NASDAQ: NWFL

The Company’s main office is located at 717 Main Street, Honesdale, Pennsylvania and its main telephone number is (570) 253-1455. The Company maintains a website at wayne.bank. Information on our website should not be treated as part of this Annual Report on Form 10-K. The Company makes copies of its Securities and Exchange Commission (“SEC”) filings available free of charge as soon as reasonably practicable after they are filed through a link on its website to the SEC’s website.

Completed Acquisitions

UpState New York Bancorp, Inc. On July 7, 2020, the Company completed the acquisition of UpState New York Bancorp, Inc. (“UpState”), and its wholly owned subsidiary, USNY Bank (“USNY Bank”). The acquisition was completed when UpState was merged with and into the Company, with the Company as the surviving corporation of the merger and USNY Bank was merged with and into Wayne Bank, with Wayne Bank as the surviving entity. At the time of completion of the acquisition, USNY Bank conducted its business from two Bank of the Finger Lakes offices in Geneva and Penn Yan, New York, and two Bank of Cooperstown offices in Cooperstown and Oneonta, New York.

In the merger, shareholders of UpState elected to receive for each share of UpState common stock they owned, either 0.9390 shares of the Company’s common stock or $33.33 in cash, or a combination of both. All shareholder elections were subject to the allocation and proration procedures set forth in the Merger Agreement which were intended to ensure that 90% of the shares of UpState would be exchanged for the Company’s common stock and 10% of the shares of UpState would be exchanged for cash. In addition, under the terms of the Merger Agreement, UpState shareholders received an additional $0.67 per share in cash for each share of UpState common stock held. In the aggregate, the merger consideration paid to UpState shareholders consisted of approximately $8,845,198 in cash and 1,865,738 shares of the Company’s common stock.

Delaware Bancshares, Inc. On July 31, 2016, the Company completed the acquisition of Delaware Bancshares, Inc. (“Delaware”) and its wholly owned subsidiary, The National Bank of Delaware County (“NBDC”). At the time of acquisition, Delaware had approximately $375.6 million in assets and 12 banking offices in Delaware and Sullivan Counties, New York. Pursuant to the terms of the Agreement and Plan of Merger, dated March 10, 2016, by and among the Company, Wayne Bank, Delaware and NBDC (the “Delaware Agreement”), Delaware was merged with and into the Company, with the Company as the surviving corporation of the merger (the “Merger”) and NBDC was merged with and into Wayne Bank immediately thereafter. At the effective time of the Merger, each outstanding share of the common stock of Delaware was converted, at the election of the holder but subject to the limitations and allocation and proration provisions set forth in the Delaware Agreement, into either $16.68 in cash or 0.6221 of a share of the Company’s common stock, par value $0.10 per share (the “Common Stock”). In the aggregate, the merger consideration paid to Delaware shareholders consisted of approximately $3,860,000 in cash and 431,605 shares of the Common Stock.

2

North Penn Bancorp, Inc.

On May 31, 2011, the Company completed the acquisition of North Penn Bancorp, Inc. (“North Penn”) and its wholly owned subsidiary, North Penn Bank. At the time of acquisition, North Penn had approximately $158.9 million in assets and four banking offices in Lackawanna and Monroe Counties, Pennsylvania. Pursuant to the terms of the Agreement and Plan of Merger by and among the Company, Wayne Bank, and North Penn, North Penn was merged with and into the Company, with the Company as the surviving corporation of the merger (the “Merger”) and North Penn Bank was merged with and into Wayne Bank immediately thereafter. At the effective time of the Merger, each outstanding share of the common stock of North Penn was converted, at the election of the holder but subject to the limitations and allocation and proration provisions set forth in the Merger Agreement, into either $19.12 in cash or 0.6829 of a share of the Company’s common stock, par value $0.10 per share (the “Common Stock”). In the aggregate, the merger consideration paid to North Penn shareholders consisted of approximately $10,648,000 in cash and 530,994 shares of the Common Stock.

