First United Corp/Md/ FUNC US Equity☆

First United Corporation_December 31, 2025

Table of Contents

​

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, DC 20549

FORM 10-K

☑ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended December 31, 2025

or

☐TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from _____to _____

Commission file number 0-14237

First United Corporation

(Exact name of registrant as specified in its charter)

​

​ ​ ​

​ ​ ​

(Address of principal executive offices) ​ (Zip Code)

​

(800) 470-4356

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

​

​ ​ ​

Title of each class Trading Symbol(s) Name of each exchange on which registered

Common Stock FUNC Nasdaq Stock Market

​

Securities registered pursuant to Section 12(g) of the Act: None.

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ◻No☑

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or 15(d) of the Act. Yes ◻No☑

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes☑ No ◻

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes☑ No ◻

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “accelerated filer”, “large accelerated filer”, “smaller reporting company” and “emerging growth company” in Rule 12b-2 of the Exchange Act).

​

​ ​ ​

Large accelerated filer ◻ ​ ​ ​ Accelerated filer ◻

Non-accelerated filer ☑ ​ Smaller reporting company ☑

Emerging growth company ☐ ​ ​

​

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ◻

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☐

​

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

​

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

​

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☑

The aggregate market value of the registrant’s outstanding voting and non-voting common equity held by non-affiliates computed by reference to the price at which the common equity was last sold, or the average bid and asked price of such common equity, as of the last business day of the registrant’s most recently completed second fiscal quarter: $179,240,809.

The number of shares of the registrant’s common stock outstanding as of February 27, 2026: 6,501,382.

Documents Incorporated by Reference

Portions of the registrant’s definitive proxy statement for the 2026 Annual Meeting of Shareholders to be filed with the SEC pursuant to Regulation 14A are incorporated by reference into Part III of this Annual Report on Form 10-K.

​

​

​

Table of Contents

​

First United Corporation

Table of Contents

​ ​ ​

FORWARD LOOKING STATEMENTS 3

PART I ​ ​

ITEM 1. Business 4

ITEM 1A. Risk Factors 15

ITEM 1B. Unresolved Staff Comments 30

ITEM 1C Cybersecurity 30

ITEM 2. Properties 32

ITEM 3. Legal Proceedings 32

ITEM 4. Mine Safety Disclosures 32

PART II ​ ​

ITEM 6. Reserved 33

ITEM 7A. Quantitative and Qualitative Disclosures About Market Risk 59

ITEM 8. Financial Statements and Supplementary Data 60

ITEM 9A. Controls and Procedures 126

ITEM 9B. Other Information 128

ITEM 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections 128

PART III ​ ​

ITEM 10. Directors, Executive Officers and Corporate Governance 128

ITEM 11. Executive Compensation 128

ITEM 14. Principal Accountant Fees and Services 129

PART IV ​ ​

ITEM 15. Exhibits and Financial Statement Schedules 130

​

​

​

​

2

​

Table of Contents

​

As used in this annual report, the terms “the Corporation”, “we”, “us”, and “our” mean First United Corporation and unless the context clearly suggests otherwise, its consolidated subsidiaries.

FORWARD LOOKING STATEMENTS

This annual report contains forward-looking statements within the meaning of The Private Securities Litigation Reform Act of 1995. Such statements include projections, predictions, expectations or statements as to beliefs or future events or results or refer to other matters that are not historical facts. Forward-looking statements are subject to known and unknown risks, uncertainties and other factors that could cause the actual results to differ materially from those contemplated by the statements. The forward-looking statements contained in this annual report are based on various factors and were derived using numerous assumptions. In some cases, you can identify these forward-looking statements by words like “may”, “will”, “should”, “expect”, “plan”, “anticipate”, “intend”, “believe”, “estimate”, “predict”, “potential”, or “continue” or the negative of those words and other comparable words. You should be aware that those statements reflect only our predictions. If known or unknown risks or uncertainties should materialize, or if underlying assumptions should prove inaccurate, actual results could differ materially from past results and those anticipated, estimated or projected. You should bear this in mind when reading this annual report and not place undue reliance on these forward-looking statements. Factors that might cause such differences include, but are not limited to:

● the effect of any epidemic.

You should also consider carefully the risk factors discussed in Item 1A of Part I of this annual report, which address additional factors that could cause our actual results to differ from those set forth in the forward-looking statements and could materially and adversely affect our business, operating results and financial condition. The risks discussed in this annual report are factors that, individually or in the aggregate, could cause our actual results to differ materially from expected and historical results. You should understand that it is not possible to predict or identify all such factors. Consequently, you should not consider such disclosures to be a complete discussion of all potential risks or uncertainties.

The forward-looking statements speak only as of the date on which they are made, and, except to the extent required by federal securities laws, we undertake no obligation to update any forward-looking statement to reflect events or circumstances after the date on which the statement is made or to reflect the occurrence of unanticipated events. In addition, we cannot assess the impact of each factor on our business or the extent to which any factor, or combination of factors, may cause actual results to differ materially from those contained in any forward-looking statements.

3

​

Table of Contents

​

PART I

ITEM 1. BUSINESS

General

First United Corporation is a Maryland corporation chartered in 1985 and a bank holding company registered with the Board of Governors of the Federal Reserve System (the “FRB”) under the Bank Holding Company Act of 1956, as amended, that elected financial holding company status in 2021. The Corporation’s primary business is serving as the parent company of First United Bank & Trust, a Maryland trust company (the “Bank”), First United Statutory Trust I (“Trust I”) and First United Statutory Trust II (“Trust II” and together with Trust I, the “Trusts”), both Connecticut statutory business trusts. The Trusts were formed for the purpose of selling trust preferred securities that qualified as Tier 1 capital. The Bank has two consumer finance company subsidiaries - OakFirst Loan Center, Inc., a West Virginia corporation, and OakFirst Loan Center, LLC, a Maryland limited liability company (together with OakFirst Loan Center, Inc., the “OakFirst Loan Centers”) - and one subsidiary that it uses to hold real estate acquired through foreclosure or by deed in lieu of foreclosure - First OREO Trust, a Maryland statutory trust. In addition, the Bank owns 99.9% of the limited partnership interests in Liberty Mews Limited Partnership, a Maryland limited partnership formed for the purpose of acquiring, developing and operating low-income housing units in Garrett County, Maryland, and a 99.9% non-voting membership interest in MCC FUBT Fund, LLC, an Ohio limited liability company formed for the purpose of acquiring, developing and operating low-income housing units in Allegany County, Maryland and Mineral County, West Virginia.

At December 31, 2025, we had total assets of $2.1 billion, net loans of $1.5 billion and deposits of $1.7 billion. Shareholders’ equity at December 31, 2025 was $203.6 million.

The Corporation maintains an Internet website at www.mybank.com on which it makes available, free of charge, its Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and all amendments to the foregoing as soon as reasonably practicable after these reports are electronically filed with, or furnished to, the SEC.

Banking Products and Services

The Bank operates 23 banking offices, one customer service center and 30 Automated Teller Machines (“ATMs”) in Allegany County, Frederick County, Garrett County, and Washington County in Maryland, and in Mineral County, Berkeley County and Monongalia County in West Virginia. The Bank is an independent community bank providing a complete range of retail and commercial banking services to businesses and individuals in its market areas. Services offered are essentially the same as those offered by the regional institutions that compete with the Bank and include checking, savings, money market deposit accounts, and certificates of deposit, business loans, personal loans, mortgage loans, lines of credit, and consumer-oriented retirement accounts including individual retirement accounts (“IRAs”) and employee benefit accounts. In addition, the Bank provides full brokerage services through a networking arrangement with Cetera Investment Services, LLC, a full-service broker-dealer. The Bank also provides safe deposit and night depository facilities, insurance products and trust services. The Bank’s deposits are insured by the Federal Deposit Insurance Corporation (the “FDIC”) up to applicable limits.

Lending Activities

Our lending activities are conducted through the Bank. Since 2010, the Bank has not originated any new loans through the OakFirst Loan Centers and their sole activity is servicing existing loans.

The Bank’s commercial loans are primarily secured by real estate, commercial equipment, vehicles or other assets of the borrower. Repayment is often dependent on the successful business operations of the borrower and may be affected by adverse conditions in the local economy or real estate market. The financial condition and cash flow of commercial borrowers is therefore carefully analyzed during the loan approval process and continues to be monitored throughout the duration of the loan by obtaining business financial statements, personal financial statements and income tax returns. The

4

​

Table of Contents

​

frequency of this ongoing analysis depends upon the size and complexity of the credit and collateral that secures the loan. It is also the Bank’s general policy to obtain personal guarantees from the principals of the commercial loan borrowers.

Commercial real estate loans are primarily those secured by land for residential and commercial development, agricultural purpose properties, service industry buildings such as restaurants, hotels and motels, retail buildings and general-purpose business space. The Bank attempts to mitigate the risks associated with these loans through low loan to value ratio standards, thorough financial analyses, and management’s knowledge of the local economy in which the Bank lends.

The risk of loss associated with commercial real estate construction lending is controlled through conservative underwriting procedures such as loan to value ratios of 80% or less, obtaining additional collateral when prudent, analysis of cash flows, and closely monitoring construction projects to control disbursement of funds on loans.

The Bank’s residential mortgage portfolio is distributed between variable and fixed rate loans. Some loans are booked at fixed rates to meet the Bank’s requirements under the federal Community Reinvestment Act (the “CRA”) or to complement our asset liability mix. Other fixed rate residential mortgage loans are originated in a brokering capacity on behalf of other financial institutions, for which the Bank receives a fee. As with any consumer loan, repayment is dependent on the borrower’s continuing financial stability, which can be adversely impacted by factors such as job loss, divorce, illness, or personal bankruptcy. Residential mortgage loans exceeding an internal loan-to-value ratio require private mortgage insurance. Title insurance protecting the Bank’s lien priority, as well as fire and casualty insurance, is also required.

Home equity lines of credit, included within the residential mortgage portfolio, are secured by the borrower’s home and can be drawn on at the discretion of the borrower. These lines of credit are at variable interest rates.

The Bank also provides residential real estate construction loans to builders and individuals for single family dwellings. Residential construction loans are usually granted based upon “as completed” appraisals and are secured by the property under construction. Site inspections are performed to determine pre-specified stages of completion before loan proceeds are disbursed. These loans typically have maturities of six to twelve months and may have a fixed or variable rate. Permanent financing for individuals offered by the Bank includes fixed and variable rate loans with five, seven or ten-year adjustable-rate mortgages.

A variety of other consumer loans are also offered to customers, including indirect and direct auto loans, student loans, and other secured and unsecured lines of credit and term loans.

An allowance for credit losses (“ACL”) is maintained to provide for losses over the life of the portfolio from our lending activities. A complete discussion of the factors considered in determination of the ACL is included in Item 7 of Part II of this report.

Deposit Activities

The Bank offers a full array of deposit products including checking, savings and money market accounts, regular and IRA certificates of deposit, and Health Savings accounts. The Bank also offers the Certificate of Deposit Account Registry Service®, or CDARS®, and the IntraFi Cash Service®, or ICS®, programs to municipalities, businesses, and consumers through which the Bank provides access to multi-million-dollar certificates of deposit, savings and demand deposits, respectively. Both programs are fully FDIC-insured. In addition, we offer our commercial customers packages which include Treasury Management, Cash Sweep and various checking opportunities.

Information about our income from and assets related to our banking business may be found in the Consolidated Statements of Financial Condition and the Consolidated Statements of Income and the related notes thereto included in Item 8 of Part II of this annual report.

