CFFI · Read the filing

Table of Contents

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

(Mark One)

For the fiscal year ended December 31, 2022

For the transition period from _________ to _________

Commission file number 000-23423

C&F FINANCIAL CORPORATION

(Exact name of registrant as specified in its charter)

3600 La Grange Parkway

Toano, VA23168

(Address of principal executive offices) (Zip Code)

Registrant’s telephone number, including area code: (804) 843-2360

Securities registered pursuant to Section 12(b) of the Act:

Title of each class Trading Symbol(s) Name of each exchange on which registered

Common Stock, $1.00 par value per share CFFI The NASDAQ Stock Market LLC

Securities registered pursuant to Section 12(g) of the Act:

NONE

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☐No☒

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐No☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer ☐ Accelerated Filer ☒

Non-accelerated filer ☐ Smaller reporting company ☒

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☒

The aggregate market value of common stock held by non-affiliates of the registrant as of June 30, 2022, the last business day of the registrant’s second fiscal quarter, was $151,245,621.

There were 3,466,947 shares of common stock, $1.00 par value per share, outstanding as of February 27, 2023.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the definitive Proxy Statement to be delivered to shareholders in connection with the Annual Meeting of Shareholders to be held April 18, 2023 are incorporated by reference in Part III of this report.

Table of Contents

TABLE OF CONTENTS

PART I Page

ITEM 1. BUSINESS 5

ITEM 1A. RISK FACTORS 19

ITEM 1B. UNRESOLVED STAFF COMMENTS 29

ITEM 2. PROPERTIES 29

ITEM 3. LEGAL PROCEEDINGS 29

ITEM 4. MINE SAFETY DISCLOSURES 29

PART II

ITEM 6. RESERVED 32

ITEM 7A. QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK 77

ITEM 8. FINANCIAL STATEMENTS AND SUPPLEMENTARY DATA 80

ITEM 9A. CONTROLS AND PROCEDURES 131

ITEM 9B. OTHER INFORMATION 134

PART III

ITEM 10. DIRECTORS, EXECUTIVE OFFICERS AND CORPORATE GOVERNANCE 134

ITEM 11. EXECUTIVE COMPENSATION 134

ITEM 14. PRINCIPAL ACCOUNTANT FEES AND SERVICES 135

PART IV

ITEM 15. EXHIBITS, FINANCIAL STATEMENT SCHEDULES 136

SIGNATURES 139

Table of Contents

Cautionary Statement Regarding Forward-Looking Statements

This report contains statements concerning the Corporation’s expectations, plans, objectives or beliefs regarding future financial performance and other statements that are not historical facts, which may constitute “forward-looking statements” as defined by federal securities laws. Forward-looking statements generally can be identified by the use of words such as “believe,” “expect,” “anticipate,” “estimate,” “plan,” “may,” “might,” “will,” “intend,” “target,” “should,” “could,” or similar expressions, are not statements of historical fact, and are based on management’s beliefs, assumptions and expectations regarding future events or performance as of the date of this report, taking into account all information currently available. These statements may include, but are not limited to: statements regarding expected future operations and financial performance; expected trends in yields on loans; expected future recovery of investments in debt securities; expected impact of unrealized losses on earnings and regulatory capital of the Corporation or the Bank; future dividend payments; competition, our loan portfolio; our digital services; deposits; improving operational efficiencies; retention of qualified loan officers; higher quality automobile loan contracts, marine and RV lending; charge-offs; changes in net interest margin and items affecting net interest margin; strategic business initiatives and the anticipated effects thereof on mortgage loan originations; technology initiatives; our diversified business strategy; asset quality; credit quality; adequacy of allowances for loan losses and the level of future charge-offs; adequacy of the reserve for indemnification losses related to loans sold in the secondary market; capital levels; the effect of future market and industry trends; changes in interest rates and the effects of future interest rate levels and fluctuations; cybersecurity risks and inflation. These forward-looking statements are subject to significant risks and uncertainties due to factors that could have a material adverse effect on the operations and future prospects of the Corporation including, but not limited to, changes in:

●interest rates, such as volatility in short-term interest rates or yields on U.S. Treasury bonds, increases in interest rates following actions by the Federal Reserve and increases or volatility in mortgage interest rates

●general business conditions, as well as conditions within the financial markets

●general economic conditions, including unemployment levels, inflation rates, supply chain disruptions and slowdowns in economic growth, and also including the economic impacts of the COVID-19 pandemic

●market disruptions including pandemics or significant health hazards, severe weather conditions, natural disasters, terrorist activities, financial crises, political crises, war and other military conflicts (including the ongoing military conflict between Russia and Ukraine) or other major events, or the prospect of these events

●attracting, hiring, training, motivating and retaining qualified employees

●the effectiveness of the Corporation’s efforts to respond to the COVID-19 pandemic, the pace of economic recovery when the COVID-19 pandemic subsides and the heightened impact it has on many of the risks described herein and in other periodic reports the Corporation files with the SEC.

●the legislative/regulatory climate, regulatory initiatives with respect to financial institutions, products and services, the Consumer Financial Protection Bureau (the CFPB) and the regulatory and enforcement activities of the CFPB

●monetary and fiscal policies of the U.S. Government, including policies of the U.S. Department of the Treasury and the Board of Governors of the Federal Reserve System (the Federal Reserve Board), and the effect of these policies on interest rates and business in our markets

●demand for financial services in the Corporation’s market area

●the value of securities held in the Corporation’s investment portfolios

●the quality or composition of the loan portfolios and the value of the collateral securing those loans

Table of Contents

●the inventory level, demand and fluctuations in the pricing of used automobiles, including sales prices of repossessed vehicles

●the level of automobile loan delinquencies or defaults and our ability to repossess automobiles securing delinquent automobile finance installment contracts

●the level of net charge-offs on loans and the adequacy of our allowance for loan losses

●the level of indemnification losses related to mortgage loans sold

●demand for loan products

●deposit flows

●the strength of the Corporation’s counterparties

●competition from both banks and non-banks, including competition in the automobile finance and marine and recreational vehicle finance markets

●reliance on third parties for key services

●the commercial and residential real estate markets

●the demand for residential mortgages and conditions in the secondary residential mortgage loan markets

●the Corporation's technology initiatives and other strategic initiatives

●the Corporation’s branch expansions and consolidations

●cyber threats, attacks or events

●expansion of C&F Bank’s product offerings

●accounting principles, policies and guidelines and elections made by the Corporation thereunder

These risks and uncertainties, and the risks discussed in more detail in Item 1A. “Risk Factors,” should be considered in evaluating the forward-looking statements contained herein. Readers should not place undue reliance on any forward-looking statement. There can be no assurance that actual results will not differ materially from historical results or those expressed in or implied by such forward-looking statements, or that the beliefs, assumptions and expectations underlying such forward-looking statements will be proven to be accurate. Forward-looking statements are made as of the date of this report and we undertake no obligation to update or revise any forward-looking statement to reflect events or circumstances arising after the date on which the statement was made, except as otherwise required by law.

Table of Contents

PART I

ITEM 1.BUSINESS

General

C&F Financial Corporation (the Corporation) is a bank holding company that was incorporated in March 1994 under the laws of the Commonwealth of Virginia. The Corporation owns all of the stock of Citizens and Farmers Bank (the Bank or C&F Bank), which is an independent commercial bank chartered under the laws of the Commonwealth of Virginia. C&F Bank originally opened for business under the name Farmers and Mechanics Bank on January 22, 1927. C&F Bank has the following five wholly-owned subsidiaries, all incorporated under the laws of the Commonwealth of Virginia:

● C&F Mortgage Corporation

● C&F Finance Company

● C&F Wealth Management Corporation

● C&F Insurance Services, Inc.

● CVB Title Services, Inc.

The Corporation operates in a decentralized manner in three principal business segments: (1) community banking through C&F Bank, C&F Wealth Management Corporation (C&F Wealth Management), C&F Insurance Services, Inc. (C&F Insurance) and CVB Title Services, Inc. (CVB Title), (2) mortgage banking through C&F Mortgage Corporation (C&F Mortgage) and (3) consumer finance through C&F Finance Company (C&F Finance). For detailed information about the financial condition and results of operations of these segments, see “Note 20: Business Segments” in Item 8. “Financial Statements and Supplementary Data” in this report.

The Corporation also owns three non-operating subsidiaries, C&F Financial Statutory Trust II (Trust II) formed in December 2007, C&F Financial Statutory Trust I (Trust I) formed in July 2005, and Central Virginia Bankshares Statutory Trust I (CVBK Trust I) formed in December 2003. These trusts were formed for the purpose of issuing $10.0 million each for Trust II and Trust I and $5.0 million for CVBK Trust I of trust preferred capital securities in private placements to institutional investors. All three trusts are unconsolidated subsidiaries of the Corporation. The principal assets of these trusts are $10.3 million each for Trust II and Trust I and $5.2 million for CVBK Trust I of the Corporation’s junior subordinated debt securities (such securities of the Corporation referred to herein as “trust preferred capital notes”) that are reported as liabilities in the consolidated balance sheet of the Corporation.

Community Banking

We provide community banking services through C&F Bank. C&F Bank provides community banking services at its main office in West Point, Virginia, and 30 Virginia branches located one each in the counties of Albemarle, Goochland, Hanover, King George, Middlesex, Powhatan, Stafford and York and the towns and cities of Charlottesville, Fredericksburg, Hampton, Montross, Newport News, Richmond, Warsaw and Williamsburg, two each in the counties of Cumberland, James City and New Kent, and four each in the counties of Chesterfield and Henrico. These branches provide a wide range of banking services to individuals and businesses. These services include various types of checking and savings deposit accounts, as well as business, real estate, development, mortgage, home equity and installment loans. The Bank also offers ATMs, internet and mobile banking, peer-to-peer payment capabilities and debit cards, as well as safe deposit box rentals, notary public, electronic transfer and other customary bank services to its customers. C&F Bank manages its commercial lending portfolio primarily through commercial lending offices located in Charlottesville, Fredericksburg, Richmond and Williamsburg, Virginia. C&F Wealth Management, which was organized in April 1995, is a full-service brokerage firm offering a comprehensive range of wealth management services and insurance products

Table of Contents

through third-party service providers primarily at C&F Bank branch locations. C&F Insurance and CVB Title were organized for the primary purpose of owning equity interests in an independent insurance agency and a full service title and settlement agency, respectively. Revenues from community banking operations consist primarily of interest earned on loans and investment securities, fees earned on deposit accounts and debit card interchange, net revenues from offering wealth management services and insurance products, and investment income from equity interests. Community banking revenues and operations are not materially affected by seasonal factors; however, public deposits tend to increase with tax collections primarily in the fourth quarter of each year and decline with spending thereafter. At December 31, 2022, assets of the community banking segment totaled $2.2 billion. For the year ended December 31, 2022, net income for this segment totaled $24.4 million.

