ORRF US Equity☆

orrf-20251231

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

For the fiscal year ended December 31, 2025

For the transition period from _____ to _____

Commission file number: 001-34292

ORRSTOWN FINANCIAL SERVICES, INC.

(Exact Name of Registrant as Specified in its Charter)

Registrant’s Telephone Number, Including Area Code: (717)532-6114

Securities registered pursuant to Section 12(b) of the Act:

Title of Each Class Trading symbol(s) Name of Each Exchange on Which Registered

Common Stock, no par value ORRF NASDAQ Stock Market

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ̈Nox

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ̈Nox

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yesx No ̈

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yesx No ̈

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and "emerging growth company" in Rule 12b-2 of the Exchange Act.

Large accelerated filer ̈ Accelerated filer x

Non-accelerated filer ̈ Smaller reporting company ☐

Emerging growth company ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act.). Yes ☐No x

The aggregate market value of the voting stock held by non-affiliates computed by reference to the price at which the common stock was last sold as of the last business day of the Registrant’s most recently completed second fiscal quarter was approximately $596.2 million. For purposes of this calculation, the term “affiliate” refers to all directors and executive officers of the registrant, and all persons beneficially owning more than 5% of the registrant’s common stock.

Number of shares outstanding of the Registrant’s common stock as of March 6, 2026: 19,619,798.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the Proxy Statement for the 2026 Annual Meeting of Shareholders are incorporated by reference in Part III of this Form 10-K.

Table of Contents

ORRSTOWN FINANCIAL SERVICES, INC.

FORM 10-K

INDEX

Page

Part I

Item 1. Business 4

Item 1A. Risk Factors 13

Item 1B. Unresolved Staff Comments 26

Item 1C. Cybersecurity 26

Item 2. Properties 27

Item 3. Legal Proceedings 27

Item 4. Mine Safety Disclosures 27

Part II

Item 6. [Reserved] 30

Item 7A. Quantitative and Qualitative Disclosures About Market Risk 62

Item 8. Financial Statements and Supplementary Data 64

Item 9A. Controls and Procedures 138

Item 9B. Other Information 138

Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections 138

Part III

Item 10. Directors, Executive Officers and Corporate Governance 138

Item 11. Executive Compensation 138

Item 14. Principal Accountant Fees and Services 139

Part IV

Item 15. Exhibit and Financial Statement Schedules 140

1

Table of Contents

Glossary of Defined Terms

The following terms may be used throughout this Annual Report on Form 10-K, including the consolidated financial statements and related notes.

Term Definition

ACL Allowance for credit losses

AFS Available-for-sale

AOCI Accumulated other comprehensive income (loss)

ASC Accounting Standards Codification

ASU Accounting Standards Update

ATM Automated teller machine

BHC Act Bank Holding Company Act of 1965

CECL Current expected credit losses

CET1 Common Equity Tier 1

CFPB Consumer Financial Protection Bureau

CMO Collateralized mortgage obligation

CRA Community Reinvestment Act

DCF Discounted cash flow

Dodd-Frank Act Dodd-Frank Wall Street Reform and Consumer Protection Act

ERM Enterprise Risk Management

Exchange Act Securities Exchange Act of 1934, as amended

FASB Financial Accounting Standards Board

FDIC Federal Deposit Insurance Corporation

FDM Financial difficulty modification

FHC Financial holding company

FHLB Federal Home Loan Bank

FRB Board of Governors of the Federal Reserve System

GAAP Accounting principles generally accepted in the United States of America

GDP Gross Domestic Product

GSE United States government-sponsored enterprise

IEL Individually evaluated loan

IRC Internal Revenue Code of 1986, as amended

LHFS Loans held for sale

MBS Mortgage-backed securities

MSR Mortgage servicing right

NIM Net interest margin

OCI Other comprehensive income (loss)

OREO Other real estate owned (foreclosed real estate)

PCD loans Purchased credit deteriorated loans

PCI loans Purchased credit impaired loans

PPP Paycheck Protection Program

Repurchase Agreements Securities sold under agreements to repurchase

ROU Right of use (leases)

SBA U.S. Small Business Administration

SEC Securities and Exchange Commission

Securities Act Securities Act of 1933, as amended

SOFR Secured Overnight Financing Rate

TDR Troubled debt restructuring

U.S. United States of America

2

Table of Contents

PART I

Caution About Forward-Looking Statements

Certain statements appearing herein, which are not historical in nature, are forward-looking statements within the meaning of Section 27A of the Securities Act and Section 21E of the Exchange Act, and are intended to be covered by the safe harbor provisions of the Private Securities Litigation Reform Act of 1995. In addition, we may make other written and oral communications, from time to time, that contain such statements. Such forward-looking statements reflect the current views of the Company's management with respect to, among other things, future events and the Company's financial performance. These statements are often, but not always, made through the use of words or phrases such as “may,” “should,” “could,” “predict,” “potential,” “believe,” “will likely result,” “expect,” “continue,” “will,” “anticipate,” “seek,” “estimate,” “intend,” “plan,” “project,” “forecast,” “goal,” “target,” “would” and “outlook,” or the negative variations of those words or other comparable words of a future or forward-looking nature. Forward-looking statements are statements that include projections, predictions, expectations, estimates or beliefs about events or results or otherwise are not statements of historical facts, many of which, by their nature, are inherently uncertain and beyond the Company's control, and include, but are not limited to, statements related to new business development, new loan opportunities, growth in the balance sheet and fee-based revenue lines of business, merger and acquisition activity, cost savings initiatives, reducing risk assets, and mitigating losses in the future. Accordingly, the Company cautions you that any such forward-looking statements are not guarantees of future performance and are subject to risks, assumptions and uncertainties that are difficult to predict. Although the Company believes that the expectations reflected in these forward-looking statements are reasonable as of the date made, actual results may prove to be materially different from the results expressed or implied by the forward-looking statements and there can be no assurances that the Company will achieve the desired level of new business development and new loans, growth in the balance sheet and fee-based revenue lines of business, successful merger and acquisition activity and cost savings initiatives, and continued reductions in risk assets or mitigate losses in the future. Factors which could cause the actual results to differ from those expressed or implied by the forward-looking statements include, but are not limited to, the following: interest rate changes or volatility; general economic conditions (including inflation and concerns about liquidity) on a national basis or in the local markets in which the Company operates; ineffectiveness of the Company's strategic growth plan due to changes in current or future market conditions; the effects of competition and how it may impact our community banking model, including industry consolidation and development of competing financial products and services; changes in consumer behavior due to changing political, business and economic conditions, or legislative or regulatory initiatives; changes in, and evolving interpretations of, existing and future laws and regulations; changes in credit quality; inability to raise capital, if necessary, under favorable conditions; volatility in the securities markets; the demand for our products and services; deteriorating economic conditions; geopolitical tensions; operational risks including, but not limited to, cybersecurity incidents, fraud, natural disasters and future pandemics; expenses associated with litigation and legal proceedings and other risks and uncertainties. The foregoing list of factors is not exhaustive.

For a description of factors that we believe could cause actual results to differ materially from such forward-looking statements, you should review our Risk Factors discussion in Item 1A, our Critical Accounting Policies section included in Item 7, and Note 24, Contingencies, in the Notes to Consolidated Financial Statements included in Item 8 of this Annual Report on Form 10-K. We encourage readers of this report to understand forward-looking statements to be strategic objectives rather than absolute targets of future performance. If one or more events related to these or other risks or uncertainties materialize, or if the Company's underlying assumptions prove to be incorrect, actual results may differ materially from what the Company anticipates. Accordingly, you should not place undue reliance on any such forward-looking statements. Any forward-looking statement speaks only as of the date on which it is made, and the Company does not undertake any obligation to publicly update or review any forward-looking statement, whether as a result of new information, future developments or otherwise. New risks and uncertainties arise from time to time, and it is not possible for the Company to predict those events or how they may affect it. In addition, the Company cannot assess the impact of each factor on its business or the extent to which any factor, or combination of factors, may cause actual results to differ materially from those contained in any forward-looking statements. All forward-looking statements, expressed or implied, included in this Annual Report on Form 10-K are expressly qualified in their entirety by this cautionary statement. This cautionary statement should also be considered in connection with any subsequent written or oral forward-looking statements that the Company or persons acting on the Company's behalf may issue.

3

Table of Contents

ITEM 1 – BUSINESS

Background

Orrstown Financial Services, Inc., a Pennsylvania corporation, is the financial holding company ("FHC") for its wholly-owned subsidiary Orrstown Bank. The Company’s principal executive offices are located at 4750 Lindle Road, Harrisburg, Pennsylvania, 17111. The Parent Company was organized on November 17, 1987 for the purpose of acquiring the Bank and such other banks and bank-related activities as are permitted by law. The Company provides banking and financial advisory services in south central Pennsylvania, principally in Berks, Cumberland, Dauphin, Franklin, Lancaster, Perry and York Counties, Pennsylvania, and in Anne Arundel, Baltimore, Harford, Howard and Washington Counties, Maryland, as well as Baltimore City, Maryland. The Company’s lending area also includes counties in Pennsylvania, Maryland, Delaware, Virginia and West Virginia within a 75-mile radius of the Company's executive and administrative offices as well as the District of Columbia.

Merger

The Company merged with Codorus Valley Bancorp, Inc. ("Codorus Valley") and the Bank merged with its wholly-owned bank subsidiary, PeoplesBank, A Codorus Valley Company, with the Company and the Bank as the surviving entities in the Merger on July 1, 2024 (the "Codorus Valley Merger"). The merger and acquisition method of accounting was used to account for the transaction with the Company as the acquirer. The Company recorded the assets and liabilities of Codorus Valley at their respective fair values as of July 1, 2024. The transaction was valued at $233.4 million and expanded the Bank’s footprint into the York, Pennsylvania market while increasing its market penetration in its existing markets.

Business

The Bank was organized in 1919 as a state-chartered bank. On March 8, 1988, in a bank holding company reorganization transaction, the Parent Company acquired 100% ownership of the Bank.

The Parent Company’s primary activity consists of owning and supervising its subsidiary, the Bank. Day-to-day management is conducted by its officers, who are also Bank officers. The Parent Company has historically derived most of its income through dividends from the Bank. At December 31, 2025, the Company had total assets of $5.5 billion, total deposits of $4.5 billion and total shareholders’ equity of $591.5 million.

The Bank operates in the community banking segment and engages in lending activities, including commercial, residential, commercial mortgages, construction, municipal, and various forms of consumer lending and deposit services, including checking, savings, time and money market deposits. The Bank also provides fiduciary, investment advisory, insurance and brokerage services. These activities engaged in by the Bank are authorized by the Pennsylvania Banking Code of 1965. The Company and the Bank are subject to regulation by certain federal and state agencies and undergo periodic examinations by such regulatory authorities. The concentrations of credit by type of loan are included in Note 4, Loans and Allowance for Credit Losses, to the Consolidated Financial Statements under Part II, Item 8, "Financial Statements and Supplementary Data."

Human Capital

At December 31, 2025, the Bank had 627 full-time and 25 part-time employees. At December 31, 2025, approximately 67% of our workforce was female and 33% was male. Our average tenure is approximately seven years. The Parent Company has no employees. Its 17 executive officers are employees of the Bank, who represent a mix of newer and more seasoned employees with significant and diverse experience and have an average tenure of 11 years with the Company.

We encourage and support the growth and development of our employees. Continuous learning and career development is advanced through ongoing performance and development conversations with employees, internally created training programs, including development and advancement training offered through our in house training program called Orrstown University, customized corporate training engagements and educational reimbursement and certification programs. Training opportunities are available both online and in-person, and all employees have online access to courses for professional development provided by a third party. We have a Management Associate Program, which had three employees in 2025. This program provides a structured learning experience, which ranges from one to two years, that focuses on the commercial line of business and credit administration, and then progresses into rotations within other lines of business.

Employee evaluations are conducted on at least an annual basis. Those evaluations focus on job performance, achievement of goals and employee and career development. In addition, we monitor employee satisfaction and engagement through periodic employee surveys.

4

Table of Contents

The safety, health and wellness of our employees is a top priority. Through teamwork and the adaptability of our management and staff, our remote work options evolved as many of our employees effectively work a hybrid schedule from our office and remote locations. We continue to highlight the importance of the safety, health and wellness of our employees. We also introduced a number of new initiatives that focus on both physical and mental health. We take every opportunity to provide our employees with the tools and resources to assist them to navigate their work environment in a more positive and thoughtful manner.

We offer competitive compensation to attract and further strengthen employee engagement and encourage retention. Compensation packages include a market-competitive salary, healthcare and retirement benefits, paid time off, and may also include bonuses or sales commissions and short-term and long-term equity incentives.

We deploy numerous methods to foster employee engagement, including regular company-wide calls, weekly communication through our Orrstown Connections publications, new employee engagement event with the CEO, employee recognitions and service anniversaries including an event for Employee Appreciation Day, community service and leadership programs, annual events for all employees and off-site events with family and friends.

Lending

Federal bank regulatory agencies have adopted uniform regulations prescribing standards for extensions of credit that are secured by liens or interests in real estate or made for the purpose of financing permanent improvements to real estate. Under these regulations, all insured depository institutions, such as the Bank, must adopt and maintain written policies establishing appropriate limits and standards for extensions of credit that are secured by liens or interests in real estate or are made for the purpose of financing permanent improvements to real estate. These policies must establish loan portfolio diversification standards, prudent underwriting standards (including loan-to-value limits) that are clear and measurable, loan administration procedures and documentation, and approval and reporting requirements. The real estate lending policies must reflect consideration of the federal bank regulatory agencies’ Interagency Guidelines for Real Estate Lending Policies.

