ITEM 1 – BUSINESS

American National Bankshares Inc. is a one-bank holding company organized under the laws of the Commonwealth of Virginia in 1984. On September 1, 1984, the Company acquired all of the outstanding capital stock of American National Bank and Trust Company, a national banking association chartered in 1909 under the laws of the United States. American National Bank and Trust Company is the only banking subsidiary of the Company.

As of December 31, 2021, the operations of the Company were conducted at 26 banking offices in south central Virginia and north central North Carolina and one loan production office in Roanoke, Virginia. Through these offices, the Company serves its primary market area of south central Virginia and north central North Carolina. The Bank provides a full array of financial products and services, including commercial, mortgage, and consumer banking; trust and investment services; and insurance. Services are also provided through 37 Automated Teller Machines ("ATMs"), "Online Banking," and "Telephone Banking."

On April 1, 2019, the Company completed the acquisition of Roanoke-based HomeTown Bankshares Corporation ("HomeTown"). The acquisition of HomeTown deepened the Company's footprint in the Roanoke, Virginia metropolitan area and created a presence in the New River Valley with an office in Christiansburg, Virginia.

The Company has two reportable segments, (i) community banking and (ii) wealth management. For more financial data and other information about each of the Company's operating segments, refer to "Note 21 - Segment and Related Information" of the Consolidated Financial Statements contained in Item 8 of this Form 10-K.

Competition and Markets

Vigorous competition exists in the Company's service areas. The Company competes not only with national, regional, and community banks, but also with other types of financial institutions including finance companies, mutual and money market fund providers, financial technology companies, brokerage firms, wealth management firms, insurance companies, credit unions, and mortgage companies.

The Company's primary market area is south central Virginia and north central North Carolina. The Company also has a significant presence in Roanoke, Virginia that increased substantially in connection with the acquisition of HomeTown. The Company's Virginia banking offices are located in the cities of Danville, Lynchburg, Martinsville, Roanoke, and Salem and in the counties of Campbell, Franklin, Halifax, Henry, Montgomery, Pittsylvania and Roanoke. In North Carolina, the Company's banking offices are located in the cities of Burlington, Graham, Greensboro, Mebane, Raleigh, Winston-Salem, and Yanceyville, which are within the counties of Alamance, Caswell, Forsyth, Guilford, and Wake. 

The Company has the largest deposit market share in the City of Danville, Virginia. The Company had a deposit market share in the Danville Micropolitan Statistical Area of 38.32% at June 30, 2021 based on Federal Deposit Insurance Corporation ("FDIC") data. The Company has the second largest deposit market share in Pittsylvania County, Virginia. The Company had a deposit market share in the County of 26.23% at June 30, 2021, based on FDIC data.

Unemployment levels in each Virginia market the Company serves have continued to improve from their COVID-19 related highs in early to mid-2020. Service sectors, financials, medical, manufacturing, construction, timber management and production, and technology related businesses have remained strong while hospitality, restaurants, travel & tourism, meeting spaces, and fitness facilities continue to suffer from the COVID-19 restrictions. Other important business industries include farming, tobacco processing and sales, and food processing. New businesses continue to move into the Company's Virginia footprint, which has been positive for economic growth.

The Company's market area in North Carolina has strong competition in attracting deposits and making loans. Its most direct competition for deposits comes from commercial banks and credit unions located in the market area, including large financial institutions that have greater financial and marketing resources available to them. The Company had a deposit market share in Alamance County of 14.35% at June 30, 2021, based on FDIC data, which was the third largest of any FDIC-insured institution.

Supervision and Regulation

The Company and the Bank are extensively regulated under federal and state law. The following description briefly addresses certain provisions of federal and state laws and regulations, and their potential effects on the Company and the Bank. Proposals to change the laws, regulations, and policies governing the banking industry are frequently raised in U.S. Congress, in state legislatures, and before the various bank regulatory agencies. The likelihood and timing of any changes and the impact such changes might have on the Company and the Bank are impossible to determine with any certainty. A change in applicable laws, regulations or policies, or a change in the way such laws, regulations or policies are interpreted by regulatory agencies or courts, may have a material impact on the business, operations, and earnings of the Company and the Bank.

American National Bankshares Inc.

American National Bankshares Inc. is qualified as a bank holding company ("BHC") within the meaning of the Bank Holding Company Act of 1956, as amended (the "BHC Act"), and is registered as such with the Board of Governors of the Federal Reserve System (the "FRB"). As a bank holding company, the Company is subject to supervision, regulation and examination by the FRB and is required to file various reports and additional information with the FRB. The Company is also registered under the bank holding company laws of Virginia and is subject to supervision, regulation and examination by the Bureau of Financial Institutions of the Virginia State Corporation Commission (the "SCC").

American National Bank and Trust Company

American National Bank and Trust Company is a federally chartered national bank and is a member of the Federal Reserve System. As a national bank, the Bank is subject to supervision, regulation and examination by the Office of the Comptroller of the Currency (the "OCC") and is required to file various reports and additional information with the OCC. The OCC has primary supervisory and regulatory authority over the operations of the Bank. Because the Bank accepts insured deposits from the public, it is also subject to examination by the FDIC.

Depository institutions, including the Bank, are subject to extensive federal and state regulations that significantly affect their business and activities. Regulatory bodies have broad authority to implement standards and initiate proceedings designed to prohibit depository institutions from engaging in unsafe and unsound banking practices. The standards relate generally to operations and management, asset quality, interest rate exposure, and capital. The bank regulatory agencies are authorized to take action against institutions that fail to meet such standards.

As with other financial institutions, the earnings of the Bank are affected by general economic conditions and by the monetary policies of the FRB. The FRB exerts a substantial influence on interest rates and credit conditions, primarily through open market operations in U.S. Government securities, setting the reserve requirements of member banks, and establishing the discount rate on member bank borrowings. The policies of the FRB have a direct impact on loan and deposit growth and the interest rates charged and paid thereon. They also impact the source, cost of funds, and the rates of return on investments. Changes in the FRB's monetary policies have had a significant impact on the operating results of the Bank and other financial institutions and are expected to continue to do so in the future; however, the exact impact of such conditions and policies upon the future business and earnings cannot accurately be predicted.

Deposit Insurance

The deposits of the Bank are insured up to applicable limits by the DIF and are subject to deposit insurance assessments to maintain the DIF. The deposit insurance assessment base of the Bank is based on its average total assets minus average tangible equity, pursuant to a rule issued by the FDIC as required by the Dodd-Frank Wall Street Reform and Consumer Protection Act (the "Dodd-Frank Act"). The FDIC uses a "financial ratios method" based on CAMELS composite ratings to determine assessment rates for small established institutions with less than $10 billion in assets, such as the Bank. The CAMELS rating system is a supervisory rating system designed to take into account and reflect all financial and operational risks that a bank may face, including capital adequacy, asset quality, management capability, earnings, liquidity and sensitivity to market risk ("CAMELS"). CAMELS composite ratings set a maximum assessment for CAMELS 1 and 2 rated banks, and set minimum assessments for lower rated institutions.

 In March 2016, the FDIC implemented by final rule certain Dodd-Frank Act provisions by raising the DIF's minimum reserve ratio from 1.15% to 1.35%. The FDIC imposed a 4.5 basis point annual surcharge on insured depository institutions with total consolidated assets of $10 billion or more. The rule granted credits to smaller banks, such as the Bank, for the portion of their regular assessments that contributed to increasing the reserve ratio from 1.15% to 1.35%. In 2021 and 2020, the Company recorded expense of $864,000 and $639,000, respectively, for FDIC insurance premiums.

Capital Requirements 

The FRB, the OCC and the FDIC have issued substantially similar capital guidelines applicable to all banks and bank holding companies. In addition, those regulatory agencies may from time to time require that a banking organization maintain capital above the minimum levels because of its financial condition or actual or anticipated growth.

