WILSON BANK HOLDING CO

There is no assurance that existing branches or future branches will maintain or achieve deposit levels, loan balances or other operating results necessary to avoid losses or produce profits. If the Company is unable to grow its revenues in amounts necessary to support this higher expense base, its results of operations will be negatively impacted. Execution on a growth strategy could lead to increases in overhead expenses if the Company were to add new offices and staff. The Company’s historical results may not be indicative of future results or results that may be achieved if it were to increase the number and concentration of its branch offices in its existing or new markets.

Development of Offices. There are considerable costs involved in opening branches, and new branches generally do not generate sufficient revenues to offset their costs until they have been in operation for at least a year or more. Accordingly, any new branches the Company establishes can be expected to negatively impact the Company’s earnings for some period of time until they reach certain economies of scale. The same is true for the Company’s efforts to expand in these markets with the hiring of additional seasoned professionals with significant experience in that market. The Company’s expenses could be further increased if it encounters delays in opening any of its new branches, including as a result of supply-chain disruption and labor challenges like those affecting the construction industry over the last few years, or regulatory actions or delays. The Company may be unable to accomplish future branch expansion plans due to a lack of available satisfactory sites, difficulties in acquiring such sites, failure to receive any required regulatory approvals, on a timely basis or at all, increased expenses or loss of potential sites due to complexities associated with zoning and permitting processes, higher than anticipated construction costs or other factors. Finally, any branch may not meet the Company’s long-term profitability expectations or otherwise be successful even after it has been established or acquired, as the case may be.

Regulatory and Economic Factors. The growth of the Bank may be adversely affected by a number of regulatory and economic developments or other events. Failure to obtain required regulatory approvals, changes in laws and regulations or other regulatory developments and changes in prevailing economic conditions or other unanticipated events may prevent or adversely affect the Company’s growth and expansion. Such factors may cause the Company to alter its growth and expansion plans or slow or halt the growth and expansion process, which may prevent the Company from entering into or expanding in its targeted markets or allow competitors to gain or retain market share in the Company’s existing markets.

Failure to successfully address these and other issues related to the Company’s expansion could have a material adverse effect on its financial condition and results of operations, and could adversely affect its ability to successfully implement its business strategy.

The Company is dependent on its information technology and telecommunications systems and third-party servicers, and systems failures, interruptions or breaches of security could have an adverse effect on its financial condition and results of operations, as well as cause legal or reputational harm.

The Company is dependent upon information technologies, computer systems and networks, including those the Company maintains and those maintained and provided to the Company by third parties, to conduct operations and is reliant on technology to help increase efficiency in its business. These systems could become unavailable or impaired due to a variety of causes, including storms and other natural disasters, terrorist attacks, fires, phishing schemes, social engineering, utility outages, internal or external theft or fraud, design defects, human error, misconduct or complications or failures encountered as existing systems are maintained, replaced or upgraded. For example, the Company’s financial, accounting, data processing, or other operating or security systems or infrastructure or those of third parties upon which it relies may fail to operate properly or become compromised, disabled or damaged, which could adversely affect the Company’s ability to process transactions or provide services. In the event that backup systems are utilized, they may not process data as quickly as the Company’s primary systems and the Company may experience data losses in the course of such recovery. The Company continuously updates the systems on which it relies to support its operations and growth and to remain compliant with all applicable laws, rules and regulations. This updating entails significant costs and creates risks associated with implementing new systems and integrating them with existing ones, including business interruptions that may occur in the course of such implementation challenges. The Company maintains a system of internal controls and security to mitigate the risks of many of these occurrences and maintains insurance coverage for certain risks; however, should an event, including a cyberattack (including a ransomware attack), occur that is not prevented or detected by the Company’s internal controls, causes an interruption, degradation or outage in service, causes the Company to pay a ransom fee or is uninsured against or in excess of applicable insurance limits, such occurrence could have an adverse effect on the Company’s business and its reputation, which, in turn, could have a material adverse effect on its financial condition, results of operations and liquidity.