All secured loans are supported with appraisals or evaluations of collateral. Business equipment and machinery, inventories, accounts receivable, and farm equipment are considered appropriate security, provided borrowers meet acceptable standards for liquidity and marketability. Loans secured by real estate generally do not exceed 85% of the appraised value of the property. Loan to collateral values are monitored as part of the loan review process, and appraisals are updated as deemed appropriate under the circumstances.

Commercial Lending

The Bank originates commercial real estate, equipment, construction, working capital and other commercial purpose loans to commercial clients throughout the Bank’s various markets. The Bank has significant market share in south central Pennsylvania and has been expanding its presence geographically in recent years. Currently, growth markets include the Harrisburg region, Lancaster County and Maryland markets, while the Bank's commercial lending is primarily focused in these geographic regions or with borrowers headquartered in these geographic regions. The Company’s lending area also includes counties in Pennsylvania, Maryland, Delaware, Virginia and West Virginia within a 75-mile radius of the Company's executive and administrative offices, as well as the District of Columbia.

The Bank’s credit policy dictates the underwriting requirements for the various types of commercial loans the Bank makes available to borrowers. The policy covers such requirements as debt coverage ratios, advance rates against different forms of collateral, loan-to-value ratios and maximum term.

A majority of the Company’s loans are for business purposes. At December 31, 2025, approximately 75% of the loan portfolio was comprised of commercial loans compared to 76% at December 31, 2024.

Consumer Lending

The Bank originates home equity loans, home equity lines of credit and other consumer loans, primarily through its branch network and client service center. A large majority of the consumer loans are secured by either a first or second lien position on the borrower’s primary residential real estate. The Bank requires a home equity loan borrower to have a credit score of 710 for a loan-to-value ratio of 85% of the value of the real estate being taken as collateral. Home equity loan borrowers with a credit score under 710 require additional real estate collateral for a loan-to value ratio less than 85%. The Bank also, at times, purchases consumer loans to help diversify credit risk in our loan portfolio.

5

Table of Contents

Residential Lending

The Bank originates residential mortgages throughout its various markets referred from retail branches and through a network of mortgage loan officers. Residential mortgages originated by the Bank may be sold to secondary market investors, which include both GSE and non-GSE investors. All mortgages, regardless of being sold or held in the Bank’s portfolio, are generally underwritten to secondary market industry standards for prime mortgages. For loans originated for investment, the Bank requires pricing adjustments commensurate with the risk and the real estate taken as collateral results in the Bank holding a first lien on the property. The loan-to-value ratio requirements of the real estate being taken as collateral varies per the Credit Policy, and may require the borrower to obtain private mortgage insurance. The Bank also, at times, purchases residential mortgage loans to help diversify credit risk in our loan portfolio and to continue meeting the credit needs of the communities in which the Bank operates.

Loan Review

The Company has a loan review policy and program, which is designed to identify and monitor risk, evaluate the adequacy and adherence to internal credit policies and loan administration procedures, verify the quality of loan approval, monitoring and risk assessments, and assess the overall quality of the loan portfolio. The Management ERM Committee, comprised of executive and senior officers and loan department personnel, is charged with the oversight of overall credit quality and risk exposure of the Company's loan portfolio. This includes the monitoring of the lending activities of all Company personnel with respect to underwriting and processing new loans and the timely follow-up and corrective action for loans showing signs of deterioration in quality. A loan review program provides the Company with an independent review of the commercial loan portfolio on an ongoing basis. Generally, consumer and residential mortgage loans are included in the Pass categories unless a specific action, such as extended delinquencies, bankruptcy, repossession or death of the borrower occurs, which increases the possibility of a credit loss.

Internal loan reviews are completed annually on all commercial relationships with a committed loan balance in excess of $2.0 million. In addition, all commercial relationships greater than $500 thousand rated special mention, substandard, doubtful or loss are reviewed quarterly and corresponding risk ratings are changed or reaffirmed by the Company's Problem Loan Committee, with subsequent reporting to the Management ERM Committee and the Board ERM Committee.

The Bank outsources its independent loan review to a third-party provider, who monitors and evaluates commercial borrowers on a quarterly basis utilizing risk-rating criteria established in the credit policy in order to identify deteriorating trends and detect conditions which might indicate potential problem loans. The results of the third-party loan review are reported quarterly to the Management and Board ERM Committees for review. The loan ratings are a data component evaluated within the qualitative factors of the ACL calculation.

Deposit Products

The Bank offers deposit products to retail, commercial, non-profit and government clients through its retail branch network, its website and commercial team. Product offerings for retail clients include checking accounts, money markets, savings and certificates of deposit. The Bank offers a suite of treasury management solutions for businesses that help them to forecast and manage their cash and receivables. The Bank is committed to advancing digital capabilities for all clients, to ensure scalability and optimization of financial performance within the organizations. A robust treasury management online banking platform allows clients to send and collect money electronically using ACH and wire transfer origination services, deposit checks via mobile or desktop capture, and mitigate fraud through check and ACH positive pay services. Wire transfers may be sent and also received domestically, as well as internationally in most currencies. Online bill-pay services allow check and electronic payments, with same day, next day and future dated payments. Additionally, business clients can automatically move money between Bank accounts using various automated sweep services. Using strategic partnerships, the Bank is able to offer best-in-class lockbox services, armored cash logistic solutions, credit cards, purchasing cards, and merchant card processing services.

Digital capability for consumers includes person-to-person (P2P) payment, bill pay, mobile deposit capture and domestic money transfer services. Traditional domestic and international wire transfer services are also offered via the Bank's branches. In addition to opening accounts and communicating with employees via traditional branch or call-center engagement, digital online account opening, online loan and credit card application processing, online mortgage pre-qualification and mortgage application processing, automated telephone services, and online chat features provide consumers with convenient digital alternatives to more traditional products and services.

Investment Services

The Bank renders services as trustee, executor, administrator, guardian, managing agent, custodian, investment advisor, and other fiduciary activities authorized by law under the trade name Orrstown Financial Advisors, or OFA. OFA offers retail

6

Table of Contents

brokerage services through a third-party broker/dealer arrangement with Cetera Wealth Services LLC. At December 31, 2025 and 2024, assets under management by OFA totaled $3.1 billion and $3.2 billion, respectively.

Competition

The Bank’s principal market area consists of south central Pennsylvania, the greater Baltimore region, and Washington County, Maryland. The Bank serves a substantial number of depositors in this market area and its contiguous counties. The Bank also competes for loans in counties in Pennsylvania, Maryland, Delaware, Virginia and West Virginia within a 75-mile radius of the Bank's executive and administrative officers as well as the District of Columbia.

The Bank competes with other banks and less heavily regulated financial services companies, such as credit unions and finance and trust companies, as well as mortgage banking companies, mutual funds, investment advisors, and brokerage firms, both within and outside of its primary market areas. Financial technology companies, or Fintechs, are also providing nontraditional, but increasingly strong competition for the acquisition and retention of clients.

The Bank competes for loans primarily on the basis of a combination of value and service by building client relationships as a result of addressing its clients’ banking needs, demonstrating expertise, and providing convenience to its clients.

The Bank competes for deposits similarly on the basis of a combination of value and service and by providing convenience through a banking network of branches and ATMs within its markets and digital service channels such as mobile banking.

The Company implements strategic initiatives focused on expanding its core businesses and exploring opportunities for acquisition and divestiture to the extent permitted by its regulators. The Company's management believes its market area will support further growth in the future.

Regulation and Supervision

The Parent Company is a bank holding company registered with the FRB and has elected status as an FHC. The Bank is a Pennsylvania-chartered commercial bank and a member bank of the Federal Reserve System.

Regulatory Environment

The banking industry is highly regulated, and Orrstown is subject to supervision, regulation, and examination by the FRB, as its primary federal regulator, and the Pennsylvania Department of Banking and Securities. The statutory and regulatory framework that governs the Company is generally intended to protect depositors and clients, the FDIC's Deposit Insurance Fund, the U.S. banking and financial system, and financial markets as a whole by ensuring the safety and soundness of bank holding companies ("BHCs") and banks. Bank regulators regularly examine the operations of BHCs and banks. Regulators have broad supervisory and enforcement authority over BHCs and banks, including the power to impose nonpublic supervisory agreements, issue cease and desist orders, impose fines and other civil penalties, terminate deposit insurance, and appoint a conservator or receiver. Engaging in unsafe or unsound practices or failing to comply with applicable laws, regulations, and supervisory agreements could subject the Company and its respective officers, directors, and institution-affiliated parties to the remedies described above, and other sanctions.

Banking statutes, regulations, and policies are continually under review, as applicable, by Congress, state legislatures, and federal and state regulatory agencies. In addition to laws and regulations, state and federal bank regulatory agencies may issue policy statements, interpretive letters, and similar written guidance applicable to Orrstown. Any change in statutes, regulations, or regulatory policies applicable to us, including changes in their interpretation or implementation, could have a material effect on our business or organization.

The Parent Company is also subject to the disclosure and regulatory requirements of the Securities Act and the Exchange Act, both as administered by the SEC, as well as the rules of Nasdaq that apply to companies with securities listed on the Nasdaq Capital Market.

Several of the more significant regulatory provisions applicable to BHCs and banks to which the Company and the Bank are subject are discussed below, along with certain regulatory matters concerning the Parent Company and the Bank. To the extent that the following information describes statutory or regulatory provisions, such information is qualified in its entirety by reference to the particular statutes or regulations. Any change in applicable law or regulation may have a material effect on the business and prospects of the Parent Company and the Bank.

7

Table of Contents

Financial and Bank Holding Company Activities

As a FHC, the Parent Company is permitted to engage, directly or through subsidiaries, in a wide variety of activities that are financial in nature or are incidental or complementary to a financial activity, in addition to the activities otherwise permitted for bank holding companies that are not FHCs.

As a FHC, the Parent Company is generally subject to the same regulation as other BHCs, including the reporting, examination, supervision and consolidated capital requirements of the FRB. To preserve its FHC status, the Parent Company must remain well-capitalized and well-managed and ensure that the Bank remains well-capitalized and well-managed for regulatory purposes and earns “satisfactory” or better ratings on its periodic CRA examinations. An FHC ceasing to meet these standards is subject to a variety of restrictions, depending on the circumstances.

If the FRB finds that the Parent Company or the Bank are either not well-capitalized or not well-managed, the FRB will notify the Parent Company of its non-compliance, and if the Bank is not well-capitalized, the Parent Company or the Bank must promptly notify the FRB. Until compliance is restored, the FRB has broad discretion to impose appropriate limitations on a FHC’s activities. If compliance is not restored within 180 days, the FRB may ultimately require the FHC to divest its depository institutions or in the alternative, to discontinue or divest any activities that are not permitted for non-FHC bank holding companies.

If the FRB determines that a FHC or its subsidiaries do not satisfy the CRA requirements, the potential restrictions are different. In that case, until all of the subsidiary institutions are restored to at least “satisfactory” CRA rating status, the FHC may not engage, directly or through a subsidiary, in any of the additional financial in nature activities permissible for FHCs under the BHC Act nor make additional acquisitions of companies engaged in such additional activities. However, completed acquisitions and additional activities and affiliations previously begun are left undisturbed, as the BHC Act does not require divestiture for this type of situation.

Federal Deposit Insurance

The FDIC's Deposit Insurance Fund provides insurance coverage for certain deposits, up to a standard maximum deposit insurance amount of $250 thousand per depositor for deposits held in the same right and capacity at an insured depository institution and is funded through assessments on insured depository institutions, based on a methodology designed to take into account the risk each institution poses to the Deposit Insurance Fund. The Bank accepts client deposits that are insured by the Deposit Insurance Fund and, therefore, must pay insurance premiums. The FDIC may increase the Bank’s insurance premiums based on various factors, including changes in the Bank's risk profile. Beginning with the first quarterly assessment period of 2023, the FDIC increased the initial base deposit insurance assessment rate by two basis points, which was intended to increase the Deposit Insurance Fund ("DIF") reserve ratio to the statutory minimum of 1.35%. For 2025 and 2024, the FDIC insurance expense for the Bank was $2.8 million and $2.7 million; respectively.

If the FDIC is appointed conservator or receiver of a bank upon that bank’s insolvency or the occurrence of other events, the FDIC may sell some, part, or all of a bank’s assets and liabilities to another bank or repudiate or disaffirm most types of contracts to which that bank was a party if the FDIC believes such contracts are burdensome. In resolving the estate of a failed bank, the FDIC as receiver will first satisfy its own administrative expenses, and the claims of holders of U.S. deposit liabilities also have priority over those of other general unsecured creditors.

Liability for Banking Subsidiaries

The Parent Company is required to serve as a source of financial and managerial strength to the Bank and, under appropriate conditions, to commit resources to support the Bank. This support may be required by the FRB at times when the Bank might otherwise determine not to provide it or when doing so is not otherwise in the interests of the Parent Company or its shareholders or creditors. The FRB may require a BHC to make capital injections into a troubled subsidiary bank and may charge the BHC with engaging in unsafe and unsound practices if the BHC fails to commit resources to such a subsidiary bank or if it undertakes actions that the FRB believes might jeopardize the BHC’s ability to commit resources to such subsidiary bank.

