MNSB US Equity☆

main20251231_10k.htm

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

(Mark One)

For the fiscal year ended December 31, 2025

OR

Commission File Number001-38817

MainStreet Bancshares, Inc.

(Exact name of Registrant as specified in its Charter)

(Address of principal executive offices) (Zip Code)

Registrant’s telephone number, including area code: (703)481-4567

Securities registered pursuant to Section 12(b) of the Act:

Title of each class Trading Symbol(s) Name of each exchange on which registered

Common Stock MNSB The Nasdaq Stock Market LLC

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the Registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. yes ☐ No ☒

Indicate by check mark if the Registrant is not required to file reports pursuant to Section 13 or 15(d) of the Act. yes ☐ No ☒

Indicate by check mark whether the Registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the Registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ no ☐

Indicate by check mark whether the Registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the Registrant was required to submit such files). Yes ☒ no ☐

Indicate by check mark whether the Registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer ☐ Accelerated filer ☒

Non-accelerated filer ☐ Smaller reporting company ☒

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the Registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the Registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the Registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the Registrant's executive officers during the relevant recovery period pursuant to section 240.10D-1(b). ☐

Indicate by check mark whether the Registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). yes ☐ no ☒

As of June 30, 2025, the last business day of the Registrant’s most recently completed second fiscal quarter, the aggregate market value of the shares of common equity held by non-affiliates of the Registrant, based on the closing price of the shares of common stock on The NASDAQ Stock Market, was $145,606,299. The number of shares of Registrant’s Common Stock outstanding as of March 6, 2026 was 7,366,049.

DOCUMENTS INCORPORATED BY REFERENCE:

The information required by Part III of this Annual Report on Form 10-K will be found in portions of the Registrant’s definitive proxy statement for its 2026 Annual Meeting of Shareholders, to be filed pursuant to Regulation 14A under the Securities Exchange Act of 1934, and such information is incorporated herein by this reference.

INDEX

Page

PART I

Item 1. Business 3

Item 1A. Risk Factors 18

Item 1B. Unresolved Staff Comments 30

Item 1C. Cybersecurity 30

Item 2. Properties 31

Item 3. Legal Proceedings 31

Item 4. Mine Safety Disclosures 31

PART II

Item 6. [Reserved] 33

Item 7A. Quantitative and Qualitative Disclosures About Market Risk 59

Item 8. Financial Statements and Supplementary Data 61

Item 9A. Controls and Procedures 99

Item 9B. Other Information 99

Item 9C. Disclosures Regarding Foreign Jurisdictions that Prevent Inspections 99

PART III

Item 10. Directors, Executive Officers and Corporate Governance 100

Item 11. Executive Compensation 100

Item 14. Principal Accountant Fees and Services 100

PART IV

Item 15. Exhibits, Financial Statement Schedules 101

2

PART I

Item 1. Business

As used herein, the “Company,” “we,” “our,” and “us” refer to MainStreet Bancshares, Inc., and the “Bank” refers to MainStreet Bank.

Overview

MainStreet Bancshares, Inc. is a financial holding company that owns 100% of MainStreet Bank and MainStreet Community Capital, LLC. On October 12, 2021, the Company filed an election to be a financial holding company with the Board of Governors of the Federal Reserve System (the “Federal Reserve”). The Company elected financial holding company status in order to engage in a broader range of financial activities than are permitted for bank holding companies generally. We emphasize providing responsive and personalized services to our clients. Due to the consolidation of financial institutions in our primary market area, we believe there is a significant opportunity for a local bank to provide a full range of financial services. By offering highly professional, personalized banking products and service delivery methods and employing advanced banking technologies, we seek to distinguish ourselves from larger, regional banks operating in our market area and are able to compete effectively with other community banks.

MainStreet Bancshares, Inc.

MainStreet Bancshares Inc. is a bank holding company incorporated under the laws of the Commonwealth of Virginia whose principal activity is the ownership and management of MainStreet Bank and MainStreet Community Capital, LLC. The Company is authorized to issue 15,000,000 shares of common stock, par value $4.00 per share. Additionally, the Company is authorized to issue 2,000,000 shares of preferred stock, par value $1.00 per share. There were 7,496,571, shares of common stock outstanding and 28,750 shares of 7.50% Series A Fixed-Rate Non-Cumulative Perpetual Preferred Stock outstanding at December 31, 2025. At that date, there were also outstanding 1,150,000 depositary shares, each representing a 1/40th interest in a share of the Company’s Series A Preferred Stock, with a liquidation preference of $1,000 per share (equivalent to $25 per depositary share).

The Company is a registered bank holding company which is governed under the Bank Holding Company Act of 1956, as amended (the “Bank Holding Act”), that has elected to be a financial holding company. As such, is subject to inspection, examination, and supervision by the Federal Reserve.

The Company’s executive offices are located at 10089 Fairfax Boulevard, Fairfax, Virginia. Our telephone number is (703) 481-4567, and our internet address is www.mstreetbank.com. The information contained on our website shall not be considered part of this Form 10-K, and the reference to our website does not constitute incorporation by reference of the information contained on the website. The Company acquired the property located in Middleburg, VA during 2025 but the branch officially commenced retail banking operations on February 9, 2026.

MainStreet Bank

MainStreet Bank is a community commercial bank incorporated in and chartered by the Commonwealth of Virginia. The Bank is a member of the Federal Reserve Bank of Richmond, and its deposits are insured by the FDIC. The Bank opened for business on May 26, 2004, and is headquartered in Fairfax, Virginia. We currently operate seven Bank branches; located in Herndon, Fairfax, McLean, Clarendon, Leesburg, and Middleburg, Virginia, and one in Washington D.C.

The Bank is a community bank focused on serving the borrowing, cash management and depository needs of retail customers, small to medium-sized businesses, and professionals. We believe we have a solid franchise that meets the financial needs of our clients and communities by providing an array of personalized products and services delivered by seasoned banking professionals with decisions made at the local level. We believe a significant customer base in our market prefers to do business with a local institution that has a local management team, a local Board of Directors and local founders and that this customer base may not be satisfied with the responsiveness of larger regional banks. By providing quality services, coupled with the opportunities provided by the economies in our market area, we have generated and expect to continue to generate organic growth.

We service Northern Virginia as well as the greater Washington, D.C. metropolitan area. Our goal is to deliver a customized and targeted mix of products and services that meets or exceeds customer expectations. To accomplish this goal, we have deployed a premium operating system that gives customers access to up-to-date banking technology. These systems and our skilled staff have allowed us to compete aggressively with larger financial institutions. We believe the combination of sophisticated technology and personal service sets us apart from our competition. We strive to be the leading community bank in our market.

We offer a full range of banking services to individuals, small to medium-sized businesses and professional service organizations through both traditional and electronic delivery. We were the first community bank in the Washington, D.C. metropolitan area to offer a full online business banking solution, including remote check scanners on a business customer’s desktop. We offer mobile banking apps for iPhones, iPads and Android devices that provide for remote deposit of checks. In addition, we were the first bank headquartered in the Commonwealth of Virginia to offer the Certificate of Deposit Account Registry Service ("CDARS"), an innovative deposit insurance solution from the IntraFi Network, LLC ("IntraFi") that provides Federal Deposit Insurance Corporation (“FDIC”) insurance on deposits up to $50 million. The Bank also participates in the IntraFi Insured Cash Sweep ("ICS") program, which also functions to provide greater FDIC insurance coverage for participating customers. We believe that enhanced electronic delivery systems and technology increase profitability through greater productivity and cost control, and allow us to offer new and better products and services.

The Bank has one subsidiary, a limited liability company, that it uses to hold real estate acquired through foreclosure.

Our products and services include: business and consumer checking, premium interest-bearing checking, business account analysis, savings, certificates of deposit and other depository services, as well as a broad array of commercial, real estate and consumer loans. Internet account access is available for all personal and business accounts, internet bill payment services are available on most accounts, and a robust online cash management system is available for business customers.

MainStreet Community Capital, LLC

In September 2021, the Company created a community development entity (“CDE”) subsidiary, MainStreet Community Capital, LLC, a Virginia limited liability company, to apply for New Market Tax Credit (“NMTC”) allocations from the U.S. Department of Treasury’s Community Development Financial Institutions Fund. To promote development in economically distressed areas, the NMTC program was established under the Community Renewal Tax Relief Act of 2000 to provide tax incentives for capital investment in disadvantaged market areas that have not experienced economic expansion. The program establishes a tax credit for investment in a CDE and ongoing compliance with the program is accomplished through a governing board and an advisory board which maintains accountability to residents and businesses in the aforementioned disadvantaged areas. This CDE will be an intermediary vehicle for the provision of loans and investments in Low-Income Communities (“LICs”). In January 2022, the Community Development Financial Institutions Fund (“CDFI”) of the United States Department of the Treasury certified MainStreet Community Capital, LLC as a registered CDE.

3

Nasdaq Listing

We were approved to list shares of our common stock on the Nasdaq Capital Market under our current symbol “MNSB” as of April 22, 2019. We were approved to list our depositary shares on the Nasdaq Capital Market under the symbol “MNSBP” as of September 16, 2020. Each depository share represents a 1/40th interest in a share of our 7.50% Series A Fixed-Rate Non-Cumulative Perpetual Preferred stock.

Our Business

We are a community-oriented financial institution. Our Bank offers a wide range of commercial and consumer loan and deposit products, as well as mortgage services to individuals, and small and medium sized businesses in our market. We seek to be the provider of choice for financial solutions to customers who value exceptional personalized service, local decision making, and modern banking technology. Our business involves attracting deposits from local businesses and individual customers and using these deposits to originate commercial, mortgage, and consumer loans in our market area. We also invest in securities consisting primarily of obligations of U.S. government sponsored entities, municipal obligations, mortgage-backed securities issued by Fannie Mae, Freddie Mac and Ginnie Mae, and the subordinated debt of other financial institutions. We also invest in NMTC funds that furthers our mission to provide opportunities to areas in need. The Company is the owner and beneficiary of bank owned life insurance (BOLI) policies on certain current and former Bank employees. These policies generate income and can be liquidated, if necessary, with associated tax costs.

The Federal Reserve and the Virginia State Corporation Commission, through its Bureau of Financial Institutions (the “Bureau”), regulate and monitor operations of the Company and the Bank. We are required to file with the FDIC quarterly financial condition and performance reports. The Federal Reserve and the Bureau conduct periodic onsite and offsite examinations. We must comply with a wide variety of reporting requirements and banking regulations. The laws and regulations governing us generally have been promulgated to protect depositors and the federal deposit insurance funds and not to protect shareholders. Additionally, we must bear the cost of compliance with the reporting and regulations; these costs can be significant and may have an effect on our financial performance.

We are focused on growing business relationships and building core deposits, loans and non-interest income. We strive to be the leading community bank in our markets. As of December 31, 2025, MainStreet Bancshares, Inc. had total consolidated assets of $2.21 billion, total net loans of $1.8 billion, total deposits of $1.9 billion and total stockholders’ equity of $218.6 million, and total tangible equity to total tangible assets was 9.88%. For the years ended December 31, 2025 and 2024, our return on average assets was 0.73% and (0.47)%, respectively, and our return on average equity was 7.33% and (4.44)%, respectively.

We believe that our core lending and deposit business segments continue to perform well. For each of the fiscal years ended December 31, 2025 and December 31, 2024, our net charge-offs to average loans were 0.00% and 0.25%, respectively. As of December 31, 2025, we had $31.5 million in non-performing loans and $1.7 million in other real estate owned. As of December 31, 2025, non-performing assets to total assets was 1.50%.

Management believes that the Company is well positioned to build on its core performance to continue to grow profitably. Although we have successfully attracted new associates, providing depth and talent in key positions, additional employees and infrastructure may be needed to manage the increasing customer relationships that would come with sustained growth.

Our Market Area. We consider our primary market area to be the northern Virginia counties of Arlington, Fairfax, Loudoun, and Prince William, and the cities of Fairfax, Alexandria, Falls Church, Leesburg, Middleburg, Manassas and Manassas Park, as well as Washington DC and the greater Washington, DC metropolitan area. Our headquarters is located approximately 15 miles west of Washington, D.C., in Fairfax County, Virginia.

4

According to the U.S. Census Bureau, the Washington, D.C. Metropolitan Statistical area (MSAs) includes three of the wealthiest counties in the United States, as well as six of the top 20 wealthiest counties. Median household income growth projections range from 8% to over 12% through 2031. Overall, the Washington D.C. MSA ranks seventh out of the largest 25 MSAs ranked by population estimates as of 2024 according to the Census Bureau. We expect our strategies to benefit from the continued growth in population and high income of our market area’s residents.

The Washington, D.C. MSA is a desirable market for a broad range of companies in a variety of industries, including twenty-nine companies from the 2025 Fortune 500 list, and eleven of the United States’ largest 200 private companies, according to the 2025 Forbes list of largest private companies by revenue. According to the U.S. Bureau of Labor Statistics, the Washington, D.C. MSA has a large and diversified economy. The following table provides an in-depth view of the distribution of employment within the Washington, D.C. MSA.