The Company’s operations rely on the secure processing, storage and transmission of confidential, proprietary, personal and other information in its computer systems and networks. Although the Company takes protective measures and endeavors to modify these systems as circumstances warrant, the security of its computer systems, software and networks may be vulnerable to breaches, unauthorized access, misuse, computer viruses or other malicious code and other events that could have a security impact. The Company provides its customers the ability to bank remotely, including over the Internet or through their mobile device. The secure transmission of confidential information is a critical element of remote and mobile banking. The Company’s network, and the systems of parties with whom it contracts or on which it relies, as well as those of its customers and regulators, could be vulnerable to unauthorized access, computer viruses, phishing schemes, social engineering, spam attacks, ransomware attacks, human error, natural disasters, power loss and other security breaches. Sources of attacks vary and may include hackers, disgruntled employees or vendors, organized crime, terrorists, foreign governments, corporate espionage and activists. In recent periods, there continues to be a rise in electronic fraudulent activity (including wire fraud), security breaches and cyber-attacks within the financial services industry, especially in the commercial banking sector due to cyber criminals targeting commercial bank accounts or seeking to infiltrate legitimate transactions. The Company believes these types of efforts will continue to increase in frequency and in their level of sophistication. The Company has established policies, processes, and procedures to identify, measure, monitor, mitigate, report, and analyze risks associated with fraud, and continue to invest in systems, resources, and controls to detect and prevent it. There are inherent limitations, however, to the Company’s risk management strategies, systems, and controls as they may exist, or develop in the future. The Company may not appropriately anticipate, monitor, or identify these risks. If the Company’s risk management framework proves ineffective in connection with any fraudulent activity, it could suffer unexpected losses, it may have to expend resources detecting and correcting the failure in its systems, and it may be subject to potential claims from third parties and government agencies. The Company may also suffer reputational damage. Any of these consequences could adversely affect the Company’s business, financial condition, or results of operations.

Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, and the use of the Internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as the Company continues to increase its mobile-payment and other Internet-based product offerings and expand its internal use of cloud-based products and applications. Even the most advanced internal control environment may be vulnerable to compromise. Targeted social engineering attacks are becoming more prevalent and sophisticated, and are extremely difficult to prevent. Generative artificial intelligence is further increasing risks in this area, including by making fraud detection more difficult, particularly with detection devices that use voice recognition or authentication. The techniques used by bad actors change frequently, may not be recognized until launched and may not be recognized until well after a breach has occurred. Additionally, the existence of cyber-attacks or security breaches at third parties with access to the Company’s data, such as vendors, may not be disclosed to the Company in a timely manner. Consistent with industry trends, the Company remains at risk for attempted electronic fraudulent activity, as well as attempts at security breaches and cybersecurity-related incidents. The Company spends significant capital and other resources to protect against the threat of security breaches and computer viruses, and may be required to spend significant capital and other resources to alleviate problems caused by security breaches or viruses. To the extent that the Company’s activities or the activities of its vendors, regulators or customers involve the storage and transmission of confidential information, security breaches (including breaches of security of customer, vendor or regulatory systems and networks) and viruses could expose the Company to claims, litigation and other possible liabilities. Any inability to prevent or promptly detect security breaches or computer viruses could also cause existing customers to lose confidence in the Company’s systems and could adversely affect its reputation, results of operations and ability to attract and retain customers and businesses. In addition, a security breach could also subject the Company to additional regulatory scrutiny, expose it to civil litigation and possible financial liability and cause reputational damage.

The Company contracts with third-party vendors to provide software or services for many of its major systems, such as data processing, loan servicing and deposit processing system. The failure of these systems, or the termination of a third-party software license or service agreement on which any of these systems is based, could interrupt the Company’s operations. Because the Company’s information technology and telecommunications systems interface with and depend on third-party systems, the Company could experience service denials if demand for such services exceeds capacity or such third-party systems fail or experience interruptions, including as a result of viruses or other attacks. If sustained or repeated, a system failure or service denial could result in a deterioration of the Company’s ability to process new and renewal loans, gather deposits and provide customer service, compromise its ability to operate effectively, damage its reputation, result in a loss of customer business and/or subject it to additional regulatory scrutiny and possible financial liability, any of which could have a material adverse effect on the Company’s financial condition, results of operations and liquidity.

The Company also faces the risk of operational disruption, failure, termination, or capacity constraints of any of the third parties that facilitate its business activities, including vendors, exchanges, and other financial intermediaries. Such parties could also be the source or cause of an attack on, or breach of, the Company’s operational systems, data or infrastructure, and could disclose such attack or breach to the Company in a delayed manner or not at all. In addition, the Company may be at risk of an operational failure with respect to its customers’ systems. The Company’s risk and exposure to these matters remains heightened because of, among other things, the evolving nature of these threats and the continued uncertain global economic environment.

