 150% risk weight (previously 100%) to nonresidential mortgage loans that are 90 days past due or on non-accrual status.

Applying a 20% credit conversion factor (previously 0%) for commitments with original maturities of one year or less that are not unconditionally cancellable.

Increasing the risk weight for mortgage servicing rights and deferred tax assets not deducted from capital from 100% to 250%.

Introducing increased risk weights ranging from 0% up to 600% for certain equity exposures.

As discussed above under “Supervision and Regulation - The Regulatory Relief Act,” recently enacted legislation directed the federal bank regulatory agencies to develop a “Community Bank Leverage Ratio,” calculated by dividing tangible equity capital by average consolidated total assets, of not less than 8% and not more than 10%. On September 17, 2019, pursuant to the Regulatory Relief Act, the federal banking agencies adopted a final rule setting a community bank leverage ratio of 9%. If a “qualified community bank,” generally a depository institution or depository institution holding company with consolidated assets of less than $10 billion, has a leverage ratio which exceeds the Community Bank Leverage Ratio, then such bank will be considered to have met all generally applicable leverage and risk based capital requirements; the capital ratio requirements for “well capitalized” status under Section 38 of the FDIA, and any other leverage or capital requirements to which it is subject. Although eligible, as of December 31, 2024, the Bank has not elected to use the Community Bank Leverage Ratio framework.

The asset size of a qualifying holding company was increased from $1 billion to $3 billion on August 30, 2018, thus excluding holding companies in this category from consolidated capital requirements.

Because total assets on a consolidated basis are less than $3 billion, Financial is not subject to the consolidated capital requirements imposed by the Bank Holding Company Act. Although the Company’s subsidiary depository institution continues to be subject to minimum capital requirement, it is unlikely that the Company will be required to comply with the consolidated capital rules until well into the future.

Transactions with Affiliates. The Bank is subject to Sections 23A and 23B of the Federal Reserve Act and Regulation W issued by the Federal Reserve Board. These provisions limit the extent to which the Bank can lend or extend credit to, invest in, or engage in certain other transactions with its affiliates (entities controlled by or under common control with the Bank), as well as transactions involving third parties secured by securities or obligations of affiliates. Specifically, these regulations limit transactions with any individual affiliate to no more than 10% of the Bank’s capital and surplus and limit the aggregate amount of all affiliate transactions to no more than 20% of capital and surplus. Extensions of credit to affiliates must be secured by qualifying collateral, and purchases of low-quality assets from affiliates are generally prohibited. Additionally, transactions with affiliates must be conducted on terms at least as favorable as comparable transactions with non-affiliated parties, or, in the absence of comparable transactions, under terms and conditions, including credit standards, that would apply to non-affiliates.

Loans to Insiders. The Bank is subject to restrictions on loans to insiders under Section 22(h) of the Federal Reserve Act and Regulation O issued by the Federal Reserve Board. Regulation O limits loans to executive officers, directors, and principal stockholders (persons owning more than 10% of the Bank’s voting shares), and their related interests, to amounts not exceeding the loans-to-one-borrower limit applicable to national banks (generally 15% of unimpaired capital and surplus). Total loans to all insiders collectively must not exceed the Bank’s unimpaired capital and surplus.

Regulation O also requires prior approval by a majority of the Bank’s board of directors (excluding any interested director) for any loan to an insider exceeding the greater of $25,000 or 5% of the Bank’s capital and surplus, with a maximum approval threshold of $500,000. Additionally, loans to insiders must be made on terms substantially similar to those offered to unrelated parties, except when made under widely available employee benefit programs that do not favor

Table of Contents

insiders. Regulation O also restricts the Bank from paying overdrafts in excess of $1,000 incurred by directors or executive officers unless pursuant to a pre-authorized credit or transfer plan.

As of December 31, 2024, all loans and extensions of credit to executive officers, directors, principal stockholders, and their affiliated interests comply with Sections 23A and 23B of the Federal Reserve Act, Regulation W, Section 22(h), and Regulation O.

Community Reinvestment Act. The Community Reinvestment Act (“CRA”) requires that, in connection with examinations of financial institutions, federal banking agencies – including the Federal Reserve Board, the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency or the Office of Thrift Supervision - evaluate an institutions performance in meeting the credit needs of its local communities, particularly low and moderate income neighborhoods, consistent with the safe and sound operation of those institutions. The CRA does not impose specific lending quotas or programs nor restrict an institution’s discretion in developing products and services suitable to its communities..

An institution’s CRA activities are considered in, among other things, evaluating mergers, acquisitions and applications to open a branch or facility, as well as determining whether the institution will be permitted to exercise certain of the powers allowed by the GLB Act. The CRA also requires all institutions to make public disclosure of their CRA ratings.

As of its most recent CRA evaluation, the Bank received a rating of “Satisfactory.”

Safety and Soundness. The federal banking agencies have broad powers under current federal law to take prompt corrective action to resolve problems of insured depository institutions. The extent of these powers depends upon whether the institutions in question are “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” or “critically undercapitalized,” all such terms are defined under uniform regulations defining such capital levels issued by each of the federal banking agencies. An insured depository institution which is less than adequately capitalized must adopt an acceptable capital restoration plan, is subject to increased regulatory oversight and is increasingly restricted in the scope of its permissible activities. As of December 31, 2024, the Bank was considered “well-capitalized.”

Regulatory Enforcement Authority. Applicable banking laws include substantial enforcement powers available to federal banking regulators. This enforcement authority includes, among other things, the ability to assess civil money penalties, to issue cease-and-desist or removal orders and to initiate injunctive actions against banking organizations and institution-affiliated parties. In general, these enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices. Other actions or inactions, including the filing of misleading or untimely reports with regulatory authorities, may provide the basis for enforcement action.

Cybersecurity. The federal bank regulatory agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a banking organization’s board of directors. This guidance, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services. The federal bank regulatory agencies expect financial institutions to establish appropriate security controls and to ensure that their risk management processes address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption and maintenance of the institution’s operations after a cyberattack. If we fail to meet the expectations set forth in such regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.

In November 2021, the federal bank regulatory agencies issued a final rule to improve the sharing of information about cyber incidents that may affect the U.S. banking system. The rule, which became effective on May 1, 2022, requires a banking organization to notify its primary federal regulator within 36 hours of determining that a “computer-security incident” has materially affected - or is reasonably likely to materially affect - the viability of the banking organization’s

Table of Contents

operations, its ability to deliver banking products and services, or the stability of the financial sector. In addition, the rule requires a bank service provider to notify affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has materially affected or is reasonably likely to materially affect banking organization customers for four or more hours.

Confidentiality and Required Disclosures of Consumer Information. The Bank is subject to various laws and regulations that address the privacy of nonpublic personal financial information of consumers. The Gramm-Leach-Bliley Act and certain regulations issued thereunder protect against the transfer and use by financial institutions of consumer nonpublic personal information. A financial institution must provide to its customers, at the beginning of the customer relationship and annually thereafter, the institution’s policies and procedures regarding the handling of customers’ nonpublic personal financial information. These privacy provisions generally prohibit a financial institution from providing a customer’s personal financial information to unaffiliated third parties unless the institution discloses to the customer that the information may be so provided and the customer is given the opportunity to opt out of such disclosure.

In August, 2018, the CFPB published its final rule to update Regulation P pursuant to the amended GLB Act. Under this rule, certain qualifying financial institutions are not required to provide annual privacy notices to customers. To qualify, a financial institution must not share nonpublic personal information about customers except as described in certain statutory exceptions which do not trigger a customer’s statutory opt-out. In addition, the financial institution must not have changed its disclosure policies and practices from those disclosed in its most recent privacy notice. The rule sets forth timing requirements for delivery of annual privacy notices in the event that a financial institution that qualified for the annual notice exemption later changes its policies or practices in such a way that it no longer qualifies for the exemption.

The Bank is also subject to various laws and regulations that attempt to combat money laundering and terrorist financing. The Bank Secrecy Act requires all financial institutions to, among other things, create a system of controls designed to prevent money laundering and the financing of terrorism, and imposes recordkeeping and reporting requirements. The USA Patriot Act facilitates information sharing among governmental entities and financial institutions for the purpose of combating terrorism and money laundering, and requires financial institutions to establish anti-money laundering programs. The Office of Foreign Assets Control (“OFAC”), which is a division of the U.S. Department of the Treasury, is responsible for helping to ensure that United States entities do not engage in transactions with “enemies” of the United States, as defined by various Executive Orders and Acts of Congress. If the Bank finds a name of an “enemy” of the United States on any transaction, account or wire transfer that is on an OFAC list, it must freeze such account or place transferred funds into a blocked account, file a suspicious activity report with the Treasury and notify the FBI.

Mortgage Banking Regulation. The Bank’s Mortgage Division is subject to the rules and regulations by the Department of Housing and Urban Development (“HUD”), the Federal Housing Administration (the “FHA”), the Department of Veteran Affairs and state regulatory authorities with respect to originating, processing, servicing and selling mortgage loans.

Among other provisions, these rules and regulations, establish standards for loan origination, prohibit discrimination, provide for inspections and appraisals of property, require credit reports on prospective borrowers and, in some cases, restrict certain loan features, and fix maximum interest rates and fees.