Washington, D.C. MSA Employment by Sector Employment Sector by Percent

Mining, Lodging, and Construction 5.3%

Manufacturing 1.7%

Trade, Transportation, and Utilities 12.0%

Information 2.4%

Financial Activities 4.6%

Professional and Business Services 23.6%

Education and Health Services 14.8%

Leisure and Hospitality 9.5%

Other Services 5.6%

Government 20.5%

As the home of the federal government, the broader Washington, D.C. region benefits from consistent population growth and remains well positioned to capitalize on any increase in government spending and infrastructure. Further, as banks in our market have experienced continued consolidation over the last few years, our opportunities to attract talented employees and capitalize on customer dislocation have improved. With its strong demographic characteristics, scale and robust economic activity we believe that the Washington, D.C. metropolitan area represents a strong geographic market for us to realize our continued growth strategies within our core business model.

The Company is active in community development activities that include support for affordable housing for low- or moderate-income (LMI) individuals, including multifamily rental housing, promoting economic development by financing small businesses or farms, revitalizing or stabilizing LMI geographies or designated disaster areas, and targeting support for community services to LMI individuals. The Company also makes qualified investments that target these initiatives within our geographic footprint. In addition, many of our employees and directors are involved in community activities as well as volunteer their time and expertise to local causes. The Company created its "Making Change" program in 2023 to allow our employees to get involved in corporate giving. Each employee has an amount of funds each year that they can choose to donate to a local organization, individuals, or families. Employees can pool their funds for a larger donation to their chosen cause.

5

Competitive Strengths. We continually review our product and service offerings and based on these reviews may selectively add additional products and services to provide further diversification of our revenue sources and to capture our customers’ full banking relationships. We believe that the following business strengths have been instrumental to the success of our core operations and will enable us to continue profitable growth and to maximize value to our shareholders, while remaining fundamentally sound.

Community Banking Philosophy. We provide our clients with local decision making and individualized service coupled with products and services offered by our larger institutional competitors. As our business lenders, officers, and directors are based in or reside in the communities we serve, we are able to maintain a high-level of involvement in local organizations and establish a strong understanding of the banking needs of the respective communities. We believe that our customer-centric business philosophy and sales approach enables us to build long-term relationships with desirable customers, which enhances the quality and stability of our funding and lending operations. Our mission and philosophy have positioned us well in the communities across our market area and have enabled us to attract and maintain a very talented and experienced management team.

Disciplined Credit Culture. We achieve our strong credit quality by adherence to sound underwriting and credit administration standards and by maintaining long-term customer relationships. All credit decisions between $250,000 and $750,000 require concurrence of the Chief Lending Officer and the Chief Credit Officer. Approvals of credits in excess of $750,000 require full consensus of the Officer’s Loan Committee. We maintain an independent loan review team, and senior management is actively involved with any credits requiring special attention.

Capital Position. The Bank exceeds the regulatory guidelines to be classified as “well capitalized.” Our capital position remains strong. At December 31, 2025, the Bank had a tier 1 leverage capital ratio of 13.28%, a common equity tier 1 risk-based capital ratio of 15.05%, a tier 1 risk-based capital ratio of 15.05%, and a total risk-based capital ratio of 16.08%. We believe that our capital position enhances our ability to grow organically because it enables the Bank to continue lending and to remain focused on our customers’ needs. For additional information, see Note 16 of Notes to Consolidated Financial Statements.

Technology. We have invested in the technology necessary to meet the developing demands of our commercial and retail customers. We utilize a strong core operating system that enables us to efficiently offer high-end deposit and loan products and have partnered with industry-leading internet banking, cash management, mobile banking, and application-based banking solutions to offer a complete banking experience to all customers, regardless of their preference. We participate in an international and nationwide automated teller machine network in order to offer our customers ATM transactions at over 55,000 locations in the United States, Canada, United Kingdom, and Mexico.

Growth Opportunities. We believe that we can attract new customers and expand our total loans and deposits within our existing market areas through organic growth, online and mobile banking, strategic branching and possible acquisition opportunities. We expect our market will continue to create opportunities to attract new clients and, in some cases, may become the catalyst for mergers and acquisitions. We expect to grow our loan portfolio, open new branches and consider acquisitions only after rigorous due diligence and substantial quantitative analysis regarding the financial and capital impacts of any such transactions. We believe that maintaining our financial discipline will generate long-term shareholder value.

Lending Activities. The Bank’s primary market focus is on making loans to small businesses, professionals and other consumers in its local market area, along with various aspects of real estate finance. Owner-occupied and investment commercial real estate loans represent the largest segments of the Bank’s loan portfolio. The Bank’s primary lending activities are principally directed to its defined market area in Northern Virginia, as well as the greater Washington, D.C. metropolitan area.

We offer a diversified loan portfolio consisting primarily of commercial business and owner-occupied and investment commercial real estate loans with higher risk-adjusted returns, shorter maturities and more sensitivity to interest rate fluctuations, while still providing high quality loan products for single-family and multi-family residential borrowers.

6

Commercial Business Lending. Commercial loans are written for a variety of business purposes, including government contract receivables, plant and equipment, general working capital, contract administration and acquisition lending. We are also a Preferred Lender for the Small Business Administration (SBA). Our client base is diverse, and we do not have a concentration of commercial business loans in any specific industry segment.

Commercial Real Estate Lending. We finance owner-occupied and investment commercial real estate. Our underwriting policies and processes focus on the client’s ability to repay the loan as well as an assessment of the underlying real estate. Risks inherent in managing a commercial real estate portfolio relate to sudden or gradual drops in property values as well as changes in the economic climate. We attempt to mitigate those risks by carefully underwriting loans of this type and by following appropriate loan-to-value standards. Commercial real estate loans represent the largest segment of the Bank’s loan portfolio. At December 31, 2025, approximately 24.0% of our loan portfolio related to owner occupied commercial real estate loans, and approximately 30.4% of our loan portfolio related to investment commercial real estate.

Real Estate Construction Lending. This segment of our portfolio is predominately residential in nature and is composed of loans with short durations. We offer real estate construction financing to customers that have in place a permanent loan “take-out,” either by the Bank or another institution. Our approach to this type of lending reduces our credit risk, yet offers a competitive product in the marketplace. We also offer construction financing to many local home builders. These loans are also short duration and carefully underwritten with an increased focus on the builder’s reputation and ability to deliver high quality homes on time and within budget.

We also stress test the construction lending portfolio based upon the percentage of completion method by stressing the as-is and as-completed appraised values. For further details, see stress test methodology in the Management's Discussion and Analysis.

Residential Real Estate Lending. The Bank offers a variety of consumer-oriented residential real estate loans both for purchase and refinancing.

Consumer Installment Lending. We offer consumer loans including term loans, home equity lines of credit, and overdraft protection.

Credit Policies and Administration. The Bank has adopted a comprehensive lending policy, which includes a well-defined risk tolerance and stringent underwriting standards for all types of loans. Management believes that it employs experienced lending officers, secures appropriate collateral and carefully monitors the financial conditions of its borrowers.

In addition to normal repayment risks, all loans in the Bank’s portfolio are subject to the state of the economy and the related effects on the borrower and/or the real estate market. Generally, longer-term loans have periodic interest rate adjustments and/or call provisions. Senior management monitors the loan portfolio closely to minimize past due loans and swiftly address potential problem loans. In addition to the internal business processes employed in the credit administration area, the Bank engages an outside or independent credit review firm to review the loan portfolio annually. Results of the credit review are used to validate our internal loan ratings and to review independent commentary on specific loans and loan administration activities.

Lending Limit. As of December 31, 2025, our legal lending limit for loans to one borrower was approximately $46.3 million. The Bank “in-house” lending limit is 50% of the legal lending limit for all relationships unless the loan is owner occupied, 1-4 family/residential or a government contract line of credit. If owner occupied, 1-4 family or a government contractor, the “in-house” lending limit is 90% of the legal lending limit for "Good" rated credits; 85% for "Standard" rated credits and 75% for "Acceptable" rated credits. Our loan policy prescribes a sub-limit to certain borrowers based upon our determination of each borrower’s credit quality. We routinely participate loan amounts in excess of our policy limits to other financial institutions.

For additional information, see Note 1 and Note 5 of Notes to Consolidated Financial Statements.

Investments and Funding. The Bank balances its liquidity needs based on loan and deposit growth through the investment portfolio and purchased funds. It is the Bank’s goal to provide adequate liquidity to support the loan growth of the Bank. In the event the Bank has excess liquidity, investment securities are used to generate additional income. In the event deposit growth does not fully support the Bank’s loan growth, the Bank will utilize deposit listing services, borrowed funds, or incorporate a combination of sales of investment securities, federal funds and other purchased/borrowed funds in order to augment the Bank’s funding position.

7

The current investment policy authorizes the Bank to invest in debt securities issued by the United States Government, agencies of the United States Government, or United States Government-sponsored enterprises. The policy permits investments in mortgage-backed securities, including pass-through securities, issued and guaranteed by Fannie Mae, Freddie Mac and Ginnie Mae. The investment policy also permits investments in federal funds and deposits in other insured institutions. In addition, management is authorized to invest in investment grade state and municipal obligations, private mortgage-backed securities, the subordinated debt of other financial institutions and equity investments in funds designed to help LMI geographies. The Bank does not engage in any hedging or trading activities in its investment portfolio. The Company is also the owner and beneficiary of bank owned life insurance (BOLI) policies on certain current and former Bank employees. These policies generate income and can be liquidated, if necessary, with associated tax costs.

Generally accepted accounting principles require that, at the time of purchase, the Bank designate a security as “held-to-maturity,” “available-for-sale,” or “trading,” depending on our ability and intent to hold such security. Debt securities available-for-sale are reported at fair value, while debt securities held-to-maturity are reported at amortized cost. The Bank does not maintain a trading portfolio. Establishing a trading portfolio would require specific authorization by the Board of Directors.

The investment portfolio is actively managed and consists of investments classified as available-for-sale (AFS) and held-to-maturity (HTM). Under the available-for-sale classification, investment instruments may be sold as deemed appropriate by management. On a monthly basis, the investment portfolio is marked to market as required by ASC 320. Additionally, the investment portfolio is used to balance the Bank’s asset and liability position. The Bank invests in fixed rate or floating rate instruments as necessary to reduce interest rate risk exposure.

At December 31, 2025, the held-to-maturity portfolio, which is primarily composed of municipal securities, and is carried at amortized cost, totaled $13.8 million. At December 31, 2025, the available-for-sale portfolio, which is composed of collateralized mortgage-backed securities, subordinated debt of other financial institutions, preferred stock, municipal securities, and U.S. Government agency securities and is carried at fair value, totaled $58.0 million. For additional information, see Note 3 of the Notes to Consolidated Financial Statements.

Subordinated Notes. In April of 2021, the Company completed an issuance and sale of $30 million in fixed-to-floating subordinated notes. The net proceeds were used to fully call subordinated notes issued in 2016 and to support additional growth for other general business purposes. The notes have a maturity date of April 15, 2031 and an annual fixed interest rate of 3.75% until April 15, 2026. After April 15, 2026, the notes will have a floating interest rate based on three-month SOFR rate plus 302 basis points (3.02%) (computed on the basis of a 360-day year of twelve 30-day months) from and including April 15, 2026, to the maturity date or any early redemption date. Interest will be paid semi-annually, in arrears, on July 1 and January 1 of each year during the time that the notes remain outstanding through the fixed interest rate period or earlier redemption date. Interest will be paid quarterly, in arrears, on April 15, July 15, October 15 and January 15 throughout the floating interest rate period or earlier redemption date.

On March 1, 2022, the Company completed the issuance of $43.8 million in aggregate principal amount of fixed-to-floating rate subordinated notes in a private placement transaction to various accredited investors. The net proceeds of the offering have been and will be used to support growth and for other general business purposes. The notes have a maturity date of March 15, 2032, and have an annual fixed interest rate of 4.00% until March 15, 2027. Thereafter, the notes will have a floating interest rate based on three-month SOFR rate plus 233 basis points (2.33%) (computed on the basis of a 360-day year of twelve 30-day months) from and including March 15, 2027, to the maturity date or any early redemption date. Interest will be paid semi-annually, in arrears, on March 15 and September 15 of each year during the time that the notes remain outstanding through the fixed interest rate period or earlier redemption date. Interest will be paid quarterly, in arrears, on March 15, June 15, September 15 and December 15 throughout the floating interest rate period or earlier redemption date.

Deposit Activities. Deposits are the major source of funding for the Bank. The Bank offers a broad array of deposit products that include demand, NOW, money market and savings accounts as well as certificates of deposit. The Bank typically pays a competitive rate on the interest-bearing deposits. As a relationship-oriented organization, we seek to obtain deposit relationships with our loan clients.

We offer a full range of consumer and commercial deposit products, including online banking with bill pay, cash management, sweep accounts, wire transfer, check imaging, remote deposit capture and courier services.

As the Bank’s overall balance sheet positions dictate, we may become more or less competitive in our interest rate structure as our liquidity position changes. Additionally, we may use wholesale deposits through sources such as deposit listing services, school systems, government entities and other sources to augment our funding position.

We can also arrange for FDIC insurance for deposits up to $50 million through CDARS, the Certificate of Deposit Account Registry Service, which provides a convenient method for a depositor to enjoy full FDIC insurance on deposits up to $50 million through a single banking relationship. The Bank also participates in the IntraFi Insured Cash Sweep ("ICS") program, which also functions to provide greater FDIC insurance coverage for participating customers.

For additional information on deposits, see Note 9 of Notes to Consolidated Financial Statements.

