EAGLE FINANCIAL SERVICES INC [EFSI] Filings

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, D.C. 20549

FORM 10-K

(Mark One)

For the fiscal year ended December 31, 2023

or

Commission File Number: 0-20146

EAGLE FINANCIAL SERVICES, INC.

(Exact name of registrant as specified in its charter)

(540) 955-2510

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act:

Common Stock, Par Value $2.50

(Title of class)

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☐ No ☒

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (232.405 of this Chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and "emerging growth company" in Rule 12b-2 of the Exchange Act.

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. □

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. □

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). □

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

The aggregate market value of the voting common equity held by non-affiliates of the registrant at June 30, 2023 was $94,161,812.

The number of shares of the registrant’s Common Stock ($2.50 par value) outstanding as of March 22, 2024 was 3,557,229.

DOCUMENTS INCORPORATED BY REFERENCE

EAGLE FINANCIAL SERVICES, INC.

INDEX TO FORM 10-K

PART I

Item 1. Business

General

Eagle Financial Services, Inc. is a bank holding company that was incorporated in 1991. The company is headquartered in Berryville, Virginia and conducts its operations through its subsidiary, Bank of Clarke (the “Bank”). The Bank changed its name from Bank of Clarke County to Bank of Clarke in 2022. The Bank is chartered under Virginia law. For purposes of this annual report on Form 10-K, the terms the "Company," "our," "us" and "we" refer to Eagle Financial Services, Inc. and our subsidiaries as a combined entity, unless this report otherwise indicates or the context otherwise requires.

The Bank has thirteen full-service branches, two loan production offices, and one drive-through only facility. The Bank’s main office is located at 2 East Main Street in Berryville, Virginia. The Bank opened for business on April 1, 1881. The Bank has Virginia offices located in Clarke County, Frederick County, Fauquier County, Loudoun County and Fairfax County, as well as the Towns of Leesburg, Ashburn and Purcellville and the City of Winchester. The Bank has a Maryland office located in Frederick. This market area is located in the Shenandoah Valley of Virginia, Northern Virginia and Frederick, Maryland.

The Bank offers a wide range of retail and commercial banking services, including demand, savings and time deposits and consumer, mortgage and commercial loans. The Bank has thirteen ATM locations in its trade area and issues debit cards to deposit customers. These cards can be used to withdraw cash at most ATMs through the Bank’s membership in both regional and national networks. These cards can also be used to make purchases at retailers who accept transactions through the same regional and national networks. The Bank offers telephone banking, internet banking, and mobile banking to its customers. Internet banking also offers online bill payment to consumer and commercial customers. The Bank offers other commercial deposit account services such as ACH origination and remote deposit capture.

The Bank of Clarke Wealth Management Division, a division of the Bank, provides both a full-service trust department and a separate brokerage area. The trust department features a full range of fiduciary expertise, including service as trustee of personal trusts, service as guardian or conservator by court appointment, fiduciary investment management, estate settlement, and agency for trustees. The brokerage area offers advisory services and a broad selection of investment products, including individual retirement accounts, mutual funds, tax-deferred annuities, 529 college savings plans, life insurance, long term care insurance, brokerage certificates of deposit, among other brokerage services. Securities and other property held by the Bank of Clarke Wealth Management Division in a fiduciary or agency capacity are not assets of the Bank and are not included in the accompanying consolidated financial statements. Non-deposit investment products are offered through a third party provider.

The Bank of Clarke is a member in Bankers Title Shenandoah, LLC, which sells title insurance and is an investor in Virginia Bankers Insurance Center, LLC, which serves as the broker for insurance sales through its member banks. Bank of Clarke is also an investor in low-income housing projects in Virginia and building rehabilitation projects in surrounding states. These investments generate tax credits for the Bank.

Employees

The Company, including the Bank, had 92 officers, 142 other full-time and 9 part-time employees (or 241 full-time equivalent employees) at December 31, 2023. None of the Company’s employees are represented by a union or covered under a collective bargaining agreement. The Company considers relations with its employees to be excellent, receiving a Great Place to Work® certified. designation in the fourth quarter of 2023.

Securities and Exchange Commission Filings

The Company maintains an internet website at www.bankofclarke.bank. Shareholders of the Company and the public may access, free of charge, the Company’s periodic and current reports (including annual reports on Form 10-K, quarterly reports on Form 10-Q and current reports on Form 8-K, and any amendments to those reports) filed with or furnished to the Securities and Exchange Commission (the "SEC"), through the “Investor Relations” section of the Company’s website. The reports are made available on this website as soon as practicable following the filing of the reports with the SEC. In addition, certain committee charters and the Company's Code of Ethics are available on the Company's website. The information is free of charge and may be reviewed, downloaded and printed from the website at any time. The information on the Company's website is not a part of, and is not incorporated into, this Annual Report on Form 10-K.

Competition

There is significant competition for both loans and deposits within the Company’s trade area. Competition for loans comes from other commercial banks, savings banks, credit unions, mortgage brokers, finance companies, financial technology firms, insurance companies, and other institutional lenders. Competition for deposits comes from other commercial banks, savings banks, credit unions, brokerage firms, and other financial institutions. Based on total deposits at June 30, 2023 as reported to the FDIC, the Bank has 9.27% of the total deposits in its market area. The Company’s primary deposit market area includes Clarke County, Frederick County, Loudoun County, Fauquier County and the City of Winchester.

Supervision and Regulation

General. As a bank holding company, the Company is subject to regulation under the Bank Holding Company Act of 1956, as amended, and the examination and reporting requirements of the Board of Governors of the Federal Reserve System (the "Federal Reserve"). As a state-chartered commercial bank, the Bank is subject to regulation, supervision and examination by the Virginia State Corporation Commission’s Bureau of Financial Institutions. It is also subject to regulation, supervision and examination by the Federal Reserve. Other federal and state laws, including various consumer and compliance laws, govern the activities of the Bank, the investments that it makes and the aggregate amount of loans that it may grant to one borrower.

The following sections summarize some of the significant federal and state laws applicable to the Company and its subsidiary. To the extent that statutory or regulatory provisions are described, the description is qualified in its entirety by reference to that particular statutory or regulatory provision.

The Bank Holding Company Act. Under the Bank Holding Company Act, the Company is subject to periodic examination by the Federal Reserve and is required to file periodic reports regarding its operations and any additional information that the Federal Reserve may require. Activities at the bank holding company level are limited to the following:

Some of the activities that the Federal Reserve has determined by regulation to be closely related to the business of a banking include making or servicing loans and specific types of leases, performing specific data processing services and acting in some circumstances as a fiduciary or investment or financial adviser.

With some limited exceptions, the Bank Holding Company Act requires every bank holding company to obtain the prior approval of the Federal Reserve before:

In addition, and subject to some exceptions, the Bank Holding Company Act and the Change in Bank Control Act, together with their regulations, require Federal Reserve approval prior to any person or company acquiring 25% or more of any class of voting securities of the bank holding company. Prior notice to the Federal Reserve is required if a person acquires 10% or more, but less than 25%, of any class of voting securities of a bank or bank holding company and either the institution has registered securities under Section 12 of the Securities Exchange Act of 1934 or no other person owns a greater percentage of that class of voting securities immediately after the transaction.