Competition

The competition for deposit products comes from other insured financial institutions such as commercial banks, thrift institutions, credit unions, and multi-state regional banks in the Company’s market area of Wayne, Pike, Monroe, Lackawanna and Luzerne Counties, Pennsylvania and Delaware, Sullivan, Ontario, Otsego and Yates Counties, New York as well as from on-line banks. Based on data compiled by the FDIC as of June 30, 2025 (the latest date for which such data is available), the Bank had the third largest share of FDIC-insured deposits in Wayne County with approximately 22.50%, the second largest share in Pike County with 17.76%, sixth largest share in Monroe County with 3.89%, the tenth largest share in Lackawanna County with 1.19% and the sixteenth largest share in Luzerne County with 0.42%. At June 30, 2025, the Bank had the largest share of FDIC-insured deposits in Delaware County, New York, with 31.39% and the fourth largest share in Sullivan County, New York, with 12.45%. The Bank’s market share in Ontario, Otsego and Yates Counties were 5.87%, 14.87% and 18.52%, respectively. This data does not reflect deposits held by credit unions with which the Bank also competes. Deposit competition also includes a number of insurance products sold by local agents and investment products such as mutual funds and other securities sold by local and regional brokers. Loan competition varies depending upon market conditions and comes from other insured financial institutions such as commercial banks, thrift institutions, credit unions, multi-state regional banks, and mortgage bankers.

Personnel

As of December 31, 2025, the Bank had 275 full-time and six part-time employees. None of the Bank’s employees are represented by a collective bargaining group.

Trust Activities

The Bank operates a Wealth Management/Trust Department which provides estate planning, investment management and financial planning to customers for which it is generally compensated based on a percentage of assets under management. As of December 31, 2025, the Bank had $213.9 million of assets under management compared to $205.1 million as of December 31, 2024. The increase reflects growth and improved market valuations during 2025, such as stock market performance which can affect the value of a customer’s investment portfolio.

Subsidiary Activities

The Bank, a Pennsylvania chartered bank, is the only wholly owned subsidiary of the Company. Norwood Investment Corp. (“NIC”), a Pennsylvania corporation incorporated in 1996 and a Pennsylvania licensed insurance agency, is a wholly owned subsidiary of the Bank. NIC’s business is brokerage activities including stocks, bonds, mutual funds, exchange traded funds and advisory services, as well as annuity and insurance products, primarily to customers of the Bank. The annuities, mutual funds and other investment products are not insured by the FDIC or any other government agency. They are not deposits, obligations of, or guaranteed by any bank. Until February 16, 2018, securities were offered through Invest Financial, a registered broker/dealer. Effective February 16, 2018, the broker/dealer relationship transitioned to LPL Financial LLC (“LPL”) as a result of the sale of Invest to LPL in 2017. LPL is a registered broker/dealer and a member of FINRA and the SIPC. NIC generated gross revenues for the Company of $708,000 and $407,000 in 2025 and 2024, respectively, which is included in Other Income.

WCB Realty Corp., a Pennsylvania corporation, is a wholly owned real estate subsidiary of the Bank whose principal asset is the administrative offices of the Company, which also includes the Main Office of the Bank.

WTRO Properties Inc. (“WTRO”), a Pennsylvania corporation, is a wholly owned real estate subsidiary of the Bank established to hold title to certain real estate upon which the Bank has foreclosed. As of December 31, 2025 and 2024, the outstanding balance of foreclosed properties on which WTRO held title totaled $0 and $0, respectively.

3

Regulation

Set forth below is a brief description of certain laws which relate to the regulation of the Company and the Bank. The description does not purport to be complete and is qualified in its entirety by reference to applicable laws and regulations.

Regulation of the Company

General. The Company, as a bank holding company registered under the Bank Holding Company Act of 1956, as amended (“BHCA”), is subject to regulation and supervision by the Federal Reserve. The Company is required to file periodic reports of its operations with, and is subject to examination by, the Federal Reserve. This regulation and oversight is generally intended to ensure that the Company limits its activities to those allowed by law and that it operates in a safe and sound manner without endangering the financial health of its subsidiary bank.

