CBNK US Equity☆

cbnk-20251231

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended December 31, 2025

OR

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15 (D) OF THE SECURITIES EXCHANGE ACT OF 1934

For the Transition Period from to

Commission file number 001-38671

CAPITAL BANCORP, INC.

(Exact name of registrant as specified in its charter)

(Address of principal executive offices) (Zip Code)

(301) 468-8848

Registrant’s telephone number, including area code

Securities registered pursuant to Section 12(b) of the Act:

Title of Each Class Trading Symbol Name of Each Exchange on Which Registered

Common Stock, par value $0.01 per share CBNK The NASDAQ Stock Market, LLC

Securities registered pursuant to Section 12(g) of the Act: None.

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☐ Noý

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ Noý

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yesý No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yesý No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer ☐ Accelerated filer ý

Non-accelerated filer ☐ Smaller reporting company ☒

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ý

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ý

The aggregate market value of the voting and non-voting common equity held by non-affiliates of the registrant as of June 30, 2025 was $374.6 million.

As of March 12, 2026, the registrant had 16,369,844 shares of common stock outstanding.

DOCUMENTS INCORPORATED BY REFERENCE

The information required by Items 10, 11, 12, 13 and 14 of Part III of this Annual Report on Form 10-K will be found in the Company’s definitive proxy statement for its 2026 Annual Meeting of Stockholders, to be filed pursuant to Regulation 14A under the Securities Exchange Act of 1934, as amended, and such information is incorporated herein by this reference.

Capital Bancorp, Inc. and Subsidiaries

Annual Report on Form 10-K

Index

PART I Page

Item 1. Business 6

Item 1A. Risk Factors 21

Item 1B. Unresolved Staff Comments 36

Item 1C. Cybersecurity 36

Item 2. Properties 38

Item 3. Legal Proceedings 39

Item 4. Mine Safety Disclosures 39

PART II

Item 6 [Reserved] 41

Item 7A. Quantitative and Qualitative Disclosures about Market Risk 72

Item 8. Financial Statements and Supplementary Data 75

Item 9A. Controls and Procedures 143

Item 9B. Other Information 146

Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections 146

PART III

Item 10. Directors, Executive Officers and Corporate Governance 147

Item 11. Executive Compensation 147

Item 14. Principal Accountant Fees and Services 147

PART IV

Item 15. Exhibits and Financial Statement Schedules 148

PRIVATE SECURITIES LITIGATION REFORM ACT SAFE HARBOR STATEMENT

This Annual Report on Form 10-K and oral statements made from time-to-time by our representatives contain “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995 that are subject to risks and uncertainties. You should not place undue reliance on such statements because they are subject to numerous risks and uncertainties relating to our operations and the business environment in which we operate, all of which are difficult to predict and many of which are beyond our control. Forward-looking statements include information concerning our possible or assumed future results of operations, including descriptions of our business strategy, expectations, beliefs, projections, anticipated events or trends, growth prospects, financial performance, and similar expressions concerning matters that are not historical facts. These statements often include words such as “may,” “believe,” “expect,” “anticipate,” “potential,” “opportunity,” “intend,” “endeavor,” “plan,” “estimate,” “could,” “project,” “seek,” “should,” “will,” or “would,” or the negative of these words and phrases or similar words and phrases.

These forward-looking statements are subject to risks and uncertainties that could cause actual results, performance or achievements to differ materially from those projected. These risks and uncertainties, some of which are beyond our control, include, but are not limited to:

General Economic, Macro and External Conditions

•the strength of the United States (“U.S.”) economy and general economic conditions (including the interest rate environment, government economic and monetary policies, the strength of global financial markets, inflation/deflation and the overall strength of the consumer) that impact the financial services industry as a whole and/or our business;

•the concentration of our business in certain geographies and the effect of changes in economic, political and environmental conditions in those markets, including proposed reductions in the federal workforce and a decline in federal government spending;

•interest rate risk associated with our business, including sensitivity of our interest earning assets and interest-bearing liabilities to changes in interest rates, and the impact to our earnings from changes in interest rates;

•geopolitical conditions, including acts or threats of terrorism, actions taken by the U.S. or other governments in response to acts or threats of terrorism and/or military conflicts, including the ongoing war in Ukraine, which could impact business and economic conditions in the U.S. and abroad;

•climate change, and other catastrophic events or disasters, acts of terrorism, an outbreak of hostilities or other international or domestic calamities, and other matters beyond our control;

•the impact of changes in the Federal Deposit Insurance Corporation (“FDIC”) insurance assessment rate or the rules and regulations related to the calculation of the FDIC insurance assessment amount, including any special assessments;

•changes in U.S. trade policies, including the implementation of tariffs and other protectionist trade policies;

•the effects of federal government shutdowns, debt ceiling standoff, or other fiscal policy uncertainty;

•volatility in our stock price due to investor sentiment and perception of the banking industry;

•the impact of governmental efforts to restructure or adjust the U.S. financial regulatory system;

•changes in the laws, rules, regulations, interpretations or policies relating to financial institutions, accounting, tax, trade, monetary and fiscal matters;

•the financial soundness of other financial institutions;

General Business Operations

•our ability to prudently manage our growth and execute our strategy;

•the effect of acquisitions we have undertaken, such as our acquisition of Integrated Financial Holdings, Inc. (“IFH”), including, without limitation, the failure to achieve the expected revenue growth and/or expense savings from such acquisitions, and/or the failure to effectively integrate an acquisition target into our operations, including with regard to the planned growth of Windsor AdvantageTM;

•strategic acquisitions we may undertake to achieve our goals;

•our dependence on our management team and board of directors and changes in management and board composition;

•increased competition in the financial services industry, particularly from regional and national banks, financial holding companies, and other traditional and non-traditional financial services providers;

•our plans to grow our commercial real estate and commercial business loan portfolios which may carry material risks of non-payment or other unfavorable consequences;

•changes in the mix of loan sectors, or types, and the level of non-performing assets, charge-offs, and delinquencies;

•adequacy of reserves, including our allowance for credit losses (“ACL”);

•deterioration of our asset quality;

•results of examinations of us by our regulators, including the possibility that our regulators may, among other things, require us to increase our ACL or to write-down assets;

•risks associated with our residential mortgage banking business;

•risks associated with our OpenSkyTM credit card division, including compliance with applicable consumer finance and fraud prevention regulations;

•changes in Small Business Administration ("SBA") and U.S. Department of Agriculture ("USDA") U.S. government guaranteed lending rules, regulations, loan and lease products and funding limits, as well as changes in SBA or USDA standard operating procedures, all of which could impact our ability to originate these types of loans within Capital Bank, N.A. or the servicing, processing and packaging by Windsor AdvantageTM of such loans on behalf of others;

•changes in the value of the collateral securing our loans;

•operational risks associated with our business;

•the adequacy of our risk management framework;

•our dependence on our information technology and telecommunications systems, including third party vendors, and the potential for any data privacy incidents or other systems failures,

interruptions, or security breaches and risks related to the development and use of artificial intelligence (“AI”);

•our ability to develop and use technologies to provide products and services that will satisfy customer demands;

•potential exposure to fraud, negligence, computer theft and cyber crime;

•the sufficiency of our capital, including sources of capital and the extent to which we may be required to raise additional capital to meet our goals;

•liquidity and funding risks associated with our business;

•our ability to maintain important customer deposit relationships and our reputation;

•our ability to attract, develop, motivate and retain skilled employees;

•fluctuations in the fair value of our investment securities;

•our engagement in derivative transactions;

•volatility and direction of market interest rates;

•our dependence upon outside third parties for the processing and handling of our records and data;

•changes to local rent control laws, which may impact the credit quality of multifamily housing loans;

•our involvement from time to time in legal proceedings, examinations and remedial actions by regulators;

•our ability to assess the effect of and incorporate the evolving uses of AI on our business

•the effectiveness of the Company’s internal control over financial reporting and disclosure controls and procedures;

•our ability to remediate the material weakness in the Company’s internal control over financial reporting; and

•other factors that are discussed in Item 1A. Risk Factors.

As you read and consider forward-looking statements, you should understand that these statements are not guarantees of performance or results. They involve risks, uncertainties and assumptions and can change as a result of many possible events or factors, not all of which are known to us or in our control. Although we believe that these forward-looking statements are based on reasonable assumptions, beliefs, and expectations, if a change occurs or our beliefs, assumptions or expectations were incorrect, our business, financial condition, liquidity and/or results of operations may vary materially from those expressed in our forward-looking statements. You should be aware that many factors could affect our actual financial results or results of operations and could cause actual results to differ materially from those in the forward-looking statements. These factors include those described under Item 1A. hereunder.

You should keep in mind that any forward-looking statement made by us speaks only as of the date on which we make it. New risks and uncertainties arise from time to time, and it is impossible for us to predict these events or how they may affect us. We have no duty to, and do not intend to, and disclaim any obligation to, update or revise any industry information or forward-looking statements after the date on which they are made. In light of these risks and uncertainties, you should keep in mind that any

forward-looking statement made in this report or elsewhere might not reflect actual results and may prove unreliable.

PART I

In this Annual Report on Form 10-K, unless we state otherwise or the context otherwise requires, references to “we,” “our,” “us,” “the Company” and “Capital” refer to Capital Bancorp, Inc. and its wholly owned subsidiaries, Capital Bank, N.A., which we sometimes refer to as “Capital Bank,” “the Bank” or “our Bank,” Church Street Capital, LLC, which we sometimes refer to as “Church Street Capital” or “CSC”, and Windsor Advantage, LLCTM, which we sometimes refer to as “Windsor AdvantageTM” or “WindsorTM.”

ITEM 1. BUSINESS

We are Capital Bancorp, Inc., a bank holding company and a Maryland corporation incorporated in 1998, operating primarily through our wholly-owned subsidiary, Capital Bank, N.A., a commercial-focused community bank based in the Washington, D.C. and Baltimore metropolitan areas. The Bank is headquartered in Rockville, Maryland, received its charter in 1999 and began operations the same year. We serve businesses, not-for-profit associations, entrepreneurs and others throughout the Washington, D.C., Baltimore, other Maryland markets, Delaware, Florida, Illinois, and North Carolina through seven commercial bank branches, one mortgage banking office, three loan production offices, three government loan servicing offices, and one credit card operations office.

On October 1, 2024, the Company completed its acquisition of IFH. At the effective time of the merger, IFH merged with and into the Company, with the Company continuing as the surviving corporation in the acquisition. Immediately following the acquisition, West Town Bank & Trust, merged with and into Capital Bank, with Capital Bank as the surviving bank. Windsor AdvantageTM, a wholly owned subsidiary of the Company, was acquired in connection with the IFH acquisition.

The Company currently operates four divisions and reporting segments: Commercial Banking, OpenSkyTM, Windsor AdvantageTM, and Capital Bank Home Loans (“CBHL”). In determining the appropriateness of segment definition, the Company considers components of the business about which financial information is available and regularly evaluated relative to resource allocation and performance assessment. The accompanying consolidated financial statements have been prepared in accordance with GAAP, and conform to general practices within the banking industry.

Our Commercial Banking division primarily operates within a corridor extending from Raleigh, North Carolina to Delaware, with significant activity in the Washington, D.C. and Baltimore metropolitan statistical areas. The Commercial Bank also maintains offices in Chicago, Illinois and Fort Lauderdale, Florida. In addition to providing relationship-driven banking services within its primary geographic markets, the Commercial Bank conducts certain lending and deposit activities on a nationwide basis through specialized verticals. These lending verticals include lender finance, government guaranteed lending and other forms of commercial and industrial (“C&I”) lending. The Commercial Bank also operates national deposit verticals serving homeowners associations (“HOAs”), title companies, political action committees (“PACs”), not-for-profit organizations, and other commercial clients.

OpenSkyTM and CBHL both leverage Capital Bank’s national banking charter to operate national consumer business lines. OpenSkyTM provides nationwide, digitally-originated and served, secured, partially-secured, and unsecured credit cards to under-banked populations and those looking to rebuild their credit scores. CBHL acts as our residential mortgage origination platform. Windsor AdvantageTM generates fee revenue for the Company through its servicing, processing and packaging of SBA and USDA loans for its financial institution clients.

In addition to its subsidiaries discussed above, Capital Bancorp, Inc. owns all of the stock of Capital Bancorp (MD) Statutory Trust I (the “Trust”). The Trust is a special purpose, non-consolidated entity organized for the sole purpose of issuing trust preferred securities.

Commercial Banking Division

The Commercial Banking division operates out of seven full service banking locations, three of which are in the Washington, D.C. Metropolitan Statistical Area (“MSA”), and its full service banking locations in Columbia, Maryland in the Baltimore, Maryland MSA, in Ft. Lauderdale, Florida in the Miami Metro Area MSA, in Chicago, Illinois in the Chicago MSA, and in Raleigh, North Carolina in the Raleigh MSA. Additionally, we have three loan production offices, one located in the Washington, D.C. area, one in Columbia, Maryland, and one in Towson, Maryland. Our Commercial Banking division’s commercial loan officers and commercial real estate loan officers provide C&I, commercial real estate, including lender finance loans, and construction lending solutions to business clients in Capital Bank’s operating markets.