As cybersecurity threats continue to evolve, the Company will likely expend significant additional resources to continue to modify or enhance its protective measures, investigate and remediate any information security vulnerabilities, or respond to any changes to state or federal regulations, policy statements or laws concerning information systems or security. Any failure to maintain adequate security over its information systems, its technology-driven products and services or its customers’ personal and transactional information could negatively affect the Company’s business and its reputation and result in fines, penalties, or other costs, including litigation expense and/or additional compliance costs, all of which could have a material adverse effect on its financial condition, results of operations and liquidity. Furthermore, the public perception that a cyber-attack on the Company’s systems has been successful, whether or not this perception is correct, may damage the Company’s reputation with customers and third parties with whom it does business. A successful penetration or circumvention of system security could result in negative consequences for the Company, including loss of customers and business opportunities, disruption to the Company’s operations and business, misappropriation or destruction of the Company’s confidential information and/or that of its customers, or damage to its customers’ and/or third parties’ computers or systems, and could result in a violation of applicable privacy laws and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in the Company’s security measures, reputational damage, reimbursement or other compensatory costs, additional compliance costs, and could adversely impact the Company’s financial condition, results of operations and liquidity.

Competition from financial institutions and other financial service providers may adversely affect the Company’s profitability.

The banking business is highly competitive and the Company experiences competition in each of its markets from many other financial and non-financial institutions. The Company competes with commercial banks, credit unions, savings and loan associations, mortgage banking firms, consumer finance companies, securities brokerage firms, insurance companies, money market funds, and other mutual funds, mobile payment platforms, as well as other community banks and super-regional and national financial institutions that operate offices in the Company’s primary market areas and elsewhere. Many of the Company’s competitors are well-established, larger financial institutions that have greater resources and lending limits and a lower cost of funds than the Company.

Additionally, the Company faces competition from similarly sized and smaller community banks and credit unions, including those with senior management who were previously affiliated with other local or regional banks or credit unions or those controlled by investor groups with strong local business and community ties. These community banks may offer higher deposit rates or lower cost loans in an effort to attract the Company’s customers, and may attempt to hire the Company’s management and employees.

Some of the Company’s competitors, including credit unions, are not subject to certain regulatory constraints, such as the CRA, which requires the Company to, among other things, implement procedures to make and monitor loans throughout the communities it serves, and which is expected to become more expansive in 2024. Credit unions also have federal tax exemptions that may allow them to offer lower rates on loans and higher rates on deposits than taxpaying financial institutions such as commercial banks. In addition, non-depository institution competitors are generally not subject to the extensive regulation applicable to institutions, like the Bank, that offer federally insured deposits, which affords them the advantage of operating with greater flexibility and lower cost structures. Other institutions may have other competitive advantages in particular markets or may be willing to accept lower profit margins on certain products.

The Company competes with these other financial and non-financial institutions both in attracting deposits and in making loans. In addition, the Company has to attract its customer base from other existing financial institutions and from new residents. This competition at times has made it more difficult for the Company to make new loans and at times has forced the Company to offer higher deposit rates or utilize secondary sources of liquidity. Price competition for loans and deposits might result in the Company earning less interest on its loans and paying more interest on its deposits, which reduces the Company’s net interest income. The Company’s profitability depends upon its continued ability to successfully compete with an array of financial and non-financial institutions in its market areas.

The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. Technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as mobile payment and other automatic transfer and payment systems, and for banks that do not have a physical presence in the Company’s markets to compete for deposits. The absence of regulatory requirements may give non-bank financial companies a competitive advantage over the Company.

The Company’s key management personnel may leave at any time.

The Company’s future success depends to a significant extent on the continued service of its key management personnel, especially John McDearman, III, its president and chief executive officer, and John Foster, the president of the Bank. While the Company does not have employment agreements with any of its personnel and can provide no assurance that it will be able to retain any of its key officers and employees, particularly in times of intense competition for talent, as the Bank is currently experiencing, or attract and retain qualified personnel in the future, it has entered into non-competition agreements with such persons which would prevent them, in most circumstances, from competing with the Bank for one year following their termination. In addition, these persons are parties to certain deferred compensation, supplemental retirement and equity incentive plans, the benefits of which would cease to accrue upon the termination of the person’s employment with the Company or the Bank or the person competing with the Bank after the termination of their employment.

An ineffective risk management framework could have a material adverse effect on the Company’s strategic planning and its ability to mitigate risks and/or losses and could have adverse regulatory consequences.

The Company has implemented a risk management framework in an effort to identify and manage its risk exposure. This framework is comprised of various processes, systems and strategies, and is designed to manage the types of risk to which it is subject, including, among others, credit, market, liquidity, fraud, operational, capital, cybersecurity, compliance, strategic and reputational risks. The Company’s framework also includes financial, analytical, forecasting, or other modeling methodologies, which involves management assumptions and judgment. However, there is no assurance that the Company’s risk management framework will be effective under all circumstances or that it will adequately identify, manage or mitigate any risk or loss to it. If the Company’s risk management framework is not effective, it could suffer unexpected losses and become subject to regulatory consequences, as a result of which its business, financial condition, results of operations or prospects could be materially adversely affected.

