​

Credit Risks

We are subject to risks related to our concentration of construction and land development and commercial real estate loans.

As of December 31, 2023, we had $164.7 million of construction and land development loans, or 5.1% of our loan portfolio. Construction and land development loans are subject to risks during the construction phase that are not present in standard residential real estate and commercial real estate loans. These risks include:

Real estate construction and land development loans may involve the disbursement of substantial funds with repayment dependent, in part, on the success of the ultimate project rather than the ability of a borrower or guarantor to repay the loan and also present risks of default in the event of declines in property values or volatility in the real estate market during the

construction phase. Our practice, in the majority of instances, is to secure the personal guaranty of individuals in support of our real estate construction and land development loans which provides us with an additional source of repayment. As of December 31, 2023, we did not have any nonperforming construction and land development loans. As of December 31, 2021, we did not have any nonperforming construction and land development loans and had $266 thousand of assets that have been foreclosed. If one or more of our larger borrowers were to default on their construction and land development loans, and we did not have alternative sources of repayment through personal guarantees or other sources, or if any of the aforementioned risks were to occur, we could incur significant losses.

As of December 31, 2023, we had $1.17 billion of commercial real estate loans outstanding, or 36.3% of our loan portfolio, including multi-family residential loans and loans secured by farmland. Commercial real estate lending typically involves higher loan principal amounts and the repayment is dependent, in large part, on sufficient income from the properties securing the loan to cover operating expenses and debt service.

We have a meaningful amount of consumer loans that are unsecured and if the borrower defaults on the loan we have no recourse to collateral in which to recover any potential losses.

Our consumer loan portfolio that are unsecured is $328.0 million, or approximately 10.0% of our total loan portfolio, as of December 31, 2023. Included in this portfolio is $199.3 million of loans sourced based on our credit underwriting criteria and managed by a third party. Consumer loan repayment is primarily driven by the borrower’s personal income which is impacted by various factors that are outside of the control of the borrower including macroeconomic conditions such as inflation and interest rates. Further, a downturn in the economy or other company-specific decisions that result in a borrower losing their job could cause the borrower’s primary source of income for repayment of the loan to decline. Each of these factors may cause a borrower to evaluate their debts and as a result they may prioritize payment of other debts above the consumer loan due to us. Although macroeconomic conditions and the economy are currently stable, such conditions can change relatively quick and may not remain at current levels. If conditions change and macroeconomic conditions and the economy worsen borrowers may stop paying their loans and it could require us to increase our provision for credit losses and adversely affect our financial condition and results of operations.

A portion of our consumer loan portfolio is originated and serviced by a third-party and includes a credit enhancement from that third-party which may not be realizable and the inability to utilize it could be detrimental to our financial condition and results of operations.

We receive a credit enhancement from the third-party managing $199.3 million of consumer loans that are recorded on our balance sheet as of December 31, 2023. The credit enhancement is primarily provided through cash flows derived from loan originations. If lending slows or stops it would cause monthly cash receipts related to this credit enhancement to decline, which may adversely affect our financial condition and results of operations.

A significant amount of our third-party serviced consumer loans were originated with a zero interest promotional period exposing us to the credit risk of the third-party that is providing reimbursement to us for interest foregone in the event of borrower prepayment and failure of the third-party to perform under its reimbursement obligation could be detrimental to our financial condition and results of operations.

Within the $199.3 million third-party originated and serviced consumer loan portfolio there is 45% of the portfolio that is in a promotional interest period as of December 31, 2023. The loans in these promotional interest periods legally accrue interest at the stated rate of the note agreement but the interest is not required to be paid during the promotional period. Further, if the borrower repays all of the principal on the note prior to the end of the promotional period the accrued interest is waived, but if there is any principal balance remaining at the end of the promotional period the borrower must repay all of the interest that has accrued. As of December 31, 2023, the amount of deferred interest on these loans was $12.2 million. Through an agreement with the third-party servicer, we are entitled to payment of all accrued interest that is waived on loans that repay all principal within the promotional period. There is a large concentration of these loans originated within proximity to each other resulting in 70% of the current balance of promotional loans ending their promotional period in the second half of 2024 through the first quarter of 2025. If a high percentage of these loans repay at the end of their promotional period a large amount of interest reimbursement will be due in a short period of time from the third-party servicer and if they cannot perform then we may not be able to realize any income on a significant amount of loans in our portfolio, which may adversely impact the realization of the fair value of the derivative asset recognized.

​

A significant amount of our loans are secured by real estate and any declines in real estate values in our primary markets could be detrimental to our financial condition and results of operations.

Real estate lending (including commercial, construction, land development, and residential loans) is a large portion of our loan portfolio, constituting $2.0 billion, or approximately 62.2% of our total loan portfolio, as of December 31, 2023. Although residential and commercial real estate values are currently strong in our market area, such values may not remain elevated. If loans that are collateralized by real estate become troubled during a time when market conditions are declining or have declined, then we may not be able to realize the full value of the collateral that we anticipated at the time of originating the loan, which could require us to increase our provision for credit losses and adversely affect our financial condition and results of operations.

As of December 31, 2023, 36.3% of our loan portfolio was comprised of loans secured by commercial real estate, including multi-family residential loans and loans secured by farmland. As of December 31, 2023, $665.9 million, or approximately 20.7% of our total loans, were secured by single-family residential real estate.As of December 31, 2021, $621.4 million, or approximately 26.6% of our total loans, were secured by single-family residential real estate. This includes $606.2 million in residential 1-4 family loans and $59.7 million in home equity lines of credit. This includes $547.6 million in residential 1-4 family loans and $73.8 million in home equity lines of credit. If housing prices in our market areas do not remain strong or deteriorate, we may experience an increase in nonperforming loans, provision for credit losses and charge-offs. If we are required to liquidate the collateral securing a loan to satisfy the debt during a period of reduced real estate values, our earnings and capital could be adversely affected.

If our nonperforming assets increase, our earnings will suffer.

At December 31, 2023, our nonperforming assets (which consist of nonaccrual loans, loans past due 90 days and accruing and OREO) totaled $10.8 million, or 0.34% of total loans and OREO, which is a decrease of $28.0 million, or 72.2%, compared with nonperforming assets of $38.8 million, or 1.32% of total non-covered loans and OREO at December 31, 2022.

Economic and market conditions have been unstable, and although our nonperforming assets as a percentage of total loans and OREO remains manageable, we may incur losses if there is an increase in nonperforming assets in the future. Our nonperforming assets adversely affect our net income in various ways. We do not record interest income on nonaccrual loans or OREO, thereby adversely affecting our net interest income, and increasing loan administration costs. When we take collateral in foreclosures and similar proceedings, we are required to mark the related loan to the then fair value of the collateral, which may ultimately result in a loss. We must reserve for expected losses, which is established through a current period charge to the provision for credit losses as well as from time to time, as appropriate, a write down of the value of properties in our OREO portfolio to reflect changing market values. We must reserve for probable losses, which is established through a current period charge to the provision for credit losses as well as from time to time, as appropriate, a write down of the value of properties in our OREO portfolio to reflect changing market values. Additionally, there are legal fees associated with the resolution of problem assets as well as carrying costs such as taxes, insurance and maintenance related to our OREO. Further, the resolution of nonperforming assets requires the active involvement of management, which can distract them from more profitable activity. Further, the resolution of nonperforming assets requires the active involvement of management, which can distract 24 Table of Contentsthem from more profitable activity. Finally, an increase in the level of nonperforming assets increases our regulatory risk profile. There can be no assurance that we will not experience future increases in nonperforming assets.