Effective January 1, 2015, the Company and the Bank became subject to rules implementing the Basel III regulatory capital reforms from the Basel Committee on Banking Supervision (the "Basel Committee") and certain provisions of the Dodd-Frank Act (the "Basel III Capital Rules"). The Basel III Capital Rules require the Company and the Bank to comply with the following minimum capital ratios: (i) a ratio of common equity Tier 1 to risk-weighted assets ("CET1") of at least 4.5%, plus a 2.5% "capital conservation buffer" (effectively resulting in a minimum CET1 ratio of at least 7%), (ii) a ratio of Tier 1 capital to risk-weighted assets of at least 6.0%, plus the 2.5% capital conservation buffer (effectively resulting in a minimum Tier 1 capital ratio of 8.5%), (iii) a ratio of total capital to risk-weighted assets of at least 8.0%, plus the 2.5% capital conservation buffer (effectively resulting in a minimum total capital ratio of 10.5%), and (iv) a leverage ratio of 4%, calculated as the ratio of Tier 1 capital to average assets. The capital conservation buffer, which was phased in ratably over a four year period beginning January 1, 2016, is designed to absorb losses during periods of economic stress. Institutions with a CET1 ratio above the minimum (4.5%) but below the minimum plus the conservation buffer (7.0%) will face constraints on dividends, equity repurchases, and discretionary compensation paid to certain officers, based on the amount of the shortfall. 

With respect to the Bank, the "prompt corrective action" regulations pursuant to Section 38 of the Federal Deposit Insurance Act (the "FDIA") were also revised, effective as of January 1, 2015, to incorporate a CET1 ratio and to increase certain other capital ratios. To be well capitalized under the revised regulations, a bank must have the following minimum capital ratios: (i) a CET1 ratio of at least 6.5%; (ii) a Tier 1 capital to risk-weighted assets ratio of at least 8.0%; (iii) a total capital to risk-weighted assets ratio of at least 10.0%; and (iv) a leverage ratio of at least 5.0%. See "Prompt Corrective Action" below.

The Tier 1 and total capital to risk-weighted asset ratios of the Company were 13.73% and 14.61%, respectively, as of December 31, 2021, thus exceeding the minimum requirements. The CET 1 ratio of the Company was 12.43% and the Bank was 13.15% as of December 31, 2021. The Tier 1 and total capital to risk-weighted asset ratios of the Bank were 13.15% and 14.03%, respectively, as of December 31, 2021, also exceeding the minimum requirements.

The Basel III Capital Rules provide for a number of deductions from and adjustments to CET1. In July 2019, the federal banking agencies adopted final rules (the "Capital Simplification Rules") that, among other things, revised these deductions and adjustments. Following the adoption of the Capital Simplification Rules, certain deferred tax assets and significant investments in non-consolidated financial entities must be deducted from CET1 to the extent that any one such category exceeds 25% of CET1. Prior to the adoption of the Capital Simplification Rules, amounts were deducted from CET1 to the extent that any one such category exceeded 10% of CET1 or all such items, in the aggregate, exceeded 15% of CET1. The Capital Simplification Rules took effect for the Company as of January 1, 2020. These limitations did not impact regulatory capital during any of the reported periods.

The Basel III Capital Rules prescribe a standardized approach for risk weightings that expanded the risk-weighting categories from the general risk-based capital rules to a much larger and more risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. government and agency securities, to 600% for certain equity exposures (and higher percentages for certain other types of interests), and resulting in higher risk weights for a variety of asset categories. In November 2019, the federal banking agencies adopted a rule revising the scope of commercial real estate mortgages subject to a 150% risk weight.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms (the standards are commonly referred to as "Basel IV"). Among other things, these standards revise the Basel Committee's standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain "unconditionally cancellable commitments," such as unused credit card lines of credit) and provide a new standardized approach for operational risk capital. Under the current capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not to the Company. The impact of Basel IV on the Company and the Bank will depend on the manner in which it is implemented by the federal bank regulatory agencies.

On September 17, 2019, the federal banking agencies jointly issued a final rule required by the Economic Growth, Regulatory Relief and Consumer Protection Act of 2018 (the "EGRRCPA") that permits qualifying banks and bank holding companies that have less than $10 billion in consolidated assets to elect to be subject to a 9% leverage ratio (commonly referred to as the community bank leverage ratio or "CBLR"). Under the final rule, banks and bank holding companies that opt into the CBLR framework and maintain a CBLR of greater than 9% are not subject to other risk-based and leverage capital requirements under the Basel III Capital Rules and are deemed to have met the well capitalized ratio requirements under the "prompt corrective action" framework. In addition, a community bank that falls out of compliance with the framework has a two-quarter grace period to come back into full compliance, provided its leverage ratio remains above 8%, and will be deemed well-capitalized during the grace period. The CBLR framework was first available for banking organizations to use in their March 31, 2020 regulatory reports. These CBLR rules were modified in response to the COVID-19 pandemic. See "Coronavirus Aid, Relief, and Economic Security Act and Consolidated Appropriations Act, 2021" below. The Company and the Bank do not currently expect to opt into the CBLR framework.

Dividends

The Company's principal source of cash flow, including cash flow to pay dividends to its shareholders, is dividends it receives from the Bank. Statutory and regulatory limitations apply to the Bank's payment of dividends to the Company. As a general rule, the amount of a dividend may not exceed, without prior regulatory approval, the sum of net income in the calendar year to date and the retained net earnings of the immediately preceding two calendar years. A depository institution may not pay any dividend if payment would cause the institution to become "undercapitalized" or if it already is "undercapitalized." The OCC may prevent the payment of a dividend if it determines that the payment would be an unsafe and unsound banking practice. The OCC also has advised that a national bank should generally pay dividends only out of current operating earnings.

Permitted Activities

As a bank holding company, the permitted activities of the Company are limited to managing or controlling banks, furnishing services to or performing services for its subsidiaries, and engaging in other activities that the FRB determines by regulation or order to be so closely related to banking or managing or controlling banks as to be a proper incident thereto. In determining whether a particular activity is permissible, the FRB must consider whether the performance of such an activity reasonably can be expected to produce benefits to the public that outweigh possible adverse effects. Possible benefits include greater convenience, increased competition, and gains in efficiency. Possible adverse effects include undue concentration of resources, decreased or unfair competition, conflicts of interest, and unsound banking practices. Despite prior approval, the FRB may order a bank holding company or its subsidiaries to terminate any activity or to terminate ownership or control of any subsidiary when the FRB has reasonable cause to believe that a serious risk to the financial safety, soundness or stability of any bank subsidiary of that bank holding company may result from such an activity.

Banking Acquisitions; Changes in Control

The BHC Act and related regulations require, among other things, the prior approval of the FRB in any case where a bank holding company proposes to (i) acquire direct or indirect ownership or control of more than 5% of the outstanding voting stock of any bank or bank holding company (unless it already owns a majority of such voting shares), (ii) acquire all or substantially all of the assets of another bank or bank holding company, or (iii) merge or consolidate with any other bank holding company. In determining whether to approve a proposed bank acquisition, the FRB will consider, among other factors, the effect of the acquisition on competition, the public benefits expected to be received from the acquisition, any outstanding regulatory compliance issues of any institution that is a party to the transaction, the projected capital ratios and levels on a post-acquisition basis, the financial condition of each institution that is a party to the transaction and of the combined institution after the transaction, the parties' managerial resources and risk management and governance processes and systems, the parties' compliance with the Bank Secrecy Act and anti-money laundering requirements, and the acquiring institution's performance under the Community Reinvestment Act of 1977, as amended (the "CRA"), and compliance with fair housing and other consumer protection laws.