Mortgage Banking

We conduct mortgage banking activities through C&F Mortgage, which was organized in September 1995, and its 51%-owned subsidiary, C&F Select LLC, which was organized in January 2019. C&F Mortgage provides mortgage loan origination services through 14 locations in Virginia and one each in Maryland, North Carolina, South Carolina, and West Virginia. The Virginia offices are located one each in Charlottesville, Chesapeake, Fishersville, Fredericksburg, Glen Allen, Harrisonburg, Mechanicsville, Richmond, Virginia Beach, Waynesboro, Williamsburg, and Yorktown, and two in Midlothian. The North Carolina office is located in Gastonia. The Maryland office is located in Clarksville. The South Carolina office is located in Fort Mill. The West Virginia office is located in Keyser. C&F Select LLC provides mortgage loan origination services through two locations in Richmond, Virginia. The mortgage banking segment offers a wide variety of residential mortgage loans, which are originated for sale to investors in the secondary mortgage market. The mortgage banking segment does not securitize loans. C&F Bank also purchases mortgage loans from the mortgage banking segment. The mortgage banking segment originates conventional mortgage loans, mortgage loans insured by the Federal Housing Administration (the FHA), and mortgage loans guaranteed by the United States Department of Agriculture (the USDA) and the Veterans Administration (the VA). A majority of the conventional loans are conforming loans that qualify for purchase by the Federal National Mortgage Association (Fannie Mae) or the Federal Home Loan Mortgage Corporation (Freddie Mac). The remainder of the conventional loans are non-conforming in that they do not meet Fannie Mae or Freddie Mac guidelines, but are eligible for sale to various other investors. The mortgage banking segment also has a division, Lender Solutions, that provides certain mortgage loan origination functions as a service to third party mortgage lenders and a subsidiary, Certified Appraisals LLC, which provides ancillary mortgage loan production services to third parties for residential appraisals. Revenues from mortgage banking operations consist principally of gains on sales of loans to investors in the secondary mortgage market, loan origination fee income, interest earned on mortgage loans held for sale and mortgage lender services income through Lender Solutions. Revenues and income from mortgage banking, which are driven primarily by the origination and sale of mortgage loans, are subject to seasonal factors, including the volume of home sales in the residential real estate market, which typically rises during spring and summer months and declines during fall and winter months. However, seasonal trends may be disrupted by cyclical and other economic factors that affect the residential real estate market. At December 31, 2022, assets of the mortgage banking segment totaled $24.5 million. For the year ended December 31, 2022, net income for this segment totaled $1.2 million.

Consumer Finance

We conduct consumer finance activities through C&F Finance. C&F Finance is a regional finance company purchasing automobile, marine and recreational vehicle (RV) loans throughout Virginia and in portions of Alabama, Colorado, Florida, Georgia, Illinois, Indiana, Iowa, Kansas, Kentucky, Maryland, Minnesota, Missouri, New Jersey, North Carolina, Ohio, Pennsylvania, South Carolina, Tennessee, Texas and West Virginia through its office in Henrico, Virginia. C&F Finance is an indirect lender that primarily provides automobile financing through lending programs that are designed to serve customers in both the prime and “non-prime” markets, including those who may have limited access to traditional automobile financing due to having experienced prior credit difficulties. C&F Finance generally purchases automobile retail installment sales contracts from manufacturer-franchised dealerships with used-car operations and through selected independent dealerships. C&F Finance selects these dealers based on the types of vehicles sold. Specifically, C&F Finance prefers to finance later model, low mileage used vehicles because the value of new vehicles typically depreciates rapidly. Because C&F Finance serves customers with higher credit risk, C&F Finance typically charges interest at higher rates than those charged by traditional financing sources. In addition, because C&F Finance provides financing in a relatively higher-

Table of Contents

risk market compared to that of C&F Bank or other traditional financial institutions, it expects to experience a higher level of credit losses than financing sources that lend primarily to more credit-worthy borrowers. In addition to automobile financing, beginning in 2018, C&F Finance expanded its lending portfolio to include marine and RV loan contracts. These contracts are also purchased on an indirect basis through a referral program administered by a third party and are for prime loans made to individuals with higher credit scores and therefore typically priced at rates lower than C&F Finance’s automobile loans. Revenues from consumer finance operations consist principally of interest earned on automobile, marine and RV loans. While the consumer finance segment’s loans outstanding and interest income are not materially affected by seasonal factors, delinquencies on automobile loans are generally highest in the period from November through January, related in part to seasonal trends affecting borrowers, including consumer spending. At December 31, 2022, assets of the consumer finance segment totaled $479.9 million. For the year ended December 31, 2022, net income for this segment totaled $6.8 million.

Human Capital Resources

The Corporation and its subsidiaries foster a culture of respect, teamwork, ownership, responsibility, initiative, integrity, and service. We believe that our officers and employees are our most important assets. Our people are critical to the Corporation’s performance and the achievement of our strategic goals, and they represent a key element of how the Corporation’s businesses compete and succeed.

Acquiring and retaining strong talent is a top strategic priority for each of the Corporation’s businesses. We provide a competitive compensation and benefits program to help meet the needs of our employees, including benefits that incentivize retention and reward longevity. We support the health and well-being of our employees through a comprehensive program designed to increase employee focus on wellness and prevention, including the benefit plans we offer, health incentives and dedicated healthcare resources for employees and their families provided through onsite health centers located at our offices in Toano and Henrico, Virginia and virtually. We encourage and support the growth and development of our employees and, wherever possible, seek to fill positions by promotion and transfer from within our organization. We have created career paths for specific positions that are designed to encourage an employee’s advancement and growth within our organization, and we aim to provide employees with the skills and opportunities they need to achieve their career goals and become leaders in our businesses.

At December 31, 2022, we employed 613 full-time equivalent employees. We consider relations with our employees to be excellent. We strive for our workforce to reflect the diversity of the customers and communities we serve. Our selection and promotion processes are without bias and include the active recruitment of minorities and women. At December 31, 2022, women represented 67 percent of our employees, and racial and ethnic minorities represented 20 percent of our employees. We also aim for our employees to develop their careers in our businesses. At December 31, 2022, 23 percent of our employees have been employed by the Corporation or its subsidiaries for at least 15 years.

Competition

Community Banking

In the Bank’s market area, we compete with large national and regional financial institutions, savings associations and other independent community banks, as well as credit unions, mutual funds, brokerage firms, insurance companies and other lending and deposit platforms offered by non-bank financial technology firms, including those that only operate digitally. Increased competition has come from out-of-state banks through their acquisition of Virginia-based banks and interstate branching, and expansion of community and regional banks into our service areas.

The banking business in Virginia, and specifically in the Bank’s primary service areas of eastern and central Virginia, is highly competitive for both loans and deposits, and is dominated by a relatively small number of large banks with many offices operating over a wide geographic area. Among the advantages such large banks have are their ability to finance wide-ranging advertising campaigns, to make larger investments in technological advancements and new products

Table of Contents

and services, to maximize efficiencies through economies of scale and, by virtue of their greater total capitalization, to have substantially higher lending limits than the Bank.

Factors such as interest rates offered, the number and location of branches, digital services and the types of products offered, as well as the reputation of the institution, affect competition for deposits and loans. We compete by emphasizing customer service, establishing long-term customer relationships, building customer loyalty and providing traditional and digital products and services to address the specific needs of our customers. Our relationships with customers depend on, among other things, our ability to attract and retain talented community bankers. We target individual customers, small-to-medium size business customers and acquisition, development and construction loan customers in our markets.

No material part of the Bank’s business is dependent upon a single or a few customers, and the loss of any single customer would not have a materially adverse effect upon the Bank’s business.

Mortgage Banking

C&F Mortgage competes with large national and regional banks, credit unions, smaller regional mortgage lenders, small local broker operations and internet lending platforms. Due to the increased regulatory and compliance burden, the industry has seen a consolidation in the number of competitors in the marketplace. The agency guidelines for sales of mortgages in the secondary market business continue to be stringent.

The competitive factors faced by C&F Mortgage continue to evolve because of regulatory reforms and initiatives, including expansion in recent years of consumer protections and related regulation of mortgage lending. While C&F Mortgage has kept pace with changes in such regulations to date, potential future legislative and regulatory initiatives have the potential to affect the operations of C&F Mortgage. Given the far-reaching effect of these regulations on mortgage finance, compliance has required and may continue to require substantial changes to mortgage lending systems and processes and other implementation efforts. These challenges may be compounded by sustained lower mortgage industry volume as a result of rising interest rates.

To operate profitably in this high interest rate and competitive and regulatory environment, mortgage companies must have a high level of operational and risk management skills and be able to attract and retain top mortgage origination talent. C&F Mortgage competes by attracting the top people in sales and operations in the industry, expanding into new markets that offer strategic growth opportunities, providing an infrastructure that manages regulatory changes efficiently and effectively, utilizing technology to improve efficiency and consistency in its operations and to mitigate compliance risk, offering products that are competitive in both loan parameters and pricing, and providing consistently high quality customer service.

No material part of C&F Mortgage’s business is dependent upon a single customer and the loss of any single customer would not have a materially adverse effect upon C&F Mortgage’s business. C&F Mortgage, like all residential mortgage lenders, would be affected by the inability of Fannie Mae, Freddie Mac, the FHA or the VA to purchase or guarantee loans. Although C&F Mortgage sells loans to various third-party investors, the ability of these aggregators to purchase or guarantee loans would be limited if these government-sponsored entities cease to exist or materially limit their purchases or guarantees of mortgage loans or suffer deteriorations in their financial condition.

Consumer Finance

The automobile finance business is highly competitive. The automobile finance market is highly fragmented and is served by a variety of financial entities, including the captive finance affiliates of major automotive manufacturers, banks, savings associations, credit unions and independent finance companies. Many of these competitors have substantially greater financial resources and lower costs of funds than our finance subsidiary. In addition, competitors often provide financing on terms that are more favorable to automobile purchasers or dealers than the terms C&F Finance offers. Many of these competitors also have long-standing relationships with automobile dealerships and may offer dealerships or their customers other forms of financing, including dealer floor plan financing and leasing, which we do not.

Table of Contents

Over the past several years, a number of financial institutions and other lenders have increased focus on operations in the non-prime automobile finance markets resulting in intensified competition for loans and qualified personnel. To continue to operate profitably, lenders must have a high level of operational and risk management skills and access to competitive costs of funds.

Providers of automobile financing traditionally have competed on the basis of interest rates charged, the quality of credit accepted, the flexibility of loan terms offered and the quality of service provided to dealers and customers. To establish C&F Finance as one of the principal financing sources for the dealers it serves, we compete predominantly by providing a high level of dealer service, building strong dealer relationships, offering flexible loan terms and quickly funding loans purchased from dealers.

No material part of C&F Finance’s business is dependent upon any single dealer relationship, and the loss of any single dealer relationship would not have a materially adverse effect upon C&F Finance’s business.

Regulation and Supervision

General

Bank holding companies, banks and their affiliates are extensively regulated under both federal and state law. Consequently, the growth and earnings performance of the Corporation and the Bank can be affected not only by management’s decisions and general economic conditions, but also by the statutes administered by, and the regulations and policies of, various governmental regulatory authorities including, but not limited to, the Virginia State Corporation Commission Bureau of Financial Institutions (VBFI), the Federal Deposit Insurance Corporation (the FDIC), the Board of Governors of the Federal Reserve System (the Federal Reserve Board), the Internal Revenue Service, federal and state taxing authorities, and the Securities and Exchange Commission (the SEC).

The following summary briefly describes significant provisions of currently applicable federal and state laws and certain regulations and the potential impact of such provisions. This summary is not complete, and we refer you to the particular statutory or regulatory provisions or proposals for more information. Because regulation of financial institutions changes regularly and is the subject of constant legislative and regulatory debate, we cannot forecast how federal and state regulation and supervision of financial institutions may change in the future and affect the Corporation’s and the Bank’s operations. See “Risks Related to the Regulation of the Corporation” below in Item 1A of Part I of Annual Report on Form 10-K for further discussion.