If our allowance for credit losses is not adequate to cover actual loan losses, our earnings will decrease.

As a lender, we are exposed to the risk that our borrowers may not repay their loans according to the terms of these loans, and the collateral securing the payment of these loans may be insufficient to ensure repayment. We make various assumptions and judgments about the collectability of our loan portfolio, including the creditworthiness of the borrowers and the value of the real estate and other assets serving as collateral for the repayment of many of our loans. The amount of the allowance represents management's best estimate of current expected credit losses on loans considering available information, from internal and external sources, relevant to assessing collectability over the loans' contractual terms, adjusted for expected prepayments when appropriate. If our assumptions prove to be incorrect or if we experience significant loan losses, our current allowance may not be sufficient to cover actual loan losses and adjustments may be necessary to allow for different economic conditions or adverse developments in our loan portfolio. A material addition to the allowance for credit losses could cause our earnings to decrease. Due to the relatively unseasoned nature of portions of our loan portfolio, we may experience an increase in delinquencies and losses as these loans continue to mature. Due to the relatively unseasoned nature of our loan portfolio, we may experience an increase in delinquencies and losses as these loans continue to mature.

In addition, federal regulators periodically review our allowance for credit losses and may require us to increase our provision for credit losses or recognize further charge-offs, based on judgments different than those of our management. Any significant increase in our allowance for credit losses or charge-offs required by these regulatory agencies would result in a decrease in net income and capital and could have a material adverse effect on our results of operations and financial condition. Any significant increase in our allowance for credit losses or charge-offs required by these regulatory agencies could have a material adverse effect on our results of operations and financial condition.

We are subject to credit quality risks and our credit policies may not be sufficient to avoid losses.

We are subject to the risk of losses resulting from the failure of borrowers, guarantors and related parties to pay interest and principal amounts on their loans. Although we maintain credit policies and credit underwriting, monitoring and collection procedures, these policies and procedures may not prevent losses, particularly during periods in which the local, regional or national economy suffers a general decline. If borrowers fail to repay their loans, our financial condition and results of operations would be adversely affected.

The Company’s mortgage revenue is cyclical and is sensitive to the level of interest rates, changes in economic conditions, decreased economic activity, and slowdowns in the housing market, any of which could adversely impact our profits.

​

The Bank originates residential mortgage loans through Primis Mortgage Company which lends to borrowers nationwide. The success of our mortgage business is dependent upon its ability to originate loans and sell them to investors, in each case at or near current volumes. Loan production levels are sensitive to changes in the level of interest rates and changes in economic conditions. Loan production levels may suffer if we experience a slowdown in housing markets, tightening credit conditions or increasing interest rates. Any sustained period of decreased activity caused by fewer refinancing transactions, higher interest rates, housing price pressure, or loan underwriting restrictions would adversely affect our mortgage originations and, consequently, could significantly reduce our income from mortgage activities. As a result, these conditions would also adversely affect our financial condition and results of operations.

Deteriorating economic conditions may also cause home buyers to default on their mortgages. In certain cases, where we have originated loans and sold them to investors, we may be required to repurchase loans or provide a financial settlement to investors if it is proven that the borrower failed to provide full and accurate information on, or related to, their loan application, if appraisals for such properties have not been acceptable or if the loan was not underwritten in accordance with the loan program specified by the loan investor. In the ordinary course of business, we record an indemnification reserve relating to mortgage loans previously sold based on historical statistics and loss rates. If such reserves were insufficient to cover claims from investors, such repurchases or settlements would adversely affect our financial condition and results of operations.

​

Market Risks

Our profitability depends significantly on local economic conditions in the areas where our operations and loans are concentrated, and our geographic concentration makes us vulnerable to local weather catastrophes, public health issues, and other external events, which could adversely affect our results of operations and financial condition.

We operate in a mixed market environment with influences from both rural and urban areas. Our profitability depends on the general economic conditions in our market areas of Northern Virginia, Maryland, Washington, D.C., Charlottesville, Northern Neck, Middle Peninsula, Richmond, Hampton Roads and the surrounding areas. Unlike larger banks that are more geographically diversified, we provide banking and financial services to clients primarily in these market areas. As of December 31, 2023, a significant portion of our commercial real estate, real estate construction and residential real estate loans were made to borrowers in our market area. As of December 31, 2021, substantially all of our commercial real estate, real estate construction and residential real estate loans were made to borrowers in our market area. The local economic conditions in this area have a significant impact on our commercial, real estate and construction and consumer loans, the ability of the borrowers to repay these loans and the value of the collateral securing these loans. In addition, if the population or income growth in these market areas slows, stops or declines, income levels, deposits and housing starts could be adversely affected and could result in the curtailment of our expansion, growth and profitability. Political conditions could also impact our earnings.

Our business is subject to interest rate risk and variations in interest rates may negatively affect our financial performance.

The majority of our assets and liabilities are monetary in nature and subject us to significant risk from changes in interest rates. These rates are highly sensitive to many factors beyond our control, including general economic conditions and the policies of the Federal Reserve and other governmental and regulatory agencies. Like most financial institutions, changes in interest rates can impact our net interest income as well as the valuation of our assets and liabilities, which is the difference between interest earned from interest-earning assets, such as loans and investment securities, and interest paid on interest-bearing liabilities, such as deposits and borrowings. We expect that we will periodically experience “gaps” in the interest rate sensitivities of our assets and liabilities, meaning that either our interest-bearing liabilities will be more sensitive to changes in market interest rates than our interest-earning assets, or vice versa. In either event, if market interest rates should move contrary to our position, this “gap” will negatively impact our earnings.

Based on our analysis of the interest rate sensitivity of our assets, an increase in the general level of interest rates may negatively affect the market value of the portfolio equity as well as negatively affect our net interest income since a majority of our assets are fixed rate loans. Additionally, an increase in interest rates may, among other things, reduce the demand for loans and our ability to originate loans as well as increase our funding costs. Additionally, an increase in interest rates may, among other things, reduce the demand for loans and our ability to originate loans. A decrease in the general level of interest rates may affect us through, among other things, increased prepayments on our loan and mortgage-backed securities portfolios, but also allow us to reduce funding costs. Accordingly, changes in the level of market interest rates affect our net yield on interest-earning assets, loan origination volume, loan and mortgage-backed securities portfolios, funding, and our overall results. While it is not expected that the FRB will continue to increase the target federal funds rate in 2024 to combat recent inflationary trends as it did in 2023, we are unable to predict changes in interest rates, which are affected by factors beyond our control, including inflation, deflation, recession, unemployment, money supply, and other changes in financial markets.

