BLUE RIDGE BANKSHARES, INC. [BRBS] Filings

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

(Mark One)

For the fiscal year ended December 31, 2022

or

For the transition period from ___________ to ___________

Commission File Number: 001-39165

BLUE RIDGE BANKSHARES, INC.

(Exact Name of Registrant as Specified in its Charter)

(540) 743-6521

Registrant’s Telephone Number, Including Area Code

Former Name, Former Address and Former Fiscal Year, if Changed Since Last Report

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☐ No ☒

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☐

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. □

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). □

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☒

The aggregate market value of voting stock held by non-affiliates of the registrant at June 30, 2022, based on the closing sale price of the registrant’s common stock on June 30, 2022, was approximately $257,678,654.

The registrant had 18,946,466 shares of common stock, no par value per share, outstanding as of March 1, 2023.

DOCUMENTS INCORPORATED BY REFERENCE

PART I

ITEM 1: BUSINESS

General

Blue Ridge Bankshares, Inc. (the “Company” ) is a bank holding company headquartered in Charlottesville, Virginia. It provides commercial and consumer banking and financial services through its wholly-owned bank subsidiary, Blue Ridge Bank, National Association (the “Bank”), and its wealth and trust management subsidiary, BRB Financial Group, Inc. (the “Financial Group”). The Company was incorporated under the laws of the Commonwealth of Virginia in July 1988.

The Bank is a federally chartered national bank with its Main Office in Martinsville, Virginia that traces its roots to Page Valley Bank of Virginia, which opened for business in 1893. At December 31, 2022, the Bank operated twenty-seven full-service banking offices across its footprint, which stretches from the Shenandoah Valley across the Piedmont region through Richmond and into the coastal peninsulas and Hampton Roads region of Virginia and central North Carolina.

The Bank serves businesses, professionals, consumers, nonprofits, and municipalities with a wide variety of financial services, including retail and commercial banking, mortgage banking, government guaranteed lending, and employee benefit plans. Banking products include checking accounts, savings accounts, money market accounts, cash management accounts, certificates of deposit, individual retirement accounts, commercial and industrial loans, residential mortgages, commercial mortgages, home equity loans, consumer installment loans, credit cards, online banking, telephone banking, and mobile banking. Deposits of the Bank are insured by the Deposit Insurance Fund (the “DIF”) of the Federal Deposit Insurance Corporation (“FDIC”) to the full extent of the limits of the DIF.

As of December 31, 2022, the Company had total assets of approximately $3.14 billion, total gross loans of approximately $2.48 billion, total deposits of approximately $2.50 billion, and stockholders’ equity of approximately $259.4 million.

On January 31, 2021, the Company completed a merger with Bay Banks of Virginia, Inc. (“Bay Banks”), a bank holding company conducting substantially all its operations through its subsidiaries Virginia Commonwealth Bank and VCB Financial Group, Inc. Immediately following the Company’s merger with Bay Banks, Virginia Commonwealth Bank was merged with and into the Bank, while VCB Financial Group, Inc., subsequently renamed BRB Financial Group, Inc., became a subsidiary of the Company (collectively, the “Bay Banks Merger”). Pursuant to the terms of the Bay Banks Merger agreement, each share of Bay Banks common stock was converted into the right to receive 0.50 shares of the Company’s common stock plus cash in lieu of fractional shares. In the merger, the Company issued 6,627,558 shares of its common stock and paid $3.4 thousand in lieu of fractional shares. The Bay Banks Merger added $1.22 billion in assets and $1.03 billion in deposits and expanded the Bank’s operating footprint east through the greater Richmond region, the Northern Neck region, Middlesex County, and the Hampton Roads region of Virginia.

The Company, through the Financial Group, offers management services for personal and corporate trusts, including estate planning, estate settlement and trust administration, insurance products, and investment and wealth management. Employment benefit services are offered under the trade name BluePoint Benefits. The Company, through its minority investment in Hammond Insurance Agency, Incorporated (“Hammond Insurance”), offers property and casualty insurance to individuals and businesses. The Bank’s mortgage banking activities include a retail mortgage business operating as Monarch Mortgage and a wholesale mortgage business operating as LenderSelect Mortgage Group (“LenderSelect”). LenderSelect offers wholesale and third-party residential mortgage origination services to other financial institutions and credit unions.

The Company has partnerships with financial technology (fintech) providers and ended 2022 with active partnerships including Unit Finance, Flexible Finance, Increase, Upgrade, Kashable, Jaris, Grow Credit, MentorWorks, and Marlette. Fintech companies provide technologies to enable the delivery of digital bank services, which generate interest income, fees, and deposits and increase the Bank’s customer reach beyond its traditional branch footprint. Two of the Company's fintech relationships provide the Bank access to other fintech companies and vastly expand the Bank’s customer reach.

As a bank holding company incorporated under the laws of the Commonwealth of Virginia, the Company is subject to regulation by the Board of Governors of the Federal Reserve System (the “Federal Reserve”) and the Bureau of Financial Institutions of the Virginia State Corporation Commission (the “Virginia SCC”). The Bank’s primary federal regulator is the Office of the Comptroller of the Currency (the “OCC”).