5

​

Table of Contents

​

Wealth Management

The Bank’s wealth department offers a full range of trust services, including personal trust, investment agency accounts, charitable trusts, retirement accounts including IRA roll-overs, 401(k) accounts and defined benefit plans, estate administration and estate planning.

At December 31, 2025 and 2024, the total market value of assets under the supervision of the Bank’s wealth department was approximately $1.8 billion and $1.7 billion, respectively. Wealth management income, which includes trust department income and brokerage commissions, for these years may be found in the Consolidated Statements of Income under the heading “Other operating income”, which is contained in Item 8 of Part II of this annual report.

COMPETITION

The banking business, in all of its phases, is highly competitive. Within our market areas, we compete with commercial banks, (including local banks and branches or affiliates of other larger banks), savings and loan associations and credit unions for loans and deposits, with consumer finance companies for loans, and with other financial institutions and other providers of financial services for various types of products and services, including trust services. There is also competition for commercial and retail banking business from banks and financial institutions located outside our market areas and on the internet.

The primary factors in competing for deposits are interest rates, personalized services, the quality and range of financial services, technology, convenience of office locations and office hours. The primary factors in competing for loans are interest rates, loan origination fees, the quality and range of lending services and personalized services.

To compete with other financial services providers, we rely principally upon local promotional activities, personal relationships established by officers, directors and employees with customers, and specialized services tailored to meet customers’ needs. In those instances in which we are unable to accommodate customers’ needs, we attempt to arrange for those services to be provided by other financial services providers with which we have a relationship.

​

6

​

Table of Contents

​

The following tables set forth deposit data for the Maryland and West Virginia Counties in which the Bank maintains offices as of June 30, 2025, the most recent date for which comparative information is available.

​

​ ​ ​ ​ ​ ​ ​ ​

​ ​ Offices ​ Deposits ​ Market

​ ​ ​ ​ (in Market) ​ ​ ​ (in thousands) ​ ​ ​ Share

Allegany County, Maryland: ​ ​ ​ ​ ​ ​ ​

Manufacturers and Traders Trust Company ​ 5 ​ ​ 249,590 ​ 30.06%

Dollar Bank, Federal Savings Bank ​ 2 ​ ​ 62,282 ​ 7.50%

Source: FDIC Deposit Market Share Report ​ ​ ​ ​ ​ ​ ​

​ ​ ​ ​ ​ ​ ​ ​

Frederick County, Maryland: ​ ​ ​ ​ ​ ​ ​

Bank Of America, National Association ​ 4 ​ ​ 797,010 ​ 12.48%

Manufacturers and Traders Trust Company ​ 6 ​ ​ 495,713 ​ 7.77%

Capital One, National Association ​ 2 ​ ​ 308,789 ​ 4.84%

Wells Fargo Bank, National Association ​ 1 ​ ​ 174,151 ​ 2.73%

JP Morgan Chase Bank, National Association ​ 1 ​ ​ 37,516 ​ 0.59%

Fulton Bank, National Association ​ 1 ​ ​ 36,972 ​ 0.58%

Woodforest National Bank ​ 1 ​ ​ 3,596 ​ 0.06%

Source: FDIC Deposit Market Share Report ​ ​ ​ ​ ​ ​ ​

​ ​ ​ ​ ​ ​ ​ ​

Garrett County, Maryland: ​ ​ ​ ​ ​ ​ ​

Manufacturers and Traders Trust Company ​ 2 ​ ​ 115,481 ​ 13.90%

Miners & Merchants Bank ​ 1 ​ ​ 7,298 ​ 0.88%

Source: FDIC Deposit Market Share Report ​ ​ ​ ​ ​ ​ ​

​ ​ ​ ​ ​ ​ ​ ​

Washington County, Maryland: ​ ​ ​ ​ ​ ​ ​

Fulton Bank, National Association ​ 4 ​ $ 629,938 ​ 19.22%

Manufacturers and Traders Trust Company ​ 9 ​ ​ 584,752 ​ 17.85%

Farmers and Merchants Trust Company of Chambersburg ​ 1 ​ ​ 25,581 ​ 0.78%

Ameriserv Financial Bank ​ 1 ​ ​ 22,170 ​ 0.68%

Jefferson Security Bank ​ 1 ​ ​ 5,891 ​ 0.18%

Source: FDIC Deposit Market Share Report ​ ​ ​ ​ ​ ​ ​

7

​

Table of Contents

​

​

​ ​ ​ ​ ​ ​ ​ ​

Berkeley County, West Virginia: ​ ​ ​ ​ ​ ​ ​

City National Bank of West Virginia ​ 4 ​ ​ 262,191 ​ 12.90%

Burke & Herbert Bank & Trust Company ​ 3 ​ ​ 182,491 ​ 8.98%

Woodforest National Bank ​ 1 ​ ​ 4,810 ​ 0.24%

Source: FDIC Deposit Market Share Report ​ ​ ​ ​ ​ ​ ​

​ ​ ​ ​ ​ ​ ​ ​

Mineral County, West Virginia: ​ ​ ​ ​ ​ ​ ​

Manufacturers and Traders Trust Company ​ 2 ​ ​ 84,345 ​ 23.24%

Source: FDIC Deposit Market Share Report ​ ​ ​ ​ ​ ​ ​

​ ​ ​ ​ ​ ​ ​ ​

Monongalia County, West Virginia: ​ ​ ​ ​ ​ ​ ​

PNC Bank, National Association ​ 2 ​ ​ 233,452 ​ 4.57%

Citizens Bank of Morgantown, Inc. ​ 1 ​ ​ 42,295 ​ 0.83%

Burke & Herbert Bank & Trust Company ​ 1 ​ ​ 39,211 ​ 0.77%

JP Morgan Chase Bank, National Association ​ 1 ​ ​ 31,636 ​ 0.62%

City National Bank of West Virginia ​ 1 ​ ​ 3,253 ​ 0.06%

Source: FDIC Deposit Market Share Report ​ ​ ​ ​ ​ ​ ​

​

​

For further information about competition in our market areas, see the Risk Factor entitled “We operate in a competitive environment, and our inability to effectively compete could adversely and materially impact our financial condition and results of operations” in Item 1A of Part I of this annual report.

SUPERVISION AND REGULATION

The following is a summary of the material regulations and policies applicable to the Corporation and its subsidiaries and is not intended to be a comprehensive discussion. Changes in applicable laws and regulations may have a material effect on our business.

General

The Corporation is registered with the FRB as a financial holding company under the Bank Holding Company Act of 1956, as amended (the “BHC Act”) and, as such, is subject to the supervision, examination and reporting requirements of the BHC Act and the regulations of the FRB. As a publicly-traded company whose common stock, par value $0.01 per share (the “Common Stock”), is registered under Section 12(b) of the Securities Exchange Act of 1934,

8

​

Table of Contents

​

as amended (the “Exchange Act”), and listed on The NASDAQ Global Select Market, the Corporation is also subject to regulation and supervision by the SEC and The NASDAQ Stock Market, LLC (“NASDAQ”).

The Bank is a Maryland trust company subject to the banking laws of Maryland and to regulation by the Maryland Department of Labor’s Office of Financial Regulation (the “Maryland OFR”), who is required by statute to make at least one examination in each calendar year (or at 18-month intervals if the Maryland OFR determines that an examination is unnecessary in a particular calendar year). The Bank also has offices in West Virginia, and the operations of these offices are subject to various West Virginia laws. As a member of the FDIC, the Bank is also subject to certain provisions of federal laws and regulations regarding deposit insurance and activities of insured state-chartered banks, including those that require examination by the FDIC. In addition to the foregoing, there are a myriad of other federal and state laws and regulations that affect, or govern the business of banking, including consumer lending, deposit-taking, and trust operations.

All non-bank subsidiaries of the Corporation are subject to examination by the FRB, and, as affiliates of the Bank, are subject to examination by the FDIC and the Maryland OFR. In addition, OakFirst Loan Center, Inc. is subject to licensing and regulation by the West Virginia Division of Banking, and OakFirst Loan Center, LLC is subject to licensing and regulation by the Maryland OFR.

Regulation of Bank Holding Companies

The Corporation and its affiliates are subject to the provisions of Section 23A and Section 23B of the Federal Reserve Act. Section 23A limits the amount of loans or extensions of credit to, and investments in, the Corporation and its non-bank affiliates by the Bank. Section 23B requires that transactions between the Bank and the Corporation and its non-bank affiliates be on terms and under circumstances that are substantially the same as with non-affiliates.

Under FRB policy, the Corporation is expected to act as a source of strength to the Bank, and the FRB may charge the Corporation with engaging in unsafe and unsound practices for failure to commit resources to a subsidiary bank when required. This support may be required at times when the bank holding company may not have the resources to provide the support. Under the prompt corrective action provisions, if a controlled bank is undercapitalized, then the regulators could require the bank holding company to guarantee the bank’s capital restoration plan. In addition, if the FRB believes that a bank holding company’s activities, assets or affiliates represent a significant risk to the financial safety, soundness or stability of a controlled bank, then the FRB could require the bank holding company to terminate the activities, liquidate the assets or divest the affiliates. The regulators may require these and other actions in support of controlled banks even if such actions are not in the best interests of the bank holding company or its stockholders. Because the Corporation is a bank holding company, it is viewed as a source of financial and managerial strength for any controlled depository institutions, like the Bank.

In addition, under the Financial Institutions Reform, Recovery and Enforcement Act of 1989 (“FIRREA”), depository institutions insured by the FDIC can be held liable for any losses incurred by, or reasonably anticipated to be incurred by, the FDIC in connection with (i) the default of a commonly controlled FDIC-insured depository institution or (ii) any assistance provided by the FDIC to a commonly controlled FDIC-insured depository institution in danger of default. Accordingly, in the event that any insured subsidiary of the Corporation causes a loss to the FDIC, other insured subsidiaries of the Corporation could be required to compensate the FDIC by reimbursing it for the estimated amount of such loss. Such cross guaranty liabilities generally are superior in priority to obligations of a financial institution to its shareholders and obligations to other affiliates.

Regulation of Financial Holding Companies

In 2021, the Corporation elected to become a financial holding company, which allows it to engage in certain activities, and own shares or control of certain entities, that are in addition to those permissible for an entity that is a bank holding company only. The provisions of the BHC Act relating to financial holding companies and the regulations promulgated thereunder require the Bank to remain “well capitalized” and “well managed”. The capital requirement is discussed below under the heading, “Prompt Corrective Action”. The Bank will be considered to be well managed so

9

​

Table of Contents

​

long as it achieves a CAMEL composite rating of at least “2” as a result of its most recent examination and at least a “satisfactory” management rating (if such rating is given). If the Bank were to fail to meet either of these requirements, then the Corporation would be required to enter into an agreement with the FRB that would address the remediation of the condition that led to the failure. During the term of that agreement, which is typically 180 days but can be extended at the discretion of the FRB, the Corporation would be prohibited from commencing any additional activity or acquiring control or shares of any company that would otherwise be permissible for a financial holding company under Section 4(k) of the BHC Act. If the Corporation were to fail to correct that condition by the expiration of the agreement’s term, then the FRB could order the Corporation to divest its ownership of the Bank or, alternatively, terminate all financial holding company activities. For so long as the Corporation remains a financial holding company, the Bank must also maintain a Satisfactory or better rating under the CRA. During any period that the Bank fails to satisfy this requirement, the Corporation is prohibited from commencing any additional activity or acquiring control or shares of any company that would otherwise be permissible for a financial holding company under Section 4(k) of the BHC Act. The Bank currently satisfies all of the foregoing conditions.