Under the BHCA, the Company generally must obtain the prior approval of the Federal Reserve before it may acquire control of another bank or bank holding company, merge or consolidate with another bank holding company, acquire all or substantially all of the assets of another bank or bank holding company, or acquire direct or indirect ownership or control of any voting shares of any bank or bank holding company if, after such acquisition, the Company would directly or indirectly own or control more than 5% of such shares.

Federal statutes impose restrictions on the ability of a bank holding company and its nonbank subsidiaries to obtain extensions of credit from its subsidiary bank, on the subsidiary bank’s investments in the stock or securities of the holding company, and on the subsidiary bank’s taking of the holding company’s stock or securities as collateral for loans to any borrower. A bank holding company and its subsidiaries are also prevented from engaging in certain tying arrangements in connection with any extension of credit, lease or sale of property, or furnishing of services by the subsidiary bank.

Source of Strength Doctrine. Under the Bank Holding Company Act, a bank holding company is required to serve as a source of financial and managerial strength to its subsidiary banks and may not conduct its operations in an unsafe or unsound manner. Under this source of strength doctrine, a bank holding company should stand ready to use available resources to provide adequate capital to its subsidiary banks during periods of financial stress or adversity and should maintain the financial flexibility and capital-raising capacity to obtain additional resources for assisting its subsidiary banks. A bank holding company’s failure to meet its obligations to serve as a source of strength to its subsidiary banks will generally be considered by the Federal Reserve to be an unsafe and unsound banking practice or a violation of the Federal Reserve regulations, or both.

Non-Banking Activities. The business activities of the Company, as a bank holding company, are restricted by the BHCA. Under the BHCA and the Federal Reserve’s bank holding company regulations, a bank holding company generally may only engage in, or acquire or control voting securities or assets of a company engaged in, (1) banking or managing or controlling banks and other subsidiaries authorized under the BHCA and (2) any business activity the Federal Reserve has determined to be so closely related to banking or managing or controlling banks to be a proper incident thereto. These include any incidental activities necessary to carry on those activities, as well as a lengthy list of activities that the Federal Reserve has determined to be so closely related to the business of banking as to be a proper incident thereto.

In addition to the above authority, bank holding companies that qualify and elect to be treated as “financial holding companies” may engage in a broad range of additional activities that are (i) financial in nature or incidental to such financial activities or (ii) complementary to a financial activity and do not pose a substantial risk to the safety and soundness of depository institutions or the financial system generally. These activities include securities underwriting and dealing, insurance agency and underwriting, and making merchant banking investments. The Company has not made an election to be deemed a financial holding company.

Regulatory Capital Requirements. The Federal Reserve has adopted regulatory capital rules pursuant to which it assesses the adequacy of capital in examining and supervising a bank holding company and in analyzing applications to it under the BHCA. The Federal Reserve’s capital rules are similar to those imposed on the Bank by the FDIC. See “Regulation of the Bank-Regulatory Capital Requirements.” The Federal Reserve’s Small Bank Holding Company Policy Statement, however, exempts from the regulatory capital requirements bank holding companies with less than $3.0 billion in consolidated assets that are not engaged in significant non-banking or off-balance sheet activities and that do not have a material amount of debt or equity securities registered with the SEC. As long as their bank subsidiaries are well capitalized, such bank holding companies need only maintain a pro forma debt to equity ratio of less than 1.0 in order to pay dividends and repurchase stock and to be eligible for expedited treatment on applications.

Regulation of the Bank

General. As a Pennsylvania chartered, FDIC-insured commercial bank which is not a member of the Federal Reserve System, the Bank is subject to extensive regulation and examination by the Department and by the FDIC, which insures its deposits to the maximum extent permitted by law. The federal and state laws and regulations applicable to banks regulate, among other things, the scope of their business, their investments, the reserves required to be kept against deposits, the timing of the availability of deposited

4

funds and the nature and amount of and collateral for certain loans. The laws and regulations governing the Bank generally have been promulgated to protect depositors and not for the purpose of protecting stockholders. This regulatory structure also gives the federal and state banking agencies extensive discretion in connection with their supervisory and enforcement activities and examination policies, including policies with respect to the classification of assets and the establishment of adequate loan loss reserves for regulatory purposes. Any change in such regulation, whether by the Department, the FDIC or the United States Congress, could have a material impact on the Company, the Bank and their operations.

