ORRSTOWN FINANCIAL SERVICES INC

Background

Orrstown Financial Services, Inc., a Pennsylvania corporation, is the financial holding company ("FHC") for its wholly-owned subsidiary Orrstown Bank. The Company’s principal executive offices are located at 77 East King Street, Shippensburg, Pennsylvania, with additional executive and administrative offices at 4750 Lindle Road, Harrisburg, Pennsylvania. The Parent Company was organized on November 17, 1987 for the purpose of acquiring the Bank and such other banks and bank-related activities as are permitted by law. The Company provides banking and financial advisory services located in south central Pennsylvania, principally in Berks, Cumberland, Dauphin, Franklin, Lancaster, Perry and York Counties, Pennsylvania, and in Anne Arundel, Baltimore, Howard and Washington Counties, Maryland, as well as Baltimore City, Maryland. The Company’s lending area also includes adjacent counties in Pennsylvania and Maryland, as well as Loudon County, Virginia and Berkeley, Jefferson and Morgan Counties, West Virginia.

Pending Merger

On December 12, 2023, the Company and Codorus Valley Bancorp, Inc. ("Codorus Valley" or “CVLY”) entered into a definitive agreement to affect a “merger of equals” transaction pursuant to which CVLY will be merged with and into the Company, with the Company as the surviving corporation (the "Merger"). Promptly following the Merger, CVLY’s wholly-owned bank subsidiary, PeoplesBank, A Codorus Valley Company, will be merged with and into the Bank, with the Bank as the surviving bank.

Under the terms of the agreement, CVLY shareholders will have the right to receive 0.875 shares of the Company’s common stock and cash in lieu of any fractional shares of the Company’s common stock. Upon closing, shareholders of the Company, prior to the closing of the Merger, will own approximately 56% of the combined company and shareholders of CVLY will own approximately 44% of the combined company. The transaction is subject to regulatory approvals and satisfaction of customary closing conditions, including approval from Orrstown and CVLY shareholders. The transaction is expected to close in the third quarter of 2024. As of December 31, 2023, CVLY had $2.2 billion in assets and operated 22 full-service branches and eight limited purpose branches in Pennsylvania and Maryland.

Business

The Bank was organized in 1919 as a state-chartered bank. On March 8, 1988, in a bank holding company reorganization transaction, the Parent Company acquired 100% ownership of the Bank.

The Parent Company’s primary activity consists of owning and supervising its subsidiary, the Bank. Day-to-day management is conducted by its officers, who are also Bank officers. The Parent Company has historically derived most of its income through dividends from the Bank. At December 31, 2023, the Company had total assets of $3.1 billion, total deposits of $2.6 billion and total shareholders’ equity of $265.1 million.

The Bank operates in the community banking segment and engages in lending activities, including commercial, residential, commercial mortgages, construction, municipal, and various forms of consumer lending and deposit services, including checking, savings, time and money market deposits. The Bank also provides fiduciary, investment advisory, insurance and brokerage services. These activities engaged in by the Bank are authorized by the Pennsylvania Banking Code of 1965. The Company and the Bank are subject to regulation by certain federal and state agencies and undergo periodic examinations by such regulatory authorities. The concentrations of credit by type of loan are included in Note 4, Loans and Allowance for Credit Losses, to the Consolidated Financial Statements under Part II, Item 8, "Financial Statements and Supplementary Data."

Human Capital

At December 31, 2023, the Bank had 410 full-time and 15 part-time employees. At December 31, 2023, approximately 66% of our workforce was female and 34% were male. Our average tenure is approximately seven years. The Parent Company has no employees. Its 12 executive officers are employees of the Bank, who represent a mix of newer and more seasoned employees with diverse experience and have an average tenure of ten years.

We encourage and support the growth and development of our employees. Continuous learning and career development is advanced through ongoing performance and development conversations with employees, internally created training programs, including development and advancement training offered through Orrstown University, customized corporate training engagements and educational reimbursement and certification programs. Training opportunities are available both online and in-person, and all employees have online access to courses for professional development provided by a third party. During 2023, we also expanded our Management Associate Program from five employees to seven employees. This program provides a structured learning experience, which ranges from one to two years, that focuses on the commercial line of business and credit administration, and then progresses into rotations within other lines of business. The inaugural class will graduate from the program in 2024.

Employee evaluations are conducted on at least an annual basis. Those evaluations focus on job performance, achievement of goals and employee and career development. In addition, we monitor employee satisfaction and engagement through periodic employee surveys.

The safety, health and wellness of our employees is a top priority. The COVID-19 pandemic presented a unique challenge with regard to maintaining employee safety while continuing successful operations. Through teamwork and the adaptability of our management and staff, our remote work options evolved as result of the COVID-19 pandemic. Currently, many of our employees effectively work a hybrid schedule from our office and remote locations. We continue to highlight the importance of the safety, health and wellness of our employees. We also introduced a number of new initiatives that focus on both physical and mental health. We take every opportunity to provide our employees with the tools and resources to assist them to navigate their work environment in a more positive and thoughtful manner.