Federal Banking Regulation

Federal banking regulators, such as the FRB and the FDIC, may prohibit the institutions over which they have supervisory authority from engaging in activities or investments that the agencies believe are unsafe or unsound banking practices. Federal banking regulators have extensive enforcement authority over the institutions they regulate to prohibit or correct activities that violate law, regulation or a regulatory agreement or which are deemed to be unsafe or unsound practices. Enforcement actions may include the appointment of a conservator or receiver, the issuance of a cease and desist order, the termination of deposit insurance, the imposition of civil money penalties on the institution, its directors, officers, employees and institution-affiliated parties, the issuance of directives to increase capital, the issuance of formal and informal agreements, the removal of or additions to restrictions on directors, officers, employees and institution-affiliated parties, and the enforcement of any such mechanisms through restraining orders or other court actions.

The Bank is subject to certain restrictions on extensions of credit to executive officers, directors, and principal shareholders or any related interest of such persons, which generally require that such credit extensions be made on substantially the same terms as those available to persons who are not related to the Bank and not involve more than the normal risk of repayment. Other laws tie the maximum amount that may be loaned to any one customer and its related interests to capital levels.

As part of the Federal Deposit Insurance Corporation Improvement Act of 1991 (“FDICIA”), each federal banking regulator adopted non-capital safety and soundness standards for institutions under its authority. These standards include internal controls, information systems and internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, and compensation, fees and benefits. An institution that fails to meet those standards may be required by the agency to develop a plan acceptable to meet the standards. Failure to submit or implement such a plan may subject the institution to regulatory sanctions. We believe that the Bank meets substantially all standards that have been adopted. FDICIA also imposes capital standards on insured depository institutions.

The CRA requires the FDIC, in connection with its examination of financial institutions within its jurisdiction, to evaluate the record of those financial institutions in meeting the credit needs of their communities, including low- and moderate-income neighborhoods, consistent with principles of safe and sound banking practices. These factors are also considered by all regulatory agencies in evaluating mergers, acquisitions and applications to open a branch or facility. As of the date of its most recent examination report, the Bank had a CRA rating of “Satisfactory”.

The Bank is also subject to a variety of other laws and regulations with respect to the operation of its business, including, but not limited to, the TILA/RESPA Integrated Disclosure rule (“TRID”), Truth in Lending Act, the Real Estate Settlement Procedures Act, the Truth in Savings Act, the Equal Credit Opportunity Act, the Electronic Funds Transfer Act, the Fair Housing Act, the Home Mortgage Disclosure Act, the Fair Debt Collection Practices Act, the Fair Credit Reporting Act, Expedited Funds Availability (Regulation CC), Reserve Requirements (Regulation D), Privacy of Consumer Information (Regulation P), Margin Stock Loans (Regulation U), the Right To Financial Privacy Act, the Flood

10

​

Table of Contents

​

Disaster Protection Act, the Homeowners Protection Act, the Servicemembers Civil Relief Act, the Telephone Consumer Protection Act, the CAN-SPAM Act, the Children’s Online Privacy Protection Act, Bank Secrecy Act/Anti-Money Laundering (“BSA/AML”) and Office of Foreign Assets Control (“OFAC”).

Capital Requirements

We require capital to fund loans, satisfy our obligations under the Bank’s letters of credit, meet the deposit withdrawal demands of the Bank’s customers, and satisfy our other monetary obligations. To the extent that deposits are not adequate to fund our capital requirements, we can rely on the funding sources identified below under the heading “Liquidity Management”. Management is not aware of any demands, commitments, events or uncertainties that are likely to materially affect our ability to meet our future capital requirements.

In addition to operational requirements, the Bank and the Corporation are subject to risk-based capital regulations, which were adopted and are monitored by federal banking regulators. These regulations are used to evaluate capital adequacy and require an analysis of an institution’s asset risk profile and off-balance sheet exposures, such as unused loan commitments and stand-by letters of credit.

Regulators may require higher capital ratios when warranted by the particular circumstances or risk profile of a given banking organization. In the current regulatory environment, banking organizations must stay well-capitalized in order to receive favorable regulatory treatment on acquisition and other expansion activities and favorable risk-based deposit insurance assessments. Our capital policy establishes guidelines meeting these regulatory requirements and takes into consideration current or anticipated risks as well as potential future growth opportunities.

In July 2019, the federal banking agencies adopted a final rule that simplifies compliance with certain aspects of the capital rules. A majority of the simplifications apply solely to banking organizations that are not subject to the advanced approaches capital rule. The rule simplified the application of regulatory capital treatment for mortgage servicing assets, certain deferred tax assets arising from temporary differences, investments in the capital of unconsolidated financial institutions, and capital issued by a consolidated subsidiary of a banking organization and held by third parties (minority interest). In addition, the rule revised the treatment of certain acquisition, development, or construction exposures.

As of December 31, 2025, we were in compliance with the applicable requirements.

Additional information about our capital ratios is contained in “Consolidated Balance Sheet Review” section of Item 7 of Part II of this annual report under the heading “Capital Resources”.

Prompt Corrective Action

The Federal Deposit Insurance Act (“FDI Act”) requires, among other things, the federal banking agencies to take “prompt corrective action” in respect of depository institutions that do not meet minimum capital requirements. The FDI Act includes the following five capital tiers: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” and “critically undercapitalized.” A depository institution’s capital tier will depend upon how its capital levels compare with various relevant capital measures and certain other factors, as established by regulation. The relevant capital measures are the total capital ratio, the Tier 1 capital ratio and the leverage ratio.

A bank will be (i) “well capitalized” if the institution has a total risk-based capital ratio of 10.0% or greater, a Tier 1 risk-based capital ratio of 8.0% or greater, a leverage ratio of 5.0% or greater, a Common Equity Tier 1 (“CET1”) ratio of 6.5% or greater, and is not subject to any order or written directive by any such regulatory authority to meet and maintain a specific capital level for any capital measure, (ii) “adequately capitalized” if the institution has a total risk-based capital ratio of 8.0% or greater, a Tier 1 risk-based capital ratio of 6.0% or greater, a leverage ratio of 4.0% or greater, a CET1 ratio of 4.5% or greater, and is not “well capitalized”, (iii) “undercapitalized” if the institution has a total risk-based capital ratio that is less than 8.0%, a Tier 1 risk-based capital ratio of less than 6.0%, a leverage ratio of less

11

​

Table of Contents

​

than 4.0%, or a CET1 ratio of less than 4.5%, (iv) “significantly undercapitalized” if the institution has a total risk-based capital ratio of less than 6.0%, a Tier 1 risk-based capital ratio of less than 4.0%, a leverage ratio of less than 3.0%, or a CET1 ratio of less than 3.0%, and (v) “critically undercapitalized” if the institution’s tangible equity is equal to or less than 2.0% of average quarterly tangible assets. An institution may be downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios if it is determined to be in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters. A bank’s capital category is determined solely for the purpose of applying prompt corrective action regulations, and the capital category may not constitute an accurate representation of the bank’s overall financial condition or prospects for other purposes.

The FDI Act generally prohibits a depository institution from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the depository institution would thereafter be “undercapitalized.” “Undercapitalized” institutions are subject to growth limitations and are required to submit a capital restoration plan. The agencies may not accept such a plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the depository institution’s capital. In addition, for a capital restoration plan to be acceptable, the depository institution’s parent holding company must guarantee that the institution will comply with such capital restoration plan. The bank holding company must also provide appropriate assurances of performance. The aggregate liability of the parent holding company is limited to the lesser of (i) an amount equal to 5.0% of the depository institution’s total assets at the time it became undercapitalized and (ii) the amount which is necessary (or would have been necessary) to bring the institution into compliance with all capital standards applicable with respect to such institution as of the time it fails to comply with the plan. If a depository institution fails to submit an acceptable plan, it is treated as if it is “significantly undercapitalized.” Significantly undercapitalized” depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become “adequately capitalized,” requirements to reduce total assets, and cessation of receipt of deposits from correspondent banks. “Critically undercapitalized” institutions are subject to the appointment of a receiver or conservator.

The appropriate federal banking agency may, under certain circumstances, reclassify a well-capitalized insured depository institution as adequately capitalized. The FDI Act provides that an institution may be reclassified if the appropriate federal banking agency determines (after notice and opportunity for hearing) that the institution is in an unsafe or unsound condition or deems the institution to be engaging in an unsafe or unsound practice.

The appropriate agency is also permitted to require an adequately capitalized or undercapitalized institution to comply with the supervisory provisions as if the institution were in the next lower category (but not treat a significantly undercapitalized institution as critically undercapitalized) based on supervisory information other than the capital levels of the institution.

As of December 31, 2025, the Bank was “well capitalized” based on the aforementioned ratios.

Liquidity Requirements

Historically, the regulation and monitoring of bank liquidity has been addressed as a supervisory matter, without required formulaic measures. The Basel III Capital Rules require banks to measure their liquidity against specific liquidity tests that, although similar in some respects to liquidity measures historically applied by banks and regulators for management and supervisory purposes, going forward would be required by regulation. One test, referred to as the liquidity coverage ratio, is designed to ensure that the banking entity maintains an adequate level of unencumbered high-quality liquid assets equal to the entity’s expected net cash outflow for a 30-day time horizon (or, if greater, 25% of its expected total cash outflow) under an acute liquidity stress scenario. The other test, referred to as the net stable funding ratio, is designed to promote more medium- and long-term funding of the assets and activities of banking entities over a one-year time horizon. These requirements will incent banking entities to increase their holdings of securities issued by the U.S. Department of the Treasury (the “Treasury”) and other sovereign debt as a component of assets and increase the use of long-term debt as a funding source.

12

​

Table of Contents

​

Deposit Insurance

The Bank is a member of the FDIC and pays an insurance premium to the FDIC based upon its assessable deposits on a quarterly basis. Deposits are insured up to applicable limits by the FDIC and such insurance is backed by the full faith and credit of the United States Government.

The deposit insurance limit set by law is currently $250,000. The coverage limit is per depositor, per insured depository institution for each account ownership category.

The Federal Deposit Insurance Reform Act of 2005, which created the Deposit Insurance Fund (“DIF”), gave the FDIC greater latitude in setting the assessment rates for insured depository institutions which could be used to impose minimum assessments. The FDIC has the flexibility to adopt actual rates that are higher or lower than the total base assessment rates adopted without notice and comment, if certain conditions are met.

In November 2023, the FDIC issued a final rule to implement a special assessment to recover losses to the DIF as a result of bank failures that year and the FDIC’s use of the systemic risk exception to cover certain deposits that were otherwise uninsured. In June 2024, due to the increased estimate of losses, the FDIC announced that it projects that the special assessment will be collected for an additional two quarters beyond the initial eight-quarter collection period at a lower rate. In December 2025, based upon the first six quarterly collections of the special assessment and anticipated collections for the seventh quarterly special assessment, the FDIC issued an interim final rule to amend the collection of the special assessment to reduce the eighth quarter special assessment and removed the special assessment for the two additional quarters was removed. The special estimate was based on estimated uninsured deposits at December 31, 2022 (excluding the first $5.0 billion). The Bank was exempt from this special assessment as its total uninsured deposits were below $5.0 billion.

The FDIC is authorized to conduct examinations of and require reporting by FDIC-insured institutions. It is also authorized to terminate a depository bank’s deposit insurance upon a finding by the FDIC that the bank’s financial condition is unsafe or unsound or that the institution has engaged in unsafe or unsound practices or has violated any applicable rule, regulation, order or condition enacted or imposed by the bank’s regulatory agency. The termination of deposit insurance for our bank subsidiary would have a material adverse effect on our earnings, operations and financial condition.