The Company’s selection of accounting policies and methods may affect its reported financial results.

The Company’s accounting policies and methods are fundamental to how the Company records and reports its financial condition and results of operations. The Company’s management must exercise judgment in selecting and applying many of these accounting policies and methods so they comply with GAAP and reflect management’s judgment of the most appropriate manner to report its financial condition and results of operations. In some cases, management must select the accounting policy or method to apply from two or more alternatives, any of which may be reasonable under the circumstances, which may result in the Company reporting materially different results than would have been reported under a different alternative.

Certain accounting policies are critical to presenting the Company’s financial condition and results of operations. They require management to make difficult, subjective or complex judgments about matters that are uncertain. Materially different amounts could be reported under different conditions or using different assumptions or estimates. Because of the uncertainty of estimates involved in these matters, the Company may be required to do one or more of the following: significantly increase the allowance for credit losses or sustain loan losses that are significantly higher than the reserve provided; reduce the carrying value of an asset measured at fair value; recognize an other-than-temporary impairment of securities; or significantly increase the Company’s accrued tax liability. Any of these could have a material adverse effect on the Company’s business, financial condition or results of operations. For a discussion of the Company’s critical accounting policies, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations – Critical Accounting Estimates” contained in the 2023 Annual Report.

The Company currently invests in bank owned life insurance (“BOLI”) and may continue to do so in the future.

The Company had approximately $59.6 million in general, hybrid and separate account BOLI contracts at December 31, 2023. BOLI is an illiquid long-term asset that provides tax savings because cash value growth and life insurance proceeds are not taxable, subject to certain exceptions. However, if the Company needed additional liquidity and converted the BOLI to cash, such transaction would be subject to ordinary income tax and applicable penalties. The Company is also exposed to the credit risk of the underlying securities in the investment portfolio and to the insurance carrier’s credit risk (in a general account contract). If BOLI was exchanged to another carrier, additional fees would be incurred and a tax-free exchange could only be done for insureds that were still actively employed by the Company at that time. There is interest rate risk relating to the market value of the underlying investment securities associated with the BOLI in that there is no assurance that the market value of these securities will not decline. Investing in BOLI exposes the Company to liquidity, credit and interest rate risk, which could adversely affect the Company’s results of operations, financial condition and liquidity.

The Company’s business reputation and relationships are important and any damage to them could have a material adverse effect on its business.

The Company’s reputation is very important in sustaining its business and it relies on its relationships with its current, former and potential clients and shareholders and other actors in the industries that it serves. Any damage to the Company’s reputation, whether arising from regulatory, supervisory or enforcement actions, matters affecting the Company’s financial reporting or compliance with SEC requirements, negative publicity, the way in which the Company conducts its business or otherwise could strain its existing relationships and make it difficult for the Company to develop new relationships. Any such damage to the Company’s reputation and relationships could in turn lead to a material adverse effect on its business.

The Company’s business is dependent on technology, and an inability to invest in technological improvements may adversely affect the Company’s results of operations and financial condition.

The financial services industry is undergoing rapid technological changes with frequent introductions of new technology-driven products and services. In addition to better serving customers, the effective use of technology increases efficiency and enables financial institutions to reduce costs. The Company has made significant investments in data processing, management information systems and internet banking accessibility, but additional investments may be required or necessary. The Company’s future success will depend in part upon its ability to create additional efficiencies in its operations through the use of technology. Many of the Company’s competitors have substantially greater resources to invest in technological improvements. The Company cannot make assurances that its technological improvements will increase its operational efficiency or that it will be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to its customers.

The Company is subject to regulatory oversight and certain litigation, and its expenses related to this regulatory oversight and litigation may adversely affect its results.

The Company is from time to time subject to certain litigation in the ordinary course of its business. The Company may also be subject to claims related to its loan servicing programs, particularly those involving servicing of commercial real estate loans, and the fees it charges deposit customers who overdraw their accounts or have insufficient funds in their accounts to cover items when items are presented for payment. These and other claims and legal actions, as well as supervisory and enforcement actions by the Company’s regulators, including those with oversight of its loan servicing programs, could involve large monetary claims, capital directives, agreements with federal regulators, cease and desist penalties and orders and significant defense costs. The outcome of any such cases or actions is uncertain. Substantial legal liability or significant regulatory action against the Company could have material adverse financial effects or cause significant reputational harm to the Company, which in turn could seriously harm its business prospects.