Subject to certain exceptions, the BHC Act and the Change in Bank Control Act, together with the applicable regulations, require FRB approval (or, depending on the circumstances, no notice of disapproval) prior to any person or company acquiring "control" of a bank or bank holding company. A conclusive presumption of control exists if an individual or company acquires the power, directly or indirectly, to direct the management or policies of an insured depository institution or to vote 25% or more of any class of voting securities of any insured depository institution. A rebuttable presumption of control exists if a person or company acquires 10% or more but less than 25% of any class of voting securities of an insured depository institution and either the institution has registered its securities with the Securities and Exchange Commission (the "SEC") under Section 12 of the Securities Exchange Act of 1934 (the "Exchange Act") or no other person will own a greater percentage of that class of voting securities immediately after the acquisition. The Company's common stock is registered under Section 12 of the Exchange Act.

In addition, Virginia law requires the prior approval of the SCC for (i) the acquisition by a Virginia bank holding company of more than 5% of the voting shares of a Virginia bank or any holding company that controls a Virginia bank, or (ii) the acquisition by a Virginia bank holding company of a bank or its holding company domiciled outside Virginia.

Source of Strength

FRB policy has historically required bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. The Dodd-Frank Act codified this policy as a statutory requirement. Under this requirement, the Company is expected to commit resources to support the Bank, including at times when the Company may not be in a financial position to provide such resources. Any capital loans by a bank holding company to any of its subsidiary banks are subordinate in right of payment to depositors and to certain other indebtedness of such subsidiary banks. In the event of a bank holding company's bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Safety and Soundness

There are a number of obligations and restrictions imposed on bank holding companies and their subsidiary banks by law and regulatory policy that are designed to minimize potential loss to the depositors of such depository institutions and the FDIC insurance fund in the event of a depository institution insolvency, receivership or default. For example, under the Federal Deposit Insurance Corporation Improvement Act of 1991, to avoid receivership of an insured depository institution subsidiary, a bank holding company is required to guarantee the compliance of any subsidiary bank that may become "undercapitalized" with the terms of any capital restoration plan filed by such subsidiary with its appropriate federal bank regulatory agency up to the lesser of (i) an amount equal to 5% of the institution's total assets at the time the institution became undercapitalized or (ii) the amount that is necessary (or would have been necessary) to bring the institution into compliance with all applicable capital standards as of the time the institution fails to comply with such capital restoration plan.

Under the FDIA, the federal bank regulatory agencies have adopted guidelines prescribing safety and soundness standards. These guidelines establish general standards relating to capital management, internal controls and information systems, internal audit systems, data security, loan documentation, credit underwriting, interest rate exposure, risk management, vendor management, corporate governance, asset growth, and compensation, fees and benefits. In general, the guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines.

Prompt Corrective Action

The federal bank regulatory agencies possess broad powers to take prompt corrective action to resolve problems of insured depository institutions. The extent of these powers depends upon whether the institution is "well capitalized," "adequately capitalized," "undercapitalized," "significantly undercapitalized," or "critically undercapitalized," as defined by the law. "Well capitalized" institutions may generally operate without additional supervisory restriction. With respect to "adequately capitalized" institutions, such banks cannot normally pay dividends or make any capital contributions that would leave the bank undercapitalized; they cannot pay a management fee to a controlling person if after paying the fee, it would be undercapitalized; and they cannot accept, renew, or rollover any brokered deposit unless the bank has applied for and been granted a waiver by the FDIC.

Immediately upon becoming "undercapitalized," a depository institution becomes subject to the provisions of Section 38 of the FDIA, which: (i) restrict payment of capital distributions and management fees; (ii) require that the appropriate federal banking agency monitor the condition of the institution and its efforts to restore its capital; (iii) require submission of a capital restoration plan; (iv) restrict the growth of the institution’s assets; and (v) require prior approval of certain expansion proposals. The appropriate federal banking agency for an undercapitalized institution also may take any number of discretionary supervisory actions if the agency determines that any of these actions is necessary to resolve the problems of the institution at the least possible long-term cost to the DIF, subject in certain cases to specified procedures. These discretionary supervisory actions include: (i) requiring the institution to raise additional capital; (ii) restricting transactions with affiliates; (iii) requiring divestiture of the institution or the sale of the institution to a willing purchaser; and (iv) any other supervisory action that the agency deems appropriate. These and additional mandatory and permissive supervisory actions may be taken with respect to significantly undercapitalized and critically undercapitalized institutions. Management believes, as of December 31, 2021 and 2020, the Bank met the requirements for being classified as "well capitalized."

Transactions with Affiliates

Pursuant to Sections 23A and 23B of the Federal Reserve Act and Regulation W, the authority of the Bank to engage in transactions with related parties or "affiliates" or to make loans to insiders is limited. Loan transactions with an affiliate generally must be collateralized and certain transactions between the Bank and its affiliates, including the sale of assets, the payment of money, or the provision of services, must be on terms and conditions that are substantially the same, or at least as favorable to the Bank, as those prevailing for comparable nonaffiliated transactions. In addition, the Bank generally may not purchase securities issued or underwritten by affiliates.

Loans to executive officers, directors or to any person who directly or indirectly, or acting through or in concert with one or more persons, owns, controls or has the power to vote more than 10% of any class of voting securities of a bank, are subject to Sections 22(g) and 22(h) of the Federal Reserve Act and their corresponding regulations (Regulation O) and Section 13(k) of the Exchange Act relating to the prohibition on personal loans to executives (which exempts financial institutions in compliance with the insider lending restrictions of Section 22(h) of the Federal Reserve Act). Among other things, these loans must be made on terms substantially the same as those prevailing on transactions made to unaffiliated individuals and certain extensions of credit to those persons must first be approved in advance by a disinterested majority of the entire board of directors. Section 22(h) of the Federal Reserve Act prohibits loans to any of those individuals where the aggregate amount exceeds an amount equal to 15% of an institution's unimpaired capital and surplus plus an additional 10% of unimpaired capital and surplus in the case of loans that are fully secured by readily marketable collateral, or when the aggregate amount on all of the extensions of credit outstanding to all of these persons would exceed the Bank's unimpaired capital and unimpaired surplus. Section 22(g) of the Federal Reserve Act identifies limited circumstances in which the Bank is permitted to extend credit to executive officers.

Consumer Financial Protection

The Company is subject to a number of federal and state consumer protection laws that extensively govern its relationship with its customers. These laws include the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Truth in Lending Act, the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Home Mortgage Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Fair Debt Collection Practices Act, the Service Members Civil Relief Act, laws governing flood insurance, federal and state laws prohibiting unfair and deceptive business practices, foreclosure laws, and various regulations that implement some or all of the foregoing. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must deal with customers when taking deposits, making loans, collecting loans and providing other services. If the Company fails to comply with these laws and regulations, it may be subject to various penalties. Failure to comply with consumer protection requirements may also result in failure to obtain any required bank regulatory approval for merger or acquisition transactions the Company may wish to pursue or being prohibited from engaging in such transactions even if approval is not required.

The Dodd-Frank Act centralized responsibility for consumer financial protection by creating a new agency, the Consumer Financial Protection Bureau (the "CFPB"), and giving it responsibility for implementing, examining, and enforcing compliance with federal consumer protection laws. The CFPB focuses on (i) risks to consumers and compliance with the federal consumer financial laws, (ii) the markets in which firms operate and risks to consumers posed by activities in those markets, (iii) depository institutions that offer a wide variety of consumer financial products and services, and (iv) non-depository companies that offer one or more consumer financial products or services.

The CFPB has broad rulemaking authority for a wide range of consumer financial laws that apply to all banks, including, among other things, the authority to prohibit "unfair, deceptive or abusive" acts and practices. Abusive acts or practices are defined as those that materially interfere with a consumer's ability to understand a term or condition of a consumer financial product or service or take unreasonable advantage of a consumer's (i) lack of financial savvy, (ii) inability to protect himself in the selection or use of consumer financial products or services, or (iii) reasonable reliance on a covered entity to act in the consumer's interests. The CFPB can issue cease-and-desist orders against banks and other entities that violate consumer financial laws. The CFPB may also institute a civil action against an entity in violation of federal consumer financial law in order to impose a civil penalty or injunction. Further regulatory positions taken by the CFPB may influence how other regulatory agencies may apply the subject consumer financial protection laws and regulations.