Competition. We face significant competition for the origination of loans and the attraction of deposits. Our competition for loans comes primarily from financial institutions in our market area and, to a lesser extent, from other financial service providers, such as mortgage companies and mortgage brokers. Competition for loans also comes from the increasing number of non-depository financial service companies entering the mortgage market, such as insurance companies, securities companies and specialty finance companies. Our most direct competition for deposits has historically come from other financial institutions operating in our market area. We also face competition for investors’ funds from money market funds, mutual funds and other corporate and government securities.

Board Leadership and Oversight

The Board of Directors combines the position of Chairman of the Board with the position of Chief Executive Officer, coupled with a Lead Independent Director position to further strengthen the Company's corporate governance structure. The Board of Directors believes this provides an efficient and effective leadership model for the Company.

The Board of Directors also believes administration of its risk oversight function is enhanced by the Board's leadership structure. To assure effective independent oversight, the Board has adopted appropriate governance practices, including:

Risk Management

The Board of Directors is actively involved in oversight of risks that could affect the Company. This oversight is conducted in part through the Audit and Risk Committee of the Board of Directors, but the full Board of Directors has retained responsibility for general oversight of risks. The Chief Risk Officer has reporting lines to the Audit and Risk Committee and are free to contact independent Directors whenever they feel the need to do so.

The Board of Directors satisfies this responsibility through full reports by the Audit and Risk Committee regarding its considerations and actions, regular reports directly from officers responsible for oversight of risks within the Company as well as through internal and external audits. The Audit and Risk Committee conducts an annual assessment of its performance and capabilities.

Risks relating to the direct operations of the Bank are further overseen by the Board of Directors of the Bank. The Board of Directors of the Bank also has additional committees that conduct risk oversight separate from the Company. Further, the Board of Directors oversees risks through the establishment of policies and procedures that are designed to guide daily operations in a manner consistent with applicable laws, regulations and risks acceptable to the organization.

Risk is inherent with every business, particularly financial institutions. We face a number of risks, including credit risk, interest rate risk, liquidity risk, operational risk, legal risk, strategic risk and reputation risk. Management is responsible for the day-to-day management of the risks the Company faces, while the Board has responsibility for the oversight of risk management. In its risk oversight role, the Board of Directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are adequate and functioning as designed. Senior management meets regularly to discuss strategy and risks facing the Company. Senior management attends the Board meetings and is available to address any questions or concerns raised by the Board on risk management and any other matters. The independent members of the Board provide independent oversight of the Company's management and affairs.

8

Environmental, Social, and Governance

At MainStreet Bancshares Inc., our overarching focus is to make a positive impact on the communities we serve. The Board and management are aligned regarding the importance of Environmental, Social and Governance (ESG) initiatives, and we believe that an emphasis on sustainability can strengthen risk management and enhance value. As we look to the future, we recognize that ESG initiatives require a commitment to the long term, and making an impact requires a willingness to listen to, learn from, and work with stakeholders across our community.

Environmental

The Company has a goal of reducing its carbon emissions each year.

MainStreet Bank’s origins as a “branch-lite” financial institution mean that we have been and will continue to be part of the transition to a sustainable economy that is kinder to our environment because it is less dependent on carbon fuels. Most banks the Company’s size have 20+ branches. The Bank has six locations. The Company has adopted a strategy of Put Our Bank in Your Office®, which also allows customers to conduct business with us without traveling to the Bank. On average, more than 70% of daily transactions are processed by our customers without the need to come to the Bank. These changes were underway at the Bank long before COVID-19 forced behavioral patterns in our society to change. For business operators in particular, our remote banking solutions have reduced the need to make frequent visits to a branch bank to deposit cash and checks. This helps to reduce vehicular traffic in our already crowded market.

The Company has converted all lighting to LED, scheduled HVAC units for maximum efficiency during off-work hours, incorporated mini-split units for specific location heating and cooling, tinted windows to reduce cooling needs and increased the number of indoor plants to improve air quality.

The Company has also added charging stations to accommodate employees who drive electric vehicles and encourages the purchase of hybrid vehicles.

We recognize the growing environmental risks of electronic waste and have procedures in place to reduce our impact in this regard. For example, MainStreet Bank contracts with an asset disposal company to ensure that electronic assets, including monitors, security cameras, and batteries, are disposed of and recycled in an appropriate and environmentally sensitive manner.

We have long allowed and even encouraged our employees to telecommute. Approximately 8% of our employees work remotely full-time. All but our relatively lean team of branch staff are eligible to telecommute, and most do so at least a few days a month. These arrangements give us a broader and more diverse pool of applicants in recruiting, and also serve to reduce our employees’ carbon footprint.

In our lending portfolio, we seek opportunities to support energy efficiency and renewable energy.

Social

In 2022, the establishment of MainStreet Community Capital is another business initiative we have taken to support ESG initiatives in our communities. MainStreet Community Capital's focus is to invigorate distressed, low-income communities in the Washington, D.C., metropolitan area by providing capital and other financial services. These investments are intended to spur the creation of quality jobs and services in underserved areas. MainStreet Community Capital has earned its designation as a Community Development Entity (CDE) as defined under the U.S. Treasury Department's Community Development Financial Institution (CDFI) Fund. MainStreet Community Capital has applied to the CDFI Fund for an allocation of the New Markets Tax Credits , and plans to continue to do so annually.

Turning to our staff, as of December 31, 2025, the Company employed 171 full-time employees. None of our employees are represented by a collective bargaining agreement.

The Board and management are focused on maintaining a strong corporate culture. The Company’s goal is to always hire the most qualified individuals. The Company is located in a diversely populated geography, and the Company’s workforce effectively represents that diversity. We believe that a diverse workforce enhances our ability to serve our customers and our communities by enabling us to better understand their financial needs and to provide necessary and appropriate financial services.

Seventy-three percent of the Company’s employees self-identify as either female or ethnically diverse (defined as all Equal Employment Opportunity Commission classifications other than white). The Company is proud to have four veterans on its team as well.

9

Governance

As indicated in the discussion of Board Leadership and Oversight, the Company believes effective oversight by the Board of Directors is an essential element of a financially sound and well-managed bank. The Board establishes the Company’s risk philosophy, ensures that it has an appropriate risk-management framework, determines the overall business strategy, and monitors implementation of strategy.

To maintain the high caliber of our Board, the Company invests regularly in director education. Additionally, our directors establish and adhere to a rigorous Code of Ethics and Business Conduct. We seek highly qualified directors with skills needed for a forward-looking Board. The Company has had a technology expert on the Board since 2011, well before it became a recommended practice for community banks.

At the Board level, the Company has eight independent directors, out of a total of ten. Two of the independent directors self-identify as female, one self-identifies as an African-American male, and one self-identifies as a Hispanic male. Four of the independent directors self-identify as white males.

Diversity is one factor taken into account when considering candidates to serve on the Board of Directors. The Board believes that diversity supports its goal of best serving the Company and our shareholders, customers and employees. The matrix below summarizes the self-identified diversity attributes of our Board members.

Board Size:

Total Number of Directors 10

Gender: Male Female Non-Binary Gender Undisclosed

Number of directors based on gender identity 8 2 — —

Number of directors who identify in any of the categories below:

African American or Black 1 — — —

Alaskan Native or American Indian — — — —

Asian — — — —

Hispanic or Latinx 1 — — —

Native Hawaiian or Pacific Islander — — — —

White 6 2 — —

Two or More Races or Ethnicities — — — —

LQBTQ+ —

Undisclosed —

10

Title Ethnically Diverse Female Ethnically Diverse Male White Female White Male

The Company is focused on equal pay for equal work, and on developing all employees to reach their full potential. The Company realizes that hiring a diverse workforce that is representative of the diversity of the local population also allows us to better serve our marketplace.

Employee Age Diversity

The age distribution of our employee base is also appropriately diversified.

11

The age distribution of our employees as denoted by generational categories.

Employees by Generation

Pre Baby Boomers 0.6 %

Baby Boomers 17.0 %

Generation X 40.9 %

Millennials 35.7 %

Generation Z 5.8 %

The gender distribution of our employee base is diversified.

Employees by Gender

For the fiscal year ended December 31, 2025, we had forty-two promotions. These promotions were distributed as follows:

2025 Promotions Diversity

Ethnically Diverse White

The Company celebrates diversity throughout the year and fosters opportunities to learn about different cultures, religious practices, traits and differences. The Company finds that doing so brings out the best in the team as we grow together to exceed customer expectations and create shareholder value.

Supervision, Regulation and Other Factors

General.The U.S. banking industry is highly regulated under federal and state law. Consequently, our growth and earnings performance will be affected not only by management decisions and general and local economic conditions, but also by the statutes administered by, and the regulations and policies of, various governmental regulatory authorities. These regulators include the Federal Reserve, FDIC, the Bureau, CFPB, SEC, Internal Revenue Service, and state taxing authorities. President Trump and his administration have proposed and implemented significant reductions in financial institution regulation over the last year. However, future administrations may have different priorities and may impose additional regulatory burdens on the banking industry. The effect of these statutes, regulations, and policies and any changes to such statutes, regulations, and policies, if adopted in the future, can be material and cannot be predicted.

The primary goals of the U.S. bank regulatory framework are to maintain a safe and sound banking system, facilitate the conduct of sound monetary policy, and promote fairness and transparency for financial products and services. The system of supervision and regulation applicable to us and the Bank establishes a comprehensive framework for their respective operations and is intended primarily for the protection of the FDIC’s Deposit Insurance Fund, the Bank’s depositors, and the public, rather than our shareholders or creditors. The descriptions below summarize certain elements of the regulatory framework. The descriptions are not intended to describe all laws and regulations applicable to us and the Bank, and the descriptions are qualified by reference to the full texts of the statutes, regulations, policies, interpretive letters, and other written guidance that are described herein.

Regulation of the Company and Bank. The Company is a bank holding company that has elected status as a financial holding company. As such, the Company is subject to extensive regulation under the Bank Holding Company Act of 1956, as amended (“BHCA”), and to the examination and reporting requirements of the Federal Reserve. The Company is also subject to the rules and regulations of the SEC and state securities administrators under federal and state securities laws.

As a Virginia-chartered commercial bank that is a member of the Federal Reserve System, the Bank is subject to regulation, supervision and examination by the Bureau and the Federal Reserve. State and federal laws also govern the activities in which the Bank engages, the investments that it makes and the aggregate amount of loans that may be granted to one borrower. The Bureau and the Federal Reserve also regulate the branching authority of the Bank. In addition, various consumer and compliance laws and regulations affect the Bank’s operations.

The earnings of the Bank, the Company’s subsidiary, and therefore the earnings of the Company, are affected by general economic conditions, management policies, changes in state and federal legislation and actions of various regulatory authorities, including those referred to above. The statutes, regulations and policies that govern our operations are under continuous review and are subject to amendment from time to time by Congress, the Virginia legislature and federal and state regulatory agencies. Any such future statutory or regulatory changes could adversely affect our operations and financial condition.

Bank Holding Company Regulation. The Company is subject to regulation under the BHCA and to supervision, examination, and enforcement by the Federal Reserve as well as the Bureau. The BHCA and other federal laws subject bank holding companies to particular restrictions on the types of activities in which they may engage, and to a range of supervisory requirements and activities, including regulatory enforcement actions for violations of laws and regulations. The Federal Reserve’s jurisdiction also extends to any company that we directly or indirectly control, such as any nonbank subsidiaries and other companies in which we own a controlling interest.

12

Financial Services Industry Reform. As final rules and regulations implementing the Dodd-Frank Act have been adopted, and may continue to be adopted and/or modified, this law has changed the bank regulatory framework and has affected the lending, deposit, investment, trading, and operating activities of banks and their holding companies.

A number of the effects of the Dodd-Frank Act are described or otherwise accounted for in various parts of this “Supervision, Regulation and Other Factors” section. In addition to those requirements, the Dodd-Frank Act addresses many investor protection, corporate governance, and executive compensation matters that affect most U.S. publicly traded companies. The Dodd-Frank Act requires certain publicly traded companies to give shareholders a non-binding vote on executive compensation and golden parachute payments; enhances independence requirements for compensation committee members; requires national securities exchanges to require listed companies to adopt incentive-based compensation “clawback” policies for executive officers; requires certain publicly traded companies to disclose the relationship between the executive compensation actually paid by the company and the financial performance of the company; and authorizes the SEC to promulgate rules that would allow shareholders to nominate their own director candidates using a company’s proxy materials. While much of the Dodd-Frank Act has been implemented in the form of final rules from the banking agencies, certain aspects of the Dodd-Frank Act remain in proposed form or have not been implemented. Accordingly, it is possible that existing rules may still be modified or repealed or that new rules may be implemented that may impact our operations.

The Economic Growth, Regulatory Relief and Consumer Protection Act (“Economic Growth Act”), which was signed into law in May 2018, provides certain limited amendments to the Dodd-Frank Act, as well as certain targeted modifications to prior financial services reform regulatory requirements. Provisions in the Economic Growth Act generally address access to mortgage credit; consumer access to credit; protections for veterans, consumers, and homeowners; and protections for student borrowers. One of the Economic Growth Act’s highlights, with implications for us, was the asset threshold under the Federal Reserve’s Small Bank Holding Company and Savings and Loan Holding Company Policy Statement being increased from $1 billion to $3 billion, which benefits bank holding companies by, among various other items, allowing for an 18-month safety and soundness examination cycle as opposed to a 12-month examination cycle, changing to scaled biannual regulatory reporting requirements as opposed to quarterly regulatory reporting requirements, and not subjecting bank holding companies to capital adequacy guidelines on a consolidated basis. Another significant provision was the Economic Growth Act’s directive that federal bank regulatory agencies adopt a threshold for a Community Bank Leverage Ratio (“CBLR”) framework. The CBLR framework and its implications for us are discussed in more detail below under the heading “- Bank Regulation - Capital Adequacy Requirements.”

