PKKW Parkway Acquisition Corporation (QX)

General

Parkway Acquisition Corp. (“Parkway,” the “Company,” “we,” “our” and “us”) was incorporated as a Virginia corporation on November 2, 2015. Parkway was formed as a business combination shell for the purpose of completing a business combination transaction between Grayson Bankshares, Inc. (“Grayson”) and Cardinal Bankshares Corporation (“Cardinal”). On November 6, 2015, Grayson, Cardinal and Parkway entered into an Agreement and Plan of Merger (the “merger agreement”), providing for the combination of the three companies. Terms of the merger agreement called for Grayson and Cardinal to merge with and into Parkway, with Parkway as the surviving corporation (the “Cardinal merger”). The merger agreement established exchange ratios under which each share of Grayson common stock was converted to the right to receive 1.76 shares of common stock of Parkway, while each share of Cardinal common stock was converted to the right to receive 1.30 shares of common stock of Parkway. The exchange ratios resulted in Grayson shareholders receiving approximately 60% of the newly issued Parkway shares and Cardinal shareholders receiving approximately 40% of the newly issued Parkway shares. The Cardinal merger was completed on July 1, 2016. Grayson is considered the acquiror and Cardinal is considered the acquiree in the transaction for accounting purposes.

Upon completion of the Cardinal merger, the Bank of Floyd, a wholly-owned subsidiary of Cardinal, was merged with and into Grayson National Bank (the “Bank’), a wholly-owned subsidiary of Grayson. The Bank was organized under the laws of the United States in 1900 and now serves the Virginia counties of Grayson, Floyd, Carroll, Wythe, Montgomery and Roanoke, and the North Carolina counties of Alleghany and Ashe, and surrounding areas through sixteen full-service banking offices and two loan production offices. Effective March 13, 2017, the Bank changed its name to Skyline National Bank.

As a Federal Deposit Insurance Corporation (“FDIC”) insured national banking association, the Bank is subject to regulation by the Comptroller of the Currency and the FDIC. Parkway is regulated by the Board of Governors of the Federal Reserve System.

On March 1, 2018, the Company and the Bank entered into an Agreement and Plan of Merger with Great State Bank pursuant to which the Company will acquire Great State Bank. The agreement provides that, upon the terms and subject to the conditions set forth therein, Great State Bank will merge with and into the Bank, with Skyline as the surviving bank in the Merger. Upon completion of the merger, shareholders of Great State bank will receive 1.21 shares of the Company’s common stock for each share of Great State common stock they own. Great State Bank is a Wilkesboro, North Carolina-based bank with branches in Boone, Wilkesboro and Yadkinville, North Carolina and loan production offices in Lenoir and Shelby, North Carolina. As of December 31, 2017, Great State Bank had total assets of $139 million. The proposed merger is expected to be completed in the third quarter of 2018, subject to approval of both companies’ shareholders, regulatory approvals, and other customary closing conditions.

For purposes of this annual report on Form 10-K, all information contained herein as of and for periods prior to July 1, 2016 reflects the operations of Grayson prior to the Cardinal merger. Unless this report otherwise indicates or the context otherwise requires, all references to “Parkway” or the “Company” as of and for periods subsequent to July 1, 2016 refer to the combined company and its subsidiary as a combined entity after the Cardinal merger, and all references to the “Company” as of and for periods prior to July 1, 2016 are references to Grayson and its subsidiary as a combined entity prior to the Cardinal merger.

Lending Activities

The Bank’s lending services include real estate, commercial, agricultural, and consumer loans. The loan portfolio constituted 86.35% of the interest earning assets of the Bank at December 31, 2017, and has historically produced the highest interest rate spread above the cost of funds. The Bank’s loan personnel have the authority to extend credit under guidelines established and approved by the Bank’s Board of Directors. The Directors’ Loan Committee has the authority to approve loans up to $2.0 million of total indebtedness to a single customer. All loans in excess of that amount must be presented to the full Board of Directors of the Bank for ultimate approval or denial.

1

Table of Contents

The Bank has in the past and intends to continue to make most types of real estate loans, including, but not limited to, single and multi-family housing, farm loans, residential and commercial construction loans, and loans for commercial real estate. At December 31, 2017, the Bank had 46.87% of the loan portfolio in single and multi-family housing, 29.57% in non-farm, non-residential real estate loans, 7.85% in farm related real estate loans, and 6.00% in real estate construction and development loans.

