OHIO VALLEY BANC CORP

In March 2015, federal regulators issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish several lines of defense and to ensure that their risk management processes also address the risks posed by compromised customer credentials, including security measures to reliably authenticate customers accessing Internet-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the financial institution’s operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the financial institution or its critical service providers fall victim to this type of cyber-attack. If Ohio Valley fails to observe the regulatory guidance, it could be subject to various regulatory sanctions, including financial penalties.

In February 2018, the SEC published interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents. These SEC guidelines, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations.

In November 2021, federal banking agencies issued a final rule that became effective in May 2022 requiring banking organizations that experience a cybersecurity incident to notify certain entities. A cybersecurity incident occurs when actual or potential harm to the confidentiality, integrity, or availability of information or an information system occurs, or there is a violation or imminent threat of a violation to banking security policies and procedures. The affected bank must notify its respective federal regulator of the cybersecurity incident as soon as possible and no later than 36 hours after the bank determines a cybersecurity incident that rises to the level of a notification incident has occurred. These notifications are intended to promote early awareness of threats to banking organizations and will help banks react to those threats before they manifest into larger incidents. This rule also requires bank service providers to notify their bank organization customers of a cybersecurity incident that has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours.

Furthermore, once final rules are adopted, the Cyber Incident Reporting for Critical Infrastructure Act, enacted in March 2022, will require certain covered entities to report a covered cyber incident to the U.S. Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency (“CISA”) within 72 hours after it reasonably believes an incident has occurred. Separate reporting to CISA will also be required within 24 hours, if a ransom payment is made as a result of a ransomware attack.

On July 26, 2023, the SEC adopted final rules that require public companies to promptly disclose material cybersecurity incidents in a Current Report on Form 8-K and detailed information regarding their cybersecurity risk management, strategy, and governance on an annual basis in an Annual Report on Form 10-K. Companies are required to report on Form 8-K any cybersecurity incident they determine to be material within four business days of making that determination. See Item 1C “Cybersecurity” in Part I of this Annual Report on Form 10-K. These SEC rules, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. Ohio Valley expects this trend of state-level activity in those areas to continue and is continually monitoring developments in the states in which our customers are located.

Executive and Incentive Compensation

Following the adoption of additional listing requirements in 2023 to comply with the Dodd-Frank Act and rules adopted by the SEC in October 2022, public companies are now required to adopt and implement “clawback” procedures policies for incentive compensation payments and to disclose the details of the procedures which allow recovery of incentive compensation that was paid on the basis of erroneous financial information necessitating an accounting restatement due to material noncompliance with financial reporting requirements. This clawback policy is intended to apply to compensation paid within the three completed fiscal years immediately preceding the date the issuer is required to prepare a restatement a three-year look-back window of the restatement and would cover all executives (including former executives) who received incentive awards. The Company adopted its clawback policy in September 2023, which is listed as Exhibit 97 and is titled “Ohio Valley Banc Corp. Policy for the Recovery of Erroneously Awarded Compensation.”

Employees

As of December 31, 2024, Ohio Valley and its subsidiaries had approximately 271 employees and officers and 260 full-time equivalent employees and officers. Management considers its relationship with its employees and officers to be good.

The Bank and Loan Central may be required to make capital expenditures related to properties which they may acquire through foreclosure proceedings in the future. However, the amount of such capital expenditures, if any, is not currently determinable.

Statistical Disclosure

The following section contains certain financial disclosures relating to Ohio Valley as required under the SEC’s Subpart 1400 of Regulation S-K, “Disclosure by Bank and Savings and Loan Registrants,” or a specific reference as to the location of the required disclosures in Ohio Valley’s 2024 Annual Report to Shareholders, which are incorporated herein by reference.

DISTRIBUTION OF ASSETS, LIABILITIES AND SHAREHOLDERS’ EQUITY; INTEREST RATES AND INTEREST DIFFERENTIAL

INVESTMENT PORTFOLIO

LOAN PORTFOLIO

ALLOWANCE FOR CREDIT LOSSES

Allocation of the Allowance for Credit Losses - Information required by this item is incorporated herein by reference to the information appearing under the caption “Table VI - Allocation of the Allowance for Credit Losses,” within “Management’s Discussion and Analysis of Financial Condition and Results of Operations” located in Ohio Valley’s 2024 Annual Report to Shareholders.

Credit ratios – Information required by this item is incorporated herein by reference to the information appearing under the caption “Table VII – Credit Ratios,” within “Management’s Discussion and Analysis of Financial Condition and Results of Operations” located in Ohio Valley’s 2024 Annual Report to Shareholders.

DEPOSITS