Under these requirements, the Parent Company may in the future be required to provide financial assistance to the Bank should it experience financial distress. Any loans by a holding company to its subsidiary bank are subordinate in right of payment to deposits and to certain other indebtedness of such subsidiary bank. In the event of the Parent Company's bankruptcy, any commitment by the Parent Company to a federal bank regulatory agency to maintain the capital of the Bank would be assumed by the bankruptcy trustee and entitled to a priority of payment.

8

Table of Contents

Pennsylvania Banking Law

The Pennsylvania Banking Code contains detailed provisions governing the organization, location of offices, rights and responsibilities of directors, officers, and employees, as well as corporate powers, savings and investment operations and other aspects of the Bank and its affairs. The Pennsylvania Banking Code delegates extensive rule-making power and administrative discretion to the Pennsylvania Department of Banking and Securities so that the supervision and regulation of state-chartered banks may be flexible and readily responsive to changes in economic conditions and in savings and lending practices.

The Federal Deposit Insurance Act, however, prohibits state-chartered banks from making new investments, loans, or becoming involved in activities as principal and equity investments which are not permitted for national banks unless the FDIC determines the activity or investment does not pose a significant risk of loss to the Deposit Insurance Fund, and a bank meets all applicable capital requirements. Accordingly, additional operating authority provided to the Bank by the Pennsylvania Banking Code may be significantly restricted by the Federal Deposit Insurance Act.

Dividend Restrictions

The Parent Company is a legal entity separate and distinct from its banking and non-banking subsidiaries. Since the Parent Company's consolidated net income consists largely of net income of its subsidiaries, its ability to make capital distributions, including paying dividends and repurchasing shares, depends upon its receipt of dividends from these subsidiaries. Under federal law, there are various limitations on the extent to which the Bank can declare and pay dividends to the Parent Company, including those related to regulatory capital requirements, general regulatory oversight to prevent unsafe or unsound practices, and federal banking law requirements concerning the payment of dividends out of net profits, surplus, and available earnings. The Bank must maintain the CET1 Capital Conservation Buffer requirement of more than 2.5% above the minimum risk based on capital requirements to avoid becoming subject to restrictions on capital distributions, including dividends. Certain contractual restrictions also may limit the ability of the Bank to pay dividends to the Parent Company. No assurances can be given that the Bank will, in any circumstances, pay dividends to the Parent Company.

The Parent Company's ability to declare and pay dividends to its shareholders is similarly limited by federal banking law and FRB regulations and policy.

FRB policy provides that a BHC should not pay dividends unless (1) the BHC’s net income over the last four quarters (net of dividends paid) is sufficient to fully fund the dividends, (2) the prospective rate of earnings retention appears consistent with the capital needs, asset quality, and overall financial condition of the BHC and its subsidiaries, and (3) the BHC will continue to meet minimum required capital adequacy ratios. Accordingly, a BHC should not pay cash dividends that can only be funded in ways that weaken the BHC’s financial health, such as by borrowing. The policy also provides that a BHC should inform the FRB reasonably in advance of declaring or paying a dividend that exceeds earnings for the period for which the dividend is being paid or that could result in a material adverse change to the BHC’s capital structure. BHCs also are expected to consult with the FRB before increasing dividends or redeeming or repurchasing capital instruments. Additionally, the FRB could prohibit or limit the payment of dividends by a BHC if it determines that payment of the dividend would constitute an unsafe or unsound practice.

Transactions between a Bank and its Affiliates

Federal banking laws and regulations impose qualitative standards and quantitative limitations upon certain transactions between a bank and its affiliates, including between a bank and its holding company and companies that the BHC may be deemed to control for these purposes. Transactions covered by these provisions must be on arm’s-length terms, and cannot be offered on terms more favorable than would be offered to non-related borrowers of similar creditworthiness, and cannot exceed certain amounts which are determined with reference to that bank’s regulatory capital. Moreover, if the transaction is a loan or other extension of credit, it must be secured by collateral in an amount and quality expressly prescribed by statute, and if the affiliate is unable to pledge sufficient collateral, the BHC may be required to provide it. The Dodd-Frank Act expanded the coverage and scope of these restrictions and requirements, including by applying them to the credit exposure arising under derivative transactions, repurchase and reverse repurchase agreements, and securities borrowing and lending transactions. Federal banking laws also place similar restrictions on loans and other extensions of credit by FDIC-insured banks, such as the Bank, and their subsidiaries to their directors, executive officers, and principal shareholders.

Regulatory Capital Requirements

Compliance with respect to capital requirements is incorporated by reference from Note 17, Shareholders' Equity and Regulatory Capital, to the Consolidated Financial Statements under Part II, Item 8, "Financial Statements and Supplementary Data," and from the Capital Adequacy and Regulatory Matters section of Item 7, “Management’s Discussion and Analysis of Consolidated Financial Condition and Results of Operations.”

9

Table of Contents

The Bank is subject to certain risk-based capital and leverage ratio requirements under the U.S. Basel III capital rules adopted by the FRB. These rules implement the Basel III international regulatory capital standards in the U.S., as well as certain provisions of the Dodd-Frank Act. These quantitative calculations are minimums, and the FRB may determine that a banking organization, based on its size, complexity, or risk profile, must maintain a higher level of capital in order to operate in a safe and sound manner.

Under the U.S. Basel III capital rules, the Parent Company's and the Bank’s assets, exposures, and certain off-balance sheet items are subject to risk weights used to determine the institutions’ risk-weighted assets. These risk-weighted assets are used to calculate the following minimum capital ratios for the Parent Company and the Bank:

• CET1 Risk-Based Capital Ratio, equal to the ratio of CET1 capital to risk-weighted assets. CET1 capital primarily includes common shareholders’ equity subject to certain regulatory adjustments and deductions, including goodwill, intangible assets, certain deferred tax assets, and AOCI. The Company has elected to opt out of including AOCI components.

• Tier 1 Risk-Based Capital Ratio, equal to the ratio of Tier 1 capital to risk-weighted assets. Tier 1 capital is primarily comprised of CET1 capital, non-cumulative perpetual preferred stock, and certain qualifying capital instruments.

• Total Risk-Based Capital Ratio, equal to the ratio of total capital, including CET1 capital, Tier 1 capital, and Tier 2 capital, to risk-weighted assets. Tier 2 capital primarily includes qualifying subordinated debt and qualifying ACL.

• Tier 1 Leverage Ratio, equal to the ratio of Tier 1 capital to quarterly average assets (net of goodwill, certain other intangible assets, and certain other deductions).

Failure to be well-capitalized or to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators that, if undertaken, could have an adverse material effect on our operations or financial condition. Failure to be well-capitalized or to meet minimum capital requirements could also result in restrictions on the Bank’s ability to pay dividends or otherwise distribute capital or to receive regulatory approval of applications.

In addition to meeting the minimum capital requirements, under the U.S. Basel III capital rules, the Bank must also exceed a Capital Conservation Buffer of 2.5% over and above the minimum risk-based capital ratio requirements to avoid becoming subject to restrictions on capital distributions and certain discretionary bonus payments to management.

At December 31, 2025, the Parent Company's and the Bank’s regulatory capital ratios were above minimum requirements and applicable well-capitalized standards and exceeded the Capital Conservation Buffer requirement.

Bank Acquisitions by Orrstown

BHCs must obtain prior approval of the FRB in connection with any acquisition that results in the BHC owning or controlling 5% or more of any class of voting securities of a bank or another BHC.

Acquisitions of Ownership of Orrstown

Acquisitions of Orrstown's voting stock above certain thresholds are subject to prior regulatory notice or approval under federal banking laws, including the BHC Act and the Change in Bank Control Act of 1978. Under the Change in Bank Control Act, a person or entity generally must provide prior notice to, and receive the non-objection of, the FRB before acquiring the power to vote 10% or more of our outstanding common stock. Investors should be aware of these requirements when acquiring shares in the Company's stock.

Consumer Protection Regulation

The Company and the Bank are subject to federal and state laws designed to protect consumers and prohibit unfair, deceptive or abusive business practices, including the Equal Credit Opportunity Act, Fair Housing Act, Home Ownership Protection Act, Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactions Act of 2003 (the “FACT Act”), the Gramm-Leach-Bliley Act (“GLBA”), the Truth in Lending Act (“TILA”), the CRA, the Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, the National Flood Insurance Act, and various state law counterparts. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must interact with clients when taking deposits, making loans, collecting loans, and providing other services. Further, the CFPB also has a broad mandate to prohibit unfair, deceptive or abusive acts and practices and is specifically empowered to require certain disclosures to consumers and draft model disclosure forms. Failure to comply with consumer protection laws and regulations can subject financial institutions to enforcement actions, fines and other penalties. The FRB examines the Bank for compliance with CFPB rules and enforces CFPB rules with respect to the Bank.

10

Table of Contents

The Dodd-Frank Act prescribes certain standards that mortgage lenders must consider before making a residential mortgage loan, including verifying a borrower’s ability to repay such mortgage loan, and allows borrowers to assert violations of certain provisions of TILA as a defense to foreclosure proceedings. Additionally, the CFPB’s qualified mortgage rule requires creditors, such as the Bank, to make a reasonable, good faith determination of a consumer’s ability to repay any consumer credit transaction secured by a dwelling prior to making the loan. The Economic Growth, Regulatory Relief, and Consumer Protection Act included provisions that ease certain requirements related to mortgage transactions for certain institutions with less than $10 billion in total consolidated assets.

Data Privacy

Federal and state law contains extensive consumer privacy protection provisions. The GLBA requires financial institutions to periodically disclose their privacy policies and practices relating to sharing such information and enables retail clients to opt out of our ability to share information with unaffiliated third parties under certain circumstances. Other federal and state laws and regulations impact our ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes, or to contact clients with marketing offers. These security and privacy policies and procedures for the protection of personal and confidential information are in effect across all businesses and geographic locations as applicable. Federal law also makes it a criminal offense, except in limited circumstances, to obtain or attempt to obtain client information of a financial nature by fraudulent or deceptive means. Data privacy and data protection are areas of increasing federal and state legislative focus.

Like other lenders, the Bank uses credit bureau data in its underwriting activities. Use of such data is regulated under the Fair Credit Reporting Act, which also regulates reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information between affiliates, and using affiliate data for marketing purposes. Similar state laws may impose additional requirements on the Company.

Cybersecurity

Multiple federal laws contain provisions requiring regulated financial institutions to maintain cybersecurity programs incorporating specific elements. The GLBA requires financial institutions to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of client records and information.

The Cybersecurity Information Sharing Act is intended to improve cybersecurity in the U.S. by enhanced sharing of information about security threats among the U.S. government and private sector entities, including financial institutions. The Cybersecurity Information Sharing Act also authorizes companies to monitor their own systems notwithstanding any other provision of law and allows companies to carry out defensive measures on their own systems from cyber-attacks. The law includes liability protections for companies that share cyber threat information with third parties so long as such sharing activity is conducted in accordance with Cybersecurity Information Sharing Act.

A bank holding company and a state member bank are required to notify the FRB within 36 hours of a computer security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its client base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector.

Community Reinvestment Act

The CRA is intended to encourage banks to help meet the credit needs of their service areas, including low- and moderate-income neighborhoods, consistent with safe and sound business practices. The relevant federal bank regulatory agency, the FRB in the Bank’s case, examines each bank and assigns it a public CRA rating. A bank’s record of fair lending compliance is part of the resulting CRA examination report. The CRA requires the relevant federal bank regulatory agency to consider a bank’s CRA assessment when considering that bank’s application to conduct certain mergers or acquisitions or to open or relocate a branch office. The FRB also must consider the CRA record of each subsidiary bank of a BHC in connection with any acquisition or merger application filed by the BHC. An unsatisfactory CRA record could substantially delay or result in the denial of an approval or application by the Parent Company or the Bank. The Bank received a CRA rating of “Satisfactory” in its most recent examination prepared by the FRB on January 22, 2024.

Leaders of the federal banking agencies had indicated their support for modernizing the CRA regulatory framework to address changing delivery systems and consumer preferences, and on October 24, 2023, the agencies jointly issued a final rule to strengthen and modernize the CRA regulations by maintaining the existing CRA ratings, but modifying the evaluation framework to replace the existing tests generally applicable to banks with at least $2.0 billion in total assets (e.g., the lending, investment and service tests) with four new tests and associated performance metrics. The October 2023 final rule updated the CRA regulations with the goals of expanding access to credit, investment, and basic banking services in low- and moderate-

11

Table of Contents

income communities, adapting to changes in the banking industry, including the expanded role of mobile and online banking, and providing greater clarity and consistency. On July 16, 2025, the FRB Board, FDIC and the OCC issued a joint notice of proposed rulemaking to rescind the October 2023 final rule and reinstate the CRA framework that existed prior to the October 2023 final rule. The Bank’s most recent performance evaluation was conducted using the CRA framework that existed prior to the October 2023 final rule.

Anti-Money Laundering

The Bank Secrecy Act ("BSA"), the USA PATRIOT Act and the Anti-Money Laundering Act of 2020 (“AMLA”) contain anti-money laundering and financial transparency provisions intended to detect and prevent the use of the U.S. financial system for money laundering and terrorist financing activities. The Bank Secrecy Act, as amended by the PATRIOT Act, requires depository institutions and their holding companies to undertake activities including maintaining an anti-money laundering program, verifying the identity of clients, verifying the identity of certain beneficial owners for legal entity clients, monitoring for and reporting suspicious transactions, reporting on cash transactions exceeding specified thresholds, and responding to requests for information by regulatory authorities and law enforcement agencies.