Bank Secrecy Act/Anti-Money Laundering

The Bank Secrecy Act (“BSA”), which is intended to require financial institutions to develop policies, procedures, and practices to prevent and deter money laundering, mandates that every national bank have a written, board-approved program that is reasonably designed to assure and monitor compliance with the BSA.

The program must, at a minimum: (i) provide for a system of internal controls to assure ongoing compliance; (ii) provide for independent testing for compliance; (iii) designate an individual responsible for coordinating and monitoring day-to-day compliance; and (iv) provide training for appropriate personnel. In addition, state-chartered banks are required to adopt a customer identification program as part of its BSA compliance program. State-chartered banks are also required to file Suspicious Activity Reports when they detect certain known or suspected violations of federal law or suspicious transactions related to a money laundering activity or a violation of the BSA.

In addition to complying with the BSA, the Bank is subject to the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (the “USA Patriot Act”). The USA Patriot Act is designed to deny terrorists and criminals the ability to obtain access to the United States’ financial system and has significant implications for depository institutions, brokers, dealers, and other businesses involved in the transfer of money. The USA Patriot Act mandates that financial service companies implement additional policies and procedures and take heightened measures designed to address any or all of the following matters: customer identification programs,

13

​

Table of Contents

​

money laundering, terrorist financing, identifying and reporting suspicious activities and currency transactions, currency crimes, and cooperation between financial institutions and law enforcement authorities.

Dodd-Frank Act

The Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”) was enacted in July 2010 and significantly restructured the financial regulatory regime in the United States. Although the Dodd-Frank Act’s provisions that have received the most public attention generally have been those applying to or more likely to affect larger institutions such as banks and bank holding companies with total consolidated assets of $50 billion or more, it contains numerous other provisions that affect all financial institutions, including the Bank. The Dodd-Frank Act established the Consumer Financial Protection Bureau (the “CFPB”), discussed below, and contains a wide variety of provisions affecting the regulation of depository institutions, including fair lending, fair debt collection practices, mortgage loan origination and servicing obligations, bankruptcy, military service member protections, use of credit reports, privacy matters, and disclosure of credit terms and correction of billing errors. Local, state and national regulatory and enforcement agencies continue efforts to address perceived problems within the mortgage lending and credit card industries through broad or targeted legislative or regulatory initiatives aimed at lenders’ operations in consumer lending markets. There continues to be a significant amount of legislative and regulatory activity, nationally, locally and at the state level, designed to limit certain lending practices while mandating certain servicing procedures. Federal bankruptcy and state debtor relief and collection laws, as well as the Servicemembers Civil Relief Act affect the ability of banks, including the Bank, to collect outstanding balances.

Moreover, the Dodd-Frank Act permits states to adopt stricter consumer protection laws and states’ attorneys general may enforce consumer protection rules issued by the CFPB. U.S. financial regulatory agencies have increasingly used a general consumer protection statute to address unethical or otherwise bad business practices that may not necessarily fall directly under the purview of a specific banking or consumer finance law. Prior to the Dodd-Frank Act, there was little formal guidance to provide insight to the parameters for compliance with the “unfair or deceptive acts or practices” (“UDAP”) law. However, the UDAP provisions have been expanded under the Dodd-Frank Act to apply to “unfair, deceptive or abusive acts or practices”, which has been delegated to the CFPB for supervision.

The Dodd-Frank Act has increased, and will likely continue to increase, our regulatory compliance burdens and costs and may restrict the financial products and services that we offer to our customers in the future.

Mortgage Lending and Servicing

The Bank’s mortgage lending and servicing activities are subject to various laws and regulations that are enforced by the federal banking regulators and the CFPB, such as the Truth in Lending Act, the Real Estate Settlement Procedures Act, and various rules adopted thereunder, including those relating to consumer disclosures, appraisal requirements, mortgage originator compensation, prohibitions on mandatory arbitration provisions under certain circumstances, and the obligation to credit payments and provide payoff statements within certain time periods and provide certain notices prior to interest rate and payment adjustments.

The Bank is required to make a reasonable and good faith determination based on verified and documented information that a consumer applying for a mortgage loan has a reasonable ability to repay the loan according to its terms. Qualified mortgages that are not “higher-priced” are afforded a safe harbor presumption of compliance with the ability to repay rules, while qualified mortgages that are “higher-priced” garner a rebuttable presumption of compliance with the ability to repay rules. In general, a “qualified mortgage” is a mortgage loan without negative amortization, interest-only payments, balloon payments, or a term exceeding 30 years, where the lender determines that the borrower has the ability to repay, and where the borrower’s points and fees do not exceed 3% of the total loan amount. “Higher-priced” mortgages must have escrow accounts for taxes and insurance and similar recurring expenses.

14

​

Table of Contents

​

Consumer Lending – Military Lending Act

The Military Lending Act (the “MLA”) and the rules adopted by the Department of Defense (“DOD”) thereunder cover virtually all consumer loan and credit card products (except for loans secured by residential real property and certain purchase-money motor vehicle/personal property secured transactions). Lenders must provide specific written and oral disclosures concerning the protections of the MLA to active-duty members of the military and dependents of active-duty members of the military (“covered borrowers”). The DOD’s rules impose a 36% “Military Annual Percentage Rate” cap that includes costs associated with credit insurance premiums, fees for ancillary products, finance charges associated with the transactions, and application and participation charges. In addition, loan terms cannot include (i) a mandatory arbitration provision, (ii) a waiver of consumer protection laws, (iii) mandatory allotments from military benefits, or (iv) a prepayment penalty. The revised rule also prohibits “roll-over” or refinances of the same loan unless the new loan provides more favorable terms for the covered borrower. Lenders may verify covered borrower status using a DOD database or information provided by credit bureaus.

Federal Securities Laws and NASDAQ Rules

The Common Stock is registered with the SEC under Section 12(b) of the Exchange Act and shares of the Common Stock are listed on the NASDAQ Global Select Market. The Corporation is subject to information reporting requirements, proxy solicitation requirements, insider trading restrictions and other requirements of the Exchange Act, including the requirements imposed under the federal Sarbanes-Oxley Act of 2002, and rules adopted by NASDAQ. Among other things, loans to and other transactions with insiders are subject to restrictions and heightened disclosure, directors and certain committees of the Board must satisfy certain independence requirements, the Corporation must comply with certain enhanced corporate governance requirements, and various issuances of securities by the Corporation require shareholder approval.

Governmental Monetary and Credit Policies and Economic Controls

The earnings and growth of the banking industry and ultimately of the Bank are affected by the monetary and credit policies of governmental authorities, including the FRB. An important function of the FRB is to regulate the national supply of bank credit in order to control recessionary and inflationary pressures. Among the instruments of monetary policy used by the FRB to implement these objectives are open market operations in U.S. Government securities, changes in the federal funds rate, changes in the discount rate of member bank borrowings, and changes in reserve requirements against member bank deposits. These means are used in varying combinations to influence overall growth of bank loans, investments and deposits and may also affect interest rates charged on loans or paid on deposits. The monetary policies of the FRB authorities have had a significant effect on the operating results of commercial banks in the past and are expected to continue to have such an effect in the future. In view of changing conditions in the national economy and in the money markets, as well as the effect of actions by monetary and fiscal authorities, including the FRB, no prediction can be made as to possible future changes in interest rates, deposit levels, loan demand or their effect on our businesses and earnings.

EMPLOYEES

At December 31, 2025, we employed 343 individuals, of whom 315 were full-time employees.

ITEM 1A. RISK FACTORS

The significant risks and uncertainties related to us, our business and our securities of which we are aware are discussed below. Investors and shareholders should carefully consider these risks and uncertainties before making investment decisions with respect to the Corporation’s securities. Any of these factors could materially and adversely affect our business, financial condition, operating results and prospects and could negatively impact the market price of the Corporation’s securities. If any of these risks materialize, the holders of the Corporation’s securities could lose all or part of their investments in the Corporation. Additional risks and uncertainties that we do not yet know of, or that we

15

​

Table of Contents

​

currently think are immaterial, may also impair our business operations. Investors and shareholders should also consider the other information contained in this annual report, including our financial statements and the related notes, before making investment decisions with respect to the Corporation’s securities.

Risks Relating to First United Corporation and its Affiliates

​

First United Corporation’s future success depends on the successful growth of its subsidiaries.

​

The Corporation’s primary business activity for the foreseeable future will be to act as the holding company of the Bank and its other direct and indirect subsidiaries. Therefore, the Corporation’s future profitability will depend on the success and growth of these subsidiaries.

​

The Bank’s funding sources may prove insufficient to replace deposits and support our future growth.

​

The Bank relies on customer deposits, advances from the FHLB, lines of credit at other financial institutions, the Federal Reserve Discount Window, and brokered funds to fund our operations. Although the Bank has historically been able to replace maturing deposits and advances if desired, no assurance can be given that the Bank would be able to replace such funds in the future if our financial condition or the financial condition of the FHLB or market conditions were to change. Our financial flexibility could be severely constrained and/or our cost of funds could increase if we are unable to maintain our access to funding or if financing necessary to accommodate future growth is not available at favorable interest rates. If we are required to rely more heavily on more expensive funding sources to support future growth, then our revenues may not increase proportionately to cover our costs. In that case, our profitability would be adversely affected.

​

We may need to raise capital in the future, and such capital may not be available when needed or at all.

​

We may need to raise capital in the future to provide it with sufficient capital resources and liquidity to meet our commitments and business needs including complying with new regulatory capital rules, particularly if our asset quality or earnings were to deteriorate significantly. Our ability to raise capital, if needed, will depend on, among other things, conditions in the capital markets at that time, which are outside of our control, and our financial condition. Economic conditions and the loss of confidence in financial institutions may limit access to certain customary sources of capital and increase our cost of raising capital. No assurance can be given that such capital will be available on acceptable terms or at all. Any occurrence that may limit our access to the capital markets, such as a decline in the confidence of depositors, investors or counterparties participating in the capital markets may adversely affect our capital costs and our ability to raise capital and, in turn, our liquidity. Moreover, if we need to raise capital in the future, we may have to do so when many other financial institutions are also seeking to raise capital and would have to compete with those institutions for investors. An inability to raise additional capital on acceptable terms as and when needed could have a materially adverse effect on our business, financial condition and results of operations.

​

Our inability to generate liquidity in a timely manner may adversely impact our ability to satisfy obligations associated with our financing, our operations and other components of our business.

​

Timely access to liquidity is essential to our business, and being able to meet obligations as they come due and pay deposits when they are withdrawn is critical to ongoing operations. If we are unable to meet our payment obligations on a daily basis, we may be subject to being placed into receivership, regardless of our capital levels. Our primary sources of liquidity consist of cash and cash balances due from correspondent banks, excess reserves at the Federal Reserve, loan repayments, federal funds sold and other short-term investments, maturities and monetization of investment securities, cash provided by operating activities and new core deposits into the Bank. Our ability to obtain or liquidate these primary sources of liquidity may be impacted by adverse economic conditions resulting from dynamic, complex, and other foreseen and unforeseen inter-related factors and events in the economic environment. If we were to rely on sales proceeds from the sale of investment securities within our portfolio in order to satisfy our obligations, we may be adversely impacted by our ability to transact and settle such sales. Sales of investment securities in an unrealized loss position would negatively affect our earnings and regulatory capital. In addition, in order to monetize our held-to-maturity (“HTM”) securities, we

16

​

Table of Contents

​

expect to rely on pledging those securities for secured funding, and our liquidity may be impaired if we are unable to timely pledge those or any other securities due to lack of available funding, operational impediments or otherwise. Our industry is susceptible to the negative impact of limited access to short-term and/or long-term sources of funds, which could result in a liquidity shortfall and/or impact our liquidity coverage ratio and could have an adverse effect on our operations, financial condition and earnings.

