Atlantic Union Bankshares Corp

GENERAL

Overview

Atlantic Union Bankshares Corporation is a financial holding company and bank holding company organized under the laws of the Commonwealth of Virginia and registered under the BHCA. We are headquartered in Richmond, Virginia and provide a wide range of financial services and products to commercial and retail clients through our wholly owned subsidiary bank, Atlantic Union Bank, a Federal Reserve member bank charted under the laws of the Commonwealth of Virginia.

The Bank is headquartered in Richmond, Virginia and, as of December 31, 2024, operated 129 branches located throughout Virginia and portions of Maryland and North Carolina. In addition, our non-bank financial services affiliates include Atlantic Union Equipment Finance, Inc., which provides equipment financing; Atlantic Union Financial Consultants LLC, which provides brokerage services; and Union Insurance Group, LLC, which offers various lines of insurance products.

At December 31, 2024, we had $24.6 billion in assets, $18.5 billion in LHFI (net of deferred fees and costs), $20.4 billion in deposits, and $3.1 billion in stockholders’ equity.

Recent Developments

Acquisition of American National Bankshares Inc.

On April 1, 2024, we completed our merger with American National, the holding company for American National Bank and Trust Company. With the acquisition of American National, we acquired 26 branches, deepening our presence in Central and Western Virginia, and expanding our franchise into contiguous markets in Southern Virginia and in North Carolina.

Pending Merger with Sandy Spring Bancorp, Inc.

On October 21, 2024, we entered into a merger agreement with Sandy Spring, a Maryland corporation. Under the merger agreement, Sandy Spring will merge with and into the Company, with the Company continuing as the surviving entity. Immediately following the merger, Sandy Spring’s wholly owned banking subsidiary, Sandy Spring Bank, will merge with and into the Bank, with the Bank continuing as the surviving bank.

All necessary regulatory and shareholder or stockholder approvals for the merger have been received by the Company and Sandy Spring, as applicable, and the merger is expected to close on April 1, 2025, subject to the satisfaction or waiver of customary closing conditions.

Forward Sale Agreements

On October 21, 2024, in connection with the execution of the merger agreement with respect to Sandy Spring, we entered into an initial forward sale agreement with Morgan Stanley & Co. LLC (the “Forward Purchaser”), relating to an aggregate of 9,859,155 shares of our common stock. On October 21, 2024, we priced the public offering of shares of our common stock in connection with such forward sale agreement and entered into an underwriting agreement with Morgan Stanley & Co. LLC, as representative for the underwriters named therein, the Forward Purchaser and Morgan Stanley & Co. LLC as forward seller (the “Forward Seller”), relating to the registered public offering and sale of 9,859,155 shares of our common stock at a public offering price of $35.50 per share (before underwriting discounts and commissions). The underwriters were granted a 30-day option to purchase up to an additional 1,478,873 shares of our common stock. On October 21, 2024, the underwriters exercised in full their option to purchase the additional 1,478,873 shares of our common stock pursuant to the underwriting agreement and, in connection therewith, we entered into an additional forward sale agreement with the Forward Purchaser relating to 1,478,873 shares of our common stock, on terms

substantially similar to those contained in the initial forward sale agreement (such additional forward sale agreement together with the initial forward sale agreement, the “Forward Sale Agreements”).

We did not initially receive any proceeds from the sale of our common stock sold by the Forward Seller to the underwriters named in the underwriting agreement. We expect to physically settle the Forward Sale Agreements (by the delivery of shares of our common stock) and receive proceeds from the sale of those shares of our common stock upon one or more forward settlement dates within approximately 18 months from the date of the Forward Sale Agreements at the then applicable forward sale price. The forward sale price was initially $34.08 per share, which is equal to the public offering price per share, less the underwriting discount per share, and would result in net proceeds (before offering expenses) of approximately $386.4 million to the Company under the Forward Sale Agreements. No physical settlement has occurred through the date of our consolidated financial statements for the year ended December 31, 2024.

History

The Company was originally incorporated under the laws of the Commonwealth of Virginia in 1991, and we completed our bank holding company formation in July 1993, in connection with the merger of Northern Neck Bankshares Corporation with and into Union Bancorp, Inc. to form Union Bankshares Corporation, which was renamed Atlantic Union Bankshares Corporation in 2019.

Union Bank & Trust Company, a predecessor of Atlantic Union Bank, was formed in 1902, and certain other of the community banks that were acquired and ultimately merged to form what is now Atlantic Union Bank were among the oldest in Virginia at the time they were acquired.

We have a history of growing through both organic growth and strategic acquisitions, particularly with our four most recent acquisitions—StellarOne Corporation in 2014, Xenith Bankshares, Inc. in 2018, Access National Corporation in 2019, and American National in 2024—which allowed us to meaningfully increase our asset size, enhance our scale and expand our footprint throughout Virginia and into portions of Maryland and North Carolina.

The table below indicates the year each of our predecessor community banks was formed, acquired by us, and merged into what is now Atlantic Union Bank.

Principal Products and Services

We are a full-service bank offering consumers and businesses a wide range of banking and related financial services, including checking, savings, certificates of deposit, and other depository services, as well as loans for commercial, industrial, residential mortgage, and consumer purposes. We also offer wealth management and trust services to individuals and corporations. In addition, through our wholly owned subsidiaries, we offer equipment financing services, and insurance products. Our customers have access to our products and services in person via our full-service branches and ATMs, and virtually through our mobile and internet banking services. We strive to provide a differentiated customer experience that is authentically human and digital forward.

Lending Activities. Our loan portfolio consists primarily of commercial, industrial, residential mortgage, and consumer loans. A substantial portion of our loan portfolio is represented by commercial and residential real estate loans (including

acquisition and development loans and residential construction loans). The ability of our borrowers to honor their loan contracts is dependent on the real estate market and general economic conditions in those markets, as well as other factors. The majority of our commercial real estate and industrial loans are made to customers in Virginia, Maryland, North Carolina, and South Carolina.

Mortgage Banking. Our mortgage unit, Atlantic Union Home Loans, originates the majority of our residential mortgage loans to borrowers within our branch footprint, largely with the intent to sell such loans into the secondary mortgage markets. We also originate certain mortgage loans to our customers outside our branch footprint with the intent to sell such loans into the secondary mortgage markets.

Equipment Finance. We provide equipment financing to commercial and corporate customers nationwide through Atlantic Union Equipment Finance, Inc., a wholly owned subsidiary of the Bank. Atlantic Union Equipment Finance provides financing for a wide array of equipment types, including marine, tractors, trailers, buses, construction, manufacturing, and medical.

Wealth Management, Trust and Insurance. We offer a wide variety of financial planning, wealth management and trust services to individuals and corporations, which allows us to reach new customers and expand product offerings to our existing loan and deposit customers. We offer financial planning, trust and investment management, and retirement planning services through our team of experienced financial advisors. Through Atlantic Union Financial Consultants, LLC, we offer brokerage services and execute securities transactions through Raymond James Financial Services, Inc., an independent broker dealer.

Our insurance affiliate, Union Insurance Group, LLC, is a wholly owned subsidiary of the Bank that operates under an agreement with Bankers Insurance LLC, a large insurance agency owned by community banks across Virginia and managed by the Virginia Bankers Association. Union Insurance Group generates revenue through the sale of various insurance products through Bankers Insurance LLC, including long-term care insurance and business owner policies.

Deposit Products and Treasury Services. Our primary source of funds for our lending and investment activities are our deposit products. We provide both commercial and consumer customers a diverse array of deposit products, including checking accounts, savings accounts, and certificates of deposit, among others. Our deposits are primarily made to customers based in Virginia and portions of Maryland and North Carolina. In addition, we provide our customers a suite of products and services including, among others, credit cards (through an arrangement with Elan Financial Services), treasury management services, and capital market services.