The AMLA codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the U.S. Department of the Treasury ("Treasury") to promulgate priorities for anti-money laundering and countering the financing of terrorism policy; requires the development of standards by the Treasury for testing technology and internal processes for BSA compliance; expands enforcement- and investigation-related authority, including a significant expansion in the available sanctions for certain BSA violations; and expands BSA whistleblower incentives and protections. Many of the statutory provisions in the AMLA required additional rulemaking, reports and other measures, and the impact of the AMLA will depend on, among other things, rulemaking and implementation guidance.

The Bank is subject to the Bank Secrecy Act and, therefore, is required to maintain an effective, risk-based anti-money laundering ("AML") and countering the financing of terrorism within the CFT program. Our program includes internal policies, procedures and controls; designation of a qualified BSA/AML Officer; ongoing employee training and independent testing to ensure compliance. The Bank has implemented policies, procedures, and internal controls that are designed to comply with these anti-money laundering requirements. The program is tailored to our risk profile and incorporates the AML/CFT National Priorities issued by the U.S. Department of the Treasury. Our Board of Directors oversees the AML/CFT program and receives regular reports on risk assessments, audit results and, when applicable, remediation efforts.

We recognize that bank regulators place significant emphasis on AML compliance, and when reviewing for merger, acquisitions and other transactions, to consider the effectiveness of the AML activities of the applicant. Accordingly, we continuously monitor our program and make enhancements as necessary to address emerging risks, regulatory changes, and technological developments and ensure that our controls remain effective and aligned with industry best practices.

Office of Foreign Assets Control Regulation

The Office of Foreign Assets Control ("OFAC") administers and enforces economic and trade sanctions that affect transactions with designated foreign countries, entities, and individuals, as authorized by various laws and Executive Orders. OFAC-administered sanctions take many different forms. For example, sanctions may include: (1) restrictions on trade with or investment in a sanctioned jurisdictions, including prohibitions against direct or indirect imports and exports to a sanctioned country and prohibitions on U.S. persons engaging in financial transactions relating to, making investments in, or providing investment-related advice or assistance to, a sanctioned party; and (2) a blocking of assets in which the government or “specially designated nationals” of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction, including property in the possession or control of U.S. persons. OFAC also publishes lists of persons, organizations, and countries suspected of aiding, harboring, or engaging in terrorist acts, narcotics trafficking and other illicit activities known as the Specially Designated Nationals and Blocked Persons ("SDN") List. Blocked assets, such as property and bank deposits, cannot be paid out, withdrawn, or transferred in any manner without a license from OFAC. Failure to comply with OFAC regulations can result in significant civil and criminal penalties.

Transaction Account Reserves

FRB regulations require depository institutions to maintain cash reserves against specified deposit liabilities. The dollar amount of a depository institution's reserve requirement is determined by applying the reserve ratios specified in Regulation D to an institution's transaction accounts (primarily NOW and regular checking accounts). Effective January 1, 2025, the FRB established a new reserve requirement exemption amount and low reserve tranche, but did not elevate the current reserve percentage from zero for depository institutions.

12

Table of Contents

Nasdaq Stock Market

The Company’s common stock is listed on the Nasdaq Capital Market under the trading symbol “ORRF” and is subject to Nasdaq’s rules for listed companies.

Available Information

The Company is subject to the informational requirements of the Exchange Act and, in accordance with the Exchange Act, it files annual, quarterly, and current reports, proxy statements, and other information with the SEC. The SEC maintains an Internet web site that contains reports, proxy statements, and other information about issuers, like us, who file electronically with the SEC. The address of the site is www.sec.gov. The reports and other information, including any related amendments, filed by us with, or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act, by the Company to, the SEC are also available free of charge at our Internet web site as soon as reasonably practicable after such material is electronically filed with, or furnished to, the SEC. The address of the site is www.orrstown.com. Except as specifically incorporated by reference into this Annual Report on Form 10-K, information on those web sites is not part of this report.

ITEM 1A – RISK FACTORS

An investment in our common stock is subject to risks inherent in our business. The material risks and uncertainties that management believes affect us are described below. This report is qualified in its entirety by these risk factors.

Before making an investment decision, you should carefully consider the risks and uncertainties described below together with all of the other information included or incorporated by reference in this report and our other filings with the SEC. The risks and uncertainties described below are not the only ones facing us. Additional risks and uncertainties that management is not aware of or focused on or that management currently deems immaterial may also impair our business operations.

If any of the following risks actually materialize, our business, financial condition and results of operations could be materially and adversely affected. If this were to happen, the market price of our common stock could decline significantly, and you could lose all or part of your investment.

Risks Related to Credit

Difficult and volatile economic and market conditions in the U.S. and globally as well as changes in fiscal, monetary, trade and regulatory policies can adversely affect the financial services industry and may materially and adversely affect us.

Our operations are sensitive to general business and economic conditions in the U.S. The economy in the U.S. and globally has experienced volatility in recent years and may continue to experience such volatility for the foreseeable future. Unfavorable or uncertain economic conditions can be caused by declines in economic growth, business activity, or investor or business confidence; limitations on the availability of or increases in the cost of credit and capital; increases in inflation or interest rates; uncertainties regarding fiscal and monetary policies; the timing and impact of changing governmental policies, including changes in guidance and interpretation by regulatory authorities; changes in trade policies by the U.S. or other countries; supply chain disruptions; consumer spending; employment levels; labor shortages; challenging labor market conditions; wage stagnation; federal government shutdowns; energy prices; home prices; commercial property values; bankruptcies and a default by a significant market participant or class of counterparties; natural disasters; climate change; epidemics; future pandemics; terrorist attacks; acts of war; or a combination of these or other factors.

Volatile business and economic conditions could have adverse effects on our business, including the following:

•investors may have less confidence in the equity markets in general and in financial services industry stocks in particular, which could place downward pressure on our stock price and resulting market valuation;

•economic and market developments may further affect consumer and business confidence levels and may cause declines in credit usage and adverse changes in payment patterns, causing increases in delinquencies and default rates;

•our ability to assess the creditworthiness of our customers may be impaired if the models and approaches we use to select, manage, and underwrite loans become less predictive of future behaviors;

•we could suffer decreases in demand for loans or other financial products and services or decreased deposits or other investments in accounts with us; and

•the value of loans and other assets or collateral securing loans may decrease.

13

Table of Contents

If our allowance for credit losses is not sufficient to cover actual losses, our earnings would decrease.

The ACL is recorded as a reduction to loans and leases and the reserve for unfunded lending commitments is included in other liabilities on the consolidated balance sheets. While we believe that our ACL as of December 31, 2025 was sufficient to cover losses in the loan and lease portfolio on that date, we may need to increase our provision for credit losses in future periods due to changes in the risk characteristics of the loan and lease portfolio, thereby negatively impacting our results of operations.

The ACL is determined based on various factors impacting the quality of the loan and lease portfolio as indicated by our borrowers' financial condition, payment performance, the value of the underlying collateral and the support from a guarantor, in addition to the impact from economic conditions, government macroeconomic policies, interest rates and the regulatory environment. The experience and expertise of our loan officers, credit analysts and special assets group are essential to performing credit quality reviews, in addition to analyzing trends in delinquencies, levels of non-accruing and criticized loans and leases and modifications to loan terms. The ACL may also be influenced by other factors, including concentrations by the type of loan, collateral, borrower or location of the collateral or borrower. Such concentrations could increase the possibility that similarly situated borrowers and their collateral may collectively be affected by certain economic conditions.

Determining the ACL inherently involves a high degree of subjectivity and requires us to make significant estimates of current credit risks and trends, all of which may undergo material changes. We cannot be sure that we will be able to identify deteriorating credits before they become nonperforming assets or that we will be able to limit losses on those loans and leases that are identified. We have in the past been, and in the future may be, required to increase our ACL for any of several reasons. State and federal regulators, in reviewing our loan and lease portfolio as part of a regulatory examination, may request that we increase the ACL. Changes in economic conditions or individual business or personal circumstances affecting borrowers, new information regarding existing loans and leases, identification of additional problem loans and leases and other factors, both within and outside of our control, may require an increase in the ACL.

If our assessment of and expectations concerning the above-mentioned factors differ from actual developments, we may be required to increase our ACL, which could have an adverse effect on our financial condition, results of operations and our regulatory capital. In addition, our regulators, as an integral part of their examination process, periodically review the ACL and may require us to increase the ACL by recognizing additional provisions for credit losses charged to income, or to charge-off loans, which, net of any recoveries, would decrease the ACL on loans. Any such additional provisions for credit losses or charge-offs could have a material adverse effect on our financial condition and results of operations.

Commercial real estate lending may expose us to a greater risk of loss and impact our earnings and profitability.

Our business strategy includes making loans secured by commercial real estate. These types of loans generally have higher risk-adjusted returns and shorter maturities than other loans. Loans secured by commercial real estate properties are generally for larger amounts and may involve a greater degree of risk than other loans. Payments on loans secured by these properties are often dependent on the income produced by the underlying properties which, in turn, depends on the successful operation and management of the properties and the businesses that operate within them. Accordingly, repayment of these loans is subject to conditions in the real estate market or the local economy. Additionally, the advent of remote work on a hybrid or full-time basis has had a potentially long-term negative impact on certain commercial real estate assets due to the risk that tenants may reduce the office space they lease. In challenging economic conditions and as a result of changing demand for office space, these loans represent higher risk and could result in internal risk rating downgrades and an increase in our total net charge-offs, requiring us to increase our ACL, which could have a material adverse effect on our financial condition or results of operations. While we seek to minimize these risks in a variety of ways, there can be no assurance that these measures will protect against credit-related losses.

Our loan portfolio has a significant concentration in commercial real estate loans.

Our loan portfolio includes a large amount of commercial real estate loans. The federal banking agencies have promulgated guidance governing banks with concentrations in commercial real estate lending. The guidance provides that a bank has a concentration in commercial real estate lending if (i) total reported loans for construction, land development and other land represent 100% or more of total risk-based capital or (ii) total commercial real estate loans represent 300% or more of total risk-based capital and that bank’s commercial real estate loan portfolio has increased 50% or more during the prior thirty-six months. Owner-occupied commercial real estate loans are excluded from this second category. If a bank is deemed to have a concentration in commercial real estate loans, it will be required to employ heightened risk management practices that address board and management oversight and strategic planning, portfolio management, development of underwriting standards, risk assessment and monitoring through market analysis and stress testing and maintenance of increased capital levels as needed to support the level of commercial real estate lending. At December 31, 2025, the Bank’s construction, land development and other land balances were 41% of total risk-based capital, commercial real estate loans were 296% of total risk-based capital and the Bank’s commercial real estate loan portfolio had increased by 87% during the prior thirty-six months, which was partially impacted by the acquired loans from the Merger. In addition, the Bank's office space portfolio was 59% of

14

Table of Contents

total risk-based capital at December 31, 2025. The Bank believes it has taken the appropriate steps to implement appropriate risk management practices, which are subject to regulatory examination, including enhanced market analysis, stress testing and sensitivity analysis. If our regulators conclude that we have not implemented appropriate risk management practices, it could adversely affect our business, and could result in the requirement to maintain increased capital levels or restrict our ability to originate new loans secured by commercial real estate. We can provide no assurance that capital would be available, or available on terms favorable to us, at that time.

The credit risk related to commercial and industrial loans is greater than the risk related to residential loans.

Commercial and industrial loans generally carry larger loan balances and involve a greater degree of risk of nonpayment or late payment than home equity loans or residential mortgage loans. Commercial and industrial loans include advances to local and regional businesses for general commercial purposes and include permanent and short-term working capital, machinery and equipment financing, and may be either in the form of lines of credit or term loans. Although commercial and industrial loans may be unsecured to our highest rated borrowers, the majority of these loans are secured by the borrower’s accounts receivable, inventory and machinery and equipment. In a significant number of these loans, the collateral also includes the business real estate or the business owner’s personal real estate or assets. Commercial and industrial loans are more susceptible to risk of loss during a downturn in the economy, as borrowers may have greater difficulty in meeting their debt service requirements and the value of the collateral may decline. We attempt to mitigate this risk through our underwriting standards, including evaluating the creditworthiness of the borrower, regular monitoring, and, to the extent available, credit ratings on the business. However, these procedures cannot entirely eliminate the risk of loss associated with commercial and industrial lending.

Environmental liability associated with our lending activities could result in losses.

In the course of business, we may acquire, through foreclosure, properties securing loans originated or purchased that are in default. Particularly in commercial real estate lending, there is a risk that material environmental violations could be discovered on these properties. In this event, we might be required to remedy these violations at the affected properties at our sole cost and expense. The cost of remedial action could substantially exceed the value of affected properties. We may not have adequate remedies against the prior owner or other responsible parties and could find it difficult or impossible to sell the affected properties. These events could have an adverse effect on our financial condition and results of operations.

Risks Related to Interest Rates and Investments

Changes in interest rates could adversely impact our financial condition and results of operations.

