RISK FACTORS
In addition to the other information included in this Annual Report on Form 10-K, the following risk factors should be carefully considered in connection with evaluating our business and any forward-looking statements contained herein. Our business, financial condition, results of operations and cash flows could be harmed by any of the risk factors described below, or other risks that have not been identified or which we believe are immaterial or unlikely. If one or more of these or other risks or uncertainties materialize, or if our underlying assumptions prove to be incorrect, our business, financial condition, operating results and cash flows could be materially adversely affected.
Table of Contents
RISKS RELATED TO OUR BUSINESS
Our profitability depends significantly on local economic conditions.
Our success depends primarily on the general economic conditions of the primary markets in Virginia in which we operate and where our loans are concentrated. Unlike nationwide banks that are more geographically diversified, we provide banking and financial services to customers primarily in the Lynchburg metropolitan statistical area (“MSA”), often referred to as Region 2000, which includes the City of Lynchburg and the Counties of Bedford, Campbell, Amherst, and Appomattox. To a lesser extent, our lending market includes the Roanoke, Charlottesville, Harrisonburg, Blacksburg, and Wytheville MSAs. As of December 2025, the Lynchburg MSA had an unemployment rate (not seasonally adjusted) of approximately 3.6%, compared to a statewide average unemployment rate of approximately 3.5%, reflecting a modest increase from approximately 3.3% at the end of 2024.
The local economic conditions in these areas have a significant impact on our commercial and industrial, real estate and construction loans, the ability of our borrowers to repay their loans and the value of the collateral securing these loans. If population or income growth in our market areas is slower than projected, income levels, deposits and housing starts could be adversely affected and could result in a reduction in our growth and profitability. If our market areas experience a downturn or recession for a prolonged period, we could experience significant increases in nonperforming loans, which could lead to operating losses, impaired liquidity and eroding capital. A significant decline in general economic conditions, caused by inflation, recession, acts of terrorism, outbreaks of hostilities or other calamities, , or monetary and fiscal policies of the federal government could affect our financial condition, results of operations and cash flows.
Future public health emergencies could adversely affect our business, financial condition, and results of operations.
A widespread public health crisis, such as a pandemic or epidemic, could adversely affect economic conditions in our markets, disrupt our operations, increase loan delinquencies and defaults, reduce the value of loan collateral, and negatively impact our financial condition and results of operations. The extent of any impact would depend on the severity and duration of the crisis and related governmental and economic responses.
A significant portion of our loan portfolio is secured by real estate, and events that negatively impact the real estate market could hurt our business.
A substantial majority of our loans have real estate as a primary or secondary component of collateral. The real estate collateral provides an alternate source of repayment in the event of default but may deteriorate in value during the time the credit is extended. Because most of our loans are concentrated in the Region 2000 area in and surrounding the City of Lynchburg, a decline in local economic conditions may have a greater effect on our earnings and capital than on larger financial institutions whose real estate loan portfolios are more geographically diverse.
A weakening of the real estate market in our primary market areas could increase borrower defaults and reduce the value of collateral securing our loans, which could adversely affect our profitability and asset quality. If we are required to liquidate collateral during a period of reduced real estate values, our earnings and capital could be adversely affected. Additionally, acts of nature, including hurricanes, tornadoes, earthquakes, fires and floods, may cause uninsured damage to real estate that secures our loans and negatively impact our financial condition.
Our loan portfolio contains a number of real estate loans with relatively large balances.
A significant portion of our loan portfolio consists of real estate loans with balances in excess of $1,000,000. The deterioration of one or a few of these loans could significantly increase nonperforming loans, loan charge-offs, and the provision for credit losses, which could have a material adverse effect on our financial condition and results of operations.
Table of Contents
Commercial real estate loans increase our exposure to credit risk.
A majority of our loan portfolio is secured by commercial real estate. Commercial real estate loans generally have higher default risk than residential real estate or consumer loans because repayment often depends on the successful operation of the property, the borrower’s income stream, and the accuracy of property valuations and construction cost estimates. An adverse development with respect to one lending relationship can expose us to significantly greater risk of loss compared with single-family residential mortgage loans because we typically have multiple loans with such borrowers. Additionally, these loans typically involve larger loan balances to single borrowers or groups of related borrowers.
The deterioration of one or a few of these loans could cause a significant decline in asset quality, a sharp increase in loan charge-offs, and could require us to significantly increase our allowance for credit losses, which could have a material adverse impact on our business, financial condition, results of operations and cash flows.
A percentage of the loans in our portfolio currently include exceptions to our loan policies and supervisory guidelines .
All loans we make are subject to written loan policies adopted by our board of directors and supervisory guidelines imposed by our regulators. Our loan policies are designed to reduce risks by requiring loan officers to take certain steps prior to closing, including documenting and perfecting liens on collateral and requiring proof of adequate insurance coverage.
Loans that do not fully comply with our loan policies are known as “exceptions,” which we categorize as policy exceptions, financial statement exceptions, and document exceptions. As a result of these exceptions, such loans may have a higher risk of loan loss than loans that fully comply with our loan policies. In addition, we may be subject to regulatory action by federal or state banking authorities if they believe the number of exceptions in our loan portfolio represents an unsafe banking practice.
As a community bank, we have different lending risks than larger banks due to our focus on individuals and small to medium-sized businesses.
Our ability to diversify our economic risks is limited by our local markets and economies. We lend primarily to small to medium-sized businesses, professionals and individuals, which may expose us to greater lending risks than banks lending to larger, better-capitalized businesses with longer operating histories. Small to medium-sized businesses frequently have smaller market share than their competition, may be more vulnerable to economic downturns, have fewer financial resources and borrowing capacity, often need substantial additional capital to expand or compete, and may experience significant volatility in operating results. Any one or more of these factors may impair a borrower’s ability to repay a loan.
In addition, the success of a small to medium-sized business often depends on the management talents and efforts of one or two persons or a small group of persons, and the death, disability or resignation of one or more of these persons could have a material adverse impact on the business and its ability to repay. Economic downturns and other events that negatively impact our market areas could cause us to incur substantial credit losses that could negatively affect our results of operations and financial condition.