Although our asset liability management strategy is designed to keep our risk within acceptable parameters, it may not be able to prevent changes in interest rates from having a material adverse effect on our results of operations and financial condition. Although our asset liability management strategy is designed to control our risk from changes in market interest rates, it may not be able to prevent changes in interest rates from having a material adverse effect on our results of operations and financial condition.

Unstable global economic conditions may have serious adverse consequences on our business, financial condition, and operations.

We are operating in an uncertain economic environment. The global credit and financial markets have experienced extreme volatility and disruptions over the past few years, including severely diminished liquidity and credit availability, declines in consumer confidence, declines in economic growth, increases in unemployment rates, high rates of inflation, and uncertainty about economic stability and a potential recession. The U.S. government's decisions regarding its debt ceiling and the possibility that the U.S. could default on its debt obligations may cause further interest rate increases, disrupt access to capital markets, and deepen recessionary conditions. While our management team continually monitors market conditions and economic factors, throughout our footprint, we are unable to predict the duration or severity of such

conditions or factors. If conditions were to worsen nationally, regionally, or locally, then we could see a sharp increase in our total net charge-offs and also be required to significantly increase our allowance for credit losses. Furthermore, the demand for loans and our other products and services could decline. An increase in our non-performing assets and related increases in our provision for loan losses, coupled with a potential decrease in the demand for loans and other products and services, could negatively affect our business and could have a material adverse effect on our capital, financial condition, results of operations, and future growth. Our clients may also be adversely impacted by changes in regulatory, trade (including tariffs), and tax policies and laws, all of which could reduce demand for loans and adversely impact our borrowers' ability to repay our loans.

There can be no assurance that further deterioration in markets and confidence in economic conditions will not occur. Our general business strategy may be adversely affected by any such economic downturn or recession, volatile business environment, hostile third-party action, or continued unpredictable and unstable market conditions. The effects of any economic downturn or recession could continue for many years after the downturn or recession is considered to have ended.

​

Declines in asset values may result in impairment charges and adversely affect the value of our investment securities, financial performance and capital.

We maintain an investment securities portfolio that includes, but is not limited to, collateralized mortgage obligations, agency mortgage-backed securities and municipal securities. The market value of investment securities may be affected by factors other than the underlying performance of the issuer or composition of the bonds themselves, such as ratings downgrades, adverse changes in the business climate and a lack of liquidity for resales of certain investment securities. At each reporting period, we evaluate investment securities and other assets for impairment indicators. We may be required to record impairment charges in our income statements through an allowance for credit losses if our investment securities suffer a decline in value below their amortized cost. During the years ended December 31, 2023, 2022 and 2021, we incurred an insignificant amount of impairment charges related to credit losses on our investment securities. During the years ended December 31, 2021, 2020 and 2019, we incurred no other-than-temporary impairment charges related to credit losses or sales of securities. If in future periods we determine that a significant impairment has occurred, we would be required to charge against earnings the credit-related portion of the impairment, which could have a material adverse effect on our financial condition and results of operations in the periods in which the impairments occur. If in future periods we determine that a significant impairment has occurred, we would be required to charge against earnings the credit-related portion of the other-than-temporary impairment, which could have a material adverse effect on our results of operations in the periods in which the write-offs occur.

A portion of our income on a portfolio of consumer loans with promotional features is due from a third-party that originated the loans on our behalf. The value of this estimated reimbursement is recorded in our balance sheet at fair value as a derivative and actual results and a significant decline in the third-party’s credit risk may impact the value of the derivative and our ability to realize that value which could affect our financial performance and results of operations.

We record a derivative asset as of December 31, 2023, which mostly reflects our estimate of the fair value of the interest reimbursement due to us from the third-party loan servicer that manages an unsecured consumer loan portfolio with promotional features for us. This derivative asset reflects the interest anticipated to be waived to borrowers under the assumed pre-payment of the borrowers’ loans that the third party will be required to pay to us. The derivative is required to be valued at fair value under U.S. GAAP with the use of various assumptions including borrower pre-payment, expected credit losses, and third-party servicer credit risk. Assumptions used to determine the value of the derivative are sensitive to various factors not within our control that include borrower repayment risk and the credit risk of the third-party servicer. These assumptions are determined based on the information available to the Company as of each balance sheet date. Actual results that differ significantly from our prior assumptions may result in an inability to realize the value of the derivative and require updates to future fair value calculations of the derivative which could result in a significant increase or decrease in the derivative value that is recorded in our results of operations, which could have a material adverse effect on our financial condition and results of operations in future periods.

Our stock price can be volatile.

Stock price volatility may make it more difficult for you to resell your common stock when you want and at prices you find attractive. Our stock price can fluctuate significantly in response to a variety of factors including, among other things:

General market fluctuations, industry factors and general economic and political conditions and events, such as economic slowdowns or recessions, interest rate changes or credit loss trends, could also cause our stock price to decrease regardless of operating results.

The trading volume in our common stock is less than that of other larger financial services companies.

Although our common stock is listed for trading on the NASDAQ Global Market, the trading volume is low, and you are not assured liquidity with respect to transactions in our common stock. A public trading market having the desired characteristics of depth, liquidity and orderliness depends on the presence in the marketplace of willing buyers and sellers of our common stock at any given time. This presence depends on the individual decisions of investors and general economic and market conditions over which we have no control. Given the lower trading volume of our common stock, significant sales of our common stock, or the expectation of these sales, could cause our stock price to fall.

Inflation could negatively impact our business, our profitability and our stock price.

​

Prolonged periods of inflation may impact our profitability by negatively impacting our fixed costs and expenses, including increasing funding costs and expense related to talent acquisition and retention, and negatively impacting the demand for our products and services. Additionally, inflation may lead to a decrease in consumer and client’s purchasing power and negatively affect the need or demand for our products and services. If significant inflation continues, our business could be negatively affected by, among other things, decreases in loan collateral values and increased default rates leading to credit losses which could decrease our appetite for new credit extensions. If significant inflation continues, our business could be negatively affected by, among other things, increased default rates leading to credit losses which could 27 Table of Contentsdecrease our appetite for new credit extensions. These inflationary pressures could result in missed earnings and budgetary projections causing our stock price to suffer.

​

ESG risks could adversely affect our reputation and shareholder, employee, client, and third party relationships and may negatively affect our stock price.

Our business faces increasing public scrutiny related to ESG activities. We risk damage to our brand and reputation if we fail to act responsibly in a number of areas, such as DEI, environmental stewardship, including with respect to climate change, human capital management, support for our local communities, corporate governance, and transparency, or fail to consider ESG factors in our business operations.

Furthermore, as a result of our diverse base of clients and business partners, we may face potential negative publicity based on the identity of our clients or business partners and the public’s (or certain segments of the public’s) view of those entities. Such publicity may arise from traditional media sources or from social media and may increase rapidly in size and scope. If our client or business partner relationships were to become intertwined in such negative publicity, our ability to attract and retain clients, business partners, and employees may be negatively impacted, and our stock price may also be negatively impacted. Additionally, we may face pressure to not do business in certain industries that are viewed as harmful to the environment or are otherwise negatively perceived, which could impact our growth.