In March 2023, the CFPB issued a final rule implementing Section 1071 of the Dodd-Frank Act. The final rule requires financial institutions to collect and report data to the CFPB on small business loan applicants, including demographic data, lending decisions, and the price and terms of credit. The purpose of the rule is to increase transparency and combat discrimination in small business lending. However, the CFPB issued a Notice of Proposed Rulemaking in November 2025 that would make certain changes to the rule, including reducing the number of data points banks must collect and report as well as extending the compliance deadline to January 1, 2028.

On October 22, 2024, the CFPB issued its final rule implementing Section 1033 of the Dodd-Frank Act with respect to personal financial data rights, more commonly known as the “Open Banking Rule.” The final rule, among other things, requires banks and other financial institutions to make a consumer’s data available upon request to the consumer and their authorized third parties in a secure and reliable manner, and establishes obligations for third parties accessing consumers’ data, including data security and privacy protections. According to the CFPB, the rule is designed to foster competition and innovation in the financial services industry by making it easier for consumers to switch financial providers and for new companies to offer innovative products and services. The rule is in a current state of uncertainty as a federal court has issued a preliminary injunction prohibiting the CFPB from enforcing the rule until the CFPB can complete its reconsideration of the rule. In August 2025, the CFPB issued an advance notice of proposed rulemaking seeking comments as it evaluates issuing a proposed rule that would replace the current rule.

At this time, it is difficult to anticipate the continued impact the above-described legislation may have on our business, our customers, and the financial industry generally. Changes resulting from further implementation of, changes to, or repeal of the Dodd-Frank Act and other regulations may impact the profitability of our business activities; require changes to certain of our business practices; impose upon us more stringent capital, liquidity, and leverage requirements; or otherwise adversely affect our business. These changes may also require us to invest significant management attention and resources to evaluate and make any changes necessary to comply with new statutory and regulatory requirements. Failure to comply with any new requirements may negatively impact our results of operations and financial condition.

Additionally, the future implementation and enforcement of regulations may be affected by the current Presidential administration. There have been significant changes in the leadership of various bank regulatory agencies. In early February 2025, the CFPB’s Acting Director issued directives to cease virtually all CFPB activities, including supervision, examinations, rulemaking, enforcement actions, and pending investigations. Since this time, the CFPB has remained largely dormant with limited rulemaking issuances or other activity. In November 2025, the Acting Director notified a federal court that the CFPB cannot request funds from the Federal Reserve under the Dodd-Frank Act to fund its operations pursuant to a legal opinion issued by the Department of Justice’s Office of Legal Counsel. In December 2025, the federal court rejected this legal interpretation. In January 2026, the Acting Director notified the federal court that he had requested funding from the Federal Reserve to fund its operations for the first quarter of 2026. We cannot predict when or how these matters involving the CFPB will be resolved.

While we cannot predict what effect any presently contemplated or future changes in the laws or regulations, their interpretations or enforcement would have on us, these changes could be materially adverse to our financial condition and results of operations.

13

Holding Company Capital Requirements. As a bank holding company with less than $3 billion in total consolidated assets, the Company is eligible to be treated as a “small bank holding company” under the Federal Reserve’s Small Bank Holding Company and Savings and Loan Holding Company Policy Statement. As a result, the Company’s capital adequacy is evaluated at the bank level and on a parent-only basis, and it is not subject to consolidated capital standards for regulatory purposes.

Imposition of Liability for Undercapitalized Subsidiaries. Federal banking regulations require FDIC-insured banks that become undercapitalized to submit a capital restoration plan. The capital restoration plan of a bank controlled by a bank holding company will not be accepted by the regulators unless the bank holding company guarantees the subsidiary’s compliance with the capital restoration plan up to a certain specified amount. Any such guarantee from a bank holding company is entitled to a priority of payment in bankruptcy.

The aggregate liability of the holding company of an undercapitalized bank in such a guarantee is limited to the lesser of 5% of the bank’s assets at the time it became undercapitalized or the amount necessary to cause the institution to be adequately capitalized. The bank regulatory agencies have greater power in situations where a bank becomes significantly or critically undercapitalized or fails to submit a capital restoration plan. For example, a bank holding company controlling such a bank can be required to obtain prior Federal Reserve approval of proposed dividends or might be required to divest the bank or other affiliates.

Acquisitions by Bank Holding Companies. We must obtain the prior approval of the Federal Reserve before acquiring more than 5% of the voting stock of any bank or other bank holding company, acquiring all or substantially all of the assets of any bank or bank holding company, or merging or consolidating with any other bank holding company. In evaluating applications with respect to these transactions, the Federal Reserve is required to consider, among other things, the effect of the acquisition on competition; the financial condition, managerial resources, and prospects of the bank holding company and the bank(s) concerned; the convenience and needs of the communities to be served (including the record of performance under the CRA); the effectiveness of the applicant in combating money laundering activities; and the extent to which the proposed acquisition would result in greater or more concentrated risks to the stability of the U.S. banking or financial system. The Federal Reserve can deny an application based on the above criteria or other considerations. In addition, as a condition to receiving regulatory approval, the Federal Reserve can impose conditions on the acquiror or the business to be acquired, which may not be acceptable or, if acceptable, may reduce the benefit of a proposed acquisition.

Control Acquisitions. Subject to various exceptions, the BHCA and the Change in Bank Control Act, together with related regulations, require Federal Reserve approval or non-objection prior to any person or company (or group acting in concert) acquiring “control” of a bank holding company. Although “control” is based on the facts and circumstances surrounding the investment, control is conclusively presumed to exist if a person or company (or group acting in concert) acquires 25% or more of any class of voting securities of the bank holding company. Control of a bank holding company is rebuttably presumed to exist under the Change in Bank Control Act if the acquiring person or entity (or group acting in concert) will own 10% or more of any class of voting securities immediately following the transaction and either no other person will hold a greater percentage of that class of voting securities after the acquisition or the bank holding company has publicly registered securities. The BHCA’s definition of “control” can also be triggered when a company acquires 5% or more of any class of voting securities and certain other factors are present or when a company acquires one-third or more of total equity (both voting and non-voting).

Regulatory Restrictions on Dividends; Source of Strength. As a bank holding company, we are subject to certain restrictions on dividends under applicable banking laws and regulations. The Federal Reserve has issued a supervisory letter on the payment of cash dividends by bank holding companies, which expresses the Federal Reserve’s view that a bank holding company should pay cash dividends only to the extent that: (1) the holding company’s net income for the past four quarters, net of any dividends previously paid during that period, is sufficient to fully fund the dividends; (2) the prospective rate of earnings retention is consistent with the bank holding company’s capital needs, asset quality, and overall financial condition; and (3) the bank holding company will continue to meet, and is not in danger of failing to meet, minimum regulatory capital adequacy ratios. Failure to comply with the supervisory letter could result in a supervisory finding that the bank holding company is operating in an unsafe and unsound manner. The Federal Reserve has indicated that bank holding companies should carefully review their dividend policy and has discouraged payment ratios that are at maximum allowable levels unless both asset quality and capital are very strong. The Federal Reserve may further restrict the payment of dividends by engaging in supervisory action to restrict dividends or by requiring us to maintain a higher level of capital than would otherwise be required under any applicable minimum capital requirements. Our ability to pay dividends and make other distributions depends in part upon the receipt of dividends from the Bank, which is subject to certain restrictions on dividends as discussed in more detail below.

Under longstanding Federal Reserve policy, which has been codified by the Dodd-Frank Act, we are expected to act as a source of financial strength to, and to commit resources to support, the Bank. This support may be required at times when we may not be inclined to provide it. In addition, any capital loans that we make to the Bank are subordinate in right of payment to deposits and to certain other indebtedness of the Bank. As discussed above, in certain circumstances, we could also be required to guarantee the capital restoration plan of the Bank, if the Bank became undercapitalized for purposes of the FDIC’s prompt corrective action regulations. In the event of our bankruptcy, any commitment by us to a federal bank regulatory agency to maintain the capital of the Bank under a capital restoration plan would be assumed by the bankruptcy trustee and entitled to a priority of payment.

14

Scope of Permissible Activities. In general, the BHCA limits the activities permissible for bank holding companies to the business of banking, managing, or controlling banks, and such other activities as the Federal Reserve has determined to be so closely related to banking as to be properly incidental thereto. Permissible activities for a bank holding company include, among others, operating a mortgage, finance, credit card, or factoring company; performing certain data processing operations; providing investment and financial advice; acting as an insurance agent for certain types of insurance; leasing personal property on a full-payout, nonoperating basis; and providing certain stock brokerage services. A bank holding company may also make an investment of up to 5% of any class of voting securities of any company that is otherwise a non-controlling investment.

The Company has elected status as a financial holding company. As such, it may engage in activities that are financial in nature or incidental to such financial activity, or complementary to a financial activity and which do not pose a substantial risk to the safety and soundness of the Bank or to the financial system generally. These activities include securities dealing, underwriting and market making, insurance underwriting and agency activities, merchant banking, and insurance company portfolio investments. Expanded financial activities of financial holding companies generally are regulated according to the type of such financial activity: banking activities by banking regulators, securities activities by securities regulators, and insurance activities by insurance regulators. A bank holding company, such as the Company may elect to be treated as a financial holding company if all of its depository institution subsidiaries are “well-capitalized” and “well-managed,” and have received a rating of not less than “Satisfactory” on their most recent examination under the CRA.

Volcker Rule. Section 13 of the BHCA, commonly known as the “Volcker Rule,” has generally prohibited insured depository institutions and their affiliates from sponsoring or acquiring an ownership interest in certain investment funds, including hedge funds and private equity funds. The Volcker Rule also places restrictions on proprietary trading. The Economic Growth Act exempts from the Volcker Rule insured depository institutions with $10 billion or less in total consolidated assets and whose total trading assets and trading liabilities are 5% or less of total consolidated assets. The Federal Reserve has effectively extended the exemption to bank holding companies with $10 billion or less in total consolidated assets. Since we meet the criteria listed above, we are exempt from the Volcker Rule.

Safe and Sound Banking Practices. Bank holding companies are not permitted to engage in unsafe and unsound banking practices. For example, the Federal Reserve’s Regulation Y generally requires a bank holding company to provide the Federal Reserve with prior notice of any redemption or repurchase of its own equity securities, if the consideration to be paid, together with the consideration paid for any repurchases or redemptions in the preceding year, is equal to 10% or more of the bank holding company’s consolidated net worth. The Federal Reserve may oppose the transaction if it believes that the transaction would constitute an unsafe or unsound practice or would violate any law or regulation. In certain circumstances, the Federal Reserve could take the position that paying a dividend would constitute an unsafe or unsound banking practice. The Federal Reserve has broad authority to prohibit activities of bank holding companies and their nonbanking subsidiaries that represent unsafe and unsound banking practices, result in breaches of fiduciary duty, or which constitute violations of laws or regulations, and can assess civil money penalties or impose enforcement actions for such activities.

Bank Regulation. The Bank is a commercial bank chartered under the laws of the Commonwealth of Virginia and is a member of the Federal Reserve. As such, the Bank is subject to extensive regulation, supervision, and examination by the Bureau and the Federal Reserve. In addition, the Bank’s deposits are insured to the maximum extent permitted by law by the FDIC. The Bank regulatory agencies have the power to enforce compliance with applicable banking laws and regulations. These requirements and restrictions include requirements to maintain reserves against deposits, restrictions on the nature and amount of loans that may be made and the interest that may be charged thereon, and restrictions relating to investments and other activities of the Bank.

Capital Adequacy Requirements. The Federal Reserve and the Bureau monitor the capital adequacy of the Bank by using a combination of risk-based guidelines and leverage ratios. These agencies consider the Bank’s capital levels when taking action on various types of applications and when conducting supervisory activities related to the safety and soundness of the Bank and the banking system.

Under the Basel III capital rules, an institution’s assets and off-balance sheet items, such as letters of credit and unfunded loan commitments, are assigned to broad risk categories, each with appropriate risk weights. Regulatory capital, in turn, is classified in one of two tiers. “Tier 1” capital includes two components: common equity Tier 1 capital and additional Tier 1 capital. Common equity Tier 1 capital consists solely of common stock (plus related surplus), retained earnings and limited amounts of minority interests that are in the form of common stock. Additional Tier 1 capital includes other perpetual instruments historically included in Tier 1 capital, such as non-cumulative perpetual preferred stock. “Tier 2” capital includes, among other things, qualifying subordinated debt and allowances for credit losses, subject to limitations. The resulting capital ratios represent capital as a percentage of total risk-weighted assets and off-balance sheet items. Pursuant to the regulatory capital rules, the Bank has made an election not to include unrealized gains and losses in the investment securities portfolio for purposes of calculating “Tier 1” capital and “Tier 2” capital.

Under the current Basel III regulatory framework, the Bank is required to maintain the following minimum regulatory capital ratios:

● A ratio of Tier 1 capital to total risk-weighted assets of at least 6%;

● A leverage ratio (Tier 1 capital to adjusted total assets) of at least 4%.