We depend on the accuracy of information provided by clients and counterparties.
In deciding whether to extend credit or enter into other transactions, we rely on information furnished by or on behalf of clients and counterparties, including financial statements and other financial information, which we do not independently verify as a matter of course. We also rely on representations of clients and counterparties as to the accuracy and completeness of that information and, with respect to financial statements, on reports of independent auditors. For example, in deciding whether to extend credit, we may assume that a customer’s audited financial statements conform
Table of Contents
with U.S. Generally Accepted Accounting Principles (“GAAP”) and fairly present the customer’s financial condition, results of operations and cash flows. Our financial condition and results of operations could be negatively impacted if we rely on financial statements that do not comply with GAAP or are materially misleading.
Credit losses could adversely affect our earnings and financial condition.
We could sustain losses if borrowers, guarantors or related parties fail to perform in accordance with the terms of their loans. We have adopted underwriting and credit monitoring procedures and policies, including the establishment and review of the allowance for credit losses, that we believe are appropriate to minimize this risk by assessing the likelihood of nonperformance, tracking loan performance and diversifying our credit portfolio. These policies and procedures, however, may not prevent unexpected losses that could materially adversely affect our results of operations.
These policies and procedures necessarily rely on our making various assumptions and judgments about the collectability of our loan portfolio, including the creditworthiness of our borrowers and the value of real estate and other assets serving as collateral. In determining the amount of the allowance for credit losses, we review our loans, our loss and delinquency experience, and economic conditions. If our assumptions are incorrect, our allowance for credit losses may not be sufficient to cover losses in our loan portfolio, resulting in additions to our allowance. Any future additions to our allowance could materially decrease our net income.
In addition, the Federal Reserve Bank of Richmond and the Virginia Bureau of Financial Institutions periodically review our allowance for credit losses and may require us to increase our provision for credit losses or recognize further loan charge-offs. Any increase in our allowance for credit losses or loan charge-offs as required by regulatory authorities could have a material adverse effect on our financial condition and results of operations.
Our allowance for credit losses may not be adequate to cover actual losses.
A significant source of risk arises from the possibility that we could sustain losses due to loan defaults and nonperformance. We maintain an allowance for credit losses in accordance with GAAP to provide for such defaults and other nonperformance. As of December 31, 2025, our allowance as a percentage of total loans was 0.97% and our allowance as a percentage of nonperforming loans was 379%. The determination of the appropriate level of allowance is an inherently difficult process based on numerous assumptions and judgments, and the amount of future losses is susceptible to changes in economic, operating and other conditions, including changes in interest rates, many of which are beyond our control. In addition, our underwriting policies, credit monitoring processes and risk management systems may not prevent unexpected losses. Our allowance may not be adequate to cover actual credit , and any increase in our allowance will affect our earnings.
We adopted the Current Expected Credit Losses (“CECL”) accounting standard on January 1, 2023. The CECL methodology requires a forward-looking approach that reflects expected credit losses over the lives of financial assets, starting when such assets are first originated or acquired. CECL requires us to record, at the time of origination, the credit losses expected throughout the life of our loans, as opposed to the previous incurred-loss method, which recorded losses only when it was probable that a loss event had already occurred. CECL necessitates the use of quantitative models, forecasts, and significant assumptions and judgment, and it relies on historical data and estimated relationships that may not accurately predict future losses, particularly during periods of economic stress or rapid changes in interest rates or the composition of our loan portfolio. In addition, we may rely on third-party vendors, models, software, or data in developing or operating our CECL methodology and forecasts, and any limitations, , or in such tools or inputs, or in our model governance, validation, and monitoring processes, could result in estimates. CECL can also result in in our allowance and provision for credit . If our assumptions prove , if actual credit differ materially from our estimates, or if regulators, auditors, or standard setters require changes to our methodology, assumptions, or inputs, we could be required to increase our allowance or otherwise modify our estimates, which could materially affect our financial condition and operating results.
Table of Contents
We face substantial competition in our markets.
The banking and financial services industry is highly competitive. We compete with other commercial banks, savings banks, credit unions, finance companies, mutual funds, insurance companies and brokerage and investment banking firms in the Virginia localities where we operate and surrounding areas. Many of these competing institutions have nationwide or regional operations and greater resources than we have, while we also face competition from local community institutions. Many of our competitors enjoy competitive advantages, including greater name recognition and financial resources, a wider geographic presence, more accessible branch locations, the ability to offer additional services, greater marketing resources, more favorable pricing for loans and deposits, and lower origination and operating costs. We are also subject to lower lending limits than our larger competitors.
Our profitability depends upon our continued ability to successfully compete in our market areas. Increased deposit competition could increase our cost of funds and adversely affect our ability to generate funds necessary for our lending operations. If we must raise interest rates paid on deposits or lower interest rates charged on loans, our net interest margin and profitability could be adversely affected. Competition could result in a decrease in loans we originate and could negatively affect our ability to grow and our results of operations.
Technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and payment systems. Many of our competitors have fewer regulatory constraints and may have lower cost structures. Additionally, due to their size, many competitors may achieve economies of scale and, as a result, may offer a broader range of products and services as well as better pricing.
We have increased and plan to continue to increase our levels of commercial and industrial loans. We may not be successful in continuing to penetrate this market segment, which has helped to drive some of our recent earnings.
A significant percentage of our loans are commercial and industrial loans, and we continue to focus on this market segment. While we intend to originate these loans in a manner consistent with safety and soundness, commercial and industrial loans generally expose us to greater risk of loss than one- to four-family residential mortgage loans because repayment generally depends, in large part, on the borrower’s business performance and ability to cover operating expenses and debt service. In addition, these loans typically involve larger loan balances to single borrowers or groups of related borrowers compared to residential mortgage loans. Changes in economic conditions beyond our or the borrower’s control could adversely affect the value of the loan collateral and the future cash flow of the affected business. As we continue to originate these loans, we may experience higher levels of non-performing assets or credit losses, or both.