SEGMENTS

We operate through two reportable operating segments: Wholesale Banking and Consumer Banking, with corporate support functions such as corporate treasury and others included in Corporate Other.

Our Wholesale Banking segment provides loan, leasing, and deposit services, as well as treasury management and capital market services to our wholesale customers primarily throughout Virginia, Maryland, North Carolina, and South Carolina. These customers include CRE and commercial and industrial customers. This segment also includes our equipment finance subsidiary, which has nationwide exposure. Our wealth management business also resides in the Wholesale Banking segment.

Our Consumer Banking segment provides loan and deposit services to consumers and small businesses throughout Virginia, Maryland, and North Carolina. Consumer Banking includes our home loan division and our investment management and advisory services businesses.

EXPANSION AND STRATEGIC ACQUISITIONS AND INVESTMENTS

We have expanded our market area and increased our market share through a combination of organic growth (internal growth and de novo expansion) and strategic mergers and acquisitions. To date, our strategic acquisitions have included whole bank acquisitions, branch and deposit acquisitions, purchases of existing branches from other banks, and registered investment advisory firms. Our merger and acquisition strategy has focused on institutions that are a strong cultural fit and that are consistent with our philosophy of soundness, profitability, and growth.

We expect to continue to assess future strategic opportunities based on market and other conditions, applying a number of criteria, including transactions that:

These transactions may include whole bank and non-bank mergers and acquisitions, minority investments, or strategic partner equity investments.

HUMAN CAPITAL RESOURCES

We continuously seek to balance our commitments to our key stakeholders: our teammates, customers, shareholders, regulators, and communities. To accomplish this, it is crucial that we continue to identify, attract and retain talent who desire to enrich the lives of the people and communities that we serve. To facilitate talent attraction and retention, we strive to create an inclusive, safe, and healthy workplace, that provides opportunities for our teammates to grow and develop in their careers, supported by strong compensation, benefits, health and welfare programs.

Employee Profile

As of December 31, 2024, we had 2,125 full-time equivalent employees (who we refer to as “teammates”). None of our teammates are represented by a union or covered under a collective bargaining agreement.

As of December 31, 2024, the average tenure of our teammates was 7.5 years.

Our Workplace Culture

We seek to be recognized as the premier Mid-Atlantic Bank – a high performing company that makes banking easy by providing competitive banking solutions, a highly differentiated customer and teammate experience and a great place to work. Our culture is defined by our purpose to enrich the lives of the people and the communities we serve. Our core values guide our actions to further this purpose and shape how we come together to meet our various stakeholder needs and expectations. We use the term “teammates” to describe our employees because we view the Company as one team, where everyone is valued for their contributions.

Our core values serve as the foundation for how we behave and operate as an organization and will influence our future success. Our core values include being:

We are committed to cultivating an inclusive and welcoming workplace where teammate and customer perspectives are valued and respected. We also seek to foster a culture of giving back to the communities where our customers live, work, and play. Charitable donations, small business lending, volunteerism, teaching financial literacy and promoting service within our communities are some of the ways we give back.

Compensation and Benefits

Our compensation programs are designed to attract, retain, and motivate high performing talent and provide market aligned pay programs in support of our business strategies. Our compensation programs are tied to both individual and corporate performances. In addition, we use the services of compensation consultants to advise us on compensation practices and to regularly benchmark our compensation and benefits program against our peers. Our compensation policies and procedures are designed to seek to ensure proper governance and acceptable levels of risk. Individual teammate total pay is influenced by the nature and scope of the job, what other employers pay for comparable jobs, experience, and individual performance. We have established minimum wage levels for all jobs through a formal salary structure that sets a defined salary range for each position. We also offer annual merit-based salary increases to eligible teammates.

Approximately 65% of our teammates are provided with an incentive opportunity under a formal incentive plan with measurable goals and metrics. All incentive programs have both upside and downside potential and are linked to both individual and company performance. Teammates who are not eligible for an incentive plan are eligible to receive cash profit sharing based on our overall financial performance.

We believe that our teammates are best able to deliver a great customer experience if they feel healthy and secure. We offer a variety of benefit programs that flex to meet the needs of teammates, as we strive for a differentiated and personalized experience and to deliver what is most important to teammates throughout the various stages of their lives and careers. We share in the benefit costs with teammates in a way that supports mutual fiscal responsibility, and we seek to assist our teammates in managing health care costs through programs that focus on wellness improvement and appropriate use of health care services. Our benefits programs include healthcare and insurance benefits, various paid time off programs (inclusive of parental leave for both birth and non-birth parents), a 401(k) Plan that includes both a Company match and Company contributions to an Employee Stock Ownership Plan, flexible work arrangements, Employee Assistance Programs, and tuition expense reimbursements. We also offer a holistic wellbeing program that provides opportunities for teammates to earn financial incentives by participating in wellness activities designed to build and sustain healthy habits.

Talent Development and Training

We believe our human capital is our most important asset, and we are committed to investing in the growth and development of our teammates. We have a performance development program that encourages teammate development through informal mentoring and ongoing conversations with their supervisors to seek to align our business objectives with our teammates’ personal development and career aspirations. Our performance development program is very important to delivering business results and helps gain greater alignment between strategic goals and individual goals. This program operates on an annual basis and begins with each teammate setting their own individual goals and development plans and ends with an annual review. Teammates are encouraged to take ownership of their development and seek guidance from their managers on goals and development areas.

We also provide training opportunities to foster teammate growth and development, enhance teammate skillsets, and prepare teammates to be successful in their roles. For example, we offer specific, targeted training to all new hires. In addition to professional development, role-based, and regulatory/compliance training, we also offer training resources on the following subjects, among others: anti-bribery; anti-money-laundering; information security; leadership; policies/procedures; ethics; product training; technical/systems; and compensation/benefits. We also offer an enterprise development program, Emerge, intended to engage and retain high potential talent and broaden career mobility within and across lines of business. We emphasize succession planning and provide executive development initiatives designed to cultivate the capabilities of our senior-level talent. We also offer an Executive Leadership Acceleration Program that identifies and prepares top-performing leaders for future executive roles, equipping participants with the strategic skills and perspectives needed to succeed in senior leadership positions. Our leadership development efforts are designed to fortify a robust talent pipeline, allow for continuous growth, and support effective leadership transitions.

All teammates have access to training opportunities through a learning management system and/or learning experience platform. We offer training through multiple modalities, including e-learning, job aids, videos, instructor-led, and on-the-job practice supported by trained mentors. The majority of our training materials are regulation-based and managed through a regulatory and compliance program. In addition to job specific training, all teammates are required to complete

mandatory compliance courses on a wide range of Company policies and procedures, such as our anti-discrimination policies and ethical standards and in response to regulatory requirements and changes.

Inclusion and Belonging

We are committed to fostering, cultivating, and preserving a culture of inclusion and belonging that welcomes varied backgrounds and experiences. We believe that the collective sum of the individual differences, life experiences, knowledge, inventiveness, innovation, self-expression, unique capabilities, and talent that our teammates invest in their work represents a significant part of not only our culture, but our reputation and achievement. We strive to foster a culture and workplace that, among other things, is inclusive and welcoming, treats everyone with respect and dignity, promotes people on their merits, and encourages different ways of thinking, ideas, perspective, and values. We have a dedicated teammate council, co-chaired by our Chief Executive Officer and our Chief Human Resources Officer, that is comprised of a cross-functional group of teammates from varied backgrounds and experiences, and that helps manage our efforts to create a more inclusive workplace.

COMPETITION

The financial services industry remains highly competitive and is constantly evolving. We experience strong competition in all aspects of our business. In our market areas, we compete with large national and regional financial institutions, credit unions, other independent community banks, as well as consumer finance companies, mortgage companies, loan production offices, mutual funds, life insurance companies and fintech companies. Competition for deposits and loans is affected by various factors including, without limitation, interest rates offered, the number and location of branches and types of products offered, digital capabilities, and the reputation of the institution. Credit unions increasingly have been allowed to expand their membership definitions, and because they enjoy a favorable tax status, they may be able to offer more attractive loan and deposit pricing. Our non-bank affiliates also operate in highly competitive environments.

