RISKS RELATED TO OUR BUSINESS

Our profitability depends significantly on local economic conditions.

Our success depends primarily on the general economic conditions of the primary markets in Virginia in which we operate and where our loans are concentrated. Unlike nationwide banks that are more geographically diversified, the Company provides banking and financial services to customers primarily in the Lynchburg metropolitan statistical area (“MSA”). Lynchburg’s MSA, which is often referred to as Region 2000, consists of approximately 2,122 square miles, and includes the City of Lynchburg and the Counties of Bedford, Campbell, Amherst and Appomattox. To a lesser extent, our lending market includes the Roanoke, Charlottesville and Harrisonburg MSAs. Our branches in localities outside of Region 2000 have a short operating history. As of December 2023, the Lynchburg MSA had an unemployment rate (not seasonally adjusted) of 3.2%, as compared to a statewide average unemployment rate of 3.0%.

The local economic conditions in these areas have a significant impact on the Company’s commercial and industrial, real estate and construction loans, the ability of its borrowers to repay their loans and the value of the collateral securing these loans. In addition, if the population or income growth in the Company’s market areas is slower than projected, income levels, deposits and housing starts could be adversely affected and could result in a reduction of the Company’s expansion, growth and profitability. If the Company’s market areas experience a downturn or a recession for a prolonged period of time, the Company could experience significant increases in nonperforming loans, which could lead to operating losses, impaired liquidity and eroding capital. A significant decline in general economic conditions, caused by inflation, recession, pandemics, acts of terrorism, outbreaks of hostilities or other international or domestic calamities, unemployment, monetary and fiscal policies of the federal government or other factors could impact these local economic conditions and could negatively affect the Company’s financial condition, results of operations and cash flows.

The Company’s business, financial condition, liquidity and results of operations may be, adversely affected by a resurgence of COVID-19 or other pandemics.

The COVID-19 pandemic negatively impacted the local, state, national, and world economies. The pandemic created economic and financial disruptions that have adversely affected, and have the potential to continue to adversely affect, the Company’s business, financial condition, liquidity and results of operations. Although the pandemic has subsided, a resurgence of COVID-19 or other pandemics could adversely impact our business, financial condition, liquidity and results of operations. The impact would depend on future developments, which are highly uncertain and cannot be predicted, including the scope and duration of the resurgence of COVID-19 or subsequent pandemics, the effectiveness of the Company’s business continuity plan, the direct and indirect impact of the resurgence or pandemic on the Company’s employees, customers, clients, and service providers, as well as other market participants, and actions taken by governmental authorities and other third parties in response to the pandemic.

A significant portion of our loan portfolio is secured by real estate, and events that negatively impact the real estate market could hurt our business.

A substantial majority of our loans have real estate as a primary or secondary component of collateral. The real estate collateral in each case provides an alternate source of repayment in the event of default by the borrower and may deteriorate in value during the time the credit is extended. Because most of our loans are concentrated in the Region 2000 area in and surrounding the City of Lynchburg, a decline in local economic conditions may have a greater effect on our earnings and capital than on the earnings and capital of larger financial institutions whose real estate loan portfolios are more geographically diverse. A weakening of the real estate market in our primary market areas could result in an increase in the number of borrowers who default on their loans and a reduction in the value of the collateral securing their loans, which in turn could have an adverse effect on our profitability and asset quality. If we are required to liquidate the collateral securing a loan to satisfy the debt during a period of reduced real estate values, our earnings and capital could be adversely affected. Additionally, acts of nature, including hurricanes, tornados, earthquakes, fires and floods, which may cause uninsured damage and other loss of value to real estate that secures these loans, may also negatively impact our financial condition.

‎

Our loan portfolio contains a number of real estate loans with relatively large balances.

A significant portion of our total loan portfolio contains real estate loans with balances in excess of $1,000,000. The deterioration of one or a few of these loans could cause a significant increase in nonperforming loans, which could result in a net loss of earnings, an increase in the provision for credit losses and an increase in loan charge-offs, all of which could have a material adverse effect on our financial condition and results of operations.

Commercial real estate loans increase our exposure to credit risk.

A majority of our loan portfolio is secured by commercial real estate. Loans secured by commercial real estate are generally viewed as having more risk of default than loans secured by residential real estate or consumer loans because repayment of the loans often depends on the successful operation of the property, the income stream of the borrowers, the accuracy of the estimate of the property’s value at completion of construction and the estimated cost of construction. An adverse development with respect to one lending relationship can expose us to a significantly greater risk of loss as compared with a single-family residential mortgage loan because we typically have more than one loan with such borrowers. Additionally, these loans typically involve larger loan balances to single borrowers or groups of related borrowers compared with single-family residential mortgage loans. Therefore, the deterioration of one or a few of these loans could cause a significant decline in the related asset quality. These loans represent higher risk and could result in a sharp increase in loans charged-off and could require us to significantly increase our allowance for credit losses, which could have a material adverse impact on our business, financial condition, results of operations and cash flows.

A percentage of the loans in our portfolio currently include exceptions to our loan policies and supervisory guidelines.

All of the loans that we make are subject to written loan policies adopted by our board of directors and to supervisory guidelines imposed by our regulators. Our loan policies are designed to reduce the risks associated with the loans that we make by requiring our loan officers to take certain steps that vary depending on the type and amount of the loan, prior to closing a loan. These steps include, among other things, making sure the proper liens are documented and perfected on property securing a loan, and requiring proof of adequate insurance coverage on property securing loans. Loans that do not fully comply with our loan policies are known as “exceptions.” We categorize exceptions as policy exceptions, financial statement exceptions and document exceptions. As a result of these exceptions, such loans may have a higher risk of loan loss than the other loans in our portfolio that fully comply with our loan policies. In addition, we may be subject to regulatory action by federal or state banking authorities if they believe the number of exceptions in our loan portfolio represents an unsafe banking practice.

As a community bank, we have different lending risks than larger banks. We provide services to individuals and small to medium-sized businesses in our local markets who may have fewer financial resources to weather a downturn in the economy.

