ITEM 1A.

RISK FACTORS.

The significant risks and uncertainties related to us, our business and our securities of which we are aware are discussed below. You should carefully consider these risks and uncertainties before making investment decisions in respect of our securities. Any of these factors could materially and adversely affect our business, financial condition, operating results and prospects and could negatively impact the market price of our securities. If any of these risks materialize, you could lose all or part of your investment in the Company. Additional risks and uncertainties that we do not yet know of, or that we currently think are immaterial, may also impair our business operations. You should also consider the other information contained in this annual report, including our financial statements and the related notes, before making investment decisions in respect of our securities.

Risks Relating to the Operations of the Company and its Affiliates

The Company’s future success depends on the successful growth of its subsidiaries.

The Company’s primary business activity for the foreseeable future will be to act as the holding company of the Bank. Therefore, the Company’s future profitability will depend on the success and growth of the Bank and any other subsidiary that it operates. Therefore, the Company’s future profitability will depend on the success and growth of these subsidiaries.

We could be adversely affected by risks associated with future acquisitions and expansions.

Although our core growth strategy has historically focused around organic growth, we may from time to time consider acquisition and expansion opportunities involving a bank or other entity operating in the financial services industry. We cannot predict if or when we will engage in strategic transactions, or the nature or terms of any such transactions. To the extent that we grow through an acquisition, we cannot assure investors that we will be able to adequately and profitably manage that growth or that an acquired business will be integrated into our existing businesses as efficiently or as timely as we may anticipate. Acquiring another business would generally involve risks commonly associated with acquisitions, including:

•

increased capital needs;

•

increased and new regulatory and compliance requirements;

•

implementation or remediation of controls, procedures and policies with respect to the acquired business;

•

diversion of management time and focus from operation of our then-existing business to acquisition-integration challenges;

•

coordination of product, sales, marketing and program and systems management functions;

•

transition of the acquired business’s users and customers onto our systems;

•

retention of employees from the acquired business;

•

integration of employees from the acquired business into our organization;

•

integration of the acquired business’s accounting, information management, human resources and other administrative systems and operations with ours;

•

potential liability for activities of the acquired business prior to the acquisition, including violations of law, commercial disputes and tax and other known and unknown liabilities;

•

potential increased litigation or other claims in connection with the acquired business, including claims brought by regulators, terminated employees, customers, former stockholders, vendors, or other third parties; and

•

potential goodwill impairment.

If we were to pursue or consummate an acquisition, then our failure to execute on our acquisition strategy could adversely affect our business, results of operations, financial condition and future prospects risks of unknown or contingent liabilities.

The majority of our business is concentrated in Maryland, much of which involves real estate lending, so a decline in the real estate and credit markets could materially and adversely impact our financial condition and results of operations.

Most of the Bank’s loans are made to borrowers located in Maryland, and many of these loans, including construction and land development loans, are secured by real estate. Accordingly, a decline in local economic conditions would likely have an adverse impact on our financial condition and results of operations, and the impact on us would likely be greater than the impact felt by larger financial institutions whose loan portfolios are geographically diverse. We cannot guarantee that any risk management practices we implement to address our geographic and loan concentrations will be effective to prevent losses relating to our loan portfolio.

The Bank’s concentrations of commercial real estate loans could subject it to increased regulatory scrutiny and directives, which could force us to preserve or raise capital and/or limit future commercial lending activities.

The federal banking regulators believe that institutions with particularly high concentrations of commercial real estate (“CRE”) loans in their lending portfolios face a heightened risk of financial difficulties in the event of adverse changes in the economy and CRE markets. Accordingly, through published guidance, these regulators have directed institutions whose concentrations exceed certain percentages of capital to implement heightened risk management practices appropriate to their concentration risk. The guidance provides that banking regulators may require such institutions to reduce their concentrations and/or maintain higher capital ratios than institutions with lower concentrations in CRE. At December 31, 2024, our CRE concentrations were above the heightened risk management thresholds set forth in this guidance. No assurance can be given that the Company’s enhanced risk management practices and monitoring controls will be effective.

The Bank may experience loan losses in excess of its allowance, which would reduce our earnings.

The risk of credit losses on loans varies with, among other things, general economic conditions, the type of loans being made, the creditworthiness of the borrowers over the term of the loans and, in the case of collateralized loans, the value and marketability of the collateral for the loans. Management of the Bank maintains an allowance for loan losses based upon, among other things, historical experience, an evaluation of economic conditions and regular reviews of delinquencies and loan portfolio quality. Based upon such factors, management makes various assumptions and judgments about the ultimate collectability of the loan portfolio and provides an allowance for credit losses based upon a percentage of the outstanding balances and for specific loans when their ultimate collectability is considered questionable. Based upon such factors, management makes various assumptions and judgments about the ultimate collectability of the loan portfolio and provides an allowance for loan losses based upon a percentage of the outstanding balances and for specific loans when their ultimate collectability is considered questionable. If management’s assumptions and judgments prove to be incorrect and the allowance for credit losses is inadequate to absorb future losses, or if the bank regulatory authorities require us to increase the allowance for credit losses as a part of its examination process, our earnings and capital could be significantly and adversely affected. If management’s assumptions and judgments prove to be incorrect and the allowance for loan losses is inadequate to absorb future losses, or if the bank regulatory authorities require us to increase the allowance for loan losses as a part of its examination process, our earnings and capital could be significantly and adversely affected. Although management continually monitors our loan portfolio and makes determinations with respect to the allowance for credit losses, future adjustments may be necessary if economic conditions differ substantially from the assumptions used or adverse developments arise with respect to our non-performing or performing loans. Although management continually monitors our loan portfolio and makes determinations with respect to the allowance for loan losses, future adjustments may be necessary if economic conditions differ substantially from the assumptions used or adverse developments arise with respect to our non-performing or performing loans. Material additions to the allowance for credit losses could result in a material decrease in our net income and capital, and could have a material adverse effect on our financial condition. Material additions to the allowance for loan losses could result in a material decrease in our net income and capital, and could have a material adverse effect on our financial condition.