Regulatory Reform

The financial crisis of 2008, including the downturn of global economic, financial and money markets and the threat of collapse of numerous financial institutions, and other events led to the adoption of numerous laws and regulations that apply to, and focus on, financial institutions. The most significant of these laws is the Dodd-Frank Wall Street Reform and Consumer Protection Act (the Dodd-Frank Act), which was enacted on July 21, 2010 and, in part, was intended to implement significant structural reforms to the financial services industry.

The Dodd-Frank Act implemented far-reaching changes across the financial regulatory landscape, including changes that have significantly affected the business of all bank holding companies and banks, including the Corporation and the Bank. Some of the rules that have been proposed and, in some cases, adopted to comply with the Dodd-Frank Act's mandates are discussed further below.

In May 2018, the Economic Growth, Regulatory Relief and Consumer Protection Act (the EGRRCPA) was enacted to reduce the regulatory burden on certain banking organizations, including community banks, by modifying or eliminating certain federal regulatory requirements. In particular, the EGRRCPA amended certain provisions of the Dodd-Frank Act as well as statutes administered by the Federal Reserve and the FDIC. Certain provisions of the Dodd-Frank Act and changes thereto resulting from the enactment of EGRRCPA that may affect the Corporation and the Bank are discussed below in more detail.

Table of Contents

The Corporation continues to experience ongoing regulatory reform. These regulatory changes could have a significant effect on how we conduct business. The specific implications of the Dodd-Frank Act, the EGRRCPA, and other potential regulatory reforms cannot yet be fully predicted and will depend to a large extent on the specific regulations that are to be adopted in the future.

Regulation of the Corporation

As a bank holding company, the Corporation is subject to the Bank Holding Company Act of 1956 (the BHCA) and regulation and supervision by the Federal Reserve Board. Pursuant to the BHCA the Federal Reserve Board has the power to order any bank holding company or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the Federal Reserve Board has reasonable grounds to believe that continuation of such activity or ownership constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company. The Federal Reserve Board and the FDIC have adopted guidelines and released interpretative materials that establish operational and managerial standards to promote the safe and sound operation of banks and bank holding companies. These standards relate to the institution’s key operating functions, including but not limited to capital management, internal controls, internal audit systems, information systems, data and cybersecurity, loan documentation, credit underwriting, interest rate exposure and risk management, vendor management, executive management and its compensation, corporate governance, asset growth, asset quality, earnings, liquidity and risk management.

The BHCA generally limits the activities of a bank holding company and its subsidiaries to that of banking, managing or controlling banks, or any other activity that is closely related to banking or to managing or controlling banks, and permits interstate banking acquisitions subject to certain conditions, including national and state concentration limits. The Federal Reserve Board has jurisdiction under the BHCA to approve any bank or non-bank acquisition, merger or consolidation proposed by a bank holding company. A bank holding company must be “well capitalized” and “well managed” to engage in an interstate bank acquisition or merger, and banks may branch across state lines provided that the law of the state in which the branch is to be located would permit establishment of the branch if the bank were a state bank chartered by such state. Bank holding companies and their subsidiaries are also subject to restrictions on transactions with insiders and affiliates, as further discussed below.

Each of the Bank’s depository accounts is insured by the FDIC against loss to the depositor to the maximum extent permitted by applicable law, and federal law and regulatory policy impose a number of obligations and restrictions on the Corporation and the Bank to reduce potential loss exposure to depositors and to the FDIC Deposit Insurance Fund (DIF). For example, pursuant to the Dodd-Frank Act and Federal Reserve Board policy, a bank holding company must commit resources to support its subsidiary depository institutions, which is referred to as serving as a “source of strength.”

The Federal Deposit Insurance Act (the FDIA) provides that amounts received from the liquidation or other resolution of any insured depository institution must be distributed, after payment of secured claims, to pay the deposit liabilities of the institution before payment of any other general creditor or stockholder of that institution – including that institution’s parent holding company. This provision would give depositors a preference over general and subordinated creditors and stockholders if a receiver is appointed to distribute the assets of a bank.

The Corporation also is subject to regulation and supervision by the Virginia State Corporation Commission. The Corporation also must file annual, quarterly and other periodic reports with, and comply with other regulations of, the SEC.

Capital Requirements

Regulatory Capital Requirements. All financial institutions are required to maintain minimum levels of regulatory capital. The FDIC establishes risk-based and leveraged capital standards for the financial institutions they regulate. The FDIC also may impose capital requirements in excess of these standards on a case-by-case basis for various reasons, including financial condition or actual or anticipated growth.

Table of Contents

Basel III Capital Framework. The Federal Reserve Board and the FDIC have adopted rules to implement the Basel III capital framework as outlined by the Basel Committee on Banking Supervision and standards for calculating risk-weighted assets and risk-based capital measurements (collectively, the Basel III Final Rules) that apply to banking institutions they supervise. For the purposes of these capital rules, (i) common equity tier 1 capital (CET1) consists principally of common stock (including surplus) and retained earnings; (ii) Tier 1 capital consists principally of CET1 plus non-cumulative preferred stock and related surplus, and certain grandfathered cumulative preferred stocks and trust preferred securities; and (iii) Tier 2 capital consists of other capital instruments, principally qualifying subordinated debt and preferred stock, and limited amounts of an institution’s allowance for loan losses. Each regulatory capital classification is subject to certain adjustments and limitations, as implemented by the Basel III Final Rules. The Basel III Final Rules also establish risk weightings that are applied to many classes of assets held by community banks, importantly including applying higher risk weightings to certain commercial real estate loans. The Basel III Final Rules also include a requirement that banks maintain additional capital known as the “capital conservation buffer.”

The Basel III Final Rules and capital conservation buffer require banks and bank holding companies to maintain:

The Basel III Final Rules provide deductions from and adjustments to regulatory capital measures, primarily to CET1, including deductions and adjustments that were not applied to reduce CET1 under historical regulatory capital rules. For example, mortgage servicing rights, deferred tax assets dependent upon future taxable income, and significant investments in non-consolidated financial entities must be deducted from CET1 to the extent that any one such category exceeds 25 percent of CET1.

The Basel III Final Rules permanently include in Tier 1 capital trust preferred securities issued prior to May 19, 2010 by bank holding companies with less than $15 billion in total assets, subject to a limit of 25 percent of Tier 1 capital. The Corporation expects that its trust preferred securities will be included in the Corporation’s regulatory capital as Tier 1 capital instruments until their maturity.

As of December 31, 2022, the Bank met all capital adequacy requirements under the Basel III Final Rules, including the capital conservation buffer.

Community Bank Leverage Ratio. As required by the EGRRCPA, the federal banking agencies issued a rule in September 2019 that permits qualifying banks with less than $10 billion in consolidated assets to elect to be subject to a 9% leverage ratio applied using less complex leverage calculations (the Community Bank Leverage Ratio Framework or CBLRF). Banks that opt into the CBLRF and maintain a leverage ratio of greater than 9% are not subject to other risk-based and leverage capital requirements and are deemed to meet Basel III Final Rules’ well capitalized ratio requirements. As of December 31, 2022, the Bank has not elected to apply the CBLRF, but the Bank continues to assess the potential impact of opting in to CBLRF as part of its ongoing capital management and planning processes.

Small Bank Holding Company. The EGRRCPA also expanded the category of bank holding companies that may rely on the Federal Reserve Board’s Small Bank Holding Company Policy Statement by raising the maximum amount of

Table of Contents

assets a qualifying bank holding company may have from $1 billion to $3 billion. In addition to meeting the asset threshold, a bank holding company must not engage in significant nonbanking activities, not conduct significant off-balance sheet activities, and not have a material amount of debt or equity securities outstanding and registered with the SEC (subject to certain exceptions). The Federal Reserve Board may, in its discretion, exclude any bank holding company from the application of the Small Bank Holding Company Policy Statement if such action is warranted for supervisory purposes.

In August 2018, the Federal Reserve Board issued an interim final rule to apply the Small Bank Holding Company Policy Statement to bank holding companies with consolidated total assets of less than $3 billion. The policy statement, which, among other things, exempts certain bank holding companies from minimum consolidated regulatory capital ratios that apply to other bank holding companies. As a result of the interim final rule, which was effective August 30, 2018, the Corporation expects that it will be treated as a small bank holding company and will not be subject to regulatory capital requirements. The comment period on the interim final rule closed on October 29, 2018 and, to date, the Federal Reserve Board has not issued a final rule to replace the interim final rule. The Bank remains subject to the regulatory capital requirements described above.

Limits on Dividends

The Corporation is a legal entity that is separate and distinct from the Bank. A significant portion of the revenues of the Corporation result from dividends paid to it by the Bank. Both the Corporation and C&F Bank are subject to laws and regulations that limit the payment of dividends, including limits on the sources of dividends and requirements to maintain capital at or above regulatory minimums. Banking regulators have indicated that Virginia banking organizations should generally pay dividends only (1) from net undivided profits of the bank, after providing for all expenses, losses, interest and taxes accrued or due by the bank and (2) if the prospective rate of earnings retention appears consistent with the organization’s capital needs, asset quality and overall financial condition. In addition, Federal Reserve Board supervisory guidance indicates that the Federal Reserve Board may have safety and soundness concerns if a bank holding company pays dividends that exceed earnings for the period in which the dividend is being paid. Further, the FDIA prohibits insured depository institutions such as C&F Bank from making capital distributions, including paying dividends, if, after making such distribution, the institution would become undercapitalized as defined in the statute. We do not expect that any of these laws, regulations or policies will materially affect the ability of the Corporation or C&F Bank to pay dividends.

Insurance of Accounts, Assessments and Regulation by the FDIC

The Bank’s deposits are insured by the DIF of the FDIC up to the standard maximum insurance amount for each deposit insurance ownership category. The basic limit on FDIC deposit insurance coverage is $250,000 per depositor. Under the FDIA, the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations as an insured institution, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, subject to administrative and potential judicial hearing and review processes. The FDIC may also suspend deposit insurance temporarily during the hearing process for the permanent termination of insurance if the institution has no tangible capital. If deposit insurance is terminated, the deposits at the institution at the time of termination, less subsequent withdrawals, shall continue to be insured for a period from six months to two years, as determined by the FDIC. Management is aware of no existing circumstances that could result in termination of the Bank’s deposit insurance.

Deposit Insurance Assessments. The DIF is funded by assessments on banks and other depository institutions calculated based on average consolidated total assets minus average tangible equity (defined as Tier 1 capital). As required by the Dodd-Frank Act, the FDIC has adopted a large-bank pricing assessment scheme, set a target “designated reserve ratio” (described in more detail below) of 2 percent for the DIF and, in lieu of dividends, provides for a lower assessment rate schedule when the reserve ratio reaches 2 percent and 2.5 percent. An institution's assessment rate is based on a statistical analysis of financial ratios that estimates the likelihood of failure over a three-year period, which considers the institution’s weighted average CAMELS composite rating, and is subject to further adjustments including those related to levels of unsecured debt and brokered deposits. At December 31, 2022, total base assessment rates for institutions that

Table of Contents

have been insured for at least five years range from 1.5 to 30 basis points applying to banks with less than $10 billion in assets.