​

Our inability to access sources of financing at terms that are favorable to us may result in an adverse effect on our business, financial condition, and results of operations.

​

Our liquidity could be adversely affected by any inability to access the debt or equity capital markets, liquidity or volatility in those capital markets, the decrease in value of eligible collateral or increased collateral requirements (including as a result of credit concerns for short-term borrowings), changes to our relationships with our funding providers based on real or perceived changes in our risk profile, prolonged federal government shutdowns or changes in regulations. Additionally, our liquidity may be negatively impacted by the unwillingness or inability of the Federal Reserve to act as a lender of last resort.

​

Our ability to raise additional financing depends on conditions in the capital markets, economic conditions and a number of other factors, including investor perceptions regarding the banking industry, market conditions and governmental activities and on our financial condition and performance. Accordingly, we may be unable to raise additional financing if needed or on acceptable terms.

​

The value of real estate collateral may fluctuate significantly resulting in an under-collateralized loan portfolio.

​

The market value of real estate, particularly real estate held for investment, can fluctuate significantly in a short period of time as a result of market conditions in the geographic area in which the real estate is located. If the value of the real estate serving as collateral for the Corporation’s loan portfolio were to decline materially, a significant part of the Corporation’s loan portfolio could become under-collateralized. If the loans that are collateralized by real estate become troubled during a time when market conditions are declining or have declined, then, in the event of foreclosure, we may not be able to realize the amount of collateral that we anticipated at the time of originating the loan. This could have a material adverse effect on the Corporation’s provision for credit losses and the Corporation’s operating results and financial condition.

​

17

​

Table of Contents

​

The Corporation is subject to lending risk, and the impacts of interest rate changes could adversely impact the Corporation.

​

There are inherent risks associated with the Corporation’s lending activities. These risks include, among other things, the impact of changes in interest rates and changes in the economic conditions in the markets where the Corporation operates. Increases in interest rates and/or weakening economic conditions could adversely impact the ability of borrowers to repay outstanding loans or the value of the collateral securing these loans.

​

Our success depends, to a certain extent, upon local, national and global economic and political conditions, as well as governmental monetary policies. Our financial performance generally, and in particular the ability of borrowers to pay interest on and repay principal of outstanding loans and the value of collateral securing the loans, as well as demand for loans and other products and services we offer, is highly dependent upon the business environment in the markets where we operate and the United States as a whole. A favorable business environment is generally characterized by, among other factors, economic growth, efficient capital markets, low inflation, low unemployment, high business and investor confidence, and strong business earnings. Unfavorable or uncertain economic and market conditions can be caused by a decline in economic growth both in the United States and internationally, declines in business activity or investor or business confidence, limitations on the availability of or increases to the cost of credit and capital, increases in inflation or interest rates, high unemployment, natural disasters, trade policies and tariffs, or a combination of these factors. Current economic conditions are being heavily impacted by recent inflationary conditions and higher interest rates, the effects of which may impact our profitability by negatively impacting our fixed costs and expenses. Economic and inflationary pressure on consumers and uncertainty regarding economic improvement could result in changes in consumer and business spending, borrowing, and savings habits. Such conditions could have a material adverse effect on the credit quality of our loans and our business, financial condition, and results of operations.

​

A substantial portion of the Corporation’s loan portfolio is comprised of residential and commercial real estate loans. The Corporation’s concentration of real estate loans may subject the Corporation to additional risk, as fluctuations in market value of collateral and difficulty monitoring income-producing property serving as a source of repayment and collateral. Any of these or other risks relating to real estate loans could adversely affect the collection by the Corporation of the outstanding loan balances.

​

Interest rates and other economic conditions will impact our results of operations.

​

Our net income depends primarily upon our net interest income. Net interest income is the difference between interest income earned on loans, investments and other interest-earning assets and the interest expense incurred on deposits and borrowed funds. The level of net interest income is primarily a function of the average balance of our interest-earning assets, the average balance of our interest-bearing liabilities, and the spread between the yield on such assets and the cost of such liabilities. These factors are influenced by both the pricing and mix of our interest-earning assets and our interest-bearing liabilities which, in turn, are impacted by such external factors as the local economy, competition for loans and deposits, the monetary policy of the Federal Open Market Committee of the FRB, and market interest rates.

​

Different types of assets and liabilities may react differently, and at different times, to changes in market interest rates. We expect that we will periodically experience gaps in the interest rate sensitivities of our assets and liabilities. That means either our interest-bearing liabilities will be more sensitive to changes in market interest rates than our interest-earning assets, or vice versa. When interest-bearing liabilities mature or re-price more quickly than interest-earning assets, an increase in market rates of interest could reduce our net interest income. Likewise, when interest-earning assets mature or re-price more quickly than interest-bearing liabilities, falling interest rates could reduce our net interest income. We are unable to predict changes in market interest rates, which are affected by many factors beyond our control, including inflation, deflation, recession, unemployment, money supply, domestic and international events and changes in the United States and other financial markets.

​

18

​

Table of Contents

​

We also attempt to manage risk from changes in market interest rates, in part, by controlling the mix of interest rate sensitive assets and interest rate sensitive liabilities. However, interest rate risk management techniques are not exact. A rapid increase or decrease in interest rates could adversely affect our results of operations and financial performance.

​

The majority of our business is concentrated in Maryland and West Virginia, much of which involves real estate lending, so a decline in the real estate and credit markets could materially and adversely impact our financial condition and results of operations.

​

Most of the Bank’s loans are made to borrowers located in Maryland and West Virginia and many of these loans, including construction and land development loans, are secured by real estate. Accordingly, a decline in local economic conditions would likely have an adverse impact on our financial condition and results of operations, and the impact on us would likely be greater than the impact felt by larger financial institutions whose loan portfolios are geographically diverse. We cannot guarantee that any risk management practices we implement to address our geographic and loan concentrations will be effective to prevent losses relating to our loan portfolio.

​

The Bank’s concentrations of commercial real estate loans could subject it to increased regulatory scrutiny and directives, which could force us to preserve or raise capital and/or limit future commercial lending activities.

​

The federal banking regulators believe that institutions that have particularly high concentrations of commercial real estate loans within their lending portfolios face a heightened risk of financial difficulties in the event of adverse changes in the economy and commercial real estate markets. Accordingly, through published guidance, these regulators have directed institutions whose concentrations exceed certain percentages of capital to implement heightened risk management practices appropriate to their concentration risk. The guidance provides that banking regulators may require such institutions to reduce their concentrations and/or maintain higher capital ratios than institutions with lower concentrations in commercial real estate. At December 31, 2025, our commercial real estate concentrations were below the heightened risk management thresholds set forth in this guidance.

​

The Bank may experience loan losses in excess of its allowance for credit losses, which would reduce our earnings.

​

The risk of credit losses on loans varies with, among other things, general economic conditions, the type of loans being made, the creditworthiness of the borrowers over the term of the loans and, in the case of collateralized loans, the value and marketability of the collateral for the loans. Management of the Bank maintains an ACL based upon, among other things, historical experience, an evaluation of economic conditions and regular reviews of delinquencies and loan portfolio quality. Based upon such factors, management makes various assumptions and judgments about the ultimate collectability of the loan portfolio and provides the ACL based upon a percentage of the outstanding balances and for specific loans when their ultimate collectability is considered questionable. If management’s assumptions and judgments prove to be incorrect and the ACL is inadequate to absorb future losses, or if the bank regulatory authorities require us to increase the ACL as a part of its examination process, our earnings and capital could be significantly and adversely affected. Although management continually monitors our loan portfolio and makes determinations with respect to the ACL, future adjustments may be necessary if economic conditions differ substantially from the assumptions used or adverse developments arise with respect to our non-performing or performing loans. Material additions to the ACL could result in a material decrease in our net income and capital; and could have a material adverse effect on our financial condition.

​

We depend on the accuracy and completeness of information about customers and counterparties, and inaccurate, incomplete or misleading information provided to us by these persons could cause us to suffer losses.

​

In deciding whether to extend credit or enter into other transactions, we rely on information furnished by or on behalf of customers and counterparties, including financial statements, credit reports and other financial information. We also rely on representations of those customers, counterparties or other third parties, such as independent auditors, as to the accuracy and completeness of that information. Reliance on inaccurate or misleading financial statements, credit

19

​

Table of Contents

​

reports or other financial information could have a material adverse impact on our business, financial condition and results of operations.

​

Our accounting estimates and risk management processes rely on analytical and forecasting models, the inadequacy of which could have a material adverse effect on our financial condition and/or results of operations.

​

The processes we use to estimate our ACL and to measure the fair value of financial instruments, as well as the processes used to estimate the effects of changing interest rates and other market measures on our financial condition and results of operations, depends upon the use of analytical and forecasting models. These models reflect assumptions that may not be accurate, particularly in times of market stress or other unforeseen circumstances. Even if these assumptions are adequate, the models may prove to be inadequate or inaccurate because of other flaws in their design or their implementation, including flaws caused by failures in controls, data management, human error or from the reliance on technology. If the models we use for interest rate risk and asset-liability management are inadequate, we may incur increased or unexpected losses upon changes in market interest rates or other market measures. If the models we use for estimating our expected credit losses are inadequate, the ACL may not be sufficient to support future charge-offs. If the models we use to measure the fair value of financial instruments are inadequate, the fair value of such financial instruments may fluctuate unexpectedly or may not accurately reflect what we could realize upon sale or settlement of such financial instruments. Any such failure in our analytical or forecasting models could have a material adverse effect on our business, financial condition and results of operations.

​

The Bank’s lending activities subject the Bank to the risk of environmental liabilities.

​

A significant portion of the Bank’s loan portfolio is secured by real property. During the ordinary course of business, the Bank may foreclose on and take title to properties securing certain loans. In doing so, there is a risk that hazardous or toxic substances could be found on these properties. If hazardous or toxic substances are found, the Bank may be liable for remediation costs, as well as for personal injury and property damage. Environmental laws may require the Bank to incur substantial expenses and may materially reduce the affected property’s value or limit the Bank’s ability to use or sell the affected property. In addition, future laws or more stringent interpretations or enforcement policies with respect to existing laws may increase the Bank’s exposure to environmental liability. Although the Bank has policies and procedures to perform an environmental review before initiating any foreclosure action on real property, these reviews may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on our financial condition and results of operations.

​

Our investment securities are subject to market risk and credit risk that may have an adverse impact on our financial condition and results of operation.

​

At December 31, 2025, investment securities in our investment portfolio having a cost basis of $123.9 million and a market value of $107.1 million were classified as available-for-sale pursuant to FASB Accounting Standards Codification (“ASC”) Topic 320, Investments – Debt and Equity Securities,relating to accounting for investments. Topic 320 requires that unrealized gains and losses in the estimated value of the available-for-sale portfolio be “marked to market” and reflected as a separate item in shareholders’ equity (net of tax) as accumulated other comprehensive loss. There can be no assurance that future market performance of our investment portfolio will enable us to realize income from sales of securities. Shareholders’ equity will continue to reflect the unrealized gains and losses (net of tax) of these investments. Moreover, there can be no assurance that the market value of our investment portfolio will not decline, causing a corresponding decline in shareholders’ equity.

