JMSB · Read the filing

John Marshall Bancorp, Inc._December 31, 2024

Table of Contents

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

☒ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended December 31, 2024

☐TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

Commission file number: 001-41315

John Marshall Bancorp, Inc.

(Exact Name of Registrant as Specified in its Charter)

1943 Isaac Newton Square

Suite 100

Reston, VA20190

(Address of Principal Executive Offices)

(703) 584-0840

(Registrant’s telephone number)

Securities registered pursuant to Section 12(b) of the Act:

Title of Each Class Trading Symbol Name of Exchange on Which Registered

Common Stock, $0.01 par value per share JMSB The Nasdaq Stock Market LLC

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☐No☒

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐No☒

Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes☒ No ☐

Indicate by check mark whether the registrant has submitted electronically; every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.0405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer ☐ Accelerated filer ☐

Non-accelerated filer ☒ Smaller reporting company ☒

Emerging growth company ☒

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☒

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report.☐

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b).☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

Based on the closing price as reported on The Nasdaq Stock Market, LLC, the aggregate market value of the Registrant's Common Stock held by non-affiliates on June 28, 2024 (the last business day of the Registrant's most recently completed second fiscal quarter) was approximately $217.7 million. Shares of Common Stock held by each executive officer and director and by each shareholder affiliated with a director or an executive officer have been excluded from this calculation because such persons may be deemed to be affiliates. This determination of affiliate status is not necessarily a conclusive determination for other purposes. The number of outstanding shares of the Registrant's Common Stock as of February 28, 2025 was 14,275,442.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the registrant’s definitive proxy statement to be used in conjunction with the registrant’s 2025 Annual Meeting of Stockholders are incorporated by reference into Part III of this Form 10-K.

Table of Contents

TABLE OF CONTENTS

Page

Part I

Item 1. Business 4

Item 1A. Risk Factors 23

Item 1B. Unresolved Staff Comments 40

Item 1C. Cybersecurity 40

Item 2. Properties 43

Item 3. Legal Proceedings 43

Item 4. Mine Safety Disclosures 43

Part II

Item 6. [Reserved] 44

Item 7A. Quantitative and Qualitative Disclosures About Market Risk 61

Item 8. Financial Statements and Supplementary Data 62

Item 9A. Controls and Procedures 108

Item 9B. Other Information 108

Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspection 108

Part III

Item 10. Directors, Executive Officers and Corporate Governance 108

Item 11. Executive Compensation 109

Item 14. Principal Accountant Fees and Services 109

Part IV

Item 15. Exhibits and Financial Statement Schedules 109

Table of Contents

CAUTIONARY NOTE REGARDING FORWARD-LOOKING STATEMENTS

In addition to historical information, this Form 10-K of John Marshall Bancorp, Inc. (the “Company”) contains forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995 that are based on certain assumptions and describe future plans, strategies and expectations of the Company. These forward-looking statements are generally identified by use of the words “believe,” “expect,” “intend,” “anticipate,” “estimate,” “project,” “will,” “should,” “may,” “view,” “opportunity,” “potential,” or similar expressions. Our ability to predict results or the actual effect of future plans or strategies is inherently uncertain. These forward-looking statements are based on our beliefs and assumptions and on the information available to us at the time that these disclosures were prepared, and involve known and unknown risks, uncertainties and other factors that may cause our actual results to differ materially from any future results expressed or implied by such forward-looking statements. Although we believe the expectations reflected in such forward-looking statements are reasonable, we can give no assurance such expectations will prove to have been correct. Should any known or unknown risks and uncertainties develop into actual events, those developments could have material adverse effects on our business, financial condition and results of operations. Factors that could have an adverse effect on the operations of the Company and its wholly-owned subsidiary, John Marshall Bank (the “Bank”), include, but are not limited to, the following:

• deterioration of our asset quality;

• the level of prepayments on loans and mortgage-backed securities;

• liquidity, interest rate and operational risks associated with our business;

• changes in consumer spending, borrowing and savings habits;

• increased competition with other financial institutions and fintech companies;

• adverse changes in the securities markets;

• our ability to maintain an effective risk management framework;

• compliance with legislative or regulatory requirements;

• technological risks and developments, and cyber threats, attacks, or events;

Table of Contents

• changes in accounting policies and practices;

• our ability to successfully capitalize on growth opportunities;

• our ability to retain key employees;

• other factors discussed in Item 1A. Risk Factors in this Form 10-K.

These risks and uncertainties should be considered in evaluating forward-looking statements and undue reliance should not be placed on such statements. We do not undertake, and specifically disclaim any obligation, to publicly release the result of any revisions which may be made to any forward-looking statements to reflect events or circumstances after the date of such statements or to reflect the occurrence of anticipated or unanticipated events. All written or oral forward-looking statements attributable to us are expressly qualified in their entirety by this cautionary note.

Table of Contents

Part I

Item 1.Business

General Overview

John Marshall Bancorp, Inc. was organized as a Virginia corporation in 2016 to serve as the holding company for John Marshall Bank. The Company and the Bank are each headquartered in Reston, Virginia (approximately 20 miles west of Washington, D.C.). The Company commenced operations as a bank holding company on March 1, 2017 following a reorganization transaction in which it became the Bank’s holding company. This transaction was treated as an internal reorganization as all shareholders of the Bank became shareholders of the Company. As a bank holding company, the Company is subject to regulation and supervision by the Federal Reserve. The Company has no material operations other than its sole ownership of the Bank. The Bank is a Virginia chartered commercial bank that commenced operations in 2006. The Bank is supervised and regulated by the Federal Reserve and the Bureau of Financial Institutions of the Virginia State Corporation Commission (the “Virginia BFI”).

We primarily serve small to medium-sized businesses, their owners and employees, professional corporations, non-profits and individuals with a broad range of banking products and financial services. Some of the products and services that we offer include commercial checking, savings and money market accounts, certificates of deposit, treasury and cash management services, commercial and industrial loans, commercial real estate loans, residential and commercial construction and development loans, online banking, and mobile banking. As of December 31, 2024, we had total consolidated assets of $2.23 billion, gross loans of $1.87 billion, total deposits of $1.89 billion and total shareholders’ equity of $246.6 million.

Market Area

A key factor in our ability to achieve our strategic goals and create shareholder value is the attractiveness of our market area. The market area in which we operate has seen considerable population and economic growth over the past several decades. The most recent economic data suggest that the relative economic strength of our market area will continue, enabling us to grow our customer base and find opportunities to grow our market share.

The Bank’s primary service area includes Arlington, Fairfax, Loudoun and Prince William counties in Virginia, Montgomery County in Maryland and the District of Columbia. The Bank has eight full service branch offices located in these contiguous cities or counties.

Our primary service area comprises the majority of the population and household income of the Washington-Arlington-Alexandria, DC-VA-MD-WV (“Washington, D.C.”) Metropolitan Statistical Area (“MSA”). The Washington, D.C. MSA, according to U.S. Bureau of Economic Analysis data, ranked sixth among all MSAs for 2023 gross domestic product. According to data sourced from S&P Global Market Intelligence, among the largest MSAs ranked by gross domestic product (Chicago, Dallas, Los Angeles, New York, Houston, and Atlanta), the Washington D.C. MSA ranked second for 2024 median household income at $118,391, second in 2024 to 2029 projected population growth at 2.7% and first in the percentage of inhabitants 25 or older with a bachelor’s degree or higher educational attainment at 54.5%. According to the U.S. Bureau of Labor Statistics, the Washington, D.C. MSA’s December 2024 unemployment rate was 2.8%, the lowest among the aforementioned MSAs.

Based upon Federal Deposit Insurance Corporation (the “FDIC”) data as of June 30, 2024, the Washington D.C. MSA housed $292 billion of deposits, with the top five financial institutions controlling 66.7%. At June 30, 2024, our deposits were $1.92 billion, ranked 18th in the MSA and represented a 0.7% market share. Ten of the seventeen banks ranked ahead of the Company are headquartered outside of the Washington, D.C. MSA. Our market area has experienced a significant degree of banking consolidation over the last several decades. Since the Company’s inception, banking assets in excess of $55 billion have been acquired. We believe that as financial institutions are merged with or acquired by remote, larger institutions, their customers can become further removed from the point of decision making. The consolidation trend provides an opportunity for the Company to execute a focused strategy of offering personalized services to attract potential customers who are underserved or dissatisfied.

Table of Contents

Given the Company’s proximity to Washington, D.C., the federal government has contributed to the growth and generally played a stabilizing role in our market area’s economy. In recent years, local governments have made great strides in diversifying their local economies. Virginia Tech selected the City of Alexandria as the site for its innovation campus which aims to graduate 25,000 new bachelor’s and master’s students in computer science and related fields over the next 20 years. The innovation campus opened February 28, 2025. The $1 billion, 600,000 square foot campus will confer over 600 graduate degrees annually and provide talent to spur further technological growth. By 2030, Amazon’s headquarters in Arlington County is expected to occupy at least 4 million square feet of office space. Phase one of Amazon’s HQ2 was completed in the spring 2023. Amazon will invest more than $2 billion to establish its new headquarters, which will create at least 25,000 high-wage jobs by 2030. Fairfax County is home to ten Fortune 500 company headquarters and 17 Fortune 1000 company headquarters. Loudoun County is known as “data center alley” as it has the world’s highest concentration of data centers with more than 30 million square feet of data center space. Loudoun County is home to more than 3,500 technology companies. Prince William County has partnered with George Mason University to found the Prince William Science Accelerator, a fast-growing biotechnology cluster to foster the study of life sciences.

We believe the size, growth, economic diversity and banking consolidation within the Washington, D.C. MSA, when combined with our business strategy, provide us with excellent opportunities for long-term, sustainable growth.

Strengths

We believe that we are well-positioned to execute our banking strategy as a result of our competitive strengths:

Table of Contents

Business Strategy

The Company’s goal is to enhance its franchise and shareholder value by achieving significant growth in assets and profitability while maintaining strong asset quality and providing exceptional customer experiences. We embrace innovation and provide value-added solutions our customers need and expect. We intend to execute on this goal by focusing on the following objectives:

Table of Contents

Competition

The banking business is highly competitive, and we face competition in our market area from many other local, regional, and national financial institutions. Competition among financial institutions is based on interest rates offered on deposit accounts, interest rates charged on loans, other credit and service charges relating to loans, the quality and scope of the services rendered, the convenience of banking services, and, in the case of loans to commercial borrowers, relative lending limits. We compete with commercial banks, credit unions, savings institutions, mortgage banking firms, finance companies, including “fintech” companies, securities brokerage firms, insurance companies, money market funds and other mutual funds, as well as regional and national financial institutions that operate offices in our market area and elsewhere. The competing major commercial banks have greater resources that may provide them a competitive advantage by enabling them to maintain numerous branch offices, mount extensive advertising campaigns and invest in new technologies. The increasingly competitive environment is the result of changes in regulation, changes in technology and product delivery systems, additional financial service providers, and the accelerating pace of consolidation among financial services providers.

The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. Banks, securities firms and insurance companies can merge under the umbrella of a financial holding company, which can offer most types of financial services, including banking, securities underwriting and insurance. Also, technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems.

Some of our non-banking competitors, such as fintech companies, have fewer regulatory constraints and may have lower cost structures. In addition, some of our competitors have assets, capital and lending limits greater than that of the Bank, have greater access to capital markets and can offer a broader range of products and services than the Bank. These institutions may have the ability to finance wide-ranging advertising campaigns and may also be able to offer lower rates on loans and higher rates on deposits than we can offer.

We compete with these institutions by focusing on our position as an independent, commercial business bank and rely upon relationships established by our officers, directors, and employees with our customers, promotional activities and specialized services tailored to meet the needs of the customers we serve. We strive to provide innovative products to our

Table of Contents

customers that are value-driven. We actively cultivate relationships with our customers that extend beyond a single loan to a full suite of products that serve the needs of our commercial customers. Our goal is to develop long-standing connections with our customers and the communities that we serve. Our management believes that we can compete effectively as a result of local market knowledge, local decision making, awareness of customer needs, and by providing exceptional customer experiences.

Our Products and Services

We emphasize providing commercial banking services. Our dedicated relationship managers serve as direct points of contact for owners, management and employees of small and medium-sized businesses. We provide subject matter expertise in a variety of niche industries including charter and private schools, government contractors, health services, nonprofits and associations, professional services, property management companies, and title companies. We focus on customers living and working in and near our service area. We offer retail banking services to accommodate the needs of both corporate customers as well as individuals residing and working in the communities we serve. We also offer online banking, mobile banking and a remote deposit service, which allows customers to facilitate and expedite deposit transactions through the use of electronic devices. A sophisticated suite of treasury management products is a key feature of our customer focused, relationship driven marketing. We have partnered with experienced service providers in both insurance and merchant services to further augment the products available to our customers.