Our operations are subject to risks and uncertainties surrounding our exposure to changes in the interest rate environment. Earnings and liquidity depend to a great extent on our interest rates. Interest rates are highly sensitive to many factors beyond our control, including competition, general economic conditions, geopolitical tensions and monetary and fiscal policies of various governmental and regulatory authorities, including the FRB. Conditions such as inflation, deflation, recession, unemployment and other factors beyond our control may also affect interest rates. The nature and timing of any changes in interest rates or general economic conditions and their effect on us cannot be controlled and are difficult to predict. If the rate of interest we pay on our interest-bearing liabilities increases more than the rate of interest we receive on our interest-earning assets, our net interest income, and therefore our earnings, could contract and be materially adversely affected. Our earnings could also be materially adversely affected if the rates on interest-earning assets fall more quickly than those on our interest-bearing liabilities. Changes in interest rates could also create competitive pressures, which could impact our liquidity position.

Changes in interest rates also can affect our ability to originate loans, our ability to obtain and retain deposits, and the value of interest-earning assets, and the ability to realize gains from the sale of such assets, which could all negatively impact shareholder's equity and regulatory capital. Additional increases in interest rates could have a negative impact on our results of operations by reducing the ability of borrowers to repay their current loan obligations, which could not only result in increased loan defaults, foreclosures and charge-offs, but could also necessitate further increases to our ACL and reduce net income. In addition, an increase in the general level of interest rates may negatively affect the market value of the investment portfolio depending on the duration of certain securities included in the investment portfolio. Conversely, decreases in interest rates may trigger loan prepayments, which may serve to reduce net interest income if we are unable to lend these funds to other borrowers or invest the funds at the same or higher interest rates.

On September 30, 2025, the Company redeemed its $32.5 million outstanding 6.0% fixed-to-floating rate subordinated notes due December 30, 2028. At redemption, the variable interest rate of three-month CME term SOFR rate, plus a spread adjustment of 0.26161% and a margin of 3.16%, on the subordinated debt was 7.72%. During the year ended December 31, 2025 and 2024, amortization expense of the debt issuance costs totaled $335 thousand and $81 thousand, respectively.

15

Table of Contents

In the Merger, the Company assumed Codorus Valley's unsecured subordinated notes that were issued in December 2020 in the amount of $31.0 million, which may be redeemed, in whole or in part, in a principal amount with integral multiples of $10.0 million, on or after December 9, 2025 and prior to the maturity date at 100% of the principal amount, plus accrued and unpaid interest. The subordinated notes mature on December 9, 2030. The subordinated notes are also redeemable in whole or in part from time to time, upon the occurrence of specific events defined within the note purchase agreements. The subordinated notes had a fixed rate of interest equal to 4.50% until December 30, 2025. After that term, the variable rate of interest is equal to the three-month CME term SOFR rate plus 4.04%, which was 8.06% at December 31, 2025. At the date of the Merger, these subordinated notes were marked to fair value at $28.6 million, with a discount of $2.4 million being amortized and netted against interest expense over the stated maturity.

The trust preferred debt issued through CVB Statutory Trust No. I has a variable rate of three-month CME term SOFR rate, plus a spread adjustment of 0.26161% and a margin of 2.02% through maturity and the trust preferred debt issued through CVB Statutory Trust No. II has a variable rate of three-month CME term SOFR rate, plus a spread adjustment 0.26161% and a margin of 1.54% through maturity. For the year ended December 31, 2025 and 2024, the cost of the trust preferred debt, excluding the fair value mark, was 6.24%. An increase in the interest rate on our subordinated debt and trust preferred debt could have a material adverse effect on our results of operations.

Our securities portfolio performance in difficult market conditions could have adverse effects on our results of operations.

Unrealized losses on investment securities result from changes in credit spreads and liquidity issues in the marketplace, along with changes in the credit profile of individual securities issuers. Under GAAP, we are required to review our investment portfolio periodically for the presence of impairment of our securities, taking into consideration current and future market conditions, the extent and nature of changes in fair value, issuer rating changes and trends, volatility of earnings, current analysts' evaluations, our ability and intent to hold investments until a recovery of fair value, as well as other factors. Adverse developments with respect to one or more of the foregoing factors may require us to deem particular securities to be impaired, with the credit-related portion of the reduction in the value recognized as a charge to our earnings through an allowance. Subsequent valuations, in light of factors prevailing at that time, may result in significant changes in the values of these securities in future periods. Any of these factors could require us to recognize further impairments in the value of our securities portfolio, which may have an adverse effect on our results of operations in future periods.

Potential downgrades of U.S. government securities by one or more of the credit ratings agencies could have a material adverse effect on our operations, earnings and financial condition.

A possible future downgrade of the sovereign credit ratings of the U.S. government and a decline in the perceived creditworthiness of U.S. government-related obligations could impact our ability to obtain funding that is collateralized by affected instruments, as well as affect the pricing of that funding when it is available. A downgrade may also adversely affect the market value of such instruments. We cannot predict if, when or how any changes to the credit ratings or perceived creditworthiness of these organizations will affect economic conditions. Among other things, a downgrade in the U.S. government’s credit rating could adversely impact the value of our securities portfolio and may trigger requirements that we post additional collateral for trades relative to these securities. A downgrade of the sovereign credit ratings of the U.S. government or the credit ratings of related institutions, agencies or instruments could significantly exacerbate the other risks to which we are subject and could have related adverse effects on our business, financial condition and results of operations.

Risks Related to Competition and to Our Business Strategy

Because our business is concentrated in south central Pennsylvania, the greater Baltimore region, and Washington County, Maryland, our financial performance could be materially adversely affected by economic conditions and real estate values in these market areas.

Our operations and the properties securing our loans are primarily located in south central Pennsylvania, the greater Baltimore region, and Washington County, Maryland. Our operating results depend largely on economic conditions and real estate valuations in these and surrounding areas. A deterioration in economic conditions, increased unemployment, inflation, and a decline in real estate values in these market areas or other factors beyond our control could materially adversely affect our operations.

Inflation can have an adverse impact on our business and on our customers.

The future rate of inflation and other economic factors remain uncertain, and the FRB may decrease or increase interest rates slower or faster than anticipated. If inflation increases and interest rates rise, the value of our investment securities, particularly those with longer maturities, will decrease, although this effect is less pronounced for floating rate instruments. Prolonged periods of inflation also may impact our profitability by negatively impacting our costs and expenses, including increasing funding costs and expenses related to talent acquisition and retention, and negatively impacting the demand for our

16

Table of Contents

products and services. Moreover, our customers are also affected by inflation and the rising costs of goods and services used in their households and businesses, which could have a negative impact on their ability to repay their loans. Adverse changes in inflation and interest rates could negatively impact consumer and business confidence, and adversely affect the economy as well as our business, results of operations, and financial condition.

Changes in U.S. trade policies, including the imposition of tariffs and retaliatory tariffs, may adversely affect our business, financial condition, and results of operations.

There have been significant changes to U.S. trade policies, including tariffs affecting many countries, and there continues to be significant discussion regarding other potential changes to U.S. trade policies, treaties, and tariffs, including the potential for additional tariffs. In addition, retaliatory tariffs have been imposed and additional retaliatory tariffs are likely. Tariffs, retaliatory tariffs or other trade restrictions on products and materials that our customers import or export could cause the prices of our customers’ products to increase, which could reduce demand for such products. Any of these effects could adversely affect the ability of our customers to pay their loans or result in changes to our customers’ borrowing patterns that could have a negative effect on our business and results of operations.

We face significant competition in the financial services industry.

We operate in a highly competitive environment that includes financial and non-financial services firms, including traditional banks, online banks, financial technology companies, and investment management and wealth advisory firms, including commercial banks and trust companies, investment advisory firms, mutual fund companies, and stock brokerage firms. These companies compete on the basis of, among other factors, size, location, quality and type of products and services offered, price, technology, brand recognition, and reputation. Emerging technologies, such as artificial intelligence (including machine learning and generative artificial intelligence) and quantum computing, have the potential to further intensify competition and accelerate disruption in the financial services industry. In recent years, non-financial services firms, such as financial technology companies, have begun to offer services traditionally provided by financial institutions. These firms attempt to use technology and mobile platforms to enhance the ability of companies and individuals to borrow, save and invest money. We may also experience the emerging competition for deposits from tokenized deposits and stablecoins. Many of these non-financial services competitors have fewer regulatory constraints and may have lower cost structures than we do. Our long-term success depends on our ability to develop and execute strategic plans and initiatives; to develop competitive products and technologies; and to attract, retain and develop a highly skilled employee workforce. We may not be as timely or successful in assessing the evolving competitive landscape and developing or introducing new products and services as our competitors. Our business may be negatively impacted if we, or our third-party providers, do not timely develop and apply emerging technologies, or if our initiatives in these areas are deficient or fail. Our, or our third-party providers’, inability, or resistance to timely innovate or adapt operations, products and services to evolving regulatory and market environments, industry standards and consumer preferences could result in service disruptions, harm our business, and adversely affect our results of operations and reputation.

Our business may be adversely affected if we fail to adapt our products and services to technological advances, evolving industry standards and consumer preferences.

The banking industry undergoes constant technological change with frequent introductions of new technology-driven products and services. The widespread adoption of new technologies, including internet services and payment systems, could require substantial expenditures to modify or adapt our existing products and services as we grow and develop our internet banking and mobile banking channel strategies in addition to remote connectivity solutions. We might not be successful in developing or introducing new products and services, integrating new products or services into our existing offerings, responding or adapting to changes in consumer behavior, preferences, spending, investing and/or saving habits, achieving market acceptance of our products and services, reducing costs in response to pressures to deliver products and services at lower prices or sufficiently developing and maintaining loyal clients. Our future success may depend, in part, on our ability to address the needs of our current and prospective clients by using technology to provide products and services that will satisfy demands for convenience, as well as to create additional efficiencies in operations.

Development of new products, services and technologies may impose additional costs on us and may expose us to increased operational risk.

The introduction of new products and services can involve significant time and resources, including to obtain regulatory approvals. Substantial risks and uncertainties are associated with the introduction of new products and services, including technical and control requirements that may need to be developed and implemented, rapid technological change in the industry, the significant and ongoing investments required to bring new products and services to market in a timely manner at competitive prices and the preparation of marketing, sales and other materials that fully and accurately describe the product or service and its underlying risks. Our failure to manage these risks and uncertainties would also expose us to enhanced risk of operational lapses which may result in the recognition of financial statement liabilities. Regulatory and internal control

17

Table of Contents

requirements, capital requirements, competitive alternatives, vendor relationships and shifting market preferences may also determine if such initiatives can be brought to market in a manner that is timely and attractive to our clients. Products and services relying on internet and mobile technologies may expose us to fraud and cybersecurity risks. Implementation of certain new technologies, such as those related to artificial intelligence, automation and algorithms, may have unintended consequences due to their limitations, potential manipulation, or our failure to use them effectively. Failure to successfully manage these risks in the development and implementation of new products or services could have a material adverse effect on our business and reputation, as well as on our consolidated results of operations and financial condition.

We may incur significant losses as a result of ineffective risk management processes and strategies.

We seek to monitor and control our risk exposure through a risk and control framework encompassing a variety of separate but complementary financial, credit, operational, compliance, and legal reporting systems; internal controls; management review processes; and other mechanisms. While we employ a broad and diversified set of risk monitoring and risk mitigation techniques, those techniques and the judgments that accompany their application may not be effective and may not anticipate every economic and financial outcome in all market environments or the specifics and timing of such outcomes.

We face continuing and growing security risks to our information base, including the information we maintain relating to our clients.

In the ordinary course of business, we rely on electronic communications and information systems to conduct our business and to store sensitive data, including financial information regarding clients. Our electronic communications and information systems infrastructure, as well as the systems infrastructures of the vendors we use to meet our data processing and communication needs, could be susceptible to cyber-attacks, such as denial of service attacks, hacking, terrorist activities or identity theft. Financial services institutions and companies engaged in data processing have reported breaches in the security of their websites or other systems, some of which have involved sophisticated and targeted attacks intended to obtain unauthorized access to confidential information, destroy data, disable or degrade service or sabotage systems, often through the introduction of computer viruses or malware, cyber-attacks and other means. Denial of service attacks have been launched against a number of large financial services institutions. Hacking and identity theft risks, in particular, could cause serious reputational harm. Cyber threats are rapidly evolving and we may not be able to anticipate or prevent all such attacks. Although, to date we have not experienced any material losses relating to cyber-attacks or other information security breaches, there can be no assurance that we will not suffer such losses in the future. No matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, and we may not be able to implement effective preventive measures against such security breaches in a timely manner. A failure or circumvention of our security systems could have a material adverse effect on our business operations and financial condition.

We regularly assess and test our security systems and disaster preparedness, including back-up systems, but the risks are substantially escalating. As a result, cybersecurity and the continued enhancement of our controls and processes to protect our systems, data and networks from attacks, unauthorized access or significant damage remain a priority. Accordingly, we may be required to expend additional resources to enhance our protective measures or to investigate and remediate any information security vulnerabilities or exposures. Any breach of our system security could result in disruption of our operations, unauthorized access to confidential client information, significant regulatory costs, litigation exposure and other possible damages, loss or liability. Such costs or losses could exceed the amount of available insurance coverage, if any, and would adversely affect our earnings. Also, any failure to prevent a security breach, or to quickly and effectively deal with such a breach, could negatively impact client confidence, damaging our reputation and undermining our ability to attract and keep clients.

