FARMERS NATIONAL BANC CORP OH

Federal banking regulators issued two related statements regarding cybersecurity in 2015. One statement indicates that financial institutions should design multiple layers of security controls to establish several lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing Internet-based services of the financial institution. The second statement indicates that management of financial institutions are expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the financial institution’s operations after a cybersecurity attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the financial institution or its critical service providers fall victim to this type of cybersecurity attack. If the Bank fails to observe the regulatory guidance, it could be subject to various regulatory sanctions, including financial penalties.

In November 2021, the federal bank regulatory agencies issued a final rules that became effective in May 2022, requiring banking organizations that experience a computer-security incident to notify certain entities. A computer-security incident occurs when actual or potential harm to the confidentiality, integrity or availability of information or the information system occurs, or there is a violation or imminent threat of a violation to banking security policies and procedures. The affected bank must notify its respective federal regulator of the computer-security incident as soon as possible and no later than 36 hours after the bank determine a computer-security incident that rises to the level of a notification incident has occurred. These notifications are intended to promote early awareness of threats to banking organizations and will help banks react to those threats before they manifest into larger incidents. This rule also requires bank service providers to notify their bank organization customers of a computer-security incident that has occurred, or is reasonably likely to cause, a material service disruption or degradation for four or more hours.

The Cyber Incident Reporting for Critical Infrastructure Act, enacted in March 2022, requires certain covered entities to report a covered incident to the U.S. Department of Homeland Security's Cybersecurity & Infrastructure Security Agency ("CISA") within 72 hours after a covered entity reasonably believes an incident has occurred. Separate reporting to CISA will also be required within 24 hours if a ransom payment is made as a result of a ransomware attack.

The SEC adopted a new rule on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies in 2023, which applies to all public companies subject to the reporting requirements of the Exchange Act and requires disclosure of material cybersecurity incidents in Current Reports on Form 8-K and periodic disclosure of cybersecurity risk management, strategy, and governance in annual reports in Annual Reports on Form 10-K.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations and many states have recently implemented or modified their data breach notification and data privacy requirements. The Company expects this trend of state-level cybersecurity regulatory activity to continue, and continues to monitor these developments.

In the ordinary course of its business, the Bank relies on electronic communications and information systems to conduct its operations and to store sensitive data, and employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding these defensive measures, the threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While the Bank has not, to date, detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, the Bank’s systems and those of its customers and third-party service providers are under constant threat and it is possible that we could experience a future significant event. The Bank expects risks and exposures related to cybersecurity attacks to remain high for the foreseeable future. For further discussion of risks related to cybersecurity, see “Item 1A Risk Factors.” See also the Company’s disclosures regarding risk management, strategy, governance and incident disclosure under “Item 1C.”

Future Legislation and Regulation

Various and significant legislation affecting financial institutions and the financial industry is from time to time introduced in the U.S. Congress and state legislatures, as well as by regulatory agencies, and such legislation may further change banking statutes and the operating environment of the Company in substantial and unpredictable ways. Such initiatives may include proposals to expand or contract the powers of bank holding companies and depository institutions or proposals to substantially change the financial institution regulatory system. With the enactment and the continuing implementation of the Dodd-Frank Act and regulations thereunder, the nature and extent of future legislative and regulatory changes affecting financial institutions remains very unpredictable.

A change in legislation affecting financial institutions and the financial industry could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance depending upon whether any of this potential legislation will be enacted, and if enacted, the effect that it or any implementing regulations, would have on the financial condition or results of operations of the Company or any of its subsidiaries. Farmers cannot predict the scope and timing of any such future legislation and, if enacted, the effect that it could have on its business, financial condition or results of operations.

Also, such statutes, regulations and policies are continually under review by the U.S. Congress and state legislatures and federal and state regulatory agencies and are subject to change at any time, particularly in the current economic and regulatory environment. Any such change in statutes, regulations or regulatory policies applicable to the Company could have a material effect on the business of the Company.

Information About Our Executive Officers

The names, ages and positions of Farmers’ executive officers as of March 1, 2025:

Officers are generally elected annually by the Board of Directors. The term of office for all the above executive officers is for the period ending with the next annual meeting.

Principal Occupation and Business Experience of Executive Officers

Mr. Adair has served as Executive Vice President, Secretary, Treasurer and Chief Financial Officer of Farmers and Senior Executive Vice President and Chief Financial Officer of Farmers Bank since August 2021. Mr. Adair joined Farmers in June of 2021 as Executive Vice President of Finance. Prior to that time, Mr. Adair was the treasurer of Home Savings Bank/Premier Bank from February 2016 through June of 2021 and Director of Risk Management from February of 2002 to February of 2016. Mr. Adair has 37 years of experience in finance and accounting in the banking industry.