Government guaranteed lending serves customers throughout the country in need of, and qualifying for, USDA and SBA loans. We generally sell the government guaranteed portion of USDA and SBA loans into the secondary market while retaining the non-guaranteed portion of the loan and the servicing rights. This allows us to realize one time gain on sale income along with a recurring servicing and interest revenue stream. In addition to the business development officers upon whom we rely to generate new business, we also have a dedicated servicing, portfolio management and workout staff with specialized expertise in U.S. government guaranteed loans.

Construction lending is a core competency of our Commercial Banking division. Our construction loan portfolio provides Capital Bank with short duration, higher yield loans. Our construction lending is focused on commercial and residential construction projects within the Washington, D.C. and Baltimore-Columbia-Towson, Maryland metropolitan operating areas, with limited exposure to suburban subdivision tract development.

Lender finance loans are loans to companies used to purchase finance receivables or extend finance receivables to the underlying obligors and are secured primarily by the finance receivables held by our borrowers.

In addition to its loan officers, who have incentives and goals to drive core deposit growth, our Commercial Banking division currently has a team of business development officers concentrating on continuing to diversify and grow Capital Bank’s core deposit funding and lessen the dependency on wholesale funding. These officers seek to grow deposits generally across the commercial client customer base and through several specialized deposit channels serving multiple sectors nationwide including the homeowner’s association sector, the title insurance sector, political action committees and not-for-profits.

Capital Bank Home Loans Division

Capital Bank Home Loans (“CBHL”) originates conventional and government guaranteed residential mortgage loans on a nationwide basis primarily for sale into the secondary market and, in certain circumstances, for our loan portfolio. Loans sold into the secondary market are sold servicing released. Our residential loan portfolio aims to retain high-quality, lower risk loans which support the Company’s business strategies. A portion of the retained residential portfolio is represented by mortgage loans on primary residences within Capital Bank’s operating markets to individuals who own businesses where Capital Bank may also pursue a commercial lending relationship and has a vested interest in maintaining the fullest possible banking relationship.

Approximately 78.5% of CBHL loan originations by volume occur within Maryland, Virginia, Delaware and Washington, D.C. The remainder of originations are national in scope and originate primarily through a direct-to-consumer model that utilizes consumer marketing and social media applications.

OpenSkyTM Secured Credit Card Division

The OpenSkyTM Division provides secured, partially secured and unsecured credit cards on a nationwide basis.

The secured credit cards require a minimum initial deposit of $100 and permit maximum initial deposits of $3,000 per card and $10,000 per individual. OpenSkyTM focuses on under-banked populations and those looking to rebuild their credit scores. In order to obtain a secured credit card from us, the customer must select a credit line amount that the customer secures with a matching deposit amount. A deposit equal to the full credit limit of the card is made into a noninterest-bearing demand account with the Bank. Once the account is opened, the deposit is required to be maintained throughout the life of the card. The customer’s funding of the deposit account is collateral and while it is not a consideration in the credit card approval process, it is a prerequisite to activating the credit line. Once the customer’s deposit account has been funded, the credit line is activated and the collateral funds are generally available to absorb potential losses on the account that may occur. Given the secured nature of the cards, credit history inquiries are not required at the time of application.

The partially secured credit card uses our proprietary scoring model, which considers among other things, credit score and repayment history (typically a minimum of six months of on-time repayments, but ultimately determined on a case-by-case basis), to offer certain existing customers an unsecured line supplementary to their secured line of credit. As each customer’s secured account ages, we obtain credit scores to baseline the customer’s improvement as an input into any decision to extend unsecured credit.

The unsecured credit card was added, for qualifying existing customers, in the fourth quarter of 2021 to expand the OpenSkyTM product offering. The addition of the unsecured card allows for an uninterrupted experience for OpenSkyTM customers who can now more easily transition from a secured to unsecured credit card and continue their relationship with the Bank. At December 31, 2025, 31% of our credit card customers had a FICO score in excess of 660 and were considered prime and 33% of outstanding credit card balances were unsecured.

OpenSkyTM cards operate on a digital and mobile enabled platform with almost all marketing and application procedures being conducted through website and mobile applications. OpenSkyTM credit cards have variable interest rates, which are beneficial to us in a rising rate environment. We believe the OpenSkyTM secured credit card product may provide a counter-cyclical benefit as more people may enter our target segment of credit rebuilders during an economic downturn. Credit card eligibility for all product offerings is based on identity and income verification.

Capital Bank uses data analytics, including AI and proprietary models, throughout the OpenSkyTM customer lifecycle to support fraud prevention and credit decisioning. During onboarding, these tools are used to help validate identity, verify eligibility and income, and inform which customers may receive offers for additional credit. After account opening, credit card transactions are evaluated in real-time to help assess transaction legitimacy and detect potentially fraudulent activity. The Bank also uses portfolio monitoring and behavioral models to provide management with insight into credit trends, identify emerging risk, mitigate potential losses, and inform actions intended to optimize account profitability over the life of the relationship.

Windsor AdvantageTM Division

Windsor AdvantageTM is a loan service provider that offers community banks and credit unions a comprehensive outsourced SBA and USDA lending platform. Windsor AdvantageTM generates fee income for the Company through its servicing, processing and packaging of such loans for its financial institution clients, including Capital Bank. Gross government loan servicing revenue totaled $19.6 million, including $4.1 million of Capital Bank related servicing fees, for the year ended December 31, 2025. Windsor

Advantage'sTM total servicing portfolio was $3.1 billion, including $1.3 billion attributable to Capital Bank at December 31, 2025.

Our Business Strategy

We believe that by using technology-enabled strategies and advice-based solutions, we can deliver attractive shareholder returns in excess of our cost of capital. While regulations, technology and competition have fundamentally impacted the economics of the banking sector, we continue to adopt strategies that we believe will drive growth while maintaining consistent profitability and enhancing shareholder value, including:

Deliver premium advice-based solutions that drive organic loan and core deposit growth with corresponding net interest income and fee revenues

•Serve as financial partners to our customers, helping them to grow their businesses through advice-based financial solutions;

•Endeavor to provide comprehensive loan and deposit solutions to our customers that are tailored to their needs, and leverage data, analytics and financial technology to improve the customer experience;

•Scale our consumer fee-based platforms by investing in fintech and other capabilities, while leveraging digital marketing to deliver high impact products and services and differentiated customer experience;

•Grow new loan and deposit verticals and products where we have a competitive advantage;

•Capitalize on market dislocation from recent in-market acquisitions to attract top sales talent, and acquire new commercial banking relationships from local competitors; and

•Selectively add banking centers where sales teams have already proved an ability to capture market share and leverage customer relationships.

Leverage technology to improve the customer experience and loyalty and deliver operational efficiencies

•Use solution structuring and customized technology implementation as differentiators to add value to clients with complex needs and enhance our relationships within our existing customer base;

•Deploy technologies that better support our lending associates and simplify our processes;

•Maximize the potential of web-based and mobile banking applications to drive core funding while maintaining our branch-lite business model; and

•Enhance cross-selling capabilities among our OpenSkyTM, Capital Bank Home Loans and Commercial Banking division customers.

Increase scale in our fee-based platforms through delivery of high value products and services

•Utilize our customer acquisition capabilities, and leverage our investment in our core processing systems, together with our expertise in data, analytics and marketing, to deliver new products and services and grow our secured credit card business;

•Retain OpenSkyTM customers that “graduate” from our secured credit product through the limited use of partially and fully unsecured credit products;

•Expand our purchase-oriented mortgage loan sales both in-market and in adjacent markets through the hiring of qualified mortgage originators and continue to enhance our direct to consumer marketing channels; and

•Utilize the systems, processes and technology within Windsor AdvantageTM to participate in the processing and packaging of SBA and USDA loans originated by our financial institution clients and to grow associated servicing balances.

Pursue acquisitions opportunistically

•Seek strategic acquisitions that complement or supplement our existing product offerings and geographic footprint, advance our business strategies and diversify our revenue and balance sheet mix;

•Evaluate specialty finance and non-bank financial company opportunities where we can add value through increasing interest and fee income and leveraging our management’s expertise and existing strategic assets; and

•Use our management’s and Board’s expertise to structure transactions in ways that minimize the integration and execution risk for the Bank.

Sustainability

We aspire to be the most valued and trusted community bank within the markets we serve. We understand our obligation to both our shareholders and the communities we serve -- to be an institution that achieves superior financial performance, while contributing to the communities we serve by delivering products and services to our customers that enhance and strengthen access, equity and opportunity.

We focus our sustainability efforts on issues that are important to our business and to our key stakeholders. Our mission is to support businesses, help people and strengthen communities, as well as to grow our operations and revenue. Essential to this mission is our commitment to provide long-term, financial and social value to our stakeholders, including the communities we serve, our shareholders and our employees.

Employees and Human Capital Resources

At December 31, 2025, we employed 459 persons, of which 434 were employed on a full-time basis. None of our employees are represented by any collective bargaining unit or are a party to a collective bargaining agreement. We believe the relationship with our employees to be excellent and we have been named a Best Bank to Work For by American Banker for six of the past seven years. Our ability to attract and retain employees is a key pillar of our success. We believe we offer a competitive total compensation and benefits program and a congenial work environment to our employees.

The Company prides itself on being a values-driven organization, where employees are empowered to share ideas that keep the organization moving forward. Our company core values guide each team member to:

•Act as an Owner

•Practice Balanced Risk Management

•Challenge the Norm

•Leverage the Team

We believe that these values enable our success with our customers and have helped us build a fun, vibrant and accountability driven culture. In addition, we are committed to developing our staff through internal/external training programs, including the use of online training resources and by affording all levels of leadership within the organization an opportunity to participate in leadership development programs.

Available Information

The Company provides access to its SEC filings through its website at www.capitalbankmd.com. After accessing the website, the filings are available upon selecting “Investor Relations.” Reports available include the Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and all amendments to those reports as soon as reasonably practicable after the reports are electronically filed with or furnished to the SEC. Further, the SEC maintains an internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC at www.sec.gov. The information on, or accessible through, our website or any other website cited in this Annual Report on Form 10-K is not part of, or incorporated by reference into, this Annual Report on Form 10-K and should not be relied upon in determining whether to make an investment decision.

SUPERVISION AND REGULATION

General

We are extensively regulated under both federal and state law. These laws restrict permissible activities and investments and require compliance with various consumer protection provisions applicable to lending, deposit, brokerage and fiduciary activities. They also impose capital adequacy requirements and conditions on a bank holding company’s (“BHC”) ability to repurchase stock or to receive dividends from its subsidiary banks. We are subject to examination and supervision by the Board of Governors of the Federal Reserve (“Federal Reserve”), and the Bank is subject to comprehensive examination and supervision by the Office of the Comptroller of the Currency (“OCC”). We are required to file with the Federal Reserve quarterly and annual reports and such additional information as the Federal Reserve may require pursuant to the Bank Holding Company Act of 1956 (“BHC Act”). The Federal Reserve may conduct examinations of BHCs and their subsidiaries. The Bank’s deposits are insured by the FDIC, through the Deposit Insurance Fund (“DIF”). As a result of this deposit insurance function, the FDIC also has certain supervisory authority and powers over the Bank as well as all other FDIC insured institutions. The Company’s and the Bank’s regulators generally have broad discretion to impose restrictions and limitations on our operations. Bank regulation is intended to protect depositors and consumers and not shareholders. This supervisory framework could materially and adversely impact the conduct and profitability of our activities.

To the extent that the following information describes statutory and regulatory provisions, it is qualified in its entirety by reference to the text of the applicable statutory and regulatory provisions. Legislative and regulatory initiatives, which necessarily impact the regulation of the financial services industry, are introduced from time to time. We cannot predict whether or when potential legislation or new regulations will be enacted, and if enacted, the effect that new legislation or any implemented regulations and supervisory policies would have on our financial condition and results of operations. The Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), by way of example, contains a comprehensive set of provisions designed to govern the practices and oversight of financial institutions and other participants in the financial markets. The Dodd-Frank Act made extensive changes in the regulation of financial institutions and their holding companies. Some of the changes brought about by the Dodd-Frank Act were modified by the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 (the “Regulatory Relief Act”), signed into law on May 24, 2018. The Dodd-Frank Act has increased the regulatory burden and compliance costs borne by the Company. The Dodd-Frank Act also modified the standard by which state consumer financial laws may be applied to national banking associations, such as the Bank. The application of that standard by state regulators and the courts may

cause the Bank’s compliance burden and costs to increase. Moreover, bank regulatory agencies appear to be increasingly aggressive in responding to concerns and trends identified in examinations, which could result in higher frequency initiation of enforcement actions against financial institutions to address credit quality, liquidity, risk management and capital adequacy, as well as other safety and soundness concerns.

Regulation of Capital Bancorp, Inc.