Our plans for future expansion depend, in some instances, on factors beyond our control, and an unsuccessful attempt to achieve growth could have a material adverse effect on our business, financial condition, results of operations and future prospects.
We may engage in branch expansion or seek to acquire other financial institutions or parts of those institutions in the future, though we have no present acquisition plans. Expansion involves a number of risks, including:
the time and costs of evaluating new markets, hiring experienced local management and opening new offices;
time lags between expansion activities and the generation of sufficient assets and deposits to support the costs;
entrance into new markets where we lack experience;
introduction of new products and services with which we have no prior experience;
failure to culturally integrate an acquisition target or new branches; and
failure to identify and retain experienced key management with local expertise and relationships in new markets.
Table of Contents
Foreclosed properties could lead to increased operating expenses and losses.
From time to time, we foreclose upon and take title to real estate serving as collateral for our loans. If our other real estate owned (OREO) balance increases, our earnings will be negatively affected by various expenses associated with OREO, including personnel costs, insurance and taxes, completion and repair costs, valuation adjustments and other expenses associated with property ownership.
At the time we foreclose upon a loan and take possession of a property, we estimate the property’s value using third-party appraisals and internal judgments. OREO property is valued on our books at the estimated market value of the property, less estimated costs to sell. Upon foreclosure, a charge-off to the allowance for credit losses is recorded for any excess of the loan balance over fair value. Thereafter, we periodically reassess fair value based on updated appraisals or other factors. Any declines in our estimate of fair value will result in valuation adjustments that negatively impact our earnings. As a result, our results of operations are vulnerable to declines in the residential and commercial real estate markets in the areas in which we operate. Any increase in non-accrual loans may lead to increases in our OREO balance.
We may need to raise additional capital in the future, which may not be available on acceptable terms.
We are required by federal and state regulatory authorities to maintain adequate levels of capital to support our operations. We may need to raise additional capital to support future growth or to meet regulatory capital requirements. Our ability to raise additional capital will depend on conditions in the capital markets at that time, which are outside of our control, and on our financial performance. We cannot assure that we will be able to raise additional capital on terms acceptable to us. If we cannot raise additional capital when needed, our ability to expand our operations could be materially impaired, and our financial condition and results of operations could be adversely affected.
Our corporate culture has contributed to our success, and if we cannot maintain this culture as we grow, we could lose the teamwork and increased productivity fostered by our culture, which could harm our business.
We believe that a critical contributor to our success has been our corporate culture, which we believe fosters teamwork and increased productivity. As our organization grows and we are required to implement more complex organizational management structures, we may find it increasingly difficult to maintain the beneficial aspects of our corporate culture. This could negatively impact our future success.
Loss of key employees could adversely affect our business.
Our success is highly dependent on our executive management team and other key personnel. As a community bank, we depend on our management team’s ties to the community to generate business and on our executives’ expertise to implement our business strategy. Our executive management and other key personnel have not signed non-competition covenants.
Competition for personnel is intense, and we may not be successful in attracting or retaining qualified personnel. The loss of several key personnel could adversely affect our growth strategy and seriously harm our business, results of operations and financial condition.
Severe weather, natural disasters, acts of war or terrorism or other adverse external events could significantly impact our business.
Severe weather, natural disasters, acts of war or terrorism or other adverse external events could have a significant impact on our ability to conduct business. Such events could affect the stability of our deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue or cause us to incur additional expenses, any of which could have a material adverse effect on our business, financial condition and results of operations.
Table of Contents
As a community bank, our ability to maintain our reputation is critical to the success of our business, and our failure to do so may materially adversely affect our performance.
Our reputation is one of the most valuable components of our business. Negative publicity can result from our actual or alleged conduct in any number of activities, including lending practices, corporate governance, acquisitions and actions taken or threatened by government regulators and community organizations in response to those activities. If our reputation is negatively affected by the actions of our employees or otherwise, there may be an adverse effect on our ability to keep and attract customers, and we might be exposed to litigation and regulatory action, any of which could materially adversely affect our business and operating results.
Our decisions regarding how we manage our credit exposure may materially and adversely affect our business.
We manage our credit exposure through careful monitoring of lending relationships and loan concentrations in particular industries, and through loan approval and review procedures. The adequacy of our allowance for credit losses is crucial in monitoring credit exposure. While our board and senior management are continuing to improve the Bank’s risk management framework and align the Bank’s risk philosophy with its capital and strategic plans, failure to continue to improve such risk management framework could have a material adverse effect on our financial condition and results of operations. We can make no assurances that our credit loss reserves will be sufficient to absorb future credit losses or prevent a material adverse effect on our business, financial condition or results of operations.
Our profitability is vulnerable to interest rate fluctuations and changes in monetary policies.
Our profitability depends substantially upon our net interest income, which is the difference between the interest earned on interest-earning assets, such as loans and investment securities, and the interest expense paid on interest-bearing liabilities, such as deposits and other borrowings. Market interest rates are highly sensitive to many factors beyond our control, including market conditions, policies of monetary and fiscal authorities, particularly the Federal Reserve, and competitive pricing pressures. Changes in interest rates may cause significant changes in our net interest income and net interest margin. Depending on our portfolio of loans and investments, our results of operations may be adversely affected by changes in interest rates.
Our financial condition and results of operations are affected by credit policies of monetary authorities, particularly the Federal Reserve Board. Actions by monetary and fiscal authorities, including the Federal Reserve Board, could have an adverse effect on our deposit levels, loan demand or business and earnings.
Inflation could adversely impact our customers’ ability to repay loans.
Inflation decreases the purchasing power of money and can reduce the value of assets and income from investments. Our customers may be adversely affected by inflation and the rising costs of goods and services used in their households and businesses, which could negatively impact their ability to repay their loans.
Cybersecurity threats and operational system failures could disrupt our business and result in financial losses.
Cybersecurity threats, including attacks on us or our third-party service providers, and operational system failures could disrupt our business, result in financial losses, increase compliance and remediation costs, and harm our reputation.