In addition to these minimum regulatory capital ratios, the Basel III regulations establish a capital conservation buffer (“CCB”) with respect to the first three capital ratios listed above. Specifically, banks must hold common equity Tier 1 capital in excess of their minimum risk-based capital ratios by at least 2.5% of risk-weighted assets in order to avoid limits on capital distributions (including dividend payments, discretionary payments on Tier 1 instruments, and stock buybacks) and certain discretionary bonus payments to executive officers. Thus, when including the 2.5% CCB, a bank’s minimum ratio of common equity Tier 1 capital to total risk-weighted assets increases to 7%, its minimum ratio of Tier 1 capital to total risk-weighted assets increases to 8.5%, and its minimum ratio of total capital to total risk-weighted assets increases to 10.5%.

These capital requirements are minimum requirements. The Federal Reserve and the Bureau may also set higher capital requirements if warranted by the Bank’s risk profile, economic conditions impacting its markets, or other circumstances particular to the Bank. For example, Federal Reserve guidance provides that higher capital may be required to take adequate account of, among other things, interest rate risk and the risks posed by concentrations of credit, nontraditional activities, or securities trading activities. In addition, the Federal Reserve’s prompt corrective action regulations discussed below also apply to the Bank. Failure to meet capital guidelines could subject the Bank to a variety of enforcement remedies, including issuance of a capital directive, restrictions on business activities, and other measures under the Federal Reserve’s prompt corrective action regulations.

15

As part of the directive under the Economic Growth Act, in September 2019, the Federal Reserve and other federal bank regulatory agencies approved the CBLR framework. This optional framework became effective January 1, 2020, and is available to the Bank as an alternative to the Basel III risk-based capital framework. The CBLR framework provides a simple measure of capital adequacy for certain community banking organizations. Specifically, depository institutions and depository institution holding companies that have less than $10 billion in total consolidated assets and meet other qualifying criteria, including a Tier I leverage ratio of greater than 9%, are considered qualifying community banking organizations eligible to opt into the CBLR framework and replace the applicable Basel III risk-based capital requirements. The federal banking agencies issued a notice of proposed rulemaking in December 2025 that would, among other things, lower the 9% leverage ratio requirement to 8%.

As of December 31, 2025, the Bank qualified for the CBLR framework. Management does not intend to utilize the CBLR framework.

Corrective Measures for Capital Deficiencies.The federal banking regulators are required by the Federal Deposit Insurance Act, as amended (“FDIA”), to take “prompt corrective action” with respect to capital-deficient banks that are FDIC-insured. For this purpose, a bank is placed in one of the following five capital tiers: “well-capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” A bank’s capital tier depends upon how its capital levels compare with various relevant capital measures and certain other regulatory factors.

To be well-capitalized, a bank must have a total risk-based capital ratio of at least 10%, a Tier I risk-based capital ratio of at least 8%, a common equity Tier I risk-based capital ratio of at least 6.5%, and a leverage ratio of at least 5%, and must not be subject to any written agreement, order, or directive requiring it to maintain a specific capital level for any capital measure. As of December 31, 2025, the Bank was in compliance with all regulatory capital standards and qualified as “well-capitalized” under the prompt corrective action regulations. See Note 16 of Notes to Consolidated Financial Statements.

Banks that are adequately capitalized, but not well-capitalized, may not accept, renew, or rollover brokered deposits without a waiver from the FDIC and are subject to restrictions on the interest rates that can be paid on deposits. The prompt corrective action regulations also generally prohibit a bank from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the bank would thereafter be undercapitalized. Undercapitalized banks are also subject to growth limitations, may not accept, renew, or rollover brokered deposits, and are required to submit a capital restoration plan. The Federal Reserve may not accept such a plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the bank’s capital. Significantly undercapitalized banks may be subject to requirements and restrictions, including orders to sell sufficient shares or obligations to become adequately capitalized, limitations on asset growth, and cessation of receipt of deposits from correspondent banks. Generally, subject to a narrow exception, the Federal Reserve must appoint a receiver or conservator for an institution that is critically undercapitalized. The capital classification of a bank also affects the bank’s ability to engage in certain activities and the deposit insurance premiums paid by the bank.

Bank Mergers. Section 18(c) of the FDIA, known as the “Bank Merger Act,” requires the written approval of a bank’s primary federal regulator before the bank may acquire through merger or consolidation, purchase or otherwise acquire the assets of, or assume the deposit liabilities of, another bank. The Bank Merger Act prohibits the reviewing agency from approving any proposed merger transaction that would result in certain significant anti-competitive effects. In every proposed merger transaction, the reviewing agency must also consider the financial and managerial resources and prospects of the existing and proposed institutions, the convenience and needs of the community to be served, the bank’s CRA performance, and the effectiveness of each insured depository institution involved in the proposed merger transaction in combating money-laundering activities. In addition to Federal Reserve approval, the Bank must also obtain the prior approval of the Bureau before acquiring or merging with another bank. The Bureau will consider similar criteria when reviewing an application.

Branching. Under Virginia law, the Bank is permitted to establish additional branch offices within Virginia, subject to the approval of the Bureau. As a result of the Dodd-Frank Act, the Bank may also establish additional branch offices outside of Virginia, subject to prior regulatory approval, provided that the laws of the state where the branch is to be located would permit a state bank chartered in that state to establish a branch. Any new branch, whether located inside or outside of Virginia, must also be approved by the Federal Reserve, as the Bank’s primary federal regulator. The Bank may also establish offices in other states by merging with banks or by purchasing branches of banks in other states, subject to certain restrictions (including obtaining the prior approval of the Bureau and Federal Reserve).

Restrictions on Transactions with Affiliates and Insiders. Federal law strictly limits the ability of banks to engage in transactions with their affiliates, including their parent bank holding companies. Sections 23A and 23B of the Federal Reserve Act, and the Federal Reserve’s Regulation W, impose quantitative limits, qualitative standards, and collateral requirements on certain transactions by a bank with, or for the benefit of, its affiliates. Generally, Sections 23A and 23B limit the extent to which the bank or its subsidiaries may engage in “covered transactions” with any one affiliate to an amount equal to 10% of such bank’s capital stock and surplus, and limit the aggregate of all such transactions with all affiliates to an amount equal to 20% of such capital stock and surplus, and require that all such transactions be on terms substantially the same, or at least as favorable, to the bank or subsidiary as those that would be provided to a non-affiliate. The term “covered transaction” includes the making of loans to the affiliate, purchase of assets from the affiliate, issuance of a guarantee on behalf of the affiliate, and several other types of transactions.

The Dodd-Frank Act expanded the coverage and scope of the limitations on affiliate transactions within a banking organization, including an expansion of what types of transactions are covered transactions to include credit exposures related to derivatives, repurchase agreements, and securities lending arrangements, and an increase in the amount of time for which collateral requirements regarding covered transactions must be satisfied.

Federal law also limits a bank’s authority to extend credit to its directors, executive officers, and 10% or greater shareholders, as well as to entities controlled by such persons. Among other things, extensions of credit to insiders are required to be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with unaffiliated persons. Also, the terms of such extensions of credit may not involve more than the normal risk of repayment or present other unfavorable features and may not exceed certain limitations on the amount of credit extended to such persons, individually and in the aggregate, which limits are based, in part, on the amount of the bank’s capital. Insiders, as well as the bank, may be subject to enforcement actions, including civil money penalties, for loans in violation of applicable restrictions.

Regulatory Restrictions on Bank Dividends. The Bank is subject to certain restrictions on dividends under federal and state laws, regulations, and policies. The board of directors of a Virginia state bank may not declare a dividend in excess of the net undivided profits of the bank without regulatory approval. The Virginia State Corporation Commission may limit or approve payment of dividends by the directors of any bank if it determines that such action is warranted by the bank’s financial condition.

Prior Federal Reserve approval is required if cash dividends declared by a bank exceed its net income for the current calendar year, plus retained net income from the two preceding years. In addition, under federal law, the Bank may not pay any dividend to the Company if it is undercapitalized, or the payment of the dividend would cause it to become undercapitalized. The Federal Reserve and the Bureau may further restrict the payment of dividends by engaging in supervisory action to restrict dividends or by requiring the Bank to maintain a higher level of capital than would otherwise be required to be adequately capitalized for regulatory purposes. Under the Basel III regulatory capital framework, the failure to maintain an adequate CCB, as discussed above, may also result in dividend restrictions. Moreover, if, in the opinion of the Federal Reserve and the Bureau, the Bank is engaged in an unsafe or unsound practice (which could include the payment of dividends), they may require, generally after notice and hearing, the Bank to cease such practice. The Federal Reserve has indicated that paying dividends that deplete a depository institution’s capital base to an inadequate level would be an unsafe banking practice.

Incentive Compensation Guidance. In 2010, the federal banking agencies issued comprehensive guidance on incentive compensation policies intended to ensure that such policies of banking organizations do not undermine the safety and soundness of those organizations by encouraging excessive risk-taking. The incentive compensation guidance sets expectations for banking organizations concerning their incentive compensation arrangements and related risk-management, control, and governance processes. The incentive compensation guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon three primary principles: balanced risk-taking incentives, compatibility with effective controls and risk management, and strong corporate governance. Any deficiencies in compensation practices that are identified may be incorporated into the organization’s supervisory ratings, which can affect its ability to make acquisitions or take other actions. In addition, under the incentive compensation guidance, a banking organization’s primary federal regulator may initiate enforcement action if the organization’s incentive compensation arrangements pose a risk to the safety and soundness of the organization. Further, the CCB described above would limit discretionary bonus payments to bank executives if the institution’s regulatory capital ratios fail to exceed certain thresholds. The scope and content of the U.S. banking regulators’ policies on executive compensation are continuing to develop and evolve.

Deposit Insurance Assessments. FDIC-insured banks are required to pay deposit insurance assessments to the FDIC. The amount of the assessment is based on the size of the bank’s assessment base, which is equal to its average consolidated total assets less its average tangible equity, and its risk classification under an FDIC risk-based assessment system. Institutions assigned to higher risk classifications (that is, institutions that pose a higher risk of loss to the Deposit Insurance Fund) pay assessments at higher rates than institutions that pose a lower risk. An institution’s risk classification is assigned based on its capital levels and the level of supervisory concern that the institution poses to the regulators. At least semi-annually, the FDIC updates its loss and income projections for the Deposit Insurance Fund and, if needed, increases or decreases assessment rates, following notice-and-comment rulemaking, if required. The FDIC issued a final rule in October 2022 increasing deposit insurance assessments on all financial institutions beginning in the first quarterly assessment period of 2023.

The FDIC can also impose special assessments in certain instances. For example, the Bank may be required to pay higher FDIC insurance premiums if there are bank or financial institution failures or if the FDIC otherwise determines to increase assessment rates in order to replenish the Deposit Insurance Fund.

Concentrated Commercial Real Estate (“CRE”) Lending Regulations. The federal banking regulatory agencies have promulgated guidance governing financial institutions with concentrations in CRE lending. The guidance provides that a bank may have a concentration in CRE lending if total reported loans for construction, land development, and other land represent 100% or more of total risk-based capital, or total non-owner occupied CRE loans, excluding owner occupied properties, represent 300% or more of the bank’s total risk-based capital and the outstanding balance of the bank’s CRE loan portfolio has increased 50% or more during the prior 36 months. If a concentration is present, the bank will be subject to further regulatory scrutiny with respect to its risk management practices for CRE lending. As of December 31, 2025, the Bank’s total reported loans for construction, land development, and other land represented more than 100% of the Bank’s total risk-based capital, and its total CRE loans, excluding owner occupied properties, represented more than 300% of the Bank’s total risk-based capital. As a result, the Bank has a concentration in CRE lending. For information regarding underwriting analysis, risk rating and stress testing of our loan portfolio, including our CRE loans, see Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations”.

16

Community Reinvestment Act. The Community Reinvestment Act of 1977, as amended (“CRA”), and the related regulations are intended to encourage banks to help meet the credit needs of their entire assessment area, including low and moderate income neighborhoods, consistent with the safe and sound operations of such banks. These regulations also provide for regulatory assessment of a bank’s CRA performance record when considering applications to establish branches, merger applications, and applications to acquire the assets and assume the liabilities of another bank. The CRA requires federal banking agencies to make public their ratings of banks’ performance under the CRA. In the case of a bank holding company transaction, the CRA performance record of the subsidiary banks of the bank holding companies involved in the transaction are reviewed in connection with the filing of an application to acquire ownership or control of shares or assets of a bank or to merge with any other bank holding company. An unsatisfactory CRA record could substantially delay approval or result in denial of an application. The Bank received a “Satisfactory” rating in its most recent CRA examination in 2025.

On October 24, 2023, the federal banking agencies adopted a final rule to modernize the CRA regulations. Under the final rule, (1) the federal banking agencies will evaluate bank performance across the varied activities they conduct and communities in which they operate in order to encourage banks to expand access to credit, investment, and banking services in low- and moderate-income communities, (2) the CRA regulations are updated to evaluate lending outside traditional assessment areas generated by the growth of non-branch delivery systems, such as online and mobile banking, branchless banking, and hybrid models, (3) a new metrics-based approach was adopted to evaluate bank retail lending and community development financing, using benchmarks based on peer and demographic data, and (4) CRA evaluations and data collection are tailored according to bank size and type. Most of the new rule's requirements were originally scheduled to become applicable on January 1, 2026 with the remaining requirements, including the data reporting requirements, becoming applicable on January 1, 2027. However, a federal court issued an injunction in March 2024 that indefinitely extended the compliance date until the injunction is lifted. Further, in July 2025, the federal banking agencies issued a notice of proposed rulemaking to rescind the October 2023 final rulemaking and replace it with the prior CRA regulation.