The Dodd-Frank Act transferred to the FDIC increased discretion with regard to managing the required amount of reserves for the DIF, or the “designated reserve ratio.” The FDIA requires that the FDIC consider the appropriate level for the designated reserve ratio on at least an annual basis. On October 18, 2022, the FDIC adopted a final rule to increase initial base deposit insurance assessment rate schedules uniformly by 2 basis points, beginning in the first quarterly assessment period of 2023. As a result of this final rule, the total base assessment rates beginning with the first quarter of 2023 for institutions with less than $10 billion in assets that have been insured for at least five years range from 2.5 to 32 basis points. This increase in assessment rate schedules is intended to increase the likelihood that the reserve ratio reaches 1.35 percent by the statutory deadline of September 30, 2028. The new assessment rate schedules will remain in effect unless and until the reserve ratio meets or exceeds 2 percent. Progressively lower assessment rate schedules will take effect when the reserve ratio reaches 2 percent, and again when it reaches 2.5 percent.

Regulation and Supervision of the Bank and Other Subsidiaries

The Bank is subject to supervision, regulation and examination by the VBFI and its primary federal regulator, the FDIC. The various laws and regulations issued and administered by the regulatory agencies (including the CFPB) affect corporate practices, such as the payment of dividends, the incurrence of debt and the acquisition of financial institutions and other companies, and affect business practices and operations, such as the payment of interest on deposits, the charging of interest on loans, the types of business conducted, the products and terms offered to customers and the location of offices. Prior approval of the applicable primary federal regulator and the VBFI is required for a Virginia chartered bank or bank holding company to merge with another bank or bank holding company, or purchase the assets or assume the deposits of another bank or bank holding company, or acquire control of another bank or bank holding company. In reviewing applications seeking approval of merger and acquisition transactions, the bank regulatory agencies will consider, among other things, the competitive effect and public benefits of the transactions, the financial condition, managerial resources, capital position and any asset concentrations (including commercial real estate loan concentrations) of the constituent organizations and the combined organization, the risks to the stability of the U.S. banking or financial system, the applicant's performance record under the Community Reinvestment Act (CRA) and fair housing initiatives, the data security and cybersecurity infrastructure of the constituent organizations and the combined organization, the applicant’s risk management programs and processes, and the applicant’s compliance with and the effectiveness of the subject organizations in combating money laundering activities and complying with Bank Secrecy Act requirements.

Certain Transactions by Insured Banks with their Affiliates. There are statutory restrictions related to the extent bank holding companies and their non-bank subsidiaries may borrow, obtain credit from or otherwise engage in “covered transactions” with their insured depository institution (i.e., banking) subsidiaries. In general, an “affiliate” of a bank includes the bank’s parent holding company and any subsidiary thereof. However, an “affiliate” does not generally include the bank’s operating subsidiaries. A bank (and its subsidiaries) may not lend money to, or engage in other covered transactions with, its non-bank affiliates if the aggregate amount of covered transactions outstanding involving the bank, plus the proposed transaction, exceeds the following limits: (a) in the case of any one such affiliate, the aggregate amount of covered transactions of the bank and its subsidiaries cannot exceed 10 percent of the bank’s capital stock and surplus; and (b) in the case of all affiliates, the aggregate amount of covered transactions of the bank and its subsidiaries cannot exceed 20 percent of the bank’s capital stock and surplus. “Covered transactions” are defined to include a loan or extension of credit to an affiliate, a purchase of or investment in securities issued by an affiliate, a purchase of assets from an affiliate, the acceptance of securities issued by an affiliate as collateral for a loan or extension of credit to any person or company, the issuance of a guarantee, acceptance or letter of credit on behalf of an affiliate, securities borrowing or lending transactions with an affiliate that creates a credit exposure to such affiliate, or a derivatives transaction with an affiliate that creates a credit exposure to such affiliate. Certain covered transactions are also subject to collateral security requirements.

Covered transactions as well as other types of transactions between a bank and a bank holding company must be on market terms, which means that the transaction must be conducted on terms and under circumstances that are substantially the same, or at least as favorable to the bank, as those prevailing at the time for comparable transactions with or involving

Table of Contents

nonaffiliates or, in the absence of comparable transactions, that in good faith would be offered to or would apply to nonaffiliates. Moreover, certain amendments to the BHCA provide that, to further competition, a bank holding company and its subsidiaries are prohibited from engaging in certain tying arrangements in connection with any extension of credit, lease or sale of property of any kind, or furnishing of any service.

Community Reinvestment Act. The CRA imposes on financial institutions an affirmative and ongoing obligation to meet the credit needs of their local communities, including low and moderate-income neighborhoods, consistent with the safe and sound operation of those institutions. A financial institution’s efforts in meeting community credit needs are assessed based on specified factors. These factors also are considered in evaluating mergers, acquisitions and applications to open a branch or facility. In 2020, the last time that the Bank's CRA activities were evaluated by the FDIC, the Bank received a “Satisfactory” CRA rating.

Federal Home Loan Bank of Atlanta. The Bank is a member of the Federal Home Loan Bank (FHLB) of Atlanta, which is one of 11 regional FHLBs that provide funding to their members for making housing loans as well as for affordable housing and community development loans. Each FHLB serves as a reserve, or central bank, for the members within its assigned region. Each FHLB makes loans to members in accordance with policies and procedures established by the Board of Directors of the FHLB. As a member, the Bank must purchase and maintain stock in the FHLB. At December 31, 2022, the Bank owned $1.1 million of FHLB stock.

Consumer Protection. The CFPB is the federal regulatory agency that is responsible for implementing, examining and enforcing compliance with federal consumer financial laws for institutions with more than $10 billion of assets and, to a lesser extent, smaller institutions. The CFPB supervises and regulates providers of consumer financial products and services, and has rulemaking authority in connection with numerous federal consumer financial protection laws (for example, but not limited to, the Truth-in-Lending Act (TILA) and the Real Estate Settlement Procedures Act (RESPA)).

Because the Corporation and the Bank are smaller institutions (i.e., with assets of $10 billion or less), most consumer protection aspects of the Dodd-Frank Act will continue to be applied to the Corporation by the Federal Reserve Board and to the Bank by the FDIC. However, the CFPB may include its own examiners in regulatory examinations by a smaller institution’s principal regulators and may require smaller institutions to comply with certain CFPB reporting requirements. In addition, regulatory positions taken by the CFPB and administrative and legal precedents established by CFPB enforcement activities, including in connection with supervision of larger bank holding companies and banks, could influence how the Federal Reserve Board and FDIC apply consumer protection laws and regulations to financial institutions that are not directly supervised by the CFPB. The precise effect of the CFPB’s consumer protection activities on the Corporation and the Bank cannot be determined with certainty.

Mortgage Banking Regulation. In connection with making mortgage loans, the Bank is subject to rules and regulations that, among other things, establish standards for loan origination, prohibit discrimination, provide for inspections and appraisals of property, require credit reports on prospective borrowers, in some cases restrict certain loan features and fix maximum interest rates and fees, require the disclosure of certain basic information to mortgagors concerning credit and settlement costs, limit payment for settlement services to the reasonable value of the services rendered and require the maintenance and disclosure of information regarding the disposition of mortgage applications based on race, gender, geographical distribution and income level. The Bank’s mortgage origination activities are subject to the Equal Credit Opportunity Act (ECOA), TILA, Home Mortgage Disclosure Act, RESPA, and Home Ownership Equity Protection Act, and the regulations promulgated under these acts, among other additional state and federal laws, regulations and rules.

The Bank’s mortgage origination activities are also subject to Regulation Z, which implements TILA. Certain provisions of Regulation Z require mortgage lenders to make a reasonable and good faith determination, based on verified and documented information, that a consumer applying for a mortgage loan has a reasonable ability to repay the loan according to its terms. Alternatively, a mortgage lender can originate “qualified mortgages”, which are generally defined as mortgage loans without negative amortization, interest-only payments, balloon payments, terms exceeding 30 years, and points and fees paid by a consumer equal to or less than 3 percent of the total loan amount. Under the EGRRCPA, most residential mortgage loans originated and held in portfolio by a bank with less than $10 billion in assets will be

Table of Contents

designated as “qualified mortgages.” Higher-priced qualified mortgages (e.g., sub-prime loans) receive a rebuttable presumption of compliance with ability-to-repay rules, and other qualified mortgages (e.g., prime loans) are deemed to comply with the ability-to-repay rules. The Corporation’s mortgage banking segment predominately originates mortgage loans that comply with Regulation Z’s “qualified mortgage” rules.

In addition to regulations applicable to the Bank’s mortgage origination activities, C&F Mortgage is subject to the rules and regulations of, and examination by, the Department of Housing and Urban Development (HUD), the FHA, the USDA, the VA and state regulatory authorities with respect to originating, processing and selling mortgage loans. Those rules and regulations, among other things, establish standards for loan origination, prohibit discrimination, provide for inspections and appraisals of property, require credit reports on prospective borrowers and, in some cases, restrict certain loan features and fix maximum interest rates and fees.

Consumer Financing Regulation. C&F Finance also is regulated by the states and local jurisdictions in which it operates, and its lending operations are subject to numerous federal regulations over which the CFPB has rulemaking authority and regarding which enforcement authority is shared by the Federal Reserve Board, the FDIC, the Department of Justice and the Federal Trade Commission. Such rules and regulations generally provide for licensing of sales finance agencies; limitations on amounts, duration and charges, including interest rates, for various categories of loans; requirements as to the form and content of finance contracts and other documentation; and restrictions on collection practices and creditors’ rights. C&F Finance is subject to regulation and supervision by the VBFI, which regulates and enforces Virginia laws relating to consumer lenders and sales finance agencies.

C&F Finance is subject to many federal, state and local statutes, regulations and ordinances that impact all aspects of its operations, including but not limited to the procedures that C&F Finance must follow regarding repossession of vehicles securing automobile finance installment contracts for purchases of used and new automobiles. C&F Finance is subject to state licensing requirements, which may require C&F Finance to file a notification or obtain a license to acquire automobile installment contracts in each state in which it acquires such contracts. C&F Finance is also subject to extensive federal statutes and regulations, including but not limited to: TILA, which requires C&F Finance and the dealers it does business with to make certain disclosures to customers, including the terms of repayment, the total finance charge and the annual percentage rate charged on automobile finance installment contracts; ECOA, which prohibits creditors from discrimination against loan applicants on the basis of race, color, sex, age or marital status and, pursuant to Regulation B promulgated thereunder, requires creditors to make certain disclosures regarding consumer rights and advise consumers of the reasons for the rejection of their credit applications; the Fair Credit and Reporting Act (FCRA), which requires C&F Finance to provide certain information to consumers whose credit applications are not approved on the basis of a report obtained from a consumer reporting agency and ensure the accuracy and integrity of consumer information reported to credit reporting agencies; the Electronic Funds Transfer Act (EFTA), which prohibits C&F Finance from requiring its customers to repay a loan or other credit by electronic funds transfer (EFT), except in limited situations, and requires C&F Finance to provide certain documentation and notifications to customers when an EFT is initiated; and federal bankruptcy and related state laws that may interfere with or affect C&F Finance’s ability to recover collateral or enforce a deficiency judgment. C&F Finance also generally adheres to the principles of the Fair Debt Collection Practices Act (FDCPA), which prohibits certain debt collectors from contacting borrowers during certain times and at certain places, from using threatening practices and from making false implications when attempting to collect a debt.