We rely on communications, information systems, and third-party service providers to operate our business and to deliver products and services to customers. These systems and relationships expose us to the risk of cyber incidents and operational disruptions, including unauthorized access, loss or destruction of data (including nonpublic personal information), account takeovers, unavailability of service, ransomware or other malware, and other attacks.
Table of Contents
Cyber threats are continually evolving, and threat actors may use increasingly sophisticated methods, including social engineering, credential theft, deepfake-enabled fraud, supply-chain compromise, and exploitation of vulnerabilities in vendor systems. In addition, our customers access our services through devices and networks we do not control, which may increase the risk of compromise of customer credentials.
Cyber incidents or operational disruptions could:
impair our ability to conduct business, process transactions, or provide customer service;
result in the disclosure, misuse, or loss of confidential information;
subject us to regulatory scrutiny, supervisory actions, investigations, or litigation;
require significant expenditures for remediation, forensic investigation, notification, system enhancements, and business continuity measures;
increase our cyber insurance costs or reduce the availability of coverage on acceptable terms; and
damage our reputation and adversely affect customer relationships.
While we maintain policies, procedures, and controls designed to prevent, detect, and respond to cyber incidents and operational disruptions, no system can provide absolute security. We have experienced cybersecurity incidents and other technology-related events in the past that resulted in costs and/or operational impacts, and we may experience additional incidents in the future. Any such incident, whether arising from our systems or those of third parties, could materially adversely affect our business, financial condition, and results of operations.
We have suffered non-material losses in the past from such events and there can be no assurance that such events will not have a material effect on the Bank.
Emerging Technological Threats
The pace of technological change continues to increase the operational, fraud, and cybersecurity risks faced by financial institutions. In particular, malicious actors are increasingly using artificial intelligence and other tools to conduct more sophisticated attacks, including highly targeted phishing and social‑engineering campaigns, business email compromise, deepfake or voice‑spoofing fraud, and account takeover attempts. These evolving tactics may be difficult to detect and prevent and could result in customer losses, theft or diversion of funds, unauthorized transactions, operational disruption, reputational harm, litigation, and increased compliance and remediation costs.
We also rely on third‑party service providers for critical technology systems and services, including core processing, online and mobile banking, payment processing, information security tools, cloud-based services, and other outsourced functions. A failure, disruption, security breach, or other compromise of our systems or those of our service providers—whether due to cyberattack, human error, system failure, or other cause—could impair our ability to deliver products and services, expose sensitive customer or Company information, or otherwise adversely affect our operations and financial condition. In addition, changes in the threat landscape and technology environment may require us to make significant ongoing investments in technology infrastructure, cybersecurity controls, fraud prevention, vendor oversight, and employee training; if we are to implement these effectively or on a timely basis, our risk exposure may increase.
Customer expectations regarding digital banking capabilities, convenience, and availability continue to evolve. If we do not successfully maintain and enhance our digital delivery channels and technology-enabled services, or if customers perceive our capabilities to be less competitive than alternatives offered by other banks, credit unions, or financial technology companies, we could lose customers, deposits, and related relationships, which could adversely affect our liquidity, net interest income, fee income, and overall profitability.
Table of Contents
Alternative financial products, digital banking trends, and technological change could affect our deposit base and competitive position.
Our traditional banking model depends heavily on stable customer deposits as a primary source of funding. The rising popularity of alternative financial products and services—including fintech platforms, cryptocurrencies, money market funds, and digital wallets—may lead to increased volatility in our deposit base as customers seek different ways to save and invest their funds. This shift in customer preferences could challenge our ability to maintain stable deposits and attract and retain customers.
The financial services industry is increasingly affected by advances in technology, including Internet-based banking, mobile banking, and new technology-driven products and services. Financial technology companies that rely on technology to provide financial services such as peer-to-peer platforms have the potential to disrupt the financial services industry. Our ability to compete successfully may depend on the extent to which we are able to adapt to and implement such technological changes and properly train our staff to use such technologies. We may not be able to effectively implement new technology-driven products and services or compete successfully against these products.
Increasing customer demand for digital banking capabilities also requires ongoing investments in technology infrastructure, cybersecurity, and regulatory compliance. Significant fluctuations in deposits could adversely affect our liquidity position, funding costs, and overall financial stability. Although we actively manage our liquidity and funding sources, a substantial shift of customer deposits to alternative products or failure to adapt to technological changes could negatively impact our operations, profitability, and competitive position.
Changes in consumers’ use of banks and changes in consumers’ spending and saving habits could adversely affect our financial results.
Technology and other changes now allow many consumers to complete financial transactions without using banks. For example, consumers can pay bills and transfer funds directly without going through a bank. This disintermediation could result in the loss of fee income, as well as the loss of customer deposits and income generated from those deposits. In addition, changes in consumer spending and saving habits could adversely affect our operations, and we may be unable to timely develop competitive new products and services in response to these changes that are accepted by new and existing customers.
We are subject to operational risks.
The Company may also be subject to disruptions of its systems arising from events that are wholly or partially beyond our control (including, for example, computer viruses or electrical or telecommunications outages), which may give rise to losses in service to customers and to financial loss or liability. The Company is further exposed to the risk that its external vendors may be unable to fulfill their contractual obligations (or will be subject to the same risk of fraud or operational errors by their respective employees as is the Company) and to the risk that the Company’s (or its vendors’) business continuity and data security systems prove to be inadequate.
Liquidity risk could adversely affect our business and financial condition.
Liquidity risk is the potential that we will be unable to meet our obligations as they become due, capitalize on growth opportunities as they arise, or pay regular cash dividends because of an inability to liquidate assets or obtain adequate funding on a timely basis, at a reasonable cost and within acceptable risk tolerances. A failure to adequately manage our liquidity risk could adversely affect our business, financial condition and operating results. In addition, the Federal Reserve could impose additional requirements on us if the agency determines that our liquidity risk management practices do not adequately manage our liquidity risk.
Table of Contents
Our liquidity could be reduced by a decrease in the value of certain assets, including loans and investment securities, caused by increases in interest rates, which could reduce the amount that we are able to borrow or reduce the proceeds from the sale of securities in our portfolio. Our ability to borrow could also be impaired by factors that are not specific to us, such as a disruption in the financial markets or negative views about the prospects for the financial services industry.