Our ability to diversify our economic risks is limited by our own local markets and economies. We lend primarily to small to medium-sized businesses, professionals and individuals, which may expose us to greater lending risks than those of banks lending to larger, better-capitalized businesses with longer operating histories. For instance, small to medium-sized businesses frequently have smaller market share than their competition, may be more vulnerable to economic downturns, have fewer financial resources in terms of capital or borrowing capacity than larger entities, often need substantial additional capital to expand or compete and may experience significant volatility in operating results. Any one or more of these factors may impair the borrower’s ability to repay a loan. In addition, the success of a small to medium-sized business often depends on the management talents and efforts of one or two persons or a small group of persons, and the death, disability or resignation of one or more of these persons could have a material adverse impact on the business and its ability to repay a loan. Economic downturns and other events that negatively impact the Company’s market areas could cause the Company to incur substantial credit losses that could negatively affect the Company’s results of operations and financial condition.

We depend on the accuracy and completeness of information about clients and counterparties, and our financial condition could be adversely affected if we rely on misleading information.

In deciding whether to extend credit or to enter into other transactions with clients and counterparties, we may rely on information furnished to us by or on behalf of clients and counterparties, including financial statements and other

financial information, which we do not independently verify as a matter of course. We also may rely on representations of clients and counterparties as to the accuracy and completeness of that information and, with respect to financial statements, on reports of independent auditors. For example, in deciding whether to extend credit to customers, we may assume that a customer’s audited financial statements conform with U.S. Generally Accepted Accounting Principles (“GAAP”) and present fairly, in all material respects, the financial condition, results of operations and cash flows of the customer. Our financial condition and results of operations could be negatively impacted to the extent we rely on financial statements that do not comply with GAAP or are materially misleading.

If we suffer credit losses from a decline in credit quality, our earnings will decrease.

We could sustain losses if borrowers, guarantors or related parties fail to perform in accordance with the terms of their loans. We have adopted underwriting and credit monitoring procedures and policies, including the establishment and review of the allowance for credit losses, that we believe are appropriate to minimize this risk by assessing the likelihood of nonperformance, tracking loan performance and diversifying our credit portfolio. These policies and procedures, however, may not prevent unexpected losses that could materially adversely affect our results of operations.

These policies and procedures necessarily rely on our making various assumptions and judgments about the collectability of our loan portfolio, including the creditworthiness of our borrowers and the value of the real estate and other assets serving as collateral for the repayment of many of our loans. In determining the amount of the allowance for credit losses, we review our loans and our loss and delinquency experience, and we evaluate economic conditions. If our assumptions are incorrect, our allowance for credit losses may not be sufficient to cover probable incurred losses in our loan portfolio, resulting in additions to our allowance. Any future additions to our allowance could materially decrease our net income.

In addition, the Federal Reserve Bank of Richmond and the Virginia Bureau of Financial Institutions (the “BFI”) periodically review our allowance for credit losses and may require us to increase our provision for credit losses or recognize further loan charge-offs. Any increase in our allowance for credit losses or loan charge-offs as required by regulatory authorities might have a material adverse effect on our financial condition and results of operations.

Our allowance may not be adequate to cover actual credit losses.

A significant source of risk arises from the possibility that we could sustain losses due to loan defaults and nonperformance on loans. We maintain an allowance in accordance with GAAP to provide for such defaults and other nonperformance. As of December 31, 2023, our allowance as a percentage of total loans was 1.22% and our allowance as a percentage of nonperforming loans was 1,895%. The determination of the appropriate level of allowance is an inherently difficult process and is based on numerous assumptions. The amount of future losses is susceptible to changes in economic, operating and other conditions, including changes in interest rates, many of which are beyond our control. In addition, our underwriting policies, adherence to credit monitoring processes and risk management systems and controls may not prevent unexpected losses. Our allowance may not be adequate to cover actual credit losses. Moreover, any increase in our allowance will adversely affect our earnings by decreasing our net income.

In June 2016, the FASB issued a new accounting standard, commonly referred to as the Current Expected Credit Losses (CECL) standard, which replaced the current approach under GAAP for establishing our allowance for credit losses. We adopted the standard on January 1, 2023. Prior to CECL, our allowance for credit losses generally considered only past events and current conditions. The CECL methodology requires a forward-looking methodology that reflects the expected credit losses over the lives of financial assets, starting when such assets are first originated or acquired. The CECL standard requires us to record, at the time of origination, credit losses expected throughout the life of our loans, as opposed to the current practice of recording losses when it is probable that a loss event has occurred. CECL requires advanced modeling techniques, heavy reliance on assumptions, and dependence on historical data that may not accurately forecast losses. CECL can result in greater volatility in the level of the allowance for credit losses, depending on various factors and assumptions applied in the model, such as the forecasted economic conditions in the foreseeable future and loan payment behaviors. Any increase in the allowance for credit losses, or expenses incurred to determine the appropriate level of the allowance for credit losses, can have an adverse effect on our financial condition and results of operations.

‎

The markets for our deposit and lending products and services are highly competitive, and we face substantial competition.

The banking and financial services industry is highly competitive. We compete as a financial intermediary with other commercial banks, savings banks, credit unions, finance companies, mutual funds, insurance companies and brokerage and investment banking firms soliciting business from residents of and businesses located in the Virginia localities where the Bank has a presence, surrounding areas and elsewhere. Many of these competing institutions have nationwide or regional operations and have greater resources than we have. We also face competition from local community institutions. Many of our competitors enjoy competitive advantages, including greater name recognition, financial resources, a wider geographic presence or more accessible branch office locations, the ability to offer additional services, greater marketing resources, more favorable pricing alternatives for loans and deposits and lower origination and operating costs. We are also subject to lower lending limits than our larger competitors. Our profitability depends upon our continued ability to successfully compete in our market areas. Increased deposit competition could increase our cost of funds and could adversely affect our ability to generate the funds necessary for our lending operations. If we must raise interest rates paid on deposits or lower interest rates charged on our loans, our net interest margin and profitability could be adversely affected. Competition could result in a decrease in loans we originate and could negatively affect our ability to grow and our results of operations.

Technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. Many of our competitors have fewer regulatory constraints and may have lower cost structures. Additionally, due to their size, many competitors may be able to achieve economies of scale and, as a result, may offer a broader range of products and services as well as better pricing for those products and services.

We have increased and plan to continue to increase our levels of commercial and industrial loans. We may not be successful in continuing to penetrate this market segment, which has helped to drive some of our recent earnings.