In November 1999, Congress enacted the Gramm-Leach-Bliley Act (“GLBA”), which made substantial revisions to the statutory restrictions separating banking activities from other financial activities. Under the GLBA, bank holding companies that are well-capitalized and well-managed and meet other conditions can elect to become “financial holding companies.” As financial holding companies, they and their subsidiaries are permitted to acquire or engage in previously impermissible activities such as insurance underwriting, securities underwriting and distribution, travel agency activities, insurance agency activities, merchant banking and other activities that the Federal Reserve determines to be financial in nature or complementary to these activities. Financial holding companies continue to be subject to the overall oversight and supervision of the Federal Reserve, but the GLBA applies the concept of functional regulation to the activities conducted by subsidiaries. For example, insurance activities would be subject to supervision and regulation by state insurance authorities. Although the Company has not elected to become a financial holding company in order to exercise the broader activity powers provided by the GLBA, the Company may elect do so in the future.

Payment of Dividends. The Company is organized under the Virginia Stock Corporation Act, which prohibits the payment of a dividend if, after giving it effect, the corporation would not be able to pay its debts as they become due in the usual course of business or if the corporation’s total assets would be less than the sum of its total liabilities plus the amount that would be needed, if the corporation were to be dissolved, to satisfy the preferential rights upon dissolution of any preferred shareholders. In addition, the Federal Reserve has indicated that a bank holding company should generally pay dividends only if its current earnings are sufficient to fully fund the dividends, and the prospective rate of earnings retention appears consistent with the organization’s capital needs, asset quality and overall financial condition.

The Company is a legal entity separate and distinct from its subsidiary. Its ability to distribute cash dividends will depend primarily on the ability of the Bank to pay dividends to it, and the Bank is subject to laws and regulations that limit the amount of dividends that it can pay. As a state member bank, the Bank is subject to certain restrictions imposed by the reserve and capital requirements of federal and Virginia banking statutes and regulations. Under Virginia law, a bank may not declare a dividend in excess of its undivided profits. Additionally, the Bank may not declare a dividend if the total amount of all dividends, including the proposed dividend, declared by it in any calendar year exceeds the total of its retained net income of that year to date, combined with its retained net income of the two preceding years, unless the dividend is approved by the Federal Reserve.

The Federal Reserve, the FDIC and the state of Virginia have the general authority to limit the dividends paid by insured banks if the payment is deemed an unsafe and unsound practice. These regulators have indicated that paying dividends that deplete a bank’s capital base to an inadequate level would be an unsound and unsafe banking practice. The Bank may also not declare or pay a dividend without the approval of its board and two-thirds of its shareholders if the dividend would exceed its undivided profits, as reported to the Federal Reserve.

The Company does not expect that any of these laws, regulations or policies will materially affect the Bank's ability to pay dividends to the Company. During 2023, the Company paid total dividends of $4.2 million, including cash dividends that were reinvested in Company stock.

Insurance of Accounts, Assessments and Regulation by the FDIC. The Bank’s deposits are insured up to applicable limits by the FDIC. In July 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act (the "Dodd-Frank Act") permanently raised the standard maximum deposit insurance amount to $250,000. The FDIC has implemented a risk-based assessment system in which assessment rates for insured institutions with under $10 billion in assets are calculated based on supervisory evaluations and certain other financial measures. The assessment base is an institution’s average consolidated total assets less average tangible equity, and the initial base assessment rates are currently between 5 and 32 basis points depending on the institution's composite rating, and subject to potential adjustment based on certain long-term unsecured debt. Progressively lower assessment rate schedules will take effect once the FDIC’s reserve ratio reaches 2.0% or greater, and again once the reserve ratio reaches 2.5% or greater.

Capital Requirements. The Federal Reserve and the other federal banking agencies have issued risk-based and leverage capital guidelines applicable to U.S. banking organizations. Those regulatory agencies may from time to time require that a banking organization maintain capital above the minimum levels because of its financial condition or actual or anticipated growth. Pursuant to the Federal Reserve’s Small Bank Holding Company and Savings and Loan Holding Company Policy Statement, qualifying bank holding companies with total consolidated assets of less than $3 billion, such as the Company, are not subject to consolidated regulatory capital requirements.

Effective January 1, 2015, the Federal Reserve adopted capital rules intended to revise and strengthen its risk-based and leverage capital requirements and its method for calculating risk-weighted assets. The rules implemented the Basel III regulatory capital reforms from the Basel Committee on Banking Supervision and certain provisions of the Dodd-Frank Act.

Under these risk-based capital requirements of the Federal Reserve, the Bank is required to maintain a minimum ratio of total capital (which is defined as core capital and supplementary capital less certain specified deductions from total capital such as reciprocal holdings of depository institution capital instruments and equity investments) to risk-weighted assets of at least 8.0%. At least 6.0% of risk-weighted assets is required to be “Tier 1 capital,” which consists principally of common and certain qualifying preferred shareholders’ equity (including grandfathered trust preferred securities) as well as retained earnings, less certain intangibles and other adjustments. The “Tier 2 capital” consists of cumulative preferred stock, long-term perpetual preferred stock, a limited amount of subordinated and other qualifying debt (including certain hybrid capital instruments), and a limited amount of the allowance for loan losses, including reserves for off-balance sheet commitments. A common equity Tier 1 capital ratio of 4.5% of risk-weighted assets also was added with the rules effective January 1, 2015.

Each of the federal bank regulatory agencies also has established a minimum leverage capital ratio of Tier 1 capital to average adjusted assets (“Tier 1 leverage ratio”). The guidelines require a minimum Tier 1 leverage ratio of 3.0% for financial holding companies and banking organizations with the highest supervisory rating. All other banking organizations are required to maintain a minimum Tier 1 leverage ratio of 4.0% unless a different minimum was specified by an appropriate regulatory authority. In addition, for a depository institution to be considered “well capitalized” under the regulatory framework for prompt corrective action, its Tier 1 leverage ratio must be at least 5.0%. Banking organizations that have experienced internal growth or made acquisitions are expected to maintain strong capital positions substantially above the minimum supervisory levels without significant reliance on intangible assets. The Federal Reserve has not advised the Company or the Bank of any specific minimum leverage ratio applicable to either entity.

The capital requirements that became effective January 1, 2015 were phased in over a four-year period. As fully phased in effective January 1, 2019, the rules require the Bank to maintain (i) a minimum ratio of common equity Tier 1 to risk-weighted assets of at least 4.5%, plus a 2.5% “capital conservation buffer” (which is added to the 4.5% common equity Tier 1 ratio, effectively resulting in a minimum ratio of common equity Tier 1 to risk-weighted assets of at least 7.0%); (ii) a minimum ratio of Tier 1 capital to risk-weighted assets of at least 6.0%, plus the 2.5% capital conservation buffer (which is added to the 6.0% Tier 1 capital ratio, effectively resulting in a minimum Tier 1 capital ratio of 8.5%); (iii) a minimum ratio of total capital to risk-weighted assets of at least 8.0%, plus the 2.5% capital conservation buffer (which is added to the 8.0% total capital ratio, effectively resulting in a minimum total capital ratio of 10.5%); and (iv) a minimum leverage ratio of 4.0%, calculated as the ratio of Tier 1 capital to average assets.

The capital conservation buffer requirement was phased in beginning January 1, 2016, at 0.625% of risk-weighted assets, increasing by the same amount each year until fully implemented at 2.5% effective January 1, 2019. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of common equity Tier 1 to risk-weighted assets above the minimum but below the conservation buffer will face constraints on dividends, equity repurchases, and compensation based on the amount of the shortfall.