Lending Services

We provide a range of commercial lending services, including commercial real estate loans, residential and commercial construction and development loans, commercial and industrial loans, and residential mortgage loans to customers generally located or conducting business in our market area. Loan terms, including interest rates, loan-to-value ratios, and maturities, are tailored as much as possible to meet the needs of the borrower. A special effort is made to keep loan products as flexible as possible within the guidelines of prudent banking practices in terms of interest rate risk and credit risk.

When considering loan requests, the primary factors taken into consideration are the cash flow and financial condition of the borrower, the value of the underlying collateral, if applicable, and the character and integrity of the borrower. These factors are evaluated in a number of ways including an analysis of financial statements, credit reviews, trade reviews, and visits to the borrower’s place of business. We have implemented comprehensive loan policies and procedures to provide our loan officers with term, collateral, loan-to-value and pricing guidelines. The policy and sound credit analysis, together with independent, third-party loan review, have resulted in a profitable loan portfolio with minimal delinquencies or problem loans.

Our lending activities are subject to risks, with the most significant risks associated with higher credit risk related to our commercial and real estate lending focus, a high concentration of loans to a small number of borrowers, and lack of seasoning in the portfolio.

Commercial business and commercial real estate loans may involve relatively large loan balances to individual or groups of related borrowers. The repayment of commercial business and commercial real estate loans depends on the successful management and operation of the borrower’s business or properties. The creditworthiness of a borrower is affected by many outside factors, including local market conditions and general economic conditions. If the overall economic climate in the United States, generally, or our market area, specifically, experiences material disruption, our borrowers may experience difficulties in repaying their loans, the collateral we hold may decrease or fluctuate in value, or become illiquid or more difficult to appraise, and the level of nonperforming loans, charge-offs and delinquencies could rise and require additional provisions for credit losses.

Our 10 largest borrowing relationships account for approximately 9.3% of our loans as of December 31, 2024. With this concentration of credit risk among a limited number of borrowers, we may face a greater risk of material credit losses if any one or several of these borrowers fail to perform in accordance with their loans, compared to a bank with a more diversified loan portfolio.

In addition, approximately 48.1% of the loans in our loan portfolio were first originated during the past three years. While we believe our underwriting standards are designed to manage normal lending risks, it is difficult to assess the future

Table of Contents

performance of our loan portfolio due to the recent origination of many of our loans. As a result, it is difficult to determine whether these loans will become non-performing or delinquent, or whether we will hold non-performing or delinquent loans that may adversely affect our future performance.

Refer to the Loan Portfolio section within Item 7 – Management’s Discussion and Analysis of Financial Condition and Results of Operations for further information regarding the composition of our loan portfolio as of December 31, 2024 and 2023.

Our aim is to build and maintain a commercial loan portfolio consisting of term loans, demand loans, lines of credit and commercial real estate loans provided to primarily locally-based borrowers. These types of loans are generally considered to have a higher degree of risk of default or loss than other types of loans, such as well underwritten, prime residential real estate loans, because repayment may be affected by general economic conditions, interest rates, the quality of management of the business and other factors which may cause a borrower to be unable to repay its obligations. Traditional installment loans and personal lines of credit are available on a selective basis. General economic conditions can directly affect the quality of a small and mid-sized business loan portfolio.

Loan business is generated primarily through direct-calling efforts and referrals. Referrals of loan business come from directors, current customers and professionals such as lawyers, accountants and financial intermediaries.

At December 31, 2024, the Bank’s statutory lending limit to any single borrower was approximately $44.3 million, subject to certain exceptions provided under applicable law. As of December 31, 2024, the Bank’s credit exposure to its largest borrower was $32.6 million.

Commercial Loans. Commercial loans are written for any prudent business purpose, including the financing of plant and equipment, the carrying of accounts receivable, contract administration, and the acquisition and construction of real estate projects. Special attention is paid to the commercial real estate market, which is particularly active in the Washington, D.C. MSA. The Bank’s commercial loan portfolio reflects a diverse group of borrowers with no concentration in any borrower, or group of borrowers.

The lending activities in which we engage carry the risk that the borrowers will be unable to perform on their obligations. As such, interest rate policies of the Federal Reserve and general economic conditions, nationally and in our primary market area, will have a significant impact on our results of operations. To the extent that economic conditions deteriorate, business and individual borrowers may be less able to meet their obligations to the Bank in full, in a timely manner, resulting in decreased earnings or losses to the Bank. To the extent that loans are secured by real estate, adverse conditions in the real estate market may reduce the ability of the borrower to generate the necessary cash flow for repayment of the loan, and reduce our ability to collect the full amount of the loan upon a default. To the extent that the Bank makes fixed rate loans, general increases in interest rates will tend to reduce our spread as the interest rates we must pay for deposits increase while interest income is flat. Economic conditions and interest rates may also adversely affect the value of property pledged as security for loans.

We constantly strive to mitigate risks in the event of unforeseen threats to the loan portfolio as a result of an economic downturn or other negative influences. Plans for mitigating inherent risks in managing loan assets include carefully enforcing loan policies and procedures, evaluating each borrower’s industry and business plan during the underwriting process, identifying and monitoring primary and alternative sources for repayment, and obtaining collateral that is margined to minimize loss in the event of liquidation.

Commercial real estate loans will generally be owner occupied or managed investment transactions with a principal reliance on the borrower’s ability to repay, as well as prudent guidelines for assessing real estate values. Risks inherent in managing a commercial real estate portfolio primarily relate to either sudden or gradual drops in property values as a result of a general or local economic downturn. A decline in real estate values can cause loan-to-value margins to increase and diminish the Bank’s equity cushion on both an individual and portfolio basis. The Bank attempts to mitigate commercial real estate lending risks by carefully underwriting each loan of this type to address the perceived risks in the individual transaction. Generally, the Bank requires a loan-to-value ratio of 75% of the lower of an appraisal or cost. A borrower’s ability to repay is carefully analyzed and policy generally calls for an ongoing cash flow to debt service requirement of at

Table of Contents

least 1.10:1.0. An approved list of commercial real estate appraisers selected on the basis of consistent standards has been established. Each appraisal is scrutinized in an effort to ensure current comparable market values.

As noted above, commercial real estate loans are generally made on owner occupied or managed investment properties where there is both a reliance on the borrower’s financial health and the ability of the borrower and the business to repay. The Bank generally requires personal guarantees on all commercial loans as a matter of policy; exceptions to policy are documented. Most borrowers are required to forward annual corporate, partnership and personal financial statements to comply with Bank policy and enforced through loan covenants. Interest rate risks to the Bank are mitigated by using either floating interest rates or by fixing rates, generally less than 10 years. While loan amortizations may be approved for up to 360 months, loans generally have a call provision (maturity date) of 10 years or less. Specific and non-specific provisions for loan credit loss reserves are generally set based upon a methodology developed by management and approved by the board of directors and described more fully under “Critical Accounting Policies and Estimates” in Item 2, Management’s Discussion and Analysis of Financial Condition and Results of Operations, of this Form 10-K. At December 31, 2024, approximately 17.6% of our loan portfolio related to owner occupied commercial real estate loans, and approximately 40.5% of our loan portfolio related to managed investment commercial real estate.

Stress testing remains an important component of our organization, including oversight of commercial real estate loans. We have incorporated stress testing into our traditional risk management procedures, which examine the commercial real estate portfolio for expected losses, provision levels, criticized or classified loans, and loan concentrations. Our loan level stress tests are conducted quarterly and assess the impact to capital, if any, resulting from decreased collateral value or debt service coverage under various economic scenarios.

Construction and Development Loans. We offer fixed and adjustable rate residential and commercial construction loan financing to builders and developers and to consumers who wish to build their own home. The term of construction and development loans generally is limited to maximum of 24 months, although payments may be structured on a longer amortization basis. Most loans will mature and require payment in full upon the sale of the property. We believe that construction and development loans generally carry a higher degree of risk than long-term financing of stabilized, rented, and owner-occupied properties because repayment depends on the ultimate completion of the project and usually on the subsequent sale of the property. Specific risks include:

● cost overruns;

● mismanaged construction;

● inferior or improper construction techniques;

● economic changes or downturns during construction;

● a downturn in the real estate market;

● rising interest rates which may prevent sale of the property; and

● failure to sell or stabilize completed projects in a timely manner.

We attempt to reduce risk associated with construction and development loans by obtaining personal guaranties and by keeping the maximum loan-to-value ratio at or below 75% of the appraised value and maximum loan-to-cost ratio at or below 85%, depending on the project type. All construction loans are administered by a centralized department within the Bank that is comprised of experienced loan administrators that specialize in residential, commercial and consumer construction project oversight. Further, all construction loans are loaded into, and managed on, a third party, nationally recognized construction loan administration platform, which is a fintech solution that provides a unique customer experience, consistency in loan administration, and risk management through portfolio monitoring, market/asset type/borrower concentration analysis, and disbursement efficiency. Finally, the Bank works with highly sophisticated sponsors that are experienced, well capitalized, and positioned to manage through a downturn. As of December 31, 2024, construction and development loans made up approximately 8.8% of our loan portfolio.

Table of Contents

Commercial Term Loans. We provide funds for equipment and general corporate needs. This loan category is designed to support borrowers who have a proven ability to service debt over a term generally not to exceed 60 months. The Bank generally requires a first lien position on all collateral and guarantees from owners having at least a 20% interest in the involved business. Interest rates on commercial term loans are generally floating, or are fixed for a term not to exceed five years. Management carefully monitors industry and collateral concentrations to avoid loan exposures to a large group of similar industries and/or similar collateral. Commercial loans are evaluated for historical and projected cash flow attributes, balance sheet strength, and primary and alternate resources of personal guarantors. Commercial term loan documents require borrowers to forward regular financial information on both the business and on personal guarantors. Loan covenants require at least annual submission of complete financial information and in certain cases this information is required more frequently, depending on the degree to which the Bank requires information for monitoring a borrower’s financial condition and compliance with loan covenants. Collateral borrowing certificates may be required to monitor certain collateral categories on a monthly or quarterly basis. Key person life insurance is required as appropriate and as necessary to mitigate the risk of loss of a primary owner or manager.

Commercial Lines of Credit. We finance a business borrower’s short-term credit needs and/or to finance a percentage of eligible receivables and inventory. In addition to the risks inherent in term loan facilities, line of credit borrowers typically require additional monitoring to protect the lender against increasing loan volumes and diminishing collateral values. Commercial lines of credit are generally revolving in nature and require close scrutiny. The Bank usually requires an annual out of debt period (for seasonal borrowers) or regular financial information (monthly or quarterly financial statements, borrowing base certificates, etc.) for borrowers with more growth and greater permanent working capital financing needs. Advances against collateral are generally in the same percentages as in term loan lending. Lines of credit and term loans to the same borrowers are typically cross-defaulted and cross-collateralized. Industry and collateral concentration, general and specific reserve allocation and risk rating disciplines are the same as those used in managing the commercial term loan portfolio. Interest rate charges on this group of loans generally float at a factor at or above the prime lending rate, subject in many cases to a minimum rate. Generally, personal guarantees are required on these loans.

Combined, commercial term loans and lines of credit represent approximately 2.6% of our loan portfolio as of December 31, 2024.

Mortgage Lending. The Bank originates, funds and services non-conforming 1-4 family residential mortgage loans for its own portfolio. Such loans are generally made at no more than the lesser of 80% loan to collateral value or cost. Mortgage loans are underwritten with full documentation, including verification of income and assets. Although the mortgage loans the Bank originates often carry amortization periods of up to 30 years, interest rate risk is controlled through balloon payments or interest rate adjustments of generally six years or less. At December 31, 2024, Bank originated 1-4 residential mortgage loans represented 3.5% of our loan portfolio.

The Bank also purchases and services 5/1, 7/1 and 10/1 adjustable rate mortgages. These mortgages are made on primary residences within our market area and are subject to a strict, uniform set of underwriting criteria. Management views purchased mortgages as a managed risk means of diversifying our earning asset portfolio and achieving a yield, net of the amortized premium, superior to that which may be available in the fixed income market. At December 31, 2024, approximately 16.0% of our loan portfolio related to purchased mortgages.

Other Loans. Loans are considered for any worthwhile personal or business purpose on a case-by-case basis, such as the financing of equipment, receivables, contract administration expenses, and automobile financing. Consumer credit facilities are underwritten to focus on the borrower’s credit record, length of employment and cash flow to debt service. Car, residential real estate and similar loans generally require advances of the lesser of 80% loan to collateral value or cost.

Investment Activities

We manage our securities portfolio and cash to, in order of priority, ensure the safety and preservation of invested principal, maintain adequate liquidity and focus on yield and returns. Specific goals of our investment portfolio are as follows:

Table of Contents

● provide collateral to secure local governmental agency and business deposits.