Mr. Helmick is the President and Chief Executive Officer of Farmers and Farmers Bank, a position he has held since November 2013. Prior to becoming President, Mr. Helmick was Secretary of Farmers and Executive Vice President – Wealth Management and Retail Services of Farmers Bank since January 2012. Mr. Helmick has been with the Company for 30 years and has a retail and investment background, including an MBA and CFP designation. From 1997 through 2008, Mr. Helmick served as the Vice President and Program Manager for Farmers Investments. In 2008, Mr. Helmick was promoted to Senior Vice President of Wealth Management and Retail Services where he was responsible for the management and oversight of the retail investment area of Farmers Bank, Farmers Insurance, and all branch sales and operational functions.

Mr. Jackson is the Executive Vice President and Chief Information Officer of Farmers Bank, a position he has held since May 2009. Prior to coming to the Company, Mr. Jackson was Assistant Vice President and Information Technology Manager with Home Savings Bank since 1993. He has over 31 years of experience in the IT field. Mr. Jackson was appointed as an executive officer in 2012.

Mr. Nicastro is the Executive Vice President and Chief Human Resources Officer of Farmers Bank. Mr. Nicastro was appointed to that position in 2017 and previously served as Director of Human Resources since joining Farmers in July 2009. Prior to that, Mr. Nicastro served as Staffing and Compliance Manager for Huntington National Bank (2007-2008) and Regional Human Resources Manager for Sky Bank from 2004 until 2007. Mr. Nicastro has an MBA, and has more than 26 years of experience in Human Resource Management from both large multi-national banks and regional community banks. He was appointed as an executive officer in 2012.

Mr. Matuszak is the Senior Executive Vice President and Chief Operating Officer of Farmers Bank, a position he has held since December of 2022. Most recently, Mr. Matuszak served as the Vice President, Cloud Services with Wellmark Blue Cross Blue Shield for 6 years, becoming Vice President, Cloud Services and CISO in 2019. Mr. Matuszak has more than 26 years of experience in operations, facilities, cybersecurity and software development throughout the financial services, insurance and healthcare industries. He also holds certifications in Six Sigma and ITIL and a master’s degree in technical communications.

Mr. Oberhaus is currently the Executive Vice President and Chief Risk Officer of Farmers Bank. Mr. Oberhaus joined Farmers National Bank as part of the merger with First National Bank of Orrville in June of 2015 as the company’s Enterprise Risk Manager. Prior to the merger Mr. Oberhaus served as the SVP and Chief Risk Officer of First National Bank of Orrville and brings more than 26 years of experience in banking.

Mr. Sabat is the Senior Vice President and Chief Accounting Officer of Farmers Bank. Mr. Sabat was appointed to that position in June 2021 and previously served as Controller of Farmers Bank since April 2006. Prior to coming to the Company, Mr. Sabat was with a regional public accounting firm. Mr. Sabat has 29 years of experience in the accounting, finance and auditing fields. He is a certified public accountant and was appointed as an executive officer in 2012.

Mr. Shaffer serves as Senior Executive Vice President and Chief Banking Officer and has held that title since January of 2025. Previously, Mr. Shaffer served as Chief Credit Officer from 2021 through January 2025. He was previously Regional President and held that title from July of 2015 through 2020. Mr. Shaffer also served as the Director of Commercial Banking & Private Client Services. In October of 2011, Mr. Shaffer joined Farmers Bank as the Commercial Lending Manager, overseeing commercial lending, small business lending and treasury management. Mr. Shaffer has over 35 years of banking and lending experience in the Mahoning Valley market. Mr. Shaffer was appointed as an executive officer in 2014.

Ms. Wallace Soukenik has served as Senior Executive Vice President and Chief Retail/Marketing Officer for Farmers Bank since November 2013. In August 2008, Ms. Wallace Soukenik joined Farmers Bank as Senior Vice President and Director of Marketing. She has 34 years of experience in the marketing field. Prior to joining the Company, Ms. Wallace Soukenik served as the Assistant Vice President of Marketing and Physician Relations at Trumbull Memorial Hospital. She was appointed as an executive officer in 2012.

Mr. Wenick is Senior Executive Vice President and Chief Wealth Management Officer of Farmers Bank. Prior to coming to Farmers National Bank in 2017, Mr. Wenick was regional president of Chemical Bank for 3 years. Prior to that, Mr. Wenick spent 5 years in local bank investment and trust positions. He brings more than 41 years of financial expertise in the area of wealth management.