We are registered as a BHC under the BHC Act and are subject to regulation and supervision by the Federal Reserve. The BHC Act requires us to secure the prior approval of the Federal Reserve before we own or control, directly or indirectly, more than 5% of the voting shares or substantially all of the assets of any bank or thrift, or merge or consolidate with another bank or thrift holding company. Further, under the BHC Act, our activities and those of any nonbank subsidiary are limited to: (i) those activities that the Federal Reserve determines to be so closely related to banking as to be a proper incident thereto, and (ii) investments in companies not engaged in activities closely related to banking, subject to quantitative limitations on the value of such investments. Prior approval of the Federal Reserve may be required before engaging in certain activities. In making such determinations, the Federal Reserve is required to weigh the expected benefits to the public, such as greater convenience, increased competition and gains in efficiency, against the possible adverse effects, such as undue concentration of resources, decreased or unfair competition, conflicts of interest and unsound banking practices.

Regulation of Capital Bank

The operations and investments of our Bank are subject to the supervision, examination and reporting requirements of the National Bank Act and the regulations of the OCC as well as other federal banking statutes and regulations, including with respect to the level of reserves that our Bank must maintain against deposits, restrictions on the types, amount, and terms and conditions of loans it may originate, and limits on the types of other activities in which our Bank may engage and the investments that it may make. The OCC also has the power to prevent the continuance or development of unsafe or unsound banking practices and other violations of law. Because our Bank’s deposits are insured by the FDIC to the maximum extent provided by law, it is also subject to certain FDIC regulations, and the FDIC has backup examination authority and some enforcement powers over our Bank. If, as a result of an examination of our Bank, the regulators should determine that the financial condition, capital resources, asset quality, earnings prospects, management, liquidity or other aspects of the Bank’s operations are unsatisfactory or that the Bank or our management is violating or has violated any law or regulation, various remedies are available to the regulators. Such remedies include the power to enjoin unsafe or unsound practices, require affirmative action to correct any conditions resulting from any violation or practice, issue an administrative order that can be judicially enforced, direct an increase in capital, restrict growth, assess civil monetary penalties and remove officers and directors. The regulators also may request the FDIC to terminate the Bank’s deposit insurance.

Capital Adequacy Guidelines

Bank holding companies and banks are subject to various regulatory capital requirements administered by state and federal agencies. See “Part II, Item 8. Financial Statements and Supplementary Data - Notes to Consolidated Financial Statements - Note 14, Regulatory Capital Matters” for additional regulatory capital information, including the Bank’s and Company’s leverage ratio as of December 31, 2025.

Community Reinvestment Act

The CRA requires the federal banking regulatory agencies to assess all financial institutions that they regulate to determine whether these institutions are meeting the credit needs of the communities they serve, including their assessment area(s) (as established for these purposes in accordance with

applicable regulations based principally on the location of branch offices). In addition to substantial penalties and corrective measures that may be required for a violation of certain fair lending laws, the federal banking agencies may take compliance with such laws and CRA into account when regulating and supervising other activities. Under the CRA, institutions are assigned a rating of “outstanding,” “satisfactory,” “needs to improve,” or “unsatisfactory.” A rating that is less than “satisfactory” may substantially inhibit the Bank’s opportunities for future growth. An institution’s record in meeting the requirements of the CRA is based on a performance-based evaluation system, and is made publicly available and is taken into consideration in evaluating any applications it files with federal regulators to engage in certain activities, including approval of a branch or other deposit facility, mergers and acquisitions, office relocations, and expansions into non-banking activities. Our Bank received an “outstanding” rating in its most recent CRA evaluation dated April 30, 2024, which was performed under the intermediate small bank requirements. Due to its asset size, our Bank will be evaluated under the “large bank” requirements in future CRA evaluations.

In October 2023, the OCC, together with the Federal Reserve and FDIC, issued a joint final rule to modernize the CRA regulatory framework. However, in July 2025, due to litigation, such agencies issued a joint notice of proposed rulemaking to rescind the 2023 final rule and replace it with the CRA framework that existed prior to the 2023 final rule.

Anti-Terrorism, Money Laundering Legislation and OFAC

The Bank is subject to the Bank Secrecy Act and the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (the “USA PATRIOT Act”). These statutes and related rules and regulations impose requirements and limitations on specified financial transactions and accounts and other relationships intended to guard against money laundering and terrorism financing. The principal requirements for an insured depository institution include (i) establishment of an anti-money laundering program that includes training and audit components, (ii) establishment of a “know your customer” program involving due diligence to confirm the identities of persons seeking to open accounts and to decline to open accounts for those persons unable to demonstrate their identities, (iii) the filing of currency transaction reports for deposits and withdrawals of large amounts of cash and suspicious activities reports for activity that might signify money laundering, tax evasion or other criminal activities, (iv) additional precautions for accounts sought and managed for non-U.S. persons and (v) verification and certification of money laundering risk with respect to private banking and foreign correspondent banking relationships. For many of these tasks, a bank must keep records to be made available to its primary federal regulator. Anti-money laundering rules and policies are developed by a bureau within the Financial Crimes Enforcement Network, but compliance by individual institutions is overseen by its primary federal regulator.

The Bank has established anti-money laundering and customer identification programs and it maintains records of cash purchases of negotiable instruments, files reports of certain cash transactions exceeding $10,000 (daily aggregate amount), and reports suspicious activity that might signify money laundering, tax evasion or other criminal activities pursuant to the Bank Secrecy Act.

The Treasury Department’s Office of Foreign Assets Control (“OFAC”) administers and enforces economic and trade sanctions against targeted foreign countries, persons, non-governmental organizations, associations, and criminal networks, among others, as defined by various Executive Orders and Acts of Congress. OFAC publishes lists of persons that are the target of sanctions, including the List of Specially Designated Nationals and Blocked Persons. Financial institutions are responsible for, among other things, blocking accounts of and transactions with sanctioned persons and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked and rejected transactions after their occurrence. If the Company or the Bank finds a name or other information on any transaction, account or wire transfer that is on an OFAC list or that otherwise indicates that the transaction involves a target of an OFAC-administered sanctions program, the Company or the Bank generally must freeze or block such account or transaction, file a suspicious activity report, and notify the appropriate

authorities. Banking regulators examine banks for compliance with the economic sanctions regulations administered by OFAC.

The Bank has implemented policies and procedures to comply with the foregoing requirements.

Federal Home Loan Bank Membership

The Bank is a member of the FHLB. Each member of the FHLB is required to maintain a minimum investment in the Class B stock of the FHLB. The Board of Directors of the FHLB can increase the minimum investment requirements in the event it has concluded that additional capital is required to allow it to meet its own regulatory capital requirements. Any increase in the minimum investment requirements outside of specified ranges requires the approval of the Federal Housing Finance Agency. Because the extent of any obligation to increase the level of investment in the FHLB depends entirely upon the occurrence of a future event, the Company is unable to determine the extent of future required potential payments to the FHLB. Additionally, if a member financial institution fails, the right of the FHLB to seek repayment of funds loaned to that institution will take priority (a super lien) over the rights of all other creditors.

Dividends and Share Repurchases

The ability of the Company to pay dividends or to repurchase its common stock, and the ability of the Bank to pay dividends to the Company, may be restricted due to several factors including: (a) the Maryland General Corporate Law ("MGCL," in the case of the Company), (b) covenants contained in any subordinated debentures and borrowing agreements in existence now or that may exist in the future, (c) restrictions on the ability of the Bank to declare dividends under the National Bank Act and OCC regulations (in the case of the Bank), and (d) the general supervisory authority of the Federal Reserve and the OCC. Our ability to pay dividends to our stockholders or to repurchase shares of our common stock is subject to the restrictions set forth in the MGCL.

Notification to the Federal Reserve is required prior to our declaring and paying a cash dividend to our stockholders during any period in which our quarterly and/or cumulative twelve‐month net earnings are insufficient to fund the dividend amount, among other requirements. Under such circumstances, we may not pay a dividend should the Federal Reserve object until such time as we receive approval from the Federal Reserve or no longer need to provide notice under applicable regulations. In addition, prior approval of the Federal Reserve may be required in certain circumstances prior to our repurchasing shares of our common stock.

In connection with the decision regarding dividends and share repurchase programs, our Board will take into account general business conditions, our financial results, projected cash flows, capital requirements, contractual, legal and regulatory restrictions on the payment of dividends by the Bank to the Company and such other factors as may be deemed relevant. We can provide no assurance that we will continue to declare dividends on a quarterly basis or otherwise or to repurchase shares of our common stock. The declaration of dividends by the Company is subject to the discretion of our Board.

Mergers and Acquisitions

Under the BHC Act, prior approval from the Federal Reserve System is required in order for any bank holding company to (i) acquire direct or indirect ownership or control of more than 5% of the voting shares of any bank, (ii) acquire all or substantially all of the assets of a bank, or (iii) merge or consolidate with any other bank holding company. Generally, the Company is not required to obtain prior approval from the Federal Reserve System to acquire a non-bank that engages in activities that are financial in nature or incidental to activities that are financial in nature, as long as the Company meets the capital, managerial, and CRA requirements to qualify as a financial holding company. Pursuant to Section 18(c) of the Federal Deposit Insurance Act, more commonly known as the Bank Merger Act, and for national banks relying on

certain other sources of merger authority, prior written approval from a bank's primary federal regulator is required before any insured depository institution may consummate a merger transaction, which includes a merger, consolidation, assumption of deposit liabilities, and certain asset transfers between or among two or more institutions. Prior written approval of a bank's primary federal regulator is also required for merger transactions between or among affiliated institutions, as well as for merger transactions between or among non-affiliated institutions. Transactions that do not involve a transfer of deposit liabilities typically do not require prior approval under the Bank Merger Act, unless the transaction involves the acquisition of all or substantially all of an institution's assets. When evaluating and acting on proposed merger transactions, regulators consider the extent of existing competition between and among the merging institutions, other depository institutions, and other providers of similar or equivalent services in the relevant product and geographic markets, the convenience and needs of the community to be served, capital adequacy and earnings prospects, and the effectiveness of the merger institutions in combating money-laundering activities, among other factors. Further, the Change in Bank Control Act of 1978 generally prohibits any person, acting directly or indirectly or in concert with other persons, from acquiring control of a covered institution without providing at least 60 days prior written notice to the FDIC or upon receipt of written notice that the FDIC does not disapprove of the acquisition.

On September 17, 2024, the FDIC, the OCC and the U.S. Department of Justice ("DOJ"), each announced new rules and policy statements impacting their bank merger review processes.

Among these actions, the FDIC approved a final statement of policy on bank merger transactions (the “2024 Statement”) and the OCC approved a final rule updating the agency’s regulations for business combinations involving national banks and federal savings associations. The OCC’s final rule modifies its procedures for reviewing bank merger applications under the Bank Merger Act, including the elimination of the expedited bank merger review and the streamlined application procedures. The OCC’s final rule also includes a new policy statement that addresses the substantive standards that it will use to evaluate bank merger applications, including indicators that point in favor of likely approval or rejection.

Concurrent with the FDIC and OCC announcements, the DOJ withdrew its 1995 Bank Merger Guidelines and announced that it would consider bank mergers under its 2023 Merger Guidelines, which are not industry specific, as well as under a separate, recently adopted bank merger addendum.

In May 2025, the OCC adopted an interim final rule amending the 2024 final rule to restore the expedited review and the use of the streamlined business combination. The OCC also rescinded its 2024 policy statement. Additionally, in July 2025, the FDIC rescinded the 2024 Statement and reinstated, on an interim basis, the statement of policy on bank merger transactions that was in effect prior to the 2024 Statement.

Customer Information Privacy and Cybersecurity

The Federal Reserve and other bank regulatory agencies have adopted guidelines for safeguarding confidential, personal, non‐public customer information. These guidelines require each financial institution, under the supervision and ongoing oversight of its board of directors or an appropriate committee thereof, to create, implement, and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazard to the security or integrity of such information, and protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. We have adopted a customer information security program to comply with these requirements.

The Gramm‐Leach‐Bliley Act of 1999 (the “GLBA”) requires financial institutions to implement policies and procedures regarding the disclosure of non-public personal information about consumers to non‐affiliated third parties. The GLBA requires disclosures to consumers on policies and procedures regarding the disclosure of such non-public personal information and, except as otherwise required by

law, prohibits disclosing such information except as provided in the Bank’s policies and procedures. We have implemented privacy policies addressing these restrictions that are distributed regularly to all existing and new customers of the Bank.

In March 2015, federal regulators issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing Internet-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.

In November 2021, the federal bank regulatory agencies issued a joint rule establishing computer-security incident notification requirements for banking organizations and their service providers. This rule requires new notification requirements when a banking organization experiences a computer-security incident.

State regulators have been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements.

In July 2023, the SEC adopted rules requiring registrants to disclose material cybersecurity incidents experienced and describe the material aspects of their nature, scope and timing. The rules, which supersede previously issued guidance published in February 2018, also require annual disclosures describing a company’s cybersecurity risk management, strategy and governance. These SEC rules, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations. See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity and Item 1C. Cybersecurity for a further discussion of the Company’s risk management strategies and governance processes related to cybersecurity.