In addition, non-bank competitors are increasingly offering products and services that traditionally were only offered by banks. Many of these non-bank competitors are not subject to the same extensive federal regulations that govern bank holding companies and federally insured banks, which may allow them to offer greater lending limits and certain products and services that we do not provide.

We believe our community focused banking framework and philosophy provides us with a competitive advantage, particularly with regard to larger national and regional institutions, allowing us to compete effectively. Additionally, our attention to incorporating digital technology has made it possible for us to provide our customers with electronic, mobile, and internet-based financial solutions, such as online deposit accounts and electronic payment processing. Our deposit market share in Virginia was 6.4% of total bank deposits as of June 30, 2024, based on FDIC deposit data, making us the largest regional bank headquartered in Virginia at that time.

ECONOMY

The economies in our market areas are diverse and include local and federal government, military, agriculture, and manufacturing. Based on Virginia Employment Commission data, the state’s seasonally adjusted unemployment rate was 3.0% as of December 31, 2024 and 2023 and continued to be below the national rate of 4.1% and 3.7%, respectively, at December 31, 2024 and 2023. Based on Bureau of Labor Statistics data, North Carolina’s seasonally adjusted unemployment rate was 3.7% and 3.6%, respectively, at December 31, 2024 and 2023, also below the national rate.

Our operations are affected not only by general economic conditions but also by the policies of various regulatory authorities. In late 2024, the Federal Reserve’s interest rate policy shifted as inflationary pressure began to ease and economic growth moderated. Following a period of aggressive rate hikes aimed at curbing inflation in 2022 and 2023, the Federal Reserve lowered rates in late 2024 by 100 bps, compared to 2023, resulting in the current Federal Funds target rate range of 4.25% to 4.50%. The FOMC has noted that it will assess incoming data, the evolving outlook, and the balance of risks and will continue to monitor the implications of incoming information for the economic outlook. In determining future actions with respect to the target rates, the FOMC will take into account a wide range of information, including readings on labor market conditions, inflation pressures and inflation expectations, and financial and international developments. Generally, we expect net interest income to decline in a decreasing rate environment given

our interest rate risk profile, particularly if our assets reprice faster than our deposits or if we are unable to reduce our deposit rates in a declining rates scenario.

Our management continues to consider the current economic environment and potential future economic conditions, including the threat of an economic recession on our performance, while also seeking to address nonperforming assets, control costs, and work with borrowers to mitigate and protect against risk of loss. Our management also continues to review the pricing of our products and services, in light of current and expected costs due to inflation, to seek to mitigate the inflationary impact on our financial performance.

SUPERVISION AND REGULATION

We are extensively regulated and supervised under both federal and state laws. The following description describes certain aspects of those regulations that are material to us and is not a complete description of all regulations, or aspects of those regulations, that affect us. To the extent statutory or regulatory provisions or proposals are described in this Form 10-K, the description is qualified in its entirety by reference to the statutory or regulatory provisions or proposals. Proposals to change the laws, regulations, and policies governing the banking industry are frequently raised at both the state and federal levels, and we expect that the Trump administration will seek to implement a regulatory reform agenda that is significantly different than the Biden administration, impacting the rulemaking, supervision, examination, and enforcement priorities of the federal banking agencies. These laws and regulations impose compliance costs and create obligations and, in some cases, reporting obligations, and compliance with these laws, regulations, and obligations may require us to use significant resources.

The likelihood and timing of any changes in laws and regulations and the supervisory environment, and the impact such changes may have on us, are difficult to ascertain. In addition to laws and regulations, bank regulatory agencies may issue policy statements, interpretive letters, and similar written guidance applicable to us. A change in applicable laws, regulations, or regulatory guidance, or in the manner such laws, regulations or regulatory guidance are interpreted by regulatory agencies or courts, may have a material adverse effect on our business, operations, and earnings. Changes in the supervisory environment may also have a material adverse effect on our business, operations, and earnings. Supervision, regulation, and examination of banks by regulatory agencies are intended primarily for the protection of depositors and customers, the Deposit Insurance Fund and the U.S. banking and financial system rather than shareholders.

Both the scope of the laws and regulations and the intensity of the supervision to which we are subject have increased in recent years, initially in response to the global financial crisis of 2008, and more recently in light of other factors such as the high-profile bank failures in 2023, stress in the financial markets, technological factors, market changes, and increased scrutiny of proposed bank mergers and acquisitions by federal and state bank regulators. The Trump administration is expected to create further changes, the impact of which is difficult to assess. As described in further detail below, we are subject to additional regulatory requirements because we have over $10 billion in consolidated assets. Regulatory enforcement and fines have also increased across the banking and financial services sector in recent years, including as a result of, among other things, the implementation of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, as amended (the “Dodd-Frank Act”).

We are also subject to the disclosure and regulatory requirements of the Securities Act of 1933, as amended (the “Securities Act”) and the Securities Exchange Act of 1934, as amended (the “Exchange Act”), both as administered by the SEC, as well as the rules of the NYSE that apply to companies with securities listed on the NYSE.

The Company

General**.**The Company is registered as a bank holding company with the Federal Reserve under the BHCA and has elected to be a financial holding company. As a financial holding company, we are subject to comprehensive regulation, examination and supervision by the Federal Reserve and are subject to its regulatory reporting requirements. Federal law subjects financial holding companies, such as the Company, to restrictions and qualifications on the types of activities in which they may engage, and to a range of supervisory requirements and activities. The Company is also registered under the bank holding company laws of Virginia and is subject to supervision, regulation, and examination by the Bureau of Financial Institutions, a division of the Virginia State Corporation Commission.

Permitted Activities**.** The BHCA generally limits the activities permissible for a bank holding company to the business of banking, managing or controlling banks, and engaging in such other activities that the Federal Reserve determines by regulation or order to be so closely related to banking as to be a proper incident thereto. In addition, bank holding companies that qualify and elect to be financial holding companies, such as the Company, may engage in any activity, or acquire and retain the shares of a company engaged in any activity, that is either (i) financial in nature or incidental to such financial activity (as determined by the Federal Reserve in consultation with the Secretary of the Treasury) or (ii) complementary to a financial activity and does not pose a substantial risk to the safety and soundness of depository institutions or the financial system generally (as solely determined by the Federal Reserve), without prior approval of the Federal Reserve. These activities include securities underwriting and dealing, insurance underwriting, and making merchant banking investments.

To maintain financial holding company status, a financial holding company and all of its depository institution subsidiaries must be “well capitalized” and “well managed” as defined under applicable Federal Reserve requirements. If a financial holding company ceases to meet these capital and management requirements, the Federal Reserve’s regulations provide that the financial holding company must enter into an agreement with the Federal Reserve to comply with all applicable capital and management requirements. Until the financial holding company returns to compliance, the Federal Reserve may impose limitations or conditions on the conduct of its activities, and the company may not commence any of the broader financial activities permissible for financial holding companies or acquire a company engaged in such financial activities without prior approval of the Federal Reserve. If the company does not return to compliance within 180 days, the Federal Reserve may require the financial holding company to divest its depository institution subsidiaries or to cease engaging in any activity that is financial in nature (or incident to such financial activity) or complementary to a financial activity.

For a financial holding company to start any new activity permitted by the BHCA or to acquire a company engaged in any new activity permitted by the BHCA, each insured depository institution subsidiary of the financial holding company must have received a rating of at least “satisfactory” in its most recent examination under the CRA. See below under “The Bank – Community Reinvestment Act.”