​

Several factors could affect the market value of our investment portfolio. These include, but are not limited to, changes in interest rates or expectations of changes, the degree of volatility in the securities markets, inflation rates or expectations of inflation and the slope of the interest rate yield curve (the yield curve refers to the differences between shorter-term and longer-term interest rates; a positively sloped yield curve means shorter-term rates are lower than longer-term rates). Also, the passage of time will affect the market values of our investment securities, in that the closer they are

20

​

Table of Contents

​

to maturing, the closer the market price should be to par value. These and other factors may impact specific categories of the portfolio differently, and management cannot predict the effect these factors may have on any specific category.

​

Our investment securities portfolio as a whole is exposed to credit risk associated with rating agency downgrades and defaults of the issuers of those securities. We measure expected credit losses on our investment portfolio through our current expected credit loss (“CECL”) estimate. Increases to the provision for credit losses would have a negative impact on our results of operations and regulatory capital ratios. Additionally, an insufficient CECL provision may result in additional losses that would have an adverse impact on our results of operations. The investment portfolio’s performance, including the existence of unrealized and unrecognized losses in the portfolio, also may create reputational risk for us, particularly in conjunction with the conditions of the banking industry generally, that could result in deposit outflows or reduced access to funding, or negatively impact our ability to attract and retain prospective customers.

​

Impairment of goodwill and other intangible assets or deferred tax assets could require charges to earnings, which could result in a negative impact on our results of operations.

​

Under current accounting standards, goodwill and other intangible assets are subject to impairment tests on at least an annual basis or more frequently if a triggering event occurs or circumstances change that reduce the fair value of a reporting unit below its carrying amount. A decline in the price of the shares of Common Stock or occurrence of a triggering event following any of our quarterly earnings releases and prior to the filing of the periodic report for that period could, under certain circumstances, cause us to perform a goodwill impairment test and result in an impairment charge being recorded for that period which was not reflected in such earnings release. In the event that we conclude that all or a portion of our goodwill and other intangible assets may be impaired, a non-cash charge for the amount of such impairment would be recorded to earnings. Such a charge would have no impact on tangible capital. At December 31, 2025, we had recorded goodwill and other intangible assets of $11.4 million, representing approximately 5.6% of shareholders’ equity.

​

At December 31, 2025, our net deferred tax assets were valued at $8.7 million. Included in that total is $2.6 million of state net operating loss carryforwards (“NOLs”) associated with separate company tax filings of the Corporation, which we do not expect to use and, thus, we have established a $2.6 million valuation allowance. A deferred tax asset is reduced by a valuation allowance if, based on the weight of the evidence available, both negative and positive, including the recent trend of quarterly earnings, the Corporation determines that it is more likely than not that some portion or all of the total deferred tax asset will not be realized. Moreover, our ability to utilize our net operating loss carryforwards to offset future taxable income may be significantly limited if we experience an “ownership change,” as determined under Section 382 of the Internal Revenue Code of 1986, as amended (“the Code”). If an ownership change were to occur, the limitations imposed by Section 382 of the Code could result in a portion of our net operating loss carryforwards expiring unused, thereby impairing their value. Section 382’s provisions are complex, and we cannot predict any circumstances surrounding the future ownership of the Common Stock. Accordingly, we cannot provide any assurance that we will not experience an ownership change in the future.

​

The impact of each of these impairment matters could have a material adverse effect on our business, results of operations, and financial condition.

​

Adverse developments affecting the financial services industry, such as actual events or concerns involving liquidity, defaults, or non-performance by financial institutions or transactional counterparties, could adversely affect our financial condition and results of operations.

​

Financial services institutions are interrelated as a result of trading, clearing, counterparty or other relationships, and we routinely execute transactions with counterparties in the financial industry. Actual events involving limited liquidity, defaults, non-performance or other adverse developments that affect financial institutions, transactional counterparties or other companies in the financial services industry or the financial services industry generally, or concerns or rumors about any events of these kinds or other similar risks, have in the past and may in the future lead to market-wide liquidity problems.

​

21

​

Table of Contents

​

In addition to the risk that occurrence of such events could adversely impact our ability to engage in routine funding transactions, they could also lead to losses or defaults by us or by other institutions, either of which could have a material adverse effect on our business, results of operations and financial condition.

​

Increases in FDIC insurance premiums may have a material adverse effect on our results of operations.

​

In general, we are unable to control the amount of premiums that are required to be paid for FDIC insurance. In October 2022, the FDIC finalized a rule to increase the assessment rate by two basis points beginning in the first quarter of 2023. The increase in the assessment rate for banks is intended to increase the Deposit Insurance Fund (“DIF)” reserve ratio to 1.35%. In early March 2023, the FDIC was appointed receiver for two banks, in each case due primarily to liquidity concerns at those institutions. Promptly following these events, the federal banking regulators announced that the FDIC will use funds from the DIF to ensure that all depositors of the two failed institutions are made whole, at no cost to taxpayers. In November 2023, the FDIC issued a final rule to implement a special assessment to recover losses to the DIF as a result of bank failures that year and the FDIC’s use of the systemic risk exception to cover certain deposits that were otherwise uninsured. In June 2024, due to the increased estimate of losses, the FDIC announced that it projects that the special assessment will be collected for an additional two quarters beyond the initial eight-quarter collection period at a lower rate. The special estimate was based on estimated uninsured deposits at December 31, 2022 (excluding the first $5.0 billion). The Bank was exempt from this special assessment as its total uninsured deposits were below $5.0 billion; however, future increases or required repayments in FDIC insurance premiums may materially adversely affect our results of operations.

We operate in a competitive environment, and our inability to effectively compete could adversely and materially impact our financial condition and results of operations.

​

We operate in a competitive environment, competing for loans, deposits, and customers with commercial banks, savings associations and other financial entities. Competition for deposits comes primarily from other commercial banks, savings associations, credit unions, money market and mutual funds and other investment alternatives. Competition for loans comes primarily from other commercial banks, savings associations, mortgage banking firms, credit unions and other financial intermediaries. Competition for other products, such as securities products, comes from other banks, securities and brokerage companies, and other non-bank financial service providers in our market area. Many of these competitors are much larger in terms of total assets and capitalization, have greater access to capital markets, and/or offer a broader range of financial services than those that we offer. In addition, banks with a larger capitalization and financial intermediaries not subject to bank regulatory restrictions have larger lending limits and are thereby able to serve the needs of larger customers.

​

In addition, changes to the banking laws over the last several years have facilitated interstate branching, merger and expanded activities by banks and holding companies. For example, the federal Gramm-Leach-Bliley Act (the “GLB Act”) revised the BHC Act and repealed the affiliation provisions of the Glass-Steagall Act of 1933, which, taken together, limited the securities and other non-banking activities of any company that controls an FDIC insured financial institution. As a result, the ability of financial institutions to branch across state lines and the ability of these institutions to engage in previously-prohibited activities are now accepted elements of competition in the banking industry. These changes may bring us into competition with more and a wider array of institutions, which may reduce our ability to attract or retain customers. Management cannot predict the extent to which we will face such additional competition or the degree to which such competition will impact our financial conditions or results of operations.

​

The banking industry is heavily regulated; significant regulatory changes could adversely affect our operations.

​

Our operations will be impacted by current and future legislation and by the policies established from time to time by various federal and state regulatory authorities. The Corporation is subject to supervision by the FRB. The Bank is subject to supervision and periodic examination by the Maryland Office of Financial Regulation, the West Virginia Division of Banking, and the FDIC. Banking regulations, designed primarily for the safety of depositors, may limit a financial institution’s growth and the return to its investors by restricting such activities as the payment of dividends,

22

​

Table of Contents

​

mergers with or acquisitions by other institutions, investments, loans and interest rates, interest rates paid on deposits, expansion of branch offices, and the offering of securities or trust services. The Corporation and the Bank are also subject to capitalization guidelines established by federal law and could be subject to enforcement actions to the extent that either is found by regulatory examiners to be undercapitalized. It is not possible to predict what changes, if any, will be made to existing federal and state legislation and regulations or the effect that such changes may have on our future business and earnings prospects. Management also cannot predict the nature or the extent of the effect on our business and earnings of future fiscal or monetary policies, economic controls, or new federal or state legislation. Further, the cost of compliance with regulatory requirements may adversely affect our ability to operate profitably.

​

The Consumer Financial Protection Bureau may continue to reshape the consumer financial laws through rulemaking and enforcement of the prohibitions against unfair, deceptive and abusive business practices. Compliance with any such change may impact our business operations.

​

The Consumer Financial Protection Bureau (“CFPB”) has broad rulemaking authority to administer and carry out the provisions of the Dodd-Frank Act with respect to financial institutions that offer covered financial products and services to consumers. The CFPB has also been directed to adopt rules identifying practices or acts that are unfair, deceptive or abusive in connection with any transaction with a consumer for a consumer financial product or service, or the offering of a consumer financial product or service. The concept of what may be considered to be an “abusive” practice is fluid and can change based on politically-appointed leadership at the CFPB. We have been required to dedicate significant personnel resources to address the compliance burdens imposed by the CFBP’s adoption of various rules, and the adoption of additional rules in the future would likely require us to dedicate even more resources.

​

Compliance with ever-evolving federal and state laws relating to the handling of information about individuals involves significant expenditure and resources, and any failure by us or our vendors to comply may result in significant liability, negative publicity, and/or an erosion of trust, which could materially adversely affect our business, results of operations, and financial condition.

​

We are subject to a number of U.S. federal, state, local and foreign laws and regulations relating to consumer privacy and data protection. Under privacy protection provisions of the GLBA and its implementing regulations and guidance, we are limited in our ability to disclose certain non-public information about consumers to nonaffiliated third parties. The GLBA regulates, among other things, the use of certain information about individuals (“non-public personal information”) in the context of the provision of financial services, including by banks and other financial institutions. The GLBA includes both a “Privacy Rule”, which imposes obligations on financial institutions relating to the use or disclosure of non-public personal information, and a “Safeguards Rule”, which imposes obligations on financial institutions and, indirectly, their service providers to implement and maintain physical, administrative and technological measures to protect the security of non-public personal financial information. Any failure to comply with the GLBA could result in substantial financial penalties and significant reputational harm. Multiple states have recently enacted, or are expected to enact, stringent privacy laws, not all of which exempt financial institutions categorically. Many other states are currently reviewing or proposing the need for greater regulation of the collection, sharing, use and other processing of information related to individuals for marketing purposes or otherwise, and there remains increased interest at the federal level as well. Further, to comply with the varying state laws around data breaches, we must maintain adequate security measures, which require significant investments in resources and ongoing attention.

​

Additionally, laws, regulations, and standards covering marketing, advertising, and other activities conducted by telephone, email, mobile devices, and the internet are or may become applicable to our business, such as the Telephone Consumer Protection Act, the CAN-SPAM Act, and similar state consumer protection and communication privacy laws. We occasionally make telephone calls and/or send SMS text messages to customers. The actual or perceived improper calling of customer phones and/or sending of text messages may subject us to potential risks, including liabilities or claims relating to consumer protection laws such as the Telephone Consumer Protection Act. Numerous class-action suits under federal and state laws have been filed in recent years against companies who conduct telemarketing and/or SMS texting programs, with many resulting in multi-million-dollar settlements to the plaintiffs. Any future such litigation against us could be costly and time-consuming to defend. In particular, the Telephone Consumer Protection Act imposes significant

23

​

Table of Contents

​

restrictions on the ability to make telephone calls or send text messages to mobile telephone numbers without the prior consent of the person being contacted. Federal or state regulatory authorities or private litigants may claim that the notices and disclosures we provide, form of consents we obtain, or our outreach practices are not adequate or violate applicable law. This may in the future result in civil claims against us. Claims that we have violated the Telephone Consumer Protection Act could be costly to litigate, whether or not they have merit, and could expose us to substantial statutory damages or costly settlements.