Community Reinvestment Act

The CRA requires the appropriate federal banking agency, in connection with its examination of a bank, to assess the bank's record in meeting the credit needs of the communities served by the bank, including low and moderate income neighborhoods. Furthermore, such assessment is also required of banks that have applied, among other things, to merge or consolidate with or acquire the assets or assume the liabilities of an insured depository institution, or to open or relocate a branch. In the case of a BHC applying for approval to acquire a bank or BHC, the record of each subsidiary bank of the applicant BHC is subject to assessment in considering the application. Under the CRA, institutions are assigned a rating of "outstanding," "satisfactory," "needs to improve," or "substantial non-compliance." The Bank was rated "satisfactory" in its most recent CRA evaluation.
 

Anti-Money Laundering Legislation

The Company is subject to several federal laws that are designed to combat money laundering, terrorist financing, and transactions with persons, companies or foreign governments designated by U.S. authorities ("AML laws"). This category of laws includes the Bank Secrecy Act of 1970, the Money Laundering Control Act of 1986, the USA PATRIOT Act of 2001, and the Anti-Money Laundering Act of 2020.

The AML laws and their implementing regulations require insured depository institutions, broker-dealers, and certain other financial institutions to have policies, procedures, and controls to detect, prevent, and report money laundering and terrorist financing. The AML laws and their regulations also provide for information sharing, subject to conditions, between federal law enforcement agencies and financial institutions, as well as among financial institutions, for counter-terrorism purposes. Federal banking regulators are required, when reviewing bank holding company acquisition and bank merger applications, to take into account the effectiveness of the anti-money laundering activities of the applicants. To comply with these obligations, the Company has implemented appropriate internal practices, procedures, and controls.

Office of Foreign Assets Control

The U.S. Treasury Department's Office of Foreign Assets Control ("OFAC") is responsible for administering and enforcing economic and trade sanctions against specified foreign parties, including countries and regimes, foreign individuals and other foreign organizations and entities. OFAC publishes lists of prohibited parties that are regularly consulted by the Company in the conduct of its business in order to assure compliance. The Company is responsible for, among other things, blocking accounts of, and transactions with, prohibited parties identified by OFAC, avoiding unlicensed trade and financial transactions with such parties and reporting blocked transactions after their occurrence. Failure to comply with OFAC requirements could have serious legal, financial and reputational consequences for the Company.

Privacy Legislation

Several recent laws, including the Right to Financial Privacy Act, and related regulations issued by the federal bank regulatory agencies, also provide new protections against the transfer and use of customer information by financial institutions. A financial institution must provide to its customers information regarding its policies and procedures with respect to the handling of customers' personal information. Each institution must conduct an internal risk assessment of its ability to protect customer information. These privacy provisions generally prohibit a financial institution from providing a customer's personal financial information to unaffiliated parties without prior notice and approval from the customer.

Incentive Compensation

In June 2010, the federal bank regulatory agencies issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of financial institutions do not undermine the safety and soundness of such institutions by encouraging excessive risk-taking. The Interagency Guidance on Sound Incentive Compensation Policies, which covers all employees that have the ability to materially affect the risk profile of a financial institutions, either individually or as part of a group, is based upon the key principles that a financial institution's incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the institution's ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the financial institution's board of directors.

Section 956 of the Dodd-Frank Act requires the federal banking agencies and the SEC to establish joint regulations or guidelines prohibiting incentive-based payment arrangements at specified regulated entities that encourage inappropriate risk-taking by providing an executive officer, employee, director or principal shareholder with excessive compensation, fees, or benefits or that could lead to material financial loss to the entity. The federal banking agencies issued such proposed rules in March 2011 and issued a revised proposed rule in June 2016 implementing the requirements and prohibitions set forth in Section 956. The revised proposed rule would apply to all banks, among other institutions, with at least $1 billion in average total consolidated assets, like the Bank, for which it would go beyond the existing Interagency Guidance on Sound Incentive Compensation Policies to (i) prohibit certain types and features of incentive-based compensation arrangements for senior executive officers, (ii) require incentive-based compensation arrangements to adhere to certain basic principles to avoid a presumption of encouraging inappropriate risk, (iii) require appropriate board or committee oversight, (iv) establish minimum recordkeeping, and (v) mandate disclosures to the appropriate federal banking agency. The proposed rules have not yet been finalized.

The FRB will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of financial institutions, such as the Company, that are not "large, complex banking organizations." These reviews will be tailored to each financial institution based on the scope and complexity of the institution's activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the institution's supervisory ratings, which can affect the institution's ability to make acquisitions and take other actions. Enforcement actions may be taken against a financial institution if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the institution's safety and soundness and the financial institution is not taking prompt and effective measures to correct the deficiencies. At December 31, 2021, the Company had not been made aware of any instances of non-compliance with the final guidance.
 

Mortgage Banking Regulation

In connection with making mortgage loans, the Bank is subject to rules and regulations that, among other things, establish standards for loan origination, prohibit discrimination, provide for inspections and appraisals of property, require credit reports on prospective borrowers, in some cases restrict certain loan features and fix maximum interest rates and fees, require the disclosure of certain basic information to mortgagors concerning credit and settlement costs, limit payment for settlement services to the reasonable value of the services rendered and require the maintenance and disclosure of information regarding the disposition of mortgage applications based on race, gender, geographical distribution and income level. The Bank is also subject to rules and regulations that require the collection and reporting of significant amounts of information with respect to mortgage loans and borrowers. The Bank’s mortgage origination activities are subject to the FRB’s Regulation Z, which implements the Truth in Lending Act. Certain provisions of Regulation Z require creditors to make a reasonable and good faith determination based on verified and documented information that a consumer applying for a mortgage loan has a reasonable ability to repay the loan according to its terms.

Cybersecurity

In March 2015, federal regulators issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. The other statement indicates that a financial institution's management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution's operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack. If the Company fails to observe the regulatory guidance, it could be subject to various regulatory sanctions, including financial penalties.

On November 18, 2021, the federal bank regulatory agencies issued a final rule, effective April 1, 2022, imposing new notification requirements for cybersecurity incidents. The rule requires financial institutions to notify their primary federal regulator as soon as possible and no later than 36 hours after the institution determines that a cybersecurity incident has occurred that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the institution’s: (i) ability to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base, in the ordinary course of business, (ii) business line(s), including associated operations, services, functions, and support, that upon failure would result in a material loss of revenue, profit, or franchise value, or (iii) operations, including associated services, functions and support, as applicable, the failure or discontinuance of which would pose a threat to the financial stability of the United States.

To date, the Company has not experienced a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, but its systems and those of its customers and third-party service providers are under constant threat and it is possible that the Company could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by the Company and its customers.

Coronavirus Aid, Relief, and Economic Security Act and Consolidated Appropriations Act, 2021

In response to the COVID-19 pandemic, the Coronavirus Aid, Relief, and Economic Security Act ("CARES Act") was signed into law on March 27, 2020 and the Consolidated Appropriations Act, 2021 ("Appropriations Act") was signed into law on December 27, 2020. Among other things, the CARES Act and Appropriations Act include the following provisions impacting financial institutions:

Future Legislation and Regulation

Congress may enact legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of the proposed legislation could affect the regulatory structure under which the Company and the Bank operate and may significantly increase costs, impede the efficiency of internal business processes, require an increase in regulatory capital, require modifications to business strategy, and limit the ability to pursue business opportunities in an efficient manner. A change in statutes, regulations or regulatory policies applicable to the Company or the Bank could have a material adverse effect on the business, financial condition and results of operations of the Company and the Bank.