We depend on the accuracy and completeness of information about customers and counterparties, and inaccurate, incomplete or misleading information provided to us by these persons could cause us to suffer losses.

In deciding whether to extend credit or enter into other transactions, we rely on information furnished by or on behalf of customers and counterparties, including financial statements, credit reports and other financial information. We also rely on representations of those customers, counterparties or other third parties, such as independent auditors, as to the accuracy and completeness of that information. Reliance on inaccurate or misleading financial statements, credit reports or other financial information could have a material adverse impact on our business, financial condition and results of operations.

Our accounting estimates and risk management processes rely on analytical and forecasting models, the inadequacy of which could have a material adverse effect on our financial condition and/or results of operations.

The processes we use to estimate our expected credit losses and to measure the fair value of financial instruments, as well as the processes used to estimate the effects of changing interest rates and other market measures on our financial condition and results of operations, depends upon the use of analytical and forecasting models. These models reflect assumptions that may not be accurate, particularly in times of market stress or other unforeseen circumstances. Even if these assumptions are adequate, the models may prove to be inadequate or inaccurate because of other flaws in their design or their implementation, including flaws caused by failures in controls, data management, human error or from the reliance on technology. If the models we use for interest rate risk and asset-liability management are inadequate, we may incur increased or unexpected losses upon changes in market interest rates or other market measures. If the models we use for estimating our expected credit losses are inadequate, the allowance for credit losses may not be sufficient to support future charge-offs. If the models we use to measure the fair value of financial instruments are inadequate, the fair value of such financial instruments may fluctuate unexpectedly or may not accurately reflect what we could realize upon sale or settlement of such financial instruments. Any such failure in our analytical or forecasting models could have a material adverse effect on our business, financial condition and results of operations.

Interest rates and other economic conditions will impact our results of operations.

Our net income depends primarily upon our net interest income. Net interest income is the difference between interest income earned on loans, investments and other interest-earning assets and the interest expense incurred on deposits and borrowed funds. The level of net interest income is primarily a function of the average balance of our interest-earning assets, the average balance of our interest-bearing liabilities, and the spread between the yield on such assets and the cost of such liabilities. These factors are influenced by both the pricing and mix of our interest-earning assets and our interest-bearing liabilities which, in turn, are impacted by such external factors as the local economy, competition for loans and deposits, the monetary policy of the Federal Open Market Committee of the Federal Reserve Board of Governors, and market interest rates.

Different types of assets and liabilities may react differently, and at different times, to changes in market interest rates. We expect that we will periodically experience gaps in the interest rate sensitivities of our assets and liabilities. That means either our interest-bearing liabilities will be more sensitive to changes in market interest rates than our interest-earning assets, or vice versa. When interest-bearing liabilities mature or re-price more quickly than interest-earning assets, an increase in market rates of interest could reduce our net interest income. Likewise, when interest-earning assets mature or re-price more quickly than interest-bearing liabilities, falling interest rates could reduce our net interest income. We are unable to predict changes in market interest rates, which are affected by many factors beyond our control, including inflation, deflation, recession, unemployment, money supply, domestic and international events and changes in the United States and other financial markets.

We also attempt to manage risk from changes in market interest rates, in part, by controlling the mix of interest rate sensitive assets and interest rate sensitive liabilities. However, interest rate risk management techniques are not exact. A rapid increase or decrease in interest rates could adversely affect our results of operations and financial performance.

The market value of our investments could decline.

As of December 31, 2024, investment securities in our investment portfolio having a cost basis of $149.0 million and a market value of $125.7 million were classified as available-for-sale pursuant to FASB Accounting Standards Codification (“ASC”) Topic 320, Investments – Debt and Equity Securities, relating to accounting for investments. Topic 320 requires that unrealized gains and losses in the estimated value of the available-for-sale portfolio be “marked to market” and reflected as a separate item in stockholders’ equity (net of tax) as accumulated other comprehensive gain or loss. There can be no assurance that future market performance of our investment portfolio will enable us to realize income from sales of securities. Stockholders’ equity will continue to reflect the unrealized gains and losses (net of tax) of these investments. Moreover, there can be no assurance that the market value of our investment portfolio will not decline, causing a corresponding decline in stockholders’ equity.

Management believes that several factors could affect the market value of our investment portfolio. These include, but are not limited to, changes in interest rates or expectations of changes, the degree of volatility in the securities markets, inflation rates or expectations of inflation and the slope of the interest rate yield curve (the yield curve refers to the differences between shorter-term and longer-term interest rates; a positively sloped yield curve means shorter-term rates are lower than longer-term rates). Also, the passage of time will affect the market values of our investment securities, in that the closer they are to maturing, the closer the market price should be to par value. These and other factors may impact specific categories of the portfolio differently, and management cannot predict the effect these factors may have on any specific category.

Impairment of deferred tax assets could require charges to earnings, which could result in a negative impact on our results of operations.

In assessing the realizability of deferred tax assets, management considers whether it is more likely than not that some portion or all of the deferred tax assets will not be realized. Assessing the need for, or the sufficiency of, a valuation allowance requires management to evaluate all available evidence, both negative and positive, including the recent trend of quarterly earnings. Positive evidence necessary to overcome the negative evidence includes whether future taxable income in sufficient amounts and character within the carryback and carry forward periods is available under the tax law, including the use of tax planning strategies. When negative evidence (e.g., cumulative losses in recent years, history of operating loss or tax credit carry forwards expiring unused) exists, more positive evidence than negative evidence will be necessary. At December 31, 2024, our net deferred tax assets were valued at $7.6 million.

The impact of each of these impairment matters could have a material adverse effect on our business, results of operations, and financial condition.

We operate in a competitive environment, and our inability to effectively compete could adversely and materially impact our financial condition and results of operations.