A significant percentage of our loans are commercial and industrial loans. Although our portfolio of commercial and industrial loans has decreased during the past year, that category has generally increased over the past several years and we continue to focus on commercial and industrial loans.

While we intend to originate these types of loans in a manner that is consistent with safety and soundness, these non-residential loans generally expose us to greater risk of loss than one- to four-family residential mortgage loans, as repayment of such commercial and industrial loans generally depends, in large part, on the borrower’s business to cover operating expenses and debt service. In addition, these types of loans typically involve larger loan balances to single borrowers or groups of related borrowers, as compared to one- to four-family residential mortgage loans. Changes in economic conditions that are beyond our or the borrower’s control could adversely affect the value of the security for the loan, including the future cash flow of the affected business. As we increase our portfolio of these loans, we may experience higher levels of non-performing assets or credit losses, or both.

Our efforts to increase our levels of commercial and industrial loans may be impacted by increased interest rates, recession, or other adverse economic conditions.

Our plans for future expansion depend, in some instances, on factors beyond our control, and an unsuccessful attempt to achieve growth could have a material adverse effect on our business, financial condition, results of operations and future prospects.

We expect to continue to engage in new branch expansion in the future. We may also seek to acquire other financial institutions, or parts of those institutions, though we have no present plans in that regard. Expansion involves a number of risks, including, without limitation:

the time and costs of evaluating new markets, hiring experienced local management and opening new offices;

the time lags between these activities and the generation of sufficient assets and deposits to support the costs of the expansion;

our entrance into new markets where we lack experience;

the introduction of new products and services with which we have no prior experience into our business;

failure to culturally integrate an acquisition target or new branches or failing to identify and select the optimal candidate for integration or expansion; and

failure to identify and retain experienced key management members with local expertise and relationships in new markets.

We may acquire and hold other real estate owned (OREO) properties, which could lead to increased operating expenses and vulnerability to declines in the market value of real estate in our areas of operations.

From time-to-time, we foreclose upon and take title to the real estate serving as collateral for our loans as part of our business. If our OREO balance increases, management expects that our earnings will be negatively affected by various expenses associated with OREO, including personnel costs, insurance and taxes, completion and repair costs, valuation adjustments and other expenses associated with property ownership. Also, at the time that we foreclose upon a loan and take possession of a property, we estimate the value of that property using third-party appraisals and opinions and internal judgments. OREO property is valued on our books at the estimated market value of the property, less the estimated costs to sell (or “fair value”). Upon foreclosure, a charge-off to the allowance for credit losses is recorded for any excess between the value of the asset on our books over its fair value. Thereafter, we periodically reassess our judgment of fair value based on updated appraisals or other factors, including, at times, at the request of our regulators. Any declines in our estimate of fair value for OREO will result in valuation adjustments, with a corresponding expense in our consolidated statements of income that is recorded under the line item for “Other real estate expenses.” As a result, our results of operations are vulnerable to declines in the market for residential and commercial real estate in the areas in which we operate. The expenses associated with OREO and property write downs could have a material adverse effect on our results of operations and financial condition. Any increase in non-accrual loans may lead to increases in our OREO balance in the future.

Additional growth and regulatory requirements may require us to raise additional capital in the future, and capital may not be available when it is needed or may have unfavorable terms, which could adversely affect our financial condition and results of operations.

We are required by federal and state regulatory authorities to maintain adequate levels of capital to support our operations. While the boards of the Company and the Bank intend to take steps to ensure that the capital plan aligns with the Bank’s strategic plan, that all material risks to the Bank are identified and measured and that capital limits are appropriate for the institution’s risk profile, failure to successfully implement such steps could have a material adverse effect on our financial condition and results of operations. We may at some point need to raise additional capital to support any future significant growth. Our ability to raise additional capital, if needed, will depend on conditions in the capital markets at that time, which are outside of our control, and on our financial performance. Accordingly, we can make no assurances of our ability to raise additional capital, if needed, on terms acceptable to us. If we cannot raise additional capital when needed, our ability to further expand our operations could be materially impaired.

Our corporate culture has contributed to our success, and if we cannot maintain this culture as we grow, we could lose the teamwork and increased productivity fostered by our culture, which could harm our business.

We believe that a critical contributor to our success has been our corporate culture, which we believe fosters teamwork and increased productivity. As our organization grows and we are required to implement more complex organizational management structures, we may find it increasingly difficult to maintain the beneficial aspects of our corporate culture. This could negatively impact our future success.

If we fail to retain our key employees, our growth and profitability could be adversely affected.

Our success is, and is expected to remain, highly dependent on our executive management team. We are especially dependent on these executives as well as other key personnel because, as a community bank, we depend on our management team’s ties to the community to generate business for us, and our executives have key expertise needed to implement our business strategy. Our executive management and other key personnel have not signed non-competition covenants.

Competition for personnel is intense, and we may not be successful in attracting or retaining qualified personnel. Our failure to compete for these personnel, or the loss of the services of several of such key personnel, could adversely affect our growth strategy and seriously harm our business, results of operations and financial condition.

Severe weather, natural disasters, acts of war or terrorism or other adverse external events could significantly impact our business.

Severe weather, natural disasters, acts of war or terrorism or other adverse external events could have a significant impact on our ability to conduct business. In addition, such events could affect the stability of our deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue or cause us to incur additional expenses. The occurrence of any of these events in the future could have a material adverse effect on our business, financial condition, results of operations and growth prospects.

As a community bank, our ability to maintain our reputation is critical to the success of our business, and our failure to do so may materially adversely affect our performance.

As a community bank, our reputation is one of the most valuable components of our business. As such, we strive to conduct our business in a manner that enhances our reputation. This is done, in part, by recruiting, hiring and retaining employees who share our core values of being an integral part of the communities we serve, delivering superior service to our customers and caring about our customers and associates. Negative publicity can result from our actual or alleged conduct in any number of activities, including lending practices, corporate governance, acquisitions and actions taken or threatened by government regulators and community organizations in response to those activities. If our reputation is negatively affected by the actions of our employees or otherwise, there may be an adverse effect on our ability to keep and attract customers, and we might be exposed to litigation and regulatory action. Any of such events could harm our business, and, therefore, our operating results may be materially adversely affected. As a financial services company with a high profile in our market area, we are inherently exposed to this risk. While we take steps to minimize reputation risk in dealing with customers and other constituencies, we will continue to face additional challenges maintaining our reputation with respect to customers of the Bank in our current primary market area in Region 2000 and in establishing our reputation in new market areas.