Pennsylvania Banking Law. The Pennsylvania Banking Code (“Banking Code”) contains detailed provisions governing the organization, location of offices, rights and responsibilities of directors, officers, and employees, as well as corporate powers, savings and investment operations and other aspects of the Bank and its affairs. The Banking Code delegates extensive rule-making power and administrative discretion to the Department so that the supervision and regulation of state-chartered banks may be flexible and readily responsive to changes in economic conditions and in savings and lending practices.

The Federal Deposit Insurance Act (“FDIA”), however, prohibits state-chartered banks from making new investments, loans, or becoming involved in activities as principal and equity investments which are not permitted for national banks unless (1) the FDIC determines the activity or investment does not pose a significant risk of loss to the Deposit Insurance Fund and (2) the bank meets all applicable capital requirements. Accordingly, the additional operating authority provided to the Bank by the Banking Code is significantly restricted by the FDIA.

Interstate Banking. The Bank operates branches in Pennsylvania and New York. Under the federal Riegle-Neal Interstate Banking and Branching Efficiency Act (the “Riegle-Neal Act”), an insured state bank that establishes a branch in another state may conduct any activity at such branch that is permissible under the laws of its home state to the extent that such activity is permissible either for a bank chartered by the host state or for a branch of an out-of-state national bank in the host state. The laws of the host state, including laws regarding community reinvestment, consumer protection, fair lending and branching within the host state, apply to any branch of an out-of-state bank to the same extent as such laws apply to a branch of an out-of-state national bank. The Riegle-Neal Act prohibits out-of-state banks from using their interstate branches primarily for purposes of deposit production. If a federal banking regulator reasonably determines from available information that an out-of-state bank’s level of lending in a host state is less than half the loan-to-deposit ratio for all banks in the host state, the regulator may order the closure of the out-of-state branches or prohibit the opening of new branches in the host state unless the out-of-state bank has an acceptable plan or can give reasonable assurances that it will reasonably help meet the credit needs of the communities served in the host state.

Federal Deposit Insurance. The Bank’s deposits are insured to applicable limits by the FDIC. The general maximum deposit insurance amount is $250,000.

The Bank is subject to deposit insurance assessments established by the FDIC to maintain the DIF. Under the FDIC’s risk-based assessment system, banks that are deemed to be less risky pay lower assessments. Assessment rates for small institutions (those with less than $10 billion in assets) are based on an institution’s weighted average CAMELS component ratings and certain financial ratios and are applied to the institution’s assessment base, which equals its average total assets minus its average tangible equity.

In October 2022, the FDIC adopted a final rule that increased the initial base deposit insurance assessment rate schedules uniformly by 2 basis points beginning with the first quarterly assessment period of 2023. The increased assessment is expected to improve the likelihood that the DIF reserve ratio would reach the statutory minimum of 1.35% by the statutory deadline of September 30, 2028, consistent with the FDIC’s amended restoration plan. The FDIC assessment rates effective January 1, 2023 (which are subject to certain adjustments) range from 5 to 18 basis points for institutions with CAMELS composite ratings of 1 or 2, 8 to 32 basis points for those with a CAMELS composite score of 3, and 18 to 32 basis points for those with CAMELS composite scores of 4 or 5.

Regulatory Capital Requirements. The Bank is required to comply with applicable capital adequacy rules adopted by the FDIC and other federal bank regulatory agencies (the “Basel III Capital Rules”). The Basel III Capital Rules apply to all depository institutions as well as to all top-tier bank and savings and loan holding companies that are not subject to the Federal Reserve Small Bank Holding Company Policy Statement.