1

The Bank’s primary source of revenue is interest income from its lending activities. The Bank’s other major sources of revenue are interest and dividend income from investments, interest income from its interest-earning deposit balances in other depository institutions, mortgage banking income, gains on sales of government-guaranteed loans, transactions and fee income from its lending and deposit activities, including fintech, and income associated with wealth and trust management services. The Bank’s major expenses are interest on deposits and general and administrative expenses, such as employee salaries and benefits, federal deposit insurance premiums, data processing expenses, technology costs, and office occupancy expenses.

On August 29, 2022, the Bank entered into a formal written agreement (the “Written Agreement”) with the OCC. The Written Agreement principally concerns the Bank’s fintech line of business and requires the Bank to continue enhancing its controls for assessing and managing the third-party, Bank Secrecy Act/Anti-Money Laundering, and information technology risks stemming from its fintech partnerships. A complete copy of the Written Agreement was furnished in a Form 8-K filed with the Securities and Exchange Commission (“SEC”) on September 1, 2022 and can be accessed on the SEC’s website (www.sec.gov) and the Company’s website (www.blueridgebankshares.com). The Company is actively working to bring the Bank’s fintech policies, procedures, and operations into conformity with OCC directives and believes its work to date has been delivered on schedule.

On December 15, 2019, the Company completed its acquisition of Virginia Community Bankshares, Inc. (“VCB”), the bank holding company of Virginia Community Bank based in Louisa, Virginia. Immediately following the merger, Virginia Community Bank, merged with and into the Bank. Pursuant to the acquisition, the Company acquired total assets of approximately $242.5 million and assumed total liabilities of approximately $219.2 million. In the merger, the Company issued 1,312,919 shares of its common stock and made cash payments to VCB shareholders totaling $16.6 million in the aggregate.

In the first quarter of 2022, the Bank sold its majority interest in MoneyWise Payroll Solutions, Inc., to the holder of the minority interest.

The principal executive offices of the Company are located at 1807 Seminole Trail, Charlottesville, Virginia 22901, and its telephone number is (540) 743-6521.

The Company files annual, quarterly and current reports, proxy statements and other information with the SEC. The Company’s SEC filings are filed electronically and are available to the public over the Internet at the SEC’s website at http://www.sec.gov. The Company’s website can be accessed at https://www.blueridgebankshares.com. The Company makes its SEC filings available free of charge through this website under “Investor Relations,” “Financial Documents,” “Documents” as soon as practicable after filing or furnishing the material to the SEC. Copies of documents can also be obtained free of charge by writing to the Company’s Corporate Secretary at P.O. Box 609, 17 West Main Street, Luray, Virginia 22835, or by calling (540) 743-6521. Information on the Company’s website does not constitute part of, and is not incorporated into, this report or any other filing the Company makes with the SEC.

The Company qualifies as an “emerging growth company”, as defined in federal securities laws. For as long as it continues to be an emerging growth company, the Company may take advantage of exemptions from various reporting requirements that are applicable to other public companies that are not emerging growth companies, including not being required to comply with the auditor attestation requirements of Section 404(b) of the Sarbanes-Oxley Act, reduced disclosure obligations regarding executive compensation in periodic reports and proxy statements, and exemptions from the requirements of holding a nonbinding advisory vote on executive compensation and stockholder approval of any golden parachute payments not previously approved. In addition, as an emerging growth company, the Company has elected to take advantage of the extended transition period for complying with new or revised accounting standards until those standards would otherwise apply to a company that is not an issuer (as defined under Section 2(a) of the Sarbanes-Oxley Act), if such standards apply to companies that are not issuers. This may make the Company’s financial statements not comparable with other public companies that are not emerging growth companies or that are emerging growth companies that have opted out of the extended transition period because of the potential differences in accounting standards used. The Company may be an emerging growth company for up to five years, although that status is lost sooner if gross revenues exceed $1.235 billion, if it issues more than $1.0 billion in non-convertible debt in a three-year period, or if the market value of common stock held by non-affiliates exceeds $700 million as of any June 30 before that time, in which case the Company would no longer be an emerging growth company as of the following December 31.

Market Area

The Bank currently has branches in Callao, Charlottesville, Chester, Colonial Heights, Culpeper, Fredericksburg, Gordonsville, Harrisonburg, Hartfield, Henrico, Kilmarnock, Louisa, Luray, Martinsville, Midlothian, Mineral, Montross,

2

Orange, Petersburg, Richmond, Shenandoah, Suffolk, Virginia Beach, Warsaw, and White Stone, Virginia, and in Greensboro, North Carolina. Interstates 40, 64, 66, 73, 74, 81, 85, and 95 and ancillary major highways pass through the Bank’s trade area and provide efficient access to other regions of Virginia, North Carolina, and beyond. The Company’s primary market area stretches from the Shenandoah Valley across the Piedmont region through Richmond and into the coastal peninsulas and Hampton Roads region of Virginia and central North Carolina. The Company’s retail mortgage operations are primarily in the Mid-Atlantic and Southern regions of the United States, while the Company's wholesale mortgage operations are nationwide. The Company’s guaranteed government lending and fintech markets span across the United States.