We may lose lower- cost funding sources.
Checking, savings and money market deposit account balances can decrease when customers perceive alternatives such as other financial institutions or investments as providing a better risk/return tradeoff. If customers move money out of bank deposits and into other investments or to other financial institutions, we could lose a relatively low-cost source of funds, thereby increasing our funding costs and reducing our net interest income and net income.
Failure to maintain effective internal and disclosure controls could adversely affect our financial reporting and stock price.
We face the risk that the design of our internal controls and procedures, including those to mitigate the risk of fraud by employees or outsiders, may prove to be inadequate or circumvented, thereby causing delays in detection of errors or inaccuracies. We regularly review and update our internal controls, disclosure controls and procedures, and corporate governance policies. Any system of controls, however well designed and operated, is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met. Any failure or circumvention of our controls and procedures or failure to comply with regulations related to controls and procedures could have a material adverse effect on our business, results of operations and financial condition.
Any failure to maintain effective controls or timely effect any necessary improvements could hinder our ability to accurately report our operating results or cause us to fail to meet our reporting obligations, which could affect our ability to remain listed with The NASDAQ Capital Market. Ineffective internal and disclosure controls could also harm our reputation, negatively impact our operating results or cause investors to lose confidence in our reported financial information, which could have a negative effect on the trading price of our securities.
Changes in the financial markets could impair the value of our investment portfolio.
Our investment securities portfolio represents a significant component of our total earning assets. Market volatility, fluctuations in interest rates, and broader economic uncertainties could adversely affect the market value of our investment portfolio, potentially negatively impacting our net income and capital levels.
As of December 31, 2024, and December 31, 2025, we had unrealized losses, net of taxes, in our investment securities portfolio of $22,915,000 and $14,937,000, respectively. While we maintain sufficient liquidity to support our intent and ability to hold these securities until maturity or market recovery, if future conditions impair our liquidity or alter our intent or ability to hold these investments to maturity, we could incur losses that negatively impact our net income and potentially our capital position.
Our deposit insurance premiums could be substantially higher in the future, which could have a material adverse effect on our future earnings.
The FDIC insures deposits at FDIC-insured depository institutions up to applicable limits. The amount of a particular institution’s deposit insurance assessment is based on that institution’s risk classification under an FDIC risk-based assessment system, which considers the institution’s capital levels and the level of supervisory concern the institution poses to its regulators. Banks are assessed deposit insurance premiums based on the bank’s average consolidated total assets, and the FDIC may modify risk-based adjustments, which increase or decrease a bank’s overall assessment rate.
Table of Contents
Bank failures can significantly deplete the FDIC’s Deposit Insurance Fund and reduce the ratio of reserves to insured deposits. If increases in assessment rates are insufficient for the Deposit Insurance Fund to meet its funding requirements, further special assessments or increases in deposit insurance premiums may be required. We are generally unable to control the amount of premiums that we are required to pay for FDIC insurance. If there are additional bank or financial institution failures, we may be required to pay higher FDIC premiums. Any future additional assessments, increases or required prepayments in FDIC insurance premiums could reduce our profitability or otherwise negatively impact our operations.
Declines in assets under management could adversely affect our investment advisory business.
PWW, our investment advisory business, derives revenue primarily from investment advisory fees based on the market value of assets under management. Assets under management may decline for various reasons including declines in the market value of the assets due to price declines in the securities markets, redemptions and other withdrawals by clients, or termination of contracts in response to adverse market conditions or pursuit of other investment opportunities. If the assets under management decline, the related decrease in fees will negatively affect our results of operations.
We may not be able to attract and retain investment advisory clients.
Our investment advisory business faces strong competition from numerous well-established investment management and wealth advisory firms including commercial banks and trust companies, investment advisory firms, mutual fund companies, stock brokerage firms, and other financial companies. Many of our competitors have greater resources than we have. Our ability to attract and retain investment advisory clients depends upon our ability to compete with competitors’ investment products, level of investment performance, client services, and marketing and distribution capabilities. If we are not successful, our results of operations and financial condition may be negatively impacted.
The investment advisory industry is subject to extensive regulation, and any enforcement action or adverse regulatory changes could decrease our revenues and profitability.
As an investment advisor registered with the Securities and Exchange Commission, PWW is subject to regulation by a number of regulatory agencies. In the event of non-compliance with regulation, governmental regulators, including the SEC and the Financial Industry Regulatory Authority, may institute administrative or judicial proceedings that could result in censure, fines, civil penalties, cease-and-desist orders, deregistration or suspension, or other adverse consequences. The imposition of any such penalties or orders could have a material adverse effect on our operating results and financial condition. New or revised legislation or regulations could also impose additional costs that adversely impact our profitability.
Loss of PWW’s key employees could adversely affect our investment advisory business.
PWW’s success is highly dependent on its executive management team and other key personnel who make investment decisions for PWW clients and manage client relations. Although they are subject to non-compete agreements, there is no assurance that these key personnel will remain employees of PWW.
Competition for investment advisory personnel is intense, and we may not be successful in attracting or retaining qualified personnel. The loss of several key personnel could adversely affect our growth strategy and seriously harm our business, results of operations and financial condition.
Table of Contents
REGULATORY AND LEGAL RISKS
We are subject to extensive regulation that could limit or restrict our activities and adversely affect our profitability.
As a bank holding company, we are primarily regulated by the Federal Reserve. The Bank is primarily regulated by the Virginia Bureau of Financial Institutions and the Federal Reserve. These regulatory authorities have extensive discretion in connection with their supervisory and enforcement activities, including the imposition of restrictions on the operation of a financial institution, the classification of assets and the adequacy of a financial institution’s allowance for credit losses. Any change in such regulation and regulatory oversight, whether in the form of regulatory policy, regulations or legislation, could have a material impact on us and our operations.