Under the Basel III Capital Rules, banks are required to meet four minimum capital standards: (1) a “Tier 1” or “core” capital leverage ratio equal to at least 4% of total adjusted assets; (2) a common equity Tier 1 capital ratio equal to 4.5% of risk-weighted assets; (3) a Tier 1 risk-based ratio equal to 6% of risk-weighted assets; and (4) a total capital ratio equal to 8% of total risk-weighted assets. Common equity Tier 1 capital is defined as common stock instruments, retained earnings, any common equity Tier 1 minority interest and, unless the bank has made an “opt-out” election, accumulated other comprehensive income, net of goodwill and certain other intangible assets. Tier 1 or core capital is defined as common equity Tier 1 capital plus certain qualifying subordinated interests and grandfathered capital instruments. Total capital consists of Tier 1 capital plus Tier 2 or supplementary capital items, which include allowances for loan losses in an amount of up to 1.25% of risk-weighted assets, qualifying subordinated instruments and certain grandfathered capital instruments. An institution’s risk-based capital requirements are measured against risk-weighted assets, which equal the sum of each on-balance-sheet asset and the credit-equivalent amount of each off-balance-sheet item after being multiplied by an assigned risk weight. Risk weightings range from 0% for cash to 100% for property acquired through foreclosure, commercial loans,

5

and certain other assets to 150% for exposures that are more than 90 days past due or are on nonaccrual status and certain commercial real estate facilities that finance the acquisition, development or construction of real property.

In addition to the above minimum requirements, the Basel III Capital Rules require banks and covered financial institution holding companies to maintain a capital conservation buffer of at least 2.5% of risk-weighted assets over and above the minimum risk-based capital requirements. Institutions that do not maintain the required capital buffer will become subject to progressively more stringent limitations on the percentage of earnings that can be paid out in dividends or used for stock repurchases and on the payment of discretionary bonuses to senior executive management. The capital buffer requirement effectively raises the minimum required risk-based capital ratios to 7% for Common Equity Tier 1 Capital, 8.5% for Tier 1 Capital and 10.5% for Total Capital on a fully phased-in basis.

In assessing an institution’s capital adequacy, the FDIC takes into consideration not only these numeric factors but also qualitative factors, and has the authority to establish higher capital requirements for individual institutions where necessary.

The Bank is also subject to minimum capital requirements imposed by the Department on Pennsylvania-chartered depository institutions. Under the Department’s capital requirements, a Pennsylvania bank or savings bank must maintain a minimum leverage ratio of Tier 1 capital (as defined under the FDIC’s capital regulations) to total assets of 4%. In addition, the Department has the supervisory discretion to require higher leverage ratio for any institutions based on the institution’s substandard performance in any of a number of areas. The Bank was in compliance with both the FDIC and the Pennsylvania capital requirements in effect as of December 31, 2025.

Prompt Corrective Regulatory Action. Under applicable federal statutes, the federal bank regulatory agencies are required to take “prompt corrective action” with respect to institutions that do not meet specified minimum capital requirements. For these purposes, the law establishes five capital categories: well capitalized, adequately capitalized, undercapitalized, significantly undercapitalized and critically undercapitalized. Under the FDIC’s prompt corrective action regulations, an institution is deemed to be “well capitalized” if it has a Total Risk-Based Capital Ratio of 10.0% or greater, a Tier 1 Risk-Based Capital Ratio of 8.0% or greater, a Common Equity Tier 1 risk-based capital ratio of 6.5% or better and a leverage ratio of 5.0% or greater.

An institution is “adequately capitalized” if it has a Total Risk-Based Capital Ratio of 8.0% or greater, a Tier 1 Risk-Based Capital Ratio of 6.0% or greater, a Common Equity Tier 1 Capital Ratio of 4.5% or better and a Leverage Ratio of 4.0% or greater. An institution is “undercapitalized” if it has a Total Risk-Based Capital Ratio of less than 8.0%, a Tier 1 Risk-Based Capital ratio of less than 6.0%, a Common Equity Tier 1 ratio of less than 4.5% or a Leverage Ratio of less than 4.0%. An institution is deemed to be “significantly undercapitalized” if it has a Total Risk-Based Capital Ratio of less than 6.0%, a Tier 1 Risk-Based Capital Ratio of less than 4.0%, a Common Equity Tier 1 ratio of less than 3.0% or a Leverage Ratio of less than 3.0%. An institution is considered to be “critically undercapitalized” if it has a ratio of tangible equity to total assets that is equal to or less than 2.0%