Products and Services

Mortgage Loans on Real Estate. The Company’s mortgage loans on real estate comprise the largest segment of its loan portfolio. Mortgage loans on real estate include family residential properties, 1-4 family investment properties, home equity loans, commercial properties, and owner-occupied commercial properties. The Company also makes loans on properties under construction to qualified individuals and builders. These loans are generally for the construction period only and funds are disbursed as construction progresses and verified by the Company. Loans are for varying terms and may be at fixed or adjustable interest rates.

Residential Mortgage Loans. Residential mortgages are underwritten and documented within regulatory guidelines. The Company offers residential loan origination with such loans either sold in the secondary market or held by the Bank. Home mortgages are generally underwritten in accordance with the guidelines of agencies including the Federal Home Loan Mortgage Corporation (“Freddie Mac”), Federal National Mortgage Association (“Fannie Mae”), and Government National Mortgage Association (“Ginnie Mae”). These loans are then sold into the secondary market on a loan-by-loan basis, usually directly to Freddie Mac, Fannie Mae, and Ginnie Mae. The Bank earns origination fees and a premium on servicing rights, if the loans are sold with servicing retained.

Commercial Real Estate Loans. Loans in this category include loans on real estate used for commercial purposes. Loans in this segment are underwritten to mitigate declines in real estate values, changes in the underlying cash flows from the properties, and general economic conditions.

Commercial and Industrial Loans. Commercial lending activities of the Company include business loans, asset-based loans, and other secured and unsecured loans and lines of credit. Commercial and industrial loans may entail greater risk than residential mortgage loans, and therefore are underwritten with strict risk management standards. During 2022, the Company added a team focused on commercial and industrial lending to middle market businesses, which are those businesses generally with revenues of at least $25 million. Among the criteria for determining the borrower’s ability to repay is a cash flow analysis of the business and business collateral.

Guaranteed Government Loans. Loans in this category provide customers access to capital that avoid many of the challenges of conventional commercial lending. Loans are generally underwritten pursuant to U.S. Small Business Administration (“SBA”) or U.S. Department of Agriculture (“USDA”) guidelines and afford the Company guarantees under these programs. The guaranteed portion of government guaranteed loans may be sold, in whole or in part, to secondary market buyers.

Consumer Loans. The Company’s consumer lending services include automobile lending, home equity lines of credit, credit cards, and other unsecured personal loans. These consumer loans historically entail greater risk than loans secured by real estate.

Consumer Deposit Services. Consumer deposit products offered by the Company include checking accounts, savings accounts, money market accounts, certificates of deposit, online banking, mobile banking, and electronic statements.

Commercial Banking Services. The Company offers a variety of services to commercial customers, including analysis checking, cash management deposit accounts, wire services, direct deposit payroll service, online banking, telephone banking, remote deposit, and a full line of commercial lending options. The Company also offers property and casualty insurance and employee benefit plans and administration.

Wealth and Trust Services. The Company, through the Financial Group, offers management services for personal and corporate trusts, including estate planning, estate settlement and trust administration, insurance products, and investment and wealth management.

Banking as a Service. The Company, through the Bank, provides banking as a service (“BaaS”) to its fintech partners. BaaS is a model that provides products and banking services to nonbank fintech partners, which are, in turn, offered to a broad base of consumers and small businesses through internet-enabled connections. The Company refers to BaaS as an

3

offering to those fintech partners that generate deposits and provide payment services. The Company also partners with certain of the fintech providers that accommodate lending programs, both consumer and small business.

Competition

The financial services industry is highly competitive. The Company competes for loans, deposits, and financial services directly with other bank and nonbank institutions, including credit unions, located within its markets, internet-based banks, out-of-market banks, fintech companies, and bank holding companies that advertise in or otherwise serve its markets, along with money market and mutual funds, brokerage houses, mortgage companies, and insurance companies or other commercial entities that offer financial services products. Competition involves efforts to retain current customers and to obtain new loans and deposits, and differentiators include the scope and type of services offered, interest rates paid on deposits and charged on loans, and the customer service experience. Many of the Company’s competitors enjoy competitive advantages, including greater financial resources, a wider geographic presence, more accessible branch office locations, greater technology, the ability to offer additional services, more favorable pricing alternatives and lower origination and operating costs. The Company believes that its competitive pricing, personalized service, and community involvement enable it to effectively compete in the communities in which it operates.

Environmental, Social and Governance

The Company is committed to promoting sound Environmental, Social and Governance (“ESG”) practices through strong board of directors and management oversight. Management believes ESG initiatives are important to its customers, its employees, its shareholders, and the communities it serves.

Environmental. During 2021, the Company began its initiative to contribute to curtailing the impacts of global climate change. The Company, through the Bank, joined the Net-Zero Banking Alliance ("NZBA"), a United Nations convened and industry-led initiative to lead practices and accountability in carbon reduction plans. The Bank will align its operations and its lending and investment portfolios to achieve net-zero emissions by 2040, while achieving intermediate performance targets by 2030. The Bank has installed electric vehicle charging stations at two of its branch locations and is reviewing other locations for accessibility and utilization. In April 2022, the Company announced an initiative to eliminate single-use plastic items within its business offices by the end of 2024 in conjunction with an effort to boost recycling efforts internally. The Company has a number of initiatives that are in various stages of study for feasibility.

Social. The Company’s board of directors and management are committed to employing a diverse workforce and the Company has developed plans, and continues to develop plans, and metrics against which actions will be measured. For example, the Company plans to adopt a diversity, equity, and inclusion plan in 2023.