We believe that it is critically important that its employee base reflects the communities that we serve. Our Diversity, Equity & Inclusion Council has taken concrete steps to diversify the job applicant pool. In addition to the our website, social media platforms and through talent recruiting efforts by third-party recruiters, job openings were posted directly at Historically Black Colleges and Universities within the Company's market area. Our President and Chief Executive Officer also signed the CEO ACTION for Diversity & Inclusion Pledge, which makes commitments to continue making our workplaces trusting places, implementing and expanding unconscious bias education, sharing best practices and creating and sharing strategic inclusion and diversity plans with our Board of Directors. Our Diversity, Equity and Inclusion Council continued to take impactful steps in 2023. The council provided educational opportunities to employees throughout the year and also represented the Company during Harrisburg's and Lancaster's PrideFest events, India Day and contributed for the purchase of children's books to the Salvation Army in Harrisburg in celebration of Black History Month. In 2023, our Diversity, Equity & Inclusion Council started the Company's first Employee Resource Group ("ERG"). The pilot ERG was named Orrstown Women's Network ("OWN") and includes 35 members focused on topics and initiatives that are important to women. During 2023, OWN met quarterly and also completed a fundraiser and participated in Harrisburg's Breast Cancer Awareness Walk. Subsequently, our Diversity, Equity & Inclusion Council announced its second ERG offering: an LGBTQ+ Employee Resource Group, which will provide resources, learning and networking opportunities to all of its members.

We offer competitive compensation to attract and further strengthen employee engagement and encourage retention. Compensation packages include market-competitive salary, healthcare and retirement benefits, paid time off, and may also include bonuses or sales commissions and short-term and long-term equity incentives.

We deploy numerous methods to foster employee engagement, including regular company-wide calls, weekly communication through our Orrstown Connections publications, new employee engagement event with the CEO, employee recognitions and service anniversaries including an event for Employee Appreciation Day, community service and leadership programs, annual events for all employees and off-site events with family and friends.

Lending

Federal bank regulatory agencies have adopted uniform regulations prescribing standards for extensions of credit that are secured by liens or interests in real estate or made for the purpose of financing permanent improvements to real estate. Under these regulations, all insured depository institutions, such as the Bank, must adopt and maintain written policies establishing appropriate limits and standards for extensions of credit that are secured by liens or interests in real estate or are made for the purpose of financing permanent improvements to real estate. These policies must establish loan portfolio diversification standards, prudent underwriting standards (including loan-to-value limits) that are clear and measurable, loan administration procedures and documentation, and approval and reporting requirements. The real estate lending policies must reflect consideration of the federal bank regulatory agencies’ Interagency Guidelines for Real Estate Lending Policies.

All secured loans are supported with appraisals or evaluations of collateral. Business equipment and machinery, inventories, accounts receivable, and farm equipment are considered appropriate security, provided borrowers meet acceptable standards for liquidity and marketability. Loans secured by real estate generally do not exceed 85% of the appraised value of the property. Loan to collateral values are monitored as part of the loan review process, and appraisals are updated as deemed appropriate under the circumstances.

Commercial Lending

The Bank originates commercial real estate, equipment, construction, working capital and other commercial purpose loans to commercial clients throughout the Bank’s various markets. The Bank has significant market share in south central Pennsylvania and has been expanding its presence geographically in recent years. Currently, growth markets include the

Harrisburg region, Lancaster County and Maryland markets, while the Bank's commercial lending is primarily focused in these geographic regions or with borrowers headquartered in these geographic regions, the Company’s lending area also includes adjacent counties in Pennsylvania and Maryland, as well as Loudon County, Virginia and Berkeley, Jefferson and Morgan Counties, West Virginia.

The Bank’s credit policy dictates the underwriting requirements for the various types of commercial loans the Bank makes available to borrowers. The policy covers such requirements as debt coverage ratios, advance rates against different forms of collateral, loan-to-value ratios and maximum term.

A majority of the Company’s loans are for business purposes. At December 31, 2023, approximately 79% of the loan portfolio was comprised of commercial loans.

Consumer Lending

The Bank originates home equity loans, home equity lines of credit and other consumer loans, primarily through its branch network and client service center. A large majority of the consumer loans are secured by either a first or second lien position on the borrower’s primary residential real estate. The Bank requires a loan-to-value ratio of no greater than 85% of the value of the real estate being taken as collateral with a minimum credit score of 710. The Bank also, at times, purchases consumer loans to help diversify credit risk in our loan portfolio.