The securities in which the Company may invest are subject to regulation and are limited to securities which are considered investment grade securities. Our investment portfolio is comprised primarily of U.S. Treasury bonds, U.S. government agency securities and mortgage-backed or collateralized mortgage obligation securities issued by government-sponsored entities, though we may hold other securities, such as municipal bonds, certificates of deposit and corporate debt securities.

Our investment policy is reviewed annually by our board of directors. The Company’s board of directors has delegated the responsibility of monitoring our investment activities to management consistent with the requirements of the Bank’s Asset Liability Management policy. Day-to-day activities pertaining to the securities portfolio are conducted under the supervision of our Chief Financial Officer and Chief Executive Officer. We actively monitor our investments on an ongoing basis to identify any material changes in the securities. We also review our securities for potential credit impairment at least quarterly.

Deposit Activities

Deposits sourced through our relationship managers and obtained through bank offices have traditionally been the principal source of the Bank’s funds for use in lending and for other general business purposes. In order to serve the needs of its customers, the Bank offers several types of deposit accounts including demand, NOW, money market and savings accounts as well as certificates of deposit. The Bank typically pays a competitive rate on the interest-bearing deposits. As a relationship-oriented organization, we seek to obtain deposit relationships with our loan customers. We offer a full range of consumer and commercial deposit products, including online banking with free bill pay, cash management with the means to detect and prevent fraud, sweep accounts, wire transfer, check imaging and remote deposit capture. Through our membership in the IntraFi Network®, we can arrange FDIC insurance of up to $150 million of transaction deposits, certificates of deposits or some combination of the two.

As the Bank’s overall balance sheet positions dictate, we may become more or less competitive in our interest rate structure as our liquidity position changes. Additionally, we may use wholesale or municipal deposits to augment our funding position or achieve a desired interest rate risk management position.

Refer to Risks Related to Funding and Liquidity – “Our deposit portfolio includes significant concentrations and a large percentage of our deposits are attributable to a relatively small number of customers” for discussion of the concentration risk in our deposit portfolio.

Other Services

The Bank has an ownership interest in one of the nation’s largest privately-owned insurance agencies. Through this investment we are able to offer our customers a broad array of business and personal insurance. Also, through third- party networks, we offer our customers access credit and purchase card products.

Our technology products include, among other things, remote deposit capture, sophisticated online internet-based cash management systems, mobile banking, and deposit sweep services that allow businesses to earn interest on their excess funds. Typically, we provide our remote deposit capture hardware and software to our commercial customers free of charge, which provides current and potential customers with a convenient means to bank with us.

Community Reinvestment Act

The Company is committed to serving the banking needs of the communities in which we are located, including low and moderate income areas, and is a supporter of the Community Reinvestment Act (“CRA”). There are several ways in which the Company attempts to fulfill this commitment, including funding no-fee checking accounts, free ATM usage worldwide, mortgage products subject to maximum income limit, small business loans, financing of affordable housing projects, and becoming involved with local groups that support community outreach programs.

Table of Contents

The Company encourages its directors and officers to participate in community, civic and charitable organizations. Management and members of our board of directors periodically review the various CRA activities of the Company, including its credit granting process and its involvement with community leaders on a personal level.

Risk Management

We believe that effective risk management is of primary importance. Risk management refers to the activities by which we identify, measure, monitor, evaluate and manage the risks we face in the course of our banking activities. These include liquidity, interest rate, credit, operational, compliance, cybersecurity, regulatory, strategic, financial and reputational risk exposures. Our board of directors, both directly and through its committees, is responsible for overseeing our risk management processes, including quarterly enterprise risk management assessments and annual cyber, Bank Secrecy Act (“BSA”)/anti-money laundering and third-party risk assessments, with each of the committees of our board of directors assuming a different and important role in overseeing the management of the risks we face.

The Audit Committee of our board of directors is responsible for overseeing risks associated with financial matters (particularly financial reporting, accounting practices and policies, disclosure controls and procedures and internal control over financial reporting). The Compensation Committee of our board of directors has primary responsibility for risks and exposures associated with our compensation policies, plans and practices, regarding both executive compensation and our compensation structure generally. In particular, our Compensation Committee, in conjunction with our President and Chief Executive Officer, as appropriate, reviews our incentive compensation arrangements to ensure these programs are consistent with applicable laws and regulations, including safety and soundness requirements, and do not encourage imprudent or excessive risk-taking by our employees. The Nominating Committee of our board of directors oversees risks associated with the independence of our board of directors and potential conflicts of interest.

Our senior management is responsible for implementing our risk management processes, including by assessing and managing the risks we face, including strategic, operational, regulatory, investment and execution risks, on a day-to-day basis, and reporting to our board of directors regarding our risk management processes. Our senior management is also responsible for creating and recommending to our board of directors for approval appropriate risk appetite metrics reflecting the aggregate levels and types of risk we are willing to accept in connection with the operation of our business and pursuit of our business objectives.

The role of our board of directors in our risk oversight is consistent with our leadership structure, with our President and Chief Executive Officer, Chief Operating Officer, Chief Financial Officer and the other members of senior management having responsibility for assessing and managing our risk exposure, and our board of directors and its committees providing oversight in connection with those efforts. We believe this division of risk management responsibilities presents a consistent, systemic and effective approach for identifying, managing and mitigating risks throughout our operations.

We believe a disciplined and conservative underwriting approach has been the key to our strong asset quality. Credit risk is the risk that borrowers or counterparties will be unable or unwilling to repay their obligations in accordance with the underlying contractual terms and the risk that credit assets will suffer significant deterioration in market value. We manage and control credit risk in our loan portfolio by adhering to well-defined underwriting criteria and account administration standards established by management, and approved by the board of directors. Our written loan policies document underwriting standards, approval levels, exposure limits and other limits or standards deemed necessary and prudent. Portfolio diversification is actively managed to mitigate concentration risk. In addition, credit risk management includes an independent credit review process that assesses compliance with policies, risk rating standards and other critical credit information. In addition to implementing risk management practices that are based upon established and sound lending practices, we adhere to sound credit principles. We evaluate our customers’ borrowing needs and capacity to repay, in conjunction with their character and history. Our management and board of directors place significant focus on maintaining a healthy risk profile and ensuring sustainable growth. Our risk appetite seeks to balance the risks necessary to achieve our strategic goals while ensuring that our risks are appropriately managed and remain within our defined limits.

Our management of interest rate and liquidity risk is overseen by our Asset and Liability Committee, based on a risk management infrastructure approved by our board of directors that outlines reporting and measurement requirements. In particular, this infrastructure reviews financial performance, trends and significant variances to budget; reviews and recommends for board approval risk limits and tolerances; reviews ongoing monitoring and reporting regarding our

Table of Contents

performance with respect to these areas of risk, including compliance with board-approved risk limits and stress-testing; ensures annual back-testing and independent validation of models at a frequency commensurate with risk level; reviews and recommends our contingency funding plan; establishes wholesale borrowing limits to be submitted to the board of directors; and reviews information and reports submitted for the purpose of identifying, investigating, and assuring remediation, to its satisfaction, of errors or irregularities, if any.

Emerging Growth Company Status

We qualify as an “emerging growth company” under the JOBS Act and as defined in Section 2(a) of the Securities Act. For as long as we are an emerging growth company, we may choose to take advantage of exemptions from various reporting requirements applicable to other public companies but not to emerging growth companies.

As an emerging growth company:

We could remain an emerging growth company for up to five years, or until the earliest of (i) the end of the first fiscal year during which we have total annual gross revenues of $1.07 billion or more, (ii) the date on which we have, during the previous three-year period, issued more than $1.0 billion in non-convertible debt and (iii) the date on which we are deemed to be a “large accelerated filer” as defined in Rule 12b-2 under the Securities Exchange Act of 1934, as amended (the “Exchange Act”).

In addition to the relief described above, the JOBS Act permits us an extended transition period for complying with new or revised accounting standards affecting public companies. We have elected not to take advantage of this extended transition period, which means that the financial statements included in this Form 10-K, as well as any financial statements that we file in the future, will be subject to all new or revised accounting standards generally applicable to public companies.

See Item 1A, Risk Factors, of this Form 10-K for more information on emerging growth companies.

Employees

As of December 31, 2024, we had 130 full-time employees and 3 part-time employees. None of our employees are covered by a collective bargaining agreement. We consider our relationship with our employees to be good and have not experienced interruptions of operations due to labor disagreements.

We provide a competitive compensation and benefits program to our employees. In addition to salaries, these programs include annual bonus opportunities, a 401(k) plan with an employer matching contribution, healthcare and insurance benefits, profit sharing, flexible spending accounts, paid time off and an employee assistance program.

General Corporate Information

Our principal executive offices are located at 1943 Isaac Newton Square, Suite 100, Reston, Virginia 20190 and our telephone number at that address is (703) 584-0840. Additional information can be found on our website: www.johnmarshallbank.com. Information on our website or any other website is not incorporated by reference herein and does not constitute a part of this Form 10-K.

Table of Contents

Public Information

Our Securities and Exchange Commission (“SEC”) filings are available to the public on the SEC’s Internet site at http://www.sec.gov. You may also obtain these documents, free of charge, from the investor relations section of our website at http://www.johnmarshallbank.com.

Supervision and Regulation

The Company and the Bank are highly regulated under both federal and state laws. The following description briefly addresses certain provisions of federal and state laws and regulations, and their potential effects on the Company and the Bank. To the extent statutory or regulatory provisions or proposals are described in this Form 10-K, the description is qualified in its entirety by reference to the particular statutory or regulatory provisions or proposals.

The Company

General. As a bank holding company registered under the Bank Holding Company Act of 1956 (the “BHCA”), the Company is subject to supervision, regulation and examination by the Federal Reserve. The Company is also registered under the bank holding company laws of Virginia and is subject to supervision, regulation and examination by the Virginia BFI.

Permitted Activities. The permitted activities of a bank holding company are limited to managing or controlling banks, furnishing services to or performing services for its subsidiaries, and engaging in other activities that the Federal Reserve determines by regulation or order to be closely related to banking or managing or controlling banks. In determining whether a particular activity is permissible, the Federal Reserve must consider whether the performance of such an activity reasonably can be expected to produce benefits to the public that outweigh possible adverse effects. Possible benefits include greater convenience, increased competition, and gains in efficiency. Possible adverse effects include undue concentration of resources, decreased or unfair competition, conflicts of interest, and unsound banking practices. Despite prior approval, the Federal Reserve may order a bank holding company or its subsidiaries to terminate any activity or to terminate ownership or control of any subsidiary when the Federal Reserve has reasonable cause to believe that a serious risk to the financial safety, soundness, or stability of any bank subsidiary of that bank holding company may result from such an activity.

Banking Acquisitions; Changes in Control. The BHCA and related regulations require, among other things, the prior approval of the Federal Reserve in any case where a bank holding company proposes to (i) acquire direct or indirect ownership or control of more than 5% of the outstanding voting stock of any bank or bank holding company (unless it already owns a majority of such voting shares), (ii) acquire all or substantially all of the assets of another bank or bank holding company, or (iii) merge or consolidate with any other bank holding company. In determining whether to approve a proposed bank acquisition, the Federal Reserve will consider, among other factors, the effect of the acquisition on competition, the public benefits expected to be received from the acquisition, any outstanding regulatory compliance issues of any institution that is a party to the transaction, the projected capital ratios and levels on a post-acquisition basis, the financial condition of each institution that is a party to the transaction and of the combined institution after the transaction, the parties’ managerial resources and risk management and governance processes and systems, the parties’ compliance with the BSA and anti-money laundering requirements, and the acquiring institution’s performance under the Community Reinvestment Act of 1977 and compliance with fair housing and other consumer protection laws.

Subject to certain exceptions, the BHCA and the Change in Bank Control Act, together with the applicable regulations, require Federal Reserve approval (or, depending on the circumstances, no notice of disapproval) prior to any person or company’s acquiring “control” of a bank or bank holding company. A conclusive presumption of control exists if an individual or company acquires the power, directly or indirectly, to direct the management or policies of an insured depository institution or to vote 25% or more of any class of voting securities of any insured depository institution. A rebuttable presumption of control exists if a person or company acquires 10% or more but less than 25% of any class of voting securities of an insured depository institution and either the institution has registered its securities with the SEC under Section 12 of the Exchange Act or no other person will own a greater percentage of that class of voting securities immediately after the acquisition.

Table of Contents

In addition, Virginia law requires prior approval from the Virginia BFI for (i) the acquisition by a Virginia bank holding company of more than 5% of the voting shares of a Virginia bank or any holding company that controls a Virginia bank, or (ii) the acquisition by a Virginia bank holding company of a bank or its holding company domiciled outside Virginia.