Our decisions regarding how we manage our credit exposure may materially and adversely affect our business.

We manage our credit exposure through careful monitoring of lending relationships and loan concentrations in particular industries, and through loan approval and review procedures. The adequacy of our allowance for credit losses is crucial in monitoring credit exposure. While our board and senior management are continuing to improve the Bank’s risk management framework and align the Bank’s risk philosophy with its capital and strategic plans, failure to continue to improve such risk management framework could have a material adverse effect on our financial condition and results of operations. We can make no assurances that our credit loss reserves will be sufficient to absorb future credit losses or prevent a material adverse effect on our business, financial condition or results of operations.

Our profitability is vulnerable to interest rate fluctuations and changes in monetary policies.

Our profitability depends substantially upon our net interest income. Net interest income is the difference between the interest earned on interest-earning assets, such as loans and investment securities, and the interest expense paid on interest-bearing liabilities, such as NOW accounts, savings accounts, time deposits and other borrowings. Market interest rates for loans, investments and deposits are highly sensitive to many factors beyond our control. Previously interest rate spreads had a sustained period of narrowness due to many factors, such as market conditions, policies of various government and regulatory authorities and competitive pricing pressures, and we cannot predict whether these rate spreads will narrow again. This narrowing of interest rate spreads could adversely affect our financial condition and results of operations. In addition, we cannot predict whether interest rates will continue to remain at present levels. Changes in interest rates may cause significant changes, up or down, in our net interest income. Depending on our portfolio of loans and investments, our results of operations may be adversely affected by changes in interest rates.

Our financial condition and results of operations are affected by credit policies of monetary authorities, particularly the Federal Reserve Board. Actions by monetary and fiscal authorities, including the Federal Reserve Board, could have an adverse effect on our deposit levels, loan demand or business and earnings.

Inflation can have an adverse impact on our customers and their ability to repay.

Inflation risk is the risk that the value of assets or income from investments will be worth less in the future as inflation decreases the value of money. Recently, there has been a pronounced rise in inflation and the Federal Reserve has raised certain benchmark interest rates in an effort to combat this trend. Our customers may also be affected by inflation and the rising costs of goods and services used in their households and businesses, which could have a negative impact on their ability to repay their loans with us.

A failure in or breach of our operational or security systems or infrastructure, or those of our third party vendors and other service providers, including as a result of cyber-attacks, could disrupt our business, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs and cause losses.

We rely heavily on communications and information systems to conduct our business. Any failure, interruption or breach in security of these systems could result in failures or disruptions in our customer-relationship management, general ledger, deposit, loan and other systems. While we have policies and procedures designed to prevent or limit the effect of the failure, interruption or security breach of our information systems, there can be no assurance that any such failures, interruptions or security breaches will not occur; or, if they do occur, that they will be adequately addressed. The occurrence of any failures, interruptions or security breaches of our information systems could disrupt our business, increase our costs, result in the disclosure of confidential client information, damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny or expose us to civil litigation and possible financial liability; any of which could have a material adverse effect on our financial condition and results of operations.

Our computer systems, software and networks have been and will continue to be vulnerable to unauthorized access, loss or destruction of data (including confidential client information), account takeovers, unavailability of service, computer viruses or other malicious code, cyber-attacks and other events. These threats may derive from human error, fraud or malice on the part of employees or third parties, or may result from accidental technological failure. Information security risks for financial institutions such as ours have generally increased in recent years in part because of the proliferation of new technologies, the use of the Internet and digital technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists and other external parties. Some of our operations rely on the secure processing, transmission and storage of confidential information in our computer systems and networks. Our business relies on our digital technologies, computer and email systems, software and networks to conduct its operations. In addition, to access our products and services, our customers may use personal smartphones, tablets, personal computers and other mobile devices that are beyond our control systems. Although we have information security procedures and controls in place, our technologies, systems, networks and our customers’ devices may become the target of cyber-attacks or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of our or our customers’ confidential, proprietary and other information, or otherwise disrupt our or our customers’ or other third parties’ business operations.

Although we maintain safeguards to protect against these risks, we have suffered losses in the past and there can be no assurance that we will not suffer losses in the future that may be material in amount or nature.

Changes in consumers’ use of banks and changes in consumers’ spending and saving habits could adversely affect our financial results.

Technology and other changes now allow many consumers to complete financial transactions without using banks. For example, consumers can pay bills and transfer funds directly without going through a bank. This disintermediation could result in the loss of fee income, as well as the loss of customer deposits and income generated from those deposits. In addition, changes in consumer spending and saving habits could adversely affect our operations, and we may be unable to timely develop competitive new products and services in response to these changes that are accepted by new and existing customers.

‎

Failure to implement new technologies in our operations may adversely affect our growth or profits.

The market for financial services, including banking services and consumer finance services, is increasingly affected by advances in technology, including developments in telecommunications, data processing, computers, automation, Internet-based banking and telebanking. Our ability to compete successfully in our markets may depend on the extent to which we are able to exploit such technological changes. However, we can provide no assurance that we will be able to properly or timely anticipate or implement such technologies or properly train our staff to use such technologies. Any failure to adapt to new technologies could adversely affect our business, financial condition or operating results.

In addition, the financial services industry is undergoing rapid technological changes, with new technology-driven products and services being frequently introduced. The changes could cause our customers to use these new services and products rather than the Bank. For example, financial technology (or “fintech”) companies that rely on technology to provide financial services such as peer-to-peer platforms, blockchain and other distributed ledger technologies have the potential to disrupt the financial services industry and change the way banks do business. Fintech companies are subject to limited regulation. We may not be able to effectively implement new technology-driven products and services or be successful in competing against products, which could impair our growth and profitability.

We are subject to operational risks.

The Company may also be subject to disruptions of its systems arising from events that are wholly or partially beyond our control (including, for example, computer viruses or electrical or telecommunications outages), which may give rise to losses in service to customers and to financial loss or liability. The Company is further exposed to the risk that its external vendors may be unable to fulfill their contractual obligations (or will be subject to the same risk of fraud or operational errors by their respective employees as is the Company) and to the risk that the Company’s (or its vendors’) business continuity and data security systems prove to be inadequate.