Residential Lending

The Bank originates residential mortgages throughout its various markets referred from retail branches and through a network of mortgage loan officers. Residential mortgages originated by the Bank may be sold to secondary market investors, which include both GSE and non-GSE investors. All mortgages, regardless of being sold or held in the Bank’s portfolio, are generally underwritten to secondary market industry standards for prime mortgages. For loans originated for investment, the Bank requires pricing adjustments commensurate with the risk, and the real estate taken as collateral generally results in the Bank holding a first lien on the property. The loan-to-value ratio requirements of the real estate being taken as collateral varies per the Credit Policy, and may require the borrower to obtain private mortgage insurance.

Loan Review

The Company has a loan review policy and program, which is designed to identify and monitor risk in the lending function. The Management ERM Committee, comprised of executive and senior officers and loan department personnel, is charged with the oversight of overall credit quality and risk exposure of the Company's loan portfolio. This includes the monitoring of the lending activities of all Company personnel with respect to underwriting and processing new loans and the timely follow-up and corrective action for loans showing signs of deterioration in quality. A loan review program provides the Company with an independent review of the commercial loan portfolio on an ongoing basis. Generally, consumer and residential mortgage loans are included in the Pass categories unless a specific action, such as extended delinquencies, bankruptcy, repossession or death of the borrower occurs, which increases the possibility of a credit loss.

Internal loan reviews are completed annually on all commercial relationships with a committed loan balance in excess of $1.0 million, which includes confirmation of risk rating by an independent credit officer. In addition, all commercial relationships greater than $500 thousand rated substandard, doubtful or loss are reviewed quarterly and corresponding risk ratings are changed or reaffirmed by the Company's Problem Loan Committee, with subsequent reporting to the Management ERM Committee and the Board of Directors.

The Bank outsources its independent loan review to a third-party provider, who monitors and evaluates borrowers on a quarterly basis utilizing risk-rating criteria established in the credit policy in order to identify deteriorating trends and detect conditions which might indicate potential problem loans. The results of the third-party loan review are reported quarterly to the Management and Board ERM Committees for review. The loan ratings provide the basis for evaluating the adequacy of the ACL.

Deposit Products

The Bank offers deposit products to retail, commercial, non-profit and government clients through its retail branch network, its website and commercial team. Product offerings for retail clients include checking accounts, money market, savings and certificates of deposit. The Bank offers a suite of treasury management solutions for businesses that help them to forecast and manage their cash and receivables. The Bank is committed to advancing digital capabilities for all clients, to ensure scalability and optimization of financial performance within the organizations. A robust treasury management online banking platform allows clients to send and collect money electronically using ACH and wire transfer origination services, deposit checks via mobile or desktop capture, and mitigate fraud through check and ACH positive pay services. Wire transfers may be sent and also received domestically, as well as internationally in most currencies. Online bill-pay services allow check and electronic payments, with same day, next day and future dated payments. Additionally, business clients can automatically move money between Bank accounts using various automated sweep services. Using strategic partnerships, the Bank is able to offer best-in-class lockbox services, armored cash logistic solutions, credit cards, purchasing cards, and merchant card processing services.

Digital capability for consumers includes person-to-person (P2P) payment, bill pay, mobile deposit capture and domestic money transfer services. Traditional domestic and international wire transfer services are also offered via the Bank's branches. In addition to opening accounts and communicating with employees via traditional branch or call-center engagement, digital online account opening, online loan and credit card application processing, online mortgage pre-qualification and mortgage application processing, automated telephone services, and online chat features provide consumers with convenient digital alternatives to more traditional products and services.

The Bank competes for deposits similarly on the basis of a combination of value and service and by providing convenience through a broad network of branches, ATMs, card services, and digital service channels.

Investment Services

Through its trust department, the Bank renders services as trustee, executor, administrator, guardian, managing agent, custodian, investment advisor, and other fiduciary activities authorized by law under the trade name Orrstown Financial Advisors, or OFA. OFA offers retail brokerage services through a third-party broker/dealer arrangement with Cetera Advisor Networks LLC. At December 31, 2023, assets under management by OFA totaled $1.8 billion.

Competition

The Bank’s principal market area consists of south central Pennsylvania, the greater Baltimore region, and Washington County, Maryland. The Bank serves a substantial number of depositors in this market area and its contiguous counties.

The Bank competes with other banks and less heavily regulated financial services companies, such as credit unions and finance and trust companies, as well as mortgage banking companies, mutual funds, investment advisors, and brokerage firms, both within and outside of its primary market areas. Financial technology companies, or Fintechs, are also providing nontraditional, but increasingly strong competition for the acquisition and retention of clients.

The Bank competes for loans primarily on the basis of a combination of value and service by building client relationships as a result of addressing its clients’ banking needs, demonstrating expertise, and providing convenience to its clients.

The Bank competes for deposits similarly on the basis of a combination of value and service and by providing convenience through a banking network of branches and ATMs within its markets and digital service channels such as mobile banking.