Because our business is highly regulated, the applicable laws, rules and regulations are subject to regular modification and change. Laws, rules and regulations may be adopted in the future that could make compliance more difficult or expensive or otherwise adversely affect our business, financial condition or prospects. Such changes may limit our growth and restrict certain of our activities, including payment of dividends, mergers and acquisitions, investments, loans and interest rates charged, interest rates paid on deposits and locations of offices. We are also subject to capital requirements by our regulators. Our compliance with regulatory requirements is costly, and the increased scope, complexity and cost of compliance affect our profitability more than some of our larger competitors.
The laws and regulations applicable to the banking industry could change at any time, and these changes may adversely affect our business and profitability.
Although many provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 have been fully integrated into our operations, ongoing regulatory interpretations, enforcement activities, or amendments to existing regulations may continue to impact our business, financial condition and profitability. While initial implementation costs have stabilized, any future changes in regulatory expectations, especially regarding capital requirements, consumer protection, stress-testing, cybersecurity and liquidity, could result in increased compliance costs, operational complexity and reduced flexibility in managing our business operations. We cannot predict the precise nature, extent or timing of any additional regulatory requirements, but such developments could materially affect our operations, increase operational expenses, reduce profitability, or restrict our ability to pursue strategic opportunities or pay dividends.
Consumer financial protection regulations could impact our compliance obligations and business practices.
We are subject to extensive federal and state consumer financial protection laws and regulations governing our lending and deposit activities, including fair lending, UDAAP, privacy and data security, and residential mortgage origination and servicing requirements, which are administered and enforced by multiple regulators, including the Consumer Financial Protection Bureau (“CFPB”) and the federal banking agencies. We originate residential mortgage loans subject to applicable mortgage-related requirements, including the Qualified Mortgage (“QM”) rules. Changes in applicable laws or regulations, supervisory expectations or interpretations, or enforcement priorities, or any failure or alleged failure by us or our third-party service providers to comply with these requirements, could increase compliance and operating costs, restrict or delay our ability to offer certain products or services, require remediation or other payments, and result in litigation, regulatory actions, penalties, or reputational harm, which could materially adversely affect our business, financial condition, and results of operations.
Regulatory capital requirements could adversely affect our operations and profitability.
Under current capital standards, in order to be well-capitalized, the Bank is required to have a common equity Tier 1 capital ratio of 6.5% and a Tier 1 capital ratio of 8.0%. The application of more stringent capital requirements could result in lower returns on invested capital, require the raising of additional capital and result in regulatory actions if we were unable to comply with such requirements. Furthermore, the imposition of liquidity requirements could result in our
Table of Contents
having to lengthen the term of our funding, restructure our business models or increase our holdings of liquid assets. Implementation of changes to asset risk weightings for risk-based capital calculations, items included or deducted in calculating regulatory capital or additional capital conservation buffers could result in management modifying its business strategy and could limit our ability to make distributions, including paying dividends or buying back shares.
Under the community bank leverage ratio framework, depository institutions and depository institution holding companies that have less than $10 billion in total consolidated assets and meet other qualifying criteria, including a leverage ratio of greater than 9 percent, are eligible to opt into the framework. Qualifying community banking organizations that elect to use the community bank leverage ratio framework and that maintain a leverage ratio of greater than 9 percent are considered to have satisfied the generally applicable risk-based and leverage capital requirements. The Bank has chosen not to opt into the community bank leverage ratio framework at this time.
RISKS RELATED TO OUR STOCK
Our ability to pay cash dividends is limited, and we may be unable to pay future dividends even if we desire to do so.
The Company is a legal entity separate and distinct from the Bank and PWW. The Company currently does not have any significant sources of revenue other than cash dividends paid to it by the Bank and PWW. Both the Company and the Bank are subject to laws and regulations that limit the payment of cash dividends, including requirements to maintain capital at or above regulatory minimums. As a bank that is a member of the Federal Reserve System, the Bank must obtain prior written approval for any cash dividend if the total of all dividends declared in any calendar year would exceed the total of its net profits for that year combined with its retained net profits for the preceding two years. PWW’s ability to pay dividends is likewise subject to certain limits imposed by state law.
Banking regulators have indicated that Virginia banking organizations should generally pay dividends only from net undivided profits and if the prospective rate of earnings retention appears consistent with the organization’s capital needs, asset quality and overall financial condition. In addition, the Federal Deposit Insurance Act prohibits insured depository institutions from making capital distributions, including the payment of dividends, if, after making such distribution, the institution would become undercapitalized. Moreover, the Federal Reserve is authorized to determine under certain circumstances relating to the financial condition of a bank that the payment of dividends would be an unsafe and unsound practice and to prohibit payment thereof. The Federal Reserve has indicated that banking organizations generally pay dividends only out of current operating earnings. The Bank may be prohibited under Virginia law from the payment of dividends if the Virginia Bureau of Financial Institutions determines that a limitation of dividends is in the public interest and is necessary to help ensure the Bank’s financial soundness.
In addition, the Bank’s ability to pay dividends will be limited if the Bank does not have the capital conservation buffer required by the capital rules, which may limit the Company’s ability to pay dividends to stockholders.
If the Bank is not permitted to pay cash dividends to the Company, it is unlikely that the Company would be able to pay cash dividends on our common stock. Moreover, holders of our common stock are entitled to receive dividends only when and if declared by our board of directors. Although we currently pay cash dividends on our common stock, we are not required to do so and our board of directors could reduce or eliminate the amount of our common stock dividends in the future.
A limited market exists for our common stock.
Our common stock commenced trading on The NASDAQ Capital Market on January 25, 2012, and trading volumes have been relatively low compared to larger financial services companies. The limited trading market for our common stock may cause fluctuations in the market value of our common stock to be exaggerated, leading to price volatility in excess of that which would occur in a more active trading market. Accordingly, holders of our common stock
Table of Contents
may have difficulty selling our common stock at prices they find acceptable or which accurately reflect the value of the Company.
Future offerings of debt or other securities may adversely affect the market price of our stock.
In the future, we may attempt to increase our capital resources or, if our or the Bank’s capital ratios fall below the required minimums, we or the Bank could be forced to raise additional capital by making additional offerings of debt or preferred equity securities, including medium-term notes, trust preferred securities, senior or subordinated notes and preferred stock. Upon liquidation, holders of any debt securities and shares of preferred stock and lenders with respect to other borrowings will receive distributions of our available assets prior to the holders of our common stock.