The CFPB has the authority to issue and enforce regulations under many federal consumer protection laws, including (subject to certain statutory limitations) TILA, ECOA, FDCPA, FCRA and EFTA. The CFPB is specifically authorized by the Dodd-Frank Act, among other things, to take action to prevent companies providing consumer financial products or services and their service providers from engaging in unfair, deceptive or abusive acts or practices in connection with consumer financial products and services, and to issue rules requiring enhanced disclosures for consumer financial products or services. Failure by C&F Finance to comply with any of these laws or regulations could have a material adverse effect on the Corporation. As of December 31, 2022, the Corporation and C&F Finance were not subject to supervision by the CFPB.

Certain federal regulatory agencies, and in particular, the CFPB, the Federal Trade Commission, and the Federal Reserve Board, as well as certain state agencies, have recently become more active in investigating the products, services

Table of Contents

and operations of banks and other finance companies engaged in auto finance activities. These investigations have extended to banks that engage in indirect automobile lending.

Brokered Deposits. Section 29 of the FDIA and FDIC regulations generally limit the ability of any bank to accept, renew or roll over any brokered deposit unless it is “well capitalized” or, with the FDIC’s approval, “adequately capitalized.” On December 15, 2020, the FDIC issued rules to revise brokered deposit regulations in light of modern deposit-taking methods. The rules established a new framework for certain provisions of the “deposit broker” definition and amended the FDIC’s interest rate methodology for calculating rates and rate caps. The rules became effective on April 1, 2021 and, to date, there has been no material impact to either the Corporation or the Bank from the rules.

Other Regulations

Prompt Corrective Action. The federal banking agencies have broad powers under current federal law to take prompt corrective action to resolve problems of insured depository institutions. The extent of these powers depends upon whether the institution in question is “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” or “critically undercapitalized.” These terms are defined under uniform regulations issued by each of the federal banking agencies regulating these institutions. An insured depository institution which is less than adequately capitalized must adopt an acceptable capital restoration plan, is subject to increased regulatory oversight and is increasingly restricted in the scope of its permissible activities. As of December 31, 2022, the Bank was considered “well capitalized.”

Incentive Compensation. The Dodd-Frank Act requires the federal banking agencies and the SEC to establish joint regulations or guidelines prohibiting incentive-based payment arrangements at specified regulated entities with at least $1 billion in total consolidated assets, that encourage inappropriate risks by providing an executive officer, employee, director, or principal stockholder with excessive compensation, fees, or benefits that could lead to material financial loss to the entity.

In 2016, the SEC and the federal banking agencies proposed rules that prohibit covered financial institutions (including bank holding companies and banks) from establishing or maintaining incentive-based compensation arrangements that encourage inappropriate risk taking by providing covered persons (consisting of senior executive officers and significant risk takers, as defined in the rules) with excessive compensation, fees or benefits that could lead to material financial loss to the financial institution. The proposed rules outline factors to be considered when analyzing whether compensation is excessive and whether an incentive-based compensation arrangement encourages inappropriate risks that could lead to material loss to the covered financial institution, and establishes minimum requirements that incentive-based compensation arrangements must meet to be considered to not encourage inappropriate risks and to appropriately balance risk and reward. The proposed rules also impose additional corporate governance requirements on the boards of directors of covered financial institutions and impose additional record-keeping requirements. The comment period for these proposed rules has closed and a final rule has not yet been published. If the rules are adopted as proposed, they will restrict the manner in which executive compensation is structured.

Confidentiality and Required Disclosures of Customer Information. The Corporation is subject to various laws and regulations that address the privacy of nonpublic personal financial information of consumers. The Gramm-Leach-Bliley Act and certain regulations issued thereunder protect against the transfer and use by financial institutions of consumer nonpublic personal information. A financial institution must provide to its customers, at the beginning of the customer relationship and annually thereafter, the institution’s policies and procedures regarding the handling of customers’ nonpublic personal financial information. These privacy provisions generally prohibit a financial institution from providing a customer’s personal financial information to unaffiliated third parties unless the institution discloses to the customer that the information may be so provided and the customer is given the opportunity to opt out of such disclosure. Certain exceptions may apply to the requirement to deliver an annual privacy notice based on how a financial institution limits sharing of nonpublic personal information and whether the institution’s disclosure practices or policies have changed in certain ways since the last privacy notice that was delivered.

The Corporation is also subject to various laws and regulations that attempt to combat money laundering and terrorist financing. The Bank Secrecy Act (the BSA) requires all financial institutions to, among other things, create a

Table of Contents

system of controls designed to prevent money laundering and the financing of terrorism, and imposes recordkeeping and reporting requirements. The USA PATRIOT Act added regulations to facilitate information sharing among governmental entities and financial institutions for the purpose of combating terrorism and money laundering, and requires financial institutions to establish anti-money laundering programs. Regulations adopted under the BSA impose on financial institutions customer due diligence requirements, and the federal banking agencies expect that customer due diligence programs will be integrated within a financial institution’s broader BSA and anti-money laundering compliance program. The Office of Foreign Assets Control (OFAC), which is a division of the U. S. Department of the Treasury, is responsible for helping to ensure that United States entities do not engage in transactions with “enemies” of the United States, as defined by various Executive Orders and Acts of Congress. If the Bank finds the name of an “enemy” of the United States on any transaction, account or wire transfer that is on an OFAC list, it must freeze such account or place transferred funds into a blocked account, and report it to OFAC.

Although these laws and programs impose compliance costs and create privacy obligations and, in some cases, reporting obligations, and compliance with all of the laws, programs, and privacy and reporting obligations may require significant resources of the Corporation and the Bank, these laws and programs do not materially affect the Bank’s products, services or other business activities.

Corporate Transparency Act. On January 1, 2021, as part of the 2021 National Defense Authorization Act, Congress enacted the Corporate Transparency Act (CTA), which required by January 1, 2022, that the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) issue regulations implementing reporting requirements for “reporting companies” (as defined in the CTA) to disclose beneficial ownership interests of certain U.S. and foreign entities. The CTA imposes additional reporting requirements on entities not previously subject to such beneficial ownership disclosure regulations and also contains exemptions for several different types of entities, including among others: (i) certain banks, bank holding companies, and credit unions; (ii) money transmitting businesses registered with FinCEN; and (iii) certain insurance companies. Reporting companies subject to the CTA will be required to provide specific information with respect to beneficial owner(s) (as defined in the CTA) as well as satisfy initial filing obligations (for newly-formed reporting companies) and submit on-going periodic reports. Non-compliance with FinCEN regulations promulgated under the CTA may result in civil fines as well as criminal penalties.

In December 2021, FinCEN proposed the first of the three sets of rules that it will issue. Thereafter, on September 29, 2022, FinCEN issued the final rule to implement the beneficial ownership reporting requirements of the CTA, which will be effective January 1, 2024. This rule does not apply to the Corporation or the Bank. Subsequent rulemakings are expected (i) to implement the CTA’s protocols for access to and disclosure of beneficial ownership information, and (ii) to revise the existing customer due diligence requirements that apply to the Corporation, the Bank and many other financial institutions, to ensure consistency between these requirements and the beneficial ownership reporting rules.

The Corporation will continue to monitor regulatory developments related to the CTA, including future FinCEN rulemakings, and will continue to assess the ultimate impact of the CTA on the Corporation and the Bank.

Cybersecurity. The federal banking agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a financial institution’s board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services. The federal banking agencies expect financial institutions to establish lines of defense and ensure that their risk management processes also address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack. If the Corporation or the Bank fails to meet the expectations set forth in this regulatory guidance, the Corporation or the Bank could be subject to various regulatory actions and any remediation efforts may require significant resources of the Corporation or the Bank. In addition, all federal and state banking agencies continue to increase focus on cybersecurity programs and risks as part of regular supervisory exams.

In October 2016, the federal banking agencies issued proposed rules on enhanced cybersecurity risk-management and resilience standards that would apply to very large financial institutions and to services provided by third parties to

Table of Contents

these institutions. The comment period for these proposed rules has closed and a final rule has not been published. Although the proposed rules would apply only to bank holding companies and banks with $50 billion or more in total consolidated assets, these rules could influence the federal banking agencies’ expectations and supervisory requirements for information security standards and cybersecurity programs of smaller financial institutions, such as the Corporation and the Bank.

On November 18, 2021, the federal bank regulatory agencies issued a final rule to improve the sharing of information about cyber incidents that may affect the U.S. banking system. The rule requires a banking organization to notify its primary federal regulator of any significant computer-security incident as soon as possible and no later than 36 hours after the banking organization determines that a cyber incident has occurred. Notification is required for incidents that have materially affected—or are reasonably likely to materially affect—the viability of a banking organization’s operations, its ability to deliver banking products and services, or the stability of the financial sector. In addition, the rule requires a bank service provider to notify affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has materially affected or is reasonably likely to materially affect banking organization customers for four or more hours. The rule became effective on May 1, 2022.

Stress Testing. The federal banking agencies have implemented stress testing requirements for certain large or risky financial institutions, including bank holding companies and state-chartered banks. Although these requirements do not apply to the Corporation and the Bank, the federal banking agencies emphasize that all banking organizations, regardless of size, should have the capacity to analyze the potential effect of adverse market conditions or outcomes on the organization’s financial condition. Based on existing regulatory guidance, the Corporation and the Bank will be expected to consider the institution’s interest rate risk management, commercial real estate loan concentrations and other credit-related information, and funding and liquidity management during this analysis of adverse market conditions or outcomes.

Volcker Rule. The Dodd-Frank Act prohibits bank holding companies and their subsidiary banks from engaging in proprietary trading except in limited circumstances, and places limits on ownership of equity investments in private equity and hedge funds (the Volcker Rule). The EGRRCPA, and final rules adopted to implement the EGRRCPA, exempt all banks with less than $10 billion in assets (including their holding companies and affiliates) from the Volcker Rule, provided thatthe institution has total trading assets and liabilities of 5 percent or less of total assets, subject to certain limited exceptions. The Corporation believes that its financial condition and its operations are not affected by the Volcker Rule, amendments thereto, or its implementing regulations.

Call Reports and Examination Cycle. All institutions, regardless of size, submit a quarterly call report that includes data used by federal banking agencies to monitor the condition, performance, and risk profile of individual institutions and the industry as a whole. The EGRRCPA contained provisions expanding the number of regulated institutions eligible to use streamlined call report forms. In June 2019, consistent with the provisions of the EGRRCPA, the federal banking agencies issued a final rule to permit insured depository institutions with total assets of less than $5 billion that do not engage in certain complex or international activities to file the most streamlined version of the quarterly call report, and to reduce data reportable on certain streamlined call report submissions.

In December 2018, consistent with the provisions of the EGRRCPA, the federal banking agencies jointly adopted final rules that permit banks with up to $3 billion in total assets, that received a composite CAMELS rating of “1” or “2,” and that meet certain other criteria (including not having undergone any change in control during the previous 12-month period, and not being subject to a formal enforcement proceeding or order), to qualify for an 18-month on-site examination cycle.