In accordance with GAAP, for matters where a loss is not probable or the amount of the loss cannot be estimated, no accrual is established. For matters where it is probable the Company will incur a loss and the amount can be reasonably estimated, the Company establishes an accrual for the loss. Once established, the accrual is adjusted periodically to reflect any relevant developments. The actual cost of any outstanding legal proceedings or threatened claims, however, may turn out to be substantially higher than the amount accrued. Further, the Company’s insurance may not cover all litigation, other proceedings or claims, or the costs of defense. Future developments could result in an unfavorable outcome for any existing or new lawsuits or investigations in which the Company is, or may become, involved, which may have a material adverse effect on its business and its results of operations.

The soundness of other financial institutions, including those with whom the Company has engaged in transactions, could adversely affect the Company.

The Company’s ability to engage in routine funding transactions could be adversely affected by the actions and financial stability of other financial institutions. Financial services institutions are interrelated as a result of trading, clearing, counterparty or other relationships. The Company has exposure to various counterparties, including brokers and dealers, commercial and correspondent banks, and others. As a result, defaults by, or rumors or questions about, one or more financial services institutions, or the financial services industry generally, may result in market-wide liquidity problems and could lead to losses or defaults by such other institutions. Such occurrences could expose the Company to credit risk in the event of default of one or more counterparties and could have a material adverse effect on the Company’s financial position, results of operations and liquidity.

Natural disasters and the effects of a changing climate may adversely affect the Company and its customers.

The Company’s operations and customer base are located in markets where natural disasters, including tornadoes, severe storms, fires and floods often occur. Such natural disasters, like the tornado that struck the Company’s markets in March 2020, could significantly impact the local population and economies and the Company’s business, and could pose physical risks to its properties. Although the Company maintains insurance coverages for such events, a significant natural disaster in or near one or more of the Company’s markets could have a material adverse effect on its financial condition, results of operations or liquidity.

In addition to natural disasters, the impact of climate change, such as rising average global temperatures and rising sea levels, and the increasing frequency and severity of extreme weather events and natural disasters such as droughts, floods, wildfires and hurricanes could negatively impact the Company’s operations including its ability to provide financial products and services to its customers. Climate change also has the potential to negatively affect the collateral the Company takes to secure loans that it makes, the valuations of home prices or commercial real estate or the Company’s customers’ (particularly those that are engaged in industries that could be negatively affected by a shift to a low-carbon economy) ability and/or willingness to pay fees, repay outstanding loans or afford new products. Climate change could also cause insurability risk and/or increased insurance costs for the Company or its customers.

The Company’s asset valuation may include methodologies, estimations and assumptions which are subject to differing interpretations and could result in changes to asset valuations that may materially adversely affect its results of operations or financial condition.

The Company uses estimates, assumptions, and judgments when financial assets and liabilities are measured and reported at fair value. Assets and liabilities carried at fair value inherently result in a higher degree of financial statement volatility. Fair values and the information used to record valuation adjustments for certain assets and liabilities are based on quoted market prices and/or other observable inputs provided by independent third-party sources, when available. When such third-party information is not available, fair value is estimated primarily by using cash flow and other financial modeling techniques utilizing assumptions such as credit quality, liquidity, interest rates and other relevant inputs. Changes in underlying factors, assumptions, or estimates in any of these areas could materially impact the Company’s future financial condition and results of operations.

During periods of market disruption, including periods of significantly rising or high interest rates, rapidly widening credit spreads or illiquidity, it may be difficult to value certain assets if trading becomes less frequent and/or market data becomes less observable. There may be certain asset classes that were in active markets with significant observable data that become illiquid due to the current financial environment. In such cases, certain asset valuations may require more subjectivity and management judgment. As such, valuations may include inputs and assumptions that are less observable or require greater estimation. Further, rapidly changing and unprecedented credit and equity market conditions could materially impact the valuation of assets as reported within the Company’s consolidated financial statements and the period-to-period changes in value could vary significantly. Decreases in value may have a material adverse effect on results of operations or financial condition.

Valuation methodologies which are particularly susceptible to the conditions mentioned above include those used to value certain securities in the Company’s available for sale investment portfolio such as non-agency mortgage and asset-backed securities, in addition to loans held for sale and intangible assets.

If the Company fails to maintain an effective system of internal control over financial reporting, it may not be able to accurately report its financial results. As a result, current and potential holders of the Company’s common stock could lose confidence in the Company’s financial reporting, which would harm the Company’s business and the trading price of its securities.