Effect of Governmental Monetary Policies

The Company's operations are affected not only by general economic conditions, but also by the policies of various regulatory authorities. In particular, the FRB regulates money and credit conditions and interest rates to influence general economic conditions. These policies have a significant impact on overall growth and distribution of loans, investments and deposits; they affect interest rates charged on loans or paid for time and savings deposits. FRB monetary policies have had a significant effect on the operating results of commercial banks, including the Company, in the past and are expected to do so in the future. As a result, it is difficult for the Company to predict the potential effects of possible changes in monetary policies upon its future operating results.

Tax Reform

As a result of the enactment of the CARES Act in 2020, the Company recognized a tax benefit for the net operating loss ("NOL") five-year carryback provision for the NOL acquired in the HomeTown merger.

Human Capital Resources

At December 31, 2021, the Company employed 327 full-time persons and 44 part-time persons. In the opinion of the management of the Company, the relationship with employees of the Company and the Bank is good.

As a holding company for a community bank, the Company is a relationship-driven organization. A key aspect of the Company’s business strategy is for its senior officers to have primary contact with current and potential customers. The Company’s growth and development are in large part a result of these personalized relationships with the customer base. The success of the Company also often depends on its ability to hire and retain qualified banking officers. The Company’s senior officers have considerable experience in the banking industry and related financial services and are extremely valuable.

The Company’s senior officer compensation programs are designed to attract, retain and motivate bankers with the ability to generate strong business results and ensure the long-term success of the Company. The compensation committee of the Company’s board of directors has established compensation programs that reflect and support the Company’s strategic and financial performance goals, the primary goal being the creation of long-term value for the shareholders of the Company, while protecting the interests of the depositors of the Bank. In addition to competitive base and incentive compensation, the Company offers competitive benefits including paid vacation and sick leave, a 401(k) plan, health, dental, and vision plans, life and disability coverage, and a wellness plan. The Company has also entered into employment contracts with certain of its senior officers, and purchased key man life insurance policies to mitigate the risk of an unforeseen departure or death of certain of the senior officers.

In addition, the Company’s strategic plan has dedicated objectives and tactics to ensure it recruits, retains, and develops a diverse and talented team, with a specific focus on enhancing diversity, equity, and inclusion.

Internet Access to Company Documents

The Company provides access to its SEC filings through a link on the Investor Relations page of the Company's website at www.amnb.com. Reports available at no cost include the annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and all amendments to those reports as soon as reasonably practicable after the reports are filed electronically with the SEC. The information on the Company's website is not incorporated into this Annual Report on Form 10-K or any other filing the Company makes with the SEC. The SEC maintains an Internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC at www.sec.gov.

CREDIT RISK

The Company's credit standards and its on-going credit assessment processes might not protect it from significant credit losses.

The Company takes credit risk by virtue of making loans and extending loan commitments and letters of credit. The Company manages credit risk through a program of underwriting standards, the review of certain credit decisions and an on-going process of assessment of the quality of the credit already extended. The Company's exposure to credit risk is managed through the use of consistent underwriting standards that emphasize local lending while avoiding highly leveraged transactions as well as excessive industry and other concentrations. The Company's credit administration function employs risk management techniques to help ensure that problem loans are promptly identified. While these procedures are designed to provide the Company with the information needed to implement policy adjustments where necessary and to take appropriate corrective actions, and have proven to be reasonably effective to date, there can be no assurance that such measures will be effective in avoiding future undue credit risk.

LIQUIDITY RISK

The Company may need to raise additional capital in the future to continue to grow, but may be unable to obtain additional capital on favorable terms or at all.

Federal and state banking regulators and safe and sound banking practices require the Company to maintain adequate levels of capital to support its operations. The Company's business strategy calls for it to continue to grow in its existing banking markets (internally and through additional offices) and to expand into new markets as appropriate opportunities arise. Continued growth in the Company's earning assets, which may result from internal expansion and new branch offices, at rates in excess of the rate at which its capital is increased through retained earnings, will reduce the Company's capital ratios. If the Company's capital ratios fell below "well capitalized" levels, the FDIC deposit insurance assessment rate would increase until capital was restored and maintained at a "well capitalized" level. A higher assessment rate would cause an increase in the assessments the Company pays for federal deposit insurance, which would have an adverse effect on the Company's operating results.

Management of the Company believes that its current and projected capital position is sufficient to maintain capital ratios significantly in excess of regulatory requirements for the next several years and allow the Company flexibility in the timing of any possible future efforts to raise additional capital. However, if, in the future, the Company needs to increase its capital to fund additional growth or satisfy regulatory requirements, its ability to raise that additional capital will depend on conditions at that time in the capital markets, economic conditions, the Company's financial performance and condition, and other factors, many of which are outside its control. There is no assurance that the Company will be able to raise additional capital on terms favorable to it or at all. Any future inability to raise additional capital on terms acceptable to the Company may have a material adverse effect on its ability to expand operations, and on its financial condition, results of operations and future prospects.

TECHNOLOGY RISK

The Company's operations may be adversely affected by cybersecurity risks.

The Company relies heavily on communications and information systems to conduct business. Any failure, interruption, or breach in security of these systems could result in failures or disruptions in the Company's internet banking, deposit, loan, and other systems. While the Company has policies and procedures designed to prevent or limit the effect of such failure, interruption, or security breach of the Company's information systems, there can be no assurance that they will not occur or, if they do occur, that they will be adequately addressed. Further, to access the Company's products and services, its customers may use computers and mobile devices that are beyond the Company's security control systems. The occurrence of any failure, interruption or security breach of the Company's communications and information systems could damage the Company's reputation, result in a loss of customer business, subject the Company to additional regulatory scrutiny, or expose the Company to civil litigation and possible financial liability. Additionally, the Company outsources its data processing to a third party. If the Company's third party provider encounters difficulties or if the Company has difficulty in communicating with such third party, it will significantly affect the Company's ability to adequately process and account for customer transactions, which would significantly affect its business operations.

In the ordinary course of business, the Company collects and stores sensitive data, including proprietary business information and personally identifiable information of its customers and employees in systems and on networks. The secure processing, maintenance and use of this information is critical to operations and the Company's business strategy. The Company has invested in accepted technologies, and annually reviews processes and practices that are designed to protect its networks, computers and data from damage or unauthorized access. Despite these security measures, the Company's computer systems and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance or other disruptions. A breach of any kind could compromise systems, and the information stored there could be accessed, damaged or disclosed. A breach in security could result in legal claims, regulatory penalties, disruption in operations, and damage to the Company's reputation, which could adversely affect the Company's business. Furthermore, as cyberattacks continue to evolve and increase, the Company may be required to expend significant additional resources to modify or enhance its protective measures, or to investigate and remediate any identified information security vulnerabilities.

Multiple major U.S. retailers, financial institutions, government agencies and departments have experienced data systems incursions reportedly resulting in the thefts of credit and debit card information, online account information, and other financial data of tens of millions of individuals and customers. Retailer incursions affect cards issued and deposit accounts maintained by many financial institutions, including the Bank. Although neither the Company's nor the Bank's systems are breached in government or retailer incursions, these events can cause the Bank to reissue a significant number of cards and take other costly steps to avoid significant theft loss to the Bank and its customers. In some cases, the Bank may be required to reimburse customers for the losses they incur. Other possible points of intrusion or disruption not within the Company's nor the Bank's control include internet service providers, electronic mail portal providers, social media portals, distant-server (so called "cloud") service providers, electronic data security providers, personal computers and mobile phones, telecommunications companies, and mobile phone manufacturers.

Consumers may increasingly decide not to use the Bank to complete their financial transactions because of technological and other changes, which would have a material adverse impact on the Company's financial condition and operations.