Additionally, investors and shareholder advocates are placing ever increasing emphasis on how corporations address ESG issues in their business strategy when making investment decisions and when developing their investment theses and proxy recommendations. We may incur meaningful costs with respect to our ESG efforts and if such efforts are negatively perceived, our reputation and stock price may suffer.

​

Operational Risks

Our business strategy includes strategic growth, and our financial condition and results of operations could be negatively affected if we fail to grow or fail to manage our growth effectively.

We intend to continue pursuing a growth strategy for our business. Our prospects must be considered in light of the risks, expenses and difficulties frequently encountered by growing companies such as the continuing need for infrastructure and personnel, the time and costs inherent in integrating a series of different operations and the ongoing expense of acquiring and staffing new banks or branches. We may not be able to expand our presence in our existing markets or successfully enter new markets and any expansion could adversely affect our results of operations. Failure to manage our growth effectively could have a material adverse effect on our business, future prospects, financial condition or results of operations, and could adversely affect our ability to successfully implement our business strategy. Our ability to grow successfully will depend on a variety of factors, including the continued availability of desirable business opportunities, the competitive responses from other financial institutions in our market areas and our ability to manage our growth.

Although there can be no assurance of success or the availability of branch or financial services acquisitions in the future, we may seek to supplement our internal growth through attractive acquisitions. We cannot predict the number, size or timing of acquisitions, or whether any such acquisition will occur at all. Our acquisition efforts have traditionally focused on targeted entities in markets in which we currently operate and markets in which we believe we can compete effectively. However, as consolidation of the financial services industry continues, the competition for suitable acquisition candidates may increase and, as the number of appropriate targets decreases, the prices for potential acquisitions could increase which could reduce our potential returns, and reduce the attractiveness of these opportunities to us. We may compete with other financial services companies for acquisition opportunities, and many of these competitors have greater financial resources than we do and may be able to pay more for an acquisition than we are able or willing to pay.

​

We must respond to rapid technological changes and these changes may be more difficult or expensive than anticipated.

If competitors introduce new products and services embodying new technologies, or if new industry standards and practices emerge, our existing product and service offerings, technology and systems may become obsolete. Further, if we fail to adopt or develop new technologies or to adapt our products and services to emerging industry standards, we may lose current and future customers, which could have a material adverse effect on our business, financial condition and results of operations. The financial services industry is changing rapidly and in order to remain competitive, we must continue to enhance and improve the functionality and features of our products, services and technologies. These changes may be more difficult or expensive than we anticipate.

New lines of business, products or services and technological advancements may subject us to additional risks.20 Table of ContentsNew lines of business, products or services and technological advancements may subject us to additional risks.

From time to time, we implement new lines of business or offer new products and services within existing lines of business. There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and/or new products and services we invest significant time and resources. Initial timetables for the introduction and development of new lines of business and/or new products or services may not be achieved and price and profitability targets may not prove feasible. External factors, such as compliance with regulations, competitive alternatives, and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services (including those related to or involving artificial intelligence, machine learning, blockchain and other distributed ledger technologies), and an established and growing demand for mobile and other phone and computer banking applications.The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology driven products and services

or be successful in marketing these products and services to our customers. In addition, our implementation of certain new technologies, such as those related to artificial intelligence, automation and algorithms, in our business processes may have unintended consequences due to their limitations or our failure to use them effectively. In addition, cloud technologies are also critical to the operation of our systems, and our reliance on cloud technologies is growing. Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse effect on our business, financial condition and results of operations.

Furthermore, any new line of business, new product or service and/or new technology could have a significant impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business, new products or services and/or new technologies could have a material adverse effect on our business, financial condition and results of operations.

We may not be able to successfully integrate our acquisitions or to realize the anticipated benefits of them.

A successful integration of each acquired business with ours will depend substantially on our ability to successfully consolidate operations, corporate cultures, systems and procedures and to eliminate redundancies and costs. While we have substantial experience in successfully integrating institutions we have acquired, we may encounter difficulties during integration, such as:

​

all of which could divert resources from regular banking operations. Additionally, general market and economic conditions or governmental actions affecting the financial industry generally may inhibit our successful merger integrations. Additionally, general market and economic conditions or governmental actions affecting the financial industry generally may inhibit our successful merger integrations.

Further, we acquire businesses with the expectation that these mergers will result in various benefits including, among other things, benefits relating to enhanced revenues, a strengthened market position for the combined company, cross selling opportunities, technology, cost savings and operating efficiencies. Achieving the anticipated benefits of these mergers is subject to a number of uncertainties, including whether we integrate these institutions in an efficient and effective manner, and general competitive factors in the marketplace. Failure to achieve these anticipated benefits could result in a reduction in the price of our shares as well as in increased costs, decreases in the amount of expected revenues and diversion of management's time and energy and could materially and adversely affect our business, financial condition and operating results.

The carrying value of goodwill and other intangible assets may be adversely affected.

When the Company completes an acquisition, goodwill and other intangible assets are often recorded on the date of acquisition as an asset. Current accounting guidance requires goodwill to be tested for impairment, and we perform such impairment analysis at least annually. A significant adverse change in expected future cash flows or sustained adverse change in the value of our common stock could require the asset to become impaired. If impaired, we would incur a charge to earnings that would have a significant impact on the results of operations. Our carrying value of goodwill and net amortizable intangibles were approximately $93.5 million and $2.0 million, respectively, at December 31, 2023.

We rely on third-party vendors to provide key components of our business infrastructure.

Third-party vendors provide key components of our business operations such as data processing, recording and monitoring transactions, online banking interfaces and services, Internet connections and network access. We have selected these third-party vendors carefully and have conducted the due diligence consistent with regulatory guidance and best practices. While we have ongoing programs to review third-party vendors and assess risk, we do not control their actions.

Any problems caused by these third parties, including those resulting from disruptions in communication services provided by a vendor, failure of a vendor to handle current or higher volumes, cyber-attacks and security breaches at a vendor, failure of a vendor to provide services for any reason or poor performance of services, could adversely affect our ability to deliver products and services to our customers and otherwise conduct our business. Financial or operational difficulties of a third-party vendor could also hurt our operations if those difficulties interfere with the vendor’s ability to serve us. Furthermore, our vendors could also be sources of operational and information security risk to us, including from breakdowns or failures of their own systems or capacity constraints. Replacing these third-party vendors could also create significant delay and expense. Accordingly, use of such third parties creates an unavoidable inherent risk to our business operations.

We face significant cyber and data security risk that could result in the disclosure of confidential information, adversely affect our business or reputation and expose us to significant liabilities.

As a financial institution, we are under threat of loss due to hacking and cyber-attacks. This risk has increased in recent years, and continues to increase, as we continue to expand customer capabilities to utilize internet and other remote channels to transact business. Two of the most significant cyber-attack risks that we face are e-fraud and loss of sensitive customer data. Loss from e-fraud occurs when cybercriminals breach and extract funds directly from customer or our accounts. The attempts to breach sensitive customer data, such as account numbers and social security numbers, are less frequent but would present significant reputational, legal and/or regulatory costs to us if successful. Our risk and exposure to these matters remains heightened because of the evolving nature and complexity of these threats from cybercriminals and hackers, our plans to continue to provide internet banking and mobile banking channels, and our plans to develop additional remote connectivity solutions to serve our customers. While we have not experienced any material losses relating to cyber-attacks or other information security breaches, we have been subject to hacking and cyber-attack and there can be no assurance that we will not suffer additional losses in the future. While we have not experienced any material losses relating to cyber-attacks or other information security breaches since 2017, we have been subject of hacking and cyber-attack and there can be no assurance that we will not suffer additional losses in the future.