The prompt corrective action regulations provide for the imposition of a variety of requirements and limitations on institutions that fail to meet the above capital requirements. In particular, the FDIC may require any state non-member bank that is not “adequately capitalized” to take certain action to increase its capital ratios. If the non-member bank’s capital is significantly below the minimum required levels of capital or if it is unsuccessful in increasing its capital ratios, the bank’s activities may be restricted.

At December 31, 2025, the Bank qualified as “well capitalized” under the prompt corrective action rules.

Affiliate Transaction Restrictions. Federal laws strictly limit the ability of banks to engage in transactions with their affiliates, including their bank holding companies. In particular, loans by a subsidiary bank and its parent company or the nonbank subsidiaries of the bank holding company are limited to 10% of a bank subsidiary’s capital and surplus and, with respect to such parent company and all such nonbank subsidiaries, to an aggregate of 20% of the bank subsidiary’s capital and surplus. Further, loans and other extensions of credit generally are required to be secured by eligible collateral in specified amounts. Transactions with non-affiliates may be treated as transactions with an affiliate to the extent that proceeds from the transaction are used to benefit the affiliate. Federal law also requires that all transactions between a bank and its affiliates be on terms at least as favorable to the bank as transactions with non-affiliates.

Loans to One Borrower. Under Pennsylvania law, commercial banks have, subject to certain exemptions, lending limits to one borrower in an amount equal to 15% of the institution’s capital accounts. An institution’s capital account includes the aggregate of all capital, surplus, undivided profits, capital securities and general reserves for loan losses. Pursuant to the national bank parity provisions of the Pennsylvania Banking Code, the Bank may also lend up to the maximum amounts permissible for national banks, which are allowed to make loans to one borrower of up to 25% of capital and surplus in certain circumstances. As of December 31, 2025, the Bank’s loans-to-one-borrower limitation was $34.3 million and the Bank was in compliance with such limitation.

Federal Home Loan Bank System. The Bank is a member of the FHLB of Pittsburgh, which is one of 11 regional FHLBs. Each FHLB serves as a reserve or central bank for its members within its assigned region. It is funded primarily from funds deposited by member institutions and proceeds from the sale of consolidated obligations of the FHLB System. It makes loans to members (i.e., advances) in accordance with policies and procedures established by the Board of Directors of the FHLB.

6

As a member, the Bank is required to purchase and maintain restricted stock in the FHLB of Pittsburgh in an amount equal to the greater of 1% of its aggregate unpaid residential mortgage loans, home purchase contracts or similar obligations at the beginning of each year or 5% of the Bank’s outstanding advances from the FHLB. At December 31, 2025, the Bank was in compliance with this requirement.

Restrictions on Dividends. The Pennsylvania Banking Code states, in part, that dividends may be declared and paid only out of accumulated net earnings and may not be declared or paid unless surplus (retained earnings) is at least equal to contributed capital. The Bank has not declared or paid any dividends which cause the Bank’s retained earnings to be reduced below the amount required. Finally, dividends may not be declared or paid if the Bank is in default in payment of any assessment due the FDIC.

The Federal Reserve has issued a policy statement on the payment of cash dividends by bank holding companies, which expresses the Federal Reserve’s view that a bank holding company should pay cash dividends only to the extent that the holding company’s net income for the past year is sufficient to cover both the cash dividends and a rate of earnings retention that is consistent with the holding company’s capital needs, asset quality and overall financial condition. The Federal Reserve also indicated that it would be inappropriate for a company experiencing serious financial problems to borrow funds to pay dividends. In addition, the Federal Reserve’s guidance states that a bank holding company should consult with its regional Federal Reserve Bank in advance of declaring or paying a dividend that exceeds earnings for the period for which the dividend is being paid or that could result in a material adverse change to the organization’s capital structure. Finally, under the federal prompt corrective action regulations, the Federal Reserve may prohibit a bank holding company from paying any dividends if the holding company’s bank subsidiary is classified as “undercapitalized.”