Source of Strength. Federal Reserve policy has historically required bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. The Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) codified this policy as a statutory requirement. Under this requirement, the Company is expected to commit resources to support the Bank, including at times when the Company may not be in a financial position to provide such resources. Any capital loans by a bank holding company to any of its subsidiary banks are subordinate in right of payment to depositors and to certain other indebtedness of such subsidiary banks. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Safety and Soundness. There are a number of obligations and restrictions imposed on bank holding companies and their subsidiary banks by law and regulatory policy that are designed to minimize potential loss to the depositors of such depository institutions and the FDIC insurance fund in the event of a depository institution insolvency, receivership, or default. For example, under the Federal Deposit Insurance Corporation Improvement Act of 1991, to avoid receivership of an insured depository institution subsidiary, a bank holding company is required to guarantee the compliance of any subsidiary bank that may become “undercapitalized” with the terms of any capital restoration plan filed by such subsidiary with its appropriate federal bank regulatory agency up to the lesser of (i) an amount equal to 5% of the institution’s total assets at the time the institution became undercapitalized, or (ii) the amount that is necessary (or would have been necessary) to bring the institution into compliance with all applicable capital standards as of the time the institution fails to comply with such capital restoration plan.

Under the Federal Deposit Insurance Act (“FDIA”), federal bank regulatory agencies have adopted guidelines prescribing safety and soundness standards. These guidelines establish general standards relating to capital management, internal controls and information systems, data security, loan documentation, credit underwriting, interest rate exposure, risk management, vendor management, corporate governance, asset growth, and compensation, fees and benefits. In general, the guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines.

Capital Requirements. Pursuant to the Federal Reserve’s Small Bank Holding Company Policy Statement, qualifying bank holding companies with total consolidated assets of less than $3 billion, such as the Company, are not subject to consolidated regulatory capital requirements. Certain capital requirements applicable to the Bank are described below under “The Bank – Capital Requirements.” Subject to capital requirements and certain other restrictions, the Company is able to borrow money to make a capital contribution to the Bank, and such loans may be repaid from dividends paid by the Bank to the Company.

Limits on Dividends and Other Payments. The Company is a legal entity, separate and distinct from its subsidiary. A significant portion of the revenues of the Company result from dividends paid to it by the Bank. There are various legal limitations applicable to the payment of dividends by the Bank to the Company and to the payment of dividends by the Company to its shareholders. The Bank is subject to various statutory and regulatory restrictions on its ability to pay dividends to the Company. Under current regulations, prior approval from the Federal Reserve is required if cash dividends declared by the Bank in any given year exceed net income for that year plus retained net profits of the two preceding years. The payment of dividends by the Bank or the Company may be limited by other factors, such as requirements to maintain capital above regulatory guidelines. Bank regulatory agencies have the authority to prohibit the Bank and the Company from engaging in unsafe or unsound practices in conducting their respective businesses. The payment of dividends, depending on the financial condition of the Bank or the Company, could be deemed to constitute such an unsafe or unsound practice.

Under the FDIA, insured depository institutions, such as the Bank, are prohibited from making capital distributions, including the payment of dividends, if after making such distributions the institution would become “undercapitalized” (as such term is used in the statute). Any non-bank subsidiaries of the Company may pay dividends to the Company periodically, subject to certain statutory restrictions.

Table of Contents

The Company may receive fees from or pay fees to its affiliated companies for expenses incurred related to certain activities performed by or for the Company for the benefit of its affiliated companies or for its benefit. These fees are charged to/received from each affiliated company based upon various specific allocation methods measuring the estimated usage of such services by that company. The fees are eliminated from reported financial statements in the consolidation process.

The Bank

General. The Bank is supervised and regularly examined by the Federal Reserve and the Virginia BFI. The various laws and regulations administered by the bank regulatory agencies affect corporate practices, such as the payment of dividends, incurrence of debt, and the acquisition of financial institutions and other companies. These laws and regulations also affect business practices, such as the payment of interest on deposits, the charging of interest on loans, credit policies, the types of business conducted, and the location of offices. Certain of these laws and regulations are referenced above under “The Company.”

Capital Requirements. The Federal Reserve and the other federal banking agencies have issued risk-based and leverage capital guidelines applicable to U.S. banking organizations. Those regulatory agencies may from time to time require that a banking organization maintain capital above the minimum levels because of its financial condition or actual or anticipated growth.

The Federal Reserve has adopted final rules regarding capital requirements and calculations of risk-weighted assets to implement the Basel III regulatory capital reforms from the Basel Committee on Banking Supervision and certain provisions of the Dodd-Frank Act. These rules require the Bank to comply with the following minimum capital ratios: (i) a minimum ratio of common equity Tier 1 to risk-weighted assets of 4.5%, plus a 2.5% capital conservation buffer, resulting in a minimum ratio of common equity Tier 1 to risk-weighted assets of 7.0%, (ii) a minimum ratio of Tier 1 capital to risk-weighted assets of 6.0%, plus the 2.5% capital conservation buffer, resulting in a minimum Tier 1 capital ratio of 8.5%, (iii) a minimum ratio of total risk-based capital to risk-weighted assets of 8.0%, plus the 2.5% capital conservation buffer, resulting in a minimum total risk-based capital ratio of 10.5%, and (iv) a minimum leverage ratio of 4.0%, calculated as the ratio of Tier 1 capital to average assets. The capital conservation buffer, is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of common equity Tier 1 to risk-weighted assets above the minimum but below the conservation buffer will face constraints on dividends, equity repurchases, and discretionary compensation paid to certain officers, based on the amount of the shortfall. As of December 31, 2024 and 2023, the capital ratios of the Bank were in excess of the requirements.

As discussed below, the Basel III capital reforms also integrated the new capital requirements into the prompt corrective action provisions under Section 38 of the FDIA. The Federal Reserve’s final rules (i) introduced a common equity Tier 1 capital ratio requirement at each level (other than critically undercapitalized), with the required ratio being 6.5% for well capitalized status, (ii) increased the minimum Tier 1 capital ratio requirement for each category, with the minimum ratio for well capitalized status being 8.0%, and (iii) eliminated the provision that provided that a bank with a composite supervisory rating of 1 may have a 3.0% Tier 1 leverage ratio and still be well capitalized. The minimum total capital to risk-weighted assets ratio (10.0%) and minimum leverage ratio (5.0%) for well capitalized status were unchanged by the final rules.

In 2016, the Financial Accounting Standards Board (“FASB”) issued Accounting Standards Update (“ASU”) 2016-13, Financial Instruments – Credit Losses (Topic 326): Measurement of Credit Losses on Financial Instruments, which requires financial institutions to estimate and establish an allowance for credit losses using a current expected credit loss (“CECL”) model. The CECL model estimates credit losses over the lifetime of our financial assets measured at amortized cost at the date of origination or acquisition, as opposed to reserving for incurred or probable losses through the balance sheet date. The Federal Reserve and FDIC have adopted rules to identify which credit loss allowances under the CECL model are eligible for inclusion in regulatory capital and to provide banking organizations the option to phase in over a three-year transition period ending January 1, 2026 the day-one impact on regulatory capital that may result from the adoption of the CECL model. The Company implemented the CECL model on January 1, 2023 and elected to apply the provisions of the CECL deferral transition in the determination of its risk based capital ratios. The impact of the application of this deferral transition on the ratios was not significant.

Table of Contents

Prompt Corrective Action. Federal banking regulators are authorized and, under certain circumstances, required to take certain actions against banks that fail to meet their capital requirements. The federal bank regulatory agencies have additional enforcement authority with respect to undercapitalized depository institutions. As described above, the final rules to implement the Basel III regulatory capital framework also integrated new requirements into the prompt corrective action framework. “Well capitalized” institutions may generally operate without additional supervisory restriction. With respect to “adequately capitalized” institutions, such banks cannot normally pay dividends or make any capital contributions that would leave the bank undercapitalized; they cannot pay a management fee to a controlling person if after paying the fee, it would be undercapitalized; and they cannot accept, renew, or rollover any brokered deposit unless the bank has applied for and been granted a waiver by the FDIC.

Immediately upon becoming “undercapitalized,” a depository institution becomes subject to the provisions of Section 38 of the FDIA, which: (i) restrict payment of capital distributions and management fees; (ii) require that the appropriate federal banking agency monitor the condition of the institution and its efforts to restore its capital; (iii) require submission of a capital restoration plan; (iv) restrict the growth of the institution’s assets; and (v) require prior approval of certain expansion proposals. The appropriate federal banking agency for an undercapitalized institution also may take any number of discretionary supervisory actions if the agency determines that any of these actions is necessary to resolve the problems of the institution at the least possible long-term cost to the Deposit Insurance Fund of the FDIC (“DIF”), subject in certain cases to specified procedures. These discretionary supervisory actions include: (i) requiring the institution to raise additional capital; (ii) restricting transactions with affiliates; (iii) requiring divestiture of the institution or the sale of the institution to a willing purchaser; and (iv) any other supervisory action that the agency deems appropriate. These and additional mandatory and permissive supervisory actions may be taken with respect to significantly undercapitalized and critically undercapitalized institutions. The Bank met the definition of being “well capitalized” as of December 31, 2024 and 2023.

Deposit Insurance. The deposits of the Bank are insured up to applicable limits by the DIF. The basic limit on FDIC deposit insurance coverage is $250,000 per depositor. Under the FDIA, the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations as an insured depository institution, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, subject to administrative and potential judicial hearing and review processes.

The Bank is subject to deposit insurance assessments to maintain the DIF. Deposit insurance pricing is based on CAMELS composite ratings and certain other financial ratios to determine assessment rates for small-established institutions with less than $10 billion in assets. The CAMELS rating system is a supervisory rating system designed to take into account and reflect all financial and operational risks that a bank may face, including capital adequacy, asset quality, management capability, earnings, liquidity, and sensitivity to market risk (“CAMELS”). CAMELS composite ratings set a maximum insurance assessment for CAMELS 1 and 2 rated banks and set minimum assessments for lower rated institutions.

For the years ended December 31, 2024 and 2023, the Company recorded expense of $1.0 million and $1.0 million, respectively, for FDIC insurance premiums.

Transactions with Affiliates. Pursuant to Sections 23A and 23B of the Federal Reserve Act and Regulation W, the authority of the Bank to engage in transactions with related parties or “affiliates,” or to make loans to insiders, is limited. Loan transactions with an affiliate generally must be collateralized and certain transactions between the Bank and its affiliates, including the sale of assets, the payment of money or the provision of services, must be on terms and conditions that are substantially the same, or at least as favorable to the Bank, as those prevailing for comparable nonaffiliated transactions. In addition, the Bank generally may not purchase securities issued or underwritten by affiliates.

Loans to executive officers, directors, or to any person who directly or indirectly, or acting through or in concert with one or more persons, owns, controls, or has the power to vote more than 10% of any class of voting securities of a bank are subject to Sections 22(g) and 22(h) of the Federal Reserve Act and their corresponding regulations (Regulation O) and Section 13(k) of the Exchange Act, relating to the prohibition on personal loans to executives (which exempts financial institutions in compliance with the insider lending restrictions of Section 22(h) of the Federal Reserve Act). Among other things, these loans must be made on terms substantially the same as those prevailing on transactions made to unaffiliated individuals and certain extensions of credit to those persons must first be approved in advance by a disinterested majority of the entire board of directors. Section 22(h) of the Federal Reserve Act prohibits loans to any of those individuals where

Table of Contents

the aggregate amount exceeds an amount equal to 15% of an institution’s unimpaired capital and surplus plus an additional 10% of unimpaired capital and surplus in the case of loans that are fully secured by readily marketable collateral, or when the aggregate amount on all of the extensions of credit outstanding to all of these persons would exceed the bank’s unimpaired capital and unimpaired surplus. Section 22(g) of the Federal Reserve Act identifies limited circumstances in which a bank is permitted to extend credit to executive officers.

Community Reinvestment Act. The Bank is subject to the requirements of the Community Reinvestment Act of 1977. The CRA imposes on financial institutions an affirmative and ongoing obligation to meet the credit needs of the local communities they serve, including low and moderate income neighborhoods. The CRA requires the appropriate federal banking agency, in connection with its examination of a bank, to assess the bank’s record in meeting such credit needs. Furthermore, such assessment is also required of banks that have applied, among other things, to merge or consolidate with or acquire the assets or assume the liabilities of an insured depository institution, or to open or relocate a branch. In the case of a bank holding company applying for approval to acquire a bank or another bank holding company, the record of each subsidiary bank of the applicant bank holding company is subject to assessment in considering the application. Under the CRA, institutions are assigned a rating of “outstanding,” “satisfactory,” “needs to improve,” or “substantial non-compliance.” The Bank received a “satisfactory” CRA rating in its most recent examination.

On October 24, 2023, the federal bank regulatory agencies issued a final rule to modernize their respective CRA regulations. The revised rules substantially alter the methodology for assessing compliance with the CRA, with material aspects taking effect January 1, 2026 and revised data reporting requirements taking effect January 1, 2027. Among other things, the revised rules evaluate lending outside traditional assessment areas generated by the growth of non-branch delivery systems, such as online and mobile banking, apply a metrics-based benchmarking approach to assessment, and clarify eligible CRA activities. The final rule has been subject to an injunction since March 29, 2024, and the effective dates will be extended pending resolution of the lawsuit.