The Company implements strategic initiatives focused on expanding its core businesses and exploring, on an ongoing basis, acquisition, divestiture, and joint venture opportunities to the extent permitted by its regulators and in alignment with its strategic goals. The Company analyzes each of the Bank's products and businesses in the context of shareholder return, client demands, competitive advantages, industry dynamics, and growth potential. The Company's management believes its market area will support further growth in the future.

Regulation and Supervision

The Parent Company is a bank holding company registered with the FRB and has elected status as a FHC. The Bank is a Pennsylvania-chartered commercial bank and a member bank of the Federal Reserve System.

Regulatory Environment

The banking industry is highly regulated, and Orrstown is subject to supervision, regulation, and examination by the FRB, as its primary federal regulator, and the Pennsylvania Department of Banking and Securities. The statutory and regulatory framework that governs the Company is generally intended to protect depositors and clients, the FDIC's Deposit Insurance Fund, the U.S. banking and financial system, and financial markets as a whole by ensuring the safety and soundness of bank holding companies ("BHCs") and banks. Bank regulators regularly examine the operations of BHCs and banks. Regulators have broad supervisory and enforcement authority over BHCs and banks, including the power to impose nonpublic supervisory agreements, issue cease and desist orders, impose fines and other civil penalties, terminate deposit insurance, and appoint a conservator or receiver. Engaging in unsafe or unsound practices or failing to comply with applicable laws, regulations, and supervisory agreements could subject the Company and its respective officers, directors, and institution-affiliated parties to the remedies described above, and other sanctions.

Banking statutes, regulations, and policies are continually under review, as applicable, by Congress, state legislatures, and federal and state regulatory agencies. In addition to laws and regulations, state and federal bank regulatory agencies may issue policy statements, interpretive letters, and similar written guidance applicable to Orrstown. Any change in statutes, regulations, or regulatory policies applicable to us, including changes in their interpretation or implementation, could have a material effect on our business or organization.

The Parent Company is also subject to the disclosure and regulatory requirements of the Securities Act and the Exchange Act, both as administered by the SEC, as well as the rules of Nasdaq that apply to companies with securities listed on the Nasdaq Capital Market.

Several of the more significant regulatory provisions applicable to BHCs and banks to which the Company are subject are discussed below, along with certain regulatory matters concerning the Parent Company and the Bank. To the extent that the following information describes statutory or regulatory provisions, such information is qualified in its entirety by reference to the particular statutes or regulations. Any change in applicable law or regulation may have a material effect on the business and prospects of the Parent Company and the Bank.

Financial and Bank Holding Company Activities

As a FHC, the Parent Company is permitted to engage, directly or through subsidiaries, in a wide variety of activities that are financial in nature or are incidental or complementary to a financial activity, in addition to all of the activities otherwise allowed.

As a FHC, the Parent Company is generally subject to the same regulation as other BHCs, including the reporting, examination, supervision and consolidated capital requirements of the FRB. To preserve its FHC status, the Parent Company must remain well-capitalized and well-managed and ensure that the Bank remains well-capitalized and well-managed for regulatory purposes and earns “satisfactory” or better ratings on its periodic CRA examinations. An FHC ceasing to meet these standards is subject to a variety of restrictions, depending on the circumstances.

If the Parent Company or the Bank are either not well-capitalized or not well-managed, the Parent Company or the Bank must promptly notify the FRB. Until compliance is restored, the FRB has broad discretion to impose appropriate limitations on a FHC’s activities. If compliance is not restored within 180 days, the FRB may ultimately require the FHC to divest its depository institutions or in the alternative, to discontinue or divest any activities that are permitted only to non-FHC bank holding companies.

If the FRB determines that a FHC or its subsidiaries do not satisfy the CRA requirements, the potential restrictions are different. In that case, until all of the subsidiary institutions are restored to at least “satisfactory” CRA rating status, the FHC may not engage, directly or through a subsidiary, in any of the additional activities permissible under the BHC Act nor make additional acquisitions of companies engaged in such additional activities. However, completed acquisitions and additional activities and affiliations previously begun are left undisturbed, as the BHC Act does not require divestiture for this type of situation.

Federal Deposit Insurance

The FDIC's Deposit Insurance Fund provides insurance coverage for certain deposits, up to a standard maximum deposit insurance amount of $250 thousand per depositor and is funded through assessments on insured depository institutions, based on a methodology designed to take into account the risk each institution poses to the Deposit Insurance Fund. The Bank accepts client deposits that are insured by the Deposit Insurance Fund and, therefore, must pay insurance premiums. The FDIC may increase the Bank’s insurance premiums based on various factors, including changes in the Bank's risk profile. Beginning with the first quarterly assessment period of 2023, the FDIC increased the initial base deposit insurance assessment rate by two basis points, which is intended to increase the Deposit Insurance Fund ("DIF") reserve ratio to the statutory minimum of 1.35%. For 2023, the FDIC insurance expense for the Bank was $2.0 million.