Community Reinvestment. All insured depository institutions have a responsibility under the Community Reinvestment Act of 1977 (the “CRA”) and federal regulations thereunder to help meet the credit needs of their communities, including low- and moderate-income neighborhoods. In connection with its examination of the Bank, the FDIC is required to assess our record of meeting the credit needs of our entire community. The CRA requires the Bank’s record of compliance with the CRA to be taken into account in the evaluation of applications by the Bank or the Company for approval of an expansionary proposal, such as a merger or other acquisition of another bank or the opening of a new branch office. The Bank received a “satisfactory” CRA rating in its most recent CRA performance evaluation by the FDIC in August 2025.

In May 2022, the FDIC and the other federal bank regulatory agencies issued a joint proposal to modernize the regulations implementing the CRA, which would change both the process and substantive tests that the regulators use to assess the record of each bank in fulfilling its obligation to the community. The regulatory agencies stated that the proposal is intended to achieve the following objectives: (i) expand access to credit, investment and basic banking services in low- and moderate-income communities, (ii) adapt to changes in the banking industry, including internet and mobile banking, (iii) provide greater clarity, consistency and transparency in the application of the regulations and (iv) tailor performance standards to account for differences in bank size, business model, and local conditions. The Company will evaluate the impact of the proposal’s potential changes to the regulations implementing the CRA and their impact to our financial condition and/or results of operations, which cannot be predicted at this time.

Bank Secrecy Act / Anti-Money Laundering Laws. The Bank is subject to the Bank Secrecy Act and other anti-money laundering laws and regulations, including the USA PATRIOT Act of 2001 and the Anti-Money Laundering Act of 2020. These laws and regulations require the Bank to implement policies, procedures, and controls to detect, prevent, and report money laundering and terrorist financing and to verify the identity of their customers. Violations of these requirements can result in substantial civil and criminal sanctions. In addition, provisions of the USA PATRIOT Act require the federal bank regulatory agencies to consider the effectiveness of a bank’s anti-money laundering activities when reviewing mergers and acquisitions.

Privacy Regulations and Cybersecurity. Federal regulations generally require that the Bank disclose its privacy policy, including identifying with whom it shares a customer’s “non-public personal information,” to customers at the time of establishing the customer relationship and annually thereafter. In addition, the Bank is required to provide its customers with the ability to “opt-out” of having their personal information shared with unaffiliated third parties and not to disclose account numbers or access codes to non-affiliated third parties for marketing purposes. The Bank currently has a privacy protection policy in place and believes that such policy is in compliance with the regulations.

In November 2021, the federal bank regulatory agencies issued a final rule requiring banking organizations to notify their primary federal regulator as soon as possible and no later than 36 hours of determining that a “computer-security incident” that rises to the level of a “notification incident,” as those terms are defined in the final rule, has occurred. A notification incident is a “computer-security incident” that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. The final rule also requires bank service providers to notify any affected bank to or on behalf of which the service provider provides services “as soon as possible” after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for four or more hours

7

Incentive Compensation. The FDIC and the Federal Reserve review, as part of their regular, risk-focused examinations, the incentive compensation arrangements of banking organizations. These reviews are tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. Deficiencies are incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

In 2010, the FDIC and the other federal bank regulatory agencies issued comprehensive guidance on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, is based upon the principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

In 2016, the U.S. financial regulators, including the FDIC, the Federal Reserve and the SEC, proposed revised rules on incentive-based payment arrangements at financial institutions having at least $1 billion in total assets. These proposed rules have not been finalized.

In October 2023, Nasdaq adopted listing standards requiring listed companies to adopt policies providing for the recovery or “clawback” of excess incentive-based compensation earned by current or former executive officers during the three fiscal years preceding the date the listed company determines an accounting restatement is required. The Company adopted a clawback policy compliant with the new Nasdaq listing standard, effective October 2, 2023.