In addition to other federal laws, mortgage origination activities are subject to the Equal Credit Opportunity Act, Truth-in-Lending Act, Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, and the Home Ownership Equity Protection Act, and the regulations promulgated thereunder. These laws prohibit discrimination, require the disclosure of certain basic information to mortgagors concerning credit and settlement costs, limit payment for settlement services to the reasonable value of the services rendered and require the maintenance and disclosure of information regarding the disposition of mortgage applications based on race, gender, geographical distribution and income level.

‎

Table of Contents

Effect of Governmental Monetary Policies

Our earnings are affected by domestic economic conditions and the monetary and fiscal policies of the United States government and its agencies. TheFederal Reserve Board and the Federal Open Market Committee (FOMC), through their monetary policy decisions, exert considerable influence over commercial banks’ operating results. These policy actions—including open market operations, adjustments to the federal funds target rate, changes in discount rates, and alterations in reserve requirements—are designed, among other purposes, to control inflation or stimulate economic activity.

The monetary policies of the Federal Reserve Board have major effects upon the levels of bank loans, investments and deposits through its open market operations in United States government securities and through its regulation of the discount rate on borrowings of member banks and the reserve requirements against member bank deposits. In particular, we are subject to risk from decisions of the FOMC to continue to increase the fed funds target rate. Such an increase could subject us to interest rate risk by, among other things, a) requiring us to increase the rates paid on deposit accounts; and b) further decreasing the value of certain assets, including our loans and investment securities. Conversely, while rate cuts by the FOMC would result in an increase in the value of our loans and investment securities, such cuts are likely to put pressure on our net interest margin.

While is it is not possible to fully predict the nature or impact of future changes in monetary and fiscal policies, we anticipate that rate decreases in 2025 could have a negative impact on our results of operations and/or financial condition.

Future Regulatory Uncertainty

Legislative and regulatory proposals regarding changes in banking, and the regulation of banks, federal savings institutions, and other financial institutions and bank and bank holding company powers are being considered by the executive branch of the federal government, Congress and various state governments. Certain of these proposals, if adopted, could significantly change the regulation or operations of banks and the financial services industry. New regulations and statutes are regularly proposed that contain wide-ranging proposals for altering the structures, regulations, and competitive relationships of the nation’s financial institutions.

The federal regulatory environment governing financial institutions evolves frequently, particularly in response to economic disruptions or institutional failures. The recent failures of several large regional banks in 2023—including Silicon Valley Bank, Signature Bank, and First Republic Bank—have led regulators, legislators, and commentators to advocate increased regulatory oversight of the banking sector. Potential regulatory responses under consideration include higher capital and liquidity standards, expanded supervisory stress testing beyond the largest systemic banks, and increased oversight of risk management practices.

Given the uncertain legislative environment and the ongoing regulatory response to these bank failures, we cannot reliably predict whether or how any such regulations or statutes will be adopted. Additional regulation, however, could materially impact our business by increasing operational costs, requiring additional capital, or limiting certain business activities or strategic flexibility. Although President Trump’s administration has advocated for a reduction in regulations, including those impacting the banking industry, we anticipate that financial institutions, including ours, will remain subject to significant regulatory oversight and compliance obligations for the foreseeable future.

Regulation of PWW

PWW is a registered investment adviser under the Investment Advisers Act of 1940, as amended, and as such, is supervised by the SEC. It is also subject to various other federal laws as well as licensing and/or registration requirements. These laws and regulations generally grant supervisory agencies broad administrative powers, including the power to limit or restrict the carrying on of business for failure to comply with such laws and regulations.

Table of Contents

Item 1A.Risk Factors

RISK FACTORS

In addition to the other information included in this Annual Report on Form 10-K, the following risk factors should be carefully considered in connection with evaluating our business and any forward-looking statements contained herein. Our business, financial condition, results of operations and cash flows could be harmed by any of the risk factors described below, or other risks that have not been identified or which we believe are immaterial or unlikely. If one or more of these or other risks or uncertainties materialize, or if our underlying assumptions prove to be incorrect, our business, financial condition, operating results and cash flows could be materially adversely affected.

RISKS RELATED TO OUR BUSINESS

Our profitability depends significantly on local economic conditions.

Our success depends primarily on the general economic conditions of the primary markets in Virginia in which we operate and where our loans are concentrated. Unlike nationwide banks that are more geographically diversified, the Company provides banking and financial services to customers primarily in the Lynchburg metropolitan statistical area (“MSA”). Lynchburg’s MSA, which is often referred to as Region 2000, consists of approximately 2,122 square miles, and includes the City of Lynchburg and the Counties of Bedford, Campbell, Amherst and Appomattox. To a lesser extent, our lending market includes the Roanoke, Charlottesville and Harrisonburg MSAs. Our branches in localities outside of Region 2000 have a short operating history. As of December 2024, the Lynchburg MSA had an unemployment rate (not seasonally adjusted) of 2.9%, as compared to a statewide average unemployment rate of 3.0%.

The local economic conditions in these areas have a significant impact on the Company’s commercial and industrial, real estate and construction loans, the ability of its borrowers to repay their loans and the value of the collateral securing these loans. In addition, if the population or income growth in the Company’s market areas is slower than projected, income levels, deposits and housing starts could be adversely affected and could result in a reduction of the Company’s expansion, growth and profitability. If the Company’s market areas experience a downturn or a recession for a prolonged period of time, the Company could experience significant increases in nonperforming loans, which could lead to operating losses, impaired liquidity and eroding capital. A significant decline in general economic conditions, caused by inflation, recession, pandemics, acts of terrorism, outbreaks of hostilities or other international or domestic calamities, unemployment, monetary and fiscal policies of the federal government or other factors could impact these local economic conditions and could negatively affect the Company’s financial condition, results of operations and cash flows.

The Company’s business, financial condition, liquidity and results of operations may be, adversely affected by future public health emergencies.

Although the COVID-19 pandemic has largely subsided and current trends do not indicate a resurgence, our business, financial condition, liquidity, and results of operations could still be adversely affected by any future public health emergencies or pandemics.

A significant portion of our loan portfolio is secured by real estate, and events that negatively impact the real estate market could hurt our business.

A substantial majority of our loans have real estate as a primary or secondary component of collateral. The real estate collateral in each case provides an alternate source of repayment in the event of default by the borrower and may deteriorate in value during the time the credit is extended. Because most of our loans are concentrated in the Region 2000 area in and surrounding the City of Lynchburg, a decline in local economic conditions may have a greater effect on our earnings and capital than on the earnings and capital of larger financial institutions whose real estate loan portfolios are more geographically diverse. A weakening of the real estate market in our primary market areas could result in an

Table of Contents

increase in the number of borrowers who default on their loans and a reduction in the value of the collateral securing their loans, which in turn could have an adverse effect on our profitability and asset quality. If we are required to liquidate the collateral securing a loan to satisfy the debt during a period of reduced real estate values, our earnings and capital could be adversely affected. Additionally, acts of nature, including hurricanes, tornados, earthquakes, fires and floods, which may cause uninsured damage and other loss of value to real estate that secures these loans, may also negatively impact our financial condition.

Our loan portfolio contains a number of real estate loans with relatively large balances.

A significant portion of our total loan portfolio contains real estate loans with balances in excess of $1,000,000. The deterioration of one or a few of these loans could cause a significant increase in nonperforming loans, which could result in a net loss of earnings, an increase in the provision for credit losses and an increase in loan charge-offs, all of which could have a material adverse effect on our financial condition and results of operations.

Commercial real estate loans increase our exposure to credit risk.

A majority of our loan portfolio is secured by commercial real estate. Loans secured by commercial real estate are generally viewed as having more risk of default than loans secured by residential real estate or consumer loans because repayment of the loans often depends on the successful operation of the property, the income stream of the borrowers, the accuracy of the estimate of the property’s value at completion of construction and the estimated cost of construction. An adverse development with respect to one lending relationship can expose us to a significantly greater risk of loss as compared with a single-family residential mortgage loan because we typically have more than one loan with such borrowers. Additionally, these loans typically involve larger loan balances to single borrowers or groups of related borrowers compared with single-family residential mortgage loans. Therefore, the deterioration of one or a few of these loans could cause a significant decline in the related asset quality. These loans represent higher risk and could result in a sharp increase in loans charged-off and could require us to significantly increase our allowance for credit losses, which could have a material adverse impact on our business, financial condition, results of operations and cash flows.

A percentage of the loans in our portfolio currently include exceptions to our loan policies and supervisory guidelines.

All of the loans that we make are subject to written loan policies adopted by our board of directors and to supervisory guidelines imposed by our regulators. Our loan policies are designed to reduce the risks associated with the loans that we make by requiring our loan officers to take certain steps that vary depending on the type and amount of the loan, prior to closing a loan. These steps include, among other things, making sure the proper liens are documented and perfected on property securing a loan, and requiring proof of adequate insurance coverage on property securing loans. Loans that do not fully comply with our loan policies are known as “exceptions.” We categorize exceptions as policy exceptions, financial statement exceptions and document exceptions. As a result of these exceptions, such loans may have a higher risk of loan loss than the other loans in our portfolio that fully comply with our loan policies. In addition, we may be subject to regulatory action by federal or state banking authorities if they believe the number of exceptions in our loan portfolio represents an unsafe banking practice.

As a community bank, we have different lending risks than larger banks. We provide services to individuals and small to medium-sized businesses in our local markets who may have fewer financial resources to weather a downturn in the economy.