In November 2023, the FDIC approved a final rule to implement a special assessment to recover the loss to the DIF associated with protecting uninsured deposits from bank events earlier in 2023. The FDIC will collect the special assessment beginning with the first quarterly assessment of 2024 and will continue to collect the special assessment for an estimated total of eight quarterly assessment periods. Banking organizations with total assets under $5.0 billion will be exempt from the special assessment, which is based on data from the December 31, 2022 reporting period.

If the FDIC is appointed conservator or receiver of a bank upon that bank’s insolvency or the occurrence of other events, the FDIC may sell some, part, or all of a bank’s assets and liabilities to another bank or repudiate or disaffirm most types of contracts to which that bank was a party if the FDIC believes such contracts are burdensome. In resolving the estate of a failed bank, the FDIC as receiver will first satisfy its own administrative expenses, and the claims of holders of U.S. deposit liabilities also have priority over those of other general unsecured creditors.

Liability for Banking Subsidiaries

The Parent Company is required to serve as a source of financial and managerial strength to the Bank and, under appropriate conditions, to commit resources to support the Bank. This support may be required by the FRB at times when the Bank might otherwise determine not to provide it or when doing so is not otherwise in the interests of the Parent Company or its shareholders or creditors. The FRB may require a BHC to make capital injections into a troubled subsidiary bank and may charge the BHC with engaging in unsafe and unsound practices if the BHC fails to commit resources to such a subsidiary bank or if it undertakes actions that the FRB believes might jeopardize the BHC’s ability to commit resources to such subsidiary bank.

Under these requirements, the Parent Company may in the future be required to provide financial assistance to the Bank should it experience financial distress. Any loans by a holding company to its subsidiary bank are subordinate in right of payment to deposits and to certain other indebtedness of such subsidiary bank. In the event of the Parent Company's bankruptcy, any commitment by the Parent Company to a federal bank regulatory agency to maintain the capital of the Bank would be assumed by the bankruptcy trustee and entitled to a priority of payment.

Pennsylvania Banking Law

The Pennsylvania Banking Code contains detailed provisions governing the organization, location of offices, rights and responsibilities of directors, officers, and employees, as well as corporate powers, savings and investment operations and other aspects of the Bank and its affairs. The Pennsylvania Banking Code delegates extensive rule-making power and administrative discretion to the Pennsylvania Department of Banking and Securities so that the supervision and regulation of state-chartered banks may be flexible and readily responsive to changes in economic conditions and in savings and lending practices.

The FDIA, however, prohibits state-chartered banks from making new investments, loans, or becoming involved in activities as principal and equity investments which are not permitted for national banks unless the FDIC determines the activity or investment does not pose a significant risk of loss to the Deposit Insurance Fund, and a bank meets all applicable capital requirements. Accordingly, additional operating authority provided to the Bank by the Pennsylvania Banking Code may be significantly restricted by the FDIA.

Dividend Restrictions

The Parent Company is a legal entity separate and distinct from its banking and non-banking subsidiaries. Since the Parent Company's consolidated net income consists largely of net income of its subsidiaries, its ability to make capital distributions, including paying dividends and repurchasing shares, depends upon its receipt of dividends from these subsidiaries. Under federal law, there are various limitations on the extent to which the Bank can declare and pay dividends to the Parent Company, including those related to regulatory capital requirements, general regulatory oversight to prevent unsafe or unsound practices, and federal banking law requirements concerning the payment of dividends out of net profits, surplus, and available earnings. The Bank must maintain the CET1 Capital Conservation Buffer requirement of 2.5% to avoid becoming subject to restrictions on capital distributions, including dividends. Certain contractual restrictions also may limit the ability of the Bank to pay dividends to the Parent Company. No assurances can be given that the Bank will, in any circumstances, pay dividends to the Parent Company.

The Parent Company's ability to declare and pay dividends to its shareholders is similarly limited by federal banking law and FRB regulations and policy.

FRB policy provides that a BHC should not pay dividends unless (1) the BHC’s net income over the last four quarters (net of dividends paid) is sufficient to fully fund the dividends, (2) the prospective rate of earnings retention appears consistent with the capital needs, asset quality, and overall financial condition of the BHC and its subsidiaries, and (3) the BHC will continue to meet minimum required capital adequacy ratios. Accordingly, a BHC should not pay cash dividends that can only be funded in ways that weaken the BHC’s financial health, such as by borrowing. The policy also provides that a BHC should inform the FRB reasonably in advance of declaring or paying a dividend that exceeds earnings for the period for which the dividend is being paid or that could result in a material adverse change to the BHC’s capital structure. BHCs also are expected to consult with the FRB before increasing dividends or redeeming or repurchasing capital instruments. Additionally, the FRB could prohibit or limit the payment of dividends by a BHC if it determines that payment of the dividend would constitute an unsafe or unsound practice.

