Security Federal (SFDL) Risk Analysis

The USA PATRIOT Act and Bank Secrecy Acts and related regulations require financial institutions to develop programs to prevent financial institutions from being used for money laundering and terrorist activities. If such activities are detected, financial institutions are obligated to file suspicious activity reports with the U.S. Treasury's Office of Financial Crimes Enforcement Network. These rules require financial institutions to establish procedures for identifying and verifying the identity of customers seeking to open new financial accounts and beneficial owners of accounts. Failure to comply with these regulations could result in fines or sanctions. While we have developed policies and procedures designed to assist in compliance with these laws and regulations, no assurance can be given that these policies and procedures will be effective in preventing violations of these laws and regulations. If our policies and procedures are deemed deficient, we would be subject to liability, including fines and regulatory actions, which may include restrictions on our ability to pay dividends and the denial of regulatory approvals to proceed with certain aspects of our business plan, including acquisitions. Additionally, any perceived or actual failure to prevent money laundering or terrorist financing activities could significantly damage our reputation. These outcomes could have a material adverse effect on our business, financial condition, results of operations, and growth prospects.

The financial services industry is extensively regulated. Federal and state banking regulations are designed primarily to protect the deposit insurance funds and consumers, not to benefit our shareholders. Regulations may sometimes impose significant limitations on operations. Regulatory authorities have extensive discretion in connection with their supervisory and enforcement activities, including the imposition of restrictions on an institution's operations, the classification of assets by the institution and the adequacy of an institution's allowance for credit losses. These bank regulators also have the ability to impose conditions in the approval of merger and acquisition transactions. The significant federal and state banking regulations that affect us are described in this report under "Business - Regulation" in Item 1 of this 2024 Form 10-K. These regulations, along with the existing tax, accounting, securities, insurance, and monetary laws, regulations, rules, standards, policies and interpretations, control the methods by which financial institutions conduct business, implement strategic initiatives and tax compliance, and govern financial reporting and disclosures. These laws, regulations, rules, standards, policies, and interpretations are constantly evolving and may change significantly over time. Any new regulations or legislation or changes in existing regulations or oversight, whether a change in regulatory policy or a change in a regulator's interpretation of a law or regulation, could have a material impact on our operations, increase our costs of regulatory compliance and of doing business and/or otherwise adversely affect us and our profitability. Additionally, actions by regulatory agencies or significant litigation against us and may lead to penalties that materially affect us. Further, changes in accounting standards can be both difficult to predict and involve judgment and discretion in their interpretation by us and our independent registered public accounting firm. These changes could materially impact, potentially even retroactively, how we report our financial condition and results of our operations as could our interpretation of those changes. We cannot predict what restrictions may be imposed upon us with future legislation.

Factors beyond our control can significantly influence the fair value of securities in our portfolio and may cause adverse changes to the fair value of these securities. These factors include, but are not limited to, rating agency actions regarding the securities, defaults by, or other adverse events affecting, the issuer or the underlying securities, and changes in market interest rates, as well as continued instability in the capital markets. Any of these factors, among others, could result in realized and/or unrealized losses in future periods and declines in other comprehensive income, which could materially affect on our business, financial condition and results of operations. The process for determining whether the impairment of a security is other-than-temporary usually requires complex, subjective judgments about the future financial performance and liquidity of the issuer and any collateral underlying the security to assess the probability of receiving all contractual principal and interest payments on the security. There can be no assurance that declines in market value will not result in other-than-temporary impairments of these assets, leading to accounting charges that could have a material adverse effect on our net income and capital levels. For the year ended December 31, 2024, we did not incur any other-than-temporary impairments in our securities portfolio.