Anti-Money Laundering Laws and Regulations. The Bank is subject to several federal laws that are designed to combat money laundering, terrorist financing, and transactions with persons, companies or foreign governments designated by U.S. authorities (“AML laws”). This category of laws includes the BSA, the Money Laundering Control Act of 1986, the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA PATRIOT Act”), and the Anti-Money Laundering Act of 2020.

The AML laws and their implementing regulations require insured depository institutions, broker-dealers, and certain other financial institutions to have policies, procedures, and controls to detect, prevent, and report money laundering and terrorist financing. The AML laws and their regulations also provide for information sharing, subject to conditions, between federal law enforcement agencies and financial institutions, as well as among financial institutions, for counter-terrorism purposes. Federal banking regulators are required, when reviewing bank holding company acquisition and bank merger applications, to take into account the effectiveness of the anti-money laundering activities of the applicants. To comply with these obligations, the Bank has implemented appropriate internal practices, procedures, and controls.

Reporting Terrorist Activities. The Office of Foreign Assets Control (“OFAC”), which is a division of the Department of the Treasury, is responsible for helping to ensure that United States entities do not engage in transactions with “enemies” of the United States, as defined by various executive orders and acts of Congress. OFAC has sent, and will send, our bank regulatory agencies lists of names of persons and organizations suspected of aiding, harboring or engaging in terrorist acts. If the Bank finds a name on any transaction, account or wire transfer that is on an OFAC list, it must freeze such account, file a suspicious activity report and notify the Federal Bureau of Investigation. The Bank has appointed an OFAC compliance officer to oversee the inspection of its accounts and the filing of any notifications. The Bank actively checks high-risk OFAC areas such as new accounts, wire transfers and customer files. The Bank performs these checks utilizing software, which is updated each time a modification is made to the lists provided by OFAC and other agencies of Specially Designated Nationals and Blocked Persons.

Consumer Financial Protection. The Bank is subject to a number of federal and state consumer protection laws that extensively govern its relationship with its customers. These laws include the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Truth in Lending Act, the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Home Mortgage Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Fair Debt Collection Practices Act, the Service Members Civil Relief Act, laws governing flood insurance, federal and

Table of Contents

state laws prohibiting unfair and deceptive business practices, foreclosure laws, and various regulations that implement some or all of the foregoing. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must deal with customers when taking deposits, making loans, collecting loans, and providing other services. If the Bank fails to comply with these laws and regulations, it may be subject to various penalties. Failure to comply with consumer protection requirements may also result in failure to obtain any required bank regulatory approval for merger or acquisition transactions the Bank may wish to pursue or being prohibited from engaging in such transactions even if approval is not required.

The Dodd-Frank Act centralized responsibility for consumer financial protection by creating a new agency, the Consumer Financial Protection Bureau (the “CFPB”), and giving it responsibility for implementing, examining, and enforcing compliance with federal consumer protection laws. The CFPB focuses on (i) risks to consumers and compliance with the federal consumer financial laws, (ii) the markets in which firms operate and risks to consumers posed by activities in those markets, (iii) depository institutions that offer a wide variety of consumer financial products and services, and (iv) non-depository companies that offer one or more consumer financial products or services. The CFPB is responsible for implementing, examining, and enforcing compliance with federal consumer financial laws for institutions with more than $10 billion of assets. While the Bank, like all banks, is subject to federal consumer protection rules enacted by the CFPB, because the Company and the Bank have total consolidated assets of less than $10 billion, the Federal Reserve oversees most consumer protection aspects of the Dodd-Frank Act and other laws and regulations applicable to the Bank.

The CFPB has broad rulemaking authority for a wide range of consumer financial laws that apply to all banks, including, among other things, the authority to prohibit “unfair, deceptive or abusive” acts and practices. Abusive acts or practices are defined as those that materially interfere with a consumer’s ability to understand a term or condition of a consumer financial product or service or take unreasonable advantage of a consumer’s (i) lack of financial savvy, (ii) inability to protect himself in the selection or use of consumer financial products or services, or (iii) reasonable reliance on a covered entity to act in the consumer’s interests. The CFPB can issue cease-and-desist orders against banks and other entities that violate consumer financial laws. The CFPB may also institute a civil action against an entity in violation of federal consumer financial law in order to impose a civil penalty or injunction. Further regulatory positions taken by the CFPB may influence how other regulatory agencies may apply the subject consumer financial protection laws and regulations. In February 2025, the Trump administration halted the CFPB’s operations, and its employees were instructed to cease all supervision and examination activity. As a result, the future of the CFPB and its impact on our business are uncertain.

Privacy Legislation. Several laws, including the Right to Financial Privacy Act and the Gramm-Leach-Bliley Act (“GLB Act”), and related regulations issued by the federal bank regulatory agencies, provide protections against the transfer and use of customer information by financial institutions. A financial institution must provide its customers information regarding its policies and procedures with respect to the handling of customers’ personal information. Each institution must conduct an internal risk assessment of its ability to protect customer information. These privacy provisions generally prohibit a financial institution from providing a customer’s personal financial information to unaffiliated parties without prior notice to and approval from the customer.

In October 2024, the CFPB issued a final rule regarding personal financial data rights that is designed to promote “open banking.” The final rule requires, among other things, that data providers, including any financial institution, make available to consumers and certain authorized third parties, upon request, certain covered transaction, account, and payment information. Institutions with at least $1.5 billion but less than $3 billion in total assets, including the Company, are required to comply with the final rule by April 1, 2029. On the same day the final rule was released, certain industry participants filed a complaint against the CFPB challenging the final rule. This legal challenge has since been paused to allow time for the CFPB to assess the rule and determine whether it aligns with the agency’s current policy objectives.

Cybersecurity. The federal bank regulatory agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a financial institution’s board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services. The federal bank regulatory agencies expect financial institutions to establish lines of defense and to ensure that their risk management processes address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption and maintenance of the

Table of Contents

institution’s operations after a cyberattack. If the Company or the Bank fails to meet the expectations set forth in this regulatory guidance, the Company or the Bank could be subject to various regulatory actions and any remediation efforts may require significant resources of the Company or the Bank.

On November 18, 2021, the federal bank regulatory agencies issued a final rule, effective April 1, 2022, imposing new notification requirements for cybersecurity incidents. The rule requires financial institutions to notify their primary federal regulator as soon as possible and no later than 36 hours after the institution determines that a cybersecurity incident has occurred that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the institution’s: (i) ability to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base, in the ordinary course of business, (ii) business line(s), including associated operations, services, functions, and support, that upon failure would result in a material loss of revenue, profit, or franchise value, or (iii) operations, including associated services, functions and support, as applicable, the failure or discontinuance of which would pose a threat to the financial stability of the United States.

In July 2023, the SEC issued a final rule to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and incident reporting by public companies that are subject to the reporting requirements of the Exchange Act. Specifically, the final rule requires current reporting about material cybersecurity incidents, periodic disclosures about a registrant’s policies and procedures to identify and manage cybersecurity risk, management’s role in implementing cybersecurity policies and procedures, and the board of directors’ cybersecurity expertise, if any, and its oversight of cybersecurity risk. See Item 1C. Cybersecurity of this Form 10-K for a discussion of the Company’s cybersecurity risk management, strategy and governance.

To date, neither the Company nor the Bank has experienced a significant compromise, significant data loss, or material financial losses related to cybersecurity attacks, but its systems and those of its customers and third-party service providers are under constant threat, and it is possible that the Company or the Bank could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking, and other technology-based products and services by the Company and the Bank and its customers.

Incentive Compensation. The federal bank regulatory agencies have issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of financial institutions do not undermine the safety and soundness of such institutions by encouraging excessive risk-taking. The Interagency Guidance on Sound Incentive Compensation Policies, which covers all employees that have the ability to materially affect the risk profile of financial institutions, either individually or as part of a group, is based upon the key principles that a financial institution’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the institution’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the financial institution’s board of directors.

The Federal Reserve will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of financial institutions, such as the Company and the Bank, that are not “large, complex banking organizations.” These reviews will be tailored to each financial institution based on the scope and complexity of the institution’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the institution’s supervisory ratings, which can affect the institution’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a financial institution if its incentive compensation arrangements or related risk-management control or governance processes pose a risk to the institution’s safety and soundness, and the financial institution is not taking prompt and effective measures to correct the deficiencies. At December 31, 2024, the Company and the Bank have not been made aware of any instances of noncompliance with this guidance.

The Nasdaq Stock Market, LLC, the exchange on which our common stock is listed, enacted a listing rule that became effective in 2023 requiring listed companies to adopt policies mandating the recovery or “clawback” of excess incentive compensation earned by a current or former executive officer during the three fiscal years preceding the date the listed company is required to prepare an accounting restatement, including to correct an error that would result in a material

Table of Contents

misstatement if the error were corrected in the current period or left uncorrected in the current period. The Company has adopted a clawback policy compliant with such rule, a copy of which is attached as Exhibit 97 to this Form 10-K.

Mortgage Banking Regulation. In connection with making mortgage loans, the Bank is subject to rules and regulations that, among other things, establish standards for loan origination, prohibit discrimination, provide for inspections and appraisals of property, require credit reports on prospective borrowers, in some cases restrict certain loan features and fix maximum interest rates and fees, require the disclosure of certain basic information to mortgagors concerning credit and settlement costs, limit payment for settlement services to the reasonable value of the services rendered and require the maintenance and disclosure of information regarding the disposition of mortgage applications based on race, gender, geographical distribution and income level. The Bank is also subject to rules and regulations that require the collection and reporting of significant amounts of information with respect to mortgage loans and borrowers. The Bank’s mortgage origination activities are subject to Regulation Z, which implements the Truth in Lending Act. Certain provisions of Regulation Z require creditors to make a reasonable and good faith determination based on verified and documented information that a consumer applying for a mortgage loan has a reasonable ability to repay the loan according to its terms.

Effect of Governmental Monetary Policies

The Company’s operations are affected not only by general economic conditions but also by the policies of various regulatory authorities. In particular, the Federal Reserve regulates money and credit conditions and interest rates to influence general economic conditions. These policies have a significant effect on overall growth and distribution of loans, investments, and deposits, and they affect interest rates charged on loans or paid for deposits. Federal Reserve monetary policies have had significant effects on the operating results of commercial banks, including the Bank, in the past and are expected to do so in the future.

Future Legislation and Regulation

Congress may enact legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or effect of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of the proposed legislation could affect the regulatory structure under which the Company and the Bank operate and may significantly increase costs, impede the efficiency of internal business processes, require an increase in regulatory capital, require modifications to business strategies, and limit the ability to pursue business opportunities in an efficient manner. A change in statutes, regulations, or regulatory policies applicable to the Company or the Bank could have a material, adverse effect on the business, financial condition, and results of operations of the Company and the Bank.

Reporting Obligations under Securities Laws

The Company is subject to the periodic and other reporting requirements of the Exchange Act, including the filing of annual, quarterly, and other reports with the SEC. The Company’s SEC filings are posted and available at no cost on its website as soon as reasonably practicable after the reports are filed electronically with the SEC. The Company’s website address is www.johnmarshallbank.com. The information on the Company’s website is not incorporated into this report or any other filing the Company makes with the SEC. The SEC maintains an Internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC at www.sec.gov.

Table of Contents

Item 1A.Risk Factors

In addition to the other information set forth in this Annual Report on Form 10-K, including the information addressed under “Cautionary Note Regarding Forward-Looking Statements” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” and our consolidated financial statements and the related notes, you should carefully consider the factors discussed below. These factors could adversely affect our business, financial condition, liquidity and results of operations, and could cause our actual results to differ materially from our historical results or the results contemplated by the forward-looking statements contained in this Annual Report on Form 10-K, in which case the trading price of our common stock could decline. Our business, financial condition, liquidity or results of operations could also be harmed by risks and uncertainties not currently known to us or that we currently do not believe are material.

Risks Related to Our Lending Activities

We may not be able to measure and limit our credit risk adequately, which could adversely affect our profitability.

Our business depends on our ability to successfully measure and manage credit risk. As a lender, we are exposed to the risk that the principal of, or interest on, a loan will not be paid timely or at all or that the value of any collateral supporting a loan will be insufficient to cover our outstanding exposure. In addition, we are exposed to risks with respect to the period of time over which the loan may be repaid, risks relating to proper loan underwriting, risks resulting from changes in economic and industry conditions, and risks inherent in dealing with individual loans and borrowers. The creditworthiness of a borrower is affected by many factors, including local market conditions and general economic conditions. Many of our loans are made to small to medium-sized businesses that are less able to withstand competitive, economic and financial pressures than larger borrowers. If the overall economic climate in the United States, generally, or in our market specifically, experiences material disruption, our borrowers may experience difficulties in repaying their loans, the collateral we hold may decrease in value or become illiquid, and the level of nonperforming loans, charge-offs and delinquencies could rise and require significant additional provisions for loan credit losses. Additional factors related to the credit quality of multifamily residential, real estate construction and other commercial real estate loans include the quality of management of the business and tenant vacancy rates.