Consumer Laws and Regulations. The Bank is subject to numerous laws and regulations intended to protect consumers in transactions with the Bank. These laws include, among others, laws regarding unfair, deceptive, and abusive acts and practices, and other federal consumer protection statutes. These federal laws include the Electronic Fund Transfer Act, the Equal Credit Opportunity Act, the Fair Housing Act, the Fair Credit Reporting Act, the Fair Debt Collection Practices Act, RESPA, the S.A.F.E. Mortgage Licensing Act of 2008, TILA, and the Truth in Savings Act, among others. Many states and local jurisdictions have consumer protection laws analogous, and in addition, to those enacted under federal law. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must deal with customers when taking deposits, making loans, and conducting other types of transactions. Failure to comply with these laws and regulations could give rise to regulatory sanctions, customer rescission rights, action by state and local attorneys general, and civil or criminal liability.

The Dodd-Frank Act created the CFPB, which has broad authority to regulate the offering and provision of consumer financial products. The CFPB has authority to promulgate regulations; issue orders, guidance, interpretations, and policy statements; conduct examinations; and bring enforcement actions regarding consumer financial products and services. In general, banks with assets of $10 billion or less, such as the Bank, will continue to be examined for consumer compliance, and subject to enforcement actions, by their primary federal regulator. However, the CFPB may participate in examinations of these smaller institutions on a “sampling basis” and may refer potential enforcement actions against such institutions to their primary federal regulators. In addition, the Dodd-Frank Act permits states to adopt consumer protection laws and regulations that are stricter than those regulations promulgated by the CFPB, and state attorneys general are permitted to enforce certain consumer protection rules adopted by the CFPB against certain institutions. As previously referenced in “Bank Holding Company Regulation – Financial Services Industry Reform”, the future of the CFPB is presently uncertain.

Mortgage Lending Rules. The Dodd-Frank Act authorized the CFPB to establish certain minimum standards for the origination of residential mortgages, including a determination of the borrower’s ability to repay. Under the Dodd-Frank Act, financial institutions may not make a residential mortgage loan unless they make a “reasonable and good faith determination” that the consumer has a “reasonable ability” to repay the loan. The Dodd-Frank Act allows borrowers to raise certain defenses to foreclosure but provides a presumption or rebuttable presumption of compliance for loans that are “qualified mortgages.” The CFPB has also issued regulations that, among other things, specify the types of income and assets that may be considered in the ability-to-repay determination, the permissible sources for income verification, and the required methods of calculating the loan’s monthly payments. These regulations extend the requirement that creditors verify and document a borrower’s income and assets to include a requirement to verify all information that creditors rely on in determining repayment ability. The rules also define “qualified mortgages” based on adherence to certain underwriting standards and certain restrictions on loan terms. Points and fees are subject to a relatively stringent cap, and the terms include a wide array of payments that may be made while closing a loan. Certain loans, including interest-only loans and negative amortization loans, cannot be “qualified mortgages.” Also, the Dodd-Frank Act and the CFPB’s final rule on loan originator compensation prohibit certain compensation payments to loan originators and the steering of consumers to loans not in their interest, particularly if the loans will result in greater compensation for a loan originator. The Dodd-Frank Act and the CFPB’s implementing regulations, including the TILA-RESPA integrated disclosure rules, also impose disclosure requirements with respect to the origination and sale of residential mortgages.

Anti-Money Laundering and OFAC. Under federal law, financial institutions are required to maintain anti-money laundering programs that include established internal policies, procedures, and controls; a designated compliance officer; an ongoing employee training program; testing of the program by an independent audit function; and a customer due diligence program. Financial institutions are also prohibited from entering into specified financial transactions and account relationships and must meet enhanced standards for due diligence and customer identification, especially in their dealings with foreign financial institutions and foreign customers. Financial institutions must take reasonable steps to conduct enhanced scrutiny of account relationships to guard against money laundering and to report any suspicious transactions, and law enforcement authorities have been granted increased access to financial information maintained by financial institutions.

OFAC administers laws and Executive Orders that prohibit U.S. entities from engaging in transactions with certain prohibited parties. OFAC publishes lists of persons and organizations suspected of aiding, harboring, or engaging in terrorist acts, known as Specially Designated Nationals and Blocked Persons. Generally, if a bank identifies a transaction, account, or wire transfer relating to a person or entity on an OFAC list, it must freeze the account or block the transaction, file a suspicious activity report, and notify the appropriate authorities.

Bank regulators routinely examine institutions for compliance with these obligations, and they must consider an institution’s compliance in connection with the regulatory review of applications, including applications for bank mergers and acquisitions. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing and comply with OFAC sanctions, or to comply with relevant laws and regulations, could have serious legal, reputational, and financial consequences for the institution.

Privacy. Federal laws and regulations limit the ability of banks and other financial institutions to disclose non-public information about consumers to non-affiliated third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a non-affiliated third party. These regulations affect how consumer information is transmitted through financial services companies and conveyed to outside vendors. In addition, consumers may also prevent disclosure of certain information among affiliated companies that is assembled or used to determine eligibility for a product or service, such as that shown on consumer credit reports and asset and income information from applications. Consumers also have the option to direct banks and other financial institutions not to share information about transactions and experiences with affiliated companies for the purpose of marketing products or services. In addition to applicable federal privacy regulations, the Bank is subject to certain state privacy laws.

Federal laws and regulations also include certain information security guidelines that require a bank, under the supervision and ongoing oversight of its board of directors or an appropriate committee of the board, to develop, implement, and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, to protect against anticipated threats or hazards to the security or integrity of such information, and to protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. Federal banking regulators regularly issue guidance regarding cybersecurity intended to enhance cybersecurity risk management. A financial institution is expected to implement multiple lines of defense against cyber-attacks. Under Federal guidance, banks are required to provide notice to affected customers of a data breach under certain circumstances, and the agencies recently adopted a rule requiring notice to the primary federal regulator within certain timeframes for certain data security incidents.

Enforcement Powers. The bank regulatory agencies have broad enforcement powers, including the power to terminate deposit insurance and impose substantial fines and other civil and criminal penalties. Failure to comply with applicable laws, regulations, and supervisory agreements, breaches of fiduciary duty, or the maintenance of unsafe and unsound conditions or practices, could subject us or our subsidiaries, including the Bank, as well as their respective officers, directors, and other institution-affiliated parties, to administrative sanctions, enforcement actions, and potentially substantial civil money penalties.

FDIC Conservatorship or Receivership. The bank regulatory agencies may appoint the FDIC as conservator or receiver for a bank (or the FDIC may appoint itself, under certain circumstances) if any one or more of a number of circumstances exist, including, without limitation, the Bank becoming critically undercapitalized under prompt corrective action.

Effect of Governmental Monetary Policies. The commercial banking business is affected not only by general economic conditions but also by U.S. fiscal policy and the monetary policies of the Federal Reserve. Some of the instruments of monetary policy available to the Federal Reserve include changes in the discount rate on member bank borrowings, the fluctuating availability of borrowings at the “discount window,” open market operations, and the imposition of, and changes in reserve requirements against member banks’ deposits and certain borrowings by banks and their affiliates and assets of foreign branches. These policies have a significant influence on the overall growth of bank loans, investments, and deposits, and the interest rates charged on loans or paid on deposits. We cannot predict the nature of future fiscal and monetary policies or the effect of these policies on our operations and activities, financial condition, results of operations, growth plans, or prospects.

Federal Securities Laws. The Company’s common stock and depositary shares (each representing a 1/40th interest in a share of 7.50% Series A Fixed-Rate Non-Cumulative Perpetual Preferred Stock) are registered under Section 12(b) of the Exchange Act, and the Company is subject to the periodic reporting and other requirements of the SEC under Section 12(b) of the Exchange Act and SEC regulations.

Our annual reports on Form 10-K, quarterly reports on Form 10-Q, and current reports on Form 8-K, and amendments to those reports, are available at no cost on our website, www.mstreetbank.com, as soon as reasonably practicable after we file, or furnish, such documents with the SEC. The information contained on our website is not part of this Annual Report on Form 10-K, nor incorporated by reference into this or any other SEC filing. Our SEC filings are also available at no cost through the SEC’s website at www.sec.gov.

17

Item 1A. Risk Factors

This section highlights material risks that the Company currently faces. Any of the risks described below, along with management’s discussion and analysis and the consolidated financial statements and footnotes, could materially adversely affect our business, financial condition, and results of operations. Additional risks of which management currently is not aware or which management currently considers to not be material may also adversely affect our business, financial condition and results of operations. There is no assurance that this section describes all potential risks to which the Company may be exposed.

Risks Related to Our Business

Credit and Lending Risks

Our business, like that of most banking organizations, is highly susceptible to credit risk.

As a lender, the Bank is exposed to the risk that borrowers will be unable to repay their loans according to terms of the loan agreements and that the collateral securing payment of the loans (if any) may not be sufficient to assure repayment. Credit losses could have a material adverse effect on our business, financial condition, and results of operations.

We have exposure to risks associated with commercial and residential real estate.

A substantial portion of our loan portfolio consists of commercial and residential real estate-related loans, including construction and residential and commercial mortgage loans. As of December 31, 2025, we had approximately $448.5 million of owner-occupied and $566.4 million of investment commercial real estate loans outstanding, which represented approximately 24.0% and 30.4%, respectively, of our loan portfolio as of December 31, 2025. As of that same date, we had approximately $300.7 million of construction real estate loans and $441.6 million of residential real estate loans, which represented 16.1% and 23.7% respectively.

The adverse consequences from real estate-related credit risks tend to be cyclical and are often driven by local and national economic developments that are not controllable or entirely foreseeable by us or our borrowers. As a result:

During the ordinary course of our business, we may foreclose on and take title to properties securing certain loans, in which event we become exposed to the costs and risks inherent in the ownership of commercial and residential real estate, which could have an adverse effect on our business, financial condition and results of operations. The amount that we, as a mortgagee, may realize after a default is dependent upon factors outside of our control, including:

• general or local economic conditions;

• environmental clean-up liabilities;

• neighborhood values;

• interest rates;

18

• real estate tax rates;

• operating expenses of the foreclosed properties;

• supply of and demand for rental units or properties;

• ability to obtain and maintain adequate occupancy of the properties;

• zoning laws;

• governmental rules, regulations and fiscal policies; and

• extreme weather conditions or other natural or man-made disasters.

Certain expenditures associated with the ownership of real estate, principally real estate taxes and maintenance costs, may also adversely affect our operating expenses.

In recent years commercial real estate markets both nationally and locally have been adversely affected by a weakening demand. Weakness in our commercial real estate market could result in increased delinquency rate and losses from these loans. We believe that the resilience of our market and borrowers provides an ability to adjust to and withstand such risks. However, increased losses from this portfolio could have an adverse effect on our business, financial condition and results of operations.

Commercial and industrial loans may expose us to greater financial and credit risk than other loans.

Commercial and industrial loans can involve a greater degree of financial and credit risk than other loans, including less collateral at liquidation. Any significant failure to pay on time by these customers would hurt our earnings. The increased financial and credit risks associated with these types of loans result from several factors, including the concentration of principal in a limited number of loans and borrowers, the size of loan balances, the effects of general economic conditions on income-producing properties and the increased difficulty of evaluating and monitoring these types of loans and factors outside the borrowers' control such as adverse financial conditions and governmental regulations. In addition, when underwriting a commercial or industrial loan, we may take a security interest in commercial real estate, and, in some instances upon a default by the borrower, we may foreclose on and take title to the property, which may lead to additional risks for us under applicable environmental laws described below.

Thesmall-to-midsized businesses that we lend to may have fewer resources to weather adverse business developments, which may impair a borrower’s ability to repay a loan, and such impairment could have a material adverse effect on our business, financial condition and results of operations.

We focus our business development and marketing strategy primarily on small-to-midsized businesses. These businesses frequently have smaller market shares than their competition, may be more vulnerable to economic downturns, often need additional capital to expand or compete and may experience volatility in operating results, any of which may impair a borrower’s ability to repay a loan. In addition, the success of a small-to-midsized business often depends on the management skills, talents and efforts of one or two people or a small group of people, and the death, disability or resignation of one or more of these people could have an adverse impact on the business and its ability to repay its loan. If general economic conditions negatively impact the markets in which we operate and small-to-midsized businesses are adversely affected or our borrowers are otherwise harmed by adverse business developments, this, in turn, could have a material adverse effect on our business, financial condition and results of operations.

The borrowing needs of our customers may increase, especially during a challenging economic environment, which could result in increased borrowing against our contractual obligations to extend credit.