We operate in a competitive environment, competing for loans, deposits, and customers with commercial banks, savings associations and other financial entities. Competition for deposits comes primarily from other commercial banks, savings associations, credit unions, money market and mutual funds and other investment alternatives. Competition for loans comes primarily from other commercial banks, savings associations, mortgage banking firms, credit unions and other financial intermediaries. Competition for other products, such as securities products, comes from other banks, securities and brokerage companies, and other non-bank financial service providers in our market area. Many of these competitors are much larger in terms of total assets and capitalization, have greater access to capital markets, and/or offer a broader range of financial services than those that we offer. In addition, banks with a larger capitalization and financial intermediaries not subject to bank regulatory restrictions have larger lending limits and are thereby able to serve the needs of larger customers.

In addition, changes to the banking laws over the last several years have facilitated interstate branching, merger and expanded activities by banks and holding companies. For example, the federal Gramm-Leach-Bliley Act revised the BHC Act and repealed the affiliation provisions of the Glass-Steagall Act of 1933, which, taken together, limited the securities and other non-banking activities of any company that controls an FDIC insured financial institution. As a result, the ability of financial institutions to branch across state lines and the ability of these institutions to engage in previously-prohibited activities are now accepted elements of competition in the banking industry. These changes may bring us into competition with more and a wider array of institutions, which may reduce our ability to attract or retain customers. Management cannot predict the extent to which we will face such additional competition or the degree to which such competition will impact our financial conditions or results of operations.

The banking industry is heavily regulated; significant regulatory changes could adversely affect our operations.

Our operations will be impacted by current and future legislation and by the policies established from time to time by various federal and state regulatory authorities. The Company is subject to supervision by the Federal Reserve. The Bank is subject to supervision and periodic examination by the Maryland Commissioner and the FDIC. The Insurance Subsidiary is subject to supervision and periodic examination by the Tennessee Insurance Department. Banking regulations, designed primarily for the safety of depositors, and insurance regulations, designed primarily for the safety of insureds, may limit a financial institution’s growth and the return to its investors by restricting such activities as the payment of dividends, mergers with or acquisitions by other institutions, investments, loans and interest rates, interest rates paid on deposits, expansion of branch offices, and the offering of securities or trust services. The Company and the Bank are also subject to capitalization guidelines established by federal law and the Insurance Subsidiary is subject to capitalization guidelines established by Tennessee law, and could be subject to enforcement actions to the extent that they are found by regulatory examiners to be undercapitalized. It is not possible to predict what changes, if any, will be made to existing federal and state legislation and regulations or the effect that such changes may have on our future business and earnings prospects. Management also cannot predict the nature or the extent of the effect on our business and earnings of future fiscal or monetary policies, economic controls, or new federal or state legislation. Further, the cost of compliance with regulatory requirements may adversely affect our ability to operate profitably.

The Consumer Financial Protection Bureau may continue to reshape the consumer financial laws through rulemaking and enforcement of the prohibitions against unfair, deceptive and abusive business practices. Compliance with any such change may impact our business operations.

The CFPB has broad rulemaking authority to administer and carry out the provisions of the Dodd-Frank Act with respect to financial institutions that offer covered financial products and services to consumers. The CFPB has also been directed to adopt rules identifying practices or acts that are unfair, deceptive or abusive in connection with any transaction with a consumer for a consumer financial product or service, or the offering of a consumer financial product or service. The concept of what may be considered to be an “abusive” practice is fluid and can change based on politically-appointed leadership at the CFPB. The full scope of the impact of this authority has not yet been determined as the CFPB has not yet released significant supervisory guidance. Any new rules adopted by the CFPB could require the Bank to dedicate significant personnel resources and could have a material adverse effect on our operations.

Bank regulators and other regulations, including the Basel III Capital Rules, may require higher capital levels, impacting our ability to pay dividends or repurchase our stock.

The capital standards to which we are subject, including the standards created by the Basel III Capital Rules, may materially limit our ability to use our capital resources and/or could require us to raise additional capital by issuing common stock. The issuance of additional shares of common stock could dilute existing stockholders.

A material weakness or significant deficiency in our disclosure or internal controls could have an adverse effect on us.

The Company is required by the Sarbanes-Oxley Act of 2002 to establish and maintain disclosure controls and procedures and internal control over financial reporting. These control systems are intended to provide reasonable assurance that material information relating to the Company is made known to our management and reported as required by the Exchange Act, to provide reasonable assurance regarding the reliability and preparation of our financial statements, and to provide reasonable assurance that fraud and other unauthorized uses of our assets are detected and prevented. These control systems are intended to provide reasonable assurance that material information relating to the Corporation is made known to our management and reported as required by the Exchange Act, to provide reasonable assurance regarding the reliability and preparation of our financial statements, and to provide reasonable assurance that fraud and other unauthorized uses of our assets are detected and prevented. We may not be able to maintain controls and procedures that are effective at the reasonable assurance level. If that were to happen, our ability to provide timely and accurate information about the Company, including financial information, to investors could be compromised and our results of operations could be harmed. If that were to happen, our ability to provide timely and accurate information about the Corporation, including financial information, to investors could be compromised and our results of operations could be harmed. Moreover, if the Company or its independent registered public accounting firm were to identify a material weakness or significant deficiency in any of those control systems, our reputation could be harmed and investors could lose confidence in us, which could cause the market price of the Company’s stock to decline and/or limit the trading market for the common stock. Moreover, if the Corporation or its independent registered public accounting firm were to identify a material weakness or significant deficiency in any of those control systems, our reputation could be harmed and investors could lose confidence in us, which could cause the market price of the Corporation’s stock to decline and/or limit the trading market for the common stock.

Customer concern about deposit insurance may cause a decrease in deposits held at the Bank.