Interchange Fees

Under the Durbin Amendment to the Dodd-Frank Act, the Federal Reserve adopted rules establishing standards for assessing whether the interchange fees that may be charged with respect to certain electronic debit transactions are “reasonable and proportional” to the costs incurred by issuers for processing such transactions. Interchange fees or “swipe” fees are charges that merchants pay to the Company and other card-issuing banks for processing electronic payment transactions. The Federal Reserve has ruled that for financial institutions with assets of $10 billion or more the maximum permissible interchange fee for an electronic debit transaction is the sum of 21 cents per transaction and 5 basis points multiplied by the value of the transaction. The Federal Reserve also has rules governing routing and exclusivity that require issuers to offer two unaffiliated networks for routing transactions on each debit or prepaid product. In October 2023, the Federal Reserve issued a proposal under which the maximum permissible interchange fee for an electronic debit transaction would be the sum of 14.4 cents per transaction and 4 basis points multiplied by the value of the transaction. While financial institutions with less than $10 billion in assets, like the Company, are exempt, there is concern that these requirements will eventually be pushed down to all financial institutions, which would negatively impact the Company’s non-interest income.

Consumer Financial Protection Bureau

The Dodd-Frank Act created a new, independent federal agency called the Consumer Financial Protection Bureau (“CFPB”), which is granted broad rulemaking, supervisory and enforcement powers under various federal consumer financial protection laws, including the Equal Credit Opportunity Act, Truth in Lending Act, Real Estate Settlement Procedures Act, Fair Credit Reporting Act, Fair Debt Collection Act, the Consumer Financial Privacy Provisions of the Gramm-Leach-Bliley Act, and certain other statutes. The CFPB has examination and primary enforcement authority with respect to depository institutions with $10 billion or more in assets. Smaller institutions are subject to rules promulgated by the CFPB but continue to be examined and supervised by federal banking regulators for consumer compliance purposes. The CFPB has authority to prevent unfair, deceptive, or abusive practices in connection with the offering of consumer financial products.

On March 5, 2024, the CFPB issued a final rule amending provisions in Regulation Z that govern credit card late fee charges to lower the safe harbor amount for past due fees that a credit card issuer can charge on consumer credit card accounts from up to $41 to $8 and eliminates a higher safe harbor dollar amount for late fees for subsequent violations of the same type. This rule only applies to card issuers, that together with their affiliates, have one million or more open credit card accounts. In April 2025, the final rule was vacated by the U.S. District Court for the Northern District of Texas.

In December 2024, the CFPB issued a final rule that subjects (with certain exceptions) overdraft services provided by financial institutions with more than $10 billion in assets to the provisions of the Truth in Lending Act and other consumer financial protection laws. In May 2025, President Trump signed a Congressional Review Act resolution that overturned the CFPB’s December 2024 final rule, which would have taken effect October 1, 2025.

In February 2025, the acting director of the CFPB directed the CFPB’s staff to cease all supervision and examination activity and stakeholder engagement, stop all work on proposed rulemaking, suspend the effective dates of any finalized but not yet effective rules, and halt other actions relating to investigations, enforcement, and litigation. Beyond the initial halt, the CFPB moved toward a more deregulatory stance in 2025, significantly reducing the volume of final rules and enforcement actions compared to 2024. Under the current U.S. administration, a level of heightened uncertainty exists with respect to the future of the CFPB, including its structure, staffing, and responsibilities. It remains uncertain whether, or to what extent, changes at the CFPB will impact our business and the overall regulatory environment.

Deposit Insurance

The Bank is a national banking association, regulated by the OCC. The Bank accepts deposits, and those deposits have the benefit of FDIC insurance up to the applicable limits established by law. The applicable statutory limit for FDIC insurance for most types of accounts is $250,000.

Under the FDIC's risk-based deposit premium assessment system, the assessment rates for an insured depository institution are determined by an assessment rate calculator, which is based on a number of elements that measure the risk each institution poses to the Deposit Insurance Fund. The calculated assessment rate is applied to average consolidated assets less the average tangible equity of the insured depository institution during the assessment period to determine the dollar amount of the quarterly assessment. Under the current system, premiums are assessed quarterly and could increase if, for example, criticized loans and leases and/or other higher risk assets increase or balance sheet liquidity decreases.

Under the Federal Deposit Insurance Act, the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the

FDIC. In the event any insured depository institution, such as the Bank, is placed into FDIC receivership due to the termination of deposit insurance, or for any other reason, and the institution is sold or liquidated, the chances of the institution's parent BHC's shareholders recovering any value is very unlikely.

Future Legislative Developments

Various legislative acts are from time to time introduced in Congress. This legislation may change banking statutes and the environment in which we operate in substantial and unpredictable ways. We cannot determine the ultimate effect that potential legislation, if enacted, or implementing regulations and interpretations with respect thereto, would have on our financial condition or results of operations.

The current presidential administration and many members of Congress have advocated for changes in financial services regulation, potentially including amendments to the Dodd-Frank Act and other federal banking laws, and structural changes to the CFPB. We cannot predict whether or in what form any other proposed regulations or statutes will be adopted or the extent to which our business may be affected by any new regulation or statute. These changes become less predictable, yet more likely to occur, following the transition of power from one presidential administration to another, especially as occurred in 2025, when it involves a change in the governing political party. New agency leaders have different priorities and, as a result, there have been and will be a number of proposed changes to regulations, guidance and supervisory tactics that impact our business. It is therefore unclear at the present time what effect the aforementioned changes will have on the banking industry as a whole or the Company specifically.

RISK FACTOR SUMMARY

The following provides an overview of the significant risks discussed more fully in Item 1A.

Risks Related to Our Business

•Adverse economic conditions could negatively affect us, our customers, or counterparties, leading to reduced loan demand and higher credit losses.

•Adverse developments in the financial services industry could weaken customer confidence and materially impact our liquidity and stock.

•Geographic concentration increases sensitivity to adverse changes in the local economy.

•Government shutdowns and federal spending reductions may impair borrowers’ ability to repay and pressure liquidity.

•Lending is inherently risky and we may be unable to measure or limit credit risk, resulting in unexpected losses.

•Our allowance for credit losses may be insufficient under CECL methodologies, requiring additional provisions or charge-offs in stressed environments.

•Small and medium-sized business exposure heightens loss susceptibility because those borrowers often have fewer resources to withstand economic stress.

•Commercial real estate and construction lending risks arise from sensitivity to market conditions, construction cost overruns, and challenges recovering collateral value.

•Real estate value and appraisal risks can lead to inaccurate collateral valuations, higher losses, or insufficient ACL levels.

•Foreclosure-related risks may increase costs or delay recoveries.

•Liquidity risk could arise from deposit attrition or limited market liquidity that restricts lending and weakens financial performance.

•Large depositor concentration poses the risk that major withdrawals could force reliance on more expensive or volatile funding sources, pressuring net interest margin.

•Mortgage banking volatility may reduce noninterest income due to interest rate shifts, market disruptions, or lower loan officer productivity.

•Secondary market and repurchase risk could lower operating income if market disruptions occur or loan repurchases are required.

•OpenSkyTM credit card portfolio risks include fraud, credit losses, ACH issues, and delinquency trends that could materially affect performance and reduce earnings if losses exceed the ACL.

•Government-guaranteed lending risks stem from borrower defaults, processing deficiencies, or potential changes to federal programs.

•Renewable energy tax credit risks may reduce financing opportunities if federal tax incentives or program structures change.

•Interest rate risk may negatively affect the value of securities and loans as rates fluctuate.

•Changes to interest rates or the economic environment could force us to recognize losses on our investment securities portfolio.

•Competitive pressures from banks and nonbank providers may limit our ability to grow loans, deposits, and fee income.

•Cybersecurity and technology risks involve potential system failures or cyberattacks that could cause operational disruption, financial loss, legal exposure and reputational harm.

Risks Related to Our Operations and Industry Regulation

•Extensive regulatory requirements may increase operational and compliance burdens or restrict business activities.

•Regulatory examinations and enforcement could result in penalties, restrictions, or other adverse impacts if we fail to meet expectations or comply with requirements.

•Elevated levels of CRE or construction concentration may require enhanced risk management policies or higher capital levels, as well as limit our ability to lend.

•External events and climate-related risks could disrupt operations or impair collateral.

•AI risks may arise from model errors, data issues, operational failures, regulatory scrutiny, or reputational concerns tied to AI use.

Risks Related to Strategic Growth

•A merger or acquisition requires us to make estimates which impact presentation of our financial condition and are subject to revision.

•If goodwill were determined to be impaired, it could have a negative impact on our profitability.

•Acquisitions may disrupt our business.

Risks Related to Ownership of Our Common Stock

•Market volatility may cause significant fluctuations in our stock price.

•Future equity offerings or issuances of convertible instruments could result in substantial dilution.

•Insider ownership and control may influence shareholder votes and elections.

•Subordination to debt and preferred stock means common shareholders face lower priority relative to senior instruments, affecting value and rights.

•Anti-takeover protections under corporate governance provisions and applicable law may deter or delay change-of-control transactions.

ITEM 1A. RISK FACTORS.

Ownership of our common stock involves certain risks. The risks and uncertainties described below are not the only ones we face. You should carefully consider the risks described below, as well as all other information contained in this Annual Report on Form 10-K. Additional risks and uncertainties not presently known to us or that we currently deem immaterial may also impair our business operations. If any of these risks actually occurs, our business, financial condition or results of operations could be materially and adversely affected.

Risks Related to Our Business

As a business operating in the financial services industry, our business and operations may be adversely affected in numerous and complex ways by weak economic conditions.

Our performance could be negatively impacted to the extent there is deterioration in business and/or economic conditions, including persistent inflation, supply chain issues or labor shortages, which have direct or indirect impacts on us, our customers and/or our counterparties. All of these factors can individually or in the aggregate be detrimental to our business, and the interplay between these factors can be complex and unpredictable. Adverse economic conditions could have a material, adverse effect on our business, and/or the financial condition of our customers and our results of operations.

Adverse developments affecting financial institutions or the financial services industry generally, such as actual events or concerns involving liquidity, defaults or non-performance, could adversely affect our operations and liquidity.

Actual events involving limited funding liquidity, customer defaults, non-performance or other adverse developments that affect financial institutions or the financial services industry generally, or concerns or rumors about similar events, including the potential negative media coverage, have in the past and may in the future lead to market-wide liquidity problems and erode customer confidence in the banking system. For example, the high-profile bank failures in the first half of 2023 led to volatility and declines in the market for bank stocks and questions about depositor confidence in depository institutions.

Such high-profile bank failures also highlighted the speed at which deposits can be moved in the digital economy, as well as the speed and reach of media attention, including social media, and its ability to disseminate concerns or rumors, in each case potentially exacerbating liquidity concerns. In addition, the banking operating environment and public trading prices of banking institutions can be highly correlated, in particular during times of stress, which could materially and adversely impact the trading price of our common stock and potentially our results of operations.

Additionally, negative news about us or the banking industry in general could negatively impact market and/or customer perceptions of the Company, which could lead to a loss of depositor confidence and an increase in deposit withdrawals, particularly among those with uninsured deposits. Furthermore, the failure of other financial institutions may cause deposit outflows as customers spread deposits among several different banks so as to maximize their amount of FDIC insurance, move deposits to banks deemed “too big to fail” or remove deposits from the banking system entirely. As of December 31, 2025, approximately 40.9% of our deposits were uninsured and 59.1% of our deposits were insured. We rely on these deposits for liquidity. A failure to maintain adequate liquidity could have a material, adverse effect on our business, financial condition and results of operations.

Our commercial business and operations are concentrated in the greater Washington, D.C. and Baltimore metropolitan areas and we are sensitive to adverse changes in the local economy.

Our success depends upon the general economic conditions in the areas in which we operate, which we cannot predict with any degree of certainty. The presidential administration and certain governmental

agencies have announced and begun to implement plans to reduce government spending and the size of the federal government workforce. The Washington, D.C. metropolitan area is characterized by a significant number of businesses that are federal government contractors or subcontractors, or which depend on such businesses for a significant portion of their revenues. In addition, federal government employees make up a significant proportion of the population of the Washington, D.C. metropolitan area. Reductions in the federal workforce through layoffs and buyouts, furloughs of government employees or government contractors as well as cancelling government contracts and other impacts from declining government spending, lapses in appropriations, or changes in fiscal appropriations could have adverse impacts on other businesses in the Company’s market and the general economy of the greater Washington, D.C. metropolitan area. Such a downturn in the local economy generally could make it more difficult for our borrowers to repay their loans and may lead to loan losses that would not be offset by operations in other markets; it may also reduce the ability of our depositors to make or maintain deposits with us. For these reasons, any regional or local economic downturn that affects the Washington, D.C. and Baltimore metropolitan areas, or existing or prospective borrowers or depositors in the Washington, D.C. and Baltimore metropolitan areas could have a material, adverse effect on our business, financial condition and results of operations.

Our customers and businesses in the Washington, D.C. metropolitan area may be adversely impacted as a result of the government shutdown and changes in government spending.

Disagreement over the U.S. federal budget, specifically regarding expiring tax credits and spending priorities, caused the U.S. federal government to shut down from October 1, 2025 to November 12, 2025. The government shutdown resulted in furloughs and layoffs for hundreds of thousands of federal employees. Recently, there have been several additional instances where there has been uncertainty regarding the ability of Congress and the President to collectively reach agreement on federal budgetary and spending matters. A period of failure to reach agreement on these matters, particularly if accompanied by another government shutdown, may have an adverse impact on the U.S. economy.