We are reliant on our ability to manage data and our ability to aggregate data in an accurate and timely manner to ensure effective risk reporting and management. Our ability to manage data and aggregate data may be limited by the effectiveness of our policies, programs, processes and practices that govern how data is acquired, validated, stored, protected and processed. While we continuously update our policies, programs, processes and practices, many of our data management and aggregation processes are manual and subject to human error or system failure. Failure to manage data effectively and to aggregate data in an accurate and timely manner may limit our ability to manage current and emerging risks, as well as to manage changing business needs.

Our security measures may not be sufficient to mitigate the risk of a cyber-attack. Communications and information systems are critical to our operations, as we rely on them to manage customer relationships, maintain our general ledger, and support other business functions. Our operations depend on the secure processing, storage, and transmission of confidential information through our computer systems and networks. While we take protective measures and adapt them as circumstances evolve, our systems may remain vulnerable to breaches, unauthorized access, denial-of-service attacks, misuse, malware, or other cyber threats. Any such event could compromise our or our customers' confidential information, disrupt operations, or harm customers and counterparties. If these risks materialize, we may incur significant expenses to investigate and remediate security vulnerabilities, enhance protective measures, or address the impact of an attack. Such incidents could expose us to litigation, regulatory scrutiny, financial losses not fully covered by insurance, and reputational damage, which could deter customers from using our services. Security breaches in our internet banking activities could further expose us to liability and reputational harm. Cybersecurity risks are particularly heightened in internet banking. Advances in criminal sophistication, technology, or vulnerabilities in third-party systems could lead to breaches that compromise the security of data and transactions, potentially discouraging customers from using our online services. While we continue to invest in systems and processes to detect and prevent breaches, no system is foolproof. A breach could result in financial losses, reputational harm, regulatory penalties, compliance costs, and legal liabilities, adversely affecting our financial condition and ability to grow our online services. Increases in criminal activity levels and sophistication, advances in computer capabilities, new discoveries, vulnerabilities in third party technologies (including browsers and operating systems) or other developments could result in a compromise or breach of the technology, processes and controls that we use to prevent fraudulent transactions and to protect data about us, our customers and underlying transactions. Any compromise of our security could deter customers from using our internet banking services that involve the transmission of confidential information. Although we have developed and continue to invest in systems and processes that are designed to detect and prevent security breaches and cyber-attacks and periodically test our security, these precautions may not protect our systems from compromises or breaches of our security measures, and could result in losses to us or our customers, our loss of business and/or customers, damage to our reputation, the incurrence of additional expenses, disruption to our business, our inability to grow our online services or other businesses, additional regulatory scrutiny or penalties, or our exposure to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition and results of operations. In addition, our security measures may not fully protect us from system failures or interruptions. While we have policies and procedures to mitigate these risks, we cannot guarantee their effectiveness. We also rely on third-party providers for data processing and operational support. Although we carefully select these providers, we do not control their actions. If a third-party vendor experiences disruptions, cyber-attacks, or fails to meet service standards, it could impair our ability to process transactions, deliver services, or conduct business. Transitioning to alternative vendors could involve significant delays and costs. Our business may also be adversely affected by the increasing prevalence of fraud and other financial crimes. As a bank, we are vulnerable to fraudulent activity, which may result in financial losses, increased costs, or damage to our reputation. Fraud may take many forms, including check fraud, electronic fraud, wire fraud, phishing, and social engineering. Nationally, incidents of fraud and financial crimes have been on the rise, and we have experienced losses due to such activities. While we have policies and procedures to prevent these losses, we cannot guarantee that they will not occur.

Competition for qualified employees in the banking industry is intense, with a limited pool of candidates experienced in community banking. Our success relies on attracting and retaining skilled management, loan origination, finance, administrative, marketing, and technical personnel, as well as on the continued contributions of key executives, including our Chief Executive Officer, J. Chris Verenes, and other critical employees. Losing any of these individuals could result in a challenging transition period and negatively impact our operations. The loss of these key personnel or directors nearing retirement without suitable replacements could adversely affect our business.

There have been no material changes in the Risk Factors previously disclosed in Item 1A of the Company's 2024 Form 10-K.