Our ability to diversify our economic risks is limited by our own local markets and economies. We lend primarily to small to medium-sized businesses, professionals and individuals, which may expose us to greater lending risks than those of banks lending to larger, better-capitalized businesses with longer operating histories. For instance, small to medium-sized businesses frequently have smaller market share than their competition, may be more vulnerable to economic downturns, have fewer financial resources in terms of capital or borrowing capacity than larger entities, often need substantial additional capital to expand or compete and may experience significant volatility in operating results. Any one or more of these factors may impair the borrower’s ability to repay a loan. In addition, the success of a small to

Table of Contents

medium-sized business often depends on the management talents and efforts of one or two persons or a small group of persons, and the death, disability or resignation of one or more of these persons could have a material adverse impact on the business and its ability to repay a loan. Economic downturns and other events that negatively impact the Company’s market areas could cause the Company to incur substantial credit losses that could negatively affect the Company’s results of operations and financial condition.

We depend on the accuracy and completeness of information about clients and counterparties, and our financial condition could be adversely affected if we rely on misleading information.

In deciding whether to extend credit or to enter into other transactions with clients and counterparties, we may rely on information furnished to us by or on behalf of clients and counterparties, including financial statements and other financial information, which we do not independently verify as a matter of course. We also may rely on representations of clients and counterparties as to the accuracy and completeness of that information and, with respect to financial statements, on reports of independent auditors. For example, in deciding whether to extend credit to customers, we may assume that a customer’s audited financial statements conform with U.S. Generally Accepted Accounting Principles (“GAAP”) and present fairly, in all material respects, the financial condition, results of operations and cash flows of the customer. Our financial condition and results of operations could be negatively impacted to the extent we rely on financial statements that do not comply with GAAP or are materially misleading.

If we suffer credit losses from a decline in credit quality, our earnings will decrease.

We could sustain losses if borrowers, guarantors or related parties fail to perform in accordance with the terms of their loans. We have adopted underwriting and credit monitoring procedures and policies, including the establishment and review of the allowance for credit losses, that we believe are appropriate to minimize this risk by assessing the likelihood of nonperformance, tracking loan performance and diversifying our credit portfolio. These policies and procedures, however, may not prevent unexpected losses that could materially adversely affect our results of operations.

These policies and procedures necessarily rely on our making various assumptions and judgments about the collectability of our loan portfolio, including the creditworthiness of our borrowers and the value of the real estate and other assets serving as collateral for the repayment of many of our loans. In determining the amount of the allowance for credit losses, we review our loans and our loss and delinquency experience, and we evaluate economic conditions. If our assumptions are incorrect, our allowance for credit losses may not be sufficient to cover probable incurred losses in our loan portfolio, resulting in additions to our allowance. Any future additions to our allowance could materially decrease our net income.

In addition, the Federal Reserve Bank of Richmond and the Virginia Bureau of Financial Institutions (the “BFI”) periodically review our allowance for credit losses and may require us to increase our provision for credit losses or recognize further loan charge-offs. Any increase in our allowance for credit losses or loan charge-offs as required by regulatory authorities might have a material adverse effect on our financial condition and results of operations.

Our allowance may not be adequate to cover actual credit losses.

A significant source of risk arises from the possibility that we could sustain losses due to loan defaults and nonperformance on loans. We maintain an allowance for credit losses in accordance with GAAP to provide for such defaults and other nonperformance. As of December 31, 2024, our allowance as a percentage of total loans was 1.22% and our allowance as a percentage of nonperforming loans was 1,895%. The determination of the appropriate level of allowance is an inherently difficult process and is based on numerous assumptions. The amount of future losses is susceptible to changes in economic, operating and other conditions, including changes in interest rates, many of which are beyond our control. In addition, our underwriting policies, adherence to credit monitoring processes and risk management systems and controls may not prevent unexpected losses. Our allowance may not be adequate to cover actual credit losses. Moreover, any increase in our allowance will adversely affect our earnings by decreasing our net income.

Table of Contents

We adopted the Current Expected Credit Losses (CECL) accounting standard on January 1, 2023. Prior to CECL, our allowance for credit losses generally considered only past events and current conditions. The CECL methodology requires a forward-looking methodology that reflects the expected credit losses over the lives of financial assets, starting when such assets are first originated or acquired. The CECL standard requires us to record, at the time of origination, the credit losses expected throughout the life of our loans, as opposed to the previous incurred-loss method, which recorded losses only when it was probable that a loss event had already occurred. CECL necessitates advanced modeling techniques, significant reliance on assumptions, and historical data that may not always accurately forecast future losses. Implementation of CECL can result in greater volatility in the allowance for credit losses, influenced by various factors and assumptions in our modeling process, such as forecasted economic conditions and loan repayment behavior. Increases in our allowance for credit losses or additional expenses incurred to determine the allowance can adversely affect our financial condition and operating results.

The markets for our deposit and lending products and services are highly competitive, and we face substantial competition.

The banking and financial services industry is highly competitive. We compete as a financial intermediary with other commercial banks, savings banks, credit unions, finance companies, mutual funds, insurance companies and brokerage and investment banking firms soliciting business from residents of and businesses located in the Virginia localities where the Bank has a presence, surrounding areas and elsewhere. Many of these competing institutions have nationwide or regional operations and have greater resources than we have. We also face competition from local community institutions. Many of our competitors enjoy competitive advantages, including greater name recognition, financial resources, a wider geographic presence or more accessible branch office locations, the ability to offer additional services, greater marketing resources, more favorable pricing alternatives for loans and deposits and lower origination and operating costs. We are also subject to lower lending limits than our larger competitors. Our profitability depends upon our continued ability to successfully compete in our market areas. Increased deposit competition could increase our cost of funds and could adversely affect our ability to generate the funds necessary for our lending operations. If we must raise interest rates paid on deposits or lower interest rates charged on our loans, our net interest margin and profitability could be adversely affected. Competition could result in a decrease in loans we originate and could negatively affect our ability to grow and our results of operations.

Technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. Many of our competitors have fewer regulatory constraints and may have lower cost structures. Additionally, due to their size, many competitors may be able to achieve economies of scale and, as a result, may offer a broader range of products and services as well as better pricing for those products and services.

We have increased and plan to continue to increase our levels of commercial and industrial loans. We may not be successful in continuing to penetrate this market segment, which has helped to drive some of our recent earnings.

A significant percentage of our loans are commercial and industrial loans. Although our portfolio of commercial and industrial loans has decreased during the past year, that category has generally increased over the past several years and we continue to focus on commercial and industrial loans.

While we intend to originate these types of loans in a manner that is consistent with safety and soundness, these non-residential loans generally expose us to greater risk of loss than one- to four-family residential mortgage loans, as repayment of such commercial and industrial loans generally depends, in large part, on the borrower’s business to cover operating expenses and debt service. In addition, these types of loans typically involve larger loan balances to single borrowers or groups of related borrowers, as compared to one- to four-family residential mortgage loans. Changes in economic conditions that are beyond our or the borrower’s control could adversely affect the value of the security for the loan, including the future cash flow of the affected business. As we increase our portfolio of these loans, we may experience higher levels of non-performing assets or credit losses, or both.

Table of Contents

Our efforts to increase our levels of commercial and industrial loans may be impacted by increased interest rates, recession, or other adverse economic conditions.

Our plans for future expansion depend, in some instances, on factors beyond our control, and an unsuccessful attempt to achieve growth could have a material adverse effect on our business, financial condition, results of operations and future prospects.

We expect to continue to engage in new branch expansion in the future. We may also seek to acquire other financial institutions, or parts of those institutions, though we have no present plans in that regard. Expansion involves a number of risks, including, without limitation:

the time and costs of evaluating new markets, hiring experienced local management and opening new offices;

the time lags between these activities and the generation of sufficient assets and deposits to support the costs of the expansion;

our entrance into new markets where we lack experience;

the introduction of new products and services with which we have no prior experience into our business;

failure to culturally integrate an acquisition target or new branches or failing to identify and select the optimal candidate for integration or expansion; and

failure to identify and retain experienced key management members with local expertise and relationships in new markets.

We may acquire and hold other real estate owned (OREO) properties, which could lead to increased operating expenses and vulnerability to declines in the market value of real estate in our areas of operations.

From time-to-time, we foreclose upon and take title to the real estate serving as collateral for our loans as part of our business. If our OREO balance increases, management expects that our earnings will be negatively affected by various expenses associated with OREO, including personnel costs, insurance and taxes, completion and repair costs, valuation adjustments and other expenses associated with property ownership. Also, at the time that we foreclose upon a loan and take possession of a property, we estimate the value of that property using third-party appraisals and opinions and internal judgments. OREO property is valued on our books at the estimated market value of the property, less the estimated costs to sell (or “fair value”). Upon foreclosure, a charge-off to the allowance for credit losses is recorded for any excess between the value of the asset on our books over its fair value. Thereafter, we periodically reassess our judgment of fair value based on updated appraisals or other factors, including, at times, at the request of our regulators. Any declines in our estimate of fair value for OREO will result in valuation adjustments, with a corresponding expense in our consolidated statements of income that is recorded under the line item for “Other real estate expenses.” As a result, our results of operations are vulnerable to declines in the market for residential and commercial real estate in the areas in which we operate. The expenses associated with OREO and property write downs could have a material adverse effect on our results of operations and financial condition. Any increase in non-accrual loans may lead to increases in our OREO balance in the future.