The Federal Reserve’s final rules also revised the “prompt corrective action” regulations pursuant to Section 38 of the FDIA by (i) introducing a common equity Tier 1 capital ratio requirement at each level (other than critically undercapitalized), with the required ratio being 6.5% for well-capitalized status; (ii) increasing the minimum Tier 1 capital ratio requirement for each category, with the minimum ratio for well-capitalized status being 8.0%; and (iii) eliminating the provision that provided that a bank with a composite supervisory rating of 1 may have a 3.0% Tier 1 leverage ratio and still be well-capitalized. These thresholds were effective for the Bank as of January 1, 2015. The minimum total capital to risk-weighted assets ratio (10.0%) and minimum leverage ratio (5.0%) for well-capitalized status were unchanged by the final rules.

As directed by the Economic Growth, Regulatory Relief and Consumer Protection Act (the “Economic Growth Act”), the federal banking regulators jointly issued a final rule in 2019 that permits qualifying banks that have less than $10 billion in total consolidated assets to elect to be subject to a 9% “community bank leverage ratio.” A qualifying bank that has chosen the proposed framework is not required to calculate the existing risk-based and leverage capital requirements and would be considered to have met the capital ratio requirements to be “well capitalized” under prompt corrective action rules, provided it has a community bank leverage ratio greater than 9%.

Other Safety and Soundness Regulations. There are a number of obligations and restrictions imposed on bank holding companies and their depository institution subsidiaries by federal law and regulatory policy that are designed to reduce potential loss exposure to the depositors of such depository institutions and to the FDIC insurance funds in the event that the depository institution is insolvent or is in danger of becoming insolvent. For example, under the requirements of the Federal Reserve with respect to bank holding company operations, a bank holding company is required to serve as a source of financial strength to its subsidiary depository institutions and to commit resources to support such institutions in circumstances where it might not do so otherwise. In addition, the “cross-guarantee” provisions of federal law require insured depository institutions under common control to reimburse the FDIC for any loss suffered or reasonably anticipated by the FDIC as a result of the insolvency of commonly controlled insured depository institutions or for any assistance provided by the FDIC to commonly controlled insured depository institutions in danger of failure. The FDIC may decline to enforce the cross-guarantee provision if it determines that a waiver is in the best interests of the deposit insurance funds. The FDIC’s claim for reimbursement under the cross guarantee provisions is superior to claims of shareholders of the insured depository institution or its holding company but is subordinate to claims of depositors, secured creditors and nonaffiliated holders of subordinated debt of the commonly controlled insured depository institutions.

Federal Reserve System. In 1980, Congress enacted legislation that imposed reserve requirements on all depository institutions that maintain transaction accounts or nonpersonal time deposits. NOW accounts, money market deposit accounts and other types of accounts that permit payments or transfers to third parties fall within the definition of transaction accounts and are subject to these reserve requirements, as are any nonpersonal time deposits at an institution.

The reserve percentages are subject to adjustment by the Federal Reserve. Because required reserves must be maintained in the form of vault cash or in a non-interest-bearing account at, or on behalf of, a Federal Reserve Bank, the effect of the reserve requirement is to reduce the amount of the institution’s interest-earning assets.

However, in March 2020, in an unprecedented move, the Federal Reserve announced that the banking system had ample reserves, and, as reserve requirements no longer played a significant role in this regime, it reduced all reserve tranches to zero percent, thereby freeing banks from the reserve maintenance requirement. The action permits the Bank to loan or invest funds that were previously unavailable. The Federal Reserve has indicated that it expects to continue to operate in an ample reserves regime for the foreseeable future.

Transactions with Affiliates. Transactions between banks and their affiliates are governed by Sections 23A and 23B of the Federal Reserve Act. An affiliate of a bank is any bank or entity that controls, is controlled by or is under common control with such bank. Generally, Sections 23A and 23B (i) limit the extent to which the Bank or its subsidiaries may engage in “covered transactions” with any one affiliate to an amount equal to 10% of such institution’s capital stock and surplus, and maintain an aggregate limit on all such transactions with affiliates to an amount equal to 20% of such capital stock and surplus, and (ii) require that all such transactions be on terms substantially the same, or at least as favorable, to the association or subsidiary as those provided to a nonaffiliate. The term “covered transaction” includes the making of loans, purchase of assets, issuance of a guarantee and similar other types of transactions.

Transactions with Insiders. The Federal Reserve Act and related regulations impose specific restrictions on loans to directors, executive officers and principal shareholders of banks. Under Section 22(h) of the Federal Reserve Act, loans to a director, an executive officer and to a principal shareholder of a bank, and some affiliated entities of any of the foregoing, may not exceed, together with all other outstanding loans to such person and affiliated entities, the bank’s loan-to-one borrower limit. Loans in the aggregate to insiders and their related interests as a class may not exceed two times the bank’s unimpaired capital and unimpaired surplus until the bank’s total deposits equal or exceed $100,000,000, at which time the aggregate is limited to the bank’s unimpaired capital and unimpaired surplus. Section 22(h) also prohibits loans, above amounts prescribed by the appropriate federal banking agency, to directors, executive officers and principal shareholders of a bank or bank holding company, and their respective affiliates, unless such loan is approved in advance by a majority of the board of directors of the bank with any “interested” director not participating in the voting. The FDIC has prescribed the loan amount, which includes all other outstanding loans to such person, as to which such prior board of director approval is required, as being the greater of $25,000 or 5% of capital and surplus (up to $500,000). Section 22(h) requires that loans to directors, executive officers and principal shareholders be made on terms and underwriting standards substantially the same as offered in comparable transactions to other persons.

The Dodd-Frank Act also provides that banks may not “purchase an asset from, or sell an asset to” a bank insider (or their related interests) unless (i) the transaction is conducted on market terms between the parties, and (ii) if the proposed transaction represents more than 10 percent of the capital stock and surplus of the bank, it has been approved in advance by a majority of the bank’s non-interested directors.

Community Reinvestment Act. Under the Community Reinvestment Act and related regulations, depository institutions have an affirmative obligation to assist in meeting the credit needs of their market areas, including low and moderate-income areas, consistent with safe and sound banking practice. The Community Reinvestment Act directs each bank to maintain a public file containing specific information, including all written comments received from the public for the current year and each of the previous two calendar years that specifically relate to the bank’s performance in helping to meet community credit needs. Depository institutions are periodically examined for compliance with the Community Reinvestment Act and are periodically assigned ratings in this regard. Banking regulators consider a depository institution’s Community Reinvestment Act rating when reviewing applications to establish new branches, undertake new lines of business, and/or acquire part or all of another depository institution. An unsatisfactory rating can significantly delay or even prohibit regulatory approval of a proposed transaction by a bank holding company or its depository institution subsidiaries.

In October 2023, the Office of the Comptroller of the Currency ("OCC"), the Federal Reserve System Board and the FDIC finalized comprehensive revisions to their CRA regulations. The objectives in issuing the final rule include strengthening the achievement of the core purpose of the statute, adapting to changes in the banking industry, including the expanded role of mobile and online banking, tailoring performance standards to account for differences in bank size and business models and local conditions, confirming that CRA and fair lending responsibilities are mutually reinforcing, and promoting a consistent regulatory approach that applies to banks regulated by all three agencies. The final rule is expected to go into effect on April 1, 2024, but most provisions of the rule, including the new tests, the need to define retail lending assessment areas, and the data collection requirements, will become applicable on January 1, 2026. Reporting of the collected data will not be required until 2027. In addition to numerous technical revisions, the final rule introduces major changes to the CRA regulations in four key areas: (A) the delineation of assessment areas; (B) the overall evaluation framework and performance standards and metrics; (C) the definition of community development activities; and (D) data collection and reporting. The new evaluation framework is “tailored” based on the size of the bank.