Technology and other changes are allowing parties to complete financial transactions through alternative methods that historically have involved banks. In particular, the activity of fintech companies has grown significantly over recent years and is expected to continue to grow. Fintech companies have and may continue to offer bank or bank-like products and some fintech companies have applied for bank charters. In addition, other fintech companies have partnered with existing banks to allow them to offer deposit products to their customers. For example, consumers can now maintain funds that would have historically been held as bank deposits in brokerage accounts, mutual funds or general-purpose reloadable prepaid cards. Consumers can also complete transactions such as paying bills and/or transferring funds directly without the assistance of banks. The process of eliminating banks as intermediaries, known as "disintermediation," could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits. The loss of these revenue streams and the lower cost of deposits as a source of funds could have a material adverse effect on the Company's financial condition and results of operations.

OPERATIONAL RISK

The Company is dependent on key personnel and the loss of one or more of those key personnel may materially and adversely affect the Company's operations and prospects.

The Company is a relationship-driven organization. A key aspect of the Company's business strategy is for its senior officers to have primary contact with current and potential customers. The Company's growth and development are in large part a result of these personalized relationships with the customer base. The success of the Company also often depends on its ability to hire and retain qualified banking officers.

The Company's senior officers have considerable experience in the banking industry and related financial services and are extremely valuable and would be difficult to replace. The loss of the services of these officers could have a material adverse effect upon future prospects. Although the Company has entered into employment contracts with certain of its senior executive officers, and purchased key man life insurance policies to mitigate the risk of an unforeseen departure or death of certain of the senior executive officers, it cannot offer any assurance that they and other key employees will remain employed by the Company. The unexpected loss of services of one or more of these key employees could have a material adverse effect on operations and possibly result in reduced revenues.

Failure to maintain effective systems of internal and disclosure control could have a material adverse effect on the Company's results of operation and financial condition.

Effective internal and disclosure controls are necessary for the Company to provide reliable financial reports and effectively prevent fraud and to operate successfully as a public company. If the Company cannot provide reliable financial reports or prevent fraud, its reputation and operating results would be harmed. As part of the Company's ongoing monitoring of internal control, it may discover material weaknesses or significant deficiencies in its internal control that require remediation. A "material weakness" is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of a company's annual or interim financial statements will not be prevented or detected on a timely basis.

The Company has in the past discovered, and may in the future discover, areas of its internal controls that need improvement. Even so, the Company is continuing to work to improve its internal controls. The Company cannot be certain that these measures will ensure that it implements and maintains adequate controls over its financial processes and reporting in the future. Any failure to maintain effective controls or to timely effect any necessary improvement of the Company's internal and disclosure controls could, among other things, result in losses from fraud or error, harm the Company's reputation or cause investors to lose confidence in the Company's reported financial information, all of which could have a material adverse effect on the Company's results of operation and financial condition.

The carrying value of goodwill may be adversely impacted.

When the Company completes an acquisition, generally goodwill is recorded on the date of acquisition as an asset. Current accounting guidance requires for goodwill to be tested for impairment, which the Company performs an impairment analysis at least annually, rather than amortizing it over a period of time. A significant adverse change in expected future cash flows or sustained adverse change in the Company's common stock could require the asset to become impaired. If impaired, the Company would incur a non-cash charge to earnings that would have a significant impact on the results of operations. The carrying value of goodwill was approximately $85.0 million at December 31, 2021.

The Company relies on other companies to provide key components of the Company's business infrastructure.

Third parties provide key components of the Company's business operations such as data processing, recording and monitoring transactions, online banking interfaces and services, Internet connections and network access. While the Company has selected these third party vendors carefully, it does not control their actions. Any problem caused by these third parties, including those resulting from disruptions in communication services provided by a vendor, failure of a vendor to handle current or higher volumes, cybersecurity breaches, failure of a vendor to provide services for any reason or poor performance of services, could adversely affect the Company's ability to deliver products and services to its customers and otherwise conduct its business. Financial or operational difficulties of a third party vendor could also hurt the Company's operations if those difficulties interface with the vendor's ability to serve the Company. Replacing these third party vendors could also create significant delay and expense. Accordingly, use of such third parties creates an unavoidable inherent risk to the Company's business operations.

LEGAL, REGULATORY AND COMPLIANCE RISK

The Company is subject to extensive regulation which could adversely affect its business.

The Company's operations as a publicly traded corporation, a bank holding company, and a parent company to an insured depository institution are subject to extensive regulation by federal, state, and local governmental authorities and are subject to various laws and judicial and administrative decisions imposing requirements and restrictions on part or all of the Company's operations. Because the Company's business is highly regulated, the laws, rules, and regulations applicable to it are subject to frequent and sometimes extensive change. Such changes could include higher capital requirements, increased insurance premiums, increased compliance costs, reductions of non-interest income and limitations on services that can be provided. Actions by regulatory agencies or significant litigation against the Company could cause it to devote significant time and resources to defend itself and may lead to liability or penalties that materially affect the Company and its shareholders. Any future changes in the laws, rules or regulations applicable to the Company may negatively affect the Company's business and results of operations.

Regulatory capital standards may have an adverse effect on the Company's profitability, lending, and ability to pay dividends on the Company's securities.

The Company is subject to capital adequacy guidelines and other regulatory requirements specifying minimum amounts and types of capital that the Company and the Bank must maintain. From time to time, regulators implement changes to these regulatory capital adequacy guidelines. If the Company fails to meet these minimum capital guidelines and/or other regulatory requirements, its financial condition would be materially and adversely affected. The Basel III Capital Rules require bank holding companies and their subsidiaries to maintain significantly more capital as a result of higher required capital levels and more demanding regulatory capital risk weightings and calculations. The Bank must also comply with the capital requirements set forth in the "prompt corrective action" regulations pursuant to Section 38 of the FDIA. Satisfying capital requirements may require the Company to limit its banking operations, retain net income or reduce dividends to improve regulatory capital levels, which could negatively affect its business, financial condition and results of operations.

Regulations issued by the CFPB could adversely impact earnings due to, among other things, increased compliance costs or costs due to noncompliance.

The CFPB has broad rulemaking authority to administer and carry out the provisions of the Dodd-Frank Act with respect to financial institutions that offer covered financial products and services to consumers. The CFPB has also been directed to write rules identifying practices or acts that are unfair, deceptive or abusive in connection with any transaction with a consumer for a consumer financial product or service, or the offering of a consumer financial product or service. For example, the CFPB has issued a final rule requiring mortgage lenders to make a reasonable and good faith determination based on verified and documented information that a consumer applying for a mortgage loan has a reasonable ability to repay the loan according to its terms, or to originate "qualified mortgages" that meet specific requirements with respect to terms, pricing and fees. The rule also contains additional disclosure requirements at mortgage loan origination and in monthly statements. The requirements under the CFPB's regulations and policies could limit the Company's ability to make certain types of loans or loans to certain borrowers, or could make it more expensive and/or time consuming to make these loans, which could adversely impact the Company's profitability.

Changes in accounting standards could impact reported earnings.

From time to time, with increasing frequency, there are changes in the financial accounting and reporting standards that govern the preparation of the Company's financial statements. These changes can materially impact how the Company records and reports its financial condition and results of operations. In some instances, the Company could be required to apply a new or revised standard retroactively, resulting in the restatement of prior period financial statements. Refer to Note 1 of the Consolidated Financial Statements contained in Item 8 of this Form 10-K for a discussion of recent accounting pronouncements.

Current and proposed regulation addressing consumer privacy and data use and security could increase the Company's costs and impact its reputation.