Due to changing behaviors since the COVID-19 pandemic, we have allowed a portion of our employees to work remotely from their homes on a full-time or hybrid schedule. Technology in employees’ homes may not be as robust as in our offices and could cause the networks, information systems, applications, and other tools available to employees to be more limited or less reliable than in our offices. The continuation of these work-from-home measures also introduces additional operational risk, including increased cybersecurity risk. These cyber risks include greater phishing, malware, and other cybersecurity attacks, vulnerability to disruptions of our information technology infrastructure and telecommunications systems for remote operations, increased risk of unauthorized dissemination of confidential information, limited ability to restore the systems in the event of a systems failure or interruption, greater risk of a security breach resulting in destruction or misuse of valuable information, and potential impairment of our ability to perform critical functions, including wiring funds, all of which could expose us to risks of data or financial loss, litigation and liability and could seriously disrupt our operations and the operations of any impacted customers.

The occurrence of any cyber-attack or information security breach could result in material adverse consequences to us including damage to our reputation and the loss of customers. We also could face litigation or additional regulatory scrutiny. Litigation or regulatory actions in turn could lead to significant liability or other sanctions, including fines and penalties or reimbursement of customers adversely affected by security breach. Even if we do not suffer any material adverse consequences as a result of other future events, successful attacks or systems failures at the Bank or at other financial institutions could lead to a general loss of customer confidence in financial institutions including the Bank.

Our ability to mitigate the adverse consequences of occurrences is in part dependent on the quality of our information security procedures and contracts and our ability to anticipate the timing and nature of any such event that occurs.22 Table of ContentsOur ability to mitigate the adverse consequences of occurrences is in part dependent on the quality of our information security procedures and contracts and our ability to anticipate the timing and nature of any such event that occurs. In recent years, we have incurred significant expense towards improving the reliability of our systems and their security from attack. Nonetheless, there remains the risk that we may be materially harmed by cyber-attacks and information security breaches in the future. Methods used to attack information systems change frequently (with generally increasing sophistication), often are not recognized until launched against a target, may be supported by foreign governments or other well-financed entities, and may originate from less regulated and remote areas around the world. As a result, we may be unable to address these methods in advance of attacks, including by implementing adequate preventive measures. If such an attack or breach does occur, we might not be able to fix it timely or adequately. To the extent that such an attack or breach relates to products or services provided by others, we seek to engage in due diligence and monitoring to limit the

risk. In addition, as the regulatory environment related to information security, data collection and use, and privacy becomes increasingly rigorous, with new and constantly changing requirements applicable to our business, compliance with those requirements could also result in additional costs.

Our business is susceptible to fraud.

​

The Company’s business exposes it to fraud risk from loan and deposit customers, the parties they do business with, as well as from employees, contractors and vendors. The Company relies on financial and other data from new and existing customers which could turn out to be fraudulent when accepting such customers, executing their financial transactions and making and purchasing loans and other financial assets. In times of increased economic stress the Company is at increased risk of fraud losses. The Company believes it has underwriting and operational controls in place to prevent or detect such fraud, but cannot provide assurance that these controls will be effective in detecting fraud or that the Company will not experience fraud losses or incur costs or other damage related to such fraud, at levels that adversely affect financial results or reputation. The real estate collateral that provides the primary or an alternate source of repayment in the event of default may deteriorate in value during the term of the loan as a result of changes in economic conditions, fluctuations in interest rates and the availability of loans to potential purchasers, changes in tax and other laws and acts of nature. The Company’s lending customers may also experience fraud in their businesses which could adversely affect their ability to repay their loans or make use of services. The Company’s and its customers’ exposure to fraud may increase the Company’s financial risk and reputation risk as it may result in unexpected loan losses that exceed those that have been provided for in the allowance for credit losses.

​

We are dependent on key personnel and the loss of one or more of those key personnel could impair our relationship with our customers and adversely affect our business.

Many community banks attract customers based on the personal relationships that the banks’ officers and customers establish with each other and the confidence that the customers have in the officers. We significantly depend on the continued service and performance of our key management personnel. We also believe our management team’s depth and breadth of experience in the banking industry is integral to executing our business plan. The loss of the services of members of our senior management team or other key employees or the inability to attract additional qualified personnel as needed could have a material adverse effect on our business.

Our compensation practices are subject to review and oversight by the Federal Reserve, the FDIC and other regulators. The federal banking agencies have issued joint guidance on executive compensation designed to help ensure that a banking organization’s incentive compensation policies do not encourage imprudent risk taking and are consistent with the safety and soundness of the organization. In addition, the Dodd-Frank Act required those agencies, along with the SEC, to adopt rules to require reporting of incentive compensation and to prohibit certain compensation arrangements. In October 2022, the SEC adopted final rules requiring national securities exchanges, including Nasdaq where we are currently listed, to establish new listing standards relating to policies for the recovery of erroneously awarded incentive-based compensation, which are often referred to as “clawback policies.” The final rules directed U.S. stock exchanges to require listed companies to implement, disclose and enforce clawback policies to recover excess incentive-based compensation that current or former executive officers received based on financial reporting measures that are later restated. In June 2023, the SEC approved the Nasdaq’s proposed clawback listing standards, which now require us and other Nasdaq-listed companies to (i) adopt and implement a compliant clawback policy; (ii) file the clawback policy as an exhibit to our annual reports; and (iii) provide certain disclosures relating to any compensation recovery triggered by the clawback policy. If, as a result of complying with the new rules, we are unable to attract and retain qualified employees, or do so at rates necessary to maintain our competitive position, or if the compensation costs required to attract and retain employees become more significant, our performance, including our competitive position, could be materially adversely affected.

Deposit insurance premiums levied against banks may increase if the number of bank failures increase or the cost of resolving failed banks increases.

The FDIC maintains a Deposit Insurance Fund (“DIF”) to protect insured depositors in the event of bank failures. The DIF is funded by fees assessed on depository institutions insured by the FDIC. Future deposit premiums paid by banks will depend on FDIC rules, which are subject to change, the level of the DIF and the magnitude and cost of future bank failures. We may be required to pay significantly higher FDIC premiums if market developments change such that the DIF balance is reduced or the FDIC changes its rules to require higher premiums.

Liquidity Risks

Liquidity risk could impair our ability to fund operations and jeopardize our financial condition, results of operations and cash flows.

Liquidity is essential to our business. Our ability to implement our business strategy will depend on our ability to obtain funding for loan originations, working capital, possible acquisitions and other general corporate purposes. An inability to raise funds through deposits, borrowings, securities sold under agreements to repurchase, the sale of loans and other sources could have a substantial negative effect on our liquidity. We anticipate that our retail and commercial deposits will be sufficient to meet our funding needs in the foreseeable future. We may rely on deposits obtained through intermediaries, FHLB advances, and other wholesale funding sources to obtain the funds necessary to implement our growth strategy.