Fair Lending; Consumer Laws. In addition to the Community Reinvestment Act, other federal and state laws regulate various lending and consumer aspects of the banking business. Governmental agencies, including the Department of Housing and Urban Development, the Federal Trade Commission and the Department of Justice, have become concerned that prospective borrowers experience discrimination in their efforts to obtain loans from depository and other lending institutions. These agencies have brought litigation against depository institutions alleging discrimination against borrowers. Many of these suits have been settled, in some cases for material sums, short of a full trial.

These governmental agencies have clarified what they consider to be lending discrimination and have specified various factors that they will use to determine the existence of lending discrimination under the Equal Credit Opportunity Act and the Fair Housing Act, including evidence that a lender discriminated on a prohibited basis, evidence that a lender treated applicants differently based on prohibited factors in the absence of evidence that the treatment was the result of prejudice or a conscious intention to discriminate, and evidence that a lender applied an otherwise neutral non-discriminatory policy uniformly to all applicants, but the practice had a discriminatory effect, unless the practice could be justified as a business necessity.

Banks and other depository institutions are also subject to numerous consumer-oriented laws and regulations. These laws, which include the Truth in Lending Act, the Truth in Savings Act, the Real Estate Settlement Procedures Act, the Electronic Funds Transfer Act, the Funds Availability Act, the Equal Credit Opportunity Act, and the Fair Housing Act, require compliance by depository institutions with various disclosure requirements and requirements regulating the availability of funds after deposit or the making of some loans to customers.

Privacy Regulations. The GLBA contains extensive customer privacy protection provisions. Under these provisions, a financial institution must provide to its customers, both at the inception of the customer relationship and on an annual basis, the institution’s policies and procedures regarding the handling of customers’ nonpublic personal financial information. The law provides that, except for specific limited exceptions, an institution may not provide such personal information to unaffiliated third parties unless the institution discloses to the customer that such information may be so provided and the customer is given the opportunity to opt out of such disclosure. An institution may not disclose to a non-affiliated third party, other than to a consumer reporting agency, customer account numbers or other similar account identifiers for marketing purposes. The GLBA also provides that the states may adopt customer privacy protections that are more strict than those contained in the act.

Regulation P provides an exception under which financial institutions that meet certain conditions are not required to provide annual privacy notices to customers. To qualify for this exception, a financial institution must not share nonpublic personal information about customers except as described in certain statutory exceptions. In addition, the rule requires that the financial institution must not have changed its policies and practices with regard to disclosing nonpublic personal information from those that the institution disclosed in the most recent privacy notice it sent. As part of its implementation, the CFPB also amended Regulation P to provide timing requirements for delivery of annual privacy notices in the event that a financial institution that qualified for this annual notice exception later changes its policies or practices in such a way that it no longer qualifies for the exception. The CFPB further removed the Regulation P provision that allowed for use of the alternative delivery method for annual privacy notices because the CFPB believes the alternative delivery method will no longer be used in light of the annual notice exception.

Anti-Money Laundering Laws and Regulations. The Bank is subject to several federal laws that are designed to combat money laundering, terrorist financing, and transactions with persons, companies or foreign governments designated by U.S. authorities (“AML laws”). This category of laws includes the Bank Secrecy Act of 1970, the Money Laundering Control Act of 1986, the USA PATRIOT Act of 2001, and the Anti-Money Laundering Act of 2020. The Anti-Money Laundering Act of 2020, the most sweeping anti-money laundering legislation in 20 years, requires various federal agencies to promulgate regulations implementing a number of its provisions.

The AML laws and their implementing regulations require insured depository institutions, broker-dealers, and certain other financial institutions to have policies, procedures, and controls to detect, prevent, and report money laundering and terrorist financing. The AML laws and their regulations also provide for information sharing, subject to conditions, between federal law enforcement agencies and financial institutions, as well as among financial institutions, for counter-terrorism purposes. Federal banking regulators are required, when reviewing bank holding company acquisition and bank merger applications, to take into account the effectiveness of the anti-money laundering activities of the applicants. To comply with these obligations, the Company has implemented appropriate internal practices, procedures, and controls.

Cybersecurity. The federal banking agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a financial institution’s board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services. The federal banking agencies expect financial institutions to establish lines of defense and ensure that their risk management processes also address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack. If the Bank fails to meet the expectations set forth in this regulatory guidance, it could be subject to various regulatory actions and any remediation efforts may require significant resources of the Bank. In addition, all federal and state bank regulatory agencies continue to increase focus on cybersecurity programs and risks as part of regular supervisory exams.

In November 2021, the federal banking agencies approved a final rule effective on April 1, 2022 that, among other things, requires banking organizations to notify their primary regulator within 36 hours of becoming aware of a “computer-security incident” that rises to the level of a “notification incident.” The rule also requires bank service providers to notify their banking organization customers as soon as possible after becoming aware of similar incidents.

In 2023, the SEC issued a final rule that requires disclosure of material cybersecurity incidents, as well as cybersecurity risk management, strategy and governance. Under this rule, banking organizations that are SEC registrants must generally disclose information about a material cybersecurity incident within four business days of determining it is material with periodic updates as to the status of the incident in subsequent filings as necessary.

Sarbanes-Oxley Act of 2002. The Sarbanes-Oxley Act implemented a number of laws affecting corporate governance, accounting obligations and corporate reporting. The Sarbanes-Oxley Act is applicable to all companies with equity securities registered or that file reports under the Securities Exchange Act of 1934. In particular, the Sarbanes-Oxley Act established: (i) requirements for audit committees, including independence, expertise, and responsibilities; (ii) responsibilities regarding financial statements for the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) standards for auditors and regulation of audits; (iv) disclosure and reporting obligations for reporting companies and their directors and executive officers; and (v) civil and criminal penalties for violations of the securities laws. Because the Company’s common stock is registered with the SEC, it is currently subject to these requirements.

Incentive Compensation. In June 2010, the Federal Reserve issued a final rule on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. Banking organizations are instructed to review their incentive compensation policies to ensure that they do not encourage excessive risk-taking and implement corrective programs as needed. The Federal Reserve will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Bank, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions.

Dodd-Frank Act. In July 2010, the Dodd-Frank Act was signed into law, incorporating numerous financial institution regulatory reforms. The Dodd-Frank Act implements far-reaching reforms of major elements of the financial landscape, particularly for larger financial institutions. Many of its provisions do not directly impact community-based institutions like the Bank. For instance, provisions that regulate derivative transactions and limit derivatives trading activity of federally-insured institutions, enhance supervision of “systemically significant” institutions, impose new regulatory authority over hedge funds, limit proprietary trading by banks, and phase-out the eligibility of trust preferred securities for Tier 1 capital are among the provisions that do not directly impact the Bank either because of exemptions for institutions below a certain asset size or because of the nature of the Bank’s operations. Certain aspects of the Dodd-Frank Act remain subject to rulemaking and interpretation and will take effect over several years, and their impact on the Company or the financial industry is difficult to predict before such regulations or interpretations are adopted.

In May 2018, the Economic Growth Act was enacted to modify or remove certain regulatory financial reform rules and regulations, including some of those implemented under the Dodd-Frank Act. While the Economic Growth Act maintains most of the regulatory structure established by the Dodd-Frank Act, it amends certain aspects of the regulatory framework for small depository institutions with assets of less than $10 billion, such as the Bank, and for large banks with assets of more than $50 billion.

Among other matters, the Economic Growth Act expands the definition of qualified mortgages which may be held by a financial institution with total consolidated assets of less than $10 billion, exempts community banks from the Volcker Rule, and includes additional regulatory relief regarding regulatory examination cycles, call reports, mortgage disclosures and risk weights for certain high-risk commercial real estate loans.