As further discussed in the Supervision and Regulation section below, the Bank is subject to the Community Reinvestment Act (the "CRA"), under which the appropriate federal banking agency periodically assesses the Bank’s record in meeting the credit needs of the communities it serves, including low and moderate income neighborhoods. The Bank has a designated CRA officer who monitors the Bank’s compliance under the CRA.

Governance. The Company operates under a strong governance structure, starting with the chairman of the board of directors that is independent from management. Members of the board of directors routinely undergo evaluations to assess their effectiveness. Employees operate under policies approved by the Company’s or the Bank’s board of directors and complete as many as 33 courses per year, covering topics such as preventing harassment, confidentiality of data, and unfair banking practices.

Human Capital Resources

The success of the Company is directly attributable to its exceptional and dedicated team of employees. Management focuses on designing compensation, incentive, and benefit programs to ensure that the Company is competitive in attracting and retaining top talent in the market, while emphasizing the importance of diversity, equity, and inclusion. Management believes that the Company's compensation programs offer competitive pay and benefits, including paid time off for vacations and sick leave, a 401(k) plan, health, dental, and vision plans, life and disability coverage, wellness plans, paid training, including tuition reimbursement, and pre-tax flexible spending accounts. In February 2023, the Company announced a sabbatical leave program to promote the benefits of work-life balance in conjunction with rewarding longevity. The Company is committed to maintaining a living wage for all its employees, raising the minimum pay rate in 2021 to $17 per hour, and then raising it to $18 per hour in February 2023. Management believes that fostering an environment that values diversity, equity, and inclusion creates an organization that is able to embrace, leverage, and respect differences amongst the

4

Company's employees and customers. Management believes that such an environment results in improved employee morale and higher levels of job satisfaction, which ultimately translates into a better customer experience.

Management also believes in giving back to the communities in which the Company serves. In 2022, the Company committed approximately $440 thousand of financial donations to many community organizations and nonprofits, including first responders, colleges and universities, youth athletics, and the arts. In addition, the Company's employees donate countless hours volunteering in business associations and helping the underserved.

The Company had 496 full-time and 39 part-time employees as of December 31, 2022. None of its employees are represented by any collective bargaining unit and the Company believes that relations with its employees are good.

Supervision and Regulation

The Company and the Bank are extensively regulated under federal and state law. The following information describes certain aspects of that regulation applicable to the Company and the Bank and does not purport to be complete. Proposals to change the laws, regulations, and policies governing the banking industry are frequently raised in the U.S. Congress, in state legislatures, and before the various bank regulatory agencies. The likelihood and timing of any changes and the impact such changes might have on the Company and the Bank are impossible to determine with any certainty. A change in applicable laws, regulations or policies, or a change in the way such laws, regulations, or policies are interpreted by regulatory agencies or courts, may have a material impact on the business, operations, and earnings of the Company and the Bank.

The Bank is subject to the Written Agreement, which principally concerns the Bank’s fintech line of business and requires the Bank to continue enhancing its controls for assessing and managing the third-party, Bank Secrecy Act/Anti-Money Laundering, and information technology risks stemming from its fintech partnerships. A complete copy of the Written Agreement was furnished in a Form 8-K filed with the SEC on September 1, 2022 and can be accessed on the SEC’s website (www.sec.gov) and the Company’s website (www.blueridgebankshares.com). The Company is actively working to bring the Bank’s fintech policies, procedures, and operations into conformity with OCC directives and believes its work to date has been delivered on schedule.

As with other financial institutions, the earnings of the Bank are affected by general economic conditions and by the monetary policies of the Federal Reserve. The Federal Reserve exerts a substantial influence on interest rates and credit conditions, primarily through open market operations in U.S. Government securities, setting the reserve requirements of member banks, and establishing the discount rate on member bank borrowings. The policies of the Federal Reserve have a direct impact on loan and deposit growth and the interest rates charged and paid thereon. They also impact the source, cost of funds, and the rates of return on investments. Changes in the Federal Reserve’s monetary policies have had a significant impact on the operating results of the Bank and other financial institutions and are expected to continue to do so in the future.

Blue Ridge Bankshares, Inc.

The Company is qualified as a bank holding company within the meaning of the Bank Holding Company Act of 1956, as amended (the “BHC Act”), and is registered as such with the Federal Reserve. As a bank holding company, the Company is subject to supervision, regulation, and examination by the Federal Reserve and is required to file various reports and additional information with the Federal Reserve. The Company is also registered under the bank holding company laws of Virginia and is subject to supervision, regulations, and examination by the Virginia SCC.

Under the Gramm-Leach-Bliley Act of 1999 (the “GLB Act”), a bank holding company may elect to become a financial holding company and thereby engage in a broader range of financial and other activities than are permissible for traditional bank holding companies. In order to qualify for the election, all of the depository institution subsidiaries of the bank holding company must be well capitalized, well managed, and have achieved a rating of “satisfactory” or better under the CRA. Financial holding companies are permitted to engage in activities that are “financial in nature” or incidental or complementary thereto as determined by the Federal Reserve. The GLB Act identifies several activities as “financial in nature,” including insurance underwriting and sales, investment advisory services, merchant banking and underwriting, and dealing or making a market in securities. The Company has not elected to become a financial holding company and has no immediate plans to become a financial holding company.