Additional growth and regulatory requirements may require us to raise additional capital in the future, and capital may not be available when it is needed or may have unfavorable terms, which could adversely affect our financial condition and results of operations.

We are required by federal and state regulatory authorities to maintain adequate levels of capital to support our operations. While the boards of the Company and the Bank intend to take steps to ensure that the capital plan aligns with the Bank’s strategic plan, that all material risks to the Bank are identified and measured and that capital limits are appropriate for the institution’s risk profile, failure to successfully implement such steps could have a material adverse effect on our financial condition and results of operations. We may at some point need to raise additional capital to support any future significant growth. Our ability to raise additional capital, if needed, will depend on conditions in the capital markets at that time, which are outside of our control, and on our financial performance. Accordingly, we can

Table of Contents

make no assurances of our ability to raise additional capital, if needed, on terms acceptable to us. If we cannot raise additional capital when needed, our ability to further expand our operations could be materially impaired.

Our corporate culture has contributed to our success, and if we cannot maintain this culture as we grow, we could lose the teamwork and increased productivity fostered by our culture, which could harm our business.

We believe that a critical contributor to our success has been our corporate culture, which we believe fosters teamwork and increased productivity. As our organization grows and we are required to implement more complex organizational management structures, we may find it increasingly difficult to maintain the beneficial aspects of our corporate culture. This could negatively impact our future success.

If we fail to retain our key employees, our growth and profitability could be adversely affected.

Our success is, and is expected to remain, highly dependent on our executive management team. We are especially dependent on these executives as well as other key personnel because, as a community bank, we depend on our management team’s ties to the community to generate business for us, and our executives have key expertise needed to implement our business strategy. Our executive management and other key personnel have not signed non-competition covenants.

Competition for personnel is intense, and we may not be successful in attracting or retaining qualified personnel. Our failure to compete for these personnel, or the loss of the services of several of such key personnel, could adversely affect our growth strategy and seriously harm our business, results of operations and financial condition.

Severe weather, natural disasters, acts of war or terrorism or other adverse external events could significantly impact our business.

Severe weather, natural disasters, acts of war or terrorism or other adverse external events could have a significant impact on our ability to conduct business. In addition, such events could affect the stability of our deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue or cause us to incur additional expenses. The occurrence of any of these events in the future could have a material adverse effect on our business, financial condition, results of operations and growth prospects.

As a community bank, our ability to maintain our reputation is critical to the success of our business, and our failure to do so may materially adversely affect our performance.

As a community bank, our reputation is one of the most valuable components of our business. As such, we strive to conduct our business in a manner that enhances our reputation. This is done, in part, by recruiting, hiring and retaining employees who share our core values of being an integral part of the communities we serve, delivering superior service to our customers and caring about our customers and associates. Negative publicity can result from our actual or alleged conduct in any number of activities, including lending practices, corporate governance, acquisitions and actions taken or threatened by government regulators and community organizations in response to those activities. If our reputation is negatively affected by the actions of our employees or otherwise, there may be an adverse effect on our ability to keep and attract customers, and we might be exposed to litigation and regulatory action. Any of such events could harm our business, and, therefore, our operating results may be materially adversely affected. As a financial services company with a high profile in our market area, we are inherently exposed to this risk. While we take steps to minimize reputation risk in dealing with customers and other constituencies, we will continue to face additional challenges maintaining our reputation with respect to customers of the Bank in our current primary market area in Region 2000 and in establishing our reputation in new market areas.

Table of Contents

Our decisions regarding how we manage our credit exposure may materially and adversely affect our business.

We manage our credit exposure through careful monitoring of lending relationships and loan concentrations in particular industries, and through loan approval and review procedures. The adequacy of our allowance for credit losses is crucial in monitoring credit exposure. While our board and senior management are continuing to improve the Bank’s risk management framework and align the Bank’s risk philosophy with its capital and strategic plans, failure to continue to improve such risk management framework could have a material adverse effect on our financial condition and results of operations. We can make no assurances that our credit loss reserves will be sufficient to absorb future credit losses or prevent a material adverse effect on our business, financial condition or results of operations.

Our profitability is vulnerable to interest rate fluctuations and changes in monetary policies.

Our profitability depends substantially upon our net interest income. Net interest income is the difference between the interest earned on interest-earning assets, such as loans and investment securities, and the interest expense paid on interest-bearing liabilities, such as NOW accounts, savings accounts, time deposits and other borrowings. Market interest rates for loans, investments and deposits are highly sensitive to many factors beyond our control. Previously interest rate spreads had a sustained period of narrowness due to many factors, such as market conditions, policies of various government and regulatory authorities and competitive pricing pressures, and we cannot predict whether these rate spreads will narrow again. This narrowing of interest rate spreads could adversely affect our financial condition and results of operations. In addition, we cannot predict whether interest rates will continue to remain at present levels. Changes in interest rates may cause significant changes, up or down, in our net interest income. Depending on our portfolio of loans and investments, our results of operations may be adversely affected by changes in interest rates.

Our financial condition and results of operations are affected by credit policies of monetary authorities, particularly the Federal Reserve Board. Actions by monetary and fiscal authorities, including the Federal Reserve Board, could have an adverse effect on our deposit levels, loan demand or business and earnings.

Inflation can have an adverse impact on our customers and their ability to repay.

Inflation risk is the risk that the value of assets or income from investments will be worth less in the future as inflation decreases the value of money. Beginning in 2021, there was pronounced rise in inflation and the Federal Reserve raised certain benchmark interest rates in an effort to combat this trend. Our customers may also be affected by inflation and the rising costs of goods and services used in their households and businesses, which could have a negative impact on their ability to repay their loans with us.

A failure in or breach of our operational or security systems or infrastructure, or those of our third party vendors and other service providers, including as a result of cyber-attacks, could disrupt our business, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs and cause losses.

We rely heavily on communications and information systems to conduct our business. Any failure, interruption or breach in security of these systems could result in failures or disruptions in our customer-relationship management, general ledger, deposit, loan and other systems. While we have policies and procedures designed to prevent or limit the effect of the failure, interruption or security breach of our information systems, there can be no assurance that any such failures, interruptions or security breaches will not occur; or, if they do occur, that they will be adequately addressed. The occurrence of any failures, interruptions or security breaches of our information systems could disrupt our business, increase our costs, result in the disclosure of confidential client information, damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny or expose us to civil litigation and possible financial liability; any of which could have a material adverse effect on our financial condition and results of operations.

Our computer systems, software and networks have been and will continue to be vulnerable to unauthorized access, loss or destruction of data (including confidential client information), account takeovers, unavailability of service, computer viruses or other malicious code, cyber-attacks and other events. These threats may derive from human error,

Table of Contents

fraud or malice on the part of employees or third parties, or may result from accidental technological failure. Information security risks for financial institutions such as ours have generally increased in recent years in part because of the proliferation of new technologies, the use of the Internet and digital technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists and other external parties. Some of our operations rely on the secure processing, transmission and storage of confidential information in our computer systems and networks. Our business relies on our digital technologies, computer and email systems, software and networks to conduct its operations. In addition, to access our products and services, our customers may use personal smartphones, tablets, personal computers and other mobile devices that are beyond our control systems. Although we have information security procedures and controls in place, our technologies, systems, networks and our customers’ devices may become the target of cyber-attacks or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of our or our customers’ confidential, proprietary and other information, or otherwise disrupt our or our customers’ or other third parties’ business operations.

Although we maintain safeguards to protect against these risks, we have suffered losses in the past and there can be no assurance that we will not suffer losses in the future that may be material in amount or nature.

Emerging Technological Threats

The pace of technological innovation introduces new challenges that can undermine our existing safeguards and business models. For instance, advancements in quantum computing could compromise traditional encryption methods, leaving sensitive financial data and transactions exposed. Similarly, the increasing use of artificial intelligence and machine learning by malicious actors enables more sophisticated cyberattacks, such as highly targeted phishing, deepfake fraud, or automated account takeovers. As these threats evolve, our existing defenses may become inadequate, and the cost and complexity of upgrading our systems and processes could materially affect our operations and financial performance.

In addition, the rapid emergence of decentralized finance (DeFi) platforms and blockchain technologies could disrupt traditional banking services, reducing our market share and fee income if we fail to adapt. The proliferation of new payment technologies and digital currencies may also introduce new security vulnerabilities, regulatory uncertainty, and competitive pressures. Our inability to address these emerging technological risks in a timely and effective manner could harm our reputation, weaken customer trust, and ultimately affect our long-term growth and profitability.

Digital Banking and Cryptocurrency Exposure

The continued growth and acceptance of digital banking services, cryptocurrencies, blockchain technologies, and DeFi present both opportunities and risks to our business. Increasing customer demand for digital banking services requires ongoing investments in technology infrastructure, cybersecurity, and regulatory compliance. Additionally, growth in cryptocurrency and DeFi could reduce traditional banking deposits and income streams, challenging our ability to attract and retain customers. Regulatory uncertainty regarding cryptocurrency and DeFi could further complicate our strategic decisions, increase compliance costs, and potentially expose us to reputational and operational risks.