We are subject to liquidity risk.

Liquidity risk is the potential that we will be unable to meet our obligations as they become due, capitalize on growth opportunities as they arise or pay regular cash dividends because of an inability to liquidate assets or obtain adequate funding in a timely basis, at a reasonable cost and within acceptable risk tolerances. A failure to adequately manage our liquidity risk could adversely affect our business, financial condition or operating results, especially in the event of another financial crisis. Further, the Federal Reserve could impose additional requirements on the Company if the agency determines that our enhanced liquidity risk management practices do not adequately manage our liquidity risk.

Further, our liquidity could be reduced because of a decrease in the value of certain assets, including loans and investment securities, caused by increases in interest rates which could in turn reduce the amount that we are able to borrow and/or reduce the proceeds from the sale of securities in our portfolio. Our ability to borrow could also be impaired by factors that are not specific to us, such as a disruption in the financial markets or negative views and expectations about the prospects for the financial services industry in light of the recent turmoil faced by banking organizations or deterioration in credit markets.

We may lose lower-cost funding sources.

Checking, savings and money market deposit account balances and other forms of customer deposits can decrease when customers perceive alternatives such as other financial institutions or investments, such as the stock market, as providing a better risk/return tradeoff. If customers move money out of bank deposits and into other investments or to other financial institutions, the Bank could lose a relatively low-cost source of funds, thereby increasing its funding costs and reducing the Bank’s net interest income and net income.

If we fail to maintain an effective system of internal and disclosure controls, we may not be able to accurately report our financial results or prevent or detect fraud.

Effective internal control over financial reporting and disclosure controls and procedures are necessary for us to provide reliable financial reports and effectively prevent or detect fraud and to operate successfully as a public company.

The Company faces the risk that the design of its controls and procedures, including those to mitigate the risk of fraud by employees or outsiders, may prove to be inadequate or are circumvented, thereby causing delays in detection of errors or inaccuracies in data and information. We regularly review and update the Company’s internal controls, disclosure controls and procedures and corporate governance policies and procedures. Any system of controls, however well designed and operated, is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met. Any failure or circumvention of the Company’s controls and procedures or failure to comply with regulations related to controls and procedures could have a material adverse effect on the Company’s business, results of operations and financial condition.

Any failure to maintain effective controls or timely effect any necessary improvement of our internal and disclosure controls could hinder our ability to accurately report our operating results or cause us to fail to meet our reporting obligations, which could affect our ability to remain listed with The NASDAQ Capital Market. Ineffective internal and disclosure controls could also harm our reputation, negatively impact our operating results or cause investors to lose confidence in our reported financial information, which likely would have a negative effect on the trading price of our securities.

Changes in the financial markets could impair the value of our investment portfolio.

Our investment securities portfolio is a significant component of our total earning assets. Turmoil in the financial markets could impair the market value of our investment portfolio, which could adversely affect our net income and possibly our capital.

In an effort combat inflation, the Federal reserve raised rates in 2022. Interest rates increased rapidly. On December 31, 2021, the Fed funds target rate was 0% to 0.25%. By June 30, 2022, the target rate stood at 1.5% to 1.75% and by December 31, 2022 the rate was 4.25% to 4.5%. By December 31, 2023, the target rate had increased to 5.25% to 5.5% where it currently remains. These increases generally had an adverse impact on the value of our securities available-for-sale portfolio.

From time to time, we hold as investments certain securities that have unrealized losses. As of December 31, 2022 and December 31, 2023, we had unrealized losses in our available-for-sale securities portfolio net of taxes of $26,781,000 and $21,615,000, respectively. While we currently maintain substantial liquidity which supports our intent and ability to hold these investments until they mature, or until there is a market price recovery, if we were to cease to have the ability and intent to hold these investments until maturity or if the market prices do not recover, and we were to sell these securities at a loss, it could adversely affect our net income and thereby our capital.

Our deposit insurance premiums could be substantially higher in the future, which could have a material adverse effect on our future earnings.

The FDIC insures deposits at FDIC-insured depository institutions, such as the Bank, up to applicable limits. The amount of a particular institution’s deposit insurance assessment is based on that institution’s risk classification under an FDIC risk-based assessment system. An institution’s risk classification is assigned based on its capital levels and the level of supervisory concern the institution poses to its regulators. Bank failures significantly depleted the FDIC’s Deposit Insurance Fund and reduced the ratio of reserves to insured deposits. As a result of recent economic conditions and the enactment of the Dodd-Frank Reform Act, banks are now assessed deposit insurance premiums based on the bank’s average consolidated total assets, and the FDIC has modified certain risk-based adjustments, which increase or decrease a bank’s overall assessment rate. This has resulted in increases to the deposit insurance assessment rates, and thus raised deposit premiums for many insured depository institutions. If these increases are insufficient for the Deposit Insurance Fund to meet its funding requirements, further special assessments or increases in deposit insurance premiums may be required. We are generally unable to control the amount of premiums that we are required to pay for FDIC insurance. If there are additional bank or financial institution failures, we may be required to pay even higher FDIC premiums than the recently increased levels. Any future additional assessments, increases or required prepayments in FDIC insurance premiums could reduce our profitability, may limit our ability to pursue certain business opportunities or otherwise negatively impact our operations.

‎

Revenues and profitability from our investment advisory business may be adversely affected by any reduction in assets under management, which could reduce fees earned.

PWW, our investment advisory business derives the majority of its revenue from noninterest income, which primarily consists of investment advisory fees. Substantially all of PWW’s revenues are generated from investment management contracts with clients. Under these contracts, the investment advisory fees paid to us are typically based on the market value of assets under management. Assets under management may decline for various reasons including declines in the market value of the assets, which could be caused by price declines in the securities markets. Assets under management may also decrease due to redemptions and other withdrawals by clients or termination of contracts. This could be in response to adverse market conditions or in pursuit of other investment opportunities. If the assets under management we supervise decline and there is a related decrease in fees, it will negatively affect our results of operations.

We may not be able to attract and retain investment advisory clients.