Maintaining and adapting the Company’s internal controls over financial reporting, as required by Section 404 of the Sarbanes-Oxley Act, is expensive and requires significant management attention. Moreover, as the Company continues to grow, its internal controls may become more complex and require additional resources to ensure they remain effective amid dynamic regulatory and other guidance. Failure to maintain effective controls or implement required new or improved controls or difficulties encountered in the process may harm the Company’s results of operations and financial condition or cause it to fail to meet its reporting obligations. If the Company or its independent registered public accounting firm identify material weaknesses in the Company’s internal control over financial reporting or the Company is required to restate the its financial statements, the Company could be required to implement expensive and time-consuming remedial measures and could lose investor confidence in the accuracy and completeness of its financial reports. The Company may also face regulatory enforcement or other actions. This could have an adverse effect on the Company’s business, financial condition or results of operations, as well as the trading price of the Company’s securities, and could potentially subject the Company to litigation.

Changes in financial accounting and reporting standards, or the interpretation of those standards could affect the way the Company accounts for its operations and these changes could have a material adverse effect on the Company’s financial condition and results of operations.

The Financial Accounting Standards Board and the SEC may change the financial accounting and reporting standards, or the interpretation of those standards, that govern the preparation of the Company’s external financial statements from time to time. The impact of these changes or the application thereof on the Company’s financial condition and operations can be difficult to predict.

Regulatory and Compliance Risks

Federal or state legislation or regulation may increase the Company’s expenses and reduce earnings.

Federal bank regulators continue to closely scrutinize financial institutions, and additional restrictions have been proposed or adopted by regulators and by Congress. Changes in tax law, federal legislation, regulation or policies, such as bankruptcy laws, deposit insurance, consumer protection laws, laws and regulations regarding fair lending and investments in communities (including the recently adopted changes to the CRA rules), and capital requirements, among others, can result in significant increases in the Company’s expenses and/or charge-offs, which may adversely affect its results of operations and financial condition. Changes in state or federal tax laws or regulations can have a similar impact. State and municipal governments, including the State of Tennessee, could seek to increase their tax revenues through increased tax levies which could have a meaningful impact on the Company’s results of operations. Furthermore, financial institution regulatory agencies may continue to be aggressive in responding to concerns and trends identified in examinations, including in the case of service charges banks impose on customers related to overdrafts and instances in which customers’ accounts do not have sufficient funds to cover items that are presented. Regulatory scrutiny is also expected to remain high following the high profile bank failures in the first half of 2023. These actions and elevated scrutiny could include the issuance of additional formal or informal enforcement or supervisory actions and the imposition of monetary penalties, and whether formal or informal, could result in the Company’s or the Bank’s agreeing to limitations or monetary penalties or to take actions that limit its operational flexibility, restrict its growth, increase its operating expenses, lower the Company’s non-interest income or increase its capital or liquidity levels, any of which could materially and adversely affect the Company’s results of operations and financial condition. Failure to comply with any formal or informal regulatory actions or restrictions, including informal supervisory actions, could lead to further regulatory enforcement actions. Negative developments in the financial services industry, like the turmoil in the banking industry that was experienced in the first half of 2023, and the impact of recently enacted or proposed legislation (or interpretation of existing legislation) in response to those developments could negatively impact the Company’s operations by restricting its business operations, including its ability to originate or sell loans or by requiring it to hold move elevated levels of capital or deduct from its regulatory capital unrealized losses in its securities portfolio, and adversely impact its financial performance. In addition, industry, legislative or regulatory developments may cause the Company to materially change its existing strategic direction, business policies, capital strategies, compensation or operating plans.

Additionally, the Company is subject to laws regarding its handling, disclosure and processing of personal and confidential information of certain parties, such as its employees, customers, suppliers, counterparties and other third parties. The GLB Act requires the Company to periodically disclose its privacy policies and practices relating to sharing such information and enables retail customers to opt out of the Company’s ability to share information with unaffiliated third parties, under certain circumstances. Other laws and regulations impact the Company’s ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes, or to contact customers with marketing offers. In addition to their obligations to safeguard customer information under GLB Act regulations, financial institutions, like the Bank, are subject to regulations that require the institutions when they become aware of an incident of unauthorized access to sensitive customer information, to conduct a reasonable investigation to promptly determine the likelihood that the information has been or will be misused. If the institution determines that misuse of the sensitive customer information has occurred or is reasonably possible, it should notify the affected customers as soon as possible. The Company is subject to laws that require it to implement a comprehensive information security program that includes administrative, technical and physical safeguards to protect the security and confidentiality of customer records and information. Additionally, other legislative and regulatory activity continue to lend uncertainty to privacy compliance requirements that impact the Company’s business. The Company also expects that there will continue to be new laws, regulations and industry standards concerning privacy, data protection and information security proposed and enacted in various jurisdictions. The potential effects of pending legislation are far-reaching and may require the Company to modify its data processing practices and policies and to incur substantial costs and expenses in an effort to comply.