Digital Banking Trends and Deposit Volatility

Our traditional banking model depends heavily on stable customer deposits as a primary source of funding. The rising popularity of alternative financial products, including fintech platforms, cryptocurrencies, money market funds, and digital wallets, may lead to increased volatility in our deposit base. Significant fluctuations in deposits could adversely affect our liquidity position, funding costs, and overall financial stability. Although we actively manage our liquidity and funding sources, a substantial shift of customer deposits to these alternative products could negatively impact our operations, profitability, and competitive position.

Table of Contents

Changes in consumers’ use of banks and changes in consumers’ spending and saving habits could adversely affect our financial results.

Technology and other changes now allow many consumers to complete financial transactions without using banks. For example, consumers can pay bills and transfer funds directly without going through a bank. This disintermediation could result in the loss of fee income, as well as the loss of customer deposits and income generated from those deposits. In addition, changes in consumer spending and saving habits could adversely affect our operations, and we may be unable to timely develop competitive new products and services in response to these changes that are accepted by new and existing customers.

Failure toimplement new technologies in our operations may adversely affect our growth or profits.

The market for financial services, including banking services and consumer finance services, is increasingly affected by advances in technology, including developments in telecommunications, data processing, computers, automation, Internet-based banking and telebanking. Our ability to compete successfully in our markets may depend on the extent to which we are able to exploit such technological changes. However, we can provide no assurance that we will be able to properly or timely anticipate or implement such technologies or properly train our staff to use such technologies. Any failure to adapt to new technologies could adversely affect our business, financial condition or operating results.

In addition, the financial services industry is undergoing rapid technological changes, with new technology-driven products and services being frequently introduced. The changes could cause our customers to use these new services and products rather than the Bank. For example, financial technology (or “fintech”) companies that rely on technology to provide financial services such as peer-to-peer platforms, blockchain and other distributed ledger technologies have the potential to disrupt the financial services industry and change the way banks do business. Fintech companies are subject to limited regulation. We may not be able to effectively implement new technology-driven products and services or be successful in competing against products, which could impair our growth and profitability.

We are subject to operational risks.

The Company may also be subject to disruptions of its systems arising from events that are wholly or partially beyond our control (including, for example, computer viruses or electrical or telecommunications outages), which may give rise to losses in service to customers and to financial loss or liability. The Company is further exposed to the risk that its external vendors may be unable to fulfill their contractual obligations (or will be subject to the same risk of fraud or operational errors by their respective employees as is the Company) and to the risk that the Company’s (or its vendors’) business continuity and data security systems prove to be inadequate.

We are subject to liquidity risk.

Liquidity risk is the potential that we will be unable to meet our obligations as they become due, capitalize on growth opportunities as they arise or pay regular cash dividends because of an inability to liquidate assets or obtain adequate funding in a timely basis, at a reasonable cost and within acceptable risk tolerances. A failure to adequately manage our liquidity risk could adversely affect our business, financial condition or operating results, especially in the event of another financial crisis. Further, the Federal Reserve could impose additional requirements on the Company if the agency determines that our enhanced liquidity risk management practices do not adequately manage our liquidity risk.

Further, our liquidity could be reduced because of a decrease in the value of certain assets, including loans and investment securities, caused by increases in interest rates which could in turn reduce the amount that we are able to borrow and/or reduce the proceeds from the sale of securities in our portfolio. Our ability to borrow could also be impaired by factors that are not specific to us, such as a disruption in the financial markets or negative views and expectations about the prospects for the financial services industry in light of the recent turmoil faced by banking organizations or deterioration in credit markets.

Table of Contents

We may lose lower-cost funding sources.

Checking, savings and money market deposit account balances and other forms of customer deposits can decrease when customers perceive alternatives such as other financial institutions or investments, such as the stock market, as providing a better risk/return tradeoff. If customers move money out of bank deposits and into other investments or to other financial institutions, the Bank could lose a relatively low-cost source of funds, thereby increasing its funding costs and reducing the Bank’s net interest income and net income.

If we fail to maintain an effective system of internal and disclosure controls, we may not be able to accurately report our financial results or prevent or detect fraud.

Effective internal control over financial reporting and disclosure controls and procedures are necessary for us to provide reliable financial reports and effectively prevent or detect fraud and to operate successfully as a public company.

The Company faces the risk that the design of its controls and procedures, including those to mitigate the risk of fraud by employees or outsiders, may prove to be inadequate or are circumvented, thereby causing delays in detection of errors or inaccuracies in data and information. We regularly review and update the Company’s internal controls, disclosure controls and procedures and corporate governance policies and procedures. Any system of controls, however well designed and operated, is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met. Any failure or circumvention of the Company’s controls and procedures or failure to comply with regulations related to controls and procedures could have a material adverse effect on the Company’s business, results of operations and financial condition.

Any failure to maintain effective controls or timely effect any necessary improvement of our internal and disclosure controls could hinder our ability to accurately report our operating results or cause us to fail to meet our reporting obligations, which could affect our ability to remain listed with The NASDAQ Capital Market. Ineffective internal and disclosure controls could also harm our reputation, negatively impact our operating results or cause investors to lose confidence in our reported financial information, which likely would have a negative effect on the trading price of our securities.

Changes in the financial markets could impair the value of our investment portfolio.

Our investment securities portfolio represents a significant component of our total earning assets. Market volatility, fluctuations in interest rates, and broader economic uncertainties could adversely affect the market value of our investment portfolio, potentially negatively impacting our net income and capital levels.

As of December 31, 2023, and December 31, 2024, we had unrealized losses, net of taxes, in our investment securities portfolio of $21,615,000 and $22,915,000, respectively. While we maintain sufficient liquidity to support our intent and ability to hold these securities until maturity or market recovery, if future conditions impair our liquidity or alter our intent or ability to hold these investments to maturity, we could incur losses that negatively impact our net income and potentially our capital position.

Our deposit insurance premiums could be substantially higher in the future, which could have a material adverse effect on our future earnings.

The FDIC insures deposits at FDIC-insured depository institutions, such as the Bank, up to applicable limits. The amount of a particular institution’s deposit insurance assessment is based on that institution’s risk classification under an FDIC risk-based assessment system. An institution’s risk classification is assigned based on its capital levels and the level of supervisory concern the institution poses to its regulators. Bank failures significantly depleted the FDIC’s Deposit Insurance Fund and reduced the ratio of reserves to insured deposits. As a result of recent economic conditions and the enactment of the Dodd-Frank Reform Act, banks are now assessed deposit insurance premiums based on the bank’s average consolidated total assets, and the FDIC has modified certain risk-based adjustments, which increase or decrease a

Table of Contents

bank’s overall assessment rate. This has resulted in increases to the deposit insurance assessment rates, and thus raised deposit premiums for many insured depository institutions. If these increases are insufficient for the Deposit Insurance Fund to meet its funding requirements, further special assessments or increases in deposit insurance premiums may be required. We are generally unable to control the amount of premiums that we are required to pay for FDIC insurance. If there are additional bank or financial institution failures, we may be required to pay even higher FDIC premiums than the recently increased levels. Any future additional assessments, increases or required prepayments in FDIC insurance premiums could reduce our profitability, may limit our ability to pursue certain business opportunities or otherwise negatively impact our operations.

Revenues and profitability from our investment advisory business may be adversely affected by any reduction in assets under management, which could reduce fees earned.

PWW, our investment advisory business derives the majority of its revenue from noninterest income, which primarily consists of investment advisory fees. Substantially all of PWW’s revenues are generated from investment management contracts with clients. Under these contracts, the investment advisory fees paid to us are typically based on the market value of assets under management. Assets under management may decline for various reasons including declines in the market value of the assets, which could be caused by price declines in the securities markets. Assets under management may also decrease due to redemptions and other withdrawals by clients or termination of contracts. This could be in response to adverse market conditions or in pursuit of other investment opportunities. If the assets under management we supervise decline and there is a related decrease in fees, it will negatively affect our results of operations.

We may not be able to attract and retain investment advisory clients.

Due to strong competition, our investment advisory business may not be able to attract and retain clients. Competition is strong because there are numerous well-established and successful investment management and wealth advisory firms including commercial banks and trust companies, investment advisory firms, mutual fund companies, stock brokerage firms, and other financial companies. Many of our competitors have greater resources than we have. Our ability to successfully attract and retain investment advisory clients is dependent upon our ability to compete with competitors’ investment products, level of investment performance, client services and marketing and distribution capabilities. If we are not successful, our results of operations and financial condition may be negatively impacted.

The investment advisory industry is subject to extensive regulation, supervision and examination by regulators, and any enforcement action or adverse changes in the laws or regulations governing our business could decrease our revenues and profitability.

As an investment advisor registered with the Securities and Exchange Commission, PWW is subject to regulation by a number of regulatory agencies that are charged with safeguarding the integrity of the securities and other financial markets and with protecting the interests of customers participating in those markets. In the event of non-compliance with regulation, governmental regulators, including the SEC, and the Financial Industry Regulatory Authority, may institute administrative or judicial proceedings that may result in censure, fines, civil penalties, the issuance of cease-and-desist orders or the deregistration or suspension of the non-compliant broker-dealer or investment adviser or other adverse consequences. The imposition of any such penalties or orders could have a material adverse effect on the wealth management segment’s operating results and financial condition. We may be adversely affected as a result of new or revised legislation or regulations. Regulatory changes have imposed and may continue to impose additional costs, which could adversely impact our profitability.

If we fail to retain PWW’s key employees, the growth and profitability of our investment advisory business could be adversely affected.