Our risk management practices, such as monitoring the concentration of our loans within specific markets and our credit approval, review and administrative practices, may not adequately reduce credit risk, and our credit administration personnel, policies and procedures may not adequately adapt to changes in economic or any other conditions affecting customers and the quality of the loan portfolio. A failure to effectively measure and limit the credit risk associated with our loan portfolio may result in loan defaults, foreclosures and additional charge-offs, and may necessitate that we significantly increase our allowance for loan credit losses, each of which could adversely affect our net income. As a result, our inability to successfully manage credit risk could have an adverse effect on our business, financial condition and results of operations.

Our allowance for loan credit losses may be inadequate to absorb expected losses inherent in the loan portfolio.

Experience in the banking industry indicates that a portion of our loans will become delinquent, and that some may only be partially repaid or may never be repaid at all. We may experience losses for reasons beyond our control, such as the impact of general economic conditions on customers and their businesses. Accordingly, we maintain an allowance for loan credit losses that represents management’s judgment of expected losses and risks inherent in our loan portfolio. In determining the size of our allowance for loan credit losses, we rely on an analysis of our loan portfolio considering historical loss experience, volume and types of loans, trends in classification, volume and trends in delinquencies and nonaccruals, economic conditions and other pertinent information. The determination of the appropriate level of the allowance for loan credit losses is inherently highly subjective and requires us to use significant judgment to estimate the level of credit risk and expected losses of the institution based on an evaluation the factors and circumstances that exist as of the applicable measurement date, all of which may change materially. Although we endeavor to maintain our allowance for loan credit losses at a level adequate to absorb any inherent expected losses in the loan portfolio, these estimates of loan credit losses are necessarily subjective and their accuracy depends on the outcome of future events. As of December 31, 2024, the allowance for loan credit losses was $18.7 million or 1.00% of total loans, net of unearned income.

Table of Contents

Deterioration of economic conditions affecting borrowers, new information regarding existing loans, inaccurate management assumptions, identification of additional problem loans, temporary modifications, loan forgiveness, automatic forbearance and other factors, both within and outside of our control, may result in our experiencing higher levels of nonperforming assets and charge-offs, and incurring loan credit losses in excess of our current allowance for loan credit losses, requiring us to make material additions to our allowance for loan credit losses, which could have an adverse effect on our business, financial condition and results of operations.

Additionally, federal and state banking regulators, as an integral part of their supervisory function, periodically review the allowance for loan credit losses. These regulatory agencies may require us to increase our provision for loan credit losses or to recognize further loan charge-offs based upon their judgments, which may be different from ours. If we need to make significant and unanticipated increases in the loss allowance in the future, or to take additional charge-offs for which we have not established adequate reserves, our business, financial condition and results of operations could be adversely affected at that time.

If our non-performing assets increase, our earnings will be adversely affected.

At December 31, 2024, we had one non-performing loan that was 90 days past due and still accruing interest. The loan was paid off, in full, on January 7, 2025. We had no non-accrual loans and no OREO at December 31, 2024 or 2023. Non-performing assets held by the Company adversely affect our net income in various ways:

If additional borrowers become delinquent and do not pay their loans and we are unable to successfully manage our non-performing assets, our losses and troubled assets could increase, which could have an adverse effect on our financial condition and results of operations.

Our focus on lending to small to medium-sized businesses may increase our credit risk.

We target our business development and marketing strategy primarily to serve the banking and financial services needs of small to medium-sized businesses. These businesses generally have fewer financial resources in terms of capital or borrowing capacity than larger entities, frequently have smaller market shares than their competition, may be more vulnerable to economic downturns, often need substantial additional capital to expand or compete, and may experience substantial volatility in operating results, any of which may impair their ability as a borrower to repay a loan. If general economic conditions in the markets in which we operate negatively impact this customer segment, our results of operations and financial condition and the value of our common stock may be adversely affected. Moreover, a portion of these loans have been made by us in recent years and the borrowers may not have experienced a complete business or economic cycle. The deterioration of our borrowers’ businesses may hinder their ability to repay their loans with us, which could have an adverse effect on our financial condition and results of operations.

A substantial portion of our loans are and will continue to be real estate related loans in the Washington, D.C. metropolitan area. Adverse changes in the real estate market or economy in this area could lead to higher levels of problem loans and charge-offs, adversely affecting our earnings and financial condition.

We make loans primarily to borrowers in the Washington, D.C. MSA, focusing on the Virginia counties of Arlington, Fairfax, Loudoun and Prince William and the independent cities located within those counties, and Washington D.C. and its Maryland suburbs, and have a substantial portion of our loans secured by real estate. These concentrations expose us to the risk that adverse developments in the real estate market, or in the general economic conditions in such areas, or the

Table of Contents

continuation of such adverse developments, could increase the levels of nonperforming loans and charge-offs, and reduce loan demand and deposit growth. Actual and proposed spending cuts by the U.S. Government, particularly those resulting in job losses in the Washington, D.C. MSA, could have a negative impact on the markets we serve, which could adversely affect our business, financial condition, and results of operations. Additionally, if economic conditions in the area deteriorate, or there is significant volatility or weakness in the economy or any significant sector of the area’s economy, our ability to develop our business relationships may be diminished, the quality and collectability of our loans may be adversely affected, our provision for loan credit losses may increase, the value of collateral may decline and loan demand may be reduced.

We are exposed to higher credit risk by commercial real estate, commercial and industrial and construction and development-based lending as well as relationship exposure with a number of large borrowers.

Commercial real estate, commercial and industrial and construction and development based lending usually involve higher credit risks than 1-4 family residential real estate lending. While we observed a decrease in exposure year-over-year, as of December 31, 2024, the following loan types accounted for the stated percentages of our loan portfolio: commercial real estate (both owner-occupied and non-owner occupied) - 63.2%; commercial and industrial - 2.6%; and construction and land - 8.8%. These types of loans also involve larger loan balances to a single borrower or groups of related borrowers. These higher credit risks are further heightened when the loans are concentrated in a small number of larger borrowers leading to relationship exposure. As of December 31, 2024, we had 39 relationships with over $10 million of outstanding borrowings with us. While we are not dependent on any of these relationships and while none of these large relationships have directly impacted our allowance for loan credit losses, a deterioration of any of these large credits could require us to increase our allowance for loan credit losses or result in significant losses to us.

Non-owner occupied commercial real estate loans may be affected to a greater extent than residential loans by adverse conditions in real estate markets or the economy because commercial real estate borrowers’ ability to repay their loans depends on successful development of their properties, in addition to the factors affecting residential real estate borrowers. These loans also involve greater risk because they generally are not fully amortizing over the loan period, but have a balloon payment due at maturity. A borrower’s ability to make a balloon payment typically will depend on being able to either refinance the loan or sell the underlying property in a timely manner.

Commercial and industrial loans and owner-occupied commercial real estate loans are typically based on the borrowers’ ability to repay the loans from the cash flow of their businesses. These loans may involve greater risk because the availability of funds to repay each loan depends substantially on the success of the business itself. In addition, the assets securing the loans have the following characteristics: (i) they depreciate over time, (ii) they are difficult to appraise and liquidate, and (iii) they fluctuate in value based on the success of the business.

Real estate construction and development loan lending involves additional risks because funds are advanced based on the security of the project, which is of uncertain value prior to its completion, and costs may exceed realizable values in declining real estate markets. Because of the uncertainties inherent in estimating construction costs and the realizable market value of the completed project and the effects of governmental regulation of real property, it is relatively difficult to evaluate accurately the total funds required to complete a project and the related loan-to-value ratio. As a result, construction loans often involve the disbursement of substantial funds with repayment dependent, in part, on the success of the ultimate project and the ability of the borrower to sell or lease the property, rather than the ability of the borrower or guarantor to repay principal and interest. If our appraisal of the value of the completed project proves to be overstated or market values or rental rates decline, we may have inadequate security for the repayment of the loan upon completion of construction of the project. If we are forced to foreclose on a project prior to or at completion due to a default, we may not be able to recover all of the unpaid balance of, and accrued interest on, the loan as well as related foreclosure and holding costs. In addition, we may be required to fund additional amounts to complete the project and may have to hold the property for an unspecified period of time while we attempt to dispose of it.

Additionally, commercial real estate loans, commercial and industrial loans and construction and development loans are more susceptible to a risk of loss during a downturn in the business cycle. Some degree of instability in the commercial real estate markets is expected in the coming quarters as loans are refinanced in markets with higher vacancy rates under current economic conditions. The outlook for commercial real estate remains dependent on the broader economic environment and, specifically, how major subsectors respond to a higher interest rate environment and higher prices for

Table of Contents

commodities, goods and services. Our underwriting, review and monitoring cannot eliminate all of the risks related to these loans.

We engage in lending secured by real estate and may be forced to foreclose on the collateral and own the underlying real estate, subjecting us to the costs and potential risks associated with the ownership of real property, or consumer protection initiatives or changes in state or federal law may substantially raise the cost of foreclosure or prevent us from foreclosing at all.

Since we originate loans secured by real estate, we may have to foreclose on the collateral property to protect our investment and may thereafter own and operate such property, in which case we would be exposed to the risks inherent in the ownership of real estate. The amount that we, as a mortgagee, may realize after a foreclosure depends on factors outside of our control, including, but not limited to, general or local economic conditions, environmental cleanup liabilities, assessments, interest rates, real estate tax rates, operating expenses of the mortgaged properties, our ability to obtain and maintain adequate occupancy of the properties, zoning laws, governmental and regulatory rules, and natural disasters. Our inability to manage the amount of costs or size of the risks associated with the ownership of real estate, or write-downs in the value of OREO could have an adverse effect on our business, financial condition and results of operations. The Company did not have any OREO as of December 31, 2024.

Additionally, consumer protection initiatives or changes in state or federal law may substantially increase the time and expenses associated with the foreclosure process or prevent us from foreclosing at all. A number of states in recent years have either considered or adopted foreclosure reform laws that make it substantially more difficult and expensive for lenders to foreclose on properties in default. Additionally, federal and state regulators have prosecuted or pursued enforcement action against a number of mortgage servicing companies for alleged consumer law violations. If new federal or state laws or regulations are ultimately enacted that significantly raise the cost of foreclosure or raise outright barriers to foreclosure, they could have an adverse effect on our business, financial condition and results of operations.

A significant percentage of our loans are attributable to a relatively small number of borrowers.

Our 10 largest borrowing relationships accounted for approximately 9.3% of our loans at December 31, 2024. Our largest single borrowing relationship accounted for approximately 1.8% of our loans at December 31, 2024. The loss of any combination of these borrowers, or a significant decline in their borrowings due to fluctuations related to their business needs, could adversely affect our results of operations if we are unable to replace their borrowings with similarly priced new loans or investments. In addition, with this concentration of credit risk among a limited number of borrowers, we may face a greater risk of material credits losses if any one or several of these borrowers fail to perform in accordance with their loans, compared to a bank with a more diversified loan portfolio.

Lack of seasoning of our loan portfolio could increase risk of credit defaults in the future.

As a result of our organic growth over the past several years, as of December 31, 2024, approximately $0.9 billion, or 48.1%, of the loans in our loan portfolio were first originated during the past three years. The average age by loan type for loans originated in the past three years is: commercial real estate loans—1.76 years; commercial and industrial loans—1.31 years; commercial construction loans—0.86 years; and consumer residential loans—1.84 years. In general, loans do not begin to show signs of credit deterioration or default until they have been outstanding for some period of time, a process referred to as “seasoning.” As a result, a portfolio of older loans will usually behave more predictably than a newer portfolio. Therefore, the recent and current level of delinquencies and defaults may not represent the level that may prevail as the portfolio becomes more seasoned and may not serve as a reliable basis for predicting the health and nature of our loan portfolio, including net charge-offs and the ratio of nonperforming assets in the future. Our limited experience with these loans may not provide us with a significant history with which to judge future collectability or performance. However, we believe that our stringent credit underwriting process, our ongoing credit review processes, and our history of successful management of our loan portfolio, mitigate these risks. Nevertheless, if delinquencies and defaults increase, we may be required to increase our provision for loan credit losses, which could have an adverse effect on our business, financial condition and results of operations.

Table of Contents

The appraisals and other valuation techniques we use in evaluating and monitoring loans secured by real property and other real estate owned may not accurately reflect the net value of the asset.