The Company, as well as the Bank, operate in an increasingly highly regulated environment and are supervised and examined by various federal and state regulatory agencies who may adversely affect the Company’s ability to conduct business.

The TDFI and the FRB supervise and examine the Bank and the Company, respectively. Because the Bank’s deposits are federally insured, the FDIC also regulates its activities. These and other regulatory agencies impose certain regulations and restrictions on the Bank, including:

●

explicit standards as to capital and financial condition;

●

limitations on the permissible types, amounts and extensions of credit and investments;

●

restrictions on permissible non-banking activities; and

●

restrictions on dividend payments.

Federal and state regulatory agencies have extensive discretion and power to prevent or remedy unsafe or unsound practices or violations of law by banks and bank holding companies. As a result, the Company must expend significant time and expense to assure that it is in compliance with regulatory requirements and agency practices.

The Company, as well as the Bank, also undergoes periodic examinations by one or more regulatory agencies. Following such examinations, the Company or the Bank may be required, among other things, to make additional provisions to its allowance for credit loss, to restrict its operations or to increase its capital levels. These actions would result from the regulators’ judgments based on information available to them at the time of their examination. The Bank’s operations are also governed by a wide variety of state and federal consumer protection laws and regulations. These federal and state regulatory restrictions limit the manner in which the Company and the Bank may conduct business and obtain financing. These laws and regulations can and do change significantly from time to time, and any such changes could adversely affect the Company’s results of operations.

The Company expects that the current Presidential administration will continue to implement a regulatory reform agenda that is significantly different than that of the prior administration. This reform agenda has included, and its likely to continue to include, an increased level of attention and focus on consumer protection, deposit fees, fair lending and investments in communities, the regulation of loan portfolios and credit concentrations to borrowers impacted by climate change or that operate in industries that would not be favored in a low-carbon economy and heightened scrutiny of BSA and AML requirements among other areas. The Company cannot predict the effects of these changes, including the recently adopted changes to the CRA rules, on its business and profitability. Because government regulation greatly affects the business and financial results of commercial banks and bank holding companies, the Company’s cost of compliance could adversely affect its ability to operate profitably.

The Company and the Bank must maintain adequate regulatory capital to support the Company’s business objectives.

Under regulatory capital adequacy guidelines and other regulatory requirements, the Company and the Bank must satisfy capital requirements based upon quantitative measures of assets, liabilities and certain off-balance sheet items. The satisfaction of these requirements by the Company and the Bank is subject to qualitative judgments by regulators that may differ materially from management’s and that are subject to being determined retroactively for prior periods. Additionally, regulators can make subjective assessments about the adequacy of capital levels, even if the Bank’s reported capital exceeds the “well-capitalized” requirements.

Failure to meet regulatory capital standards could have a material adverse effect on the Company’s business, including damaging the confidence of customers in the Company, and adversely impacting its reputation and competitive position and retention of key personnel. Any of these developments could limit the Company’s access to:

●

brokered deposits;

●

the FRB discount window;

●

advances from the FHLB Cincinnati;

●

capital markets transactions; and

●

development of new financial services

Failure to meet regulatory capital standards may also result in higher FDIC assessments. If the Bank falls below guidelines for being deemed “adequately capitalized” the FDIC or FRB could impose restrictions on the Company’s activities and a broad range of regulatory requirements in order to effect “prompt corrective action.” The capital requirements applicable to the Company and the Bank are in a process of continuous evaluation and revision in connection with actions of the Basel Committee and the Company’s and the Bank’s regulators. In July 2023, federal banking regulators issued a joint agency proposal that sought to implement the final components of the Basel III Endgame as well as make changes aimed at addressing the underlying causes of the turmoil in the banking industry that was experienced in the first half of 2023 with the failure of certain larger financial institutions. The proposal seeks to revise the capital framework for banks with total assets of $100 billion or more in four main areas of credit risk, market risk, operational risk and credit valuation adjustment risk. The proposal also would require banks with total assets of $100 billion or more to include unrealized gains and losses from certain securities in their capital ratios, to comply with supplementary leverage ratio requirements and to comply with countercyclical capital buffer requirements, if activated. The comment period for these proposed changes ends in the first quarter of 2024 and though the proposal applies only to banks with total assets of $100 billion or more, certain of these more stringent requirements could be imposed on the Company or the Bank through the ongoing regulatory oversight process, which could adversely impact the Company's profitability or, if it fails to satisfy any such requirements, its financial condition and results of operations.