A commitment to extend credit is a formal agreement to lend funds to a customer as long as there is no violation of any condition established under the agreement. The actual borrowing needs of our customers under these credit commitments have historically been lower than the contractual amount of the commitments. A significant portion of these commitments expire without being drawn upon. Because of the credit profile of our customers, we typically have a substantial amount of total unfunded credit commitments, which is not reflected on our balance sheet. As of December 31, 2025, we had $202.6 million in unfunded credit commitments to our customers. Actual borrowing needs of our customers may exceed our expectations, especially during a challenging economic environment when our customers may be more dependent on our credit commitments due to the lack of available credit elsewhere, the increasing costs of credit, or the limited availability of financings from venture firms. This could adversely affect our liquidity, which could impair our ability to fund operations and meet obligations as they become due and could have a material adverse effect on our business, financial condition and results of operations.

Our allowance for credit losses may not be adequate to cover actual future losses.

Our success depends significantly on the quality of our assets, particularly loans. Like all financial institutions, we are exposed to the risk that our borrowers may not repay their loans according to their terms, and the collateral securing the payment of these loans may be insufficient to fully compensate us for the outstanding balance of the loan plus the costs to dispose of the collateral.

19

We maintain an allowance for credit losses ("ACL"), which includes the allowance for credit losses on loans, at a level we believe is adequate to absorb expected losses in our loan portfolio as of the corresponding balance sheet date. The process to determine the ACL uses models and assumptions that require us to make difficult and complex judgments that are often interrelated. This includes forecasting how borrowers will perform in changing and unprecedented economic conditions. The ability of our borrowers to repay their obligations will likely be impacted by changes in future economic conditions, which in turn could impact the accuracy of our loss forecasts and allowance estimates. There is also the possibility that we have failed or will fail to accurately identify the appropriate economic indicators, to accurately estimate the timing of future changes in economic conditions, or to estimate accurately the impacts of future changes in economic conditions to our borrowers, which similarly could impact the accuracy of our loss forecasts and allowance estimates.

If the models, estimates, and assumptions we use to establish reserves or the judgments we make in extending credit to our borrowers prove inaccurate in predicting future events, we may suffer unexpected losses. The ACL is our best estimate of expected credit losses; however, there is no guarantee that it will be sufficient to address credit losses, particularly if the economic outlook deteriorates significantly and quickly. In such an event, we may increase our ACL, which would reduce our earnings. Additionally, to the extent that economic conditions worsen, impacting our consumer and commercial borrowers or underlying collateral, and credit losses are worse than expected, as may be caused by persistent inflation, an economic recession or otherwise, we may increase our provision for credit losses, which could have an adverse effect on our results of operations and could negatively impact our financial condition.

Continuing deterioration in economic conditions, including inflation, a possible recession, higher interest rates, unresolved or new adverse effects of a pandemic, and unanticipated problem loans, may necessitate an increase in our allowance for credit losses. In addition, bank regulatory authorities may require an increase to the allowance for credit losses to cover future charge-offs, based on their judgments which may differ from ours.

We may be required to increase our provisions for credit losses and to charge off loans in the future; increases in provision and charge offs could materially adversely affect us.

There is no precise method of predicting the timing of credit losses. We can give no assurance that our allowance for credit losses is or will be sufficient to absorb actual credit losses. We maintain an allowance for credit losses on loans, which is a reserve established through a provision for credit losses charged to expense, that represents management’s estimable and observable losses within the existing portfolio of loans. The level of the allowance reflects management’s evaluation of, among other factors, the status of specific individually evaluated loans, trends in historical loss experience, delinquency trends, credit concentrations and economic conditions within our market area. The determination of the appropriate level of the allowance for credit losses inherently involves a high degree of subjectivity and judgment and requires us to make significant estimates of current and expected future credit risks and future trends, any or all of which may undergo subsequent material changes. Changes in economic conditions affecting borrowers, new information regarding existing loans, identification of additional problem loans and other factors, both within and outside of our control, may require us to increase our allowance for credit losses. Increases in non-performing loans may have an impact on our allowance for credit losses.

In addition, bank regulatory agencies periodically review our allowance for credit losses and may require us to increase the provision for credit losses or to recognize further loan charge-offs, based on judgments that differ from those of management. If loan charge-offs in future periods exceed our allowance for credit losses, we will need to record additional provisions to increase our allowance for credit losses. Furthermore, growth in our loan portfolio would generally lead to an increase in the provision for credit losses. Generally, increases in our allowance for credit losses will result in a decrease in net income and stockholders’ equity, and may have a material adverse effect on our financial condition, results of operations and cash flows. Material additions to our allowance could also materially decrease our net income and, possibly, capital, and may have an adverse effect on our business.

Our credit standards and judgments and our ongoing process of credit assessment might not protect us from significant credit losses.

We extend credit to a variety of customers based on internally established standards, judgments and procedures. We manage credit risk through a program of underwriting standards, the review of certain credit decisions and an on-going process of assessment of the quality of the credit already extended. We avoid highly leveraged transactions as well as excessive industry and other concentrations. Our credit administration function employs risk management techniques to ensure that loans adhere to corporate policy and problem loans are promptly identified. While these procedures are designed to provide us with the information needed to implement policy adjustments where necessary, and to take proactive corrective actions, there can be no assurance that such measures will be effective in avoiding undue credit risk.

Our stress tests may not accurately predict our financial condition.

We perform credit and capital stress testing on an quarterly basis using stress test assumptions we believe are reasonable. Within our stress test, we estimate our credit losses, resources available to absorb those losses, and any necessary additions to capital. The results of these stress tests involve many assumptions about the future economy, credit losses and default rates and may not accurately reflect our financial condition. Any deterioration in the economy could result in significantly higher credit losses and negative impacts on our financial condition and capital than projected by our internal stress tests.

20

We are subject to environmental liability risk associated with our lending activities.

In the course of our business, we may purchase real estate, or we may foreclose on and take title to real estate. Although we exercise prudent due diligence when making loans, we could be subject to environmental liabilities with respect to these properties. We may be held liable to a governmental entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination or may be required to investigate or clean up hazardous or toxic substances or chemical releases at a property. The costs associated with investigation or remediation activities could be substantial. In addition, if we are the owner or former owner of a contaminated site, we may be subject to common law claims by third parties based on damages and costs resulting from environmental contamination emanating from the property. Any significant environmental liabilities could cause an adverse effect on our business, financial condition and results of operations.

Climate change could have a material negative impact on us.

Climate change could negatively impact our business, as well as the operations and activities of our customers. Climate change could present both immediate and long-term risks to our operations, and these risks could increase over time. Climate change could present multi-faceted risks, including operational risks from the physical effects of environmental events on our facilities and other assets, as well as those of our customers; potential credit risk from borrowers with significant exposure to environmental risk; and potential reputational risk from shareholder and public comments and concerns about our practices related to climate change and our relationships with customers and vendors who operate in environmentally sensitive industries. Our business, reputation and ability to attract and retain employees could also be harmed if our responses to climate change are negatively perceived.

Interest Rate Risks

Changes in interest rates may negatively affect our earnings, income and financial condition as well as the value of our assets.

Our earnings and cash flows depend substantially upon our net interest income. Net interest income is the difference between interest income earned on interest-earning assets, such as loans and investment securities, and interest expense paid on interest-bearing liabilities, such as deposits and borrowed funds. Interest rates are sensitive to many factors that are beyond our control, including general economic conditions, competition and policies of various governmental and regulatory agencies and, in particular, the policies of the Federal Reserve.

In an attempt to help the overall economy and in response to inflationary pressures, throughout 2022 and 2023 the Federal Reserve increased its targeted Fed Funds rate. More recently, the Federal Reserve began decreasing the federal funds rate. At this time there is considerable uncertainty regarding future interest rate levels.

Changes in monetary policy, including rapid changes in interest rates, not only could influence the interest we receive on loans and investment securities and the amount of interest we pay on deposits and borrowings, but such changes could also affect: (1) our ability to originate loans and obtain deposits; (2) the fair value of our financial assets and liabilities, including our securities portfolio; and (3) the average duration of our interest-earning assets. Interest-earning assets may be more responsive to changes in interest rates than interest-bearing liabilities, or vice versa (repricing risk), individual interest rates or rate indices underlying various interest-earning assets and interest-bearing liabilities may not change in the same degree over a given time period (basis risk), and interest rate relationships may change across the spectrum of interest-earning asset and interest-bearing liability maturities (yield curve risk), including a prolonged flat or inverted yield curve environment. Higher interest payment obligations could also adversely affect certain borrowers, particularly our floating-rate borrowers. Substantial and prolonged increases in market interest rates could have a material adverse effect on our financial condition, results of operation, and liquidity.

We have implemented strategies to lessen the potential effects of interest rate changes on our financial condition and results of operations. However, such strategies may only mitigate these effects and not always be successful.

21

Liquidity Risk

Liquidity risk could impair our ability to fund operations, meet our obligations as they become due, and jeopardize our financial condition.

Liquidity is essential to our business. An inability to raise funds through deposits, borrowings, the sale of loans and other sources could have a substantial negative effect on our liquidity. Our access to funding sources in amounts adequate to finance our activities, or on terms that are acceptable to us, could be impaired by factors that affect us specifically or the financial services industry or the economy in general. Factors that could detrimentally affect our access to liquidity sources include, among other things, a decrease in the level of our business activity as a result of a downturn in the markets in which our loans are concentrated and an adverse regulatory action against us. Our ability to borrow could also be impaired by factors that are not specific to us, such as a disruption in the financial markets or negative views and expectations about the prospects for the financial services industry.

Among other sources of funds, we rely heavily on deposits for funds to make loans and provide for our other liquidity needs. However, our loan demand has historically exceeded the rate at which we have been able to build core deposits for which there is substantial competition from a variety of different competitors, so we have relied on interest-sensitive deposits, including wholesale deposits, as sources of funds. In the future, depositors may not renew these deposits when they mature, or we may have to pay a higher rate of interest to attract or retain them or to replace them with other deposits or with funds from other sources. Not being able to attract deposits, or to retain or replace them as they mature, would adversely affect our liquidity. Paying higher deposit rates to attract, retain or replace those deposits could have a negative effect on our interest margin and operating results. A failure to maintain adequate liquidity could have a material adverse effect on our business, financial condition and results of operation.

Operational Risks

New lines of business, products, product enhancements, or services may subject us to additional risks.

General. From time to time, we implement new lines of business, or offer new products and product enhancements as well as new services within our existing lines of business and we will continue to do so in the future. There are risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed. In implementing, developing, or marketing new lines of business, products, product enhancements or services, we may invest significant time and resources, although we may not assign the appropriate level of resources or expertise necessary to make these new lines of business, products, product enhancements or services successful or to realize their expected benefits. Further, initial timetables for the introduction and development of new lines of business, products, product enhancements or services may not be achieved, and price and profitability targets may not prove feasible. External factors, such as compliance with regulations, competitive alternatives and shifting market preferences, may also impact the ultimate implementation of a new line of business or offerings of new products, product enhancements or services. Furthermore, any new line of business, product, product enhancement or service could have a significant impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business or offerings of new products, product enhancements or services could have an adverse impact on our business, financial condition or results of operations.

We face risks related to our operational, technological, and organizational infrastructure.

Our ability to grow and compete is dependent on the Company’s ability to build or acquire the necessary operational and technological infrastructure and to manage the cost of that infrastructure as we expand. In our case, operational risk can manifest itself in many ways, such as errors related to failed or inadequate processes, faulty or disabled computer systems, fraud by employees or outside persons and exposure to external events. As discussed below, we are dependent on our operational infrastructure to help manage these risks. In addition, we are heavily dependent on the strength and capability of our technology systems that the Company uses both to interface with customers and to manage internal financial and other systems. Our ability to develop and deliver new products that meet the needs of our existing customers and attract new ones depends on the functionality of our technology systems. Additionally, our ability to run our business in compliance with applicable laws and regulations is dependent on these infrastructures.

We continuously monitor our operational and technological capabilities and make modifications and improvements as circumstances warrant. In some instances, the Company may build and maintain these capabilities itself. We outsource many of these functions to third parties. These third parties may experience errors or disruptions that could adversely impact the Company and over which it may have limited control. We also face risk from the integration of new infrastructure platforms and/or new third-party providers of such platforms into the Company’s existing businesses.

Many of our larger competitors have substantially greater resources to invest in technological improvements. As a result, they may be able to offer additional or superior technologies compared to those that we will be able to provide, which could put us at a competitive disadvantage. Accordingly, we may lose customers seeking new technology-driven products and services to the extent we are unable to compete effectively.

22

A failure or a breach of our operational systems or infrastructure, or those of third party service providers, could disrupt our business, result in the unauthorized disclosure of confidential or proprietary information, damage our reputation, and cause financial losses.

Operations Risk. Our business is dependent on our ability to process, store and transmit, on a daily basis, numerous transactions. These transactions, as well as the information technology services we provide to clients, often must adhere to client-specific guidelines, as well as legal and regulatory standards. Developing and maintaining our operational systems and infrastructure is challenging, particularly as a result of rapidly evolving legal and regulatory requirements and technological shifts. Our financial, accounting, data processing or other operating systems and facilities may fail to operate properly or become disabled as a result of events that are wholly or partially beyond the Company’s control, such as a spike in transaction volume, cyber-attack or other unforeseen catastrophic events, which may adversely affect our ability to process these transactions or provide services.