In considering whether to make a loan secured by real property, we generally require an appraisal of the property. However, an appraisal is only an estimate of the value of the property at the time the appraisal is made, and, as real estate values may change significantly in value in relatively short periods of time (especially in periods of heightened economic uncertainty), this estimate may not accurately reflect the net value of the collateral after the loan is made. As a result, we may not be able to realize the full amount of any remaining indebtedness when we foreclose on and sell the relevant property. In addition, we rely on appraisals and other valuation techniques to establish the value of OREO that we acquire through foreclosure proceedings and to determine loan impairments. If any of these valuations are inaccurate, our consolidated financial statements may not reflect the correct value of our OREO, if any, and our allowance for loan credit losses may not reflect accurate loan impairments. Inaccurate valuation of OREO or inaccurate provisioning for loan credit losses could have an adverse effect on our business, financial condition and results of operations. The Company did not have any OREO as of December 31, 2024.

Risks Related to Funding and Liquidity

Our deposit portfolio includes significant concentrations and a large percentage of our deposits are attributable to a relatively small number of customers.

We rely on a small number of large deposit customers, including high-average balance municipal deposits, as a source of funds. Our 10 largest depositor relationships accounted for approximately 17.5% of our deposits at December 31, 2024. Our largest depositor relationship accounted for approximately 3.7% of our deposits at December 31, 2024. These deposits can and do fluctuate substantially. The loss of any combination of these depositors, or a significant decline in the deposit balances due to ordinary course fluctuations related to these customers’ operations, could adversely affect our liquidity and require us to raise deposit rates to attract new deposits, purchase federal funds or borrow funds on a short-term basis to replace such deposits. Depending on the interest rate environment and competitive factors, low cost deposits may need to be replaced with higher cost funding, resulting in a decrease in net interest income and net income.

Limits on our ability to use brokered deposits as part of our funding strategy may adversely affect our ability to grow.

A “brokered deposit” is any deposit that is obtained from, or through the mediation or assistance of, a deposit broker. These deposit brokers attract deposits from individuals and companies throughout the country and internationally whose deposit decisions are based almost exclusively on obtaining the highest interest rates. Legislation excludes reciprocal deposits of up to the lesser of $5 billion or 20.0% of an institution’s total liabilities from the definition of brokered deposits, where the institution is well capitalized and has a composite supervisory rating of 1 or 2. We have used brokered deposits in the past, and we may continue to use brokered deposits as one of our funding sources to support future growth. As of December 31, 2024, brokered deposits represented approximately 14.6% of our total deposits. Reciprocal deposits represented an additional 17.3% of total liabilities at December 31, 2024.

There are risks associated with using brokered deposits. In order to continue to maintain our level of brokered deposits, we may be forced to pay higher interest rates than those contemplated by our asset-liability pricing strategy which could have an adverse effect on our net interest margin. In addition, banks that become less than “well capitalized” under applicable regulatory capital requirements may be restricted in their ability to accept or renew, or prohibited from accepting or renewing, brokered deposits. If this funding source becomes more difficult to access, we will have to seek alternative funding sources in order to continue to fund our growth. This may include increasing our reliance on Federal Home Loan Bank of Atlanta (“FHLB”) borrowing, attempting to attract additional non-brokered deposits, and selling loans. There can be no assurance that brokered deposits will be available, or if available, sufficient to support our future growth. The unavailability of a sufficient volume of brokered deposits could have an adverse effect on our business, financial condition and results of operations.

Liquidity risk could impair our ability to fund operations and meet our obligations as they become due.

Liquidity is essential to our business and we monitor our liquidity and manage our liquidity risk at the holding company and bank level. We require sufficient liquidity to fund asset growth, meet customer loan requests, customer deposit

Table of Contents

maturities and withdrawals, payments on our debt obligations as they come due and other cash commitments under both normal operating conditions and other unpredictable circumstances, including events causing industry or general financial market stress. Liquidity risk can increase due to a number of factors, which include, but are not limited to, an over-reliance on a particular source of funding, changes in the liquidity needs of our depositors, an increase in borrowing by our customers, adverse regulatory actions against us, or a downturn in the markets in which our loans are concentrated.

Market conditions or other events could also negatively affect the level or cost of funding, affecting our ongoing ability to accommodate liability maturities and deposit withdrawals, meet contractual obligations, and fund asset growth and new business transactions at a reasonable cost, in a timely manner, and without adverse consequences. The actual borrowing needs of our customers may exceed our expectations, especially during a challenging economic environment when our customers’ companies may be more dependent on our credit commitments due to the lack of available credit elsewhere, the increasing costs of credit, or the limited availability of financings from other sources. Our inability to raise funds through deposits, borrowings, the sale of loans, and other sources could have an adverse effect on our business, financial condition and results of operations, and could result in the closure of the Bank.

Other primary sources of funds consist of cash flows from operations, maturities and sales of investment securities and proceeds from issuance and sale of our equity and debt securities. Additional liquidity is provided by the ability to borrow from the FHLB, and the Federal Reserve Bank of Richmond (“Reserve Bank”) to fund our operations. We may also borrow funds from third-party lenders, such as other financial institutions. Our access to funding sources in amounts adequate to finance our activities or on acceptable terms could be impaired by factors that affect our organization specifically or the financial services industry or economy in general. Our access to funding sources could also be affected by a decrease in the level of our business activity as a result of a downturn in our primary market or by one or more adverse regulatory actions against us.

Any substantial, unexpected, and/or prolonged change in the level or cost of liquidity could impair our ability to fund operations and meet our obligations as they become due and could have an adverse effect on our business, financial condition and results of operations. Although we have historically been able to replace maturing deposits and advances if desired, we may not be able to replace such funds in the future if our financial condition, the financial condition of the FHLB or market conditions change. FHLB borrowings and other current sources of liquidity may not be available or, if available, sufficient to provide adequate funding for operations and to support our future growth. The unavailability of a sufficient funding could have an adverse effect on our business, financial condition and results of operations.

The proportion of our deposit account balances that exceed FDIC insurance limits may expose the Bank to enhanced liquidity risk in times of financial distress.

In the wake of the 2023 regional bank failures, which the FDIC concluded were generated by, in significant part, a high volume of uninsured deposits, many large depositors withdrew deposits in excess of applicable deposit insurance limits and deposited these funds in other financial institutions. In many instances, depositors moved these funds into money market mutual funds or other similar securities accounts in an effort to diversify the risk of further bank failure(s).

Uninsured deposits historically have been viewed by the FDIC as less stable than insured deposits. An interagency policy statement issued in July 2023 noted that banks should maintain actionable contingency funding plans that take into account a range of possible stress scenarios, assess the stability of their funding and maintain a broad range of funding sources, ensure that collateral is available for borrowing, and review and revise contingency funding plans periodically and more frequently as market conditions and strategic initiatives change.

Deposits that were not insured or not collateralized by securities represented 34.7% of total deposits as of December 31, 2024. If a significant portion of our deposits were to be withdrawn within a short period of time such that additional sources of funding would be required to meet withdrawal demands, we may be unable to obtain funding at favorable terms, which may have an adverse effect on our net interest margin. Moreover, obtaining adequate funding to meet our deposit obligations may be more challenging during periods of elevated prevailing interest rates, such as the present period. Our ability to attract depositors during a time of actual or perceived distress or instability in the marketplace may be limited. Further, interest rates paid for borrowings generally exceed the interest rates paid on deposits. This spread may be exacerbated by higher prevailing interest rates. In addition, because our available-for-sale investment securities lose value when interest rates rise, after-tax proceeds resulting from the sale of such assets may be diminished during periods when

Table of Contents

interest rates are elevated. Under such circumstances, we may be required to access funding from sources such as the Federal Reserve’s discount window in order to manage our liquidity risk.

Unrealized losses in our securities portfolio could affect liquidity.

As market interest rates increased in 2022 and 2023, we experienced significant unrealized losses on our available for sale securities portfolio. Unrealized losses related to available for sale securities are reflected in accumulated other comprehensive income in our consolidated balance sheets and reduce the level of our book capital and tangible common equity. However, such unrealized losses do not affect our regulatory capital ratios. We actively monitor our available for sale securities portfolio and we do not currently anticipate the need to sell securities for liquidity purposes. Furthermore, we believe it is unlikely that we would be required to sell any such securities before recovery of their amortized cost bases, which may be at maturity. Nonetheless, our access to liquidity sources could be affected by unrealized losses if securities must be sold at a loss; tangible capital ratios continue to decline from an increase in unrealized losses or realized credit losses; the FHLB or other funding sources reduce capacity; or bank regulators impose restrictions on us that impact the level of interest rates we may pay on deposits or our ability to access brokered deposits. Additionally, significant unrealized losses could negatively impact market and/or customer perceptions of our company, which could lead to a loss of depositor confidence and an increase in deposit withdrawals, particularly among those with uninsured deposits.

Risks Related to Our Business, Industry and Markets

We operate in a highly competitive market and face increasing competition from a variety of traditional and new financial services providers.

We have many competitors. Our principal competitors are commercial and community banks, credit unions, savings and loan associations, mortgage banking firms and online mortgage lenders and consumer finance companies, including large national financial institutions that operate in our market. Many of these competitors are larger than us, have significantly more resources, greater brand recognition and more extensive and established branch networks or geographic footprints than we do, and may be able to attract customers more effectively than we can. Because of their scale, many of these competitors can be more aggressive than we can on loan and deposit pricing, and may better afford and make broader use of media advertising, support services and electronic technology than we do. Also, many of our non-bank competitors have fewer regulatory constraints and may have lower cost structures. We compete with these other financial institutions both in attracting deposits and making loans. We expect competition to continue to increase as a result of legislative, regulatory and technological changes, the continuing trend of consolidation in the financial services industry and the emergence of alternative banking sources. Our profitability in large part depends upon our continued ability to compete successfully with traditional and new financial services providers, some of which maintain a physical presence in our market and others of which maintain only a virtual presence. Increased competition could require us to increase the rates we pay on deposits or lower the rates that we offer on loans, which could reduce our profitability.

Failure to keep up with the rapid technological changes in the financial services industry could have an adverse effect on our competitive position and profitability.

The financial services industry is undergoing rapid technological changes, with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions to better serve customers and reduce costs. Our future success will depend, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands for convenience, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements than we have. We may not be able to implement new technology-driven products and services effectively or be successful in marketing these products and services to our customers. Failure to keep pace successfully with technological change affecting the financial services industry could harm our ability to compete effectively and could have an adverse effect on our business, financial condition and results of operations. As these technologies improve in the future, we may be required to make significant capital expenditures in order to remain competitive, which may increase our overall expenses and have an adverse effect on our business, financial condition and results of operations.

Table of Contents

Interest rate shifts may reduce net interest income and otherwise negatively impact our financial condition and results of operations.

The majority of our banking assets are monetary in nature and subject to risk from changes in interest rates. Like most financial institutions, our earnings are significantly dependent on our net interest income, the principal component of our earnings, which is the difference between interest earned by us from our interest-earning assets, such as loans and investment securities, and interest paid by us on our interest-bearing liabilities, such as deposits and borrowings. We expect that we will periodically experience “gaps” in the interest rate sensitivities of our assets and liabilities, meaning that either our interest-bearing liabilities will be more sensitive to changes in market interest rates than our interest-earning assets, or vice versa. In either event, if market interest rates should move contrary to our position, this “gap” will negatively impact our earnings. Many factors impact interest rates, including governmental monetary policies, inflation, recession, changes in unemployment, the money supply, and international disorder and instability in domestic and foreign financial markets.

Interest rate increases often result in larger payment requirements for our borrowers, which increase the potential for default. At the same time, the marketability of the property securing a loan may be adversely affected by any reduced demand resulting from higher interest rates. In a declining interest rate environment, there may be an increase in prepayments on loans as borrowers refinance their loans at lower rates.

Changes in interest rates also can affect the value of loans, securities and other assets. An increase in interest rates that adversely affects the ability of borrowers to pay the principal or interest on loans may lead to an increase in nonperforming assets and a reduction of income recognized, which could have an adverse effect on our results of operations and cash flows.

If short-term interest rates remain elevated relative to longer-term interest rates, we could experience net interest margin compression as the rate of increase in the cost of our interest-bearing liabilities could outpace the rate in which we are able to re-price our interest-earning assets. Such an occurrence would have an adverse effect on our net interest income and results of operations.

Although we believe that we have implemented effective asset and liability management strategies to mitigate the potential adverse effects of changes in interest rates on our results of operations, any substantial or unexpected change in, or prolonged change in market interest rates could have an adverse effect on our financial condition and results of operations.

The fair value of our investment securities can fluctuate due to factors outside of our control.