Due to strong competition, our investment advisory business may not be able to attract and retain clients. Competition is strong because there are numerous well-established and successful investment management and wealth advisory firms including commercial banks and trust companies, investment advisory firms, mutual fund companies, stock brokerage firms, and other financial companies. Many of our competitors have greater resources than we have. Our ability to successfully attract and retain investment advisory clients is dependent upon our ability to compete with competitors’ investment products, level of investment performance, client services and marketing and distribution capabilities. If we are not successful, our results of operations and financial condition may be negatively impacted.

The investment advisory industry is subject to extensive regulation, supervision and examination by regulators, and any enforcement action or adverse changes in the laws or regulations governing our business could decrease our revenues and profitability.

As an investment advisor registered with the Securities and Exchange Commission, PWW is subject to regulation by a number of regulatory agencies that are charged with safeguarding the integrity of the securities and other financial markets and with protecting the interests of customers participating in those markets. In the event of non-compliance with regulation, governmental regulators, including the SEC, and the Financial Industry Regulatory Authority, may institute administrative or judicial proceedings that may result in censure, fines, civil penalties, the issuance of cease-and-desist orders or the deregistration or suspension of the non-compliant broker-dealer or investment adviser or other adverse consequences. The imposition of any such penalties or orders could have a material adverse effect on the wealth management segment’s operating results and financial condition. We may be adversely affected as a result of new or revised legislation or regulations. Regulatory changes have imposed and may continue to impose additional costs, which could adversely impact our profitability.

If we fail to retain PWW’s key employees, the growth and profitability of our investment advisory business could be adversely affected.

PWW’s success is, and is expected to remain, highly dependent on its executive management team as well as other key personnel because of their role in, among other things, making investment decisions for PWW clients and managing client relations. Although each of the foregoing are subject to non-compete agreements, there are no assurances that these key personnel will remain employees of PWW.

Competition for investment advisory personnel is intense, and we may not be successful in attracting or retaining qualified personnel. Our failure to compete for these personnel, or the loss of the services of several of such key personnel, could adversely affect our growth strategy and seriously harm our business, results of operations and financial condition.

‎

REGULATORY AND LEGAL RISKS

We are subject to extensive regulation that could limit or restrict our activities and impose financial requirements or limitations on the conduct of our business, which limitations or restrictions could adversely affect our profitability.

As a bank holding company, we are primarily regulated by the Federal Reserve. The Bank is primarily regulated by the BFI and the Federal Reserve. These regulatory authorities have extensive discretion in connection with their supervisory and enforcement activities, including the imposition of restrictions on the operation of a financial institution, the classification of assets by a financial institution and the adequacy of a financial institution’s allowance for credit losses. The Company periodically reviews its policies, procedures and limits, and undertakes reporting, to ensure all guidance is appropriate for the Bank’s current and planned operations and aligns with regulatory expectations. In this regard, regulatory authorities may impose particular requirements on the Bank, which could have a material adverse effect on our results of operations. Any change in such regulation and regulatory oversight, whether in the form of regulatory policy, regulations or legislation, could have a material impact on us and our operations. Further, our compliance with Federal Reserve and the BFI regulations is costly. Because our business is highly regulated, the applicable laws, rules and regulations are subject to regular modification and change. Laws, rules and regulations may be adopted in the future that could make compliance more difficult or expensive or otherwise adversely affect our business, financial condition or prospects. For instance, such changes may limit our growth and restrict certain of our activities, including payment of dividends, mergers and acquisitions, investments, loans and interest rates charged, interest rates paid on deposits and locations of offices. We are also subject to capital requirements by our regulators.

The laws and regulations, including the Dodd-Frank Reform Act, applicable to the banking industry could change at any time, and these changes may adversely affect our business and profitability.

We are subject to extensive federal and state regulation. Because government regulation greatly affects the business and financial results of all commercial banks and bank holding companies, our cost of compliance could adversely affect our ability to operate profitably. The increased scope, complexity, and cost of corporate governance, reporting, and disclosure practices are proportionately higher for a company of our size and will affect our profitability more than that of some of our larger competitors. We expect to experience increasing compliance costs related to this supervision and regulation.

Regulatory authorities continue to implement provisions of the Dodd-Frank Reform Act and other financial sector regulatory requirements. Additional regulation and supervision may increase our costs and limit our ability to pursue business opportunities. The effects of any recently enacted, or proposed, legislation and regulatory programs on us cannot reliably be determined at this time.

The Consumer Financial Protection Bureau’s (the “CFPB”) “ability-to-repay” and “qualified mortgage” rules may have a negative impact on our loan origination process and foreclosure proceedings, which could adversely affect our business, operating results and financial condition.

On January 10, 2013, the CFPB issued a final rule to implement the “qualified mortgage” provisions of the Dodd-Frank Reform Act requiring mortgage lenders to consider consumers’ ability to repay home loans before extending them credit. The CFPB’s “qualified mortgage” rule, which became effective on January 10, 2014, describes certain minimum requirements for lenders making ability-to-repay determinations, but does not dictate that they follow particular underwriting models. Lenders will be presumed to have complied with the ability-to-repay rule if they issue “qualified mortgages,” which are generally defined as mortgage loans prohibiting or limiting certain risky features. Loans that do not meet the ability-to-repay standard can be challenged in court by borrowers who default, and the absence of ability-to-repay status can be used against a lender in foreclosure proceedings. Any loans that we make outside of the “qualified mortgage” criteria could expose us to an increased risk of liability and reduce or delay our ability to foreclose upon the underlying property. Any decreases in loan origination volume or increases in compliance and foreclosure costs caused by the rule could negatively affect our business, operating results and financial condition. The CFPB also has adopted a number of additional requirements and issued additional guidance, including with respect to appraisals, escrow accounts and servicing, each of which entails increased compliance costs. In addition, the CFPB likely will continue to make rules relating to consumer protection, and it is difficult to predict which of our products and services will be subject to these rules or how these rules will be implemented.

Compliance with the Dodd-Frank Reform Act will increase our regulatory compliance burdens, and may increase our operating costs and may adversely impact our earnings or capital ratios, or both.

Signed into law on July 21, 2010, the Dodd-Frank Reform Act has represented a significant overhaul of many aspects of the regulation of the financial services industry. Among other things, the Dodd-Frank Reform Act created the CFPB, tightened capital standards, imposed clearing and margining requirements on many derivatives activities and generally increased oversight and regulation of financial institutions and financial activities.