Due to the large number of bank failures that have occurred since the 2008 recession, banking customers across the country have become increasingly concerned about the extent to which their deposits are insured by the FDIC. This concern could cause the Bank’s customers to withdraw deposits from the Bank in an effort to ensure that the amount they have on deposit with us is fully-insured. Because the Bank relies heavily on deposits to fund loans and purchase other interest-earning assets, a decrease in deposits could have a materially adverse effect on our funding costs and net income.

The Bank’s funding sources may prove insufficient to replace deposits and support our future growth.

The Bank relies on customer deposits, advances from the FHLB, lines of credit at other financial institutions and brokered funds to fund our operations. Although the Bank has historically been able to replace maturing deposits and advances if desired, no assurance can be given that the Bank would be able to replace such funds in the future if our financial condition or the financial condition of the FHLB or market conditions were to change. Our financial flexibility will be severely constrained and/or our cost of funds will increase if we are unable to maintain our access to funding or if financing necessary to accommodate future growth is not available at favorable interest rates. Finally, if we are required to rely more heavily on more expensive funding sources to support future growth, our revenues may not increase proportionately to cover our costs. In that case, our profitability would be adversely affected.

We may need to raise additional capital in the future, and such capital may not be available when needed or at all.

The Company may need to raise additional capital in the future to provide it with sufficient capital resources and liquidity to meet our commitments and business needs including complying with new regulatory capital rules, particularly if its asset quality or earnings were to deteriorate significantly. Our ability to raise additional capital, if needed, will depend on, among other things, conditions in the capital markets at that time, which are outside of its control, and its financial condition. Economic conditions and the loss of confidence in financial institutions may limit access to certain customary sources of capital, and increase the Bank’s cost of raising capital. No assurance can be given that such capital will be available on acceptable terms or at all. Any occurrence that may limit our access to the capital markets, such as a decline in the confidence of depositors, investors or counterparties participating in the capital markets may adversely affect our capital costs and our ability to raise capital and, in turn, our liquidity. Moreover, if we need to raise capital in the future, we may have to do so when many other financial institutions are also seeking to raise capital and would have to compete with those institutions for investors. An inability to raise additional capital on acceptable terms as and when needed could have a materially adverse effect on our business, financial condition and results of operations.

The Bank’s lending activities subject the Bank to the risk of environmental liabilities.

A significant portion of the Bank’s loan portfolio is secured by real property. During the ordinary course of business, the Bank may foreclose on and take title to properties securing certain loans. In doing so, there is a risk that hazardous or toxic substances could be found on these properties. If hazardous or toxic substances are found, the Bank may be liable for remediation costs, as well as for personal injury and property damage. Environmental laws may require the Bank to incur substantial expenses and may materially reduce the affected property’s value or limit the Bank’s ability to use or sell the affected property. In addition, future laws or more stringent interpretations or enforcement policies with respect to existing laws may increase the Bank’s exposure to environmental liability. Although the Bank has policies and procedures to perform an environmental review before initiating any foreclosure action on real property, these reviews may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on our financial condition and results of operations.

We may be subject to claims and the costs of defensive actions, and such claims and costs could materially and adversely impact our financial condition and results of operations.

Our customers may sue us for losses due to alleged breaches of fiduciary duties, errors and omissions of employees, officers and agents, incomplete documentation, our failure to comply with applicable laws and regulations, or many other reasons. Also, our employees may knowingly or unknowingly violate laws and regulations. Management may not be aware of any violations until after their occurrence. This lack of knowledge may not insulate us from liability. Claims and legal actions will result in legal expenses and could subject us to liabilities that may reduce our profitability and hurt our financial condition.

We may not be able to keep pace with developments in technology.

We use various technologies in conducting our businesses, including telecommunication, data processing, computers, automation, internet-based banking, and debit cards. The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. Our future success depends, in part, on our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology driven products and services or be successful in marketing these products and services to our customers. In addition, our implementation of certain new technologies, such as those related to artificial intelligence, automation and algorithms, in our business processes may have unintended consequences due to their limitations or our failure to use them effectively. In addition, cloud technologies are also critical to the operation of our systems, and our reliance on cloud technologies is growing. Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse effect on our business, financial condition and results of operations.

Our information systems may experience an interruption or a breach in security, including due to cyber-attacks.

Our business depends heavily on the use of computer systems, the Internet and other means of electronic communication and recordkeeping. In the ordinary course of business, we collect and store sensitive data, including proprietary business information and personally identifiable information of our customers and employees in systems and on networks. Moreover, we use third party vendors to provide products and services necessary to conduct our day-to-day operations, which exposes us to the risk that these vendors will not perform in accordance with the service arrangements, including by failing to protect the confidential information we entrust to them. The secure processing, maintenance, and use of our and our customers’ information is critical to our operations and business strategy. Any failure, interruption, or breach in security or operational integrity of our communications or operations systems could result in failures or disruptions in our customer relationship management, general ledger, deposit, loan, and other systems. Although we have invested in various technologies and continually review processes and practices that are designed to protect our networks, computers, and data from damage or unauthorized access, our computer systems and infrastructure, and those of our third-party vendors, may nevertheless be vulnerable to attacks by hackers or breached due to employee error, malfeasance, or other disruptions. Further, cyber-attacks can originate from a variety of sources and the techniques used are increasingly sophisticated. A breach of any kind could compromise our systems and those of our vendors, and the information stored there could be accessed, damaged, or disclosed. A breach in security or other failure could result in legal claims, regulatory penalties, disruptions in operations, increased expenses, loss of customers and business partners, and damage to our reputation, which could in turn adversely affect our business, financial condition and/or results of operations. Furthermore, as cyber threats continue to evolve and increase, we may be required to expend significant additional financial and operational resources to modify or enhance our protective measures, or to investigate and remediate any identified information security vulnerabilities.

We may not achieve the expected benefits from the Insurance Subsidiary.

