FIRST NATIONAL CORP /VA/

The federal banking agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a financial institution’s board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services. The federal banking agencies expect financial institutions to establish lines of defense and ensure that their risk management processes also address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack. If the Bank fails to meet the expectations set forth in this regulatory guidance, it could be subject to various regulatory actions and any remediation efforts may require significant resources of the Bank. In addition, all federal and state bank regulatory agencies continue to increase focus on cybersecurity programs and risks as part of regular supervisory exams.

In November 2021, the federal banking agencies approved a final rule that requires banking organizations to notify their primary regulator within 36 hours of becoming aware of a “computer-security incident” that rises to the level of a “notification incident”, among other things, the rule also requires bank service providers to notify their banking organization customers as soon as possible after becoming aware of similar incidents.

*Digital Assets.*In July 2025, President Trump signed into law the Guiding and Establishing National Innovation for U.S. Stablecoins Act (the “GENIUS Act”), which establishes a regulatory framework for “payment stablecoins” and their issuers. The GENIUS Act permits payment stablecoins to be issued in the United States only by “permitted payment stablecoin issuers”, including the subsidiary of an insured depository institution such as the Bank. The GENIUS Act requires federal and state regulators to issue regulations on numerous topics to interpret and implement the act. The effect of the GENIUS Act on the Company and the Bank will depend on the final form of any regulations and cannot be predicted at this time. Digital assets activities are an area of significant focus for Congress, the current Presidential administration, and federal banking regulators. Any changes in law or in the Company’s or the Bank’s supervisory frameworks relating to digital assets cannot be predicted but may have a significant effect on the Company’s business.

Consumer Laws and Regulations. The Bank is also subject to certain consumer laws and regulations issued thereunder that are designed to protect consumers in transactions with banks. These laws include the Truth in Lending Act, the Truth in Savings Act, the Electronic Funds Transfer Act, the Expedited Funds Availability Act, the Equal Credit Opportunity Act, Real Estate Settlement Procedures Act, Home Mortgage Disclosure Act, the Fair Credit Reporting Act, the Fair Housing Act and the Dodd-Frank Act, among others. The laws and related regulations mandate certain disclosure requirements and regulate the manner in which financial institutions transact business with customers. The Bank must comply with the applicable provisions of these consumer protection laws and regulations as part of its ongoing customer relations.

Incentive Compensation. In June 2010, the federal banking agencies issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of financial institutions do not undermine the safety and soundness of such institutions by encouraging excessive risk-taking. TheInteragency Guidance on Sound Incentive Compensation Policies, which covers all employees that have the ability to materially affect the risk profile of a financial institution, either individually or as part of a group, is based upon the key principles that a financial institution’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the institution’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by good corporate governance, including active and effective oversight by the financial institution’s board of directors.

The Federal Reserve will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of financial institutions, such as the Company, that are not “large, complex banking organizations.” These reviews will be tailored to each financial institution based on the scope and complexity of the institution’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the institution’s supervisory ratings, which can affect the institution’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a financial institution if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the institution’s safety and soundness and the financial institution is not taking prompt and effective measures to correct the deficiencies. At December 31, 2025, the Company had not been made aware of any instances of non-compliance with the guidance.

Effect of Governmental Monetary Policies

The Company’s operations are affected not only by general economic conditions but also by the policies of various regulatory authorities. In particular, the Federal Reserve regulates money and credit conditions and interest rates to influence general economic conditions. These policies have a significant impact on overall growth and distribution of loans, investments and deposits; they affect interest rates charged on loans or paid for time and savings deposits. Federal Reserve monetary policies have had a significant effect on the operating results of commercial banks, including the Company, in the past and are expected to do so in the future.

Future Legislation and Regulation

Congress may enact legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of any proposed legislation could impact the regulatory structure under which the Company and the Bank operate and may significantly increase costs, impede the efficiency of internal business processes, require an increase in regulatory capital, require modifications to business strategy, and limit the ability to pursue business opportunities in an efficient manner. A change in statutes, regulations or regulatory policies applicable to the Company or the Bank are difficult to predict, and could have a material, adverse effect on the business, financial condition and results of operations of the Company and the Bank.

Filings with the SEC

The Company’s internet address iswww.fbvirginia.com. The Company’s Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q and Current Reports on Form 8-K, and amendments to those reports, as filed with or furnished to the Securities and Exchange Commission (the SEC), are available free of charge atwww.fbvirginia.com as soon as reasonably practicable after being filed with or furnished to the SEC. A copy of any of the Company’s filings will be sent, without charge, to any shareholder upon written request to: Brad E. Schwartz, Chief Financial Officer, at 112 West King Street, Strasburg, Virginia 22657. The information on the Company's website is not a part of, and is not incorporated into, this Annual Report on Form 10-K.