The Company is required to act as a source of financial and managerial strength for the Bank in times of stress.

Under federal law, the Company is required to act as a source of financial and managerial strength to the Bank, and to commit resources to support the Bank if necessary. The Company may be required to commit additional resources to the Bank, or guarantee the Bank’s compliance with a capital plan developed by the Bank to raise capital, at times when the Company may not be in a financial position to provide such resources or guarantee or when it may not be in the Company’s, or its shareholders’ or its creditors’ best interests to do so. Providing such support is more likely during times of financial stress for the Company and the Bank, which may make any capital the Company is required to raise to provide such support more expensive than it might otherwise be. In addition, any capital loans the Company makes to the Bank are subordinate in right of payment to depositors and to certain other indebtedness of the Bank. In the event of the Company’s bankruptcy, any commitment by it to a federal banking regulator to maintain the capital of the Bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Non-compliance with the Patriot Act, the BSA or other laws and regulations, like those issued by OFAC, could result in fines or sanctions against the Company.

The BSA, as amended by the Patriot Act, requires financial institutions to design and implement programs to prevent financial institutions from being used for money laundering and terrorist activities. If such activities are detected, financial institutions are obligated to file suspicious activity reports with the Treasury’s Financial Crimes Enforcement Network. These rules require financial institutions to establish procedures and maintain staffing levels that are sufficient for identifying and verifying the identity of customers seeking to open new financial accounts. Failure to comply with these and other regulations aimed at combatting terrorism, money laundering and preventing transactions with "enemies" of the United States could result in fines or sanctions, including restrictions on conducting acquisitions or establishing new branches, as well as additional operating expenses to add staff and/or technological enhancements to the Company’s systems to better comply.

Risks Relating to the Company’s Securities

The Company’s common stock is thinly traded, and recent prices may not reflect the prices at which the stock would trade in an active trading market.

The Company’s common stock is not traded through an organized exchange, but rather is traded in individually-arranged transactions between buyers and sellers. As a result, shares of the Company's common stock have less liquidity than shares traded through an organized exchange. Therefore, recent prices at which the stock has traded may not necessarily reflect the actual value of the Company’s common stock. A shareholder’s ability to sell the shares of Company common stock in a timely manner, or in desired amounts, may be substantially limited by the lack of a trading market for the common stock.

The Company’s ability to declare and pay dividends is limited.

While the Company has historically paid a biannual cash dividend on its common stock, there can be no assurance of whether or when it may pay dividends on its common stock in the future. Future dividends, if any, will be declared and paid at the discretion of the Company’s board of directors and will depend on a number of factors, including the Company’s and the Bank’s capital levels. The Company’s principal source of funds used to pay cash dividends on its common stock will be dividends that it receives from the Bank. Although the Bank’s asset quality, earnings performance, liquidity and capital requirements will be taken into account before the Company declares or pays any future dividends on its common stock, the Company’s board of directors will also consider its liquidity and capital requirements and its board of directors could determine to declare and pay dividends without relying on dividend payments from the Bank.

Federal and state banking laws and regulations and state corporate laws restrict the amount of dividends the Company may declare and pay and that the Bank may declare and pay to the Company. For example, FRB regulations implementing the capital rules required under Basel III do not permit dividends unless capital levels exceed those minimum levels required to be adequately capitalized plus those amounts required by the capital conservation buffers. In addition, the FRB has issued supervisory guidance advising bank holding companies to eliminate, defer or reduce dividends paid on common stock and other forms of Tier 1 capital where the company’s net income available to shareholders for the past four quarters, net of dividends previously paid during that period, is not sufficient to fully fund the dividends, the company’s prospective rate of earnings retention is not consistent with the company’s capital needs and overall current and prospective financial condition or the company will not meet, or is in danger of not meeting, minimum regulatory capital adequacy ratios. Supplements to this guidance reiterate the need for bank holding companies to inform their applicable reserve bank sufficiently in advance of the proposed payment of a dividend in certain circumstances.

An investment in the Company’s common stock is not an insured deposit.

The Company’s common stock is not a bank deposit and, therefore, is not insured against loss by the FDIC, any other deposit insurance fund or by any other public or private entity. Investment in the Company’s common stock is inherently risky for the reasons described in this “Risk Factors” section and elsewhere in this report and is subject to the equity market forces like other common stock. As a result, if you acquire the Company’s stock, you could lose some or all of your investment