Effect of Governmental Monetary Policies. As with other financial institutions, the earnings of the Corporation and the Bank are affected by general economic conditions as well as by the monetary policies of the Federal Reserve Board. Such policies, which include regulating the national supply of bank reserves and bank credit, can have a major effect upon the source and cost of funds and the rates of return earned on loans and investments. The Federal Reserve Board exerts a substantial influence on interest rates and credit conditions, primarily through establishing target rates for federal funds, open market operations in U.S. Government securities, varying the discount rate on member bank borrowings and setting cash reserve requirements against deposits. Changes in monetary policy, including changes in interest rates, will influence

Table of Contents

the origination of loans, the purchase of investments, the generation of deposits, and rates received on loans and investment securities and paid on deposits. Fluctuations in the Federal Reserve Board’s monetary policies have had a significant impact on the operating results of the Corporation and the Bank and are expected to continue to do so in the future.

Future Regulation

From time to time, various legislative and regulatory initiatives are introduced in Congress and state legislatures, as well as by regulatory agencies. Such initiatives may include proposals to expand or contract the powers of bank holding companies and depository institutions or proposals to substantially change the financial institution regulatory system. Such legislation could change banking statutes and the operating environment of the Corporation in substantial and unpredictable ways. If enacted, such legislation could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among banks, savings associations, credit unions, and other financial institutions. The Corporation cannot predict whether any such legislation will be enacted, and, if enacted, the effect that it, or any implementing regulations, would have on the financial condition or results of operations of the Corporation. A change in statutes, regulations or regulatory policies applicable to the Corporation or any of its subsidiaries could have a material effect on the business of the Corporation.

Available Information

The Corporation’s SEC filings are filed electronically and are available to the public over the Internet at the SEC’s website at http://www.sec.gov. The Corporation’s SEC filings also are available through our website at http://www.cffc.com under “Investor Relations/Financial Documents/SEC Filings” as of the day they are filed with the SEC. Copies of documents also can be obtained free of charge by writing to the Corporation’s secretary at 3600 La Grange Parkway, Toano, VA 23168 or by calling 804-843-2360.

ITEM 1A.RISK FACTORS

Investments in the Company’s common stock involve risk. In addition to the other information set forth in this Report on Form 10-K, including the information addressed under “Cautionary Statement Regarding Forward-Looking Statements,” investors in the Company’s common stock should carefully consider the risk factors discussed below. The following discussion highlights the risks that we believe are material to the Company, but the following discussion does not necessarily include all risks that we may face, and an investor in the Company’s common stock should not interpret the disclosure of a risk in the following discussion to state or imply that the risk has not already materialized. These factors could materially and adversely affect the Company’s business, financial condition, liquidity, results of operations, and capital position, and could cause the Company’s actual results to differ materially from its historical results or the results contemplated by the forward-looking statements contained in this Annual Report on Form 10-K, in which case the trading price of the Company’s common stock could decline.

Risk Factors Related to our Lending Activities and Economic Conditions

Our business is subject to various lending and other economic risks that could adversely affect our results of operations and financial condition.

Deterioration in economic conditions could adversely affect our business. Our business is directly affected by general economic and market conditions; broad trends in industry and finance; legislative and regulatory changes; changes in governmental monetary and fiscal policies; and inflation, all of which are beyond our control. Prolonged periods of inflation may impact our profitability by negatively impacting our fixed costs and expenses, including increasing funding costs and expense related to talent acquisition and retention, and negatively impacting the demand for our products and services. Additionally, inflation may lead to a decrease in consumer and client’s purchasing power and increase default rates on our loans. A deterioration in economic conditions, in particular a prolonged economic slowdown within our geographic region or a broader disruption in the economy, possibly as a result of a pandemic or other widespread public

Table of Contents

health emergency, acts of terrorism or outbreak of domestic or international hostilities (including the ongoing military conflict between Russia and Ukraine), could result in the following consequences, any of which could hurt our business materially: an increase in loan delinquencies; an increase in problem assets and foreclosures; a decline in demand for our products and services; a deterioration in the value of collateral for loans made by our various business segments; and changes in the fair value of financial instruments held by the Corporation or its subsidiaries.

Adverse changes in economic conditions in our market areas or adverse conditions in an industry on which a local market in which we do business is dependent could adversely affect our results of operations and financial condition.

We provide full service banking and other financial services throughout eastern and central Virginia. Our loan and deposit activities are directly affected by, and our financial success depends on, economic conditions within these markets, as well as conditions in the industries on which those markets are economically dependent. A deterioration in local economic conditions or in the condition of an industry on which a local market depends, such as the U.S. military and related defense contractors and industries, could adversely affect such factors as unemployment rates, business formations and expansions and housing market conditions. Adverse developments in any of these factors could result in among other things, a decline in loan demand, a reduction in the number of credit-worthy borrowers seeking loans, an increase in delinquencies, defaults and foreclosures, an increase in classified and nonaccrual loans, a decrease in the value of loan collateral, and a decline in the financial condition of borrowers and guarantors, any of which could adversely affect our financial condition or business.

The Corporation also invests in the debt securities of corporate issuers, primarily financial institutions, that the Corporation views as having a strong financial position and earnings potential. However, a deterioration in economic or other conditions in the localities in which these institutions do business in could adversely affect their financial condition and results of operations, and therefore adversely affect the value of our investment. Additionally, the majority of the debt securities in which we have invested are in an unrealized loss position as of December 31, 2022, due primarily to increases in interest rates after we purchased those debt securities. If the Corporation is forced to sell debt securities in an unrealized loss position for liquidity or other needs or determines that there is credit loss with respect to any of the corporation’s debt securities, the corporation may be forced to recognize those losses or an impairment charge in net income.

Weakness in the secondary residential mortgage loan markets or demand for mortgage loans may adversely affect income from C&F Mortgage.

Our mortgage banking segment provides a significant portion of our noninterest income. We generate gains on sales of mortgage loans primarily from sales of mortgage loans that we originate. Interest rates, housing inventory, housing demand, inflation, cash buyers, new mortgage lending regulations and other market conditions, such as the number of third-party investors and their demand to purchase mortgage loans, have a direct effect on loan originations across the industry. In particular, in the current higher interest rate environment, our originations of mortgage loans decreased, resulting in fewer loans available to be sold to investors, which has resulted in a decrease in noninterest income that may continue into future periods, and which may occur during other periods of rising interest rates. In addition, our results of operations are affected by the amount of noninterest expenses (including for personnel and systems infrastructure) associated with mortgage banking activities. During periods of reduced loan demand, our results of operations are adversely affected as we are unable to reduce expenses commensurate with the decline in mortgage loan origination activity.

If our allowance for loan losses becomes inadequate, our results of operations may be adversely affected.

Making loans is an essential element of our business. The risk of nonpayment is affected by a number of factors, including but not limited to: the duration of the credit; credit risks of a particular customer; inflation; changes in economic and industry conditions; and, in the case of a collateralized loan, risks resulting from uncertainties about the future value of the collateral. Although we seek to mitigate risks inherent in lending by adhering to specific underwriting practices, our loans may not be repaid. We attempt to maintain an appropriate allowance for loan losses to provide for losses in our loan portfolio. Because any estimate of loan losses is necessarily subjective and the accuracy of any estimate depends on the outcome of future events that are not within our control, we face the risk that charge-offs in future periods will exceed our

Table of Contents

allowance for loan losses and that additional provision for loan losses will be required, which would have an adverse effect on the Corporation’s net income. Although we believe our allowance for loan losses is adequate to absorb losses that are inherent in our loan portfolio, we cannot predict the timing or severity of such losses nor give any assurance that our allowance will be adequate in the future.

Our banking regulators, as an integral part of their examination process, periodically review the allowance for loan losses and may require us to increase our allowance by recognizing additional provision for loan losses charged to expense, or to decrease the allowance by recognizing loan charge-offs. Any such required additional provisions for loan losses or charge-offs could have a material adverse effect on our financial condition and results of operations.

On January 1, 2023, we adopted Accounting Standards Codification (ASC) Topic 326, “Financial Instruments—Credit Losses” (ASC 326), which replaces existing accounting principles for the recognition of loan losses based on losses that have been incurred with a requirement to record an allowance for credit losses that represents expected credit losses over the lifetime of all loans in the Corporation’s portfolio. Under ASC 326, the Corporation’s estimate of expected credit losses will be based on reasonable and supportable forecasts of future economic conditions and loan performance. While the adoption of ASC 326 will not affect ultimate loan performance or cash flows of the Corporation from making loans, the period in which expected credit losses affect net income of the Corporation may not be similar to the recognition of loan losses under current accounting guidance, and recognizing an allowance based on expected credit losses may create more volatility in the level of our allowance for credit losses and our results of operations, including based on volatility in economic forecasts and our expectations of loan performance in future periods, as actual results may differ materially from our estimates. If we are required to materially increase our level of allowance for credit losses for any reason, such increase could adversely affect our business, financial condition, and results of operations.

An increase in mortgage loan defaults or prepayments may result in losses related to loans sold by C&F Mortgage.

Deterioration in economic conditions may cause borrowers to default on their mortgages, which may result in losses to investors who purchased residential mortgage loans originated by C&F Mortgage and sold in the secondary market, especially if accompanied by declines in the value of residential real estate securing those loans. This may result in potential repurchase or indemnification obligations for C&F Mortgage. Such obligations may arise in the event of claims by investors of borrower misrepresentation, fraud, early-payment default, or underwriting error, as investors attempt to minimize their losses. We cannot be assured that a prolonged period of payment defaults and foreclosures will not result in an increase in requests for repurchases or indemnifications. Alternatively, during periods of low or falling interest rates, our customers may find opportunities to refinance shortly after obtaining a mortgage loan from C&F Mortgage, which may result in unexpected prepayments on loans that have been sold into the secondary market. This may result in obligations of C&F Mortgage to return a portion of the sales proceeds from such loans to investors pursuant to the terms of the sale. Moreover, prolonged periods of inflation may also lead to increased loan defaults and losses, which may result in losses incurred by secondary market investors for which C&F Mortgage may have an indemnification or repurchase obligation. We attempt to maintain an appropriate reserve for indemnification losses and for prepayment obligations. Although we believe our reserves for indemnification losses and prepayment obligations are adequate, these estimates are inherently subjective and actual indemnification losses and prepayment obligations will depend on future events that are often not within our control. Therefore, we can give no assurance that established reserves will be adequate. Additional provision for indemnification losses or additional obligations arising from prepayments would have an adverse effect on the Corporation’s net income.

Our level of credit risk is higher due to the concentration of our loan portfolio in commercial loans and in consumer finance loans.

At December 31, 2022, 47.9 percent of our loan portfolio consisted of commercial, financial and agricultural loans, which include loans secured by real estate for builder lines, acquisition and development and commercial development, as well as commercial loans secured by personal property. These loans generally carry larger loan balances and involve a greater degree of financial and credit risk than home equity and residential loans. The increased financial and credit risk associated with these types of loans is a result of several factors, including the concentration of principal in a limited

Table of Contents

number of loans and to borrowers in similar lines of business, the size of loan balances, the effects of general economic conditions on income-producing properties and the increased difficulty of evaluating and monitoring these types of loans.