We formed the Insurance Subsidiary as a captive insurance company in late 2016 to insure or reinsure certain risks faced by the Bank as part of our enterprise-wide, multi-year insurance strategy to better position our risk programs and provide us with increased flexibility in the management of our insurance programs as well as contribute to efficiencies relating to our insurance programs over time. As indicated by our decision to not renew our most recent policy, we may deviate from or change our insurance strategy from time to time, such as by choosing to not purchase insurance coverage through the Insurance Subsidiary for a particular year. If we do purchase insurance coverage through the Insurance Subsidiary, we may experience unanticipated events that could reduce or eliminate the benefits, both operational and financial, that we hope to realize through this entity, including, without limitation, significant insurance claims and/or changes in tax laws. In particular, we may not realize the tax benefits of owning a captive insurance company, which are discussed in the section of Item 1 of this annual report entitled “Supervision and Regulation” under the heading “Laws Related to the Insurance Subsidiary”. Although we believe that we have structured the Insurance Subsidiary’s operations to achieve these benefits, no assurance can be given that our efforts were or will be successful. If we are unable to achieve these benefits, then we will likely suspend the operations of the Insurance Subsidiary.

It should be noted that the operation by financial holding companies of captive insurance companies having a structure similar to the Insurance Subsidiary and FCBI is a relatively new development. If we are not able to successfully manage the Insurance Subsidiary, then our financial condition and/or results of operations could be materially and adversely impacted. If we are not able to successfully manage the Insurance Subsidiary, either due to our lack of experience or otherwise, then our financial condition and/or results of operations could be materially and adversely impacted.

Certain of our U.S. consolidated federal income tax returns are currently being audited.

In April 2018, we were notified by the IRS that our 2016 U.S. consolidated federal tax return was selected for audit. In April 2020, we were notified by the IRS that our 2017 and 2018 U.S. consolidated federal tax returns had also been selected for audit. As part of its audits, the IRS reviewed the deductions related to, and the income generated by, the Insurance Subsidiary. Following the completion of its audits, the IRS determined that it disagreed with our tax treatment of the Insurance Subsidiary in 2016, 2017 and 2018, and we have appealed such determination. Following the completion of its audits, the IRS determined that it disagrees with our tax treatment of the Insurance Subsidiary, and we are in the process of appealing such determination. Management cannot predict whether our appeal and defense of our tax positions will be successful. If our appeal is not successful, then we could be required to pay taxes, interest, and penalties totaling approximately $2.0 million as of December 31, 2024 for the tax years under audit and our taxable earnings and/or the effective tax rate on our future earnings could increase substantially, any of which could have a material adverse effect on our business, financial condition and results of operations. See Note 11 to the consolidated financial statements presented elsewhere in this report for further information about this risk.

In August 2023, the IRS notified us that our 2019 and 2020 U.S. consolidated federal tax returns had been selected for audit. In January 2023, the IRS notified us that our 2021 U.S. consolidated federal tax return had also been selected for audit. Management believes that the Insurance Subsidiary is the focus of these audits, but that might not be the case. Management cannot predict whether any of the tax positions taken in our 2019, 2020 or 2021 returns will be challenged by the IRS or, if challenged, whether we will be successful in defending those tax positions. If we are not successful in defending a challenge to our tax positions, then we could be required to amend the applicable tax return and pay additional taxes, interest, fines and/or penalties. More specifically, if the Insurance Subsidiary is the focus of these audits and we are not successful in defending a challenge to our tax positions related thereto, then we estimate that we could be required to pay additional taxes, interest, fines and/or penalties of approximately $1.6 million.

Compliance with ever-evolving federal and state laws relating to the handling of information about individuals involves significant expenditure and resources, and any failure by us or our vendors to comply may result in significant liability, negative publicity, and/or an erosion of trust, which could materially adversely affect our business, results of operations, and financial condition.

We are subject to a number of U.S. federal, state, local and foreign laws and regulations relating to consumer privacy and data protection. Under privacy protection provisions of the GLBA and its implementing regulations and guidance, we are limited in our ability to disclose certain non-public information about consumers to nonaffiliated third parties. The GLBA regulates, among other things, the use of certain information about individuals (“non-public personal information”) in the context of the provision of financial services, including by banks and other financial institutions. The GLBA includes both a “Privacy Rule,” which imposes obligations on financial institutions relating to the use or disclosure of non-public personal information, and a “Safeguards Rule,” which imposes obligations on financial institutions and, indirectly, their service providers to implement and maintain physical, administrative and technological measures to protect the security of non-public personal financial information. Any failure to comply with the GLBA could result in substantial financial penalties and significant reputational harm. Multiple states have recently enacted, or are expected to enact, stringent privacy laws, not all of which exempt financial institutions categorically. Many other states are currently reviewing or proposing the need for greater regulation of the collection, sharing, use and other processing of information related to individuals for marketing purposes or otherwise, and there remains increased interest at the federal level as well. Further, to comply with the varying state laws around data breaches, we must maintain adequate security measures, which require significant investments in resources and ongoing attention.

Additionally, laws, regulations, and standards covering marketing, advertising, and other activities conducted by telephone, email, mobile devices, and the internet are or may become applicable to our business, such as the Telephone Consumer Protection Act, the CAN-SPAM Act, and similar state consumer protection and communication privacy laws. We occasionally make telephone calls and/or send SMS text messages to customers. The actual or perceived improper calling of customer phones and/or sending of text messages may subject us to potential risks, including liabilities or claims relating to consumer protection laws such as the Telephone Consumer Protection Act. Numerous class-action suits under federal and state laws have been filed in recent years against companies who conduct telemarketing and/or SMS texting programs, with many resulting in multi-million-dollar settlements to the plaintiffs. Any future such litigation against us could be costly and time-consuming to defend. In particular, the Telephone Consumer Protection Act imposes significant restrictions on the ability to make telephone calls or send text messages to mobile telephone numbers without the prior consent of the person being contacted. Federal or state regulatory authorities or private litigants may claim that the notices and disclosures we provide, form of consents we obtain or our outreach practices are not adequate or violate applicable law. This may in the future result in civil claims against us. Claims that we have violated the Telephone Consumer Protection Act could be costly to litigate, whether or not they have merit, and could expose us to substantial statutory damages or costly settlements.