In addition, our operations rely on the secure processing, storage and transmission of confidential, proprietary and other information on our computer systems, networks, and cloud infrastructure. Although we take protective measures to maintain the confidentiality, integrity, and availability of our and our clients’ information across all geographic and product lines, and endeavor to modify these protective measures as circumstances warrant, the nature of the threats continues to evolve. As a result, our computer systems, software, and networks may be vulnerable to unauthorized access, loss or destruction of data (including confidential and proprietary client information), account takeovers, unavailability of service, computer viruses or other malicious code, cyber-attacks and other events that could have an adverse security impact. Despite the defensive measures we take to manage our internal technological and operational infrastructure, these threats may originate externally from third parties such as foreign governments, organized crime and other hackers, and outsource or infrastructure-support providers and application developers or may originate internally from within our organization. Given the increasingly high volume of our transactions, certain errors may be repeated or compounded before they can be discovered and rectified.

We also face the risk of operational disruption, failure, termination or capacity constraints of any of the third parties that facilitate our business activities, including exchanges, clearing agents, clearing houses or other financial intermediaries. Such parties could also be the source of an attack on, or breach of, our operational systems, data or infrastructure. In addition, as interconnectivity with our clients grows, we increasingly face the risk of operational failure with respect to our clients’ systems.

Vendor Support Risk. As discussed below, we rely on external vendors to support our operations. We also rely on vendors to provide part of the services we deliver to customers. While we have a vendor management program policy in place and believe we have selected our vendors appropriately, we cannot directly control their employees or their operating environments. A breach or failure of a chosen vendor could have a material adverse impact on our operating environment and may expose the Company’s or our customers’ data which could result in operational, compliance and/or reputational risks. Replacing a chosen vendor could also result in a significant delay and expense.

Internet Risk. Our services and technology solutions rely on internet communications. Computers connected to the internet are vulnerable to many types of threats by cyber criminals. Although none of these types of attacks have had a material impact on our business to date, we anticipate that the efforts to attack our systems, and those of our customers and vendors, will grow in complexity and volume. As such, we have developed an incident response plan to coordinate the efforts following the identification of an attack.

Failure to maintain a secure computing environment, stay up to date on security vulnerabilities or deploy adequate technologies to protect against attacks, may subject our information and systems to security breaches that could compromise confidential information and damage our reputation and business. We rely on industry-standard encryption and authentication security systems to provide the security required to protect our data. Periodically our systems are subjected to scans, exploitations and audits by a qualified independent third party to evaluate the effectiveness of our security controls and system configurations.

Cyber criminals may attempt to trick employees, customers or vendors through phishing schemes or other methods to disclose sensitive information. Employees receive annual security training and are periodically assessed through simulated attack tools to assist with behavior shaping and coaching against social engineering threats.

If one or more of these events occurs, it could potentially jeopardize the confidential, proprietary and other information processed and stored in, and transmitted through, the Company’s computer systems and networks, or otherwise cause interruptions or malfunctions in our, as well as our clients’ or other third parties’ operations, which could result in damage to our reputation, substantial costs, regulatory penalties and/or client dissatisfaction or loss.

Potential costs of a cyber incident may include, but would not be limited to, remediation costs, increased protection costs, lost revenue from the unauthorized use of proprietary information or the loss of current and/or future customers, and litigation.

Insurance Risk. We maintain an insurance policy through the Company’s blanket bond at the maximum of currently available limits. However, we cannot assure you that this policy would be sufficient to cover all financial losses, damages, and penalties, including lost revenues, should the Company experience any one or more of our or a third party’s systems failing or experiencing attack.

A cyber-attack or other security incident, including one that results in the theft, loss, manipulation, or misuse of information (including personal information), or the disabling of systems and access to information critical to business operations, may result in increased costs, reductions in revenue, reputational damage, legal exposure and business disruptions.

A “deep fake” incident, which involves synthetic media that is created using artificial intelligence to create realistic images, videos, or audio recordings of people that appear to be real but are not. This technology has the potential to be used for malicious purposes, such as spreading misinformation or impersonating individuals. Deep fakes could have a material impact on the Company in a number of ways, including:

23

Our ability to provide our products and services, many of which are internet-based, and communicate with our customers, depends upon the management and safeguarding of information systems and infrastructure, networks, software, data, technology, methodologies and business secrets, including those of our service providers. Our products and services involve the collection, authentication, management, usage, storage, transmission and eventual destruction of sensitive and confidential information, including personal information, regarding our customers and their accounts, our employees, our partners and other third parties with which we do business. We also have arrangements in place with third parties through which we share and receive information about their customers who are or may become our customers. The financial services industry, including the Company, is particularly at risk because of the use of and reliance on digital banking products and other digital services, including mobile banking products, such as mobile payments, and other internet- and cloud-based products and applications, and the development of additional remote connectivity solutions, which increase cybersecurity risks and exposure.

Technologies, systems, networks, and other devices of the Bank as well as those of our employees, service providers, partners and other third parties with whom we interact, have been and may continue to be the subject of cyber-attacks and other security incidents, including computer viruses, hacking, malware, ransomware, supply chain attacks, vulnerabilities, credential stuffing, or phishing or other forms of social engineering. Such cyber-attacks and other security incidents are designed to lead to various harmful outcomes, such as unauthorized transactions in the Bank’s accounts, unauthorized or unintended access to or release, gathering, monitoring, disclosure, loss, destruction, corruption, disablement, encryption, misuse, modification or other processing of confidential or sensitive information (including personal information), intellectual property, software, methodologies or business secrets, disruption, sabotage or degradation of service, systems or networks, or other damage. These threats may derive from, among other things, error, fraud or malice on the part of our employees, insiders, or third parties or may result from accidental technological failure or design flaws. Any of these parties may also attempt to fraudulently induce employees, service providers, customers, partners or other third-party users of our systems or networks to disclose confidential or sensitive information (including personal information) in order to gain access to our systems, networks or data or that of our customers, partners, or third parties with whom we interact, or to unlawfully obtain monetary benefit through misdirected or otherwise improper payment. For instance, any party that obtains our confidential or sensitive information (including personal information) through a cyber-attack or other security incident may use this information for ransom, to be paid by us or a third party, as part of a fraudulent activity that is part of a broader criminal activity, or for other illicit purposes.

Cyber and information security risks for financial institutions like us continue to increase due to the proliferation of new technologies, the industry-wide shift to reliance upon the internet to conduct financial transactions, and the increased sophistication and activities of malicious actors, organized crime, perpetrators of fraud, hackers, terrorists, activists, extremist parties, formal and informal instrumentalities of foreign governments, state-sponsored actors and other external parties. In addition, our customers access our products and services using personal devices that are necessarily external to our security control systems. There has also been a significant proliferation of consumer information available on the internet resulting from breaches of third-party entities, including personal information, log-in credentials and authentication data. This threat could include the risk of unauthorized account access, data loss and fraud. The use of artificial intelligence, “bots” or other automation software can increase the velocity and efficacy of these types of attacks. We will likely face an increasing number of attempted cyber-attacks as we expand our mobile and other internet-based products and services, as well as our usage of mobile and cloud technologies and as we provide more of these services to a greater number of banking customers.

The methods and techniques employed by malicious actors change frequently, are increasingly sophisticated and often are not fully recognized or understood until after they have occurred, and some techniques could occur and persist for an extended period of time before being detected and remediated. We may also be unable to hire, develop and retain talent that keeps pace with the rapidly changing cyber threat landscape, and which are capable of preventing, detecting, mitigating or remediating these risks. Although we seek to maintain a robust suite of authentication and layered information security controls, any one or combination of these controls could fail to prevent, detect, mitigate or remediate these risks in a timely manner.

A disruption or breach, including as a result of a cyber-attack or media reports of perceived security vulnerabilities at the Bank or at our service providers, could result in legal and financial exposure, regulatory intervention, litigation, remediation costs, card reissuance, supervisory liability, damage to our reputation or loss of confidence in the security of our systems, products and services that could adversely affect our business. There can be no assurance that unauthorized access or cyber incidents will not occur or that we will not suffer material losses in the future. If future attacks are successful or if customers are unable to access their accounts online for other reasons, it could adversely impact our ability to service customer accounts or loans, complete financial transactions for our customers or otherwise operate any of our businesses or services. In addition, a breach or attack affecting one of our service providers or other third parties with which we interact could harm our business even if we do not control the service that is attacked.

Further, our ability to monitor our service providers’ cybersecurity practices is limited. Although the agreements that we have in place with our service providers generally include requirements relating to cybersecurity and data privacy, we cannot guarantee that such agreements will prevent a cyber incident impacting our systems or information or enable us to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents.

In addition, the increasing prevalence and the evolution of cyber-attacks and other efforts to breach or disrupt our systems or networks or those of our customers, service providers, partners or other third parties with which we interact has led, and will likely continue to lead, to increased costs to us with respect to preventing, detecting, mitigating and remediating these risks, as well as any related attempted fraud. In order to address ongoing and future risks, we must expend resources to support protective security measures, investigate and remediate any vulnerabilities of our information systems and infrastructure and invest in new technology designed to mitigate security risks. Further, high profile cyber incidents at the Bank or other financial institutions could lead to a general loss of customer confidence in financial institutions that could negatively affect us, including harming the market perception of the effectiveness of our security measures or the global financial system in general, which could result in reduced use of our financial products. We have insurance against some cyber risks and attacks; nonetheless, our insurance coverage may not be sufficient to offset the impact of a material loss event (including if our insurer denies coverage as to any particular claim in the future), and such insurance may increase in cost or cease to be available on commercially reasonable terms, or at all, in the future.

The adoption and use of artificial intelligence tools by us and our third-party vendors and service providers may increase the risk of errors, omissions, unfair treatment or fraudulent behavior by our employees, clients, or counterparties, or other third parties.

Our adoption and use of artificial intelligence, including generative artificial intelligence, machine learning, and similar tools and technologies that collect, aggregate, analyze or generate data or other materials or content (collectively, "AI"), for internal use has increased our efficiency, and we expect to continue to adopt such tools as appropriate, in line with our AI Strategy. In addition, we expect our third-party vendors and service providers to increasingly develop and incorporate AI into their product offerings faster than we are able to do so independently. The adoption and incorporation of such AI tools can lead to concerns around safety and soundness, fair access to financial services, fair treatment of consumers, and compliance with applicable laws and regulations. We have implemented an AI governance function and risk management framework that includes a risk assessment of internal and vendor AI solutions, due diligence, and controls.

In addition, regulation of AI is rapidly evolving as legislatures and regulators are increasingly focused on these powerful emerging technologies. The technologies underlying AI and its uses are subject to a variety of laws and regulations, including intellectual property, data privacy and cybersecurity, consumer protection, competition, equal opportunity, and fair lending laws, and are expected to be subject to increased regulation and new laws or new applications of existing laws and regulations. AI is the subject of ongoing review by various U.S. governmental and regulatory agencies, and various U.S. states are applying, or are considering applying, existing laws and regulations to AI or are considering general legal frameworks for AI. We may not be able to anticipate how to respond to these rapidly evolving frameworks, and we may need to expend resources to adjust our operations or offerings in certain jurisdictions if the legal frameworks are inconsistent across jurisdictions. Furthermore, because AI technology itself is highly complex and rapidly developing, it is not possible to predict all the legal, operational or technological risks that may arise relating to the use of AI. Our use of AI may require additional resources, including the incurrence of additional costs, to develop and maintain our products and services to minimize potentially harmful or unintended consequences, to comply with applicable and emerging laws and regulations, to maintain or extend our competitive position, and to address any ethical, reputational, technical, operational, legal, competitive or regulatory issues which may arise as a result of any of the foregoing.

24

We rely on third party service providers to provide key components of our business infrastructure, and a failure of these parties to perform for any reason could disrupt our operations.

Third parties provide key components of our business infrastructure such as data processing, internet connections, network access, cloud computing access, core application processing, statement production and account analysis. Our business depends on the successful and uninterrupted functioning of our information technology and telecommunications systems and third-party servicers. The failure of these systems, or the termination of a third-party software license or service agreement on which any of these systems is based, could interrupt our operations. Because our information technology and telecommunications systems interface with and depend on third-party systems, we could experience service denials if demand for such services exceeds capacity or such third-party systems fail or experience interruptions. Replacing vendors or addressing other issues with our third-party service providers could entail significant delay and expense. If we are unable to efficiently replace ineffective service providers, or if we experience a significant, sustained or repeated system failure or service denial, it could compromise our ability to operate effectively, damage our reputation, result in a loss of customer business, and subject us to additional regulatory scrutiny and possible financial liability, any of which could have an adverse effect on our business, financial condition and results of operations.

Reputational risk and social factors may impact our results.

Our ability to originate and maintain accounts is highly dependent upon consumer and other external perceptions, whether or not true, of our business practices and/or our financial health. Adverse perceptions could damage our reputation in both the customer and funding markets, leading to difficulties in generating and maintaining accounts as well as in financing them. Adverse developments with respect to the consumer or other external perceptions regarding the practices of our competitors, or our industry as a whole, may also adversely impact our reputation. In addition, adverse reputational impacts on third parties with whom we have important relationships may also adversely impact our reputation. Adverse impacts on our reputation, or the reputation of our industry, may also result in greater regulatory and/or legislative scrutiny, which may lead to laws or regulations that may change or constrain the manner in which the Company engages with its customers and the products the Company offers. Adverse reputational impacts or events may also increase our litigation risk. We carefully monitor internal and external developments for areas of potential reputational risk and have established governance structures to assist in evaluating such risks in our business practices and decisions.

We could be subject to losses, regulatory action, or reputational harm due to fraudulent and negligent acts on the part of loan applicants, our employees, and vendors.