We may not be able to successfully implement future information technology system enhancements, which could adversely affect our business operations and profitability.

We invest significant resources in information technology system enhancements in order to provide functionality and security at an appropriate level. We may not be able to successfully implement and integrate future system enhancements, which could adversely impact the ability to provide timely and accurate financial information in compliance with legal and regulatory requirements, which could negatively impact our growth and profitability and could result in regulatory scrutiny. In addition, future system enhancements could have higher than expected costs and/or result in operating inefficiencies, which could increase the costs associated with the implementation as well as ongoing operations.

Failure to properly utilize system enhancements that are implemented in the future could result in significant costs to remediate or replace the defective components, which would adversely impact our financial condition and results of operations. In addition, we may incur significant training, licensing, maintenance, consulting and amortization expenses during and after systems implementations, and any such costs may continue for an extended period of time.

18

Table of Contents

We may become subject to claims and litigation pertaining to fiduciary responsibility.

We provide fiduciary services through OFA. From time to time, clients may make claims and take legal action with regard to the performance of our fiduciary responsibilities. Whether such claims and legal actions are founded or unfounded, if such claims or legal actions are not resolved in a manner favorable to us, the claims or related actions may result in significant financial expense and liability to us and/or adversely affect our reputation in the marketplace, as well as adversely impact client demand for our products and services. Any financial liability or reputation damage could have a material adverse effect on our business, which, in turn, could have a material adverse effect on our financial condition and results of operations.

Climate change may adversely affect our business and results of operations.

Current and anticipated effects of climate change could negatively impact us and our clients. Weather-related events, such as severe storms, hurricanes, flooding and droughts, can present risks to us and our clients, including property damage, change in the value of properties securing our loans, changes in client behavior and preferences, and disruption of business operations, all which can increase credit risk and result in loss of revenue and additional expenses. These concerns over the impacts of climate change have gained political and social attention resulting in many legislative and regulatory initiatives to lessen the effects of climate change, which also may result in heightened supervisory expectations on banks’ risk management practices. Despite recent changes in the U.S. Administration, Congressional leadership and regulatory agency leadership, state legislatures and federal and state regulatory agencies may continue to propose and advance numerous legislative and regulatory initiatives seeking to mitigate the effects of climate change which may result in increases to compliance and operating costs, which could have a negative impact on our financial condition and results of operations.

Risks Related to Mergers and Acquisitions

Our business may be negatively impacted by risks associated with acquisitions.

We intend to pursue a growth plan consistent with our business strategy, including growth by acquisition, as well as leveraging our existing branch network. Our business may be negatively impacted by certain risks inherent with the acquisition of other companies. Some of these risks include the following:

•we may incur substantial expenses in pursuing acquisitions;

•management may divert its attention from other aspects of our business;

•we may assume potential and unknown liabilities of the acquired company;

•the acquired business may not perform in accordance with management's expectations, including potentially losing key clients of the acquired business;

•difficulties may arise in connection with the integration of the operations of the acquired business with our businesses; and

•we may lose key employees of the combined business.

Our ability to manage growth successfully will depend on our ability to attract qualified personnel and maintain cost controls and asset quality while attracting additional loans and deposits on favorable terms, as well as on factors beyond our control, such as economic conditions and competition. If we grow too quickly and are not able to attract qualified personnel, control costs and maintain asset quality, this continued rapid growth could materially adversely affect our financial performance.

Goodwill generated in acquisitions may negatively affect our financial condition.

To the extent that merger consideration, consisting of cash and shares of our common stock, exceeds the fair value of the net assets acquired, including identifiable intangibles, that amount will be reported as goodwill by us. In accordance with current accounting guidance, goodwill will not be amortized, but will be evaluated for impairment annually or more frequently as warranted by specific events or circumstances. A failure to realize the expected benefits of a merger could adversely impact the carrying value of the goodwill recognized in such merger and, in turn, negatively affect our financial results.

The market price of our common stock after acquisitions may be affected by factors different from those affecting our shares currently.

The businesses of us and acquired entities may differ and, accordingly, the results of operations of the combined company and the market price of the shares of common stock of the combined company may be affected by factors different from those currently affecting the independent results of operations and market prices of common stock of each separate entity. The market value of our common stock fluctuates based upon various factors, including changes in our business, operations or prospects, market assessments of a merger, regulatory considerations, market and economic considerations, and other factors. Further, the

19

Table of Contents

market price of our common stock after an acquisition may be affected by factors different from those currently affecting our common stock. Additionally, future business acquisitions may result in the issuance and payment of additional shares of stock, which would dilute current shareholders’ ownership interests, and may involve the payment of a premium over book and market values. Therefore, dilution of our tangible book value and net income per common share could occur in connection with any future transaction.

Risks Related to Regulatory Compliance and Legal Matters

We operate in a highly regulated industry, and laws and regulations, or changes in them, could limit or restrict our activities and could have a material adverse effect on our operations.

We and our subsidiaries are subject to extensive state and federal regulation and supervision. Federal and state laws and regulations govern numerous matters affecting us, including changes in the ownership or control of banks and bank holding companies, maintenance of adequate capital and the financial condition of a financial institution, permissible types, amounts and terms of extensions of credit and investments, permissible non-banking activities, the level of reserves against deposits and restrictions on dividend payments. The FRB and the state banking regulators have the power to issue cease and desist orders to prevent or remedy unsafe or unsound practices or violations of law by banks subject to their regulation, and the FRB possesses similar powers with respect to bank holding companies. These and other restrictions limit the manner in which we and our subsidiaries may conduct business and obtain financing.

The laws, rules, regulations, and supervisory guidance and policies applicable to us are subject to regular modification and change. We expect to become subject to future laws, rules and regulations beyond those currently proposed, adopted or contemplated in the U.S., as well as evolving interpretations of existing and future laws, rules and regulations. These changes could, among other things, subject us to additional costs, including costs of compliance; limit the types of financial services and products we may offer; and/or increase the ability of non-banks to offer competing financial services and products. Failure to comply with laws, regulations, policies, or supervisory guidance could result in enforcement and other legal actions by federal or state authorities, including criminal and civil penalties, the loss of FDIC insurance, revocation of a banking charter, other sanctions by regulatory agencies, civil money penalties, and/or reputational damage, which could have a material adverse effect on our business, financial condition, and results of operations. See the "Supervision and Regulation" section of Item 1, "Business."

Altering our overdraft fee practices could materially adversely affect our fee income and results of operations.

Overdraft fee practices of banks have recently come under increased regulatory scrutiny and been the subject of litigation. This increased scrutiny and litigation have prompted many larger banks to reform their overdraft fee practices or cease charging overdraft fees altogether. Reforming, reducing or eliminating overdraft fees could materially adversely affect our fee income and results of operations. Pending or future legal proceedings, regarding our overdraft fee practice, may result in judgments, settlements, fines, penalties, defense costs, or other results adverse to us, which could materially adversely affect our business, financial condition or results of operations, or cause serious reputational harm to us.

Legislative, regulatory and legal developments involving income and other taxes could materially adversely affect our results of operations and cash flows.

We are subject to U.S. federal and U.S. state income, payroll, property, sales and use, and other types of taxes, including the Pennsylvania Bank Shares Tax. Significant judgment is required in determining our provisions for income taxes. Changes in tax rates, enactments of new tax laws, revisions of tax regulations, and claims or litigation with taxing authorities could result in substantially higher taxes, and therefore, could have a significant adverse effect on our results of operations, financial condition and liquidity. Increases in the assessment rate for the Pennsylvania Bank Shares Tax, which is calculated on the outstanding equity of the Bank, may also materially adversely affect our results of operations.

We are required to use judgment in applying accounting policies and different estimates and assumptions in the application of these policies could result in a decrease in capital and/or other material changes to the reports of financial condition and results of operations.

Material estimates that are particularly susceptible to significant change relate to the determination of the ACL, the fair value of certain financial instruments, particularly securities, and goodwill and purchase accounting. While we have identified those accounting policies that we consider critical and have procedures in place to facilitate the associated judgments, different assumptions in the application of these policies could have a material adverse effect on our financial condition and results of operations.

20

Table of Contents

Changes in our accounting policies or in accounting standards could materially affect how we report our financial results and condition.

From time to time, the FASB, SEC and other regulatory bodies change the financial accounting and reporting standards that govern the preparation of our consolidated financial statements. These changes can be operationally complex to implement and can materially impact how we report our financial condition and results of operations.

We are subject to stringent capital requirements which may adversely impact return on equity, require additional capital raises, or limit the ability to pay dividends or repurchase shares.

Federal regulations establish minimum capital requirements for insured depository institutions, including minimum risk-based capital and leverage ratios, and define “capital” for calculating these ratios. The minimum capital requirements are: (i) a common equity Tier 1 capital ratio of 4.5%; (ii) a Tier 1 to risk-based assets capital ratio of 6%; (iii) a total capital ratio of 8%; and (iv) a Tier 1 leverage ratio of 4%. The regulations also establish a “capital conservation buffer” of 2.5%, which if complied with will result in the following minimum ratios: (i) a common equity Tier 1 capital ratio of 7.0%; (ii) a Tier 1 to risk-based assets capital ratio of 8.5%; and (iii) a total capital ratio of 10.5%. If we are unable to meet these capital requirements or these requirements are increased, we could, among other things, be required to maintain higher capital, resulting in lower returns on equity, and we could be required to obtain additional capital or be subject to adverse regulatory actions, including limitations on our ability to pay dividends or repurchase shares.

The FRB may require us to commit capital resources to support the Bank.

Federal law requires that a holding company act as a source of financial and managerial strength to its subsidiary bank and to commit resources to support such subsidiary bank. Under the “source of strength” doctrine, the FRB may require a holding company to make capital injections into a troubled subsidiary bank and may charge the holding company with engaging in unsafe and unsound practices for failure to commit resources to a subsidiary bank. A capital injection may be required at times when the holding company may not have the resources to provide it and therefore may require the holding company to borrow the funds or raise capital on terms considered unfavorable to shareholders. Any loans by a holding company to its subsidiary bank are subordinate in right of payment to deposits and to certain other indebtedness of such subsidiary bank. In the event of a holding company’s bankruptcy, the bankruptcy trustee will assume any commitment by the holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank. Moreover, bankruptcy law provides that claims based on any such commitment will be entitled to a priority of payment over the claims of the institution’s general unsecured creditors, including the holders of its note obligations. Thus, any borrowing that must be done by us to make a required capital injection becomes more difficult and expensive and could have an adverse effect on our business, financial condition and results of operations.

We are subject to numerous laws designed to protect consumers, including the Community Reinvestment Act and fair lending laws, and failure to comply with these laws could lead to a wide variety of sanctions.

The Community Reinvestment Act, the Equal Credit Opportunity Act, the Fair Housing Act, and other fair lending laws and regulations impose community investment and nondiscriminatory lending requirements on financial institutions. The CFPB, the FRB, the Department of Justice and other federal agencies are responsible for enforcing these laws and regulations. A successful regulatory challenge to an institution’s performance under the Community Reinvestment Act, the Equal Credit Opportunity Act, the Fair Housing Act or other fair lending laws and regulations could result in a wide variety of sanctions, including damages and civil money penalties, injunctive relief, restrictions on mergers and acquisitions, restrictions on expansion and restrictions on entering new business lines. Private parties may also have the ability to challenge an institution’s performance under fair lending laws in private class action litigation. Such actions could have a material adverse effect on our business, financial condition and results of operations.

We may become subject to enforcement actions even though noncompliance was inadvertent or unintentional.

The financial services industry is subject to intense scrutiny from bank supervisors in the examination process and aggressive enforcement of federal and state regulations, particularly with respect to mortgage-related practices and other consumer compliance matters, and compliance with anti-money laundering, Bank Secrecy Act and Office of Foreign Assets Control regulations, and economic sanctions against certain foreign countries and nationals. Enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices. We maintain systems and procedures designed to ensure that we comply with applicable laws and regulations; however, some legal/regulatory frameworks provide for the imposition of fines or penalties for noncompliance even though the noncompliance was inadvertent or unintentional and even though systems and procedures designed to ensure compliance were in place at the time. Failure to comply with these and other regulations, and supervisory expectations related thereto, may result in fines, penalties, lawsuits, regulatory sanctions, reputation damage, or restrictions on our business.

21

Table of Contents

We face significant legal risks, both from regulatory investigations and proceedings and from private actions brought against us.

As a participant in the financial services industry, many aspects of our business involve substantial risk of legal liability. From time to time we are named as a defendant or are otherwise involved in various legal proceedings, including regulatory enforcement actions, class actions and other litigation or disputes with third parties. Litigation pending against us, if any, is described in Note 24, Contingencies, to the Consolidated Financial Statements under Part II, Item 8, "Financial Statement and Supplementary Data," of this Annual Report on Form 10-K. There is no assurance that regulatory enforcement actions or litigation with private parties will not increase in the future. Pending or future legal proceedings against us may result in judgments, settlements, fines, penalties, indemnification costs, defense costs, or other results adverse to us, which could materially adversely affect our business, financial condition or results of operations, or cause serious reputational harm to us.

We are subject to a variety of risks in connection with any sale of loans we may conduct.