We also send marketing messages via email and are subject to the CAN-SPAM Act. The CAN-SPAM Act imposes certain obligations regarding the content of emails and providing opt-outs (with the corresponding requirement to honor such opt-outs promptly). While we strive to ensure that all of our marketing communications comply with the requirements set forth in the CAN-SPAM Act, any violations could result in the FTC seeking civil penalties against us.

Moreover, we are considered a “user” of consumer reports provided by consumer reporting agencies under the FCRA, as amended by the Fair and Accurate Credit Transactions Act. FCRA regulates and protects consumer information collected by consumer reporting agencies and imposes specific obligations on “users” of consumer reports. Such obligations may include restricting the sharing of information contained in a consumer report, notifying consumers when such reports are used to make an adverse decision, and, in the context of completing employee background checks, providing a notice containing certain disclosures to the consumer and obtaining their consent.

Consumers may decide not to use banks to complete their financial transactions.

Technology and other changes are allowing parties to complete financial transactions through alternative methods that historically have involved banks. For example, consumers can now maintain funds that would have historically been held as bank deposits in brokerage accounts, mutual funds or general-purpose reloadable prepaid cards. Consumers can also complete transactions, such as paying bills and/or transferring funds directly without the assistance of banks. Although the digital asset marketplace has in recent months experienced substantial instability, transactions utilizing digital assets, including cryptocurrencies, stablecoins and other similar assets, have increased substantially over the course of the last several years. Certain characteristics of digital asset transactions, such as the speed with which such transactions can be conducted, the ability to transact without the involvement of regulated intermediaries, the ability to engage in transactions across multiple jurisdictions, and the anonymous nature of the transactions, are appealing to certain consumers notwithstanding the various risks posed by such transactions as illustrated by the current and ongoing market volatility. Accordingly, digital asset service providers, which at present are not subject to the extensive regulation of banking organizations and other financial institutions, have become active competitors for our customers’ banking business. The process of eliminating banks as intermediaries, known as “disintermediation”, could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits. Further, an initiative by the CFPB, as prompted by the current Presidential Administration, to promote “open and decentralized banking” through the proposal of a Personal Financial Data Rights rule designed to facilitate the transfer of customer information at the direction of the customer to other financial institutions could lead to greater competition for products and services among banks and nonbanks alike if a final rule is adopted. The timing of and prospects for any such action are uncertain at this time. The loss of these revenue streams and the lower cost of deposits as a source of funds could have a material adverse effect on our financial condition and results of operations.

The loss of key personnel could disrupt our operations and result in reduced earnings.

Our growth and profitability will depend upon our ability to attract and retain skilled managerial, marketing and technical personnel. Competition for qualified personnel in the financial services industry is intense, and there can be no assurance that we will be successful in attracting and retaining such personnel. Our current executive officers provide valuable services based on their many years of experience and in-depth knowledge of the banking industry and the market areas we serve. Due to the intense competition for financial professionals, it might be difficult to find qualified replacements in the event that a key employee’s employment were to terminate, which could disrupt the continuity of operations and/or result in a reduction in earnings.

We are a community bank and our ability to maintain our reputation is critical to the success of our business.

We are a community banking institution, and our reputation is one of the most valuable components of our business. A key component of our business strategy is to rely on our reputation for customer service and knowledge of local markets to expand our presence by capturing new business opportunities from existing and prospective customers in our current market and contiguous areas. As such, we strive to conduct our business in a manner that enhances our reputation. This is done, in part, by recruiting, hiring and retaining employees who share our core values of being an integral part of the communities we serve, delivering superior service to our customers and caring about our customers and associates. If our reputation is negatively affected by the actions of our employees, by our inability to conduct our operations in a manner that is appealing to current or prospective customers, or otherwise, our business and, therefore, our operating results may be materially adversely affected.

The Company is subject to risks from a proxy contest and/or the actions of activist stockholders.

The Company could from time to time receive notices of a stockholder’s intention to submit proposals for approval and/or nominate candidates for election to the Company’s Board of Directors at an annual or special meeting of stockholders and, in connection therewith, solicit proxies from our stockholders. In the event that the Company’s Board of Directors disagrees with such a proposal and/or believes that such candidates would not complement the rest of the Board, the Company might oppose such proposal and/or candidates in its proxy statement for that meeting. A proxy contest or related activities on the part of the proposing stockholder could adversely affect our business for a number of reasons, including, without limitation, the following:

●

Responding to proxy contests and other actions by activist stockholders can be costly and time-consuming, disrupting our operations and diverting the attention of management and our employees;

●

Perceived uncertainties as to our future direction may result in the loss of potential business opportunities and may make it more difficult to attract and retain qualified personnel, business partners, customers and others important to our success, any of which could negatively affect our business and our results of operations and financial condition; and

●

Our ability to effectively and timely implement our strategic plans and/or to realize long-term value from our assets could be adversely affected if nominees advanced by activist stockholders are elected or appointed to the Company’s Board of Directors with a specific agenda, and that could in turn have an adverse effect on our business and on our results of operations and financial condition.

Proxy contests could cause our stock price to experience periods of volatility. Further, if a proxy contest results in a change in control of the Company’s Board of Directors, then such an event could subject us to risks relating to certain third parties’ rights under our existing contractual obligations, which could adversely affect our business.

Risks Relating to Ownership of Our Common Stock

Our ability to pay dividends on the common stock is limited by applicable law, and the payment of dividends is at the discretion of our board of directors.