The Washington, D.C. metropolitan area is characterized by a significant number of businesses that are federal government contractors or subcontractors, or which depend on such businesses for a significant portion of their revenues. In addition, federal government employees make up a significant proportion of the population of the Washington, D.C. metropolitan area. The impact of a decline in federal government spending, a reallocation of government spending to different industries or different areas of the country or a delay in payments to such contractors could have a ripple effect. Temporary layoffs, staffing freezes, salary reductions and/or furloughs of government employees or government contractors could have adverse impacts on other businesses in the Company’s market and the general economy of the greater Washington, D.C. metropolitan area, and may indirectly lead to a loss of revenues by the Company’s customers, including vendors and lessors to the federal government and government contractors or to their employees, as well as to a wide variety of commercial and retail businesses and the local housing market. Accordingly, such potential federal government activities could lead to increases in past due loans, nonperforming loans, loan loss reserves and charge-offs, and could adversely affect our liquidity position.

In addition, a significant portion of our loan portfolio is secured by real estate, including construction and land development loans, all of which are in greater demand when interest rates are low and economic conditions are good. Accordingly, a decline in local economic conditions would likely have an adverse impact on our financial condition and results of operations, and the impact on us would likely be greater than the impact felt by larger financial institutions whose loan portfolios are more geographically diverse. We cannot guarantee that any risk management practices that we implement to address our geographic and loan concentrations will be effective in preventing losses relating to our loan portfolio.

We may not be able to measure and limit our credit risk adequately, which could lead to unexpected losses.

A primary component of our business involves making loans to customers. The business of lending is inherently risky, including risks that the principal of or interest on any loan will not be repaid in a timely manner or at all or that the value of any collateral supporting the loan will be insufficient to cover our outstanding exposure. A failure to measure and limit the credit risk associated with our loan portfolio effectively could lead to unexpected losses and have a materially adverse effect on our business, financial condition and results of operations.

Our ACL may prove to be insufficient to absorb life-time losses in our loan portfolio, which may adversely affect our business, financial condition and results of operations.

Under the current expected credit loss model (“CECL”), the ACL on loans is a valuation allowance estimated at each balance sheet date in accordance with U.S. generally accepted accounting principles (“GAAP”) that is deducted from the loans’ amortized cost basis to present the net amount expected to be collected on the loans. We estimate the ACL on loans based on the underlying assets’ amortized cost basis, which is the amount at which the financing receivable is originated or acquired, adjusted for applicable accretion or amortization of premium, discount, and net deferred fees or costs, collection of cash, and charge-offs. Expected credit losses are reflected in the ACL through a charge to the provision for credit loss expense. When we deem all or a portion of a financial asset to be uncollectible the appropriate amount is written off and the ACL is reduced by the same amount. We apply judgment to determine when a financial asset is deemed uncollectible; however, generally speaking, an asset will be considered uncollectible no later than when all efforts at collection have been exhausted. Subsequent recoveries, if any, are credited to the ACL when received.

We measure expected credit losses of financial assets on a collective (pool) basis, when the financial assets share similar risk characteristics. Depending on the nature of the pool of financial assets with similar risk characteristics, we use a discounted cash flow method or a loss-rate method to estimate expected credit losses. Our methodologies for estimating the ACL consider available relevant information about the collectability of cash flows, including information about past events, current conditions, and reasonable and supportable forecasts. The methodologies apply historical loss information, adjusted for asset-specific characteristics, economic conditions at the measurement date, and forecasts about future economic conditions expected to exist through the contractual lives of the financial assets that are reasonable and supportable, to the identified pools of financial assets with similar risk characteristics for which the historical loss experience was observed. Our methodologies revert back to historical loss information on a straight-line basis over eight quarters when the methodology can no longer develop reasonable and supportable forecasts.

Loans that do not share risk characteristics are evaluated on an individual basis. For collateral dependent financial assets where we have determined that foreclosure of the collateral is probable, or where the borrower is experiencing financial difficulty and we expect repayment of the financial asset to be provided substantially through the operation or sale of the collateral, the ACL is measured based on the difference between the fair value of the collateral and the amortized cost basis of the asset as of the measurement date. When repayment is expected to be from the operation of the collateral, expected credit losses are calculated as the amount by which the amortized cost basis of the financial asset exceeds the present value of expected cash flows from the operation of the collateral. When repayment is expected to be from the sale of the collateral, expected credit losses are calculated as the amount by which the amortized costs basis of the financial asset exceeds the fair value of the underlying collateral less estimated cost to sell. The ACL may be zero if the fair value of the collateral at the measurement date exceeds the amortized cost basis of the financial asset.

Additional credit losses will occur in the future and may occur at a rate greater than we have previously experienced. We may be required to take additional provisions for credit losses in the future to

further supplement our ACL, either due to management’s decision to do so or requirements by our banking regulators. In addition, bank regulatory agencies will periodically review our ACL and the value attributed to nonaccrual loans or to real estate acquired through foreclosure. Such regulatory agencies may require us to recognize future charge-offs. These adjustments could have a material, adverse effect on our business, financial condition and results of operations.

The small- to medium-sized businesses that we lend to may have fewer resources to weather adverse business developments, which may impair our borrowers’ ability to repay loans.

Small- to medium-sized businesses frequently have smaller market shares than their competition, may be more vulnerable to economic downturns, often need substantial additional capital to expand or compete and may experience substantial volatility in operating results, any of which may impair a borrower’s ability to repay a loan. If our borrowers are unable to repay their loans, our business, financial condition and results of operations could be materially and adversely affected.

Our commercial real estate and real estate construction loan portfolio exposes us to credit risks that may be greater than the risks related to other types of loans.

These loans typically involve repayment that depends upon income generated, or expected to be generated, by the property securing the loan in amounts sufficient to cover operating expenses and debt service. Unexpected deterioration in the credit quality of our commercial real estate loan portfolio could require us to increase our ACL, which would reduce our profitability and could have a material, adverse effect on our business, financial condition and results of operations.

Construction loans also involve risks because loan funds are secured by a project under construction and the project is of uncertain value prior to its completion. It can be difficult to accurately evaluate the total funds required to complete a project, and construction lending often involves the disbursement of substantial funds with repayment dependent, in part, on the success of the ultimate project rather than the ability of a borrower or guarantor to repay the loan. If we are forced to foreclose on a project prior to completion, we may be unable to recover the entire unpaid portion of the loan. In addition, we may be required to fund additional amounts to complete a project and incur taxes, maintenance and compliance costs for a foreclosed property, and we may have to hold the property for an indeterminate period of time, any of which could materially and adversely affect our business, financial condition and results of operations.

Because a significant portion of our loan portfolio held for investment is comprised of real estate loans, negative changes in the economy affecting real estate values and liquidity could impair the value of collateral securing our real estate loans and result in loan and other losses.

Adverse developments affecting real estate values and the liquidity of real estate in our primary markets could increase the credit risk associated with our loan portfolio, and could result in losses that adversely affect credit quality, financial condition and results of operations. If real estate values decline, it is likely that we would be required to increase our ACL, which would adversely affect our business, financial condition and results of operations.

A portion of our loan portfolio is comprised of commercial loans secured by receivables, inventory, equipment or other commercial collateral, the deterioration in value of which could expose us to credit losses.

In general, these loans are collateralized by general business assets, including, among other things, accounts receivable, inventory and equipment, and most are backed by a personal guaranty of the borrower or principal. Significant adverse changes in the economy or local market conditions in which our commercial lending customers operate could cause rapid declines in loan collectability and the values associated with general business assets resulting in inadequate collateral coverage that may expose us

to credit losses and could materially and adversely affect our business, financial condition and results of operations.

Appraisals and other valuation techniques we use in evaluating and monitoring loans secured by real property, other real estate owned and repossessed personal property may not accurately describe the net value of the asset.

In considering whether to make a loan secured by real property, we generally require an appraisal of the property. However, an appraisal is only an estimate of the value of the property at the time the appraisal is made and, inasmuch as real estate values may change significantly in value in relatively short periods of time (especially in periods of heightened economic uncertainty), this estimate may not accurately describe the net value of the real property collateral after the loan is made. As a result, we may not be able to recover the full amount of any remaining indebtedness when we foreclose on and sell the relevant property. In addition, we rely on appraisals and other valuation techniques to establish the value of our other real estate owned (“OREO”) and personal property that we acquire through foreclosure proceedings and to determine certain loan impairments. If any of these valuations are inaccurate, our combined and consolidated financial statements may not reflect the correct value of our OREO, and our allowance for credit losses may not reflect accurate loan impairments. This could have a material, adverse effect on our business, financial condition and/or results of operations.

We engage in lending secured by real estate and may be forced to foreclose on the collateral and own the underlying real estate, subjecting us to the costs and potential risks associated with the ownership of the real property, or consumer protection initiatives or changes in state or federal law may substantially raise the cost of foreclosure or prevent us from foreclosing at all.

Since we originate loans secured by real estate, we may have to foreclose on the collateral property to protect our investment and may thereafter own and operate such property, in which case we would be exposed to the risks inherent in the ownership of real estate. Our inability to manage the amount of costs or the risks associated with the ownership of real estate, or write-downs in the value of OREO, could have a material, adverse effect on our business, financial condition and results of operations.

Additionally, consumer protection initiatives or changes in state or federal law may substantially increase the time and expense associated with the foreclosure process or prevent us from foreclosing at all. If new state or federal laws or regulations are ultimately enacted that raise the cost of foreclosure or impose outright barriers, such could have a materially adverse effect on our business, financial condition and results of operation.

A lack of liquidity could impair our ability to fund operations and adversely impact our business, financial condition and results of operations.

Liquidity is essential to our business. We rely on our ability to generate deposits and effectively manage the repayment and maturity schedules of our loans and investment securities, respectively, to ensure that we have adequate liquidity to fund our operations. An inability to raise funds through deposits, borrowings, sales of our investment securities, sales of loans or other sources could materially and adversely impact our ability to originate loans, invest in securities, meet our expenses or fulfill obligations such as repaying our borrowings or meeting deposit withdrawal demands, any of which could, in turn, have a material, adverse effect on our business, financial condition and results of operations.

We have several large depositor relationships, the loss of which could force us to fund our business through more expensive and less stable sources.

Withdrawals of deposits by any one of our largest depositors could force us to rely more heavily on borrowings and other sources of funding for our business, adversely affecting our net interest margin and results of operations. We may also be forced, as a result of any withdrawal of deposits, to rely more

heavily on other, potentially more expensive and less stable funding sources. Consequently, the occurrence of any of these events could have a material, adverse effect on our business, financial condition and results of operations.

Our mortgage banking division may not meaningfully contribute to noninterest income.

The residential mortgage banking business is highly competitive and highly susceptible to changes in market interest rates, consumer confidence levels, employment statistics, the capacity and willingness of secondary market purchasers to acquire and hold or securitize loans, and other factors beyond our control. Additionally, in many respects, the traditional mortgage origination business is relationship-based, and dependent on the services of individual mortgage loan officers. The loss of services of one or more loan officers could have the effect of reducing the level of our mortgage production, or the rate of growth of production. As a result of these various factors, we cannot be certain that we will be able to maintain or increase the volume or percentage of revenue or net income produced by our residential mortgage business.

We earn income by originating residential mortgage loans for resale in the secondary mortgage market, and disruptions in that market could reduce our operating income.

Historically, as part of our focus on loan origination and sales activities, we enter into formal commitments and informal agreements with larger banking companies and mortgage investors earning the Bank income from these sales. Under these arrangements, we originate single-family mortgages that are priced and underwritten to conform to previously agreed upon criteria before loan funding and are delivered to the investor shortly after funding.

Disruptions in the secondary market may not only affect us but also the ability and desire of mortgage investors and other banks to purchase residential mortgage loans that we originate. As a result, we may not be able to maintain or grow the income we receive from originating and reselling residential mortgage loans. Additionally, we hold certain mortgage loans that we originated for sale, increasing our exposure to interest rate risk and adverse changes in the value of the residential real estate that serves as collateral for the mortgage loan prior to sale.

Our financial condition, earnings and asset quality could be adversely affected if we are required to repurchase loans originated for sale by our mortgage banking division.

The Bank originates residential mortgage loans for sale to secondary market investors, subject to contractually specified recourse provisions. Because the loans are intended to be originated within investor guidelines, using designated automated underwriting and product-specific requirements as part of the loan application, the loans sold have a limited recourse provision. Should loan repurchases become a material issue, our earnings and asset quality could be adversely impacted, which could materially and adversely impact our business, financial condition and results of operations.

Delinquencies and credit losses from our OpenSkyTM credit card division could adversely affect our business, financial condition and results of operations.