At December 31, 2022, 25.1 percent of our loan portfolio consisted of automobile consumer finance loans, primarily for customers who have limited access to traditional automobile financing due to increased credit risk. During periods of high inflation, economic slowdown or recession, delinquencies, defaults, repossessions and losses may increase in this portfolio. Significant increases in the inventory of used automobiles during periods of economic recession may also depress the prices at which we may sell repossessed vehicles or delay the timing of these sales. Rising delinquencies and declining wholesale automobile values have contributed to higher net charge-offs during the second half of 2022, and we expect those trends to continue in 2023, as government stimulus measures in response to the pandemic that benefitted borrowers had a decreased effect in 2022, the wholesale value of used automobiles declined from a recent peak during the COVID-19 pandemic, and challenges in repossessing automobiles increased due to a decline in the number of repossession agencies. Because our borrowers have increased credit risk, the actual rates of delinquencies, defaults, repossessions and losses on these loans are higher than those experienced in the general automobile finance industry and could be dramatically affected by a general economic downturn. In addition, our servicing costs may increase without a corresponding increase in our finance charge income. While we manage the higher risk inherent in loans made to these borrowers through our underwriting criteria for installment sales contracts we purchase and collection methods, we cannot guarantee that these criteria or methods will ultimately provide adequate protection against these risks.

Risk Factors Related to our Industry

We are subject to interest rate risk and fluctuations in interest rates may negatively affect our financial performance.

Our profitability depends in substantial part on our net interest margin, which is the difference between the interest earned on loans, securities and other interest-earning assets, and interest paid on deposits and borrowings divided by total interest-earning assets. Changes in interest rates will affect our net interest margin in diverse ways, including the pricing of loans and deposits, the levels of prepayments and asset quality. We are unable to predict actual fluctuations of market interest rates because many factors influencing interest rates, including changes in economic conditions, are beyond our control. We believe that our current interest rate exposure is manageable and does not indicate any significant exposure to interest rate changes. To combat rising inflation, beginning in March 2022, the Federal Reserve has raised its benchmark federal funds interest rate at the fastest pace in over 40 years, increasing 425 basis points during 2022. Additionally, the Federal Reserve raised the federal funds benchmark rate by 25 basis points in February of 2023. If market rates continue to rise, to combat inflation or otherwise, we may experience more competitive pressures to increase the rates we pay on deposits, which may decrease our net interest income, a change in the mix of noninterest and interest-bearing accounts, reduced demand for loans or increases in the rate of default on existing loans. Although further increases to the target federal funds rate by the Federal Reserve are expected in 2023 to combat recent inflationary trends, if interest rates do not rise, or if the Federal Reserve lowers the target federal funds rate, such lower rates could limit our interest rate spread and may adversely affect our business forecasts. If interest rates were to fall, yields on loans and investments may fall. In addition, the Corporation could experience further net interest margin compression if it is unable to maintain its current level of loans outstanding by continuing to originate new loans or if it experiences a decrease in deposit balances, which would require the Corporation to seek funding from other sources at relatively higher rates of interest. It is possible that significant or unexpected changes in interest rates may take place in the future, and we cannot always accurately predict the nature or magnitude of such changes or how such changes may affect our business or results of operations.

The Corporation’s investment portfolio consists of fixed income debt securities, classified as available for sale, whose market values fluctuate with changes in interest rates. Available for sale debt securities are carried at estimated fair value with the corresponding unrealized gains and losses recognized in other comprehensive income. Gains or losses are only recognized in net income upon the sale of the security. Additionally, under ASC 326 a loss is recognized for expected credit losses on available for sale debt securities or when the Corporation does not expect to recover its investment in a debt security, to the extent that the carrying amount of the security exceeds its market value. As a result of increases in market interest rates during 2022, the market value of the Corporation’s investment portfolio declined significantly. While the Corporation does not intend to sell any of its securities, the portfolio serves as a source of liquidity and consists of

Table of Contents

securities available for sale, which may be sold in response to changes in market interest rates, changes in prepayment risk, increases in loan demand, general liquidity needs and other similar factors. If the Corporation is forced to sell any of its securities while in an unrealized loss position, the loss would be recognized in net income. Additionally, while the regulatory capital of the Corporation or the Bank is not expected to be impacted by unrealized losses on securities, tangible common equity, a non-GAAP financial measure, is reduced for unrealized losses on securities, and regulatory capital would be reduced for any losses recognized in net income.

We rely substantially on deposits obtained from customers in our target markets to provide liquidity and support growth.

Our business strategies are based on access to funding from local customer deposits. Deposit levels may be affected by a number of factors, including interest rates paid by competitors, general interest rate levels, returns available to customers on alternative investments and general economic conditions that affect savings levels and the amount of liquidity in the economy, including government stimulus efforts in response to economic crises. If our deposit levels fall, we could lose a relatively low cost source of funding and our interest expense would likely increase as we obtain alternative funding to replace lost deposits. If local customer deposits are not sufficient to fund our normal operations and growth, we will look to outside sources, such as borrowings from the FHLB, which is a secured funding source. Our ability to access borrowings from the FHLB will be dependent upon whether and the extent to which we can provide collateral to secure FHLB borrowings. We may also look to federal funds purchased and brokered deposits, although the use of brokered deposits may be limited or discouraged by our banking regulators. We may also seek to raise funds through the issuance of shares of our common stock, or other equity or equity-related securities, or debt securities including subordinated notes as additional sources of liquidity. If we are unable to access funding sufficient to support our business operations and growth strategies or are unable to access such funding on attractive terms, we may not be able to implement our business strategies which may negatively affect our financial performance.

Consumers may increasingly decide not to use banks to complete their financial transactions, which could have a material adverse impact on our financial condition and operations.

Technology and other changes are allowing parties to complete financial transactions through alternative methods that historically have involved banks. For example, consumers can now maintain funds that would have historically been held as bank deposits in brokerage accounts, mutual funds, general-purpose reloadable prepaid cards, or in other types of assets, including crypto currencies or other digital assets. Consumers can also complete transactions such as paying bills or transferring funds directly without the assistance of banks. The process of eliminating banks as intermediaries, known as “disintermediation,” could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits. The loss of these revenue streams and the loss of deposits as a lower cost source of funds could have a material adverse effect on our financial condition and results of operations.

Competition from other financial institutions and financial intermediaries may adversely affect our profitability.

We face substantial competition in originating loans and in attracting deposits. Our competition in originating loans and attracting deposits comes principally from other banks, mortgage banking companies, consumer finance companies, savings associations, credit unions, brokerage firms, insurance companies and other institutional lenders and purchasers of loans, and includes firms that attract customers primarily through digital and online products which may offer greater convenience to customers than traditional banking products and services. Additionally, banks and other financial institutions with larger capitalization and financial intermediaries not subject to bank regulatory restrictions have larger lending limits and are thereby able to serve the credit needs of larger clients. These institutions may be able to offer the same loan products and services that we offer at more competitive rates and prices. Moreover, technological innovation continues to contribute to greater competition in financial services markets as technological advances enable more companies to provide financial products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. Increased competition could require us to increase the rates we pay on deposits or lower the rates we offer on loans, which could adversely affect our profitability.

Table of Contents

Accounting for business combinations may expose us to intangible asset risk, which could affect our results of operations.

In connection with accounting for prior acquisitions, we recorded assets acquired and liabilities assumed at their fair value, which resulted in the recognition of certain intangible assets, including goodwill. Adverse conditions in our business climate, including a significant decline in future operating cash flows, changes in interest rates that may lead to net interest margin compression, changes in demand for loans or our ability to originate and hold loans, a sustained period of elevated loan losses, a significant decrease in valuations or stock prices of the Corporation or other bank holding companies, or a deviation from our expected growth rate and performance, may significantly affect the fair value of the Corporation’s reporting units and may trigger impairment losses on intangible assets, which could be materially adverse to our results of operations.

Risk Factors Related to our Operations and Technology

Our risk management framework may not be effective in mitigating risk and loss.

We maintain an enterprise risk management program that is designed to identify, quantify, monitor, report and control the risks we face. These risks include, but are not limited to, interest rate, credit, liquidity, operational, reputation, legal, compliance, economic and litigation risk. Although we assess our risk management program on an ongoing basis and make identified improvements to it, we can give no assurance that this approach and risk management framework (including related controls) will effectively mitigate the risks listed above or limit losses that we may incur. If our risk management program has flaws or gaps, or if our risk management controls do not function effectively, our results of operations, financial condition or business may be adversely affected.

We are subject to security and operational risks, including cybersecurity risks and cyber attacks, relating to our use of technology that could damage our reputation and our business.

In the ordinary course of business, the Corporation collects and stores sensitive data, including proprietary business information and personally identifiable information of our customers and employees, in systems and on networks, including those hosted by third-party vendors. The secure processing, maintenance and use of this information is critical to operations and the Corporation’s business strategy. The Corporation has invested in information security technologies and continually reviews processes and practices that are designed to protect its networks, computers and data from damage or unauthorized access, including periodically those employed by third-party vendors that host the Corporation’s data and applications. Despite these security measures, the Corporation’s computer systems and infrastructure may be vulnerable to attacks by hackers or may be breached due to employee error, malfeasance or other disruptions. Security breaches, including cyber incidents, identity theft and hacking events, have been experienced by several of the world’s largest financial institutions that utilize sophisticated security tools to prevent such breaches, incidents and events. Any security breach that we experience could result in legal claims, regulatory penalties, disruption in operation, remediation expenses, costs associated with customer notification and credit monitoring services, increased insurance premiums, loss of customers and business partners and damage to the Corporation’s reputation. We rely on customary security systems and procedures to provide the security and authentication necessary to effect secure collection, transmission and storage of sensitive data. These systems and procedures include but are not limited to (i) regular penetration testing of our network, (ii) regular employee training programs on sound security practices and awareness of security threats, (iii) deployment of tools to monitor our network including intrusion prevention and detection systems, electronic mail spam filters, anti-virus, anti-malware, anti-ransomware, resource logging and patch management, (iv) multifactor authentication for customers using treasury management tools and employees who access our network from outside of our premises, and (v) enforcement of security policies and procedures for the additions and maintenance of user access and rights to resources. However, because the techniques used to obtain unauthorized access, or to disable or degrade systems change frequently and are often not recognized until launched against a target, even with all reasonable security efforts, the Corporation may be unable to anticipate these techniques or to implement adequate protective measures.

Table of Contents

While most of our core data processing is conducted internally, certain key applications are outsourced to third party providers. If our third party providers encounter difficulties or if we have difficulty in communicating with such third parties, it will significantly affect our ability to adequately process and account for customer transactions, which would significantly affect our business operations and reputation. Additionally, in recent years banking regulators have focused on the responsibilities of financial institutions to supervise vendors and other third-party service providers. We may have to dedicate significant resources to manage risks and regulatory burdens presented by our relationship with vendors and third-party service providers, including our data processing and cybersecurity service providers.

We rely on other companies to provide key components of our business infrastructure.

Third parties provide key components of our businesses’ operations such as data processing, recording and monitoring transactions, online banking interfaces and services, internet connections, and network access. In addition, each of these third parties faces the risk of a cyber-attack, information breach or loss, or technology failure and there is no assurance that they have not or will not experience a system or network breach. While we have selected these third-party vendors carefully, we do not control their actions, and any failure to maintain performance, reliability and security of these systems could have a significant adverse effect on our financial condition or results of operations. Any problem caused by these third parties, such as poor performance of services, failure to provide services, disruptions in communication services provided by a vendor, a cyber-attack, information breach or loss, or failure to handle current or higher volumes could adversely affect the Corporation’s ability to deliver products and services to its customers and otherwise conduct its business, and may harm its reputation. Financial or operational difficulties of a third-party vendor could also hurt the Corporation’s operations if those difficulties affect the vendor’s ability to serve the Corporation. Replacing these third-party vendors could also create significant delay and expense, and we cannot provide any assurance that we could negotiate terms with alternative service sources that are as favorable or could obtain similar services as found in our existing systems without expending substantial resources. Accordingly, use of such third parties creates an unavoidable inherent risk to our businesses’ operations.