Because the Company is not engaged in any direct business activities, the Company expects to fund dividends, if and when declared by the Company’s board of directors, using cash received from the Bank and the Insurance Subsidiary. No assurance can be given that the Bank or the Insurance Subsidiary will be able to pay dividends to the Company for these purposes at times and/or in amounts requested by the Company. Both federal and Maryland laws impose restrictions on the ability of the Bank to pay dividends, and Tennessee law imposes restrictions on the Insurance Subsidiary’s ability to pay dividends. Further information about these limitations is contained in Item 5 of Part II of this annual report under the heading, “Market Price Analysis and Dividends”.

Notwithstanding the foregoing, stockholders must understand that the declaration and payment of dividends and the amounts thereof are at the discretion of the Company’s board of directors. Thus, even at times when the Company could pay cash dividends on its common stock, neither the payment of such dividends nor the amounts thereof can be guaranteed.

The shares of common stock are not insured.

The shares of our common stock are not deposits and are not insured against loss by the FDIC or any other governmental or private agency.

Our common stock is not heavily traded, and the stock price may fluctuate significantly.

Our common stock is not traded on any exchange. Certain brokers currently make a market in the common stock by trading shares in the over-the-counter market, but such transactions are infrequent and the volume of shares traded is relatively small. Management cannot predict whether these or other brokers will continue to make a market in our common stock. Prices on stock that is not heavily traded, such as our common stock, can be more volatile than stock trading in an active public market. Factors such as our financial results, the introduction of new products and services by us or our competitors, publicity regarding the banking industry, and various other factors affecting the banking industry may have a significant impact on the market price of the shares of our common stock. Likewise, events that are unrelated to the Company but that affect the equity markets generally, such as international health crises, wars, political instability and similar factors, could also have a significant impact on the market price and trading volume of the shares of common stock. Management also cannot predict the extent to which an active public market for our common stock will develop or be sustained in the future. Accordingly, stockholders may not be able to sell their shares of our common stock at the volumes, prices, or times that they desire.

The Company’s Articles of Incorporation and Bylaws and Maryland law may discourage a corporate takeover.

The Company’s Articles of Incorporation (the “Charter”) and Bylaws contain certain provisions designed to enhance the ability of the Company’s board of directors to deal with attempts to acquire control of the Company. First, the board of directors is classified into four classes. Directors of each class serve for staggered four-year periods, and no director may be removed except for cause, and then only by the affirmative vote of a majority of the outstanding voting stock. Second, the board has the authority to classify and reclassify unissued shares of stock of any class or series of stock by setting, fixing, eliminating, or altering in any one or more respects the preferences, rights, voting powers, restrictions and qualifications of, dividends on, and redemption, conversion, exchange, and other rights of, such securities. The board could use this authority, along with its authority to authorize the issuance of securities of any class or series, to issue shares having terms favorable to management to a person or persons affiliated with or otherwise friendly to management. In addition, the Bylaws require any stockholder who desires to nominate a director to abide by strict notice requirements.

Maryland laws include provisions that could discourage a sale or takeover of the Company. The Maryland Business Combination Act generally prohibits, subject to certain limited exceptions, corporations from being involved in any “business combination” (defined as a variety of transactions, including a merger, consolidation, share exchange, asset transfer or issuance or reclassification of equity securities) with any “interested stockholder” for a period of five years following the most recent date on which the interested shareholder became an interested stockholder. An interested stockholder is defined generally as a person who is the beneficial owner of 10% or more of the voting power of the outstanding voting stock of the corporation after the date on which the corporation had 100 or more beneficial owners of its stock or who is an affiliate or associate of the corporation and was the beneficial owner, directly or indirectly, of 10% percent or more of the voting power of the then outstanding stock of the corporation at any time within the two-year period immediately prior to the date in question and after the date on which the corporation had 100 or more beneficial owners of its stock. The Maryland Control Share Acquisition Act applies to acquisitions of “control shares”, which, subject to certain exceptions, are shares the acquisition of which entitle the holder, directly or indirectly, to exercise or direct the exercise of the voting power of shares of stock of the corporation in the election of directors within any of the following ranges of voting power: one-tenth or more, but less than one-third of all voting power; one-third or more, but less than a majority of all voting power or a majority or more of all voting power. Control shares have limited voting rights. Maryland banking law provides that the Maryland Commissioner must approve certain acquisitions of the common stock of the Company or the Bank, and this law imposes a mandatory five-year voting prohibition on shares that are acquired without the required approval.

Although these provisions do not preclude a takeover, they may have the effect of discouraging, delaying or deferring a tender offer or takeover attempt that a shareholder might consider in his or her best interest, including those attempts that might result in a premium over the market price for the common stock. Such provisions will also render the removal of the Company’s board of directors and of management more difficult and, therefore, may serve to perpetuate current management. These provisions could potentially adversely affect the market prices of the Company’s securities.

The Company has adopted a stockholder rights agreement that could make it difficult for a person or group of persons to acquire more than 11% of our issued and outstanding stock.

On July 30, 2024, in an effort to protect the interests of the Company and its stockholders by, among other things, guarding against hostile takeover attempts, abusive tactics, and other tactics potentially disadvantageous to the interests of the Company and its stockholders, the Company’s Board of Directors adopted a stockholder rights agreement pursuant to which it issued to the record holders of common stock one right in respect of each share of common stock held by such holders as of the close of business on August 12, 2024 (the “Rights Agreement”). In general terms, the Rights Agreement imposes significant dilution upon any person or group (other than the Company or certain related persons) that is or becomes the beneficial owner of 11% or more of the outstanding shares of common stock without the prior approval of the Board. The Rights Agreement could make it difficult for a stockholder or group of stockholders acting together to acquire more than 11% of the outstanding shares of our common stock without causing significant dilution to that stockholder or group’s ownership interest in the Company. A more complete summary of the Rights Agreement, which is filed as Exhibit 4.1 to this Annual Report, is set forth in the Company’s Current Report on Form 8-K that was filed with the SEC on July 30, 2024.

ITEM 1B.

UNRESOLVED STAFF COMMENTS

This Item 1B is not applicable because the Company is a “smaller reporting company”.