Our OpenSkyTM Division provides secured, partially secured, and unsecured credit cards on a nationwide basis to under-banked populations and those looking to rebuild their credit scores. Although some OpenSkyTM credit cards are fully or partially secured, losses may occur as a result of fraud, or when the account exceeds its established limit or if a cardholder ceases to maintain the account in good standing. Fraud, such as identity fraud, payment fraud and funding fraud (where, for example, an individual funds a card using information from someone they know well, such as a relative or roommate) can result in substantial losses. In the case of an OpenSkyTM account that is funded through fraud on the part of an applicant, we are required by applicable laws to refund the amount of the original deposit, and we charge off balances which were subsequently charged on the card. Account balances in excess of

established credit limits happen as a result of certain VISA membership policies that allow cardholders to incur certain charges even if they exceed their card limits, which include, but are not limited to, rental car charges, gas station charges and hotel deposits. If an OpenSkyTM cardholder exceeds his or her credit limit as a result of purchases in one of these categories, we may incur losses for amounts in excess of the collateral deposited if the borrower fails to repay such excess amounts. Customers can also exceed their credit limit by making intra-period payments to replenish their available lines. If the payments are made via the Automated Clearing House (“ACH”) and were fraudulent, we could incur the cost of the payment. Losses to our credit card portfolio also arise when cardholders cease to maintain the account in good standing with timely payments. For example, in the event a secured card becomes more than 90 days past due, or an unsecured card becomes more than 150 days past due, the credit card balance is recovered against any corresponding deposit account and the account becomes eligible for charge-off. A charge-off is recorded for any related fees, accrued interest or other charges in excess of the deposit account balance no later than 120 days for secured and 180 days for unsecured. We have invested in technology and systems designed to detect fraudulent behavior and somewhat mitigate losses but such investments may not be adequate, and our systems may not adequately monitor or mitigate potential losses arising from these risks.

A high credit loss rate (the rate at which we charge off uncollectible loans) on either our secured, partially secured, or unsecured portfolio could materially and adversely impact our overall financial performance. We maintain an ACL, which we believe to be adequate to cover credit losses inherent in our OpenSkyTM portfolio, but we cannot be certain that the allowance will be sufficient to cover actual credit losses. If credit losses from our OpenSkyTM portfolio exceed our ACL, our net income will be reduced by the excess of such credit losses.

The inability of our OpenSkyTM credit card division to continue its growth rate could adversely affect our earnings.

We do not know if we will be able to retain existing customers or attract new customers, or that we will be able to increase account balances for new or existing customers.

We hope the development and expansion of new credit card products and related cardholder service products will be an important contributor to our growth and earnings in the future; however, if we are unable to implement new cardholder products and features, our ability to grow will be negatively impacted. Declining sales of cardholder service products would likely result in reduced income from fees and interest.

Our participation in government guaranteed lending activities subjects us to additional risks.

As an approved participant in the SBA Preferred Lender Program, we are able to facilitate SBA loans for our customers without subjecting them to the potentially burdensome SBA approval process required for lenders that are not part of the program. The loss of our status as an SBA Preferred Lender could result in a loss of customers to other lenders who maintain this designation. Such a loss could materially and adversely affect our business and financial results.

In situations where we sell the government guaranteed portion of SBA or USDA loans, we remain exposed to credit risk on the unguaranteed portion of the loan. Furthermore, if a bank sells a government guaranteed loan in the secondary market and the borrower subsequently defaults, the SBA or USDA may seek to recover the loss associated with the loan if it is determined that the default arose due to a significant technical deficiency in the origination, funding or servicing of the loan.

This creates a potential credit risk for us with respect to the guaranteed portion of SBA or USDA loans to the extent that we originated the loan in a manner that was not in compliance with applicable standard operating procedures. Additionally, technical defaults could lead to potential liability for WindsorTM if it assisted in the origination or servicing of the loan on behalf of another bank. Such technical defaults and

associated losses could materially adversely affect our business. Furthermore, increased instances of technical defaults, particularly where Windsor AdvantageTM acted as a lender service provider, could result in reputational damage to us.

Any modification or reduction in the level of government support for government guaranteed loan programs could result in a significant impact to our results of operations.

A material part of our business consists of originating and servicing government guaranteed loans, in particular those guaranteed by the SBA and the USDA. Our government guaranteed lending program is substantially dependent on the continued support of the U.S. federal government. Under established and long-standing SBA and USDA programs, the federal government guarantees a portion of the loans originated by us or by clients we service through Windsor AdvantageTM.

Any changes to the laws, regulations, procedures, or funding levels governing the SBA or USDA programs could impair our ability, as well as the ability of our clients through Windsor AdvantageTM, to originate, process, and sell these loans in the secondary market. Such changes could have a material, adverse impact on our business, including through a reduction in sales income and decreased revenue within Windsor AdvantageTM.

Changes to renewable energy tax credits and federal incentive programs could adversely affect certain lending opportunities.

A portion of our lending activities is tied to the financing of renewable energy projects, including, but not limited to, commercial solar farms. A portion of the committed equity in some of these projects is derived from investment tax credits and other financial incentives provided through federal programs, legislative measures, and governmental support.

The U.S. federal government has previously enacted changes affecting the availability and terms of certain renewable energy tax credits and related incentives. These programs remain subject to further legislative, regulatory, or administrative modification, reinterpretation, or repeal. Any additional changes to the structure, availability, transferability, monetization, or timing of these tax credits or related support programs could affect the economics or viability of projects seeking financing.

Reductions in renewable energy incentives, expiration, phase-down, or modification of key tax benefits, or delays in reauthorization or expansion of related programs could materially impact the volume of renewable energy lending opportunities. In addition uncertainty regarding future federal policy may delay project development, financing decisions or capital commitments.

Accordingly, adverse changes in the regulatory framework or governmental support for renewable energy projects could materially and adversely affect our financial performance.

We are subject to interest rate risk as fluctuations in interest rates may adversely affect our earnings.

The majority of our banking assets and liabilities are monetary in nature and subject to risk from changes in interest rates. Like most financial institutions, our earnings are significantly dependent on our net interest income, the principal component of our earnings, which is the difference between interest earned by us from our interest earning assets, such as loans and investment securities, and interest paid by us on our interest-bearing liabilities, such as deposits and borrowings. We expect that we will periodically experience “gaps” in the interest rate sensitivities of our assets and liabilities, meaning that either our interest-bearing liabilities will be more sensitive to changes in market interest rates than our interest earning assets, or vice versa. In either case, if market interest rates move contrary to our position, this gap will negatively impact our earnings. The impact on earnings is more adverse when short-term interest rates increase more than long-term interest rates or when long-term interest rates decrease more

than short-term interest rates, or in circumstances of a flattened or inverted yield curve. Many factors impact interest rates, including governmental monetary policies, inflation, recession, changes in unemployment, the money supply, international economic weakness and disorder and instability in domestic and foreign financial markets.

Interest rate increases often result in larger payment requirements for our borrowers, which increases the potential for default and could result in a decrease in the demand for loans. At the same time, the marketability of the property securing a loan may be adversely affected by any reduced demand resulting from a higher interest rate environment. In a declining interest rate environment, there may be an increase in prepayments on loans as borrowers refinance their loans at lower rates. In addition, in a low interest rate environment, loan customers often pursue long-term fixed rate credits, which could adversely affect our earnings and net interest margin if rates later increase. Changes in interest rates also can affect the value of loans, securities and other assets. An increase in interest rates that adversely affects the ability of borrowers to pay the principal or interest on loans may lead to an increase in nonperforming assets and a reduction of income recognized, which could have a material, adverse effect on our results of operations and cash flows. Further, when we place a loan on nonaccrual status, we reverse any accrued but unpaid interest receivable, which decreases interest income. At the same time, we continue to incur costs to fund the loan, which is reflected as interest expense, without any interest income to offset the associated funding expense. Thus, an increase in the amount of nonperforming assets would have a material, adverse impact on net interest income.

We could recognize losses on investment securities held in our securities portfolio, particularly if interest rates increase or economic and market conditions deteriorate.

We invest a portion of our total assets in investment securities with the primary objectives of providing a source of liquidity, providing an appropriate return on funds invested and managing interest rate risk. Factors beyond our control can significantly and adversely influence the fair value of securities in our portfolio. Because of changing economic and market conditions affecting interest rates, the financial condition of issuers of the securities and the performance of the underlying collateral, we may recognize realized and/or unrealized losses in future periods, which could have a material, adverse effect on our business, financial condition and results of operations. Net unrealized losses related to available-for-sale investment securities are reflected in Accumulated Other Comprehensive Loss in our Consolidated Balance Sheets and reduce the level of our tangible common equity. Such unrealized losses do not affect our regulatory capital ratios.

We face strong competition from financial services companies and other companies that offer banking services.

We operate in the highly competitive financial services industry and face significant competition for customers from financial institutions located both within and beyond our principal markets. We compete with commercial banks, savings banks, credit unions, non-bank financial services companies and other financial institutions operating within or near the areas we serve. In addition, many of our non-bank competitors are not subject to the same extensive regulations that govern our activities and may have greater flexibility in competing for business. Our inability to compete successfully in the markets in which we operate could have a material, adverse effect on our business, financial condition or results of operations.

System failure or cybersecurity breaches of our network security could subject us to increased operating costs as well as litigation and other potential losses and regulatory implications.

Our computer systems and network infrastructure could be vulnerable to hardware and cybersecurity issues. Any damage or failure that causes an interruption in our operations could have a material, adverse effect on our financial condition and results of operations.

Our operations are also dependent upon our ability to protect our computer systems and network infrastructure, including our digital, mobile and internet banking activities, against damage from physical break-ins, cybersecurity breaches and other disruptive problems. Such computer break-ins and other disruptions would jeopardize the security of information stored in and transmitted through our computer systems and network infrastructure, which may result in significant liability, damage our reputation and inhibit the use of our internet banking services by current and potential customers. A breach of our security that results in unauthorized access to our data could expose us to a disruption or challenges relating to our daily operations, as well as to data loss, litigation, damages, fines and penalties, significant increases in compliance costs and reputational damage, any of which could have a material, adverse effect on our business, financial condition and results of operations. In addition, we may need to take our systems off-line if they become infected with malware or a computer virus or as a result of another form of cyber-attack. In the event that backup systems are utilized, they may not process data as quickly as our primary systems and some data might not have been saved to backup systems, potentially resulting in a temporary or permanent loss of such data. In addition, our ability to implement backup systems and other safeguards with respect to third-party systems is more limited than with respect to our own systems. We frequently update our systems to support our operations and growth and to remain compliant with applicable laws, rules and regulations. These updates entail significant costs and create risks associated with implementing new systems and integrating them with existing ones, including business interruptions. Implementation and testing of controls related to our computer systems, security monitoring, and retaining and training personnel required to operate our systems also entail significant costs.

We face security risks, including denial of service attacks, hacking, malware intrusion and data corruption attempts, and identity theft that could result in the disclosure of confidential information, materially and adversely affect our business or reputation, and create significant legal and financial exposure.

Our business relies on the secure processing, transmission, storage and retrieval of confidential, proprietary, and other information in our computer and data management systems and networks, and in the computer and data management systems and networks of third parties. In addition, to access our network, products and services, our customers and other third parties may use personal mobile devices or computing devices that are outside of our network environment and are subject to their own cybersecurity risks.

We, our customers, regulators, and other third parties, including other financial services institutions and companies engaged in data processing, have been subject to, and are likely to continue to be the target of, cyber-attacks. These cyber-attacks include computer viruses, malicious or destructive code, phishing attacks, denial of service or information, ransomware, improper access by employees or vendors, attacks on personal email of employees, ransom demands to not exploit security vulnerabilities in our systems or the systems of third parties, and other security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary and other information of ours, our employees, our customers, or of third parties, and damage to our systems that could otherwise materially disrupt our or our customers’ or other third parties’ network access or business operations. As cyber-threats continue to evolve, we may be required to expend significant additional resources to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities or incidents. Despite efforts to ensure the integrity of our systems and implement controls, processes, policies and other protective measures, we may not be able to anticipate all security breaches, nor may we be able to implement sufficient preventive measures against such security breaches, which may expose us to material losses and other material, adverse consequences.

Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, including artificial intelligence, and the use of the internet and telecommunications technologies to conduct financial transactions. Even the most advanced internal control environment may be vulnerable to compromise. The techniques used by cyber criminals change frequently, may not be recognized until launched, and may not be recognized until well after a breach has

occurred. The speed at which new vulnerabilities are discovered and exploited, often before security patches are published, continues to rise. The risk of a security breach caused by a cyber-attack on a vendor or by unauthorized vendor access has also increased in recent years.

Cyber-attacks or other security breaches, whether directed at us or third parties, may result in a material loss or have other material, adverse consequences. Furthermore, the public perception that a cyber-attack on our systems has been successful, whether or not this perception is correct, may damage our reputation with customers and third parties with whom we do business. Hacking of personal information and identity theft risks, in particular, could cause serious reputational harm. A successful penetration or circumvention of system security could cause us serious negative consequences, including a loss of customers and business opportunities, costs associated with maintaining business relationships after an attack or breach, significant business disruption to our operations and business, misappropriation, exposure or destruction of our confidential information, intellectual property, funds and/or those of our customers; or damage to our or our customers’ and/or third parties’ computers or systems, and could result in a violation of applicable privacy and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our security measures, reputational damage, reimbursement or other compensatory costs, and additional compliance costs, and could materially and adversely impact our results of operations, liquidity and financial condition. In addition, we may not have adequate insurance coverage to compensate for losses from a cybersecurity event.