Future Legislation and Regulation. Congress may enact legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of the proposed legislation could impact the regulatory structure under which the Company and the Bank operate and may significantly increase costs, impede the efficiency of internal business processes, require an increase in regulatory capital, require modifications to business strategy, and limit the ability to pursue business opportunities in an efficient manner. A change in statutes, regulations or regulatory policies applicable to the Company or the Bank could have a material, adverse effect on the business, financial condition and results of operations of the Company and the Bank. Future legislation, regulation, and government policy could affect the banking industry as a whole, including the business and results of operations of the Company and the Bank, in ways that are difficult to predict. The Company fully expects that the financial institution industry will remain heavily regulated in the near future and that additional laws or regulations may be adopted further regulating specific banking practices.

Wage and Hour Division, Department of Labor. On December 16, 2019, the Department of Labor issued a final rule, the rule updates a number of regulations on the calculation of overtime compensation both to provide clarity and to better reflect the 21st-century workplace. These changes will promote compliance with the FLSA, provide appropriate and updated guidance in an area of evolving law and practice, and encourage employers to provide additional and innovative benefits to workers without fear of costly litigation. This final rule was effective on January 15, 2020.

CARES Act. In response to the COVID-19 pandemic, President Trump signed into law the Coronavirus Aid, Relief, and Economic Security (“CARES”) Act on March 27, 2020. Among other things, the CARES Act included the Small Business Administration's Paycheck Protection Program. Under the Paycheck Protection Program, funds were authorized for small business loans to pay payroll and group health costs, salaries and commissions, mortgage and rent payments, utilities, and interest on other debt. The loans were provided through participating financial institutions, including the Bank, that processed loan applications and serviced the loans.

Item 1A. Risk Factors

The Company is subject to many risks that could adversely affect its future financial condition and performance and, therefore, the market value of its securities. The risk factors applicable to the Company include, but are not limited to the following:

Credit Risks

The Company’s concentration in loans secured by real estate may increase its credit losses, which would negatively affect our financial results.

At December 31, 2023, loans secured by real estate totaled $1.0 billion and represented 71.5% of the Company’s loan portfolio, net of net deferred loan costs and premiums. If we experience adverse changes in the local real estate market or in the local or national economy, borrowers’ ability to pay these loans may be impaired, which could impact the Company’s financial performance. The Company attempts to limit its exposure to this risk by applying good underwriting practices at origination, evaluating the appraisals used to establish property values, and routinely monitoring the financial condition of borrowers. If the value of real estate serving as collateral for the loan portfolio were to continue to decline materially, a significant part of the loan portfolio could become under-collateralized. If the loans that are secured by real estate become troubled when real estate market conditions are declining or have declined, in the event of foreclosure, the Company may not be able to realize the amount of collateral that was anticipated at the time of originating the loan. In that event, the Company might have to increase the provision for loan losses, which could have a material adverse effect on its operating results and financial condition.

An inadequate allowance for credit losses would reduce our earnings.

Our earnings are significantly affected by our ability to properly originate, underwrite and service loans. We maintain an allowance for credit losses on loans based upon many factors, including the following:

These determinations are based upon estimates that are inherently subjective, and their accuracy depends on the outcome of future events; therefore, realized losses may differ from current estimates. Changes in economic, operating, and other conditions, including changes in interest rates, which are generally beyond our control, could increase actual loan losses significantly. As a result, actual losses could exceed our current allowance estimate. We cannot provide assurance that our allowance for credit losses is sufficient to cover actual loan losses should such losses differ significantly from the current estimates.

Technology Risks

The Company’s operations may be adversely affected by cybersecurity risks.

In the ordinary course of business, the Company collects and stores sensitive data, including proprietary business information and personally identifiable information of its customers and employees in systems and on networks of the Company and its customers and third-party service providers. The secure processing, maintenance, and use of this information is critical to the Company's operations and business strategy. In addition, the Company relies heavily on communications and information systems to conduct its business. Any failure, interruption, or breach in security or operational integrity of these systems could result in failures or disruptions in the Company's customer relationship management, general ledger, deposit, loan, and other systems. The Company has invested in accepted technologies, and continually reviews processes and practices that are designed to protect its networks, computers, and data from damage or unauthorized access. To date, the Company has not experienced a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, but the Company’s

systems and those of its customers and third-party service providers are under constant threat and it is possible that the Company could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by the Company and its customers. The Company’s computer systems and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance, or other disruptions. A breach of any kind could compromise systems and the information stored there could be accessed, damaged, or disclosed. A breach in security or other failure could result in legal claims, regulatory penalties, disruption in operations, increased expenses, loss of customers and business partners, and damage to the Company’s reputation, which could adversely affect its business and financial condition. Furthermore, as cyber threats continue to evolve and increase, the Company may be required to expend significant additional financial and operational resources to modify or enhance its protective measures, or to investigate and remediate any identified information security vulnerabilities.

Failure to keep pace with technological change could adversely affect our business.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions and other firms to better serve customers and to reduce costs. The pace of these technological changes has increased in the “Fintech” environment, in which industry changing products and services are often introduced and adopted, including innovative ways that customers can make payments, access products, and manage accounts. Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology-driven products and services, which could entail significant time, resources and additional risk to develop or adopt, or be successful in marketing these products and services to our customers. Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse impact on our business and, in turn, our financial condition and results of operations.

Liquidity and Interest Rate Risks

The Company’s success depends upon its ability to manage interest rate risk.

The profitability of the Company depends significantly on its net interest income, which is the difference between the interest earned on loans, securities and other interest-earning assets, and the interest paid on deposits and borrowings. Changes in interest rates will affect the rates earned on securities and loans and rates paid on deposits and other borrowings. These factors include competition, federal economic, monetary and fiscal policies, and general economic conditions.

In addition, changes in interest rates may negatively affect both the returns on and market value of the Company’s investment securities. During 2022 and early 2023, the FRB increased the federal funds rate 11 times and has held such rates steady since July 2023. Interest rate changes can reduce unrealized gains or increase unrealized losses in its portfolio and thereby negatively impact its accumulated other comprehensive income and equity levels. Further, such losses could be realized into earnings should liquidity and/or business strategy necessitate the sales of securities in a loss position. Additionally, actual investment income and cash flows from investment securities that carry prepayment risk, such as mortgage-backed securities and callable securities, may materially differ from those anticipated at the time of investment or subsequently as a result of changes in interest rates and market conditions. These occurrences could have a material adverse effect on the Company’s net interest income or our results of operations.

The Company relies substantially on deposits obtained from customers in its target markets to provide liquidity and support growth.

The Company requires sufficient liquidity to fund asset growth, meet customer loan requests, customer deposit maturities and withdrawals, make payments on its debt obligations as they come due and other cash commitments. The Company’s business strategy is based primarily on access to funding from local customer deposits. Deposit levels may be affected by a number of factors, including interest rates paid by competitors, general interest rate levels, returns available to customers on alternative investments, changes in the liquidity needs of our depositors and general economic conditions that affect savings levels and the amount of liquidity in the economy, including government stimulus efforts in response to economic crises. If market interest rates rise or our competitors raise the rates they pay on deposits, the Company’s funding costs may increase, either because we raise our rates to avoid losing deposits or because we lose deposits and must rely on more expensive sources of funding. Either of these factors could reduce the Company’s net interest margin and net interest income and could have a material adverse effect on the Company’s business, financial condition, results of operations, liquidity and cash flows from operations.