PWW’s success is, and is expected to remain, highly dependent on its executive management team as well as other key personnel because of their role in, among other things, making investment decisions for PWW clients and

Table of Contents

managing client relations. Although each of the foregoing are subject to non-compete agreements, there are no assurances that these key personnel will remain employees of PWW.

Competition for investment advisory personnel is intense, and we may not be successful in attracting or retaining qualified personnel. Our failure to compete for these personnel, or the loss of the services of several of such key personnel, could adversely affect our growth strategy and seriously harm our business, results of operations and financial condition.

REGULATORY AND LEGAL RISKS

We are subject to extensive regulation that could limit or restrict our activities and impose financial requirements or limitations on the conduct of our business, which limitations or restrictions could adversely affect our profitability.

As a bank holding company, we are primarily regulated by the Federal Reserve. The Bank is primarily regulated by the BFI and the Federal Reserve. These regulatory authorities have extensive discretion in connection with their supervisory and enforcement activities, including the imposition of restrictions on the operation of a financial institution, the classification of assets by a financial institution and the adequacy of a financial institution’s allowance for credit losses. The Company periodically reviews its policies, procedures and limits, and undertakes reporting, to ensure all guidance is appropriate for the Bank’s current and planned operations and aligns with regulatory expectations. In this regard, regulatory authorities may impose particular requirements on the Bank, which could have a material adverse effect on our results of operations. Any change in such regulation and regulatory oversight, whether in the form of regulatory policy, regulations or legislation, could have a material impact on us and our operations. Further, our compliance with Federal Reserve and the BFI regulations is costly. Because our business is highly regulated, the applicable laws, rules and regulations are subject to regular modification and change. Laws, rules and regulations may be adopted in the future that could make compliance more difficult or expensive or otherwise adversely affect our business, financial condition or prospects. For instance, such changes may limit our growth and restrict certain of our activities, including payment of dividends, mergers and acquisitions, investments, loans and interest rates charged, interest rates paid on deposits and locations of offices. We are also subject to capital requirements by our regulators.

The laws and regulations, including the Dodd-Frank Reform Act, applicable to the banking industry could change at any time, and these changes may adversely affect our business and profitability.

We are subject to extensive federal and state regulation. Because government regulation greatly affects the business and financial results of all commercial banks and bank holding companies, our cost of compliance could adversely affect our ability to operate profitably. The increased scope, complexity, and cost of corporate governance, reporting, and disclosure practices are proportionately higher for a company of our size and will affect our profitability more than that of some of our larger competitors. We expect to experience increasing compliance costs related to this supervision and regulation.

Although many provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) have been fully integrated into our operations, ongoing regulatory interpretations, enforcement activities, or amendments to existing regulations may continue to impact our business, financial condition, and profitability. While initial implementation costs have stabilized, any future changes in regulatory expectations, especially regarding capital requirements, consumer protection, stress-testing for smaller banks, cybersecurity, and liquidity, could result in increased compliance costs, operational complexity, and reduced flexibility in managing our business operations. We cannot predict the precise nature, extent, or timing of any additional regulatory requirements, but such developments could materially affect our operations, increase operational expenses, reduce profitability, or restrict our ability to pursue strategic opportunities or pay dividends.

‎

Table of Contents

Consumer Financial Protection Bureau Oversight

We remain subject to the oversight of consumer financial protection regulations enforced by various agencies, including the Consumer Financial Protection Bureau (“CFPB”). While recent judicial and legislative actions have led to uncertainty regarding the future authority and structure of the CFPB, consumer protection regulations continue to apply through other federal agencies. Any significant changes to consumer protection enforcement or regulatory oversight could impact our compliance obligations, potentially increasing operational complexity or affecting our business practices, operational costs, and customer relationships.

Qualified Mortgage Provisions (2025)

We originate residential mortgage loans subject to the Consumer Financial Protection Bureau’s (CFPB) Qualified Mortgage (QM) rules established under the Dodd-Frank Act. Recent amendments have adjusted QM criteria, and while uncertainties regarding compliance obligations have largely stabilized, future regulatory interpretations or additional revisions to QM standards could impact our lending practices. Although we currently believe our residential mortgage lending practices comply fully with applicable QM requirements, changes to these rules, interpretations, or enforcement practices could increase compliance costs, limit our lending flexibility, or potentially expose us to litigation risk or regulatory scrutiny.

Compliance with the Dodd-Frank Reform Act will increase our regulatory compliance burdens, and may increase our operating costs and may adversely impact our earnings or capital ratios, or both.

Signed into law on July 21, 2010, the Dodd-Frank Reform Act has represented a significant overhaul of many aspects of the regulation of the financial services industry. Among other things, the Dodd-Frank Reform Act created the CFPB, tightened capital standards, imposed clearing and margining requirements on many derivatives activities and generally increased oversight and regulation of financial institutions and financial activities.

In addition to the self-implementing provisions of the statute, the Dodd-Frank Reform Act calls for over 200 administrative rulemakings by numerous federal agencies to implement various parts of the legislation. While many rules have been finalized or issued in proposed form, additional rules have yet to be proposed. It is not possible at this time to predict when all such additional rules will be issued or finalized, and what the content of such rules will be. We will have to apply resources to ensure that we are in compliance with all applicable provisions of the Dodd-Frank Reform Act and any implementing rules, which may increase our costs of operations and adversely impact our earnings or capital, or both.

The Dodd-Frank Reform Act and any implementing rules that are ultimately issued could have adverse implications on the financial industry, the competitive environment and our ability to conduct business.

The short-termand long-term impact of regulatory capital requirements and capital rules is uncertain.

Under the capital standards, in order to be well-capitalized, the Bank is required to have a common equity to Tier 1 capital ratio of 6.5% and a Tier 1 capital ratio of 8.0%. The application of more stringent capital requirements for the Bank could, among other things, result in lower returns on invested capital, require the raising of additional capital and result in regulatory actions if we were to be unable to comply with such requirements. Furthermore, the imposition of liquidity requirements in connection with the implementation of Basel III could result in our having to lengthen the term of our funding, restructure our business models or increase our holdings of liquid assets, or all or any combination of the foregoing. Implementation of changes to asset risk weightings for risk based capital calculations, items included or deducted in calculating regulatory capital or additional capital conservation buffers, or both, could result in management modifying its business strategy, and could limit our ability to make distributions, including paying out dividends or buying back shares.

Table of Contents

institutions and depository institution holding companies that have less than $10 billion in total consolidated assets and meet other qualifying criteria, including a leverage ratio (equal to tier 1 capital divided by average total consolidated assets) of greater than 9 percent, will be eligible to opt into the community bank leverage ratio framework (qualifying community banking organizations). Qualifying community banking organizations that elect to use the community bank leverage ratio framework and that maintain a leverage ratio of greater than 9 percent will be considered to have satisfied the generally applicable risk-based and leverage capital requirements in the agencies’ capital rules (generally applicable rule) and, if applicable, will be considered to have met the well-capitalized ratio requirements for purposes of section 38 of the Federal Deposit Insurance Act. At this point the Bank has chosen not to opt in to the community bank leverage ratio framework.

RISKS RELATED TO OUR STOCK

Our ability to pay cash dividends is limited, and we may be unable to pay future dividends even if we desire to do so.

The Company is a legal entity, separate and distinct from the Bank and PWW. The Company currently does not have any significant sources of revenue other than cash dividends paid to it by the Bank and PWW. Both the Company and the Bank are subject to laws and regulations that limit the payment of cash dividends, including requirements to maintain capital at or above regulatory minimums. As a bank that is a member of the Federal Reserve System, the Bank must obtain prior written approval for any cash dividend if the total of all dividends declared in any calendar year would exceed the total of its net profits for that year combined with its retained net profits for the preceding two years. PWW’s ability to pay dividends is likewise subject to certain limits imposed by state law.

Banking regulators have indicated that Virginia banking organizations should generally pay dividends only (1) from net undivided profits of the bank, after providing for all expenses, losses, interest and taxes accrued or due by the bank and (2) if the prospective rate of earnings retention appears consistent with the organization’s capital needs, asset quality and overall financial condition. In addition, the FDIA prohibits insured depository institutions such as the Bank from making capital distributions, including the payment of dividends, if, after making such distribution, the institution would become undercapitalized as defined in the statute. Moreover, the Federal Reserve is authorized to determine under certain circumstances relating to the financial condition of a bank that the payment of dividends would be an unsafe and unsound practice and to prohibit payment thereof. The payment of dividends that deplete a bank’s capital base could be deemed to constitute such an unsafe and unsound banking practice. The Federal Reserve has indicated that banking organizations generally pay dividends only out of current operating earnings. The Bank may be prohibited under Virginia law from the payment of dividends, including in the event the BFI determines that a limitation of dividends is in the public interest and is necessary to ensure the Bank’s financial soundness.

In addition, the Bank’s ability to pay dividends will be limited if the Bank does not have the capital conservation buffer required by the capital rules, which may limit the Company’s ability to pay dividends to stockholders.

If the Bank is not permitted to pay cash dividends to the Company, it is unlikely that the Company would be able to pay cash dividends on our common stock. Moreover, holders of our common stock are entitled to receive dividends only when and if declared by our board of directors. Although we currently pay cash dividends on our common stock, we are not required to do so and our board of directors could reduce or eliminate the amount of our common stock dividends in the future.

A limited market exists for our common stock.