The Company is subject to a number of laws concerning consumer privacy and data use and security, including information safeguard rules under the Gramm-Leach-Bliley Act. These rules require that financial institutions develop, implement and maintain a written, comprehensive information security program containing safeguards that are appropriate to the financial institution's size and complexity, the nature and scope of the financial institution's activities, and the sensitivity of any customer information at issue. The United States has experienced a heightened legislative and regulatory focus on privacy and data security, including requiring consumer notification in the event of a data breach. In addition, most states have enacted security breach legislation requiring varying levels of consumer notification in the event of certain types of security breaches. New regulations in these areas may increase the Company's compliance costs, which could negatively impact earnings. In addition, failure to comply with the privacy and data use and security laws and regulations to which the Company is subject, including by reason of inadvertent disclosure of confidential information, could result in fines, sanctions, penalties or other adverse consequences and loss of consumer confidence, which could materially adversely affect the Company's results of operations, overall business, and reputation.

The Company is subject to claims and litigation pertaining to fiduciary responsibility.

From time to time, customers make claims and take legal action pertaining to the performance of the Company's fiduciary responsibilities. Whether customer claims and legal action related to the performance of the Company's fiduciary responsibilities are founded or unfounded, if such claims and legal actions are not resolved in a manner favorable to the Company, they may result in significant financial liability and/or adversely affect the market perception of the Company and its products and services, as well as impact customer demand for those products and services. Any financial liability or reputation damage could have a material adverse effect on the Company's business, which, in turn, could have a material adverse effect on the Company's financial condition and results of operations.

Increasing scrutiny and evolving expectations from customers, regulators, investors, and other stakeholders with respect to environmental, social and governance ("ESG") practices may impose additional costs on the Company or expose it to new or additional risks.

Companies are facing increasing scrutiny from customers, regulators, investors, and other stakeholders related to ESG practices and disclosure. Investor advocacy groups, investment funds and influential investors are also increasingly focused on these practices, especially as they relate to climate risk, hiring practices, the diversity of the work force, and racial and social justice issues. Increased ESG related compliance costs could result in increases to the Company’s overall operational costs. Failure to adapt to or comply with regulatory requirements or investor or stakeholder expectations and standards could negatively impact the Company’s reputation, ability to do business with certain partners, and the Company’s stock price. New government regulations could also result in new or more stringent forms of ESG oversight and expanding mandatory and voluntary reporting, diligence, and disclosure.

STRATEGIC RISK

The Company faces strong competition from financial services companies and other companies that offer banking and other financial services, which could negatively affect the Company's business.

The Company encounters substantial competition from other financial institutions in its market area. Ultimately, the Company may not be able to compete successfully against current and future competitors. Many competitors offer the same banking services that the Company offers. These competitors include national, regional, and community banks. The Company also faces competition from many other types of financial institutions, including finance companies, mutual and money market fund providers, financial technology ("fintech") companies, brokerage firms, insurance companies, credit unions, financial subsidiaries of certain industrial corporations, and mortgage companies. In particular, competitors include several major financial companies whose greater resources may afford them a marketplace advantage by enabling them to maintain numerous banking locations and ATMs and conduct extensive promotional and advertising campaigns. Increased competition may result in reduced business for the Company.

Additionally, banks and other financial institutions with larger capitalization and financial intermediaries not subject to bank regulatory restrictions have larger lending limits and are thereby able to serve the credit needs of larger customers. These institutions also may have differing pricing and underwriting standards, which may adversely affect the Company through the loss of business or causing a misalignment in the Company's risk-return relationship. Areas of competition include interest rates for loans and deposits, efforts to obtain loans and deposits, and range and quality of products and services provided, including new technology-driven products and services. Technological innovation continues to contribute to greater competition in domestic financial services markets as technological advances enable more companies to provide financial services. If the Company is unable to attract and retain banking customers, it may be unable to continue to grow loan and deposit portfolios and its results of operations and financial condition may be adversely affected.

The inability of the Company to successfully manage its growth or implement its growth strategy may adversely affect the Company's results of operations and financial condition.

The Company may not be able to successfully implement its growth strategy if it is unable to identify attractive markets, locations or opportunities to expand in the future. In addition, the ability to manage growth successfully depends on whether the Company can maintain adequate capital levels, cost controls and asset quality, and successfully integrate any businesses acquired into the Company.

As the Company continues to implement its growth strategy by opening new branches or acquiring branches or banks, it expects to incur increased personnel, occupancy and other operating expenses. In the case of new branches, the Company must absorb those higher expenses while it begins to generate new deposits; there is also further time lag involved in redeploying new deposits into attractively priced loans and other higher yielding earning assets. The Company's plans to expand could depress earnings in the short run, even if it efficiently executes a growth strategy leading to long-term financial benefits.

Difficulties in combining the operations of acquired entities with the Company's own operations may prevent the Company from achieving the expected benefits from acquisitions.

The Company may not be able to achieve fully the strategic objectives and operating efficiencies expected in an acquisition. Inherent uncertainties exist in integrating the operations of an acquired entity. In addition, the markets and industries in which the Company and its potential acquisition targets operate are highly competitive. The Company may lose customers or the customers of acquired entities as a result of an acquisition; the Company may lose key personnel, either from the acquired entity or from itself; and the Company may not be able to control the incremental increase in noninterest expense arising from an acquisition in a manner that improves its overall operating efficiencies. These factors could contribute to the Company not achieving the expected benefits from its acquisitions within desired time frames, if at all. Future business acquisitions could be material to the Company and it may issue additional shares of common stock to pay for those acquisitions, which would dilute current shareholders' ownership interests. Acquisitions also could require the Company to use substantial cash or other liquid assets or to incur debt; the Company could therefore become more susceptible to economic downturns and competitive pressures.
 

RISKS RELATING TO OUR SECURITIES

While the Company’s common stock is currently traded on the Nasdaq Global Select Market, it has less liquidity than stocks for larger companies quoted on a national securities exchange.

The trading volume in the Company’s common stock on the Nasdaq Global Select Market has been relatively low when compared with larger companies listed on the Nasdaq Global Select Market or other stock exchanges. There is no assurance that a more active and liquid trading market for the common stock will exist in the future. Consequently, shareholders may not be able to sell a substantial number of shares for the same price at which shareholders could sell a smaller number of shares. In addition, the Company cannot predict the effect, if any, that future sales of the Company’s common stock in the market, or the availability of shares of common stock for sale in the market, will have on the market price of the common stock.

Economic and other conditions may cause volatility in the price of the Company’s common stock.

In the current economic environment, the prices of publicly traded stocks in the financial services sector have been volatile. However, even in a more stable economic environment the price of the Company’s common stock can be affected by a variety of factors such as expected or actual results of operations, changes in analysts’ recommendations or projections, announcements of developments related to its businesses, operating and stock performance of other companies deemed to be peers, news or expectations based on the performance of others in the financial services industry, and expected impacts of a changing regulatory environment. These factors not only impact the price of the Company’s common stock but could also affect the liquidity of the stock given the Company’s size, geographical footprint, and industry. The price for shares of the Company’s common stock may fluctuate significantly in the future, and these fluctuations may be unrelated to the Company’s performance. General market price declines or market volatility in the future could adversely affect the price for shares of the Company’s common stock, and the current market price of such shares may not be indicative of future market prices.

Future issuances of the Company’s common stock could adversely affect the market price of the common stock and could be dilutive.

The Company is not restricted from issuing additional shares of common stock, including any securities that are convertible into or exchangeable for, or that represent the right to receive, shares of common stock. Issuances of a substantial number of shares of common stock, or the expectation that such issuances might occur, including in connection with acquisitions by the Company, could materially adversely affect the market price of the shares of the common stock and could be dilutive to shareholders. Because the Company’s decision to issue common stock in the future will depend on market conditions and other factors, it cannot predict or estimate the amount, timing or nature of possible future issuances of its common stock. Accordingly, the Company’s shareholders bear the risk that future issuances will reduce the market price of the common stock and dilute their stock holdings in the Company.

The primary source of the Company’s income from which it pays cash dividends is the receipt of dividends from its subsidiary bank.