We maintain an investment portfolio consisting of various high-quality liquid fixed-income securities. The total carrying value of the AFS securities portfolio as of December 31, 2024 was $130.3 million and the estimated duration of the portfolio was approximately 3.1 years. The nature of fixed-income securities is such that changes in market interest rates impact the value of these assets. Based on the duration of our AFS securities portfolio, a one percent increase or decrease in market rates is projected to negatively or positively impact the market value of the AFS securities portfolio by approximately $3.4 million and $3.4 million, respectively. Other factors beyond our control including, but are not limited to, rating agency actions in respect of the securities, defaults by the issuer or with respect to the underlying securities, and instability in the capital markets can also significantly influence the fair value of securities in our portfolio and can cause potential adverse changes to the fair value of these securities. Any of these factors, among others, could cause expected credit losses and realized and/or unrealized losses in future periods and declines in other comprehensive income, which could materially and adversely affect our business, financial condition or results of operations. The process for determining whether expected credit losses exist usually requires complex, subjective judgments about the future financial performance and liquidity of the issuer and collateral underlying the security. Our failure to correctly and timely assess any expected credit losses with respect to our securities could have an adverse effect on our business, financial condition or results of operations.

Inflation can have an adverse impact on our business and on our customers.

Prevailing price-wage inflation may cause us to give higher than normal raises to employees and start new employees at a higher wage. Furthermore, our clients are also affected by inflation and the rising costs of goods and services used in their households and businesses, which could have a negative impact on their ability to repay their loans with us. Higher interest

Table of Contents

rates reduce the demand for loans and increase the attractiveness of alternative investment and savings products, like U.S. Treasury securities and money market funds, which can make it difficult to attract and retain deposits.

Monetary policies and regulations of the Federal Reserve could have an adverse effect on our business, financial condition and results of operations.

Our earnings and growth are affected by the policies of the Federal Reserve. An important function of the Federal Reserve is to regulate the money supply and credit conditions. Among the instruments used by the Federal Reserve to implement these objectives are open market purchases and sales of U.S. government securities, adjustments of the discount rate and changes in banks’ reserve requirements against bank deposits. These instruments are used in varying combinations to influence overall economic growth and the distribution of credit, bank loans, investments and deposits. Their use also affects interest rates charged on loans or paid on deposits.

The monetary policies and regulations of the Federal Reserve have had a significant effect on the operating results of commercial banks in the past and are expected to continue to do so in the future. The effects of such policies upon our business, financial condition and results of operations cannot be predicted.

Risks Related to Our Operations

We are subject to certain operational risks, including, but not limited to, customer or employee fraud and data processing system failures and errors.

Employee errors and employee and customer misconduct could subject us to financial losses or regulatory sanctions and seriously harm our reputation. Misconduct by our employees could include hiding unauthorized activities from us, improper or unauthorized activities on behalf of our customers or improper use of confidential information. It is not always possible to prevent employee errors and misconduct, and the precautions we take to prevent and detect this activity may not be effective in all cases. Employee errors could also subject us to financial claims for negligence.

We maintain a system of internal controls and insurance coverage to mitigate against operational risks, including data processing system failures and errors and customer or employee fraud. If our internal controls fail to prevent or detect an occurrence, or if any resulting loss is not insured or exceeds applicable insurance limits, it could have an adverse effect on our business, financial condition and results of operations.

In addition, we rely heavily upon information supplied by third parties, including the information contained in credit applications, property appraisals, title information, equipment pricing and valuation and employment and income documentation, in deciding which loans we will originate, as well as the terms of those loans. In deciding whether to extend credit, we may rely upon customers’ representations that their financial statements conform to GAAP and present fairly the financial condition, results of operations and cash flows of the customer. We also may rely on customer representations and certifications, or other audit or accountants’ reports, with respect to the business and financial condition of our customers. If any of the information upon which we rely is misrepresented, either fraudulently or inadvertently, and the misrepresentation is not detected prior to asset funding, the value of the asset may be significantly lower than expected, or we may fund a loan that we would not have funded or on terms we would not have extended. Whether a misrepresentation is made by the customer or another third party, we generally bear the risk of loss associated with the misrepresentation. A loan subject to a material misrepresentation is typically unsellable or subject to repurchase if it is sold prior to detection of the misrepresentation. The sources of the misrepresentations are often difficult to locate, and it is often difficult to recover any of the monetary losses we may suffer. As a result, our business, financial condition and results of operations could be adversely affected if we rely on misleading, false, inaccurate or fraudulent information.

We rely on third parties to provide key components of our business infrastructure.

We rely on third parties to provide key components for our business operations, such as data processing and storage, recording and monitoring transactions, online banking interfaces and services, internet connections, and network access. While we select these third-party vendors carefully, we do not control their actions. Any problems caused by these third parties, including those resulting from breakdowns or other disruptions in communication services provided by a vendor, failure of a vendor to handle current or higher volumes, cyber-attacks and security breaches at a vendor, failure of a vendor to provide services for any reason, or poor performance of services by a vendor, could adversely affect our ability to deliver

Table of Contents

products and services to our customers and otherwise conduct our business. Financial or operational difficulties of a third-party vendor could also hurt our operations if those difficulties interfere with the vendor’s ability to serve us. Replacing these third-party vendors could create significant delays and expense that adversely affect our business and performance.

We follow a relationship-based operating model and our ability to maintain our reputation is critical to the success of our business and the failure to do so may materially adversely affect our performance.

We are a community bank, and our reputation is one of the most valuable components of our business. As such, we strive to conduct our business in a manner that enhances our reputation. This is done, in part, by recruiting, hiring and retaining bankers and other associates who share our core values of being an integral part of the communities we serve, delivering superior service to our customers and caring about our customers and associates. Furthermore, maintaining our reputation also depends on our ability to protect our brand name and associated trademarks.

However, reputation risk, or the risk to our business, earnings and capital from negative public opinion surrounding our Company and the financial institutions industry generally, is inherent in our business. Negative public opinion can result from our actual or alleged conduct in any number of activities, including business and lending practices, corporate governance and acquisitions, and from actions taken by government regulators and community organizations in response to those activities. Negative public opinion can adversely affect our ability to keep and attract customers and employees and can expose us to litigation and regulatory action. Although we take steps to minimize reputation risk in dealing with our customers and communities, this risk will always be present given the nature of our business.

If our reputation is negatively affected by the actions of our employees or otherwise, our business and operating results may be materially adversely affected.

We may be adversely affected by the lack of soundness of other financial institutions or market utilities.

Our ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services companies may be interrelated as a result of trading, clearing, counterparty, and other relationships. We have exposure to different industries and counterparties, and through transactions with counterparties in the financial services industry, including broker-dealers, commercial banks, investment banks, and other financial intermediaries. As a result, defaults by, declines in the financial condition of, or even rumors or questions about, one or more financial services companies, or the financial services industry generally, could lead to market-wide liquidity problems and losses or defaults by us or other institutions. These losses could have an adverse effect on our business, financial condition and results of operations.

External and internal risk has proliferated in recent years.

The shift in recent years to digital, mobile, and online platforms have resulted in a large volume of payment transactions being executed more quickly leaving banks less time to identify and counteract fraud, and recover the funds misappropriated by fraudulent actors. Moreover, the level of sophistication of fraud has increased in part due to greater collaboration among bad actors, including the exchange of stolen data, new techniques and expertise available on the dark web. The financial services industry is continually developing and forcing countermeasures to prevent, detect and remediate the ever-shifting fraud landscape and the ability to quickly adapt to new threats is a critical element of fraud prevention.

Our risk management framework may not be effective in mitigating risks and/or losses to us.

Our risk management framework is comprised of various processes, systems and strategies, and is designed to manage the types of risk to which we are subject, including, among others, credit, market, liquidity, interest rate and compliance. Our framework also includes financial or other modeling methodologies that involve management assumptions and judgment. Our risk management framework may not be effective under all circumstances. Our risk management framework may not adequately mitigate any risk or loss to us. If our risk management framework is not effective, we could suffer unexpected losses and our business, financial condition and results of operations could be adversely affected. We may also be subject to potentially adverse regulatory consequences.

Table of Contents

System failure or breaches of our network security, including as a result of cyber-attacks or data security breaches, could subject us to increased operating costs as well as litigation and other liabilities.

The computer systems and network infrastructure we use may be vulnerable to physical theft, fire, power loss, telecommunications failure or a similar catastrophic event, as well as security breaches, denial of service attacks, viruses, worms and other disruptive problems caused by hackers. Any damage or failure that causes breakdowns or disruptions in our customer relationship management, general ledger, deposit, loan and other systems could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny for failure to comply with required information security standards, or expose us to civil litigation and possible financial liability, any of which could have an adverse effect on us.

Computer break-ins, phishing and other disruptions could also jeopardize the security of information stored in and transmitted through our computer systems and network infrastructure. Information security risks have generally increased in recent years in part because of the proliferation of new technologies, the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists, and other external parties. Our operations rely on the secure processing, transmission and storage of confidential information in our computer systems and networks. In addition, to access our products and services, our customers may use devices that are beyond our control systems. Although we believe we have robust information security procedures and controls, our technologies, systems, networks, and our customers’ devices may become the target of cyber-attacks or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of the Bank’s or our customers’ confidential, proprietary and other information, or otherwise disrupt the Bank’s or our customers’ or other third parties’ business operations. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities.

The Bank is under continuous threat of loss due to hacking and cyber-attacks especially as we continue to expand customer capabilities to utilize internet and other remote channels to transact business. Two of the most significant cyber-attack risks that we face are e-fraud and loss of sensitive customer data. Loss from e-fraud occurs when cybercriminals breach and extract funds directly from customer or our accounts. Attempts to breach sensitive customer data, such as account numbers and social security numbers, present significant reputational, legal and/or regulatory costs to us if successful. Our risk and exposure to these matters remains heightened because of the evolving nature and complexity of these threats from cybercriminals and hackers, our plans to continue to provide internet banking and mobile banking channels, and our plans to develop additional remote connectivity solutions to serve our customers. We cannot assure that we will not be the victim of successful hacking or cyberattacks in the future that could cause us to suffer material losses. The occurrence of any cyber-attack or information security breach could result in potential liability to customers, reputational damage and the disruption of our operations, and regulatory concerns, all of which could adversely affect our business, financial condition or results of operations.

The Company’s business continuity plans or data security systems could prove to be inadequate, resulting in a material interruption in, or disruption to, its business and a negative impact on results of operations.

The Company relies heavily on communications and information systems to conduct its business. Any failure, interruption or breach in security of these systems, whether due to severe weather, natural disasters, cyber-attack, acts of war or terrorism, criminal activity or other factors, could result in failures or disruptions in general ledger, deposit, loan, customer relationship management and other systems. While the Company has disaster recovery and other policies and procedures designed to prevent or limit the effect of the failure, interruption or security breach of its information systems, there can be no assurance that any such failures, interruptions or security breaches will not occur or, if they do occur, that they will be adequately addressed. The occurrence of any failures, interruptions or security breaches of the Company’s information systems could damage its reputation, result in a loss of customer business, subject it to additional regulatory scrutiny or expose it to civil litigation and possible financial liability, any of which could have a material adverse effect on results of operations.

Table of Contents

We are dependent on the use of data and modeling in both our management’s decision-making generally and in meeting regulatory expectations in particular.

The use of statistical and quantitative models and other quantitatively-based analyses is endemic to bank decision making and regulatory compliance processes, and the employment of such analyses is becoming increasingly widespread in our operations. Liquidity stress testing, interest rate sensitivity analysis, allowance for loan credit loss measurement, portfolio stress testing and the identification of possible violations of anti-money laundering regulations are examples of areas in which we are dependent on models and the data that underlie them. We anticipate that model-derived insights will be used more widely in our decision making in the future. While these quantitative techniques and approaches improve our decision making, they also create the possibility that faulty data or flawed quantitative approaches could yield adverse outcomes or regulatory scrutiny. Secondarily, because of the complexity inherent in these approaches, misunderstanding or misuse of their outputs could similarly result in suboptimal decision making, which could have an adverse effect on our business, financial condition and results of operations.

We are exposed to risk of environmental liabilities with respect to properties to which we obtain title.

A significant portion of our loan portfolio is secured by real estate. In the course of our business, we may foreclose and take title to real estate and could be subject to environmental liabilities with respect to these properties. We may be held liable to a government entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination, or may be required to clean up hazardous or toxic substances, or chemical releases at a property. The costs associated with investigation and remediation activities could be substantial. In addition, if we are the owner or former owner of a contaminated site, we may be subject to common law claims by third parties based on damages and costs resulting from environmental contamination emanating from the property. These costs and claims could adversely affect our business, results of operations and prospects.

Risks Related to our Regulatory Environment

Our industry is highly regulated, and the regulatory framework, together with any future legislative or regulatory changes, may have a materially adverse effect on our operations.

John Marshall Bancorp, Inc. JMSB US Equity

JMSB · 10-K · period ended 2024-12-31

Item 1.Business

Item 1A.Risk Factors

John Marshall Bancorp, Inc. JMSB US Equity☆

JMSB · 10-K · period ended 2024-12-31

Item 1.Business

Item 1A.Risk Factors

John Marshall Bancorp, Inc. JMSB US Equity