Further, if local customer deposits are not sufficient to fund the Company’s normal operations and growth, we may rely on secondary sources of liquidity, such as borrowings from the Federal Home Loan Bank of Atlanta ("FHLB"), and federal funds lines of credit with larger institutions; however, there can be no assurance that these arrangements will be available to us when needed on favorable terms, or at all, or that they will be sufficient to meet future liquidity needs. For example, the Company’s ability to access borrowings from the FHLB will be dependent upon whether and the extent to which we can provide collateral to secure FHLB borrowings. In addition, the availability of these funding sources is highly dependent upon the perception of the liquidity and creditworthiness of the financial institution, and such perception can change quickly in response to market conditions or circumstances unique to a particular company. The Company also may need to raise funds through the issuance of shares of our debt or equity securities, or the sale of investment securities or loans, as additional sources of liquidity. If the Company is unable to access funding sufficient to support our business operations and growth strategies or are unable to access such funding on attractive terms, the Company may not be able to implement our business strategies or satisfy our obligations.

Market Risks

The Company’s success depends upon its ability to compete effectively in the banking industry.

The Company’s banking subsidiary faces competition from banks and other financial institutions, including savings and loan associations, savings banks, finance companies and credit unions for deposits, loans and other financial services in our market area. Certain divisions within the banking subsidiary face competition from wealth management and investment brokerage firms. A number of these banks and other financial institutions are significantly larger and have substantially greater access to capital and other resources, as well as larger lending limits and branch systems, and offer a wider array of banking services. In addition, the Company faces competition from market place lenders and other financial technology firms, which may provide competitive services quickly and in innovative ways and may have fewer regulatory constraints and lower cost structures. This competition may reduce or limit our margins and our market share and may adversely affect our results of operations and financial condition.

The Company could be adversely affected by economic conditions in its market area.

The Company’s branches are located in the counties of Clarke, Frederick, Fauquier, and Loudoun, the towns of Purcellville, Leesburg and Ashburn, and the City of Winchester. The Company also operates loan production offices in the counties of Fairfax (Virginia) as well as Frederick (Maryland). Because our lending is concentrated in these markets, we will be affected by the general economic conditions in these areas. Changes in the economy may influence the growth rate of our loans and deposits, the quality of the loan portfolio and loan and deposit pricing. Although the domestic and global economies have largely recovered from the COVID-19 pandemic, certain consequences of the pandemic continue to impact the macroeconomic environment and may persist for some time. For example, the COVID-19 pandemic could have long-lasting impacts certain industries due to changes in consumer behavior and business practices, including remote work and business travel. Further, the growth in economic activity and in the demand for goods and services, coupled with labor shortages, supply chain disruptions and other factors, has contributed to rising inflationary pressures, the Federal Reserve’s responsive interest rate hikes, and the risk of recession. A decline in general economic conditions caused by inflation, recession, unemployment or other factors beyond our control would impact the demand for banking products and services generally, which could negatively affect our financial condition and performance.

The soundness of other financial institutions could adversely affect us.

Our ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services institutions are interrelated as a result of trading, clearing, counterparty or other relationships. We have exposure to many different industries and counterparties, and we routinely execute transactions with counterparties in the financial industry. As a result, defaults by, or even rumors or questions about, one or more financial services institutions, or the financial services industry generally, have led to market-wide liquidity problems and could lead to losses or defaults by us or by other institutions. Many of these transactions expose us to credit risk in the event of default of our counterparty or client. In addition, our credit risk may be exacerbated when the collateral held by us cannot be realized upon or is liquidated at prices not sufficient to recover the full amount of the financial instrument exposure due us. There is no assurance that any such losses would not materially and adversely affect our results of operations.

In addition, financial challenges at other banking institutions could lead to depositor concerns that spread within the banking industry. In March 2023, Silicon Valley Bank and Signature Bank experienced large deposit outflows coupled with insufficient liquidity to meet withdrawal demands, resulting in the institutions being placed into FDIC receiverships. In the aftermath, there was substantial market disruption and concern that diminished depositor confidence could spread across the banking industry, leading to deposit outflows that could destabilize other institutions. While public confidence in the banking

system has stabilized, deposit outflows caused by reputational concerns or events affecting the banking industry generally could adversely affect the Company’s liquidity, financial condition, and results of operations.

Operational Risks

Our exposure to operational risk may adversely affect our business.

We are exposed to many types of operational risk, including reputational risk, legal and compliance risk, the risk of fraud or theft by employees or outsiders, unauthorized transactions by employees or operational errors, including clerical or record-keeping errors or those resulting from faulty or disabled computer or telecommunications systems.

Reputational risk, or the risk to our earnings and capital from negative public opinion, could result from our actual alleged conduct in any number of activities, including lending practices, corporate governance, regulatory compliance or the occurrence of any of the events or instances mentioned below, or from actions taken by government regulators or community organizations in response to that conduct. Negative public opinion could also result from adverse news or publicity that impairs the reputation of the financial services industry generally.

Further, if any of our financial, accounting, or other data processing systems fail or have other significant shortcomings, we could be adversely affected. We depend on internal systems and outsourced technology to support these data storage and processing operations. Our inability to use or access these information systems at critical points in time could unfavorably impact the timeliness and efficiency of our business operations. We could be adversely affected if one of our employees causes a significant operational break-down or failure, either as a result of human error or where an individual purposefully sabotages or fraudulently manipulates our operations or systems. We are also at risk of the impact of natural disasters, terrorism and international hostilities on our systems or for the effects of outages or other failures involving power or communications systems operated by others.

If any of the foregoing risks materialize, it could have a material adverse affect on our business, financial condition and results of operations.

The Company may not be able to successfully manage its growth or implement its growth strategy, which may adversely affect results of operations and financial condition.

A key component of the Company’s business strategy is to continue to grow and expand. The Company’s ability to grow and expand depends upon its ability to open new branch locations, attract new deposits to the existing and new branch locations, and identify attractive loan and investment opportunities. The Company may not be able to implement its growth strategy if it is unable to identify attractive markets or branch locations. Once identified, successfully managing growth will depend on integrating the new branch locations while maintaining adequate capital, cost controls and asset quality. As this growth strategy is implemented, the Company will incur construction costs and increased personnel, occupancy and other operating expenses. Because these costs are incurred before new deposits and loans are generated, adding new branch locations will initially decrease earnings, despite efficient execution of this strategy. In addition, the Company could experience difficulties expanding into new markets or product lines. The Company’s lack of history and familiarity with those markets, clients and lines of business may lead to unexpected challenges or difficulties that inhibit its success and adversely affect the Company’s results of operations.

Severe weather, natural disasters, acts of war or terrorism, geopolitical instability, public health issues, and other external events could significantly impact the Company's business.

Severe weather, natural disasters, acts of war or terrorism, geopolitical instability, public health issues, and other adverse external events could have a significant impact on the Company's ability to conduct business. In addition, such events could affect the stability of the Company’s deposit base, cause economic or market uncertainty, negatively impact consumer confidence, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue, and/or cause the Company to incur additional expenses. The Company is also at risk of the impact of natural disasters, terrorism, and international hostilities on its systems and from the effects of cyberattacks, outages or other failures involving power or communications systems operated by others, which may give rise to disruption of service to customers and to financial loss or liability. The occurrence of any such events in the future and the economic impact from such events could have a material adverse effect on the Company's business, which, in turn, could have a material adverse effect on its financial condition and results of operations.

The Company relies heavily on its senior management team and the unexpected loss of key officers could adversely affect operations.

The Company believes that its growth and success depends heavily upon the skills of its senior management team. The Company also depends on the experience of its subsidiary’s officers and on their relationships with the customers they serve. The loss of one or more of these officers could disrupt the Company’s operations and impair its ability to implement its business strategy, which could adversely affect the Company’s financial condition and performance.