Our business is technology dependent, and an inability to successfully implement technological improvements may adversely affect our ability to be competitive and our results of operations and financial condition.

The financial services industry is undergoing rapid technological changes with frequent introductions of new technology-driven products, systems and services, which may require substantial initial investment to be implemented, including the cost of modifying or adapting existing products, systems and services. The Corporation invests in new technology to enhance customer service, and to increase efficiency and reduce operating costs. Our future success will depend in part upon our ability to create synergies in our operations through the use of technology and to facilitate the ability of customers to engage in financial transactions in a manner that enhances the customer experience. We cannot give any assurance that technological improvements will increase operational efficiency or that we will be able to effectively implement new technology-driven products, systems and services or be successful in marketing new products and services to our customers. A failure to maintain or enhance a competitive position with respect to technology, whether because of a failure to anticipate customer expectations, substantially fewer resources to invest in technological improvements than larger competitors, or because our technological developments fail to perform as desired or are not implemented in a timely manner, could result in higher operating costs, decreased customer satisfaction, and lower market share. An inability to effectively implement new technology and realize operational efficiencies could result in the loss of initial investments in such projects and higher operating costs. Either of these outcomes could have a material adverse impact on our financial condition and results of operations.

We rely heavily on our management team and the unexpected loss of key officers may adversely affect our operations.

We believe that our growth and future success will depend in large part on the skills of our executive officers. We also depend upon the experience of the officers of our subsidiaries and on their relationships with the communities they serve. The loss of the services of one or more of these officers could disrupt our operations and impair our ability to implement our business strategy, which could adversely affect our business, financial condition and results of operations.

Table of Contents

The success of our business strategies depends on our ability to identify, recruit and retain individuals with experience and relationships in our primary markets.

The successful implementation of our business strategy will require us to continue to attract, hire, motivate and retain skilled personnel to develop new customer relationships as well as new financial products and services. The market for qualified management personnel is competitive, which has contributed to salary and employee benefit costs that have risen and are expected to continue to rise, which may have an adverse effect on the Corporation’s net income. In addition, the process of identifying and recruiting individuals with the combination of skills and attributes required to carry out our strategy is often lengthy, and we may not be able to effectively integrate these individuals into our operations. Our inability to identify, recruit and retain talented personnel to manage our operations effectively and in a timely manner could limit our growth or impair our ability to implement our business strategy effectively and efficiently, which could materially adversely affect our business.

The Corporation or any of its subsidiaries is a defendant from time to time in a variety of litigation and other actions.

The Corporation or any of its subsidiaries may be involved from time to time in a variety of litigation arising out of its business, and the Corporation operates in a legal and regulatory environment that exposes it to potential significant litigation risk. The Corporation’s insurance may not cover all claims that may be asserted against it in legal or administrative actions or costs that it may incur defending such actions, and any claims asserted against it, regardless of merit or eventual outcome, may harm the Corporation’s reputation. Should the ultimate judgments or settlements and/or costs incurred in any litigation exceed any applicable insurance coverage, they could have a material adverse effect on the Corporation’s financial condition and results of operation for any period.

Risks Related to the Regulation of the Corporation

Our earnings are significantly affected by the fiscal and monetary policies of the federal government and its agencies.

The policies of the Federal Reserve affect us significantly. The Federal Reserve regulates the supply of money and credit in the United States. Its policies directly and indirectly influence the rate of interest earned on loans and paid on borrowings and interest-bearing deposits and can also affect the value of financial instruments we hold. Those policies determine to a significant extent our cost of funds for lending and investing. Changes in those policies are beyond our control and are difficult to predict. Federal Reserve policies can also affect our borrowers, potentially increasing the risk that they may fail to repay their loans. For example, a tightening of the money supply by the Federal Reserve could reduce the demand for a borrower's products and services. This could adversely affect the borrower’s earnings and ability to repay a loan, which could have an adverse effect on our financial condition and results of operations. Alternatively, an expansion of the money supply could make it easier for a borrower to obtain a loan from another financial institution at a lower interest rate, resulting in a payoff of that borrower’s higher rate loan with us, and which could have an adverse effect on our financial condition and results of operations.

Compliance with laws, regulations and supervisory guidance, both new and existing, may adversely affect our business, financial condition and results of operations.

We are subject to numerous laws, regulations and supervision from both federal and state agencies. Failure to comply with these laws and regulations could result in financial, structural and operational penalties, including receivership. In addition, establishing systems and processes to achieve compliance with these laws and regulations may increase our costs and/or limit our ability to pursue certain business opportunities.

Laws and regulations, and any interpretations and applications with respect thereto, generally are intended to benefit consumers, borrowers and depositors, but not stockholders. The legislative and regulatory environment is beyond our control, may change rapidly and unpredictably and may negatively influence our revenues, costs, earnings, and capital levels. Our success depends on our ability to maintain compliance with both existing and new laws and regulations.

Table of Contents

Future legislation, regulation and government policy, particularly following changes in political leadership and policymakers in the federal government, could affect the banking industry as a whole, including the Corporation’s business and results of operations, in ways that are difficult to predict. In addition, the Corporation’s results of operations could be adversely affected by changes in the way in which existing statutes and regulations are interpreted or applied by courts and government agencies. See “Regulation and Supervision” included in Item 1. Business, of this Annual Report on Form 10-K for a more detailed description of the certain regulatory requirements applicable to the Corporation.

The CFPB may increase our regulatory compliance burden and could affect the consumer financial products and services that we offer.

The CFPB significantly influences consumer financial laws, regulation and policy through rulemaking related to enforcement of the Dodd-Frank Act’s prohibitions against unfair, deceptive and abusive consumer finance products or practices, which are directly affecting the business operations of financial institutions offering consumer financial products or services, including the Corporation. This agency’s broad rulemaking authority includes identifying practices or acts that are unfair, deceptive or abusive in connection with any consumer financial transaction, financial product or service. Although the CFPB has jurisdiction over banks with $10 billion or greater in assets, rules, regulations and policies issued by the CFPB may also apply to the Corporation or its subsidiaries by virtue of the adoption of such policies and practices by the Federal Reserve and the FDIC. Further, the CFPB may include its own examiners in regulatory examinations by the Corporation’s primary regulators. The limitations and restrictions imposed by the CFPB may produce significant, material effects on our business, financial condition and results of operations.

Increased scrutiny and evolving expectations from customers, regulators, investors, and other stakeholders with respect to environmental, social and governance (ESG) practices may impose additional costs on the Corporation or expose it to new or additional risks.

As a regulated financial institution and a publicly traded company, we are facing increasing scrutiny from customers, regulators, investors, and other stakeholders related to ESG practices and disclosure. Investor advocacy groups, investment funds, and influential investors are increasingly focused on these practices, especially as they relate to climate risk, hiring practices, the diversity of the work force, and racial and social justice issues. Failure to adapt to or comply with regulatory requirements or investor or stakeholder expectations and standards could negatively impact the Corporation’s reputation, ability to do business with certain partners, and stock price. New government regulations could also result in new or more stringent forms of ESG oversight and expanding mandatory and voluntary reporting, diligence, and disclosure. ESG-related costs, including with respect to compliance with any additional regulatory or disclosure requirements or expectations, could adversely impact our results of operations.

Risks Related to the COVID-19 Pandemic

The Corporation’s results of operations and financial condition may be adversely affected by the COVID-19 pandemic.

The outbreak of the COVID-19 pandemic, the widespread government response and the impact on consumers and businesses caused significant disruption in the United States and international economies and financial markets and have had a significant impact on consumers and businesses in our market area and the operations and financial performance of the Corporation. Although conditions regarding the spread of the illness are improving, new variants emerge that could cause further outbreaks or more severe outbreaks in the future, resulting in additional lockdowns, economic disruptions, or other unknown impacts.

Consequences of the pandemic have included and may include further market volatility, interest rate fluctuations, disrupted trade and supply chains, increased unemployment, rising prices, inflation and reduced economic activity. The period of recovery from the negative economic effects of the pandemic cannot be predicted and may be protracted. As loan payment deferral programs and government stimulus or relief efforts, such as the Paycheck Protection Program (PPP), have largely ended, signs of credit deterioration that were masked or obscured may emerge, and the Corporation can give no assurance that loan performance or net charge-offs will continue at the levels experienced in 2022, 2021 and 2020.

Table of Contents

The extent to which the COVID-19 pandemic impacts our business, results of operations and financial condition will depend on future developments, which are highly uncertain and cannot be predicted, including, but not limited to the duration and severity of the COVID-19 pandemic, the acceptance and continued effectiveness of vaccines and treatments for COVID-19, the effects of the pandemic on our customers and vendors, and the short- and long-term health impacts of the pandemic. There can be no assurance that any efforts by the Corporation to address the adverse impacts of the COVID-19 pandemic will be effective. Even after the COVID-19 pandemic has subsided, we may continue to experience adverse impacts to our business as a result of changes in the behavior of customers, businesses and their employees. Furthermore, the financial condition of our customers and vendors may be adversely impacted, which may result in an elevated level of loan losses, a decrease in demand for our products and services, or reduced availability of services provided by third parties on which we rely. Any of these events may, in turn, have a material adverse impact our business, results of operations and financial condition.

Risks Related to Owning the Corporation’s Common Stock

Our common stock price may be volatile, which could result in losses to our investors.

Our common stock price has been volatile in the past, and several factors could cause the price to fluctuate in the future. These factors include, but are not limited to, actual or anticipated variations in earnings, changes in analysts’ recommendations or projections with regard to our common stock or the markets and businesses in which we operate, operations and stock performance of other companies deemed to be our peers, and reports of trends and concerns and other issues related to the financial services industry. Fluctuations in our common stock price may be unrelated to our performance. General market declines or market volatility in the future, especially in the financial institutions sector, could adversely affect the price of our common stock, and the current market price may not be indicative of future market prices.

The trading volume of our common stock may not provide adequate volume for investors, and future sales of our common stock by shareholders or the perception that those sales could occur may cause our common stock price to decline.

Although our common stock is listed for trading on NASDAQ Global Select Market, the trading volume in our common stock may be lower than that of other larger financial institutions. A public trading market having the desired characteristics of depth, liquidity and orderliness depends on the presence in the marketplace of willing buyers and sellers of the common stock at any given time. This presence depends on the individual decisions of investors and general economic and market conditions over which we have no control. Given the potential for lower relative trading volume in our common stock, significant sales of the common stock in the public market, or the perception that those sales may occur, could cause the trading price of our common stock to decline or to be lower than it otherwise might be in the absence of these sales or perceptions.

The Corporation’s dividends may not be sustained.

C & F Financial Corp CFFI US Equity

CFFI · 10-K · period ended 2022-12-31

ITEM 1.BUSINESS

ITEM 1A.RISK FACTORS

C & F Financial Corp CFFI US Equity☆

CFFI · 10-K · period ended 2022-12-31

ITEM 1.BUSINESS

ITEM 1A.RISK FACTORS

C & F Financial Corp CFFI US Equity