The Federal Reserve may order a bank holding company or its subsidiaries to terminate any activity or to terminate ownership or control of any subsidiary when the Federal Reserve has reasonable cause to believe that a serious risk to the financial safety, soundness, or stability of any bank subsidiary of that bank holding company may result from such an activity.

Banking Acquisitions; Changes in Control. The BHCA and related regulations require, among other things, the prior approval of the Federal Reserve in any case where a bank holding company proposes to (i) acquire direct or indirect ownership or control of more than 5% of the outstanding voting stock of any bank or bank holding company (unless it already owns a majority of such voting shares), (ii) acquire all or substantially all of the assets of another bank or bank holding company, or (iii) merge or consolidate with any other bank holding company. In determining whether to approve a proposed bank acquisition, the Federal Reserve will consider public or private interests that may not be aligned with those of the Company’s shareholders or non-deposit creditors.

Late in the Biden administration, the standards by which, bank and financial institution acquisitions would be evaluated have been undergoing review and change by the Office of the Comptroller of the Currency (the “OCC”), FDIC, and U.S. Department of Justice (the “DOJ”), but not by the Federal Reserve. These reviews were incorporated into non-binding guidance. Whether and how the guidance might be further changed or interpreted by the Trump administration is uncertain. In September 2024, the OCC and the FDIC finalized a new Policy Statement Regarding Statutory Factors Under the Bank Merger Act and a new FDIC Statement of Policy on Bank Merger Transactions, respectively. These new

policy statements outline factors that the OCC and the FDIC will consider when evaluating a proposed bank merger transaction. The Federal Reserve did not release a new merger policy statement.

Also in September 2024, the DOJ withdrew its 1995 Bank Merger Guidelines and announced that it will instead evaluate the competitive impact of bank mergers using its 2023 Merger Guidelines that apply across all industries. Compared to the 1995 Bank Merger Guidelines, the 2023 Merger Guidelines set forth more stringent market concentration limits and add several largely qualitative bases on which the DOJ may challenge a merger. The effect of these changes remains uncertain, but these changes may make it more difficult, costly or otherwise onerous to obtain regulatory approval for an acquisition.

Acquisitions of the Company’s voting stock above certain thresholds are subject to prior regulatory notice or approval under federal banking laws, including the BHCA and the Change in Bank Control Act of 1978, as amended (the “CIBCA”). Under the CIBCA, a person or entity generally obtains non-objection from the Federal Reserve before acquiring the power to vote 10% or more of any class of voting stock, including the Company’s common stock. Investors should be aware of these requirements when acquiring shares in the Company’s stock.

In addition, Virginia law requires the prior approval of the Bureau of Financial Institutions, a division of the Bureau of Financial Institutions, a division of the Virginia State Corporation Commission for (i) the acquisition by a Virginia bank holding company of more than 5% of the voting shares of a Virginia bank or a Virginia bank holding company, or (ii) the acquisition by any other person of control of a Virginia bank holding company or a Virginia bank.

Source of Strength**.** The Company is statutorily required to act as a source of financial and managerial strength to its subsidiary bank. The Company is expected to commit resources to support the Bank, including times when the Company may not be in a financial position to provide such resources.

Safety and Soundness**.** There are a number of obligations and restrictions imposed on bank holding companies and their subsidiary banks by law and regulatory policy that are designed to minimize potential loss to the depositors of such depository institutions and the Deposit Insurance Fund in the event of a depository institution insolvency, receivership, or default.

Under the Federal Deposit Insurance Act, the federal bank regulatory agencies have adopted guidelines prescribing safety and soundness standards. These guidelines establish general standards relating to capital management, internal controls and information systems, internal audit systems, information systems, data security, loan documentation, credit underwriting, interest rate exposure and risk management, vendor management, corporate governance, asset growth and compensation, fees, and benefits. In general, the guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines. The guidelines prohibit excessive compensation as an unsafe and unsound practice and characterize compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer or employee, director or principal shareholder. In addition, the federal banking agencies have adopted regulations that authorize but do not require an agency to order an institution that has been given notice by the agency that it is not in compliance with any of the safety and soundness standards to submit a compliance plan. If after being so notified, an institution fails to submit an acceptable compliance plan, the agency must issue an order directing action to correct the deficiency and may issue an order directing other actions of the types, including those that may limit growth or capital distributions.

Capital Requirements.** **The Federal Reserve imposes certain capital requirements on bank holding companies under the BHCA, including a minimum leverage ratio and a minimum ratio of “qualifying” capital to risk-weighted assets. These requirements are described below under “The Bank – Capital Requirements.” Subject to its capital requirements and certain other restrictions, the Company is able to borrow money to make a capital contribution to the Bank, and such loans may be repaid from dividends paid by the Bank to the Company.

Limits on Dividends, Capital Distributions and Other Payments**.**The Company is a legal entity, separate and distinct from its subsidiaries. A significant portion of the revenues of the Company result from dividends paid to it by the Bank. There are various legal limitations applicable to the payment of dividends by the Bank to the Company to the payment of dividends by the Company to its shareholders, and to the repurchase by the Company of outstanding shares of its capital stock. Federal Reserve policy provides that bank holding companies, such as the Company, should generally pay dividends to shareholders only if (i) the organization’s net income available to common shareholders over the past year has been sufficient to fully fund the dividends; (ii) the prospective rate of earnings retention appears consistent with the

organization’s capital needs, asset quality and overall financial condition; and (iii) the organization will continue to meet minimum capital adequacy ratios. In addition, the Bank is subject to various statutory and regulatory restrictions on its ability to pay dividends to the Company. Under current regulations, prior approval from the Federal Reserve is required if cash dividends declared by the Bank in any given year exceed net income for that year, plus retained net profits of the two preceding years. The payment of dividends by the Bank or the Company may be limited by other factors, such as requirements to maintain capital above regulatory guidelines. Bank regulatory agencies have the authority to prohibit the Bank or the Company from engaging in an unsafe or unsound practice in conducting its respective business. The payment of dividends or the repurchase of outstanding capital stock, depending on the financial condition of the Bank, or the Company, could be deemed to constitute such an unsafe or unsound practice.

Under the Federal Deposit Insurance Act, insured depository institutions such as the Bank, are prohibited from making capital distributions, including the payment of dividends, if, after making such distributions, the institution would become “undercapitalized” (as such term is used in the statute). Based on the Bank’s current financial condition, the Company does not expect that this provision will have any impact on its ability to receive dividends from the Bank.

The Bank

General**.**The Bank is chartered by the Commonwealth of Virginia and is supervised and regularly examined by the Bureau of Financial Institutions, a division of the Virginia State Corporation Commission. The Bank, as a member of the Federal Reserve System, is also supervised and regularly examined by the Federal Reserve. The Bank is also subject to regulation and supervision by the CFPB, as an institution with more than $10 billion in assets. The various laws and regulations administered by the bank regulatory agencies affect corporate practices, such as the payment of dividends, incurrence of debt, and acquisition of financial institutions and other companies; they also affect business practices, such as the payment of interest on deposits, the charging of interest on loans, types of business conducted, and location of offices. Certain of these laws and regulations are referenced above under “The Company”.

Interchange Fees.* *Interchange fees, or “swipe” fees, are charges that merchants pay to the Bank and other card-issuing banks for processing electronic payment transactions. Under the final rules, which are applicable to financial institutions that have assets of $10 billion or more, the maximum permissible interchange fee is equal to the sum of 21 cents plus 5 bps of the transaction value for many types of debit interchange transactions. The rules permit an upward adjustment to an issuer’s debit card interchange fee of no more than one cent per transaction if the issuer develops and implements policies and procedures reasonably designed to achieve certain fraud-prevention standards. The Federal Reserve also has rules governing routing and exclusivity that require issuers to offer two unaffiliated networks for routing transactions on each debit or prepaid product.