Our common stock commenced trading on The NASDAQ Capital Market on January 25, 2012, and trading volumes since that time have been relatively low as compared to larger financial services companies. The limited trading market for our common stock may cause fluctuations in the market value of our common stock to be exaggerated, leading to price volatility in excess of that which would occur in a more active trading market. Accordingly, holders of our common stock may have difficulty selling our common stock at prices which holders find acceptable or which accurately reflect the value of the Company.

Table of Contents

Future offerings of debt or other securities may adversely affect the market price of our stock.

In the future, we may attempt to increase our capital resources or, if our or the Bank’s capital ratios fall below the required minimums, we or the Bank could be forced to raise additional capital by making additional offerings of debt or preferred equity securities, including medium-term notes, trust preferred securities, senior or subordinated notes and preferred stock. Upon liquidation, holders of any debt securities and shares of preferred stock and lenders with respect to other borrowings will receive distributions of our available assets prior to the holders of our common stock.

Our stockholders may experience dilution due to our issuance(s) of additional securities in the future.

We may in the future issue additional shares of our common stock to raise cash for operations or to fund acquisitions, to provide equity-based incentives to our management and employees, to permit our stockholders to invest cash dividends and optional cash payments in shares of our common stock or as consideration in acquisition transactions. Additional equity offerings and issuance(s) of additional shares of our common stock may dilute the holdings of our existing stockholders or reduce the market price of our common stock, or both. No assurances can be given that the Company will not issue additional securities that will have the effect of diluting the equity interest of our stockholders. Holders of our common stock are not entitled to preemptive rights or other protections against dilution.

Virginia law and the provisions of our articles of incorporation and bylaws could deter or prevent takeover attempts by a potential purchaser of our common stock that would be willing to pay holders a premium for their shares of our common stock.

Our articles of incorporation and bylaws contain provisions that may be deemed to have the effect of discouraging or delaying uninvited attempts by third parties to gain control of us. These provisions include the division of our board of directors into classes with staggered terms, the ability of our board of directors to set the price, terms and rights of, and to issue, one or more series of our preferred stock and the ability of our board of directors, in evaluating a proposed business combination or other fundamental change transaction, to consider the effect of the business combination on us and our stockholders, employees, customers and the communities which we serve. Similarly, the Virginia Stock Corporation Act contains provisions designed to protect Virginia corporations and employees from the adverse effects of hostile corporate takeovers. These provisions reduce the possibility that a third party could effect a change in control without the support of our incumbent directors. These provisions may also strengthen the position of current management by restricting the ability of stockholders to change the composition of the board of directors, to affect its policies generally and to benefit from actions which are opposed by the current board of directors.

Item 1B.Unresolved Staff Comments

None.

Item 1.C.Cybersecurity

As a publicly-traded financial institution, we are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations and reputation, including, but not limited to, cyber-attacks against us or our service providers focused on gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data or causing operational disruption. As described below, we have risk management and governance practices and processes designed to address these risks.

The Company has established an enterprise risk management framework that outlines the processes and procedures the Company uses to identify, assess, mitigate, and monitor the risks faced by the Company, including cybersecurity risk. Within the overarching enterprise risk management framework, we have an information security program (“ISP”) designed to preserve the confidentiality, integrity, and availability of information or data on our systems and those of our service providers, as documented in our information security policy.

Table of Contents

The Company maintains an ISP to support the management of cybersecurity risk as an integral component of the Company’s ERM framework. The ISP encompasses the Company’s cybersecurity policies and practices and procedures that we use to identify, assess, mitigate, and monitor the risks faced by the Company. In addition, as part of the ISP, the Company has a Cyberecurity Incident Response Policy (“CIRP”) and Incident Response Team (“IRT”).

The IRT includes members of executive and senior management and other employees, including representatives from audit, compliance, human resources, finance, credit, information technology, information security, and legal. The IRT manages how incidents are defined, identified, and classified and ensures that procedures are in place to properly escalate, report and respond to incidents, as they are defined in the policy. The CIRP covers incident preparation, detection, analysis, and declaration, as well as plan execution and process guides for specific scenarios. Post incident activity, which covers incident termination, metrics, lessons learned, evidence retention, and plan maintenance is also included. The ISP follows relevant industry frameworks and standards set by the relevant legal and regulatory authorities and is being updated to align with the NIST Cybersecurity Framework 2.0.

The Board is responsible for the oversight of cybersecurity risk management. In 2022, we elevated the Enterprise Risk Committee to a “committee of the whole” of the Bank’s board of directors. At the second board meeting of each calendar quarter, a significant portion of the meeting is dedicated to enterprise risk management. At that board meeting, management presents the enterprise risk management matrix, including the portions related to cybersecurity, to the board. In addition, the board receives regular reports from management on our cybersecurity threat risk management and strategic processes on topics including information on any cybersecurity incidents (including any remedial actions), including, for example, results of our EDR and XDR programs.

At the management level, the Company has designated an information security officer (“ISO”). Our ISO is responsible for the overall administration and execution of the ISP and reports to our EVP-General Counsel. Our ISO has over twenty years of experience working in information security. The ISO monitors the security of, among other things, systems, applications, tools, databases, computers, websites, cloud infrastructure, vendor tools, and user access systems. The ISO also works with and oversees third-party vendors that provide us with information security services and products. The ISO performs an annual information security risk assessment, which, among other things, documents inherent risk levels and controls in place to manage those risks. The information security risk assessment is presented to the Board annually. The ISO has various professional certifications in relevant fields. The ISO is responsible for administering and executing the ISP and formulating a risk-based approach for evaluating and managing technology and cybersecurity threats.

Management determines and prioritizes appropriate risk responses for each identified enterprise risk. In doing so, executive and senior management work directly with our information technology team and our ISO. Management is accountable for our day-to-day risk management activities.

We strive to minimize the occurrence of cybersecurity incidents and the risks resulting from such incidents. However, when a cybersecurity incident does occur, the Company has in place an incident response program to guide our assessment of and response to the incident. The ISO coordinates the Company’s response to a cybersecurity incident, including investigating, recording and evaluating any potential, suspected or confirmed incidents involving non-public customer information or Company confidential information.

On a regular basis, the ISO reports to executive management and the Board information security risk issues, risk mitigation progress and developments, and information security enhancement initiatives. The ISO also reports the status of information security-related key risk indicators to executive management.

The Company employs third parties in certain aspects of its information security and cybersecurity risk management.For example, we engage third parties to assess the information security risks related to our ISP as well as information security products, services, and security infrastructure.We have adopted a Third-Party Relationship Risk Management Program to help us effectively assess, measure, monitor and control the risks associated with third party relationships, including those related to information security. The board and senior management are responsible for all

Table of Contents

vendor relationships.The ISO assesses and monitors information risks posed by third parties and any non-compliance with the controls created to address such risks.With respect to cybersecurity incidents affecting our third-party service providers, the ISO works with our service providers to understand and document any incidents, along with managing the impact to us and reporting such incidents to executive management, and, if applicable, the Board. We utilize endpoint detection and response (EDR) and extended detection and response (XDR) platforms which both align to the MITRE ATT&CK® knowledge base for threat modeling and methodologies. These assist us in detecting, investigating, and responding to actual and potential security incidents.

Based on information known to us, to date, we have not incurred any material losses related to cybersecurity incidents.However, the risk management and governance processes described above may not be sufficient to prevent cybersecurity incidents, and we could incur substantial costs and suffer other negative consequences from cybersecurity incidents.We can give no assurance that we have detected or protected against all cybersecurity threats or incidents. Please refer to “A failure in or breach of our operational or security systems or infrastructure, or those of our third party vendors and other service providers, including as a result of cyber-attacks, could disrupt our business, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs and cause losses” included “Item 1A, Risk Factors” of this Annual Report on Form 10-K for additional information about material risks related to cybersecurity threats.

Item 2.Properties

Current Locations and Property

Depending on such factors as cost, availability, and location, we may either lease or purchase our operating facilities. The existing facilities that we have purchased typically have been former branches of other financial institutions. As of March 26, 2025 the Bank conducts its operations from 21 locations, of which we own 13 and lease 8. In addition, PWW operates from 1925 Atherholt Road, Lynchburg, Virginia, which it leases from the Bank.

The following table describes the location and general character of our primary operating facilities:

Address Type of Facility Year Opened Owned/Leased

Table of Contents

501 VES RoadLynchburg, Virginia Limited-service branch 2010 Leased (3)

3562 Electric RoadRoanoke, Virginia Full-service branch with ATM 2017 Leased (6)

45 South Main StreetLexington, Virginia Full-service branch with ATM 2019 Owned

(1)The current term of the amended and restated lease expires in three years and the Bank has three five-year renewal options (subject to the terms and conditions outlined in the lease). The Bank leases this property from Jamesview Investment, LLC, which is wholly-owned by William C. Bryant III, a member of the Board of Directors of both Financial and the Bank.

(2)Base lease expires March 31, 2028. We have one or more renewal options that we may exercise at our discretion subject to the terms and conditions outlined in the lease.

Table of Contents

(3)Base lease expires May 31, 2025. We have one or more renewal options that we may exercise at our discretion subject to the terms and conditions outlined in the lease.

(4) Base lease expires April 30, 2025. We have one or more renewal options that we may exercise at our discretion subject to the terms and conditions outlined in the lease.

(5)Base lease expires October 31, 2026. We have one or more renewal options that we may exercise at our discretion subject to the terms and conditions outlined in the lease.