Legal, Regulatory and Compliance Risks

Government measures to regulate the financial industry, including the Dodd-Frank Act, subject us to increased regulation and could adversely affect us.

As a financial institution, we are heavily regulated at the state and federal levels. These laws and regulations are generally intended to benefit consumers, borrowers and depositors, but not investors. Our success depends on our ability to maintain compliance with existing and new laws and regulations. We face, and expect to continue to face, increased public and legislative scrutiny as well as stricter and more comprehensive regulation of our financial services practices. The Dodd-Frank Act includes significant changes in the financial regulatory landscape and has increased our operations and compliance costs in the short-term. Future legislation, regulation and government policy, which are beyond our control, may change rapidly and unpredictably and could affect the banking industry as a whole, including our business and results of operations, in ways that are difficult to predict. We expect that financial institutions will remain heavily regulated in the near future and that additional laws or regulations may be adopted further regulating specific banking practices. As a result of the provisions in the Dodd-Frank Act and other current or future laws and regulations applicable to the Bank, we could experience additional costs, as well as limitations on the products and services we offer and on our ability to efficiently pursue business opportunities, which may adversely affect our businesses, financial condition or results of operations.

The Bank is subject to stringent capital and liquidity requirements as a result of the Basel III regulatory capital reforms and the Dodd-Frank Act.

The Bank is subject to capital adequacy guidelines and other regulatory requirements specifying minimum amounts and types of capital which it must maintain. From time to time, regulators implement changes to these regulatory capital adequacy guidelines. Under the Dodd-Frank Act, the federal banking agencies have established stricter capital requirements and leverage limits for banks and bank holding companies that are based on the Basel III regulatory capital reforms. The Basel III Capital Rules require banking organizations to maintain significantly more capital and adopted more demanding regulatory capital risk weightings and calculations. While the recently passed Economic Growth Act requires that federal banking regulators establish a simplified leverage capital framework for smaller banks, these more stringent capital requirements could, among other things, limit banking operations and activities, and growth of loan portfolios, in order to focus on retention of earnings to improve capital levels. The Bank believes that it maintains sufficient levels of Tier 1 and Common Equity Tier 1 capital to comply with the Basel III Final rules. However, if the Bank fails to meet these minimum capital guidelines and/or other regulatory requirements, the Bank could be subject to regulatory restrictions, including limitations on paying dividends to the holding company for shareholder dividends and share repurchases and paying discretionary bonuses, or experience other adverse consequences that could cause its financial condition to be materially and adversely affected.

Changes in accounting standards could impact reported earnings and capital.

The authorities that promulgate accounting standards, including the Financial Accounting Standards Board (the “FASB”), the SEC, and other regulatory authorities, periodically change the financial accounting and reporting standards that govern the preparation of the Company’s consolidated financial statements. These changes are difficult to predict and can materially impact how the Company records and reports its financial condition and results of operations. In some cases, the Company could be required to apply a new or revised standard retroactively, resulting in the restatement of financial statements for prior periods. Such changes could also impact the capital levels of the Bank, or require the Company to incur additional personnel or technology costs. Most notably, new guidance on the calculation of credit reserves using current expected credit losses, referred to as CECL, was finalized in June 2016. The standard was effective for the Company beginning January 1, 2023. To implement the new standard, the Company has and will incur costs related to data collection and documentation, technology and training. Upon implementation in 2023, the Company recognized a one-time cumulative effect adjustment to reduce retained earnings and increase the allowance for credit losses as well as the reserve for unfunded commitments as a result of adopting the CECL standard as further described in Note 1 to the Consolidated Financial Statements. If the Company is required to materially increase the level of the allowance for credit losses or incurs additional expenses to determine the appropriate level of the allowance for credit losses, such changes could adversely affect the Company’s capital levels, financial condition and results of operations.

Increasing scrutiny and evolving expectations from customers, regulators, investors, and other stakeholders with respect to environmental, social and governance (ESG) practices may impose additional costs on the Company or expose it to new or additional risks.

Companies are facing increasing scrutiny from customers, regulators, investors, and other stakeholders related to ESG practices and disclosure. Investor advocacy groups, investment funds, and influential investors are also increasingly focused on these practices, especially as they relate to climate risk, hiring practices, the diversity of the work force, and racial and social justice issues. Increased ESG related compliance costs could result in increases to the Company’s overall operational costs. Failure to adapt to or comply with regulatory requirements or investor or stakeholder expectations and standards could negatively impact the Company’s reputation, ability to do business with certain partners, and the Company’s stock price. New government regulations could also result in new or more stringent forms of ESG oversight and expanding mandatory and voluntary reporting, diligence, and disclosure.

Climate change and related legislative and regulatory initiatives may result in operational changes and expenditures that could significantly impact the Company’s business.

The current and anticipated effects of climate change are creating an increasing level of concern for the state of the global environment. As a result, political and social attention to the issue of climate change has increased. Federal and state legislatures and regulatory agencies have continued to propose and advance numerous legislative and regulatory initiatives seeking to mitigate the effects of climate change. The federal banking agencies have emphasized that climate-related risks are faced by banking organizations of all types and sizes and are in the process of enhancing supervisory expectations regarding banks’ risk management practices. In December 2021, the OCC published proposed principles for climate risk management by banking organizations with more than $100 billion in assets. The OCC also has appointed its first ever Climate Change Risk Officer and established an internal climate risk implementation committee in order to assist with these initiatives and to support the agency’s efforts to enhance its supervision of climate change risk management. Similar and even more expansive initiatives are expected, including potentially increasing supervisory expectations with respect to banks’ risk management practices, accounting for the effects of climate change in stress testing scenarios and systemic risk assessments, revising expectations for credit portfolio concentrations based on climate-related factors and encouraging investment by banks in climate-related initiatives and lending to communities disproportionately impacted by the effects of climate change. To the extent that these initiatives lead to the promulgation of new regulations or supervisory guidance applicable to the Company, the Company would likely experience increased compliance costs and other compliance-related risks.

In March 2024, the SEC issued new climate-related disclosure rules, which when effective, will require new climate-related disclosures in SEC filings and audited financial statements, including certain climate-related metrics and greenhouse gas emissions data, information about climate-related targets and goals, transition plans, if any, and attestation requirements. While the final rule was scaled-down from the original proposal and includes a phase-in period, these rules could impose increased costs.

The lack of empirical data surrounding the credit and other financial risks posed by climate change render it impossible to predict how specifically climate change may impact the Company’s financial condition and results of operations; however, the physical effects of climate change may also directly impact the Company. Specifically, unpredictable and more frequent weather disasters may adversely impact the value of real property securing the loans in the Bank’s loan portfolio. Additionally, if insurance obtained by borrowers is insufficient to cover any losses sustained to the collateral, or if insurance coverage is otherwise unavailable to borrowers, the collateral securing loans may be negatively impacted by climate change, which could impact the Company’s financial condition and results of operations. Further, the effects of climate change may negatively impact regional and local economic activity, which could lead to an adverse effect on customers and impact the communities in which the Company operates. Overall, climate change, its effects and the resulting, unknown impact could have a material adverse effect on the Company’s financial condition and results of operations.

Risks Relating to Our Securities

There can be no assurances concerning continuing dividend payments.