In addition to the self-implementing provisions of the statute, the Dodd-Frank Reform Act calls for over 200 administrative rulemakings by numerous federal agencies to implement various parts of the legislation. While many rules have been finalized or issued in proposed form, additional rules have yet to be proposed. It is not possible at this time to predict when all such additional rules will be issued or finalized, and what the content of such rules will be. We will have to apply resources to ensure that we are in compliance with all applicable provisions of the Dodd-Frank Reform Act and any implementing rules, which may increase our costs of operations and adversely impact our earnings or capital, or both.

The Dodd-Frank Reform Act and any implementing rules that are ultimately issued could have adverse implications on the financial industry, the competitive environment and our ability to conduct business.

The short-term and long-term impact of regulatory capital requirements and capital rules is uncertain.

Under the capital standards, in order to be well-capitalized, the Bank is required to have a common equity to Tier 1 capital ratio of 6.5% and a Tier 1 capital ratio of 8.0%. The application of more stringent capital requirements for the Bank could, among other things, result in lower returns on invested capital, require the raising of additional capital and result in regulatory actions if we were to be unable to comply with such requirements. Furthermore, the imposition of liquidity requirements in connection with the implementation of Basel III could result in our having to lengthen the term of our funding, restructure our business models or increase our holdings of liquid assets, or all or any combination of the foregoing. Implementation of changes to asset risk weightings for risk based capital calculations, items included or deducted in calculating regulatory capital or additional capital conservation buffers, or both, could result in management modifying its business strategy, and could limit our ability to make distributions, including paying out dividends or buying back shares.

Pursuant to the Regulatory Relief Act, on September 17, 2019, the federal banking agencies adopted a final rule regarding a community bank leverage ratio. Under the final rule, which was effective on January 1, 2021, depository institutions and depository institution holding companies that have less than $10 billion in total consolidated assets and meet other qualifying criteria, including a leverage ratio (equal to tier 1 capital divided by average total consolidated assets) of greater than 9 percent, will be eligible to opt into the community bank leverage ratio framework (qualifying community banking organizations). Qualifying community banking organizations that elect to use the community bank leverage ratio framework and that maintain a leverage ratio of greater than 9 percent will be considered to have satisfied the generally applicable risk-based and leverage capital requirements in the agencies’ capital rules (generally applicable rule) and, if applicable, will be considered to have met the well-capitalized ratio requirements for purposes of section 38 of the Federal Deposit Insurance Act. At this point the Bank has chosen not to opt in to the community bank leverage ratio framework.

RISKS RELATED TO OUR STOCK

Our ability to pay cash dividends is limited, and we may be unable to pay future dividends even if we desire to do so.

The Company is a legal entity, separate and distinct from the Bank and PWW. The Company currently does not have any significant sources of revenue other than cash dividends paid to it by the Bank and PWW. Both the Company and the Bank are subject to laws and regulations that limit the payment of cash dividends, including requirements to maintain capital at or above regulatory minimums. As a bank that is a member of the Federal Reserve System, the Bank must obtain prior written approval for any cash dividend if the total of all dividends declared in any calendar year would exceed the total of its net profits for that year combined with its retained net profits for the preceding two years. PWW’s ability to pay dividends is likewise subject to certain limits imposed by state law.

Banking regulators have indicated that Virginia banking organizations should generally pay dividends only (1) from net undivided profits of the bank, after providing for all expenses, losses, interest and taxes accrued or due by the bank and (2) if the prospective rate of earnings retention appears consistent with the organization’s capital needs, asset quality and overall financial condition. In addition, the FDIA prohibits insured depository institutions such as the Bank from making capital distributions, including the payment of dividends, if, after making such distribution, the institution would become undercapitalized as defined in the statute. Moreover, the Federal Reserve is authorized to determine under certain circumstances relating to the financial condition of a bank that the payment of dividends would be an unsafe and unsound practice and to prohibit payment thereof. The payment of dividends that deplete a bank’s capital base could be deemed to constitute such an unsafe and unsound banking practice. The Federal Reserve has indicated that banking organizations generally pay dividends only out of current operating earnings. The Bank may be prohibited under Virginia law from the payment of dividends, including in the event the BFI determines that a limitation of dividends is in the public interest and is necessary to ensure the Bank’s financial soundness.

In addition, the Bank’s ability to pay dividends will be limited if the Bank does not have the capital conservation buffer required by the capital rules, which may limit the Company’s ability to pay dividends to stockholders.

If the Bank is not permitted to pay cash dividends to the Company, it is unlikely that the Company would be able to pay cash dividends on our common stock. Moreover, holders of our common stock are entitled to receive dividends only when and if declared by our board of directors. Although we currently pay cash dividends on our common stock, we are not required to do so and our board of directors could reduce or eliminate the amount of our common stock dividends in the future.

A limited market exists for our common stock.

Our common stock commenced trading on The NASDAQ Capital Market on January 25, 2012, and trading volumes since that time have been relatively low as compared to larger financial services companies. The limited trading market for our common stock may cause fluctuations in the market value of our common stock to be exaggerated, leading to price volatility in excess of that which would occur in a more active trading market. Accordingly, holders of our common stock may have difficulty selling our common stock at prices which holders find acceptable or which accurately reflect the value of the Company.

Future offerings of debt or other securities may adversely affect the market price of our stock.

In the future, we may attempt to increase our capital resources or, if our or the Bank’s capital ratios fall below the required minimums, we or the Bank could be forced to raise additional capital by making additional offerings of debt or preferred equity securities, including medium-term notes, trust preferred securities, senior or subordinated notes and preferred stock. Upon liquidation, holders of any debt securities and shares of preferred stock and lenders with respect to other borrowings will receive distributions of our available assets prior to the holders of our common stock.

Our stockholders may experience dilution due to our issuance(s) of additional securities in the future.

We may in the future issue additional shares of our common stock to raise cash for operations or to fund acquisitions, to provide equity-based incentives to our management and employees, to permit our stockholders to invest cash dividends and optional cash payments in shares of our common stock or as consideration in acquisition transactions. Additional equity offerings and issuance(s) of additional shares of our common stock may dilute the holdings of our existing stockholders or reduce the market price of our common stock, or both. No assurances can be given that the Company will not issue additional securities that will have the effect of diluting the equity interest of our stockholders. Holders of our common stock are not entitled to preemptive rights or other protections against dilution.