​

We also send marketing messages via email and are subject to the CAN-SPAM Act. The CAN-SPAM Act imposes certain obligations regarding the content of emails and providing opt-outs (with the corresponding requirement to honor such opt-outs promptly). While we strive to ensure that all of our marketing communications comply with the requirements set forth in the CAN-SPAM Act, any violations could result in the FTC seeking civil penalties against us.

​

Moreover, we are considered a “user” of consumer reports provided by consumer reporting agencies under the Fair Credit Reporting Act (“FCRA”), as amended by the Fair and Accurate Credit Transactions Act. FCRA regulates and protects consumer information collected by consumer reporting agencies and imposes specific obligations on “users” of consumer reports. Such obligations may include restricting the sharing of information contained in a consumer report, notifying consumers when such reports are used to make an adverse decision, and, in the context of completing employee background checks, providing a notice containing certain disclosures to the consumer and obtaining their consent.

​

Bank regulators and other regulations, including the Basel III Capital Rules, may require higher capital levels, impacting our ability to pay dividends or repurchase our stock.

​

The capital standards to which we are subject, including the standards created by the Basel III Capital Rules, may materially limit our ability to use our capital resources and/or could require us to raise additional capital by issuing additional shares of Common Stock or other equity securities. In addition, we could experience increases in deposits and assets as a result of other depository institutions’ difficulties or failures, which would increase the capital that we are required to maintain to support such growth. The issuance of additional equity securities to fund our capital needs could dilute existing stockholders.

​

A material weakness in our disclosure or internal controls could have an adverse effect on us.

​

The Corporation is required by the Sarbanes-Oxley Act of 2002 to establish and maintain disclosure controls and procedures and internal control over financial reporting. These control systems are intended to provide reasonable assurance that material information relating to the Corporation is made known to our management and reported as required by the Exchange Act, to provide reasonable assurance regarding the reliability and preparation of our financial statements, and to provide reasonable assurance that fraud and other unauthorized uses of our assets are detected and prevented. We may not be able to maintain controls and procedures that are effective at the reasonable assurance level. If that were to happen, our ability to provide timely and accurate information about the Corporation, including financial information, to investors could be compromised and our results of operations could be harmed. Moreover, if the Corporation or its independent registered public accounting firm were to identify a material weakness in any of those control systems, our reputation could be harmed and investors could lose confidence in us, which could cause the market price of the Corporation’s stock to decline and/or limit the trading market for the shares of the Common Stock.

​

We may not be able to keep pace with developments in technology.

​

We use various technologies in conducting our businesses, including telecommunication, data processing, computers, automation, internet-based banking, and debit cards. The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. Our future success depends, in part, on our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology driven products and services or be successful in marketing these products and services to our customers.

24

​

Table of Contents

​

In addition, our implementation of certain new technologies, such as those related to artificial intelligence, automation and algorithms, in our business processes may have unintended consequences due to their limitations or our failure to use them effectively. In addition, cloud technologies are also critical to the operation of our systems, and our reliance on cloud technologies is growing. Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse effect on our business, financial condition and results of operations.

​

Our operational or communications systems or infrastructure may fail or may be the subject of a breach or cyber-attack that, if successful, could adversely affect our business or disrupt business continuity.

​

Our business depends heavily on the use of computer systems, the Internet and other means of electronic communication and recordkeeping to process, record, and monitor client transactions and to communicate with clients and other institutions on a continuous basis. As client, industry, public, and regulatory expectations regarding operational and information security have increased, our operational systems and infrastructure continue to be safeguarded and monitored for potential failures, disruptions, and breakdowns, whether as a result of events beyond our control or otherwise.

​

Our business, financial, accounting, data processing, or other operating systems and facilities may stop operating properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control. For example, there could be sudden increases in client transaction volume; electrical or telecommunications outages; natural disasters such as earthquakes, tornadoes, floods, and hurricanes; disease pandemics; events arising from local or larger scale political or social matters, including terrorist acts; occurrences of employee error, fraud, theft, or malfeasance; disruptions caused by technology implementation, including hardware deployment and software updates; and, as described below, cyber-attacks.

​

Although we have business continuity plans and other safeguards in place, our operations and communications may be adversely affected by significant and widespread disruption to our systems and infrastructure that support our businesses, clients, and teammates. While we continue to evolve and modify our business continuity plans, there can be no assurance in an escalating threat environment that they will be effective in avoiding disruption and business impacts. Our insurance may not be adequate to compensate us for all resulting losses, and the cost to obtain adequate coverage may increase for us or the industry.

​

Security risks for financial institutions such as ours have dramatically increased in recent years in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication, resources, and activities of hackers, terrorists, activists, industrial spies, insider bad actors, organized crime, and other external parties, including nation state actors. In addition, to access our products and services, clients may use devices and/or software that are beyond our control environment, which may provide additional avenues for attackers to gain access to confidential information. Although we have information security procedures and controls in place, our technologies, systems, networks, and clients' devices and software may become the target of cyber-attacks, information security breaches, business email compromise, or information theft that could result in the unauthorized release, gathering, monitoring, misuse, loss, change, or destruction of our or our clients' or teammates' confidential, proprietary, or other information (including personal identifying information of individuals), or otherwise disrupt our or our clients' or our third parties' business operations. U.S. financial institutions and financial service companies have reported breaches in the security of their websites or other systems, including attempts to shut down access to their networks and/or systems in an attempt to extract compensation from them to regain control. Financial institutions, including the Bank, have experienced distributed denial-of-service attacks, a sophisticated and targeted attack intended to disable or degrade internet service or to sabotage systems.

​

We and others in our industry are regularly the subject of attempts by attackers to gain unauthorized access to our networks, systems, and data, or to obtain, change, or destroy confidential data (including personal identifying information of individuals) through a variety of means, including computer viruses, malware, business email compromise, and phishing. These attacks may result in unauthorized individuals obtaining access to our confidential information or that of our clients or teammates, or otherwise accessing, compromising, damaging, or disrupting our systems or infrastructure.

​

25

​

Table of Contents

​

We are continuously developing and enhancing our controls, processes, and practices designed to protect our systems, computers, software, data, and networks from attack, damage, or unauthorized access. This continued development and enhancement will require us to expend additional resources, including resources to investigate and remediate any information security vulnerabilities that may be detected. Despite our ongoing investments in security resources, talent, and business practices, we are unable to assure that any security measures will be effective.

​

If our systems and infrastructure were to be breached, compromised, damaged, or disrupted, or if we were to experience a loss of our confidential information or that of our clients or teammates, we could be subject to serious negative consequences, including disruption of our operations, damage to our reputation, a loss of trust in us on the part of our clients, vendors or other counterparties, client or teammate attrition, reimbursement or other costs, increased compliance costs, significant litigation exposure and legal liability, or regulatory fines, penalties or intervention. Any of these could materially and adversely affect our results of operations, our financial condition, and/or our share price.

​

A disruption, breach, or failure in the operational systems or infrastructure of our third-party vendors or other service providers, including as a result of cyber-attacks, could adversely affect our business.

​

Third parties perform significant operational services on our behalf. These third parties with whom we do business or that facilitate our business activities, including exchanges, clearing houses, central clearing counterparties, financial intermediaries, or vendors that provide services or security solutions for our operations, could also be sources of operational and information security risk to us, including from breakdowns or failures of their own systems or capacity constraints. In particular, operating our business requires us to provide access to client, teammate, and other sensitive Company information to our contractors, consultants, and other third parties and authorized entities. Controls and oversight mechanisms are in place that are designed to limit access to this information and protect it from unauthorized disclosure, theft, and disruption. However, control systems and policies pertaining to system access are subject to errors in design, oversight failure, software failure, human error, intentional subversion, or other compromise resulting in theft, error, loss, or inappropriate use of information or systems to commit fraud, cause embarrassment to us or our executives or to gain competitive advantage. In addition, regulators expect financial institutions to be responsible for all aspects of their performance, including aspects which they delegate to third parties. If a disruption, breach, or failure in the system or infrastructure of any third party with whom we do business occurred, then our business may be materially and adversely affected in a manner similar to if our own systems or infrastructure had been compromised. As has been the case in other major system events in the U.S., our systems and infrastructure may also be attacked, compromised, or damaged as a result of, or as the intended target of, any disruption, breach, or failure in the systems or infrastructure of any third party with whom we do business.

​

We may be subject to claims and the costs of defensive actions, and such claims and costs could materially and adversely impact our financial condition and results of operations.

​

Our customers may sue us for losses due to alleged breaches of fiduciary duties, errors and omissions of employees, officers and agents, incomplete documentation, our failure to comply with applicable laws and regulations, or many other reasons. Also, our employees may knowingly or unknowingly violate laws and regulations. Management may not be aware of any violations until after their occurrence. This lack of knowledge may not insulate us from liability. Claims and legal actions will result in legal expenses and could subject us to liabilities that may reduce our profitability and hurt our financial condition.

​

The loss of key personnel could disrupt our operations and result in reduced earnings.

​

Our growth and profitability will depend upon our ability to attract and retain skilled managerial, marketing and technical personnel. Competition for qualified personnel in the financial services industry is intense, and there can be no assurance that we will be successful in attracting and retaining such personnel. Our current executive officers provide valuable services based on their many years of experience and in-depth knowledge of the banking industry and the market areas we serve. Due to the intense competition for financial professionals, these key personnel would be difficult to

26

​

Table of Contents

​

replace, and an unexpected loss of their services could result in a disruption to the continuity of operations and a possible reduction in earnings.

​

We are a community banking organization and our ability to maintain our reputation is critical to the success of our business.

​

We are a community banking organization, and our reputation is one of the most valuable components of our business. A key component of our business strategy is to rely on our reputation for customer service and knowledge of local markets to expand our presence by capturing new business opportunities from existing and prospective customers in our current market and contiguous areas. As such, we strive to conduct our business in a manner that enhances our reputation. This is done, in part, by recruiting, hiring and retaining employees who share our core values of being an integral part of the communities we serve, delivering superior service to our customers and caring about our customers and associates. If our reputation is negatively affected by the actions of our employees, by our inability to conduct our operations in a manner that is appealing to current or prospective customers, or otherwise, our business and, therefore, our operating results may be materially adversely affected.

​

We could be adversely affected by risks associated with future acquisitions and expansions.

​

Although our core growth strategy is focused around organic growth, we may from time to time consider acquisition and expansion opportunities involving a bank or other entity operating in the financial services industry. We cannot predict if or when we will engage in such a strategic transaction, or the nature or terms of any such transaction. To the extent that we grow through an acquisition, we cannot assure investors that we will be able to adequately and profitably manage that growth or that an acquired business will be integrated into our existing businesses as efficiently or as timely as we may anticipate. Acquiring another business would generally involve risks commonly associated with acquisitions, including:

​

● increased capital needs;

● increased and new regulatory and compliance requirements;

● transition of the acquired business’s users and customers onto our systems;

● retention of employees from the acquired business;

● integration of employees from the acquired business into our organization;

● potential goodwill impairment.