Our common stockholders are only entitled to receive the dividends declared by our Board of Directors. Although we have historically paid quarterly dividends on our common stock, there can be no assurances that we will be able to continue to pay regular quarterly dividends or an annual stock dividend or that any dividends we do declare will be in any particular amount. The primary source of money to pay our cash dividends comes from dividends paid to the Company by the Bank. The Bank’s ability to pay dividends to the Company is subject to, among other things, its earnings, financial condition and applicable

regulations, which in some instances limit the amount that may be paid as dividends. In addition, the Company and the Bank are required to maintain a capital conservation buffer of 2.5% of Common Equity Tier 1 Capital on top of minimum risk-weighted asset ratios to pay dividends without additional restrictions.

There is a limited trading market for our common shares, and you may not be able to resell your shares at or above the price you paid for them.

Although our common shares are listed for trading under the symbol “EFSI,” the trading in our common shares has substantially less liquidity than many other publicly traded companies. A public trading market having the desired characteristics of depth, liquidity and orderliness depends on the presence in the market of willing buyers and sellers of our common shares at any given time. This presence depends on the individual decisions of investors and general economic and market conditions over which we have no control. We cannot assure you that volume of trading in our common shares will increase in the future.

The stock market can be volatile, and fluctuations in our operating results and other factors could cause our stock price to decline.

The stock market has experienced, and may continue to experience, fluctuations that significantly impact the market prices of securities issued by many companies. Market fluctuations could adversely affect our stock price. These fluctuations have often been unrelated or disproportionate to the operating performance of particular companies. These broad market fluctuations, as well as general economic, systemic, political and market conditions, such as recessions, loss of investor confidence, interest rate changes, tariffs, government shutdowns, or international currency fluctuations, may negatively affect the market price of our common stock. Moreover, our operating results may fluctuate and vary from period to period due to the risk factors set forth herein. As a result, period-to-period comparisons should not be relied upon as an indication of future performance. Our stock price could fluctuate significantly in response to our quarterly or annual results, annual projections, and the impact of these risk factors on our operating results or financial position.

Item 1B. Unresolved Staff Comments

None.

Item 1C. Cybersecurity

Risk Management and Strategy

Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. To mitigate these risks and protect sensitive customer data, financial transactions, and our information systems, the Company has implemented a comprehensive Information Security Program (“Program”) which is a component of its overarching enterprise risk management program. The Program is achieved through a collaborative effort involving operations, technology, compliance, risk, and senior management. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential cyber threats.

Key components of the risk management program include:

Governance and Oversight

The Board of Directors, including its Risk Subcommittee provides oversight of Company cybersecurity risks. The Board of Directors receives periodic reports on cybersecurity threats, awareness training, and key risk indicators related to cybersecurity. Additionally, the Company’s Audit Committee provides oversight as it relates to annual audits related to information technology and cybersecurity. Management promptly reviews results of these audits to initiate necessary remediation, which are then reviewed by the Audit Committee.

The Board of Directors has designated the Security Committee and Incident Response Team with responsibilities related to information security and cybersecurity.

The Security Committee is a management committee with representation from operations, technology, compliance, risk, and senior management. The Security Committee monitors, reviews, and makes necessary changes to the Information Security Program. This Committee provides accountability for policies and procedures and reviews incidents that may affect information security.

The Incident Response Team has overall authority and responsibility for preparing and responding to incidents and consists of various sub-teams including representation from operations, technology, risk, compliance, human resources, and marketing. While key personnel have identified roles, this team ensures appropriate reports, statuses, and decisions are presented to the Executive Management and the Board of Directors.

The Company’s Chief Technology Officer (“CTO”) oversees the Company’s information technology programs and investments. The Company’s CTO has over 30 years of information technology experience. The Company’s Compliance and Security Officer, who oversees the Company’s information security programs, has over 10 years of experience and reports to the Chief Operating Officer. The Compliance and Security Officer is designated as the program coordinator responsible for coordinating and overseeing the Information Security Program.

Material Effects of Cybersecurity Threats

While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including because of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company’s cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company’s controls are, it will not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner.

For more information on how cybersecurity risk may materially affect the Company’s business strategy, results of operations or financial condition, refer to Item 1A, Risk Factors of this Form 10-K.

Item 2. Properties

The Company owns or leases buildings which are used in normal business operations. The Company’s corporate headquarters, and that of Bank of Clarke, is located at 2 East Main Street, Berryville, Virginia, 22611. At December 31, 2023, Bank of Clarke operated thirteen full-service branches, one loan production office, and one drive-through only facility in the Virginia communities of Berryville, Winchester, Boyce, Stephens City, Purcellville, Warrenton, Leesburg, Ashburn and Fairfax. The Bank also operated one loan production office in the Maryland community of Frederick. See Note 1 “Nature of Banking Activities and Significant Accounting Policies” and Note 6 “Bank Premises and Equipment, Net” and Note 13 "Leases" in the “Notes to the Consolidated Financial Statements” of this Form 10-K for information with respect to the amounts at which bank premises and equipment are carried and commitments under long-term leases.

All of the Company’s properties are well maintained, are in good operating condition and are adequate for the Company’s present and anticipated future needs.

Item 3. Legal Proceedings

There are no material pending legal proceedings to which the Company is a party or of which the property of the Company is subject.

Item 4. Mine Safety Disclosures

None.

PART II

Item 5. Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities

The Company’s common stock is quoted on the OTC Markets Group's OTCQX Market under the symbol “EFSI.” The OTC Markets Group provides information about the common stock to professional market makers who match sellers with buyers. Securities brokers can obtain information from the OTC Markets Group when working with clients. When a client decides to initiate a transaction, the broker will contact one of the stock’s market makers. Any over-the-counter market quotations in the Company’s common stock reflect inter-dealer prices, without retail mark-up, mark-down or commission and may not necessarily represent actual transactions.

As of March 22, 2024, the Company had approximately 868 shareholders of record.

The Company has historically paid dividends on a quarterly basis. The final determination of the timing, amount and payment of dividends on the Common Stock is at the discretion of the Company’s Board of Directors. Some of the factors affecting the payment of dividends on the Company’s common stock are operating results, financial condition, capital adequacy, regulatory requirements and shareholders returns.

Issuer Purchases of Equity Securities for the Quarter Ended December 31, 2023

On June 21, 2023, the Corporation renewed the stock repurchase program to repurchase up to 150,000 shares of its common stock prior to June 30, 2024. During 2023, the Company purchased 8,531 shares of its Common Stock under its stock repurchase program at an average price of $35.34.

The following table details the Company's purchases of its common stock during the fourth quarter pursuant to the stock repurchase program discussed above.

Item 6. Reserved

Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operation

The purpose of this discussion is to focus on the important factors affecting the financial condition, results of operations, liquidity and capital resources of Eagle Financial Services, Inc. (the “Company”). This discussion should be read in conjunction with the Company’s Consolidated Financial Statements and the Notes to the Consolidated Financial Statements presented in Item 8, Financial Statements and Supplementary Data, of this Form 10-K.

GENERAL

The Company is a bank holding company which owns 100% of the stock of Bank of Clarke (the “Bank”). Accordingly, the results of operations for the Company are dependent upon the operations of the Bank. The Bank conducts a commercial banking business which consists of attracting deposits from the general public and investing those funds in commercial, consumer and real estate loans and corporate, municipal and U.S. government agency securities. The Bank also operates a wealth management division, which provides both a full-service trust department and a separate brokerage area. The Bank’s deposits are insured by the Federal Deposit Insurance Corporation to the extent permitted by law. At December 31, 2023, the Company had total assets of $1.83 billion, net loans of $1.45 billion, total deposits of $1.51 billion and shareholders’ equity of $108.4 million. The Company’s net income was $9.4 million for the year ended December 31, 2023.

The following table presents selected financial data, which was derived from the Company’s audited financial statements for the periods indicated.