(6)Base lease expires January 31, 2027.

(7)Base lease expired February 28, 2021. The Bank currently leases on a month-to-month basis.

(8)Base lease expires February 28, 2029. We have one or more renewal options that we may exercise at our discretion subject to the terms and conditions outlined in the lease.

(9)This is a temporary location. We anticipate relocating to our permanent branch in the third quarter 2025.

We believe that each of these operating facilities is maintained in good operating condition and is suitable for our operational needs.

Interest in Additional Properties

On September 18, 2023, the Bank purchased real property located at 2935 Rockfish Valley Highway, Nellysford, Virginia. The building on the property previously served as a bank branch for another financial institution. The Bank anticipates that the cost to upfit the building will be minimal. The property is a subject to a restrictive covenant that prohibits the Bank from using the property for any banking-related activity until the covenant expires in September 2025. Upon opening, this branch will replace the temporary location noted in the table above.

As discussed in “Management’s Discussion and Analysis—Expansion Plans” in addition to the facilities set forth above, the Bank owns real property located at 1925 Atherholt Road, Lynchburg, Virginia, which is being held for possible expansion. The Bank purchased this property in 2021. The building currently houses all personnel of the Company’s wholly-owned subsidiary, PWW. PWW is currently leasing the space from the Bank on a month-to-month basis. While the Bank currently does not have a timeline for a branch at this location, the space is attractive for a branch due to its close proximity to Centra’s Lynchburg General Hospital. Management estimates that the investment needed to upfit the property for use as a bank branch will be minimal.

In addition, the Bank owns undeveloped property located in the Timberlake Road area of Campbell County (Lynchburg), Virginia. The Bank purchased this for possible expansion but following acquisition of the property located at 20795 Timberlake Road, the Bank put the property on the market for sale.

Management of the Bank continues to look for and evaluate additional locations for future branch growth and will consider opening an additional branch in the next 18 months if a suitable location is available on acceptable terms. The opening of all additional branches is contingent upon the receipt of regulatory approval.

We will use the internet, consistent with applicable regulatory guidelines, to augment our growth plans. We currently offer online account access, bill payment, and account management functions through our website and apps for mobile devices.

Item 3.Legal Proceedings

There are no material pending legal proceedings to which the Company is a party or to which the property of the Company is subject.

Table of Contents

Item 4.Mine Safety Disclosures

Not applicable.

PART II

Item 5.Market For Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities

Market Prices and Dividends

Since January 25, 2012, the Common Stock of Financial is listed and has been trading on the NASDAQ Capital Market LLC (NASDAQ) under the symbol “BOTJ.” Prior to this time, the Common Stock of Financial was quoted on the Over the Counter Bulletin Board (OTCBB) under the symbol “BOJF” (“BOJF.OB” on some systems) and transactions generally involved a small number of shares.

As of March 26, 2025, there were approximately 4,543,338 shares of Common Stock outstanding, which shares are held by approximately 1,500 active shareholders of record.

Dividend Policy

The Company’s future dividend policy is subject to the discretion of its Board of Directors and will depend upon a number of factors, including future earnings, financial condition, liquidity and capital requirements of both the Company and the Bank, applicable governmental regulations and policies and other factors deemed relevant by its Board of Directors.

The Company is organized under the Virginia Stock Corporation Act, which prohibits the payment of a dividend if, after giving it effect, the corporation would not be able to pay its debts as they become due in the normal course of business or if the corporation’s total assets would be less than the sum of its total liabilities plus the amount that would be needed, if the corporation were to be dissolved, to satisfy the preferential rights upon dissolution of any preferred shareholders.

The Company is a legal entity separate and distinct from its subsidiaries. Its ability to distribute cash dividends will depend primarily on the ability of the Bank and PWW to pay dividends to it, and the Bank is subject to laws and regulations that limit the amount of dividends that it can pay. As a state member bank, the Bank is subject to certain restrictions imposed by the reserve and capital requirements of federal and Virginia banking statutes and regulations. For a discussion of these restrictions, see “Supervision and Regulation of Financial – Limits on the Payment of Dividends” in Item 1 of this Report on Form 10-K. PWW’s ability to pay dividends is subject to certain limits imposed by state law.

On January 21, 2025 Financial declared a cash dividend for the fourth quarter of 2024 of $0.10 per common share. The dividend was paid on March 21, 2025 to shareholders of record at the close of business on March 7, 2025. Financial will evaluate the factors set forth above when making a determination of whether to continue to pay a cash dividend in 2025.

Financial does not have an active stock repurchase plan and during the quarter ended December 31, 2024, Financial repurchased no shares of common stock.

On February 6, 2023, the Company’s board of directors approved a stock repurchase plan to purchase up to $998,000 of the Company’s common stock. The plan authorized the Company to make purchases from March 8, 2023 through March 7, 2024, unless extended or sooner terminated. The plan allowed the Company to make purchases in open market transactions or privately negotiated transactions, in accordance with Rule 10b5-1 and Rule 10b-18 under the Securities Exchange Act of 1934, as amended. Pursuant to the Plan, the Company purchased an aggregate of 85,319 shares between the adoption date and April 6, 2023. Because the Company used substantially all of the funds allocated

Table of Contents

under the Plan, on April 18, 2023, the Company’s board of directors terminated the repurchase plan. Following the termination, the Company did not have a stock repurchase plan in place.

Item 6.[Reserved]

Item 7.Management’s Discussion and Analysis of Financial Condition and Results of Operations

The following discussion is intended to assist readers in understanding and evaluating our financial condition and results of operations. You should read this discussion in conjunction with our financial statements and accompanying notes included elsewhere in this report. Bank of the James Financial Group, Inc. (“Financial”) has no material operations and conducts no business other than the ownership of its operating subsidiaries, Bank of the James (and its divisions and subsidiary), and Pettyjohn, Wood & White, Inc., which was acquired on December 31, 2021. However, for ease of reading and because our financial statements are presented on a consolidated basis, references to “we,” “us,” or “our” refer to Financial, Bank of the James, and their divisions and subsidiaries as appropriate.

Cautionary Statement Regarding Forward-Looking Statements

This report contains statements that constitute “forward-looking statements” within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended, and the Private Securities Litigation Reform Act of 1995. Statements made in this document and in any documents that are incorporated by reference which are not purely historical are forward-looking statements, including any statements regarding descriptions of management’s plans, objectives, or goals for future operations, products or services, and forecasts of its revenues, earnings, or other measures of performance. Forward-looking statements are based on current management expectations and, by their nature, are subject to risks and uncertainties. These statements generally may be identified by the use of words such as “believe,” “expect,” “anticipate,” “plan,” “estimate,” “should,” “will,” “intend,” or similar expressions. Shareholders should note that many factors, some of which are discussed elsewhere in this document, could affect the future financial results of Financial and could cause those results to differ materially from those expressed in forward-looking statements contained in this document. These factors, many of which are beyond Financial’s control, include, but are not necessarily limited to the following:

the effects of a pandemic on the business, customers, employees and third-party service providers of Financial or any of its acquisition targets;

problems with technology utilized by us;

potential exposure to fraud, negligence, computer theft and cyber-crime, and the Company’s ability to maintain the security of its data processing and information technology systems;

operating, legal and regulatory risks, including the effects of legislative or regulatory developments affecting the financial industry generally or Financial specifically;

government legislation and policies (including the impact of the Dodd-Frank Wall Street Reform and the Consumer Protection Act and its related regulations);

economic, market, political and competitive forces affecting Financial’s banking and other businesses;

competition for our customers from other providers of financial services; government legislation and regulation relating to the banking industry (which changes from time to time and over which we have no control) including but not limited to the Dodd-Frank Wall Street Reform and Consumer Protection Act;

reliance on our management team, including our ability to attract and retain key personnel;

changes in interest rates, monetary policy and general economic conditions, which may impact Financial’s net interest income;

changes in the value of real estate securing loans made by the Bank;

adoption of new accounting standards or changes in existing standards;

compliance or operational risks related to new products, services, ventures, or lines of business, if any, that Financial may pursue or implement;

Table of Contents

the risk that Financial’s analysis of these risks and forces could be incorrect and/or that the strategies developed to address them could be unsuccessful;

the stability of the overall banking industry in the United States;

liquidity and perceived liquidity in the banking industry in the United States;

Bank of the James Financial Group Inc BOTJ US Equity

BOTJ · 10-K · period ended 2024-12-31

Item 1.Business

Item 1A.Risk Factors

Item 1B.Unresolved Staff Comments

Item 1.C.Cybersecurity

Item 2.Properties

Item 3.Legal Proceedings

Item 4.Mine Safety Disclosures

Item 5.Market For Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities

Item 6.[Reserved]

Item 7.Management’s Discussion and Analysis of Financial Condition and Results of Operations

Bank of the James Financial Group Inc BOTJ US Equity☆

BOTJ · 10-K · period ended 2024-12-31

Item 1.Business

Item 1A.Risk Factors

Item 1B.Unresolved Staff Comments

Item 1.C.Cybersecurity

Item 2.Properties

Item 3.Legal Proceedings

Item 4.Mine Safety Disclosures

Item 5.Market For Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities

Item 6.[Reserved]

Item 7.Management’s Discussion and Analysis of Financial Condition and Results of Operations

Bank of the James Financial Group Inc BOTJ US Equity