Our access to funding sources in amounts adequate to finance our activities or on terms which are acceptable to us could be impaired by factors that affect us specifically or the financial services industry or economy in general, including a decrease in the level of our business activity as a result of a downturn in the markets in which our loans are concentrated or adverse regulatory action against us. Our ability to borrow could also be impaired by factors that are not specific to us, such as a disruption in the financial markets or negative views and expectations about the prospects for the financial services industry. Access to liquidity may also be negatively impacted by the value of our securities portfolio, if liquidity and/or business strategy necessitate the sales of securities in a loss position. To the extent we are not successful in obtaining such funding, we will be unable to implement our strategy as planned which could have a material adverse effect on our financial condition, results of operations and cash flows.

Adverse developments affecting the financial services industry, such as actual events or concerns involving liquidity, defaults or non-performance by financial institutions or transactional counterparties, could adversely affect our current and projected business operations and its financial condition and results of operations.

Actual events involving limited liquidity, defaults, non-performance or other adverse developments that affect financial institutions, transactional counterparties or other companies in the financial services industry or the financial services industry generally, or concerns or rumors about any events of these kinds or other similar risks, have in the past and may in the future lead to market-wide liquidity problems. For example, on March 10, 2023, Silicon Valley Bank, or SVB, was closed by the California Department of Financial Protection and Innovation, which appointed the Federal Deposit Insurance Corporation, or the FDIC, as receiver. Similarly, on March 12, 2023, Signature Bank and Silvergate Capital Corp. were each swept into receivership. If any parties with whom we conduct business are unable to access deposits with another financial institution, funds pursuant to such instruments or lending arrangements with such a financial institution, such parties’ credit quality, ability to pay their obligations to us, or to enter into new commercial arrangements requiring additional payments to us could be adversely affected. Uncertainty remains over liquidity concerns in the broader financial services industry. Additionally, confidence in the safety and soundness of regional banks specifically or the banking system generally could impact where customers choose to maintain deposits, which could materially adversely impact our liquidity, loan funding capacity, ability to raise funds, and results of operations. Similar impacts have occurred in the past, such as during the 2008-2010 financial crisis.

Inflation and rapid increases in interest rates have led to a decline in the trading value of previously issued government securities with interest rates below current market interest rates. Although the U.S. Department of Treasury, FDIC and Federal Reserve Board have announced a program to provide up to $25 billion of loans to financial institutions secured by certain of such government securities held by financial institutions to mitigate the risk of potential losses on the sale of such instruments, widespread demands for customer withdrawals or other liquidity needs of financial institutions for immediate liquidity may exceed the capacity of such program. There is no guarantee that the U.S. Department of Treasury, FDIC and Federal Reserve Board will provide access to uninsured funds in the future in the event of the closure of other banks or financial institutions, or that they would do so in a timely fashion.

Although we assess our funding relationships as we believe necessary or appropriate, our access to funding sources and other arrangements in amounts adequate to finance or capitalize our current and projected future business operations could be significantly impaired by factors that affect us, our customers, the financial institutions with which we have arrangements directly, or the financial services industry or economy in general. These factors could include, among others,

events such as liquidity constraints or failures, the ability to perform our obligations under various types of financial, credit or liquidity agreements or arrangements, disruptions or instability in the financial services industry or financial markets, or concerns or negative expectations about the prospects for companies in the financial services industry. These factors could involve financial institutions or financial services industry companies with which we or our customers have financial or business relationships, but could also include factors involving financial markets or the financial services industry generally.

Additionally, we could be impacted by current or future negative perceptions and expectations about the prospects for the financial services industry (including the impact of Moody’s Investors Service’s rating change of the outlook of the US banking system from “stable” to “negative”), which could worsen over time and result in downward pressure on, and continued or accelerated volatility of, bank securities.

We also anticipate increased regulatory scrutiny – in the course of routine examinations and otherwise – and new regulations directed towards banks of similar size to the Bank, designed to address the negative developments in the banking industry, all of which may increase the Company’s costs of doing business and reduce its profitability. Among other things, there may be an increased focus by both regulators and investors on deposit composition, the level of uninsured deposits, losses embedded in the held-to-maturity portion of our securities portfolio, contingent liquidity, CRE composition and concentration, capital position and our general oversight and internal control structures regarding the foregoing. As primarily a commercial bank, the Bank has an elevated degree of uninsured deposits compared to larger national banks or smaller community banks with a stronger focus on retail deposits, and also maintains a robust CRE portfolio. As a result, the Bank could face increased scrutiny or be viewed as higher risk by regulators and the investor community. In addition, bank failures have and could in the future prompt the FDIC to increase deposit insurance costs. Increases in funding, deposit insurance, or other costs as a result of these types of events have and could in the future materially adversely affect our financial condition and results of operations. Further, the disruption following these types of events have and could in the future generate significant market trading volatility among publicly traded bank holdings companies and, in particular, regional banks like the Company.

Capital Adequacy Risks

Future growth or operating results may require us to raise additional capital, but that capital may not be available, be available on unfavorable terms or may be dilutive.

Primis Bank is required by the FRB to maintain adequate levels of capital to support our operations. In the event that our future operating results erode capital, if the Bank is required to maintain capital in excess of well-capitalized standards, or if we elect to expand through loan growth or acquisitions, we may be required to raise additional capital. Our ability to raise capital will depend on conditions in the capital markets, which are outside our control, and on our financial performance. Accordingly, we cannot be assured of our ability to raise capital on favorable terms when needed, or at all. If we cannot raise additional capital when needed, we will be subject to increased regulatory supervision and the imposition of restrictions on our growth and business. These outcomes could negatively impact our ability to operate or further expand our operations through acquisitions or the establishment of additional branches and may result in increases in operating expenses and reductions in revenues that could have a material adverse effect on our financial condition and results of operations. In addition, in order to raise additional capital, we may need to issue shares of our common stock that would dilute the book value of our common stock and reduce our current shareholders’ percentage ownership interest to the extent they do not participate in future offerings.

We may issue a new series of preferred stock or debt securities, which would be senior to our common stock and may cause the market price of our common stock to decline.

We have issued $27.0 million in aggregate principal amount of 5.875% Fixed-to-Floating Rate Subordinated Notes due January 31, 2027 and $60.0 million of fixed-to-floating rate Subordinated Notes due 2030. In the future, we may increase our capital resources by making additional offerings of debt or equity securities, which may include senior or additional subordinated notes, classes of preferred shares and/or common shares. Holders of our common stock are not entitled to preemptive rights or other protections against dilution. Preferred shares and debt, if issued, have a preference on liquidating distributions or a preference on dividend or interest payments that could limit our ability to make a distribution to the

holders of our common stock. Future issuances and sales of parity preferred stock, or the perception that such issuances and sales could occur, may also cause prevailing market price for our common stock to decline and may adversely affect our ability to raise additional capital in the financial markets at times and prices favorable to us. Further issuances of our common stock could be dilutive to holders of our common stock.

We currently intend to pay dividends on our common stock; however, our future ability to pay dividends is subject to restrictions.