Our stockholders may experience dilution due to issuances of additional securities.
We may in the future issue additional shares of our common stock to raise cash for operations or to fund acquisitions, to provide equity-based incentives to our management and employees, to permit our stockholders to invest cash dividends and optional cash payments in shares of our common stock, or as consideration in acquisition transactions. Additional equity offerings and issuances of additional shares of our common stock may dilute the holdings of our existing stockholders or reduce the market price of our common stock, or both. Holders of our common stock are not entitled to preemptive rights or other protections against dilution.
Virginia law and the provisions of our articles of incorporation and bylaws could deter or prevent takeover attempts.
Our articles of incorporation and bylaws contain provisions that may discourage or delay uninvited attempts by third parties to gain control of us. These provisions include the division of our board of directors into classes with staggered terms, the ability of our board of directors to set the price, terms and rights of, and to issue, one or more series of our preferred stock, and the ability of our board of directors, in evaluating a proposed business combination or other fundamental change transaction, to consider the effect of the business combination on us and our stockholders, employees, customers and the communities we serve. Similarly, the Virginia Stock Corporation Act contains provisions designed to protect Virginia corporations and employees from the adverse effects of hostile corporate takeovers. These provisions reduce the possibility that a third party could effect a change in control without the support of our incumbent directors. These provisions may also strengthen the position of current management by restricting the ability of stockholders to change the composition of the board of directors, to affect its policies.
Item 1B. Unresolved Staff Comm ents
None.
Item 1C. Cybersecu rity
As a publicly-traded financial institution, we are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations and reputation, including, but not limited to, cyber-attacks against us or our service providers focused on gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data or causing operational disruption. As described below, we have risk management and governance practices and processes designed to address these risks.
The Company has established an enterprise risk management framework that outlines the processes and procedures the Company uses to identify, assess, mitigate, and monitor the risks faced by the Company, including cybersecurity risk. Within the overarching enterprise risk management framework, we maintain an information security program (“ISP”) designed to preserve the confidentiality, integrity, and availability of information or data on our systems and those of our service providers, as documented in our information security policy. The ISP encompasses the Company’s cybersecurity policies and practices and procedures that we use to identify, assess, mitigate, and monitor
Table of Contents
cybersecurity risks. The ISP follows relevant industry frameworks and standards set by the relevant legal and regulatory authorities and has been updated to align with the NIST Cybersecurity Framework 2.0.
As part of the ISP, the Company has a Cybersecurity Incident Response Plan (“CIRP”) and Incident Response Team (“IRT”). The IRT includes members of executive and senior management and other employees, including representatives from audit, compliance, human resources, finance, credit, information technology, information security, and legal. The IRT manages how incidents are defined, identified, and classified and ensures that procedures are in place to properly escalate, report and respond to incidents, as they are defined in the policy. The CIRP covers incident preparation, detection, analysis, and declaration, as well as plan execution and process guides for specific scenarios. Post incident activity, which covers incident termination, metrics, lessons learned, evidence retention, and plan maintenance is also included.
The Company maintains ongoing cybersecurity awareness training programs for employees to help prevent social engineering, phishing attacks, and other cyber threats. Additionally, the Company maintains cybersecurity insurance coverage as part of its overall risk mitigation strategy.
The Board is responsible for the oversight of cybersecurity risk management. In 2022, we elevated the Enterprise Risk Committee to a “committee of the whole” of the Bank’s board of directors. At the second board meeting of each calendar quarter, a significant portion of the meeting is dedicated to enterprise risk management. At that board meeting, management presents the enterprise risk management matrix, including the portions related to cybersecurity, to the board. In addition, the board receives regular reports from management on our cybersecurity threat risk management and strategic processes on topics including information on any cybersecurity incidents (including any remedial actions), including, for example, results of our EDR and XDR programs.
At the management level, the Company has designated an information security officer (“ISO”). Our ISO is responsible for the overall administration and execution of the ISP and reports to our EVP-CFO. Our ISO has over twenty years of experience working in information security. The ISO monitors the security of, among other things, systems, applications, tools, databases, computers, websites, cloud infrastructure, vendor tools, and user access systems. The ISO also works with and oversees third-party vendors that provide us with information security services and products. The ISO performs an annual information security risk assessment, which, among other things, documents inherent risk levels and controls in place to manage those risks. The information security risk assessment is presented to the Board annually. The ISO has various professional certifications in relevant fields. The ISO is responsible for administering and executing the ISP and formulating a risk-based approach for evaluating and managing technology and cybersecurity threats.
Management determines and prioritizes appropriate risk responses for each identified enterprise risk. In doing so, executive and senior management work directly with our information technology team and our ISO. Management is accountable for our day-to-day risk management activities.
We strive to minimize the occurrence of cybersecurity incidents and the risks resulting from such incidents. However, when a cybersecurity incident does occur, the Company has in place an incident response program to guide our assessment of and response to the incident. The ISO coordinates the Company’s response to a cybersecurity incident, including investigating, recording and evaluating any potential, suspected or confirmed incidents involving non-public customer information or Company confidential information.
On a quarterly basis, the ISO reports to executive management and the Board information security risk issues, risk mitigation progress and developments, and information security enhancement initiatives. The ISO also reports the status of information security-related key risk indicators to executive management.
The Company employs third parties in certain aspects of its information security and cybersecurity risk management. For example, we engage third parties to assess the information security risks related to our ISP as well as information security products, services, and security infrastructure. We have adopted a Third -Party Relationship Risk Management Program to help us effectively assess, measure, monitor and control the risks associated with third party
Table of Contents
relationships, including those related to information security. The board and senior management are responsible for all vendor relationships. The ISO assesses and monitors information risks posed by third parties and any non-compliance with the controls created to address such risks. With respect to cybersecurity incidents affecting our third-party service providers, the ISO works with our service providers to understand and document any incidents, along with managing the impact to us and reporting such incidents to executive management, and, if applicable, the Board. We utilize endpoint detection and response (EDR) and extended detection and response (XDR) platforms which both align to the MITRE ATT&CK® knowledge base for threat modeling and methodologies. These assist us in detecting, investigating, and responding to actual and potential security incidents.