In October 2023, the Federal Reserve issued proposed rules that would reduce the maximum permissible interchange fee cap. The proposed rules would also adopt an approach for future adjustments to the interchange fee cap, which would occur every other year based on data received by the Federal Reserve in biennial surveys of covered financial institutions. It is unclear when or whether this rule will be finalized.

Capital Requirements.** **The Federal Reserve and the other federal banking agencies have issued risk-based and leverage capital guidelines applicable to U.S. banking organizations. Those regulatory agencies may from time to time require that a banking organization maintain capital above the minimum levels because of its financial condition or actual or anticipated growth.

The Federal Reserve has adopted capital requirements and calculations of risk-weighted assets to implement the Basel III regulatory capital reforms from the Basel Committee on Banking Supervision and certain provisions of the Dodd-Frank Act.

Under these risk-based capital requirements of the Federal Reserve, the Company and the Bank are required to maintain the following to be considered adequately capitalized: (i) a minimum ratio of total capital to risk-weighted assets of at least 8.0%, (ii) a minimum ratio of Tier 1 capital to risk-weighted assets of at least 6.0%, and (iii) a minimum ratio of common equity Tier 1 capital to risk-weighted assets of at least 4.5%.

The Federal Reserve’s capital requirements also impose a capital conservation buffer requirement of 2.5% of risk-weighted assets. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking

institutions with a ratio of common equity Tier 1 to risk-weighted assets above the minimum but below the conservation buffer will face constraints on dividends, equity repurchases, and compensation based on the amount of the shortfall.

Each of the federal bank regulatory agencies also has established a minimum leverage capital ratio of Tier 1 capital to average adjusted assets (“Tier 1 leverage ratio”). The guidelines require a minimum Tier 1 leverage ratio of 3.0% for advanced approach banking organizations; all other banking organizations are required to maintain a minimum Tier 1 leverage ratio of 4.0%. In addition, for a depository institution to be considered “well capitalized” under the regulatory framework for Prompt Corrective Action, its Tier 1 leverage ratio must be at least 5.0%. Banking organizations that have experienced internal growth or made acquisitions are expected to maintain strong capital positions substantially above the minimum supervisory levels without significant reliance on intangible assets.

The Federal Reserve’s final rules prescribe a standardized approach for risk weightings for a risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. government and agency securities to 600% for certain equity exposures, and resulting in higher risk weights for a variety of asset classes.

The Federal Reserve’s regulatory capital rules also provide that the Company’s trust preferred securities qualify as Tier 2 capital. The Company has $170.5 million of trust preferred securities outstanding and approximately $24.6 billion in assets as of December 31, 2024.

As of December 31, 2024, the Company and the Bank were well above minimum requirements and requirements for “well capitalized” status, as applicable. The capital ratios for the Company and the Bank as of December 31, 2024 are set forth below:

(1)* * Reflects the well-capitalized standard applicable to the Bank and the well-capitalized standard applicable to the Company under the Federal Reserve Board’s Regulation Y.

In July 2023, the Federal Reserve Board and the FDIC issued proposed rules to implement the final components of the Basel III agreement, commonly known as the “Basel III endgame.” These proposed rules contained provisions that would apply to banks with $100 billion or more in total assets. In September 2024, a re-proposal to the Basel III endgame was announced that would cover all major areas of the rule: credit risk; operational risk; and market risk. Under the re-proposal, banks with assets between $100 and $250 billion would no longer be subject to the changes of the Basel III endgame, other than the requirement to recognize unrealized gains and losses of their securities in regulatory capital. Neither the proposed rules nor the re-proposed rules for the Basel III endgame would apply to holding companies or banks with less than $100 billion in assets, such as the Company and the Bank, but the final impacts of these rules cannot yet be predicted, as the agencies have not made final decisions on any aspect of the re-proposals. It is uncertain if and when final rules will be adopted, and if so, whether and to what extent they will differ from the proposal.

On August 26, 2020, the federal bank regulatory agencies adopted a final rule that allowed the Company to phase in the impact of adopting the CECL methodology up to two years, with a three-year transition period to phase out the

cumulative benefit to regulatory capital provided during the two-year delay. The Company elected to phase in the regulatory capital impact as permitted under this final rule. The CECL transition amount is being phased out of regulatory capital over a three-year period that began in 2022 and ended in 2024. Refer to Item 7 “Management’s Discussion and Analysis of Financial Condition and Results of Operations” section “Capital Resources” of this Form 10-K for information regarding the impact of this final rule on the Company’s regulatory capital.

Deposit Insurance. The Bank’s deposits are insured by the FDIC in the standard insurance amount of $250,000 per depositor for each account ownership type. The FDIC has adopted a large-bank pricing assessment structure, set a target “designated reserve ratio” of 2% for the Deposit Insurance Fund, and in lieu of dividends, provides for a lower assessment rate schedule, when the reserve ratio reaches 2% and 2.5%. An institution’s assessment rate is based on a statistical analysis of financial ratios that estimates the likelihood of failure over a three-year period, which considers the institution’s weighted average capital adequacy, asset quality, management, earnings, liquidity, and sensitivity, or CAMELS, composite rating and is subject to further adjustments including related to levels of unsecured debt and brokered deposits.

In November 2023, the FDIC approved a special assessment to recover the loss to the Deposit Insurance Fund associated with the closures of Silicon Valley Bank and Signature Bank in early 2023. The assessment base for the special assessment is equal to an insured depository institution’s estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion of uninsured deposits. The special assessment will be collected at an annual rate of approximately 13.4 bps for an anticipated total of eight quarterly assessment periods beginning with the first quarterly assessment period in 2024, with the first payment due on June 28, 2024. While the special assessment will be collected at a quarterly rate of 3.36 bps for the initial eight-quarter collection period, given the update to the loss estimates and the increase in the aggregate special assessment base resulting from amendments to the reported amount of estimated uninsured deposits related to the bank failures, as of September 2024, the FDIC was projecting that the special assessment will be collected for an additional two quarters beyond the initial eight-quarter collection period, at a lower rate.

For the years ended December 31, 2024, 2023, and 2022, we incurred deposit insurance assessment expenses of $18.3 million, $18.0 million, and $8.3 million, respectively. The 2024 and 2023 expenses included the impact of the 2 bps initial base deposit insurance assessment rate increase, effective the first quarter of 2023, as well as $840,000 and $3.4 million for the years ended 2024 and 2023, respectively, attributable to the FDIC’s special assessment described above.

Transactions with Affiliates**.**The authority of the Bank to engage in transactions with related parties or affiliates, or to make loans to insiders, is limited by Sections 23A and 23B of the Federal Reserve Act of 1913 and Regulation W. Loan transactions with an affiliate generally must be collateralized and certain transactions between the Bank and its affiliates, including the sale of assets, the payment of money or the provision of services, must be on terms and conditions that are substantially the same, or at least as favorable to the Bank, as those prevailing for comparable nonaffiliated transactions. In addition, the Bank generally may not purchase securities issued or underwritten by affiliates.

Prompt Corrective Action**.** Federal banking regulators are authorized and, under certain circumstances, required to take certain actions against banks that fail to meet their capital requirements. The federal bank regulatory agencies have additional enforcement authority with respect to undercapitalized depository institutions. “Well capitalized” institutions may generally operate without additional supervisory restriction. With respect to “adequately capitalized” institutions, such banks cannot normally pay dividends or make any capital contributions that would leave it undercapitalized, they cannot pay a management fee to a controlling person if, after paying the fee, it would be undercapitalized, and they cannot accept, renew, or roll over any brokered deposit unless the bank has applied for and been granted a waiver by the FDIC.