We declared the first cash dividend on our common stock in February 2012, and each quarter thereafter through 2023. There are a number of restrictions on our ability to pay dividends. It is the policy of the FRB that bank holding companies should pay cash dividends on common stock only out of income available over the past year and only if prospective earnings retention is consistent with the organization’s expected future needs and financial condition. The policy provides that bank holding companies should not maintain a level of cash dividends that undermines the bank holding company’s ability to serve as a source of strength to its banking subsidiaries.

Our principal source of funds to pay dividends on our common stock is cash dividends that we receive from the Bank. The payment of dividends by the Bank to us is subject to certain restrictions imposed by federal banking laws, regulations and authorities. The federal banking statutes prohibit federally insured banks from making any capital distributions (including a dividend payment) if, after making the distribution, the institution would be "under capitalized" as defined by statute. In addition, the relevant federal regulatory agencies have authority to prohibit an insured bank from engaging in an unsafe or unsound practice, as determined by the agency, in conducting an activity. The payment of dividends could be deemed to constitute such an unsafe or unsound practice, depending on the financial condition of the Bank. Regulatory authorities could impose administratively stricter limitations on the ability of the Bank to pay dividends to us if such limits were deemed appropriate to preserve certain capital adequacy requirements.

Regulatory Risks

We are heavily regulated by federal and state agencies; changes in laws and regulations or failures to comply with such laws and regulations may adversely affect our operations and our financial results.

We and the Bank are subject to extensive regulation, supervision and examination by federal and state banking authorities. Any change in applicable regulations or federal or state legislation could have a substantial impact on us and the Bank, and our respective operations. Additional legislation and regulations may be enacted or adopted in the future that could significantly affect our powers, authority and operations or the powers, authority and operations of the Bank, which could have a material adverse effect on our financial condition and results of operations.

Further, bank regulatory authorities have the authority to bring enforcement actions against banks and their holding companies for unsafe or unsound practices in the conduct of their businesses or for violations of any law, rule or regulation, any condition imposed in writing by the appropriate bank regulatory agency or any written agreement with the agency. Possible enforcement actions against us could include the issuance of a cease-and-desist order that could be judicially enforced, the imposition of civil monetary penalties, the issuance of directives to increase capital or enter into a strategic transaction, whether by merger or otherwise, with a third party, the appointment of a conservator or receiver, the termination of insurance on deposits, the issuance of removal and prohibition orders against institution-affiliated parties, and the enforcement of such actions through injunctions or restraining orders. The exercise of this regulatory discretion and power may have a negative impact on us. See the discussion above at Supervision and Regulation for an additional discussion of the extensive regulation and supervision the Company and the Bank are subject to.

As a regulated entity, Primis and the Bank must maintain certain required levels of regulatory capital that may limit our operations and potential growth.

As further described above under Supervision and Regulation—Capital Requirements, Primis and the Bank each are subject to various regulatory capital requirements administered by the FRB.

Failure to meet minimum capital requirements can initiate certain mandatory, and possibly additional, discretionary actions by regulators that, if undertaken, could have a direct material effect on the Bank’s and our consolidated financial statements. Under capital adequacy guidelines and the regulatory framework for prompt corrective action, the Bank must meet specific capital guidelines that involve quantitative measures of the Bank’s assets, liabilities and certain off-balance sheet commitments as calculated under these regulations.

As of December 31, 2023, Primis and the Bank exceeded the amounts required to be well capitalized with respect to all four required capital ratios. As of December 31, 2023, Primis’ leverage, CET1 risk-based capital, Tier 1 risk-based capital and Total risk-based capital ratios were 8.37%, 8.96%, 9.25%, and 13.44%, respectively. As of December 31, 2021, Primis’ leverage, CET1 risk-based capital, Tier 1 risk-based capital and Total risk-based capital ratios were 9.41%, 13.09%, 13.52% and 18.52%, respectively. As of December 31, 2023, the Bank’s leverage, CET1 risk-based capital, Tier 1 risk-based capital and Total risk-based capital ratios were 9.80%, 10.88%, 10.88% and 12.12%, respectively. As of December 31, 2021, the Bank’s leverage, CET1 risk-based capital, Tier 1 risk-based capital and Total risk-based capital ratios were 11.14%, 16.18%, 16.18% and 17.43%, respectively.

Many factors affect the calculation of Primis and the Bank’s risk-based assets and its ability to maintain the level of capital required to achieve acceptable capital ratios. For example, changes in risk weightings of assets relative to capital and other factors may combine to increase the amount of risk-weighted assets in the Tier 1 risk-based capital ratio and the Total risk-based capital ratio. Any increases in its risk-weighted assets will require a corresponding increase in its capital to maintain the applicable ratios. In addition, recognized loan losses in excess of amounts reserved for such losses, loan impairments, impairment losses on investment securities and other factors will decrease the Bank’s capital, thereby reducing the level of the applicable ratios.

Primis and the Bank’s failure to remain well capitalized for bank regulatory purposes could affect customer confidence, our ability to grow, our costs of funds and FDIC insurance costs, our ability to pay dividends on our capital stock, our ability to make acquisitions, and on our business, results of operations and financial condition. Under FRB rules, if the Bank ceases to be a well-capitalized institution for bank regulatory purposes, the interest rates that it pays on deposits and its ability to accept, renew or rollover brokered deposits may be restricted. As of December 31, 2023, we had $75.0 million of brokered certificates of deposits. As of December 31, 2021, we did not have any brokered certificates of deposits.

We are subject to commercial real estate lending guidance issued by the federal banking regulators that impacts our operations and capital requirements.

The federal banking regulators have issued final guidance regarding concentrations in commercial real estate lending directed at institutions that have particularly high concentrations of commercial real estate loans within their lending portfolios. This guidance suggests that institutions whose commercial real estate loans exceed certain percentages of capital should implement heightened risk management practices appropriate to their concentration risk and may be required to maintain higher capital ratios than institutions with lower concentrations in commercial real estate lending. Based on our commercial real estate concentration as of December 31, 2023, we believe that we are operating within the guidelines. However, increases in our commercial real estate lending could subject us to additional supervisory analysis. We cannot guarantee that any risk management practices we implement will be effective to prevent losses relating to our commercial real estate portfolio. Management has implemented controls to monitor our commercial real estate lending concentrations, but we cannot predict the extent to which this guidance will continue to impact our operations or capital requirements.

Changes in accounting standards or assumptions in applying accounting policies could adversely affect us.

Our accounting policies and methods are fundamental to how we record and report our financial condition and results of operations. Some of these policies require use of estimates and assumptions that may affect the reported value of our assets or liabilities and results of operations and are critical because they require management to make difficult, subjective and complex judgments about matters that are inherently uncertain. If those assumptions, estimates or judgments were incorrectly made, we may be required to correct and restate prior-period financial statements. Accounting standard-setters and those who interpret the accounting standards, the SEC, banking regulators and our independent registered public accounting firm may also amend or even reverse their previous interpretations or positions on how various standards should be applied. These changes may be difficult to predict and could impact how we prepare and report our financial statements. In some cases, we may be required to apply a new or revised standard retrospectively, resulting in us revising prior-period financial statements.