Blue Ridge Bank, National Association

The Bank is a federally chartered national bank. The Bank is subject to supervision, regulation, and examination by the OCC and is required to file various reports and additional information with the OCC. The OCC has primary supervisory and

5

regulatory authority over the operations of the Bank. Because the Bank accepts insured deposits from the public, it is also subject to examination by the FDIC.

Depository institutions, including the Bank, are subject to extensive federal and state regulations that significantly affect their businesses and activities. Regulatory bodies have broad authority to implement standards and initiate proceedings designed to prohibit depository institutions from engaging in unsafe and unsound banking practices. The standards relate generally to operations and management, asset quality, interest rate exposure, and capital. The bank regulatory agencies are authorized to take action against institutions that fail to meet such standards.

The Dodd-Frank Act

The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”), signed into law in July 2010, significantly restructured the financial regulatory regime in the United States and has had a broad impact on the financial services industry as a result of the significant regulatory and compliance changes required under the act.

The Economic Growth, Regulatory Relief and Consumer Protection Act of 2018 (the “EGRRCPA”), which became effective May 24, 2018, amended the Dodd-Frank Act to provide regulatory relief for certain smaller and regional financial institutions, such as the Company and the Bank. The EGRRCPA, among other things, provides financial institutions with less than $10 billion in total consolidated assets with relief from certain capital requirements and exempts banks with less than $250 billion in total consolidated assets from the enhanced prudential standards and the company-run and supervisory stress tests required under the Dodd-Frank Act. The Dodd-Frank Act has had, and may in the future have, a material impact on the Company’s operations, particularly through increased compliance costs resulting from new and possible future consumer and fair lending regulations. The future changes resulting from the Dodd-Frank Act may affect the profitability of business activities, require changes to certain business practices, impose more stringent regulatory requirements, or otherwise adversely affect the business and financial condition of the Company and the Bank. These changes may also require the Company to invest significant management attention and resources to evaluate and make necessary changes to comply with new statutory and regulatory requirements.

Deposit Insurance

The deposits of the Bank are insured up to applicable limits by the DIF and are subject to deposit insurance assessments to maintain the DIF. The deposit insurance assessment base is based on average total assets minus average tangible equity, pursuant to a rule issued by the FDIC as required by the Dodd-Frank Act. Deposit insurance pricing is a “financial ratios method” based on “CAMELS” composite ratings to determine assessment rates for small established institutions with less than $10 billion in assets. The CAMELS rating system is a supervisory rating system designed to take into account and reflect all financial and operational risks that a bank may face, including capital adequacy, asset quality, management capability, earnings, liquidity, and sensitivity to market risk (“CAMELS”).

On October 18, 2022, the FDIC adopted a final rule to increase base deposit insurance assessment rate schedules uniformly by 2 basis points beginning in the first quarterly assessment period of 2023. The increase is being instituted to account for extraordinary growth in insured deposits during the first and second quarters of 2020, which caused a substantial decrease in the “reserve ratio” of the DIF to total industry deposits. The FDIC has indicated that the new assessment rate schedules will remain in effect until the DIF reserve ratio meets or exceeds 2 percent. In the years ended December 31, 2022 and 2021, the Company recorded expense of $1.3 million and $1.0 million, respectively, for FDIC insurance premiums.

Capital Requirements

The Federal Reserve, the OCC, and the FDIC have issued substantially similar capital requirements applicable to all banks and bank holding companies. In addition, those regulatory agencies may from time to time require that a banking organization maintain capital above the minimum levels because of its financial condition or actual or anticipated growth.

The Bank is subject to the rules implementing the Basel III capital framework and certain related provisions of the Dodd-Frank Act (the “Basel III Capital Rules”). The Basel III Capital Rules, effective January 1, 2015, require the Company and the Bank to comply with the following minimum capital ratios: (i) a ratio of common equity Tier 1 to risk-weighted assets of at least 4.5%, plus a 2.5% “capital conservation buffer” (effectively resulting in a minimum ratio of common equity Tier 1 to risk-weighted assets of 7%), (ii) a ratio of Tier 1 capital to risk-weighted assets of at least 6.0%, plus the 2.5% capital conservation buffer (effectively resulting in a minimum Tier 1 capital ratio of 8.5%), (iii) a ratio of total capital to risk-weighted assets of at least 8.0%, plus the 2.5% capital conservation buffer (effectively resulting in a minimum total capital ratio of 10.5%), and (iv) a leverage ratio of 4%, calculated as the ratio of Tier 1 capital to average assets ("Tier 1 Leverage

6

ratio"). The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of common equity Tier 1 to risk-weighted assets above the minimum but below the conservation buffer face constraints on dividends, equity repurchases, and compensation, based on the amount of the shortfall. The common equity Tier 1 capital ratio was 10.25% for the Bank as of December 31, 2022. The Tier 1 and total capital to risk-weighted asset ratios of the Bank were 10.25% and 11.15%, respectively, as of December 31, 2022. The Tier 1 Leverage ratio for the Bank was 9.25% as of December 31, 2022.