The availability of dividends from the Company is limited by various statutes and regulations. It is possible, depending upon the financial condition of the Bank and other factors, that the OCC could assert that payment of dividends or other payments is an unsafe or unsound practice. In the event the Bank was unable to pay dividends to the Company, or be limited in the payment of such dividends, the Company would likely have to reduce or stop paying common stock dividends. The Company’s reduction, limitation. or failure to pay such dividends on its common stock could have a material adverse effect on the market price of the common stock.

The Company’s governing documents and Virginia law contain anti-takeover provisions that could negatively impact its shareholders.

The Company’s Articles of Incorporation and Bylaws and the Virginia Stock Corporation Act contain certain provisions designed to enhance the ability of the Company’s Board of Directors to deal with attempts to acquire control of the Company. These provisions and the ability to set the voting rights, preferences and other terms of any series of preferred stock that may be issued, may be deemed to have an anti-takeover effect and may discourage takeovers (which certain shareholders may deem to be in their best interest). To the extent that such takeover attempts are discouraged, temporary fluctuations in the market price of the Company’s common stock resulting from actual or rumored takeover attempts may be inhibited. These provisions also could discourage or make more difficult a merger, tender offer, or proxy contest, even though such transactions may be favorable to the interests of shareholders, and could potentially adversely affect the market price of the Company’s common stock.

GENERAL RISK

Changes in economic conditions could materially and negatively affect the Company's business.

The Company's business is directly impacted by economic, political, and market conditions, broad trends in industry and finance, legislative and regulatory changes, changes in government monetary and fiscal policies, and inflation, all of which are beyond the Company's control. A deterioration in economic conditions, whether caused by global, national or local events (including the COVID-19 pandemic, rising wages in a tight labor market, geopolitical instability and supply chain complications), especially within the Company's market area, could result in potentially negative material consequences such as the following, among others: loan delinquencies increasing; problem assets and foreclosures increasing; demand for products and services decreasing; low cost or noninterest bearing deposits decreasing; and collateral for loans, especially real estate, declining in value, in turn reducing customers' borrowing power, and reducing the value of assets and collateral associated with existing loans. Each of these consequences may have a material adverse effect on the Company's financial condition and results of operations.

Wealth management income is a major source of non-interest income for the Company. Trust and brokerage fee revenue is largely dependent on the fair market value of assets under management and on trading volumes in the brokerage business. General economic conditions and their subsequent effect on the securities markets tend to act in correlation. When general economic conditions deteriorate, securities markets generally decline in value, and the Company's trust and brokerage fee revenue is negatively impacted as asset values and trading volumes decrease.

The Company's exposure to operational, technological and organizational risk may adversely affect the Company.

The Company is exposed to many types of operational risks, including reputation, legal, and compliance risk, the risk of fraud or theft by employees or outsiders, unauthorized transactions by employees or operational errors, clerical or record-keeping errors, and errors resulting from faulty or disabled computer or telecommunications systems.

Negative public opinion can result from the actual or alleged conduct in any number of activities, including lending practices, corporate governance, and acquisitions, and from actions taken by government regulators and community organizations in response to those activities. Negative public opinion can adversely affect the Company's ability to attract and retain customers and can expose it to litigation and regulatory action.

Certain errors may be repeated or compounded before they are discovered and successfully rectified. The Company's necessary dependence upon automated systems to record and process its transactions may further increase the risk that technical system flaws or employee tampering or manipulation of those systems will result in losses that are difficult to detect. The Company may also be subject to disruptions of its operating systems arising from events that are wholly or partially beyond its control (for example, computer viruses or electrical or telecommunications outages), which may give rise to disruption of service to customers and to financial loss or liability. The Company is further exposed to the risk that its external vendors may be unable to fulfill their contractual obligations (or will be subject to the same risk of fraud or operational errors by their respective employees as is the Company) and to the risk that the Company's (or its vendors') business continuity and data security systems prove to be inadequate.

The Company's risk-management framework may not be effective in mitigating risk and loss.

The Company maintains an enterprise risk management program that is designed to identify, quantify, monitor, report, and control the risks that it faces. These risks include, but are not limited to: strategic, interest-rate, credit, liquidity, operations, pricing, reputation, compliance, litigation and cybersecurity. While the Company assesses and improves this program on an ongoing basis, there can be no assurance that its approach and framework for risk management and related controls will effectively mitigate all risk and limit losses in its business. If conditions or circumstances arise that expose flaws or gaps in the Company's risk-management program, or if its controls break down, the Company's results of operations and financial condition may be adversely affected.

Negative perception of the Company through media may adversely affect the Company's reputation and business.

The Company's reputation is critical to the success of its business. The Company believes that its brand image has been well received by customers, reflecting the fact that the brand image, like the Company’s business, is based in part on trust and confidence. The Company’s reputation and brand image could be negatively affected by rapid and widespread distribution of publicity through social and traditional media channels. The Company’s reputation could also be affected by the Company’s association with clients affected negatively through social and traditional media distribution, or other third parties, or by circumstances outside of the Company’s control. Negative publicity, whether deserved or undeserved, could affect the Company’s ability to attract or retain customers, or cause the Company to incur additional liabilities or costs, or result in additional regulatory scrutiny.

Climate change and related legislative and regulatory initiatives may result in operational changes and expenditures that could significantly impact the Company’s business.

The current and anticipated effects of climate change are creating an increasing level of concern for the state of the global environment. As a result, political and social attention to the issue of climate change has increased. Federal and state legislatures and regulatory agencies have continued to propose and advance numerous legislative and regulatory initiatives seeking to mitigate the effects of climate change. The federal banking agencies, including the OCC, have emphasized that climate-related risks are faced by banking organizations of all types and sizes and are in the process of enhancing supervisory expectations regarding banks’ risk management practices. In December 2021, the OCC published proposed principles for climate risk management by banking organizations with more than $100 billion in assets. The OCC also has appointed its first ever Climate Change Risk Officer and established an internal climate risk implementation committee in order to assist with these initiatives and to support the agency’s efforts to enhance its supervision of climate change risk management. Similar and even more expansive initiatives are expected, including potentially increasing supervisory expectations with respect to banks’ risk management practices, accounting for the effects of climate change in stress testing scenarios and systemic risk assessments, revising expectations for credit portfolio concentrations based on climate-related factors and encouraging investment by banks in climate-related initiatives and lending to communities disproportionately impacted by the effects of climate change. To the extent that these initiatives lead to the promulgation of new regulations or supervisory guidance applicable to the Company, the Company would likely experience increased compliance costs and other compliance-related risks.

The lack of empirical data surrounding the credit and other financial risks posed by climate change render it impossible to predict how specifically climate change may impact the Company’s financial condition and results of operations; however, the physical effects of climate change may also directly impact the Company. Specifically, unpredictable and more frequent weather disasters may adversely impact the value of real property securing the loans in the Bank’s loan portfolio. Additionally, if insurance obtained by borrowers is insufficient to cover any losses sustained to the collateral, or if insurance coverage is otherwise unavailable to borrowers, the collateral securing loans may be negatively impacted by climate change, which could impact the Company’s financial condition and results of operations. Further, the effects of climate change may negatively impact regional and local economic activity, which could lead to an adverse effect on customers and impact the communities in which the Company operates. Overall, climate change, its effects and the resulting, unknown impact could have a material adverse effect on the Company’s financial condition and results of operations.

Severe weather, natural disasters, acts of war or terrorism, geopolitical instability, public health issues, and other external events could significantly impact the Company's business.

Severe weather, natural disasters, acts of war or terrorism, geopolitical instability, public health issues, and other adverse external events could have a significant impact on the Company's ability to conduct business. In addition, such events could affect the stability of the Company's deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue, and/or cause the Company to incur additional expenses. The occurrence of any such event in the future could have a material adverse effect on the Company's business, which, in turn, could have a material adverse effect on its financial condition and results of operations.