Transactions between a Bank and its Affiliates

Federal banking laws and regulations impose qualitative standards and quantitative limitations upon certain transactions between a bank and its affiliates, including between a bank and its holding company and companies that the BHC may be deemed to control for these purposes. Transactions covered by these provisions must be on arm’s-length terms, and cannot be offered on terms more favorable than would be offered to non-related borrowers of similar creditworthiness, and cannot exceed certain amounts which are determined with reference to that bank’s regulatory capital. Moreover, if the transaction is a loan or other extension of credit, it must be secured by collateral in an amount and quality expressly prescribed by statute, and if the affiliate is unable to pledge sufficient collateral, the BHC may be required to provide it. The Dodd-Frank Act expanded the coverage and scope of these restrictions and requirements, including by applying them to the credit exposure arising under derivative transactions, repurchase and reverse repurchase agreements, and securities borrowing and lending transactions. Federal banking laws also place similar restrictions on loans and other extensions of credit by FDIC-insured banks, such as the Bank, and their subsidiaries to their directors, executive officers, and principal shareholders.

Regulatory Capital Requirements

Compliance with respect to capital requirements is incorporated by reference from Note 17, Shareholders' Equity and Regulatory Capital, to the Consolidated Financial Statements under Part II, Item 8, "Financial Statements and Supplementary Data," and from the Capital Adequacy and Regulatory Matters section of Item 7, “Management’s Discussion and Analysis of Consolidated Financial Condition and Results of Operations.”

The Bank is subject to certain risk-based capital and leverage ratio requirements under the U.S. Basel III capital rules adopted by the FRB. These rules implement the Basel III international regulatory capital standards in the U.S., as well as certain provisions of the Dodd-Frank Act. These quantitative calculations are minimums, and the FRB may determine that a banking organization, based on its size, complexity, or risk profile, must maintain a higher level of capital in order to operate in a safe and sound manner.

Under the U.S. Basel III capital rules, the Parent Company's and the Bank’s assets, exposures, and certain off-balance sheet items are subject to risk weights used to determine the institutions’ risk-weighted assets. These risk-weighted assets are used to calculate the following minimum capital ratios for the Parent Company and the Bank:

• CET1 Risk-Based Capital Ratio, equal to the ratio of CET1 capital to risk-weighted assets. CET1 capital primarily includes common shareholders’ equity subject to certain regulatory adjustments and deductions, including goodwill, intangible assets, certain deferred tax assets, and AOCI. The Company has elected to opt out of including AOCI components.

• Tier 1 Risk-Based Capital Ratio, equal to the ratio of Tier 1 capital to risk-weighted assets. Tier 1 capital is primarily comprised of CET1 capital, perpetual preferred stock, and certain qualifying capital instruments.

• Total Risk-Based Capital Ratio, equal to the ratio of total capital, including CET1 capital, Tier 1 capital, and Tier 2 capital, to risk-weighted assets. Tier 2 capital primarily includes qualifying subordinated debt and qualifying ACL.

• Tier 1 Leverage Ratio, equal to the ratio of Tier 1 capital to quarterly average assets (net of goodwill, certain other intangible assets, and certain other deductions).

Failure to be well-capitalized or to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators that, if undertaken, could have an adverse material effect on our operations or financial condition. Failure to be well-capitalized or to meet minimum capital requirements could also result in restrictions on the Bank’s ability to pay dividends or otherwise distribute capital or to receive regulatory approval of applications.

In addition to meeting the minimum capital requirements, under the U.S. Basel III capital rules, the Bank must also maintain the required Capital Conservation Buffer to avoid becoming subject to restrictions on capital distributions and certain discretionary bonus payments to management. The Capital Conservation Buffer is calculated as a ratio of CET1 capital to risk-weighted assets, and it effectively increases the required minimum risk-based capital ratios. The Capital Conservation Buffer requirement is 2.5%. The Tier 1 Leverage Ratio is not impacted by the Capital Conservation Buffer, and a banking institution may be considered well-capitalized while remaining out of compliance with the Capital Conservation Buffer.

The Parent Company has the ability to provide additional capital to the Bank to maintain the Bank’s risk-based capital ratios at levels which would be considered well-capitalized.

At December 31, 2023, the Company's and the Bank’s regulatory capital ratios were above applicable well-capitalized standards and met the Capital Conservation Buffer requirement.

Bank Acquisitions by Orrstown

BHCs must obtain prior approval of the Federal Reserve in connection with any acquisition that results in the BHC owning or controlling 5% or more of any class of voting securities of a bank or another BHC.

Acquisitions of Ownership of Orrstown

Acquisitions of Orrstown's voting stock above certain thresholds are subject to prior regulatory notice or approval under federal banking laws, including the BHC Act and the Change in Bank Control Act of 1978. Under the Change in Bank Control Act, a person or entity generally must provide prior notice to the FRB before acquiring the power to vote 10% or more of our outstanding common stock. Investors should be aware of these requirements when acquiring shares in the Company's stock.