​

Financial Reporting Risks

Failure to maintain an effective system of disclosure controls and procedures could have a material adverse effect on our business, results of operations and financial condition and could impact the price of our common stock.

Failure to maintain an effective internal control environment could result in us not being able to accurately report our financial results, prevent or detect fraud, or provide timely and reliable financial information pursuant to our reporting obligations, which could have a material adverse effect on our business, financial condition, and results of operations. Further, it could cause our investors to lose confidence in the financial information we report, which could affect the trading price of our common stock.

Management regularly reviews and updates our disclosure controls and procedures, including our internal control over financial reporting. Management regularly reviews and updates our disclosure controls and procedures, including our internal control over financial reporting. Any system of controls, however well designed and operated, is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met. Any failure or circumvention of our controls and procedures or failure to comply with regulations related to controls and procedures could have a material adverse effect on our business, results of operations and financial condition.

During the year end December 31, 2023, management identified material weaknessess in its internal controls over financial reporting related to (i) properly assessing the accounting treatment for certain loan transfer transactions, (ii) properly assessing the accounting treatment for an agreement with a third-party to originate and manage a portfolio of consumer loans, and (iii) a process to evaluate expected credit losses on its third-party originated and managed consumer loan portfolio. Management also identified a material weakness in its internal controls over financial reporting related to (ii) above during the year ended December 31, 2022. Management is currently remediating the material weaknesses including design of and testing new controls related to the accounting and disclosure for these items. If management fails to timely and effectively remediate the deficiency in its control environment for these accounting issues it could result in additional incorrect accounting application to similar transactions in the future which may have a material adverse effect on our financial condition.

​

Item 1B. Unresolved Staff Comments

Primis Financial Corp. does not have any unresolved staff comments from the SEC to report for the year ended December 31, 2023.

​

Item 1C. Cybersecurity

Cybersecurity Risk Management and Strategy

​

The Bank’s information security program is designed to protect sensitive information from unauthorized access, use, disclosure, alteration, or destruction, and to maintain the confidentiality, integrity, and availability of our information assets, including employee and customer non-public information, financial data, and internal operational information. Our Chief Information Officer (“CIO”) manages our information security strategy and development as overseen by our overarching Enterprise Risk Management (“ERM”) program. On January 16, 2024, G. Cody Sheflett, Jr., CIO of the Company, passed away. The Company has actively engaged a recruiting firm to fill the CIO vacancy, but has not formally appointed a new CIO. During such vacancy, the Company has appointed an interim CIO and unless otherwise noted, references to the CIO and his duties refer to Mr. Sheflett’s historical role and the interim CIO’s role, and the duties and obligations the Company anticipates the next CIO to abide by. The Company’s interim CIO has worked in the financial services industry for over 20 years and held similar roles at other financial institutions including four years as a Chief Information Officer and five years as a Chief Technology Officer.

​

The Bank’s cybersecurity program, including our information security policies, is designed to align with regulatory guidance and industry practices. To protect our information systems, network, and information assets from cybersecurity threats, we use various security tools, products, and processes that help identify, prevent, investigate, and remediate cybersecurity threats and security incidents.

​

The Bank’s Network Team monitors threat intelligence sources to research evolving threats, investigates the potential impact to financial services companies, examines company controls to detect and defend against those threats, and proactively adjusts company defenses against those threats. The Network Team also actively monitors company networks and systems to detect suspicious or malicious events, and contracts with third-party consultants to perform penetration testing and routine vulnerability scans. A managed security service provider supplements our efforts to provide 24 hours a day, seven days a week coverage.

​

We maintain policies and procedures for the safe storage, handling, and secure disposal of customer information. Each employee is expected to be responsible for the security and confidentiality of customer information, and we communicate this responsibility to employees upon hiring and regularly throughout their employment. Annually, we provide employees with mandatory security awareness training. The curriculum includes the recognition and appropriate handling of potential phishing emails, which could place sensitive customer or employee information at risk. The Company employs a number of technical controls to mitigate the risk of phishing emails targeting employees. We test employees monthly to determine their susceptibility to phishing test emails, and we require susceptible employees to take additional training and provide regular reports to management.

​

As part of our information security program, we have adopted a Cyber Incident Response Plan (“Incident Response Plan”) which is administered by our CIO who closely coordinates with the Bank’s Information Technology team. The Incident Response Plan describes the Bank’s processes, procedures, and responsibilities for responding to cybersecurity incidents, and identifies those team members responsible for assessing potential security incidents, declaring an incident, and initiating a response. The Incident Response Plan outlines action steps for investigating, containing, and remediating a cybersecurity incident, and includes procedures for escalation and reporting of potentially significant cybersecurity incidents to the Bank’s Senior Leadership Team, including the Chief Executive Officer (“CEO”), Chief Financial Officer (“CFO”), Chief Risk Officer (“CRO”), and the Board of Directors. As necessary, the Company may retain a third-party firm to assist with forensic investigation and management of cybersecurity incidents.

​

The Bank conducts due diligence prior to engaging third-party service providers which have access to the Bank’s networks, systems, and/or customer or employee data. Risk assessments are performed using Service Organization Controls (SOC) reports, self-attestation questionnaires, and other tools. Third-party service providers are required to comply with the Bank’s policies regarding non-public personal information and information security. Third parties processing non-public personal information are contractually required to meet all legal and regulatory obligations to protect customer data against security threats or unauthorized access. After contract execution, Primis requires critical and high-risk providers to have an ongoing monitoring plan.

​

While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive, and cybersecurity risk has increased in recent years. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, result of operations or financial condition. See “Item 1A. Risk Factors – Operational Risks” of this report for additional information.

​

Cybersecurity Governance

​

Our Board of Directors is responsible for overseeing the Bank’s business and affairs, including risks associated with cybersecurity threats. The ERM Committee (“ERMC”) of the Board has primary responsibility for overseeing the Bank’s comprehensive ERM program, including its cybersecurity program. The ERM program assists senior leadership team in

identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. Cybersecurity matters and assessments are regularly included in both Audit Committee (“AC”) and ERMC meetings.

​

The Board’s oversight of cybersecurity risk is supported by our CIO. The CIO attends ERMC meetings and provides cybersecurity updates to these Board committees on a quarterly basis. Our CRO, in conjunction with our CIO, facilitates the involvement of the ERMC in oversight of potentially significant cybersecurity incidents. The Executive Vice President and Chief Financial Officer and the Network Manager have been attending the ERMC meetings in the CIO’s absence.

​

The Bank’s CIO directs the Bank’s information security program and our information technology risk management. In this role, in addition to the responsibilities discussed above, the CIO manages the Bank’s information security and day-to-day cybersecurity operations and supports the information security risk oversight responsibilities of the Board and its committees. The CIO is also responsible for the Bank’s information technology governance, risk, and compliance program and ensures that high level risks receive appropriate attention. Led by our CIO, the Network Team examines risks to the Bank’s information systems and assets, designs and implements security solutions, monitors the environment, and provides responses to threats. Our CRO has over three decades of experience in risk management, and our Network Team collectively has over 19 years of experience in cybersecurity operations.

​