Immediately upon becoming “undercapitalized,” a depository institution becomes subject to the provisions of Section 38 of the Federal Deposit Insurance Act, which: (i) restrict payment of capital distributions and management fees; (ii) require that the appropriate federal banking agency monitor the condition of the institution and its efforts to restore its capital; (iii) require submission of a capital restoration plan; (iv) restrict the growth of the institution’s assets; and (v) require prior approval of certain expansion proposals. The appropriate federal banking agency for an undercapitalized institution also may take any number of discretionary supervisory actions if the agency determines that any of these actions is necessary to resolve the problems of the institution at the least possible long-term cost to the Deposit Insurance Fund, subject in certain cases to specified procedures. These discretionary supervisory actions include: (i) requiring the institution to raise additional capital; (ii) restricting transactions with affiliates; (iii) requiring

divestiture of the institution or the sale of the institution to a willing purchaser; and (iv) any other supervisory action that the agency deems appropriate. These and additional mandatory and permissive supervisory actions may be taken with respect to significantly undercapitalized and critically undercapitalized institutions. The Bank met the definition of being “well capitalized” as of December 31, 2024.

The prompt corrective action regulations pursuant to Section 38 of the Federal Deposit Insurance Act require for well-capitalized status a minimum Tier 1 leverage ratio of 5.0%, a minimum common equity Tier 1 capital ratio of 6.5%, a minimum Tier 1 capital ratio of 8.0%, and a minimum total capital ratio of 10.0%.

Community Reinvestment Act. The Bank is subject to the requirements of the CRA. The CRA imposes on financial institutions an affirmative and ongoing obligation to meet the credit needs of the local communities, including low- and moderate-income neighborhoods. If the Bank receives a rating from the Federal Reserve of less than “satisfactory” under the CRA, restrictions on operating activities would be imposed. In addition, in order for a financial holding company, like the Company, to commence any new activity permitted by the BHCA, or to acquire any company engaged in any new activity permitted by the BHCA, each insured depository institution subsidiary of the financial holding company must have received a rating of at least “satisfactory” in its most recent examination under the CRA. The Bank received a “satisfactory” CRA rating in its most recent examination.

On October 24, 2023, the federal bank regulatory agencies jointly issued a final rule to modernize CRA regulations consistent with the following key goals: (i) to encourage banks to expand access to credit, investment, and banking services in low to moderate income communities; (ii) to adapt to changes in the banking industry, including internet and mobile banking and the growth of non-branch delivery systems; (iii) to provide greater clarity and consistency in the application of the CRA regulations, including adoption of a new metrics-based approach to evaluating bank retail lending and community development financing; and (iv) to tailor CRA evaluations and data collection to bank size and type, recognizing that differences in bank size and business models may impact CRA evaluations and qualifying activities. As currently written, most of the final CRA rule’s requirements will be applicable beginning January 1, 2026, with certain requirements, including the data reporting requirements, to become applicable as of January 1, 2027. However, the legality of the final rule is being challenged and a preliminary injunction against enforcing new rules implementing the new CRA regulations has been granted. Additionally, the final CRA rule may be impacted by President Trump’s presidential memorandum entitled “Regulatory Freeze Pending Review” discussed below. The Bank is actively monitoring the status of the legal challenge and is continuing to evaluate the expected impact of the modified CRA regulations. We cannot currently predict the nature and timing of future developments that may potentially impact the final CRA rule.

FHLB. The Bank is a member of the FHLB of Atlanta, which is one of 12 regional Federal Home Loan Banks that provide funding to their members for making housing loans as well as for affordable housing and community development loans. Each Federal Home Loan Bank serves as a reserve, or central bank, for the members within its assigned region, and makes loans to its members in accordance with policies and procedures established by the Board of Directors of the applicable Federal Home Loan Bank. As a member, the Bank must purchase and maintain stock in the FHLB.

Anti-money laundering and U.S. economic sanctions compliance**.**The Bank is subject to the Bank Secrecy Act, as amended (the “Bank Secrecy Act”), and its implementing regulations, which require financial institutions to, among other things, implement and maintain anti-money laundering and countering the financing of terrorism (“AML/CFT”) compliance programs designed to prevent money laundering and the financing of terrorism and to adhere to recordkeeping and reporting requirements which require the Bank to collect and maintain information about its customers and, in some instances, its legal entity customers’ beneficial owners. For example, the Bank Secrecy Act, as amended, and its implementing regulations require banks and other covered financial institutions to verify their customers’ identity at account opening and to establish written procedures to identify and verify the identity of the beneficial owners of legal entity customers. The Bank Secrecy Act and its implementing regulations also require banks and other covered financial institutions to implement and maintain risk-based procedures for conducting ongoing customer due diligence to, among other things, (1) understand the nature and purpose of customer relationships to develop a customer risk profile and (2) conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, maintain and update customer information. Banks and other covered financial institutions are required to integrate their customer due diligence policies, procedures and process within their broader AML/CFT compliance programs.

The Anti-Money Laundering Act of 2020, enacted on January 1, 2021 as part of the National Defense Authorization Act (“AMLA”), amends the Bank Secrecy Act but does not directly impose new requirements on banks. In an effort to increase transparency in the U.S. financial system and prevent shell entities from being used to launder money or hide assets, AMLA includes the Corporate Transparency Act (the “CTA”), which requires the U.S. Treasury Department’s Financial Crimes Enforcement Network (“FinCEN”) to, among other things, establish a national beneficial ownership information registry. In September 2022, FinCEN issued the final Beneficial Ownership Information Reporting Requirements rule (the “BOI Reporting Rule”), which, effective January 1, 2024, requires certain “reporting companies” to file beneficial ownership information reports with FinCEN that will be stored in the national beneficial ownership registry and will detail the reporting company’s beneficial owners. A federal court has suspended enforcement of the BOI Reporting Rule pending ongoing litigation regarding the constitutionality of the CTA and, thus, it is not clear what impact the CTA and BOI Reporting Rule will have on the Bank.

The U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”) is responsible for administering U.S. economic sanctions, which prohibit certain transactions with designated foreign countries, nationals and others. OFAC-administered sanctions take on many different forms. For example, sanctions may include: (1) restrictions on trade with or investment in a sanctioned country, including prohibitions on U.S. persons engaging in financial transactions relating to, making investments in, or providing investment-related advice or assistance to, a sanctioned country; and (2) blocking assets in which certain sanctioned foreign governments, entities or individuals have an interest, by prohibiting transfers of property subject to U.S. jurisdiction, including property in the possession or control of U.S. persons. OFAC maintains a list of designated persons, groups or entities that are the target of sanctions, including the “Specially Designated Nationals and Blocked Persons List.” The assets of designated persons, groups or entities are blocked and U.S. persons are generally prohibited from dealing with any such persons. Moreover, blocked assets, for example property and bank deposits, cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. If the Bank finds a name on any transaction, account or wire transfer associated with a sanctioned person, it must freeze or block such account or transaction, file a blocked property report with OFAC and notify the appropriate authorities.

Volcker Rule.** **The Dodd-Frank Act prohibits banks and their affiliates from engaging in proprietary trading and investing in, sponsoring, and having certain relationships with private funds such as hedge funds or private equity funds that would be considered an investment company for purposes of the Volcker Rule. The compliance requirements under regulations implementing the Volcker Rule are tailored based on the size and scope of trading activities. Because its total trading assets and liabilities are maintained under $1 billion, the Company is categorized with “limited” total trading assets and liabilities and benefits from a presumption of compliance with the Volcker Rule.

Consumer Financial Protection**.** The Bank is subject to a number of federal and state consumer protection laws that extensively govern its relationship with its customers. These laws include, but are not limited to, the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Truth in Lending Act, the Truth in Savings Act, the Electronic Fund Transfer Act, the Home Mortgage Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Service Members Civil Relief Act, the Consumer Financial Protection Act and their respective state law counterparts. If we fail to comply with these laws and regulations, we may be subject to various penalties or enforcement actions. Failure to comply with consumer protection requirements may also result in delays in obtaining or failure to obtain any required bank regulatory approval for our proposed merger or acquisition transactions.