Additionally, the Company utilizes a third-party online brand protection service to identify, analyze, and facilitate the takedown of malicious mobile applications, social media accounts, and websites attempting to impersonate the Bank. While we cannot guarantee that all impersonation attempts will be successfully removed, this continuous monitoring service helps protect our customers and reputation from fraudulent actors.
Based on information known to us, we have not incurred material costs or losses related to cybersecurity incidents. However, like other financial institutions, we have experienced cybersecurity incidents and other technology-related events in the past that resulted in costs and/or operational impacts, and we may experience additional incidents in the future. However, the risk management and governance processes described above may not be sufficient to prevent cybersecurity incidents, and we could incur substantial costs and suffer other negative consequences from cybersecurity incidents. We can give no assurance that we have detected or protected against all cybersecurity threats or incidents. Please refer to “ Emerging Technological Threats ” included “Item 1A, Risk Factors” of this Annual Report on Form 10-K for additional information about material risks related to cybersecurity .
Item 2. Properti es
Current Locations and Property
Depending on such factors as cost, availability, and location, we may either lease or purchase our operating facilities. The existing facilities that we have purchased typically have been former branches of other financial institutions. As of March 25, 2026 the Bank conducts its operations from 23 locations, of which we own 15 and lease 8. In addition, PWW operates from 1925 Atherholt Road, Lynchburg, Virginia, which it leases from the Bank.
The following table describes the location and general character of the Bank’s primary operating facilities:
Address
Type of Facility
Year Opened
Owned/Leased
5204 Fort Avenue
Lynchburg, Virginia
Full-service branch with drive-through and ATM
Owned
4698 South Amherst Highway
Madison Heights, Virginia
Full-service branch with drive-through and ATM
Owned
17000 Forest Road
Forest, Virginia
Full-service branch with drive-through and ATM
Headquarters for Mortgage Division
Owned
164 South Main Street
Amherst, Virginia
Full-service branch with drive-through and ATM
Owned
1405 Ole Dominion Blvd
Bedford, Virginia
Full-service branch with drive-through and ATM
Owned
1110 Main Street
Altavista, Virginia
Full-service branch with drive-through and ATM
Owned
Table of Contents
828 Main Street
Lynchburg, Virginia
Corporate Headquarters; Full-service branch with drive-through and ATM
Leased (1)
4935 Boonsboro Road, Suites C and D
Lynchburg, Virginia
Full-service branch with drive-through and ATM
Leased (2)
501 VES Road
Lynchburg, Virginia
Limited-service branch
Leased (3)
250 Pantops Mountain Road
Charlottesville, Virginia
Limited-service branch
Leased (4)
1391 South High Street
Harrisonburg, Virginia
Full-service branch with drive-through and ATM
Owned
1745 Confederate Blvd
Appomattox, Virginia
Full-service branch with drive-through and ATM
Owned
225 Merchant Walk Avenue
Charlottesville, Virginia
Full-service branch with drive-through and ATM
Leased (5)
3562 Electric Road
Roanoke, Virginia
Full-service branch with ATM
Leased (6)
800 South Main Street
Blacksburg, Virginia
Mortgage origination office
Leased (7)
550 East Water Street
Suite 100
Charlottesville, Virginia
Full-service branch with ATM
Owned
2101 Electric Road
Roanoke, Virginia
Full-service branch with drive-through and ATM
Leased (8)
45 South Main Street
Lexington, Virginia
Full-service branch with ATM
Owned
13 Village Highway
Rustburg, VA 24588
Full-service branch with drive-through and ATM
Owned
4105 Boonsboro Road
Lynchburg, Virginia
Full-service branch with drive-through and ATM
Owned
20795 Timberlake Road
Lynchburg, Virginia
Full-service branch with drive-through and ATM
Owned
19792 Main Street
Buchanan, Virginia
Full-service branch with drive-through and ATM
Owned
2935 Rockfish Valley Highway
Nellysford, Virginia
Full-service branch with drive-through and ATM
Owned
(1) The current term of the amended and restated lease expires in three years and the Bank has three five-year renewal options (subject to the terms and conditions outlined in the lease). The Bank leases this property from Jamesview Investment, LLC, which is wholly-owned by William C. Bryant III, a member of the Board of Directors of both Financial and the Bank.
Table of Contents
(2) Base lease expires March 31, 2028. We have one or more renewal options that we may exercise at our discretion subject to the terms and conditions outlined in the lease.
(3) Base lease expired May 31, 2025. The Bank currently leases the property on a month-to-month basis.
(4) Base lease expires April 30, 2030. We have one or more renewal options that we may exercise at our discretion subject to the terms and conditions outlined in the lease.
(5) Base lease expires October 31, 2026. We have one or more renewal options that we may exercise at our discretion subject to the terms and conditions outlined in the lease.
(6) Base lease expires January 31, 2027.
(7) Base lease expired February 28, 2021. The Bank currently leases on a month-to-month basis.
(8) Base lease expires February 28, 2029. We have one or more renewal options that we may exercise at our discretion subject to the terms and conditions outlined in the lease.
We believe that each of these operating facilities is maintained in good operating condition and is suitable for our operational needs.
Interest in Additional Properties
1925 Atherholt Road, Lynchburg, Virginia currently serves as the office for the Company’s wholly-owned subsidiary, PWW, which leases the space from the Bank on a month-to-month basis. The property is held for possible future branch expansion, although the Bank does not currently have a timeline for opening a branch at this location.
The Bank also owns two additional properties in its market area, one held for possible future expansion or sale and one under contract for sale, subject to due diligence and other customary closing conditions.
The opening of any additional branches is contingent upon receipt of applicable regulatory approvals.
Item 3. Legal Proceedi ngs
There are no material pending legal proceedings to which the Company is a party or to which the property of the Company is subject.