Failure to maintain an effective system of internal control and disclosure controls and procedures could have a material adverse effect on our results of operations, financial condition and stock price.

As disclosed in Part II - Item 9A. Controls and Procedures, management has identified a material weakness in our internal control over financial reporting and, as a result, concluded that our internal control over financial reporting and our disclosure controls and procedures were not effective as of December 31, 2025. We are currently working to remediate the material weakness. However, there can be no assurance that these remediation efforts will be successful. In addition, these remediation efforts will place a burden on management and may result in additional expenses.

If we are unable to remediate this material weakness, or are otherwise unable to maintain effective internal control over financial reporting or disclosure controls and procedures, our ability to record, process and report financial information accurately, and to prepare financial statements within required time periods, could be adversely affected, which could subject us to litigation or investigations requiring management resources and payment of legal and other expenses, result in violations of applicable securities laws, prejudice our ability to meet NASDAQ listing requirements, negatively affect investor confidence in the accuracy and completeness of our financial statements, and adversely impact the trading price of our securities.

Risks Related to Our Operations and the Regulation of Our Industry

We operate in a highly regulated environment and the laws and regulations that govern our operations, corporate governance, executive compensation and accounting principles, or changes in them, or our failure to comply with them, could adversely affect us.

Banking is highly regulated under federal and state law. Accordingly, we are subject to extensive regulation, supervision and legal requirements that govern almost all aspects of our operations. Compliance with applicable laws and regulations can be complex and costly, and changes to laws and regulations, including changes in federal policy and regulatory priorities associated with transitions in U.S. Presidential administrations frequently impose additional operating costs. Recent administrations have pursued regulatory agendas that differ in approach and emphasis, and we expect that rulemaking, supervision, examination and enforcement priorities of the federal banking agencies will continue to evolve. Such changes may affect the manner in which we conduct our business, the products and

services we offer, and the costs associated with compliance. Our failure to comply with applicable laws and regulations, even where such failure reflects good faith efforts or differences in interpretation, could subject us to restrictions on our business activities, enforcement actions, fines, or other penalties, any of which could adversely affect our results of operations, regulatory capital levels, and the price of our securities. In addition, new or amended laws, rules or regulations could increase compliance costs, limit business opportunities, or otherwise materially and adversely affect our business, financial condition, and results of operations.

Federal banking agencies periodically conduct examinations of our business, including compliance with laws and regulations, and our failure to comply with any supervisory actions to which we are or become subject as a result of such examinations could adversely affect us.

As part of the bank regulatory process, the OCC and the Federal Reserve, periodically conduct examinations of our business, including compliance with laws and regulations. If, as a result of an examination, one of these federal banking agencies were to determine that the financial condition, capital resources, asset quality, earnings prospects, management, liquidity, asset sensitivity, risk management or other aspects of any of our operations have become unsatisfactory, or that the Company, the Bank or their respective management were in violation of any law or regulation, it may take a number of different remedial actions as it deems appropriate. These actions include the power to enjoin “unsafe or unsound” practices, to require affirmative actions to correct any conditions resulting from any violation or practice, to issue an administrative order that can be judicially enforced, to direct an increase in our capital levels, to restrict our growth, to assess civil monetary penalties against us, the Bank or their respective officers or directors, to remove officers and directors and, if it is concluded that such conditions cannot be corrected or there is an imminent risk of loss to depositors, to terminate the Bank’s deposit insurance. If we become subject to such regulatory actions, our business, financial condition, results of operations and reputation would be materially and adversely affected.

Regulatory requirements affecting our loans secured by commercial real estate could limit our ability to leverage our capital and adversely affect our growth and profitability.

The federal bank regulatory agencies have indicated their view that banks with high concentrations of loans secured by commercial real estate are subject to increased risk and should implement robust risk management policies and maintain higher capital than regulatory minimums to maintain an appropriate cushion against loss that is commensurate with the perceived risk. Federal bank regulatory guidelines identify institutions potentially exposed to commercial real estate concentration risk as those that have (i) experienced rapid growth in commercial real estate lending, (ii) notable exposure to a specific type of commercial real estate, (iii) total reported loans for construction, land development and other land loans representing 100% or more of the institution’s capital, or (iv) total non-owner-occupied commercial real estate (including construction) loans representing 300% or more of the institution’s capital if the outstanding balance of the institution’s non-owner-occupied commercial real estate (including construction) loan portfolio has increased 50% or more during the prior 36 months. At December 31, 2025, the Bank’s construction to total capital ratio was 100% and the Bank’s non-owner-occupied commercial real estate (including construction) loans to total capital ratio was 302%, which exceeded the 300% regulatory guideline threshold set forth in clause (iv) above. As a result, we are deemed to have a concentration in commercial real estate lending under applicable regulatory guidelines. Additionally, at December 31, 2025, the Company’s construction to total capital ratio was 88.1% and the Company’s non-owner-occupied commercial real estate (including construction) loans to total capital ratio was 270.8%. Because a significant portion of our loan portfolio depends on commercial real estate, a change in the regulatory capital requirements applicable to us or a decline in our regulatory capital could limit our ability to leverage our capital as a result of these policies, which could have a material, adverse effect on our business, financial condition and results of operations.

Further, management has implemented controls to monitor our commercial real estate lending concentrations, but we cannot predict the extent to which regulatory guidelines will impact our operations or capital requirements.

Severe weather, earthquakes, other natural disasters, climate change, pandemics, acts of war or terrorism and other external and geopolitical events could significantly impact the business.

Severe weather, earthquakes, other natural disasters, pandemics, climate change, acts of war or terrorism and other adverse external events could have a significant impact on the Company’s ability to conduct business. Such events could affect the stability of our deposit base, impair the ability of our borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue, cause us to incur additional expenses or disrupt the Company’s operations. Climate change has the potential to increase the frequency and severity of severe weather events in the future. Although management has established disaster recovery policies and procedures, the occurrence of any such events could have a material, adverse effect on our business, financial condition, results of operations or profitability.

The development and use of AI presents risks that may adversely impact our business.

We are evaluating and may continue to expand our use of AI, and other emerging technologies in various aspects of our operations, including customer service, internal processes, risk management, and data analytics. Furthermore, our vendors or third parties may develop or incorporate AI technology in certain business processes, services or products. While these technologies may enhance efficiency and decision-making, their adoption presents risks and challenges.

AI systems may produce inaccurate, biased or inconsistent outputs, including as a result of flawed data, model limitations or inadequate oversight. Reliance on such outputs could lead to operational errors, customer harm, regulatory scrutiny or legal liability. In addition, the use of AI may raise concerns related to data privacy, intellectual property, cybersecurity and model governance, particularly where third-party vendors or externally developed tools are involved. The legal and regulatory environment governing AI remains rapidly evolving. Federal and state regulators may introduce new rules, supervisory expectations or guidance regarding transparency, consumer protection, fair lending, model risk management, data usage or vendor oversight. Compliance with these evolving requirements could increase costs, restrict our use of certain technologies or require modifications to existing processes or systems. Further, failures or perceived misuse of AI technologies could result in reputational harm, loss of customer confidence or competitive disadvantage. Operational disruptions, technology failures or security vulnerabilities associated with AI tools or service providers could adversely affect our business continuity or information security posture. We maintain governance, risk management and oversight processes designed to manage the risks associated with AI, but there can be no assurance that such processes will be effective in identifying or mitigating all risks. As a result, the use of AI and similar technologies could materially and adversely affect our business and results of operations.

Risks Related to Strategic Growth

A merger or acquisition requires us to make estimates, including the fair value of acquired assets and assumed liabilities.

GAAP requires us to record the assets and liabilities of an acquired business to their fair values at the time of the acquisition. With transactions, such as our merger with IFH, fair value and other estimates can take up to one year to finalize. These estimates, and their revisions, can have a substantial effect on the presentation of our financial condition and operating results after the transaction closes. In addition, the excess of the purchase price over the fair value of the assets acquired, net of liabilities assumed, is recorded as goodwill. If the estimates that we have used at any financial statement date are significantly

revised in the future, there could be a negative impact to our goodwill or other acquisition-related intangibles and our results of operations for the period in which the revisions are made.

If our goodwill were determined to be impaired, it could have a negative impact on our profitability.

GAAP requires that goodwill be tested for impairment at the unit level on at least an annual basis or more frequently upon the occurrence of a triggering event. An impairment loss is to be recognized if the carrying value of the net assets assigned to the reporting unit exceeds the fair value of the reporting unit. A significant decline in our expected future cash flows, a continued period of economic disruption, changes to financial markets, slower growth rates, or other external factors, all of which can be highly unpredictable, may impact fair value calculations and require us to recognize an impairment loss in the future. While goodwill is excluded from regulatory capital, such an impairment may have a material, adverse effect on our financial condition and results of our operations.

Acquisitions may disrupt our business.

The success of our merger with IFH or any future acquisition we may consummate will depend on, among other things, our ability to realize anticipated revenue enhancements and efficiencies and to combine our business with the business of the target institution in a manner that does not materially disrupt the existing customer relationships of either institution, or result in decreased revenues resulting from any loss of customers, and that permits growth opportunities to occur. If we are not able to successfully achieve these objectives, the anticipated benefits of the subject acquisition may not be realized fully or at all or may take longer to realize than expected.

It is possible that the integration process associated with any pending or future acquisition could result in the loss of key employees, the disruption of ongoing businesses or inconsistencies in standards, controls, procedures and policies that adversely affect our ability to maintain relationships with clients, customers, depositors and employees or to achieve the anticipated benefits of the acquisition. Integration efforts could also divert management attention and resources. These integration matters could have a material and adverse effect on the combined Company.

Risks Related to Ownership of Our Common Stock

The market price of our common stock may be subject to substantial fluctuations, which may make it difficult for you to sell your shares at the volume, prices and times desired.

The market price of our common stock may be highly volatile, which may make it difficult for you to resell your shares at the volume, prices and times desired. There are many factors that may affect the market price and trading volume of our common stock, most of which are outside of our control.

The stock market and the market for financial institution stocks has experienced substantial fluctuations in recent years, which in some cases have been unrelated to the operating performance and prospects of particular companies. In addition, significant fluctuations in the trading volume in our common stock may cause significant price variations to occur. Increased market volatility may materially and adversely affect the market price of our common stock, which could make it difficult for you to sell your shares in the volume and at prices and times desired.

The market price of our common stock could decline significantly and you may experience future dilution due to actual or anticipated issuances or sales of our common stock in the future.

Our board of directors may determine from time to time that we need to raise additional capital by issuing additional shares of our common stock or other securities. We cannot predict the size of future issuances of our common stock or the effect, if any, that future issuances and sales of our common stock

will have on the market price of our common stock. To the extent we raise additional capital by issuing additional shares of our common stock or other securities convertible into, or exchangeable for, our common stock, you may experience substantial dilution.

Our management and board of directors have significant control over our business.

As of December 31, 2025, our directors, directors of the Bank, our named executive officers and their respective family members and affiliated entities beneficially owned an aggregate of 5,438,261 shares, or approximately 33.2% of our issued and outstanding common stock. Consequently, our management and board of directors may be able to significantly affect the outcome of the election of directors and the potential outcome of other matters submitted to a vote of our shareholders, such as mergers, the sale of substantially all of our assets and other extraordinary corporate matters. The interests of these insiders could conflict with the interests of our other shareholders.

Our common stock is subordinate to our existing and future indebtedness and preferred stock.

Our common stock ranks junior to all of our existing and future indebtedness and other non-equity claims with respect to assets available to satisfy claims against us, including claims in the event of our liquidation. As of December 31, 2025, we had $2.1 million in aggregate principal amount of junior subordinated debentures and we had no aggregate principal amount of subordinated notes outstanding. We may incur additional indebtedness in the future to increase our capital resources or if our total capital ratio or the total capital ratio of the Bank falls below the required minimums. Furthermore, our common stock is subordinate to any series of preferred stock we may issue in the future.

Provisions in our governing documents and Maryland law may have an anti-takeover effect, and there are substantial regulatory limitations on changes of control of bank holding companies.

Our corporate organizational documents and provisions of federal and state law to which we are subject contain certain provisions that could have an anti-takeover effect and may delay, make more difficult or prevent an attempted acquisition that you may favor or an attempted replacement of our board of directors or management.

In addition, certain provisions of Maryland law may delay, discourage or prevent an attempted acquisition or change in control. Furthermore, banking laws impose notice, approval and ongoing regulatory requirements on any shareholder or other party that seeks to acquire direct or indirect “control” of an FDIC-insured depository institution or its holding company. These laws include the BHC Act and the Change in Bank Control Act (“CBCA”). These laws could delay or prevent an acquisition.

ITEM 1B. UNRESOLVED STAFF COMMENTS

None.