The CFPB has broad rulemaking, supervisory and enforcement powers under various federal consumer financial protection laws, including the laws referenced above, other fair lending laws, and certain other statutes. The CFPB also has examination and primary enforcement authority with respect to consumer financial laws for depository institutions with $10 billion or more in assets, including, among other things, the authority to prohibit “unfair, deceptive, or abusive” acts and practices in connection with the offering of consumer financial products. The CFPB may issue cease-and-desist orders against banks and other entities that violate consumer financial laws. The CFPB also may institute civil actions against banks and other entities that violate federal consumer financial laws, and such civil actions may result in civil penalties or injunctions. Further, regulatory positions taken by the CFPB may influence how other regulatory agencies apply the consumer financial protection laws and regulations subject to such regulatory positions. The CFPB may issue regulations that impact products and services offered by the Company or the Bank. The regulations could reduce the fees that we receive, alter the way we provide our products and services or expose us to greater risk of private litigation or regulatory enforcement action.

For example, the CFPB has, among other things, issued final rules as part of an initiative to reduce the amounts and types of fees financial institutions may charge. On December 12, 2024, the CFPB issued a final rule that would amend Regulation E and Regulation Z, which implement the Truth in Lending Act, and treat discretionary overdraft services offered by financial institutions with more than $10 billion in assets as credit. As a result, in connection with such discretionary overdraft services, consumers would receive new disclosures and would be evaluated for their ability to repay the obligation. The final rule would exempt “courtesy” overdraft services, which are services where the overdraft fee covers only the break-even cost of the service or falls within a CFPB-prescribed break-even cost. Fees charged in excess of break-even overdraft costs would be treated as finance charges. The final rule also prohibits covered financial institutions from conditioning the extension of overdraft credit on a consumer’s compulsory use of preauthorized transfers under Regulation E. A covered financial institution must offer a consumer at least one method of repaying an overdraft credit balance other than by preauthorized electronic fund transfer. The final rule has an effective date of October 1, 2025.

On October 22, 2024, the CFPB issued a final rule to implement Section 1033 of the Dodd-Frank Act, which requires covered financial institutions to make consumer data about financial services and products more readily available to consumers and authorized third parties. The final rule adds consumer protection obligations on financial institutions and third parties authorized by the consumer to collect and use that data. Financial institutions are required to make specified information available through an electronic interface including 24 months of transactional data available, account information (e.g., account balance, upcoming bills, basic account verification) information to initiate payment to and from accounts, and terms and conditions under which the account or card was provided. The final rule establishes five deadlines based on assets size with the first date on April 1, 2026, and the second compliance date, which would be expected to apply to the Bank, of April 1, 2027.

Under President Trump’s presidential memorandum entitled “Regulatory Freeze Pending Review” discussed below, rules with future effective dates may be re-evaluated. We cannot currently predict the nature and timing of future developments that may potentially impact CFPB rules and proposals.

Mortgage Banking Regulation. In connection with making mortgage loans, we are subject to rules and regulations that, among other things, establish standards for loan origination and servicing, prohibit discrimination, provide for inspections and appraisals of property, require credit reports on prospective borrowers, in some cases restrict certain loan features and fix maximum interest rates and fees, require the disclosure of certain basic information to mortgagors concerning credit and settlement costs, limit payment for settlement services to the reasonable value of the services rendered and require the maintenance and disclosure of information regarding the disposition of mortgage applications based on race, gender, geographical distribution and income level, and establish requirements for servicing mortgage loans including loan mitigation. We are also subject to rules and regulations that require the collection and reporting of significant amounts of information with respect to mortgage loans and borrowers.

Our mortgage origination activities are subject to Regulation Z, which implements the Truth in Lending Act. Certain provisions of Regulation Z require creditors to make a reasonable and good faith determination based on verified and documented information that a consumer applying for a mortgage loan has a reasonable ability to repay the loan according to its terms. Creditors are required to determine consumers’ ability to repay in one of two ways. The first alternative requires the creditor to consider the following eight underwriting factors when making the credit decision: (i) current or reasonably expected income or assets; (ii) current employment status; (iii) the monthly payment on the covered transaction; (iv) the monthly payment on any simultaneous loan; (v) the monthly payment for mortgage-related obligations; (vi) current debt obligations, alimony, and child support; (vii) the monthly debt-to-income ratio or residual income; and (viii) credit history. Alternatively, the creditor can originate “qualified mortgages,” which are entitled to a presumption that the creditor making the loan satisfied the ability-to-repay requirements. In general, a “qualified mortgage” is a mortgage loan without negative amortization, interest-only payments, balloon payments, or terms exceeding 30 years. In addition, to be a qualified mortgage, the points and fees paid by a consumer cannot exceed 3% of the total loan amount.

Qualified mortgages that are higher-priced (e.g., subprime loans) garner a rebuttable presumption of compliance with the ability-to-repay rules, while qualified mortgages that are not “higher-priced” (e.g., prime loans) are given a safe harbor of compliance. To meet the mortgage credit needs of a broader customer base, we are predominantly an originator of mortgages that are intended to comply with the ability-to-pay requirements.

Real Estate Lending Standards and Guidance. The federal banking agencies have adopted uniform regulations setting forth standards for extensions of credit that are secured by real estate. Under these regulations, the Bank must adopt and maintain written policies establishing appropriate limits and standards for extensions of credit that are secured by real estate. These policies must establish loan portfolio diversification standards, prudent underwriting standards (including loan-to-value limits) that are clear and measurable, loan administration procedures and documentation, approval and reporting requirements.

The federal banking agencies have also jointly issued guidance on “Concentrations in Commercial Real Estate Lending,” which defines CRE loans as exposures secured by raw land, land development and construction (including 1-4 family residential construction), multi-family property, and non-farm nonresidential property where the primary or a significant source of repayment is derived from rental income or the proceeds of the sale, refinancing, or permanent financing of the property. The guidance requires that appropriate processes be in place to identify, monitor and control risks associated with real estate lending concentrations. If a concentration is present, management must employ heightened risk management practices that address key elements, including board and management oversight and strategic planning, portfolio management, development of underwriting standards, risk assessment and monitoring through market analysis and stress testing, and maintenance of increased capital levels as needed to support the level of CRE lending. The guidance states that the following metrics may indicate a concentration of CRE loans, but that these metrics are neither limits nor a safe harbor: (1) total reported loans for construction, land development, and other land represent 100% or more of total risk-based capital; or (2) total reported loans secured by multi-family properties, nonfarm non-residential properties (excluding those that are owner-occupied), and loans for construction, land development, and other land represent 300% or more of total risk-based capital and the bank’s CRE loan portfolio has increased 50% or more during the prior 36 months

Data Privacy and Cybersecurity.* *We are, or may in the future become, subject to a variety of complex and evolving laws, regulations, rules and standards at the federal, state and local levels regarding data privacy and cybersecurity. Data privacy and cybersecurity are currently areas of considerable legislative and regulatory attention, with new or modified laws, regulations, rules and standards being frequently adopted and potentially subject to divergent interpretation or application in a manner that may create inconsistent or conflicting requirements for businesses. Data privacy and cybersecurity laws and regulations often impose strict requirements regarding the collection, storage, handling, use, disclosure, transfer, protection and other processing of personal information, which may have adverse consequences on our business, including incurring significant compliance costs, requiring changes to our business or operations and imposing severe penalties for non-compliance. Specifically, we are subject to various laws and regulations that address the privacy of nonpublic personal financial information of customers. As a financial institution, we must provide our customers information regarding our policies and procedures with respect to the handling of customers’ personal information. We must also conduct an internal risk assessment of our ability to protect customer information. These data privacy laws and regulations generally prohibit financial institutions from providing a customer’s personal financial information to unaffiliated parties without prior notice and approval from the customer.