With respect to the Bank, the “prompt corrective action” regulations pursuant to Section 38 of the FDI Act incorporate a common equity Tier 1 capital ratio and increase certain other capital ratios. To be well capitalized under these regulations, a bank must have the following minimum capital ratios: (i) a common equity Tier 1 capital ratio of at least 6.5%; (ii) a Tier 1 capital to risk-weighted assets ratio of at least 8.0%; (iii) a total capital to risk-weighted assets ratio of at least 10.0%; and (iv) a Tier 1 Leverage ratio of at least 5.0%. The Bank exceeded the thresholds to be considered well capitalized as of December 31, 2022.

Under the Basel III Capital Rules, banks must hold a capital conservation buffer above the adequately capitalized risk-based capital ratios of 2.50% for all ratios, except the tier 1 leverage ratio. If a banking organization dips into its capital conservation buffer, it is subject to limitations on certain activities, including payment of dividends, share repurchases, and discretionary compensation to certain officers. Management believes, as of December 31, 2022, the Bank met all capital adequacy requirements to which it is subject.

In December 2017, the Basel Committee on Banking Supervision published standards that it described as the finalization of the Basel III post-crisis regulatory reforms (the standards are commonly referred to as “Basel IV”). Among other things, these standards revise the standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain “unconditionally cancellable commitments,” such as unused credit card lines of credit) and provide a new standardized approach for operational risk capital. Under the proposed framework, these standards are effective on January 1, 2023, with an aggregate output floor phasing-in through January 1, 2027. Under the current capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not to the Company. The impact of Basel IV on the Company and the Bank will depend on the manner in which it is implemented by the federal bank regulatory agencies.

In August 2018, the Federal Reserve issued an interim final rule required by the EGRRCPA that expands the applicability of the Federal Reserve’s Small Bank Holding Company Policy Statement (the “SBHC Policy Statement”) to bank holding companies with total consolidated assets of less than $3 billion (up from the prior $1 billion threshold). The annual measurement date to determine if a bank holding company's total assets meets the $3 billion threshold is June 30. Under the SBHC Policy Statement, qualifying bank holding companies have additional flexibility in the amount of debt they can issue and are also exempt from the Basel III Capital Rules (subsidiary depository institutions of qualifying bank holding companies are still subject to capital requirements). As of June 30, 2022, the most recent annual measurement date, the Company had less than $3 billion in total consolidated assets and would likely qualify under the revised SBHC Policy Statement. However, the Company does not currently intend to issue a material amount of debt or take any other action that would cause its capital ratios to fall below the minimum ratios required by the Basel III Capital Rules.

In September 2019, the federal banking agencies jointly issued a final rule required by the EGRRCPA that permits qualifying banks and bank holding companies that have less than $10 billion in consolidated assets to elect to be subject to a 9% leverage ratio that would be applied using less complex leverage calculations (commonly referred to as the community bank leverage ratio or “CBLR”). Under the rule, which became effective on January 1, 2020, banks and bank holding companies that opt into the CBLR framework and maintain a CBLR of greater than 9% are not subject to other risk-based and leverage capital requirements under the Basel III Capital Rules and would be deemed to have met the well capitalized ratio requirements under the “prompt corrective action” framework. These CBLR rules were modified in response to the COVID-19 pandemic. See “Coronavirus Aid, Relief, and Economic Security Act and Consolidated Appropriations Act, 2021” below. The Company has not opted into the CBLR framework.

Dividends

The Company’s principal source of cash flow, including cash flow to pay dividends to its shareholders, is dividends it receives from the Bank. Statutory and regulatory limitations apply to the Bank’s payment of dividends to the Company. As a general rule, the amount of a dividend may not exceed, without prior regulatory approval, the sum of net income in the calendar year to date and the retained net earnings of the immediately preceding two calendar years. A depository institution may not pay any dividend if payment would cause the institution to become “undercapitalized” or if it already is “undercapitalized.” The OCC may prevent the payment of a dividend if it determines that the payment would be an unsafe

7

and unsound banking practice. The OCC also has advised that a national bank should generally pay dividends only out of current operating earnings. In addition, under the current supervisory practices of the Federal Reserve, the Company should inform and consult with the Federal Reserve reasonably in advance of declaring or paying a dividend that exceeds earnings for the period (e.g., quarter) for which the dividend is being paid or that could result in a material adverse change to the Company’s capital structure.

Permitted Activities

As a bank holding company, the Company is limited to managing or controlling banks, furnishing services to or performing services for its subsidiaries, and engaging in other activities that the Federal Reserve determines by regulation or order to be so closely related to banking or managing or controlling banks as to be a proper incident thereto. In determining whether a particular activity is permissible, the Federal Reserve must consider whether the performance of such an activity reasonably can be expected to produce benefits to the public that outweigh possible adverse effects. Possible benefits include greater convenience, increased competition, and gains in efficiency. Possible adverse effects include undue concentration of resources, decreased or unfair competition, conflicts of interest, and unsound banking practices. Despite prior approval, the Federal Reserve may order a bank holding company or its subsidiaries to terminate any activity or to terminate ownership or control of any subsidiary when the Federal Reserve has reasonable cause to believe that a serious risk to the financial safety, soundness, or stability of any bank subsidiary of that bank holding company may result from such an activity.