Data Privacy

Federal and state law contains extensive consumer privacy protection provisions. The GLB Act requires financial institutions to periodically disclose their privacy policies and practices relating to sharing such information and enables retail clients to opt out of our ability to share information with unaffiliated third parties under certain circumstances. Other federal and state laws and regulations impact our ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes, or to contact clients with marketing offers. These security and privacy policies and procedures for the protection of personal and confidential information are in effect across all businesses and geographic locations as applicable. Federal law also makes it a criminal offense, except in limited circumstances, to obtain or attempt to obtain client information of a financial nature by fraudulent or deceptive means. Data privacy and data protection are areas of increasing federal and state legislative focus.

Like other lenders, the Bank uses credit bureau data in its underwriting activities. Use of such data is regulated under the Fair Credit Reporting Act, which also regulates reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information between affiliates, and using affiliate data for marketing purposes. Similar state laws may impose additional requirements on the Company.

Cybersecurity

Multiple federal laws contain provisions requiring regulated financial institutions to maintain cybersecurity programs incorporating specific elements. The GLB Act requires financial institutions to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of client records and information.

The Cybersecurity Information Sharing Act is intended to improve cybersecurity in the U.S. by enhanced sharing of information about security threats among the U.S. government and private sector entities, including financial institutions. The Cybersecurity Information Sharing Act also authorizes companies to monitor their own systems notwithstanding any other provision of law and allows companies to carry out defensive measures on their own systems from cyber-attacks. The law includes liability protections for companies that share cyber threat information with third parties so long as such sharing activity is conducted in accordance with Cybersecurity Information Sharing Act.

The United States federal bank regulatory agencies adopted a rule regarding notification requirements for banking organizations related to significant computer security incidents. Effective April 1, 2022, a bank holding company and a state member bank are required to notify the Federal Reserve within 36 hours of incidents that have materially disrupted or degraded, or are reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its client base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector.

Community Reinvestment Act

The CRA is intended to encourage banks to help meet the credit needs of their service areas, including low- and moderate-income neighborhoods, consistent with safe and sound business practices. The relevant federal bank regulatory agency, the FRB in the Bank’s case, examines each bank and assigns it a public CRA rating. A bank’s record of fair lending compliance is part of the resulting CRA examination report. The CRA requires the relevant federal bank regulatory agency to consider a bank’s CRA assessment when considering that bank’s application to conduct certain mergers or acquisitions or to open or relocate a branch office. The FRB also must consider the CRA record of each subsidiary bank of a BHC in connection with any acquisition or merger application filed by the BHC. An unsatisfactory CRA record could substantially delay or result in the denial of an approval or application by the Parent Company or the Bank. The Bank received a CRA rating of “Satisfactory” in its most recent examination prepared by the FRB on January 25, 2021. Leaders of the federal banking agencies had indicated their support for modernizing the CRA regulatory framework to address changing delivery systems and consumer preferences, and on October 24, 2023, the agencies jointly issued a final rule to strengthen and modernize the CRA regulations by maintaining the existing CRA ratings, but modifying the evaluation framework to replace the existing tests generally applicable to banks with at least $2.0 billion in total assets (e.g., the lending, investment and service tests) with four new tests and associated performance metrics. The final rule updates the CRA regulations to expand access to credit, investment, and basic banking services in low- and moderate-income communities, adapt to changes in the banking industry, including the expanded role of mobile and online banking, and provide greater clarity and consistency. The new CRA regulations will become effective on January 1, 2026.

Anti-Money Laundering

The Bank Secrecy Act and the PATRIOT Act contain anti-money laundering and financial transparency provisions intended to detect and prevent the use of the U.S. financial system for money laundering and terrorist financing activities. The Bank Secrecy Act, as amended by the PATRIOT Act, requires depository institutions and their holding companies to undertake activities including maintaining an anti-money laundering program, verifying the identity of clients, verifying the identity of certain beneficial owners for legal entity clients, monitoring for and reporting suspicious transactions, reporting on cash transactions exceeding specified thresholds, and responding to requests for information by regulatory authorities and law enforcement agencies. The Bank is subject to the Bank Secrecy Act and, therefore, is required to provide its employees with anti-money laundering training, designate an anti-money laundering compliance officer, and undergo an annual, independent audit to assess the effectiveness of its anti-money laundering program. The Bank has implemented policies, procedures, and internal controls that are designed to comply with these anti-money laundering requirements. Bank regulators are focusing their examinations on anti-money laundering compliance, and we will continue to monitor and augment, where necessary, our anti-money laundering compliance programs. The federal banking agencies are required, when reviewing bank and BHC acquisition or merger applications, to consider the effectiveness of the anti-money laundering activities of the applicant.