Virginia law and the provisions of our articles of incorporation and bylaws could deter or prevent takeover attempts by a potential purchaser of our common stock that would be willing to pay holders a premium for their shares of our common stock.

Our articles of incorporation and bylaws contain provisions that may be deemed to have the effect of discouraging or delaying uninvited attempts by third parties to gain control of us. These provisions include the division of our board of directors into classes with staggered terms, the ability of our board of directors to set the price, terms and rights of, and to

issue, one or more series of our preferred stock and the ability of our board of directors, in evaluating a proposed business combination or other fundamental change transaction, to consider the effect of the business combination on us and our stockholders, employees, customers and the communities which we serve. Similarly, the Virginia Stock Corporation Act contains provisions designed to protect Virginia corporations and employees from the adverse effects of hostile corporate takeovers. These provisions reduce the possibility that a third party could effect a change in control without the support of our incumbent directors. These provisions may also strengthen the position of current management by restricting the ability of stockholders to change the composition of the board of directors, to affect its policies generally and to benefit from actions which are opposed by the current board of directors.

Item 1B.Item 1A. Unresolved Staff Comments

None.

Item 1.C.Item 1A. Cybersecurity

As a publicly-traded financial institution, we are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations and reputation, including, but not limited to, cyber-attacks against us or our service providers focused on gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data or causing operational disruption. As described below, we have risk management and governance practices and processes designed to address these risks.

The Company has established an enterprise risk management framework that outlines the processes and procedures the Company uses to identify, assess, mitigate, and monitor the risks faced by the Company, including cybersecurity risk. Within the overarching enterprise risk management framework, we have an information security program (“ISP”) designed to preserve the confidentiality, integrity, and availability of information or data on our systems and those of our service providers, as documented in our information security policy.

The Company maintains an ISP to support the management of cybersecurity risk as an integral component of the Company’s ERM framework. The ISP encompasses the Company’s cybersecurity policies and practices and procedures that we use to identify, assess, mitigate, and monitor the risks faced by the Company. In addition, as part of the ISP, the Company has a Cyberecurity Incident Response Policy (“CIRP”) and Incident Response Team (“IRT”).

The IRT includes members of executive and senior management and other employees, including representatives from audit, compliance, human resources, finance, credit, information technology, information security, and legal. The IRT manages how incidents are defined, identified, and classified and ensures that procedures are in place to properly escalate, report and respond to incidents, as they are defined in the policy. The CIRP covers incident preparation, detection, analysis, and declaration, as well as plan execution and process guides for specific scenarios. Post incident activity, which covers incident termination, metrics, lessons learned, evidence retention, and plan maintenance is also included. The ISP follows relevant industry frameworks and standards set by the relevant legal and regulatory authorities and is being updated to align with the NIST Cybersecurity Framework 2.0.

The Board is responsible for the oversight of cybersecurity risk management. In 2022, we elevated the Enterprise Risk Committee to a “committee of the whole” of the Bank’s board of directors. At the second board meeting of each calendar quarter, a significant portion of the meeting is dedicated to enterprise risk management. At that board meeting, management presents the enterprise risk management matrix, including the portions related to cybersecurity, to the board. In addition, the board receives regular reports from management on our cybersecurity threat risk management and strategic processes on topics including information on any cybersecurity incidents (including any remedial actions), including, for example, results of our EDR and XDR programs.

At the management level, the company has designated an information security officer (“ISO”). Our ISO is responsible for the overall administration and execution of the ISP and reports to our EVP-General Counsel. Our ISO has over twenty years of experience working in information security. The ISO monitors the security of, among other things, systems, applications, tools, databases, computers, websites, cloud infrastructure, vendor tools, and user access systems. The ISO also works with and oversees third-party vendors that provide us with information security services and products. The ISO performs an annual information security risk assessment, which, among other things, documents inherent risk levels and controls in place to manage those risks. The information security risk assessment is presented to the Board

annually. The ISO has various professional certifications in relevant fields. The ISO is responsible for administering and executing the ISP and formulating a risk-based approach for evaluating and managing technology and cybersecurity threats.

Management determines and prioritizes appropriate risk responses for each identified enterprise risk. In doing so, executive and senior management work directly with our information technology team and our ISO. Management is accountable for our day-to-day risk management activities.

We strive to minimize the occurrence of cybersecurity incidents and the risks resulting from such incidents. However, when a cybersecurity incident does occur, the Company has in place an incident response program to guide our assessment of and response to the incident. The ISO coordinates the Company’s response to a cybersecurity incident, including investigating, recording and evaluating any potential, suspected or confirmed incidents involving non-public customer information or Company confidential information.

On a regular basis, the ISO reports to executive management and the Board information security risk issues, risk mitigation progress and developments, and information security enhancement initiatives. The ISO also reports the status of information security-related key risk indicators to executive management.

The Company employs third parties in certain aspects of its information security and cybersecurity risk management. For example, we engage third parties to assess the information security risks related to our ISP as well as information security products, services, and security infrastructure. We have adopted a Third-Party Relationship Risk Management Program to help us effectively assess, measure, monitor and control the risks associated with third party relationships, including those related to information security. The board and senior management are responsible for all vendor relationships. The ISO assesses and monitors information risks posed by third parties and any non-compliance with the controls created to address such risks. With respect to cybersecurity incidents affecting our third-party service providers, the ISO works with our service providers to understand and document any incidents, along with managing the impact to us and reporting such incidents to executive management, and, if applicable, the Board. We utilize endpoint detection and response (EDR) and extended detection and response (XDR) platforms which both align to the MITRE ATT&CK^® knowledge base for threat modeling and methodologies. These assist us in detecting, investigating, and responding to actual and potential security incidents.

Based on information known to us, to date, we have not incurred any material losses related to cybersecurity incidents. However, the risk management and governance processes described above may not be sufficient to prevent cybersecurity incidents, and we could incur substantial costs and suffer other negative consequences from cybersecurity incidents. We can give no assurance that we have detected or protected against all cybersecurity threats or incidents. Please refer to “A failure in or breach of our operational or security systems or infrastructure, or those of our third party vendors and other service providers, including as a result of cyber-attacks, could disrupt our business, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs and cause losses” included “Item 1A, Risk Factors” of this Annual Report on Form 10-K for additional information about material risks related to cybersecurity threats.