Banking Acquisitions; Changes in Control

The BHC Act requires, among other things, the prior approval of the Federal Reserve in any case where a bank holding company proposes to (i) acquire direct or indirect ownership or control of more than 5% of the outstanding voting stock of any bank or bank holding company (unless it already owns a majority of such voting shares), (ii) acquire all or substantially all of the assets of another bank or bank holding company, or (iii) merge or consolidate with any other bank holding company. In determining whether to approve a proposed bank acquisition, the Federal Reserve will consider, among other factors, the effect of the acquisition on competition, the public benefits expected to be received from the acquisition, the projected capital ratios and levels on a post-acquisition basis, and the acquiring institution’s performance under the CRA, and its compliance with fair housing and other consumer protection laws.

Subject to certain exceptions, the BHC Act and the Change in Bank Control Act, together with the applicable regulations, require Federal Reserve approval (or, depending on the circumstances, no notice of disapproval) prior to any person or company acquiring “control” of a bank or bank holding company. A conclusive presumption of control exists if an individual or company acquires the power, directly or indirectly, to direct the management or policies of an insured depository institution or to vote 25% or more of any class of voting securities of any insured depository institution. A rebuttable presumption of control exists if a person or company acquires 10% or more but less than 25% of any class of voting securities of an insured depository institution and either the institution has registered its securities with the SEC under Section 12 of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), or no other person will own a greater percentage of that class of voting securities immediately after the acquisition.

In addition, Section 18(c) of the Federal Deposit Insurance Act, commonly known as the “Bank Merger Act,” requires the prior written approval of the OCC before any national bank may (i) merge or consolidate with, (ii) purchase or otherwise acquire the assets of, or (iii) assume the deposit liabilities of, another bank if the resulting institution is to be a national bank. In determining whether to approve a proposed merger transaction, the OCC must consider the effect on competition, the financial and managerial resources and future prospects of the existing and resulting institutions, the convenience and needs of the communities to be served, and the effectiveness of each insured depository institution involved in the proposed merger transaction in combating money-laundering activities.

In addition, Virginia law requires the prior approval of the Virginia SCC for (i) the acquisition of more than 5% of the voting shares of a Virginia bank or any holding company that controls a Virginia bank, or (ii) the acquisition by a Virginia bank holding company of a bank or its holding company domiciled outside Virginia.

Source of Strength

Federal Reserve policy has historically required bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. The Dodd-Frank Act codified this policy as a statutory requirement. Under this requirement, the Company is expected to commit resources to support the Bank, including at times when the Company may not be in a financial position to provide such resources. Any capital loans by a bank holding company to any of its subsidiary banks are subordinate in right of payment to depositors and to certain other indebtedness of such subsidiary banks. In the

8

event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

The Federal Deposit Insurance Corporation Improvement Act

Under the Federal Deposit Insurance Corporation Improvement Act of 1991 (“FDICIA”), the federal bank regulatory agencies possess broad powers to take prompt corrective action to resolve problems of insured depository institutions. The extent of these powers depends upon whether the institution is “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” or “critically undercapitalized,” as defined by the law.

As required by FDICIA, the federal bank regulatory agencies also have adopted guidelines prescribing safety and soundness standards relating to, among other things, internal controls and information systems, internal audit systems, loan documentation, credit underwriting, and interest rate exposure. In general, the guidelines require appropriate systems and practices to identify and manage the risks and exposures specified in the guidelines. In addition, the agencies adopted regulations that authorize, but do not require, an institution that has been notified that it is not in compliance with safety and soundness standard to submit a compliance plan. If, after being so notified, an institution fails to submit an acceptable compliance plan, the agency must issue an order directing action to correct the deficiency and may issue an order directing other actions of the types to which an undercapitalized institution is subject under the prompt corrective action provisions described above.

Transactions with Affiliates

Pursuant to Sections 23A and 23B of the Federal Reserve Act and Regulation W, the authority of the Bank to engage in transactions with related parties or “affiliates” or to make loans to insiders is limited. Loan transactions with an affiliate generally must be collateralized and certain transactions between the Bank and its affiliates, including the sale of assets, the payment of money or the provision of services, must be on terms and conditions that are substantially the same, or at least as favorable to the Bank, as those prevailing for comparable nonaffiliated transactions. In addition, the Bank generally may not purchase securities issued or underwritten by affiliates.

Loans to executive officers, directors, or to any person who directly or indirectly, or acting through or in concert with one or more persons, owns, controls or has the power to vote more than 10% of any class of voting securities of a bank, are subject to Sections 22(g) and 22(h) of the Federal Reserve Act and their corresponding regulations (Regulation O) and Section 13(k) of the Exchange Act relating to the prohibition on personal loans to executives (which exempts financial institutions in compliance with the insider lending restrictions of Section 22(h) of the Federal Reserve Act). Among other things, these loans must be made on terms substantially the same as those prevailing on transactions made to unaffiliated individuals, and certain extensions of credit to those persons must first be approved in advance by a disinterested majority of the entire board of directors. Section 22(h) of the Federal Reserve Act prohibits loans to any of those individuals where the aggregate amount exceeds an amount equal to 15% of an institution’s unimpaired capital and surplus plus an additional 10% of unimpaired capital and surplus in the case of loans that are fully secured by readily marketable collateral, or when the aggregate amount on all of the extensions of credit outstanding to all of these persons would exceed the Bank’s unimpaired capital and unimpaired surplus. Section 22(g) of the Federal Reserve Act identifies limited circumstances in which the Bank is permitted to extend credit to executive officers.