We routinely sell newly originated residential mortgage loans and may also sell other loans or loans portfolios. We may make certain representations and warranties to the purchaser concerning the loans sold and the procedures under which those loans have been originated and serviced. If any of these representations and warranties are invalid, we may be required to refund premiums, indemnify the purchaser for any related costs or losses, or it may be required to repurchase part or all of the affected loans. We may also be required to repurchase loans as a result of borrower fraud or in the event of early payment default by the borrower on a loan it has sold. Demand for our loans in the secondary markets could also be affected by these risks, which could lead to a reduction in related business activities.

Risks Related to Liquidity

If we are unable to access the capital markets, have prolonged net deposit outflows, or our borrowing costs increase, our liquidity and competitive position will be negatively affected.

Liquidity is essential to our business. We must maintain sufficient funds to respond to the needs of depositors and borrowers. To manage liquidity, we draw upon a number of funding sources in addition to in-market deposit growth and repayments and maturities of loans and investments. Any inability to access the capital markets, illiquidity or volatility in the capital markets, the decrease in value of eligible collateral or increased collateral requirements (including as a result of credit concerns for short-term borrowing), changes to our relationships with our funding providers based on real or perceived changes in our risk profile, prolonged federal government shutdowns, or changes in regulations or regulatory guidance, or other events could negatively affect our access to or cost of funding, affecting our ongoing ability to accommodate liability maturities and deposit withdrawals, meet contractual obligations, or fund asset growth and new business initiatives at a reasonable cost, in a timely manner and without adverse consequences. Additionally, our liquidity or cost of funds may be negatively impacted by the unwillingness or inability of the FRB to act as lender of last resort, unexpected simultaneous draws on lines of credit or deposits, the withdrawal of or failure to attract customer deposits, or increased regulatory liquidity, capital and margin requirements.

Although we maintain a liquid asset portfolio and have implemented strategies to maintain sufficient and diverse sources of funding to accommodate planned, as well as unanticipated, changes in assets, liabilities, and off-balance sheet commitments under various economic conditions, a substantial, unexpected, or prolonged change in the level or cost of liquidity could have a material adverse effect on us. If the cost effectiveness or the availability of supply in these credit markets is reduced for a prolonged period of time, our funding needs may require us to access funding and manage liquidity by other means. These alternatives may include generating client deposits, reliance on brokered deposits or certificates of deposits, extending the maturity of wholesale borrowings, borrowing under certain secured borrowing arrangements, using relationships developed with a variety of fixed income investors, securitizing or selling loans, and further managing loan growth and investment opportunities. These alternative means of funding may result in an increase to the overall cost of funds and may not be available under stressed conditions, which would cause us to liquidate a portion of our liquid asset portfolio to meet any funding needs. In the event additional liquidity is needed, we have access to liquidity from the FHLB, the FRB discount window and other sources.

At December 31, 2025, we have combined borrowing capacity from the FHLB of approximately $1.7 billion. Accessing these sources of liquidity may impose additional borrowing costs on us.

Loss of deposits or a change in deposit mix could increase our cost of funding.

Deposits are a stable source of funding for which costs are typically lower than other financing options. We compete with banks and other financial institutions, in addition to emerging competition from tokenized deposits and stablecoins, for deposits, as well as institutions offering uninsured investment alternatives, including money market funds and Treasury Bill alternatives. Our competitors may offer higher interest rates than we do, which could decrease the deposits that we attract or

22

Table of Contents

require us to increase our rates to retain existing deposits or obtain new deposits. Bank failures could negatively impact depositor confidence in us or the banking industry and cause our deposits to decline. Funding costs may increase if we lose deposits and are forced to replace them with more expensive sources of funding, if clients shift their deposits into higher cost products or if we need to raise interest rates to avoid losing deposits. Higher funding costs reduce our net interest margin and net income. Increased deposit competition could materially adversely affect our ability to fund lending operations. As a result, we may need to seek other sources of funds that could increase our cost of funds.

In July 2025, the Guiding and Establishing National Innovation for U.S. Stablecoins Act ("GENIUS Act") was signed into law. The GENIUS Act created a comprehensive federal regulatory framework for payment stablecoins in the U.S., which could create increased competition with respect to our deposit products, depending on interest from consumers and businesses.

Wholesale funding sources may prove insufficient to replace deposits at maturity and support our operations and future growth.

We must maintain sufficient funds to respond to the needs of depositors and borrowers. To manage liquidity, we draw upon a number of funding sources in addition to core deposit growth and repayments and maturities of loans and investments. These sources may include FHLB advances, proceeds from the sale of investments and loans, and liquidity resources at the holding company. Our ability to manage liquidity will be severely constrained if we are unable to maintain access to funding or if adequate financing is not available to accommodate future growth at acceptable costs. In addition, if we are required to rely more heavily on more expensive funding sources to support future growth, our revenues may not increase proportionately to cover our costs. In this case, operating margins and profitability would be adversely affected. Turbulence in the capital and credit markets may adversely affect our liquidity and financial condition and the willingness of certain counterparties and clients to do business with us. Our ability to borrow from other financial institutions or to access the debt or equity capital markets on favorable terms or at all could be adversely affected by disruptions in the capital markets or other events, including actions by rating agencies and deteriorating investor expectations.

The Parent Company is a holding company dependent on liquidity through payments, including dividends, from its bank subsidiary, which is subject to restrictions.

The Parent Company is a holding company, separate from the Bank, and must provide for its own liquidity. The Parent Company depends on dividends, distributions and other payments from the Bank to fund dividend payments and stock repurchases, if permitted, and to fund all payments on obligations. The FRB requires a BHC to act as a source of financial and managerial strength for its subsidiary banks. The FRB could require us to commit resources to the Bank when doing so is not otherwise in the interests of our shareholders or creditors. The Bank is subject to laws that restrict dividend payments or authorize regulatory bodies to prohibit or reduce the flow of funds from it to us. If the Bank is unable to pay dividends to us, we may not be able to service our debt, pay dividends on our common stock or engage in stock repurchases. A reduction or elimination of dividends could adversely affect the market price of our common stock and would adversely affect our business, financial condition, results of operations and prospects. In addition, our right to participate in a distribution of assets upon the Bank’s liquidation or reorganization is subject to the prior claims of the Bank’s creditors, including its depositors. Restrictions on the Bank’s ability to dividend funds to the Company are included in Note 17, Shareholders' Equity and Regulatory Capital, to the Consolidated Financial Statements under Part II, Item 8, "Financial Statements and Supplementary Data."

Concerns about the soundness of other financial institutions could adversely affect us.

Our ability to engage in routine funding and other transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services institutions are interrelated as a result of trading, clearing, counterparty or other relationships. As a result, defaults by, or even rumors or questions about, one or more financial services institutions, or the financial services industry generally, have historically led to market-wide liquidity problems, losses of depositor, creditor and counterparty confidence and could lead to losses or defaults by us or by other institutions. Bank failures could negatively impact client and investor confidence in us, which could negatively impact our earnings, stock price or liquidity. We could experience increases in deposits and assets as a result of other banks’ difficulties or failure, which would increase the capital we are required to maintain to support such growth.

Risks Related to Owning Our Stock

If we want, or are compelled, to raise additional capital in the future, that capital may not be available when it is needed or on terms favorable to current shareholders.

Federal banking regulators require us to maintain adequate levels of capital to support our operations. These capital levels are determined and dictated by law, regulation and banking regulatory agencies. In addition, capital levels are also determined by our management and board of directors based on capital levels that they believe are necessary to support our business operations. Changes in our financial condition or results of operations, applicable accounting standards, laws and regulations

23

Table of Contents

and other factors could make it necessary or advisable for us to raise additional capital. Under such circumstances, our ability to raise additional capital will depend on conditions in the capital markets at that time, which are outside of our control, and on our financial performance. Accordingly, we cannot provide assurance of our ability to raise additional capital on terms and time frames acceptable to us or to raise additional capital at all. Additionally, the inability to raise capital in sufficient amounts may adversely affect our operations, financial condition and results of operations. Our ability to borrow could also be impaired by factors that are nonspecific to us, such as severe disruption of the financial markets or negative news and expectations about the prospects for the financial services industry as a whole. If we raise capital through the issuance of additional shares of our common stock or other securities, we would likely dilute the ownership interests of current investors by diluting earnings per share of our common stock and potentially diluting book value per share, depending on the issuance price. The price at which we issue additional shares of stock could be less than the current market price of our common stock. Furthermore, a capital raise through the issuance of additional shares may have an adverse impact on our stock price. In addition, a capital raise involving the issuance of debt securities could negatively impact our earnings and liquidity.

The market price of our common stock is subject to volatility.

The market price of our common stock has been subject to fluctuations in response to numerous factors, many of which are beyond our control. These factors include actual or anticipated variations in our operational results and cash flows, changes in financial estimates by securities analysts, trading volume, large purchases or sales of our common stock, market conditions within the banking industry, the general state of the securities markets and the market for stocks of financial institutions, as well as general economic conditions. The impact of the large bank failures on the price of securities issued by financial institutions, generally, is one example of a situation in which factors outside of our control can negatively impact the market price of our securities. In addition, if our common stock ceases to be included in the Russell 2000 index, which is reconstituted in June of each year, this could result in decreased liquidity in, and demand for, our common stock, which could cause the market price of our common stock to decline.

A reduction in our credit rating could adversely affect our access to capital and could increase our cost of funds.

A credit rating agency regularly evaluates the Parent Company and the Bank, and credit ratings are based on a number of factors, including our financial strength and ability to generate earnings, as well as factors not entirely within our control, including conditions affecting the financial services industry, the economy, and changes in rating methodologies. There can be no assurance that we will maintain our current credit ratings. A downgrade of the credit ratings of the Parent Company or the Bank could adversely affect our access to liquidity and capital, and could significantly increase our cost of funds, trigger additional collateral or funding requirements, and decrease the number of investors and counterparties willing to lend to us or purchase our securities. This could affect our growth, profitability, and financial condition, including liquidity.

We cannot guarantee that our allocation of capital to various alternatives, including share repurchase programs, will enhance long-term shareholder value.

Our business plan calls for us to execute a variety of strategies to allocate and deploy any excess capital including, but not limited to, continued organic balance sheet growth and diversification, implementation of share repurchase programs, and payment of regular cash dividends. If we are unable to effectively and timely deploy capital through these strategies, it may constrain growth in earnings and return on equity and thereby diminish potential growth in shareholder value. On June 20, 2025, our Board of Directors authorized a share repurchase program pursuant to which we may repurchase up to 500,000 shares of our outstanding common stock in accordance with all applicable securities laws and regulations. The timing and actual number of shares repurchased will depend on a variety of factors including price, corporate and regulatory requirements, market conditions, and other corporate liquidity requirements and priorities.

General Risk Factors

We may not be able to attract and retain skilled people.

Competition for the best people in most activities engaged in by us can be intense, and we may not be able to attract and hire sufficiently skilled people to fill open and newly created positions or to retain current or future employees. This competition for talented, skilled and diverse employees has been intensified by the increase in remote and flexible work arrangements, wage pressures and opportunities in the labor market. An inability to attract and retain individuals with the necessary skills to fill open positions, or the unexpected loss of services of one or more of our key personnel, could have a material adverse impact on our business due to the loss of their skills, knowledge of our markets, years of industry experience or the difficulty of promptly finding qualified replacement personnel.

We believe that our continued growth and future success will depend in large part on the skills of our management team and our ability to motivate and retain these individuals and other key personnel. The loss of service of one or more of our executive officers or key personnel could delay or reduce our ability to successfully implement our long-term business strategy,

24

Table of Contents

our business could suffer, and the value of our stock could be materially adversely affected. Leadership changes will occur from time to time, and we cannot predict whether significant resignations will occur or whether we will be able to recruit additional qualified personnel. We believe our management team possesses valuable knowledge about the banking industry and that their knowledge and relationships could be very difficult to replicate. Our success also depends on the experience of our branch managers and lending officers and on their relationships with the clients and communities they serve. The loss of these key personnel could negatively impact our banking operations. The loss of key personnel, or the inability to recruit and retain qualified personnel in the future, could have an adverse effect on our business, financial condition, or operating results.

We could be adversely affected by a failure in our internal controls.

We rely on our employees to design, manage, and operate our systems and controls to assure that we properly enter into, record and manage processes, transactions and other relationships with clients, suppliers and other parties with whom we do business. In some cases, we rely on employees of third parties to perform these tasks. We also depend on employees and the systems and controls for which they are responsible to assure that we identify and mitigate the risks that are inherent in our relationships and activities. When we change processes or procedures, introduce new products or services, or implement new technologies, we may fail to adequately identify or manage operational risks resulting from such changes.

As a result of our reliance on employees, whether ours or those of third parties, we are subject to human vulnerabilities. These range from innocent human error to misconduct or malfeasance, potentially leading to operational breakdowns or other failures. Our controls may not be adequate to prevent problems resulting from human involvement in our business, including risks associated with the design, operation and monitoring of automated systems. Errors by our employees or others responsible for systems and controls on which we depend and any resulting failures of those systems and controls could result in significant harm to us. This could include client remediation costs, regulatory fines or penalties, litigation or enforcement actions, or limitations on our business activities. We could also suffer damage to our reputation, impacting our ability to attract and retain clients and employees.

Management regularly reviews and updates our internal controls, disclosure controls and procedures, and corporate governance policies and procedures. Any system of controls, however well-designed and operated, is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met. Any failure or circumvention of the controls and procedures or failure to comply with regulations related to controls and procedures could have a material adverse effect on our business, results of operations and financial condition.