The Anti-Money Laundering Act of 2020 (“AMLA”), which amends the BSA, was enacted in January 2021. The AMLA codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the U.S. Department of the Treasury ("Treasury") to promulgate priorities for anti-money laundering and countering the financing of terrorism policy; requires the development of standards by the Treasury for testing technology and internal processes for BSA compliance; expands enforcement- and investigation-related authority, including a significant expansion in the available sanctions for certain BSA violations; and expands BSA whistleblower incentives and protections. Many of the statutory provisions in the AMLA required additional rulemaking, reports and other measures, and the impact of the AMLA will depend on, among other things, rulemaking and implementation guidance. Of these statutory provisions, the final rule for the Corporate Transparency Act (the "CTA") became effective January 1, 2024. The CTA authorized FinCEN to collect uniform beneficial ownership information for certain types of corporations, limited liability companies or other similar entities and disclose the information to authorized Federal agencies engaged in national security, intelligence, or law enforcement activities; state, local, and Tribal law enforcement agencies with court authorization; financial institutions with client due diligence requirements and regulators supervising them for compliance with such requirements; foreign law enforcement agencies, prosecutors, judges, and other agencies that meet specific criteria; and Treasury officers and employees under certain circumstances in an attempt to help prevent criminal and terrorist activity.

Office of Foreign Assets Control Regulation

The Office of Foreign Assets Control is responsible for administering economic sanctions that affect transactions with designated foreign countries, nationals, and others, as defined by various Executive Orders and in various legislation. Office of Foreign Assets Control-administered sanctions take many different forms. For example, sanctions may include: (1) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on U.S. persons engaging in financial transactions relating to, making investments in, or providing investment-related advice or assistance to, a sanctioned country; and (2) a blocking of assets in which the government or “specially designated nationals” of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction, including property in the possession or control of U.S. persons. The Office of Foreign Assets Control also publishes lists of persons, organizations, and countries suspected of aiding, harboring, or engaging in terrorist acts, known as Specially Designated Nationals and Blocked Persons. Blocked assets, such as property and bank deposits, cannot be paid out, withdrawn, set off, or transferred in any manner without a license from the Office of Foreign Assets Control. Failure to comply with these sanctions could have serious legal and reputational consequences.

Transaction Account Reserves

FRB regulations require depository institutions to maintain cash reserves against specified deposit liabilities. The dollar amount of a depository institution's reserve requirement is determined by applying the reserve ratios specified in Regulation D to an institution's transaction accounts (primarily NOW and regular checking accounts). The FRB issued a final rule, effective December 22, 2020, lowering the reserve requirement on transaction accounts to 0%. Effective January 1, 2024, the FRB will establish the new reserve requirement exemption amount and low reserve tranche for 2024, but will not elevate the current reserve percentage from zero for depository institutions.

Consumer Protection Regulation and Supervision

The Bank is subject to the regulations promulgated by the CFPB, as administered by the FRB, with respect to federal consumer protection laws. The Bank is also subject to certain state consumer protection laws and, under the Dodd-Frank Act, state attorneys general and other state officials are empowered to enforce certain federal consumer protection laws and regulations. State authorities have increased their focus on and enforcement of consumer protection rules. These federal and state consumer protection laws apply to a broad range of the Bank's activities and to various aspects of its business and include laws relating to interest rates, fair lending, disclosures of credit terms and estimated transaction costs to consumer borrowers, debt collection practices, the use and provision of information to consumer reporting agencies, and the prohibition of unfair, deceptive, or abusive acts or practices in connection with the offer, sale, or provision of consumer financial products and services.

The CFPB has promulgated many mortgage-related final rules since it was established under the Dodd-Frank Act, including rules related to the ability to repay, qualified mortgage standards, mortgage servicing standards, loan originator compensation standards, high-cost mortgage requirements, Home Mortgage Disclosure Act requirements, and appraisal and escrow standards for higher priced mortgages. The mortgage-related final rules issued by the CFPB have materially restructured the origination, servicing, and securitization of residential mortgages in the U.S. These rules have impacted, and will continue to impact, the business practices of residential mortgage lenders, including the Bank.

Nasdaq Capital Market

The Company’s common stock is listed on the Nasdaq Capital Market under the trading symbol “ORRF” and is subject to Nasdaq’s rules for listed companies.

Available Information

The Company is subject to the informational requirements of the Exchange Act and, in accordance with the Exchange Act, it files annual, quarterly, and current reports, proxy statements, and other information with the SEC. The SEC maintains an Internet web site that contains reports, proxy statements, and other information about issuers, like us, who file electronically with the SEC. The address of the site is www.sec.gov. The reports and other information, including any related amendments, filed by us with, or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act, by the Company to, the SEC are also available free of charge at our Internet web site as soon as reasonably practicable after such material is electronically filed with, or furnished to, the SEC. The address of the site is www.orrstown.com. Except as specifically incorporated by reference into this Annual Report on Form 10-K, information on those web sites is not part of this report.