For example, at the federal level, the federal banking regulators have adopted certain rules, including pursuant to the

amended Gramm-Leach-Bliley Act in 2018 (“GLBA”), that limit the ability of banks and other financial institutions to disclose non-public personal information about consumers to third parties. In addition, consumers may also prevent disclosure among affiliated companies of certain non-public personal information that is assembled or used to determine eligibility for a product or service, such as that shown on consumer credit reports and application information. Consumers also have the option to direct banks and other financial institutions not to share certain information about transactions and experiences with affiliated companies for the purpose of marketing products or services. Additionally, an amendment to Regulation S-P, an implementing regulation promulgated under the GLBA, was adopted by the SEC on May 16, 2024 and requires broker-dealers and investment advisors to, among other things, adopt and implement an incident response program as part of their formal data security policies and procedures and report data breaches to affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization within 30 days of becoming aware of such data breach.

Additionally, the federal bank regulatory agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a financial institution’s board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services. For example, the federal bank regulatory agencies expect financial institutions to establish lines of defense and to ensure that their risk management processes address the risk posed by compromised customer credentials and also

expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption and maintenance of the institution’s operations after a cyberattack. If we fail to meet the expectations set forth in this regulatory guidance, we could be subject to various regulatory actions and any remediation efforts may require us to devote significant resources.

The federal bank regulatory agencies issued a final rule to improve the sharing of information about cyber incidents that may affect the U.S. banking system. The rule requires a banking organization to notify its primary federal regulator of any significant “computer-security incident” as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred. Notification is required for incidents that have materially disrupted or degraded—or are reasonably likely to materially disrupt or degrade—for example, business line(s) that would result in a material loss of revenue, a banking organization’s ability to deliver certain banking products and services, or operations, the failure of which would pose a threat to the stability of the U.S. financial sector. In addition, the rule requires a bank service provider to notify affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has materially disrupted or degraded or is reasonably likely to materially disrupt or degrade covered services provided to such banking organization customers for four or more hours. The rule became effective May 1, 2022.

Additionally, the enactment of the Cyber Incident Reporting for Critical Infrastructure Act (“CIRCIA”) in 2022, once rulemaking is complete, will require, among other things, covered entities to report significant cyber incidents, including ransomware attacks, to the Cybersecurity and Infrastructure Security Agency (“CISA”) within 72 hours from the time the covered entity reasonably believes the incident occurred (and within 24 hours of making a ransom payment as a result of a ransomware attack). The CISA proposed a rule under the CIRCIA in April 2024 that, among other things, would clarify the scope of cyber incidents to be reported and would further define covered entities subject to the CIRCIA to expressly include companies in the financial services sector that are required to report cyber incidents to their respective primary federal regulators.

The Company and its nonbanking subsidiaries are also subject to rules and regulations issued by the Federal Trade Commission, which regulates unfair or deceptive acts or practices, including with respect to data privacy and cybersecurity. Additionally, like other lenders, the Bank uses credit bureau data in its underwriting activities. Use of such data is regulated under the Fair Credit Reporting Act, which also regulates reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information between affiliates, and using affiliate data for marketing purposes. Similar state laws may impose additional requirements on the Company and its subsidiaries.

Data privacy and cybersecurity are areas of increasing state legislative focus. Several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also implemented, or are considering implementing, comprehensive data privacy and cybersecurity laws and regulations, such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and the Virginia Consumer Data Protection Act (“VCDPA”). The VCDPA grants Virginia residents the right to access, correct, delete, know, and opt-out of the sale and processing for targeted advertising purposes of their personal information, similar to the protections provided by similar consumer data privacy laws in California and in Europe. The VCDPA also imposes data protection assessment requirements and authorizes the Attorney General of Virginia to enforce the VCDPA but does not provide a private right of action for consumers. The Bank is exempt from the VCDPA, but certain third-party vendors of the Company or the Bank are subject to the VCDPA, which could negatively impact the products or services that we obtain from those vendors. In addition, laws in all 50 U.S. states generally require businesses to provide notice under certain circumstances to individuals whose personal information has been disclosed as a result of a data breach. Moreover, Congress has considered, and is currently considering, various proposals for more comprehensive data privacy and cybersecurity legislation, to which we and/or the Bank may be subject if passed. These laws and regulations impose compliance costs and create obligations and, in some cases, reporting obligations, and compliance with these laws, regulations, and obligations may require us to use significant resources. With increased focus on data privacy and cybersecurity, we are continuing to monitor legislative, regulatory, and supervisory developments related thereto. For more information on our cybersecurity practices, see Item 1C. “Cybersecurity.”

Incentive Compensation**.**The Dodd-Frank Act requires the federal banking agencies and the SEC to establish joint regulations or guidelines prohibiting incentive-based payment arrangements at specified regulated entities with at least $1 billion in total consolidated assets, that encourage inappropriate risks by providing an executive officer, employee, director, or principal shareholder with excessive compensation, fees, or benefits that could lead to material financial loss

to the entity. In 2016, the SEC and the federal banking agencies proposed rules that prohibit covered financial institutions (including bank holding companies and banks) from establishing or maintaining incentive-based compensation arrangements that encourage inappropriate risk taking by providing covered persons (consisting of senior executive officers and significant risk takers, as defined in the rules) with excessive compensation, fees, or benefits that could lead to material financial loss to the financial institution. It is unclear when or whether this rule will be finalized.

Future Regulation

From time to time, various legislative and regulatory initiatives are introduced in Congress and state legislatures, as well as by regulatory agencies. Such initiatives may include proposals to expand or contract the powers of bank holding companies and depository institutions or proposals to substantially change the financial institution regulatory system. Such legislation or regulation could change banking statutes and our operating environment in substantial and unpredictable ways. If enacted or implemented, such legislation or regulation could increase or decrease our cost of doing business, limit or expand permissible activities, or affect the competitive balance among banks, savings associations, credit unions, and other financial institutions. We cannot predict whether any such legislation or regulation will be enacted or implemented, and, if so, the effect that it would have on our financial condition or results of operations. For example, in January 2025, the Federal Reserve stated that Vice Chair for Supervision Michael Barr would step down from the position, effective February 28, 2025. The Federal Reserve stated that it will not issue any major rulemakings from the time of the announcement until a new vice chair for supervision is confirmed by the U.S. Senate. In addition, in January 2025, President Trump issued a presidential memorandum titled “Regulatory Freeze Pending Review” that directs federal agencies to (1) not propose or issue any rules until they are reviewed and approved by a department or agency head appointed by President Trump, (2) immediately withdraw any unpublished rules to allow for the review by a department or agency head as described above, and (3) consider postponing for 60 days from the date of the executive order the effective date for any rules that have been published in the Federal Register, or any rules that have been issued but have not taken effect, to allow for review of any questions of fact, law, or policy.

Effect of Governmental Monetary Policies

Our operations are affected not only by general economic conditions but also by the policies of various regulatory authorities. In particular, the Federal Reserve uses monetary policy tools to impact money market and credit market conditions and interest rates to influence general economic conditions. These policies have a significant impact on our overall growth and distribution of loans, investments, and deposits; they affect market interest rates charged on loans or paid for time and savings deposits and can significantly influence employment and inflation rates. Federal Reserve monetary policies have had a significant effect on the operating results of commercial banks, including us, in the past and are expected to do so in the future.

Filings with the SEC

Our annual reports on Form 10-K, quarterly reports on Form 10-Q, and current reports on Form 8-K and amendments to those reports filed or furnished to the SEC pursuant to the Exchange Act are available at no cost on our investor relations website,http://investors.atlanticunionbank.com, as soon as reasonably practicable after we file, or furnish, such documents with the SEC. The information contained on our website is not a part of this Form 10-K, nor incorporated by reference into this Form 10-K or of any other filing with the SEC. Our SEC filings are also available at no cost through the SEC’s website athttp://www.sec.gov.