Consumer Financial Protection

The Company is subject to a number of federal and state consumer protection laws that extensively govern its relationship with its customers. These laws include the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Truth in Lending Act, the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Home Mortgage Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Fair Debt Collection Practices Act, the Service Members Civil Relief Act, laws governing flood insurance, federal and state laws prohibiting unfair and deceptive business practices, foreclosure laws, and various regulations that implement some or all of the foregoing. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must deal with customers when taking deposits, making loans, collecting loans and providing other services. For example, mortgage lenders are required to make a reasonable and good faith determination based on verified and documented information that a consumer applying for a mortgage loan has a reasonable ability to repay the loan according to its terms, either by considering underwriting factors prescribed by Regulation Z or by originating loans that meet the definition of a “qualified mortgage.” If the Company fails to comply with these laws and regulations, it may be subject to various penalties. Failure to comply with consumer protection requirements may also result in failure to obtain any required bank regulatory

9

approval for merger or acquisition transactions the Company may wish to pursue or being prohibited from engaging in such transactions even if approval is not required.

The Dodd-Frank Act centralized responsibility for consumer financial protection by creating a new agency, the Consumer Financial Protection Bureau ("CFPB"), and giving it responsibility for implementing, examining, and enforcing compliance with federal consumer protection laws. The CFPB focuses on (i) risks to consumers and compliance with the federal consumer financial laws, (ii) the markets in which firms operate and risks to consumers posed by activities in those markets, (iii) depository institutions that offer a wide variety of consumer financial products and services, and (iv) non-depository companies that offer one or more consumer financial products or services. The CFPB has broad rule making authority for a wide range of consumer financial laws that apply to all banks, including, among other things, the authority to prohibit “unfair, deceptive or abusive” acts and practices. Abusive acts or practices are defined as those that materially interfere with a consumer’s ability to understand a term or condition of a consumer financial product or service or take unreasonable advantage of a consumer’s (i) lack of financial savvy, (ii) inability to protect himself in the selection or use of consumer financial products or services, or (iii) reasonable reliance on a covered entity to act in the consumer’s interests. The CFPB can issue cease-and-desist orders against banks and other entities that violate consumer financial laws. The CFPB may also institute a civil action against an entity in violation of federal consumer financial law in order to impose a civil penalty or injunction.

Community Reinvestment Act

The CRA requires the appropriate federal banking agency, in connection with its examination of a bank, to assess the bank’s record in meeting the credit needs of the communities served by the bank, including low and moderate income neighborhoods. Furthermore, such assessment is also required of banks that have applied, among other things, to merge or consolidate with or acquire the assets or assume the liabilities of an insured depository institution, or to open or relocate a branch. In the case of a bank holding company applying for approval to acquire a bank or bank holding company, the record of each subsidiary bank of the applicant bank holding company is subject to assessment in considering the application. Under the CRA, institutions are assigned a rating of “outstanding,” “satisfactory,” “needs to improve,” or “substantial non-compliance.” The Bank was rated “satisfactory” in its most recent CRA evaluation.

In May 2022, the federal bank regulatory agencies jointly issued a proposed rule intended to strengthen and modernize the CRA regulatory framework. If implemented, the rule would, among other things, (i) expand access to credit, investment and basic banking services in low- and moderate-income communities, (ii) adapt to changes in the banking industry, including internet and mobile banking, (iii) provide greater clarity, consistency and transparency in the application of the regulations and (iv) tailor performance standards to account for differences in bank size, business model, and local conditions.

Anti-Money Laundering Legislation

The Company is subject to several federal laws that are designed to combat money laundering, terrorist financing, and transactions with persons, companies or foreign governments designated by U.S. authorities (the “AML laws”). This category of laws includes the Bank Secrecy Act of 1970, the Money Laundering Control Act of 1986, the USA PATRIOT Act of 2001, and the Anti-Money Laundering Act of 2020.

The AML laws and their implementing regulations require insured depository institutions, broker-dealers, and certain other financial institutions to have policies, procedures, and controls to detect, prevent, and report money laundering and terrorist financing. The AML laws and their regulations also provide for information sharing, subject to conditions, between federal law enforcement agencies and financial institutions, as well as among financial institutions, for counter-terrorism purposes. Federal banking regulators are required, when reviewing bank holding company acquisition and bank merger applications, to take into account the effectiveness of the anti-money laundering activities of the applicants. To comply with these obligations, the Company has implemented internal practices, procedures, and controls.

Office of Foreign Assets Control

The U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”) is responsible for administering and enforcing economic and trade sanctions against specified foreign parties, including countries and regimes, foreign individuals, and other foreign organizations and entities. OFAC publishes lists of prohibited parties that are regularly consulted by the Company in the conduct of its business in order to assure compliance. The Company is responsible for, among other things, blocking accounts of, and transactions with, prohibited parties identified by OFAC, avoiding unlicensed trade and financial transactions with such parties, and reporting blocked transactions after their occurrence. Failure to comply with OFAC requirements could have serious legal, financial, and reputational consequences for the Company.

10

Privacy Legislation