​

Our failure to execute our acquisition strategy could adversely affect our business, results of operations, financial condition and future prospects risks of unknown or contingent liabilities.

​

New lines of business, products or services may subject us to additional risks.

​

From time to time, we implement new lines of business or offer new products and services within existing lines of business. There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and/or new products and services we

27

​

Table of Contents

​

invest significant time and resources. Initial timetables for the introduction and development of new lines of business and/or new products or services may not be achieved, and price and profitability targets may not prove feasible. External factors, such as compliance with regulations, competitive alternatives, and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service. Furthermore, any new line of business, new product or service and/or new technology could have a significant impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business, new products or services and/or new technologies could have a material adverse effect on our business, financial condition and results of operations.

​

Increasing scrutiny and evolving expectations from customers, regulators, investors, and other stakeholders with respect to our sustainability practices may impose additional costs on us or expose us to new or additional risks.

​

Many companies are facing increasing scrutiny from customers, regulators, investors, and other stakeholders related to their sustainability practices and disclosure. Investor advocacy groups, investment funds and influential investors are also increasingly focused on these practices, especially as they relate to the environment, health and safety, diversity, labor conditions and human rights. Increased sustainability-related compliance costs could result in increases to our overall operational costs. Failure to adapt to or comply with regulatory requirements or investor or stakeholder expectations and standards could negatively impact our reputation, ability to do business with certain partners, and our stock price. New government regulations could also result in new or more stringent forms of sustainability oversight and expanding mandatory and voluntary reporting, diligence, and disclosure. Due to divergent stakeholder views on these matters, we are at increased risk that any action, or lack thereof, concerning these matters will be perceived negatively by some stakeholders, which could negatively affect our business and reputation.

​

Risks Relating to First United Corporation’s Securities

​

The shares of Common Stock are not insured.

​

The shares of the Common Stock are not deposits and are not insured against loss by the FDIC or any other governmental or private agency.

​

The shares of Common Stock are not heavily traded.

​

Shares of the Common Stock are listed on the NASDAQ Global Select Market but are not heavily traded. Securities that are not heavily traded can be more volatile than stock trading in an active public market. Factors such as our financial results, the introduction of new products and services by us or our competitors, changes in the financial estimates by securities analysts, market conditions within the banking industry, the general state of the securities market, general economic condition, and investor speculation as to our future plans and strategies could have a significant impact on the market price and trading volume of the shares of Common Stock. Likewise, events that are unrelated to the Corporation but that affect the equity markets generally, such as national or international health crises, wars, political instability, the loss of investor or depositor confidence due to the failure of one or more financial institutions, and similar factors, could also have a significant impact on the market price and trading volume of the shares of Common Stock. Management cannot predict the extent to which an active public market for shares of Common Stock will develop or be sustained in the future. Accordingly, shareholders may not be able to sell their shares at the volumes, prices, or times that they desire.

​

Significant sales of shares of Common Stock, or the perception that significant sales may occur in the future, could adversely affect the market price of shares of Common Stock.

The sale of a substantial number of shares of the Common Stock could adversely affect the market price of such shares. The availability of shares for future sale could adversely affect the prevailing market price of shares of Common Stock and could cause the market price of such shares to remain low for a substantial amount of time. In addition, the Corporation may grant equity awards under its equity compensation plans from time to time in effect, including fully-

28

​

Table of Contents

​

vested shares of Common Stock. It is possible that if a significant percentage of such available shares were attempted to be sold within a short period of time, the market for the shares would be adversely affected. Management cannot predict whether the market for shares of Common Stock could absorb a large number of attempted sales in a short period of time, regardless of the price at which they might be offered. Even if a substantial number of sales do not occur within a short period of time, the mere existence of this “market overhang” could have a negative impact on the market for the common stock and our ability to raise capital in the future.

​

The Corporation’s ability to pay dividends on the common stock is subject to the terms of the outstanding TPS Debentures, which prohibit the Corporation from paying dividends during an interest deferral period.

​

In March 2004, the Corporation issued approximately $30.9 million, in the aggregate, of junior subordinated debentures (“TPS Debentures”) to the Trusts in connection with the Trusts’ sales to third party investors of $30.0 million, in the aggregate, in mandatorily redeemable preferred capital securities. The terms of the TPS Debentures require the Corporation to make quarterly payments of interest to the Trusts, as the holders of the TPS Debentures, although the Corporation has the right to defer payments of interest for up to 20 consecutive quarterly periods, and the Corporation has exercised this deferral right in the past. An election to defer interest payments does not constitute an event of default under the terms of the TPS Debentures. The terms of the TPS Debentures prohibit the Corporation from declaring or paying any dividends or making other distributions on, or from repurchasing, redeeming or otherwise acquiring, any shares of its capital securities, including the common stock, if the Corporation elects to defer quarterly interest payments under the TPS Debentures. In addition, a deferral election will require the Trusts to likewise defer the payment of quarterly dividends on their related trust preferred securities.

​

Applicable banking and Maryland laws impose additional restrictions on the ability of the Corporation and the Bank to pay dividends and make other distributions on their capital securities, and, in any event, the payment of dividends is at the discretion of the boards of directors of the Corporation and the Bank.

​

In the past, the Corporation has funded dividends on its capital securities using cash received from the Bank, and this will likely be the case for the foreseeable future. No assurance can be given that the Bank will be able to pay dividends to the Corporation for these purposes at times and/or in amounts requested by the Corporation. Both federal and state laws impose restrictions on the ability of the Bank to pay dividends. Under Maryland law, a state-chartered commercial bank may pay dividends only out of undivided profits or, with the prior approval of the Maryland Commissioner, from surplus in excess of 100% of required capital stock. If, however, the surplus of a Maryland bank is less than 100% of its required capital stock, cash dividends may not be paid in excess of 90% of net earnings. In addition to these specific restrictions, bank regulatory agencies have the ability to prohibit proposed dividends by a financial institution which would otherwise be permitted under applicable regulations if the regulatory body determines that such distribution would constitute an unsafe or unsound practice. Banks that are considered “troubled institution” are prohibited by federal law from paying dividends altogether. Notwithstanding the foregoing, shareholders must understand that the declaration and payment of dividends and the amounts thereof are at the discretion of the Corporation’s Board of Directors. Thus, even at times when the Corporation is not prohibited from paying cash dividends on its capital securities, neither the payment of such dividends nor the amounts thereof can be guaranteed.

​

The Corporation’s charter and bylaws and Maryland law may discourage a corporate takeover.

​

The Corporation’s charter and its bylaws (the “Bylaws”) contain certain provisions designed to enhance the ability of the Corporation’s Board of Directors to deal with attempts to acquire control of the Corporation. First, the Board of Directors is a declassified board structure. Each director serves for a one-year term, and no director may be removed except for cause, and then only by the affirmative vote of either a majority of the entire Board of Directors or a majority of the outstanding voting stock. Second, the Board has the authority to classify and reclassify unissued shares of stock of any class or series of stock by setting, fixing, eliminating, or altering in any one or more respects the preferences, rights, voting powers, restrictions and qualifications of, dividends on, and redemption, conversion, exchange, and other rights of, such securities. The Board could use this authority, along with its authority to authorize the issuance of securities of any class or series, to issue shares having terms favorable to management or to a person or persons affiliated with or otherwise

29

​

Table of Contents

​

friendly to management. In addition, the Bylaws require any shareholder who desires to nominate a director to abide by strict notice requirements.

​

Maryland laws include provisions that could discourage a sale or takeover of the Corporation. The Maryland Business Combination Act generally prohibits, subject to certain limited exceptions, corporations from being involved in any “business combination” (defined as a variety of transactions, including a merger, consolidation, share exchange, asset transfer or issuance or reclassification of equity securities) with any “interested shareholder” for a period of five years following the most recent date on which the interested shareholder became an interested shareholder. An interested shareholder is defined generally as a person who is the beneficial owner of 10% or more of the voting power of the outstanding voting stock of the corporation after the date on which the corporation had 100 or more beneficial owners of its stock or who is an affiliate or associate of the corporation and was the beneficial owner, directly or indirectly, of 10% percent or more of the voting power of the then outstanding stock of the corporation at any time within the two-year period immediately prior to the date in question and after the date on which the corporation had 100 or more beneficial owners of its stock. The Maryland Control Share Acquisition Act applies to acquisitions of “control shares”, which, subject to certain exceptions, are shares the acquisition of which entitle the holder, directly or indirectly, to exercise or direct the exercise of the voting power of shares of stock of the corporation in the election of directors within any of the following ranges of voting power: one-tenth or more, but less than one-third of all voting power; one-third or more, but less than a majority of all voting power or a majority or more of all voting power. Control shares have limited voting rights. Maryland banking laws provide that the Maryland Commissioner must approve certain acquisitions of the common stock of the Corporation and/or the Bank, and these laws impose penalties on persons who effect such acquisitions without approval, including a five-year voting prohibition.

​

Although these provisions do not preclude a sale or takeover, they may have the effect of discouraging, delaying or deferring a sale, tender offer, or takeover attempt that a shareholder might consider in his or her best interest, including those attempts that might result in a premium over the market price for the common stock. Such provisions will also render the removal of the Board of Directors and of management more difficult and, therefore, may serve to perpetuate current management. These provisions could potentially adversely affect the market prices of the Corporation’s securities.

​

​

ITEM 1B. UNRESOLVED STAFF COMMENTS

None.

​

ITEM 1C. CYBERSECURITY

Risk Management Strategy

Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Corporation, including financial, operational, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Cyber Security Initiative (“CSI”) committee led by our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management committee. The Information Security Officer reports directly to the Managing Director of Operations and, as discussed below, regularly to the Risk and Compliance Committee of our board of directors.

Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the Cyber Risk Institute’s cybersecurity profile designed specifically for the financial services industry, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer, along with key members of our risk management committee, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The

30

​

Table of Contents

​

information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

We employ an in-depth, layered, defensive strategy that embraces a “never trust, always verify” philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employe a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts, external penetration testers, and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We have optimized our vulnerability management program that scans devices every four hours, and we have strict key performance metrics to ensure vulnerabilities are remediated quickly. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and the Risk and Compliance Committee of our board of directors. The Incident Response Plan is coordinated through the Chief Operating Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our Company. For further discussion of risks from cybersecurity threats, see the section captioned “A disruption, breach, or failure in the operational systems or infrastructure of our third-party vendors or other service providers, including as a result of cyber-attacks, could adversely affect our business” in Item 1A. Risk Factors.

Governance

Our Information Security Officer and Director of Information Technology is accountable for managing our enterprise information security processes and procedures and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, incident response and business resilience, vulnerability assessment, threat intelligence, identity access governance, enterprise risk management, and third-party risk management. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the CSI Committee, provides guidance, oversight, monitoring, and challenge of the first line’s activities. The Committee as a whole, consists of information security professionals with varying degrees of education and experience as well as information technology professionals, and audit and fraud professionals. Individuals within the Committee are generally subject to professional education and certification requirements. In particular, our Information Security Officer has the necessary relevant expertise and formal training in the areas of information security and cybersecurity risk management.

Our board of directors has approved management committees including the CSI Committee, which focuses on technology impact, and the Risk Management Committee, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. There are also three technology steering committees that plan and guide technology projects in alignment with the Corporation’s strategic plan.

31

​

Table of Contents

​

These committees are chaired by managers and experts within the Corporation and include the Chief Operating Officer, as well as his direct reports and other key departmental managers from throughout the entire company. These committees meet regularly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation to facilitate timely information and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Risk and Compliance Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).