ITEM 1C.

CYBERSECURITY

The Company’s cybersecurity risk program was developed and is maintained to identify, analyze, and remediate the associated risks that cyber threats pose to our organization, particularly in light of our continually increasing reliance on technology in delivering electronic banking solutions and supporting our computer network. The program is overseen and executed by a team of experienced, certified cybersecurity professionals.

23

---

The objective of our program is to avoid or minimize the impact of external threats and efforts to disrupt and/or gain unauthorized access to our computer systems and the secure customer data information stored on these systems. Our computer environment is aligned with the National Institute of Standards and Technology Cybersecurity (the “NIST”) framework, banking regulations, and other applicable security industry standards and protocols. We use industry expert vendors to provide 24/7/365 threat intelligence and network security monitoring and to provide periodic risk assessment audits, in addition to the periodic information technology audit examinations conducted by the FDIC and Maryland Commissioner. Our President and our Information Technology Security/Compliance Officer provide periodic reports, recommendations and information about industry best practices to the Board of Directors, the Board’s Audit Committee, and the Bank’s Information Technology Strategic Planning Committee.

Our Information Technology Security/Compliance Officer is primarily responsible for the ongoing review and management of our cybersecurity risk program and provides quarterly reports and other information throughout the year to our President, our Board of Directors, the Board’s Audit Committee and its Executive Committee, and the Bank’s Information Technology Strategic Planning Committee for the purpose of providing them with an understanding of our ongoing monitoring activities and preparedness with respect to our cybersecurity risks so that they can engage in an informed review of our program and direct the implementation of our ongoing monitoring activities and preparedness with respect to our cybersecurity risks so that they can engage in an informed review of our program and direct the implementation of appropriate changes as and when needed.

IT Security/Compliance – Annual Cybersecurity Risk Assessment (Board Review/Approval)

Our Information Technology Security/Compliance Officer completed a comprehensive self-assessment of the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool (“CAT”). The CAT is developed by the Financial Service Sector Coordinating Council and is aligned to the NIST Cybersecurity framework in the identification of organizational risks and determination of cybersecurity preparedness. These assessments take into account our organizational characteristics and actual and perceived external threats and evaluate, among other things, how those threats could impact and be impacted by our technologies and connection types, our delivery channels, our online and mobile banking products and other electronic banking services, our risk management oversight and controls, our dependence on outside vendors and how we manage those relationships, and our cybersecurity incident management process. The Company’s third-party information technology network security consultant reviews the completed CAT reports, along with our annual information technology risk assessment audit reviews.

Cybersecurity Defense Approach

We deploy and maintain a layered cybersecurity defense approach to securely protect our network computer systems, software applications, and stored data/information resources. As a first layer of defense, we employ a multi-faceted firewall and replication of primary and backup servers in our computer network. The Company receives daily and weekly reports and cybersecurity activity alerts, which are reviewed by our network administration management team. Our President and our Information Technology Security/Compliance Officer present quarterly Customer Data & Information Systems Security Program report updates to our boards of directors and their joint Executive Committee.

Third-Party Vendor Management

In accordance with the FDIC’s information technology (“IT”) compliance requirement for an annual vendor risk management program, the Bank developed a vendor management policy and performs an annual risk assessment review. This comprehensive review of mission-critical bank industry and network security vendors includes annual review of vendor compliance reports performed by accounting and audit firms, reviews of annual financial reports for vendors, and risk assessment reviews encompassing vendor performance, information technology compliance, operations, quality of service and support, contractual compliance, and business resumption contingency plans. These annual vendor management risk assessments are evaluated by the bank’s designated Information Technology Security/Compliance Officer for review and authorization by the bank’s President and senior information technology management, with final presentation, review, and approval by the Board of Directors. Complementing the Bank’s vendor risk assessment review and program, are additional risk assessment evaluations including the FDIC Risk Assessment, inclusive of network systems risk assessment, customer information systems risk assessment, and electronic banking vendor management risk assessment. Additionally, the Bank maintains a disaster recovery policy and conducts annual disaster recovery testing with respect to its mission-critical software vendor applications, as well as performs an annual business impact analysis that evaluates each mission-critical vendor in a prioritized hierarchy of hardware and software restoration relative to specified recovery time objectives and recovery time objectives in accordance with the FDIC’s information technology compliance requirements.

24

---

Incident Response Program

In accordance with the FDIC’s requirement for development of an annual IT incident response policy, the Bank maintains an incident response and computer forensics policy. This policy is reviewed on an annual basis and updated as necessary by the Bank’s President and its Information Technology Security/Compliance Officer and then presented for review and approval by the Bank’s Board of Directors. The policy is also reviewed as part of an annual network security risk assessment audit conducted by the Bank’s IT security consultant and by the FDIC and the Maryland Commissioner when they conduct their IT examinations. The Bank has established incident alert levels, response and recovery timeframes, and computer forensics procedures for cybersecurity attack events, data breaches of sensitive information, systems failures and alerts, and corresponding customer and key contact notification including regulatory, vendors, local authorities, and bank directors/employees. The Bank annually contracts with a third-party industry expert vendor to provide computer forensics guidance and escalated support in the event of a cybersecurity incident when such vendor’s expertise and resources are needed.

Security Awareness and Training

The Bank maintains a program led by our Information Technology Security/Compliance Officer that is intended to comply with the FDIC’s requirement for annual network security training of all employees. This training program includes a comprehensive network security overview, including phishing and ransomware awareness training, a summary review of the Bank’s disaster recovery and pandemic plans, and an annual renewal and authorization of an employee network acceptable use policy. In addition, the Bank’s IT management and network administrators attend periodic training programs and certifications, review regulatory compliance and industry IT security briefs, and participate in vendor application quality assurance reviews. Finally, we provide our customers with information about cybersecurity awareness and electronic banking security practices, phishing and malware awareness, and fraudulent scams targeting customers on our dedicated website.