ITEM 1C. CYBERSECURITY

As a publicly-traded financial institution, we are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations, and reputation, including cyber-attacks against us or our critical third-party service providers. Cyber-attackers may attempt to gain unauthorized access to our systems for purposes such as misappropriation of Company assets, accessing confidential or sensitive customer non-public information, corrupting or destroying data, disrupting operations, or making ransom demands.

Cybersecurity threats continue to evolve in both frequency and sophistication as financial institutions increasingly rely on digital channels, remote connectivity, cloud-based services, and third-party technology providers. While we devote significant resources to managing these risks, no cybersecurity controls or procedures can provide absolute assurance that a cybersecurity incident will not occur.

Our information security program is designed to preserve the confidentiality, integrity, and availability of Company confidential information, customer non-public personal information, and other data maintained on our systems, as well as to secure our interfaces with critical third-party service providers. The program is risk-based and tailored to the size, complexity, and risk profile of the Company and is integrated into the Company’s broader enterprise risk management framework.

The cybersecurity program includes administrative, technical, and physical safeguards intended to identify, assess, manage, and monitor cybersecurity risks across the organization. Risk assessments are conducted periodically and in connection with material technology changes, new products, and third-party relationships. Identified risks are prioritized and addressed through remediation activities, risk acceptance, or other mitigation strategies consistent with the Company’s risk appetite.

Additionally, the Company continually works to align its policies and practices with industry-accepted information security practices as provided by the Cyber Risk Institute, Payment Card Industry Data Security Standards, and other applicable standards, laws, and regulations.

Cybersecurity risk considerations are incorporated into strategic planning, technology initiatives, and day-to-day business operations. The Company maintains written policies, standards, and procedures designed to address evolving cybersecurity threats and regulatory expectations. These policies define roles and responsibilities for employees and contractors and are supported by ongoing training and awareness activities.

The Company utilizes a combination of internal resources and external service providers to support elements of its cybersecurity program, including security monitoring, threat intelligence, vulnerability management, penetration testing, social engineering testing, and incident response preparedness. These activities are designed to enhance the Company’s ability to prevent, detect, and respond to cybersecurity threats in a timely manner.

The Board of Directors is ultimately responsible for the oversight of cybersecurity risk management.The Board, primarily through its Risk Committee, receives periodic updates from management regarding the status and effectiveness of the Company’s information security program, key risk indicators, emerging cybersecurity threats, and significant risk management initiatives. The Board also receives cybersecurity education to support informed oversight.

Management is responsible for implementing and maintaining the Company’s cybersecurity risk management program. Cybersecurity oversight is conducted through established management

committees comprised of senior executives with risk management, technology, and information security expertise. These committees provide direction, review program performance and risk metrics, approve key initiatives, and escalate significant matters to senior management and the Board, as appropriate.

The Company employs a Chief Information Security Officer who is responsible for administering and executing the Company’s written information security program and coordinating cybersecurity risk management activities across the organization. The Chief Information Security Officer works closely with other members of management to align cybersecurity practices with business objectives and regulatory requirements.

The Company maintains a cybersecurity incident response program designed to guide the assessment of and response to cybersecurity incidents. The program includes defined procedures for incident identification, investigation, documentation, escalation, and communication. Incident response plans are periodically reviewed and tested to promote preparedness and coordination across the organization.

In the event of a significant cybersecurity incident, senior management and the Board are informed in accordance with established escalation protocols. The Company also evaluates whether incidents require notification to customers, regulators, or other stakeholders, as applicable, based on the nature and severity of the incident and applicable legal and regulatory requirements.

The Company manages cybersecurity risks associated with third-party service providers through a third-party risk management program that includes risk-based due diligence, contractual security requirements, and ongoing monitoring. The Company seeks to obtain appropriate assurances regarding third-party security controls and incident notification obligations and monitors third-party performance throughout the lifecycle of the relationship.

While the Company believes that its cybersecurity risk management practices are appropriate for its business and risk profile, cybersecurity threats remain a persistent and evolving risk. The increasing reliance on technology, interconnected systems, and third-party providers heightens the potential impact of a cybersecurity incident.

As of the date of this filing, the Company is not aware of any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations, or financial condition. For additional discussion of cybersecurity-related risks, see Item 1A. “Risk Factors.”

ITEM 2. PROPERTIES

Our headquarters are currently located at 2275 Research Boulevard, Suite 600, Rockville, Maryland 20850. The following table summarizes pertinent details of our commercial bank branch locations, mortgage banking offices, loan production offices (“LPO”), government loan servicing offices, and our credit card operations office. Our mortgage offices typically contain both origination and operations professionals.

Location Owned/Leased Lease Expiration Type of office

7820 West 26th StreetNorth Riverside, IL 60546 Owned Commercial Branch

ITEM 3. LEGAL PROCEEDINGS.

From time to time, we are a party to various litigation matters incidental to the ordinary conduct of our business. We are not presently a party to any legal proceedings likely to result in a material, adverse effect on our financial statements.

ITEM 4. MINE SAFETY DISCLOSURES.

Not applicable.

PART II

ITEM 5. MARKET FOR THE REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES

Shareholder Information

The common stock of the Company has been publicly traded since September 2018 and is currently traded on the Nasdaq Global Select Market under the symbol CBNK. As of March 12, 2026, there were approximately 314 holders of record of our common stock.

Dividends

Commencing with the third quarter of 2021, shareholders have received quarterly cash dividends on shares of common stock. Dividends paid in 2025 totaled $7.3 million. As a general matter, the payment of dividends is at the discretion of the Company’s board of directors, based on such factors as operating results, financial condition, capital adequacy and regulatory requirements. Although we have no obligation to pay dividends and we may change our dividend policy at any time without notice to shareholders, the Company anticipates continuing a regular quarterly cash dividend. Any future determination to pay dividends to holders of our common stock will depend on our results of operations, financial condition, capital requirements, banking regulations, contractual restrictions and any other factors that our board of directors may deem relevant.

Our ability to pay dividends on our common stock is dependent on the Bank’s ability to pay dividends to the Company. Various statutory provisions restrict the amount of dividends that the Bank can pay without regulatory approval.

Repurchases of Common Stock

On February 21, 2025, the Company announced a stock repurchase program under which the Company was authorized to repurchase up to $15 million of its Common Stock, par value $0.01 per share (“Common Stock”), or an aggregate of 483,559 shares of Common Stock. The stock repurchase program expired on February 28, 2026. Although the Company’s stock repurchase program expired on February 28, 2026, the board of directors may, from time to time, consider the adoption of additional stock repurchase programs. Any such program would be dependent on market conditions, the Company’s financial condition, capital levels, regulatory restrictions, and other factors deemed appropriate by the board.

During the year ended December 31, 2025, the Company repurchased 419,643 shares of Common Stock under the stock repurchase program at a weighted-average price of $27.79 per share, totaling $11.7 million.

During the three months ended December 31, 2025, the Company repurchased Common Stock under the stock repurchase program as reflected in the following table.

Equity Compensation Plan Information

The following table provides information as of December 31, 2025, with respect to non-qualified and incentive stock options and restricted stock units (“RSUs”) outstanding and shares available for future awards under the Company’s active equity incentive plans.

(a) (b) (c)

Equity compensation plans approved by security holders:

Equity compensation plans not approved by security holders — — —

_______________

(1) Column (b) includes RSUs that can be exercised for no consideration. Excluding RSUs, the weighted-average exercise price would have been $25.21.

Unregistered Sales of Common Stock

There were no unregistered sales of the Company’s stock during the year ended December 31, 2025.

ITEM 6. [Reserved]

ITEM 7. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

Introduction

This Management’s Discussion and Analysis of Financial Condition and Results of Operations (“MD&A”) is intended as a review of significant factors affecting the Company’s financial condition and results of operations for the periods indicated. This discussion and analysis should be read in conjunction with the accompanying consolidated financial statements and the related notes.

Non-GAAP Financial Measures

This report contains non-GAAP financial measures denoted throughout our MD&A by reference to “non-GAAP.” We believe these non-GAAP financial measures provide useful information to investors because they are used by management to evaluate our operating performance and to make day-to-day operating decisions. In addition, we believe our non-GAAP results in any given reporting period reflect our on-going financial performance in that period and, accordingly, are useful to consider in addition to our GAAP financial results. We further believe the presentation of non-GAAP results increases comparability of period-to-period results.

Other companies may use similarly titled non-GAAP financial measures that may be calculated differently from the way we calculate such measures. Accordingly, our non-GAAP financial measures may not be comparable to similar measures used by such companies. We caution investors not to place undue reliance on such non-GAAP financial measures, but to consider them with the most directly comparable GAAP measures. Non-GAAP financial measures have limitations as analytical tools and should not be considered in isolation or as a substitute for our results reported under GAAP.

For more information on the computation of non-GAAP financial measures, see “Non-GAAP Financial Measures and Reconciliations.”

Financial Performance

The following summary should be read in conjunction with the MD&A section in its entirety.

Net income of $57.2 million for the year ended December 31, 2025 increased $26.2 million, or 84.6% when compared to the prior year, augmented in part by the acquisition of IFH and strong organic growth. Net income as adjusted for the year ended December 31, 2025 of $56.3 million excludes the impact of $3.5 million after-tax impact from issuing a call of brokered time deposits acquired from the IFH transaction (“Call of Brokered Time Deposits”) and $2.6 million after-tax merger-related expenses. Net income as adjusted for the year ended December 31, 2024 included $3.3 million of after-tax merger-related expenses, $3.2 from the Initial IFH ACL Provision on non-purchased credit deteriorated loans, and $2.6 million of non-recurring equity and debt investment write-down that was nondeductible for tax purposes (non-GAAP). Net interest income of $196.0 million increased $41.2 million from the prior year primarily driven by organic growth and the acquisition of IFH. For more information on the computation of non-GAAP financial measures, see “Non-GAAP Financial Measures and Reconciliations.”

The net interest margin decreased 12 basis points to 6.10% for the year ended December 31, 2025 compared to 6.22% for the prior year. The decrease was primarily driven by the acquisition of commercial loans from IFH, which diluted the impact from OpenSkyTM. For the year ended December 31, 2025, average interest earning assets increased $727.9 million, or 29.3%, to $3.2 billion as compared to the same period in 2024, and the average yield on interest earning assets decreased 46 basis points as a result of the acquisition of commercial loans from IFH, diluting the impact from OpenSkyTM. The Commercial Bank net interest margin was 4.38% for the year ended December 31, 2025, which included 15 basis points related to the Call of Brokered Time Deposits, compared to 3.93% for the prior year. For the year ended December 31, 2025, the Commercial Bank average interest earning assets increased $713.4 million, or 30.2%, to $3.1 billion as compared to the same period in 2024, driven by the acquired interest-earning assets from IFH and strong organic growth during 2025. The Commercial Bank yield on portfolio loans (non-GAAP, excluding credit card loans) was 6.99% for the year ended December 31, 2025, which included 4 basis points of purchase accounting accretion, compared to 7.03% for the prior year, which included 3 basis points of purchase accounting amortization. Excluding purchase accounting, the Commercial Bank loan yield decreased 11 basis points primarily due to changes in the rate environment. Compared to the same period in the prior year, average interest-bearing liabilities increased $548.7 million, or 35.2%, while the average cost of interest-bearing liabilities decreased 68 basis points to 3.1% from 3.8%. For additional details, see “Non-GAAP Financial Measures and Reconciliations.”

For the year ended December 31, 2025, the provision for credit losses was $15.0 million, a decrease of $2.8 million from the prior year. The provision for credit losses for the year-ended December 31, 2024 included the initial IFH ACL provision of $4.2 million. Excluding this, the provision for credit losses increased $1.2 million which was primarily due to increased provision expense for OpenSkyTM due to growth in the unsecured credit card portfolio. Net charge-offs for the year ended December 31, 2025 were $12.4 million, or 0.45% of average portfolio loans, compared to $9.0 million, or 0.42% of average portfolio loans, for the same period in 2024. The $12.4 million in net charge-offs during the year ended December 31, 2025 were comprised, in part, of OpenSkyTM credit card portfolio net charge-offs, with $5.4 million related to unsecured cards and $1.6 million related to secured and partially secured cards. Further, $3.4 million of net charge-offs were related to commercial and industrial loans, $1.9 million were related to owner-occupied commercial real estate loans, and $0.3 million were related to construction loans.

For the year ended December 31, 2025, noninterest income of $49.2 million increased $17.8 million, or 56.6%, from the same period in 2024. This increase was primarily driven by reporting results from the IFH acquisition for a full year in 2025 compared to only three months in 2024. Activity from IFH included increased government loan servicing revenue (WindsorTM) of $11.5 million, increased government lending

revenue of $1.9 million, offset by decreased loan servicing rights of $0.5 million. The noninterest income also increased $2.6 million as a result of 2024 including non-recurring equity and debt write-down related to an IFH investment.

For the year ended December 31, 2025, noninterest expense of $155.1 million increased $28.9 million, or 22.9%, from the same period in 2024, largely due to the IFH acquisition. The increase was primarily driven by a $16.1 million, or 28.8%, increase in salaries and employee benefits, a $3.1 million increase in occupancy and equipment, a $3.1 million increase in professional fees, and a $2.1 million, or 7.6%, increase in data processing expense.