Negative public opinion could damage our reputation and adversely affect our earnings.

Reputational risk, or the risk to our earnings and capital from negative public opinion, is inherent in our business. Negative public opinion can result from the actual or perceived manner in which we conduct our business activities, including banking operations and trust and investment operations, our management of actual or potential conflicts of interest and ethical issues, and our protection of confidential client information. Negative public opinion can also result from events occurring in the banking industry, such as bank failures, which are outside of our control. Negative public opinion can adversely affect our ability to keep and attract clients and can expose us to litigation and regulatory action. Although we take steps to minimize reputation risk in the way we conduct our business activities and deal with our clients, communities and vendors, these steps may not be effective. The proliferation of social media websites utilized by us and other third parties, as well as the personal use of social media by our employees and others, including personal blogs and social network profiles, also may increase the risk that negative, inappropriate or unauthorized information may be posted or released publicly that could harm our reputation or have other negative consequences, including as a result of our employees interacting with our clients in an unauthorized manner in various social media outlets. Any damage to our reputation could affect our ability to retain and develop the business relationships necessary to conduct business, which in turn could negatively impact our financial condition, results of operations, and the market price of our common stock.

Acts of terrorism, natural disasters, global climate change, future pandemics, wars and global conflicts may have a negative impact on our business and operations.

Acts of terrorism, natural disasters, global climate change, future pandemics, wars, global conflicts or other similar events could disrupt our operations, result in damage to our properties, reduce or destroy the value of the collateral for our loans and otherwise have a negative impact on our business and operations. While we have in place business continuity plans, such events could still damage our facilities, disrupt or delay the normal operations of our business (including communications and technology), result in harm to, or cause travel limitations on, our employees, and have a similar impact on our clients, suppliers, third-party vendors and counterparties. These events also could impact us negatively to the extent that they result in reduced capital markets activity, lower asset price levels, or disruptions in general economic activity in the U.S. or abroad, or in financial market settlement functions. In addition, these or similar events may impact economic growth negatively, which could have an adverse effect on our business and operations, and may have other adverse effects on us in ways that we are unable to predict.

25

Table of Contents

Anti-takeover provisions could negatively impact our shareholders.

Provisions of Pennsylvania law and provisions of our articles of incorporation and bylaws could make it more difficult for a third party to acquire control of us or have the effect of discouraging a third party from attempting to acquire control of us, even if a merger might be in the best interest of our shareholders. Our articles of incorporation authorize our Board of Directors to issue preferred stock without shareholder approval and such preferred stock could be issued as a defensive measure in response to a takeover proposal. These and other provisions could make it more difficult for a third party to acquire us.

ITEM 1B – UNRESOLVED STAFF COMMENTS

None.

ITEM 1C – CYBERSECURITY

We use, store and process data for and about our customers and employees. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems.We did not experience any cybersecurity incidents in 2025 that materially affected the Company.

Risk Management Oversight and Governance

Under the ultimate direction of our Chief Executive Officer and executive management team, our Information Security Core Committee has primary responsibility for overseeing our management of cybersecurity risks. This committee is chaired by our Chief Information Security Officer, or CISO, who reports directly to our Chief Risk Officer. Other members of the committee include representatives from Information Technology, Operations, Privacy, Compliance, BSA, Audit, Business Continuity, Vendor Management, Human Resources, Physical Security, Unified Fraud, Retail, Wealth Management, Lending, and Enterprise Risk Management.

Our CISO, working with his team and the Information Security Core Committee, has primary responsibility for assessing and managing our cybersecurity threat management program. He has more than 25 years of experience in building and leading information security teams and has worked at a technology start-up and a large, publicly-traded financial institution before joining the Company. His experience as a technology engineer has prepared him to lead a variety of teams, both large and small, design, as well as implement and execute executive cyber and information security controls. He studied Computer Science at the University of Virginia and holds a Certified Information Systems Security Professional ("CISSP") certification.

In addition to frequent electronic communication, the committee meets monthly and more frequently, as circumstances warrant, to discuss and monitor prevention, detection, mitigation and remediation of risks from cybersecurity threats. When appropriate, meetings will also include our Chief Risk Officer, Chief Financial Officer, General Counsel and members of our disclosure committee. On a regular basis, the CISO also updates the executive management team on developments within the cybersecurity sphere.

The Board of Directors has delegated oversight of the Company’s cybersecurity program to the Enterprise Risk Management Committee of the Board of Directors. The Enterprise Risk Management Committee is responsible for reviewing reports on data management and security initiatives and significant existing and emerging cybersecurity risks, including cybersecurity incidents, the impact on the Company and its stakeholders of any significant cybersecurity incident and any disclosure obligations arising from any such incidents.

Our CISO meets quarterly with the Enterprise Risk Management Committee of the Board of Directors to discuss management’s ongoing cybersecurity risk management programs. He provides information about the sources and nature of risks the Company faces, how management assesses such risks – including in terms of likelihood and severity of impact, progress on vulnerability remediation and current developments in the cybersecurity landscape. This presentation is shared with the full Board of Directors to enable discussion of cybersecurity risk management at the full board level.

Processes for the Identification of Cybersecurity Threats

Under the guidance of the Information Security Core Committee and the CISO, we have adopted a cybersecurity risk management program that addresses, among other areas:

•Identification of assets at risk from cybersecurity threats;

•Identification of potential sources of cybersecurity threats;

•Assessment of the status of protections in place to prevent or mitigate cybersecurity threats; and

•Given that landscape, how to manage cybersecurity risks.

26

Table of Contents

Our risk assessment and mitigation program is centered on three key components:

•Identification of risks, which involves input from different groups across the Company;

•Evaluation of the likelihood of the risks manifesting, the severity of the potential consequences and prioritization of different risk items based on, among other things, importance to the business and cost/benefit analysis to fully address; and

•Execution – establishment of a program to address.

Our information security team is responsible for monitoring our information systems for vulnerabilities and mitigating any issues. It works with other groups in the Company to understand the severity of the potential consequences of a cybersecurity incident and to make decisions about how to prioritize mitigation and other initiatives based on, among other things, materiality to the business. The information security team has processes designed to keep the Company apprised of the different threats in the cybersecurity landscape – this includes interacting with intelligence networks, working with researchers, discussions with peers at other companies, monitoring social media, reviewing government alerts and other news items and attending security conferences. The team also regularly monitors our internal network and out customer-facing network to identify security risks.

Our Internal Audit function updates the Enterprise Risk Management Committee of our Board of Directors on a quarterly basis about the Company’s enterprise risk management program. These reports are the culmination of a process that involves discussions with leaders across the Company and incorporates a multitude of enterprise risk factors, including cybersecurity threats. The Enterprise Risk Management Committee Chair, in turn, reports to the full Board of Directors a summary of the enterprise risk management presentation.

We have an employee education program that is designed to raise awareness of cybersecurity threats to reduce our vulnerability as well as to encourage consideration of cybersecurity risks across functions.

As part of the assessment of the protections we have in place to mitigate risks from cybersecurity threats, we engage third parties to conduct risk assessments on our systems. To assess the effectiveness of our program, we also have engaged consultants to conduct penetration testing and other vulnerability analyses. Over a cycle of several years, our Internal Audit function, with the assistance of outside technical advisors, will conduct an assessment of different systems to provide the Enterprise Risk Management Committee with information on our risk management processes, including cybersecurity risk.

Cyber Risks Related to Third Parties

Risks from cybersecurity threats associated with our use of third-party service providers or third-party technology or other solutions are addressed as part of our overall cybersecurity risk management program. Before purchasing third party technology or other solutions that involve exposure to the Company’s assets and electronic information, our information technology team requires those companies to complete a security review before being approved to work with the Company. To help control cyber risks at third parties and protect customer data and systems on an ongoing basis, we also conduct periodic information security assessments of certain of our third-party service providers.

ITEM 2 – PROPERTIES

Our principal executive offices are located at 4750 Lindle Road, Harrisburg, Pennsylvania.

We own or lease other premises for use in conducting our business activities, including bank branches and offices in Cumberland, Dauphin, Franklin, Lancaster, Perry and York Counties, Pennsylvania and Anne Arundel, Baltimore, Harford, Howard, and Washington Counties, Maryland. We believe that the properties currently owned and leased are adequate for present levels of operation. We are constantly evaluating the best and most efficient mix of branch locations to service our clients due to evolving trends in our industry and increased client engagement through digital channels.

At December 31, 2025, the Bank had 38 full-service branches and five limited purpose branches.

ITEM 3 – LEGAL PROCEEDINGS

Information regarding legal proceedings is included in Note 24, Contingencies, to the Consolidated Financial Statements under Part II, Item 8, "Financial Statement and Supplementary Data."

ITEM 4 – MINE SAFETY DISCLOSURES

Not applicable.

27

Table of Contents

PART II

ITEM 5 – MARKET FOR REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES

Market Information

Our common stock is traded on the NASDAQ Capital Market under the symbol “ORRF.” At the close of business on March 6, 2026, there were 3,015 shareholders of record.

The Board declared cash dividends of $1.06 and $0.86 per common share in 2025 and 2024, respectively. Although the Company cannot guarantee the amount of future dividend payments, the Board understands the importance of the dividend to our shareholders and is committed to paying regular cash dividends; however, there can be no assurance as to future dividends because they are dependent on our future earnings, capital requirements and financial condition. Restrictions on the payment of dividends are discussed in Note 17, Shareholders' Equity and Regulatory Capital, to the Consolidated Financial Statements under Part II, Item 8, "Financial Statements and Supplementary Data." On January 27, 2026, the Board declared a cash dividend of $0.30 per common share, which was paid on February 17, 2026, to shareholders of record as of February 10, 2026.

Securities Authorized for Issuance under Equity Compensation Plans

Information regarding the Company's equity compensation plans is included in Part III, Item 12, Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters.

Issuer Purchases of Equity Securities

(a) (b) (c) (d)

On June 20, 2025, the Board of Directors of the Company authorized a share repurchase program pursuant to which the Company could repurchase up to 500,000 shares of its outstanding common stock in accordance with all applicable securities laws and regulations, including Rule 10b-18 of the Exchange Act, as amended. When and if appropriate, repurchases may be made in the open market or privately negotiated transactions, depending on market conditions, regulatory requirements and other corporate considerations, as determined by management. Share repurchases may not occur and may be discontinued at any time. For the year ended December 31, 2025, the Company repurchased 8,330 shares of its common stock. Common stock available for future repurchase totals 491,670 shares, or 2.5% of the Company's outstanding common stock at December 31, 2025.

28

Table of Contents

PERFORMANCE GRAPH

The performance graph below compares the cumulative total shareholder return on our common stock with other indexes: the S&P U.S. SmallCap Banks index of banks with assets between $1.0 billion and $5.0 billion, the S&P 500 Index, and the NASDAQ Composite index. The graph assumes an investment of $100 on December 31, 2020 and reinvestment of dividends on the date of payment without commissions. Shareholder returns on our common stock are based on trades on the NASDAQ Stock Market. The performance graph represents past performance and should not be considered to be an indication of future performance.

Period Ending

Source: S&P Global Market Intelligence © 2026

In accordance with the rules of the SEC, this section captioned “Performance Graph” shall not be incorporated by reference into any of our future filings made under the Exchange Act or the Securities Act. The Performance Graph and its accompanying table are not deemed to be soliciting material or to be considered filed under the Exchange Act or the Securities Act.

Recent Sales of Unregistered Securities

The Company has not, within the past three years, sold any equity securities, which were not registered under the Securities Act.

29

Table of Contents

ITEM 6 – [RESERVED]

ITEM 7 – MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

The following discussion and analysis is intended to assist readers in understanding the consolidated financial condition and results of operations of the Company and should be read in conjunction with our Consolidated Financial Statements and notes thereto included in this Annual Report on Form 10-K. Certain prior period amounts presented in this discussion and analysis have been reclassified to conform to current period classifications. These reclassifications did not have a material impact on the Company's consolidated balance sheets, statements of income or statement of consolidated cash flows.

Overview

The Company, headquartered in Harrisburg, Pennsylvania, is a one-bank holding company that has elected status as a financial holding company. The consolidated financial information presented herein reflects the Company and its wholly-owned subsidiary, the Bank. At December 31, 2025, the Company had total assets of $5.5 billion, total liabilities of $5.0 billion and total shareholders' equity of $591.5 million as reported in the consolidated balance sheets.

The Company acquired Codorus Valley and its wholly-owned bank subsidiary PeoplesBank, A Codorus Valley Company on July 1, 2024. The merger and acquisition method of accounting was used to account for the transaction with the Company as the acquirer. The Company recorded the assets and liabilities of Codorus Valley at their respective fair values as of July 1, 2024. The transaction was valued at $233.4 million and expanded the Bank’s footprint into the York, Pennsylvania market while increasing its market penetration in its existing markets.

The Company incurred merger-related expenses of $2.6 million for the year ended December 31, 2025. For the year ended December 31, 2024, the Company incurred merger-related expenses of $22.7 million, a provision for non-PCD loans of $15.5 million, expenses for the retirement of an executive of $4.8 million and a provision for legal settlement of $478 thousand. The merger-related and other non-recurring expenses are included in non-interest expenses in the consolidated statements of income under Part II, Item 8, "Financial Statements and Supplemental Data."

Critical Accounting Estimates