The Bank’s loan portfolio includes commercial and agricultural production loans totaling 6.04% of the portfolio at December 31, 2017. Consumer and other loans make up approximately 3.67% of the total loan portfolio. Consumer loans include loans for household expenditures, car loans, and other loans to individuals. While this category has historically experienced a greater percentage of charge-offs than the other classifications, the Bank is committed to continue to make this type of loan to fulfill the needs of the Bank’s customer base.

All loans in the Bank’s portfolio are subject to risk from the state of the economy in the Bank’s service area and also that of the nation. The Bank has used and continues to use conservative loan-to-value ratios and thorough credit evaluation to lessen the risk on all types of loans. The use of conservative appraisals has also reduced exposure on real estate loans. Thorough credit checks and evaluation of past internal credit history has helped reduce the amount of risk related to consumer loans. Government guarantees of loans are used when appropriate, but apply to a minimal percentage of the portfolio. Commercial loans are evaluated by collateral value and ability to service debt. Businesses seeking loans must have a good product line and sales, responsible management, and demonstrated cash flows sufficient to service the debt.

Investments

The Bank invests a portion of its assets in U.S. Treasury, U.S. Government agency, and U.S. Government Sponsored Enterprise securities, state, county and local obligations, corporate and equity securities. The Bank’s investments are managed in relation to loan demand and deposit growth, and are generally used to provide for the investment of excess funds at reduced yields and risks relative to increases in loan demand or to offset fluctuations in deposits.

Deposit Activities

Deposits are the major source of funds for lending and other investment activities. The Bank considers the majority of its regular savings, demand, NOW, money market deposits, individual retirement accounts and small denomination certificates of deposit to be core deposits. These accounts comprised approximately 90.15% of the Bank’s total deposits at December 31, 2017. Certificates of deposit in denominations of $100,000 or more represented the remaining 9.85% of deposits at December 31, 2017.

Market Area

The Bank’s primary market area consists of:

2

Table of Contents

Grayson, Carroll, Alleghany, and Ashe Counties, as well as the City of Galax, are rural in nature and employment in these areas was once dominated by furniture and textile manufacturing. As those industries have declined employment has shifted to healthcare, retail and service, light manufacturing, tourism, and agriculture. Median household income in these markets ranged from a low of $31,002 in Grayson County, to a high of $38,352 in Alleghany County, based upon 2016 census data. Montgomery, Pulaski, Floyd and Wythe counties, while largely rural, are more economically diverse. Montgomery County is home to two major universities, Virginia Tech and Radford University, while community colleges are located in both Wythe County and Pulaski County. The university presence has led to the development of several technology related companies in the region. Manufacturing, agriculture, tourism, retail, healthcare and service industries are also prevalent in these markets. The increased economic diversity of these markets is reflected in the median household incomes which range from a low of $42,888 in Wythe County, to a high of $49,712 in Montgomery County, according to the 2016 census data. The Bank has a lesser presence in Roanoke County and the Cities of Roanoke and Salem where median household incomes ranged from a low of $39,201 in Roanoke City, to a high of $60,380 in Roanoke County.

Competition

The Bank encounters strong competition both in making loans and attracting deposits. The deregulation of the banking industry and the widespread enactment of state laws that permit multi-bank holding companies as well as an increasing level of interstate banking have created a highly competitive environment for commercial banking. In one or more aspects of its business, the Bank competes with other commercial banks, savings and loan associations, credit unions, finance companies, mutual funds, insurance companies, brokerage and investment banking companies, and other financial intermediaries. Many of these competitors have substantially greater resources and lending limits and may offer certain services that the Bank does not currently provide. In addition, many of the Bank’s competitors are not subject to the same extensive federal regulations that govern bank holding companies and federally insured banks. Recent federal and state legislation has heightened the competitive environment in which financial institutions must conduct their business, and the potential for competition among financial institutions of all types has increased significantly.

To compete, the Bank relies upon specialized services, responsive handling of customer needs, and personal contacts by its officers, directors, and staff. Large multi-branch banking competitors tend to compete primarily by rate and the number and location of branches, while smaller, independent financial institutions tend to compete primarily by rate and personal service.

Employees

At December 31, 2017, the Company had 177 total employees representing 172 full time equivalents, none of whom are represented by a union or covered by a collective bargaining agreement. The Company’s management considers employee relations to be good.

Government Supervision and Regulation

The Company and the Bank are extensively regulated under federal and state law. The following information describes certain aspects of that regulation applicable to the Company and the Bank and does not purport to be complete. Proposals to change the laws and regulations governing the banking industry are frequently raised in U.S. Congress, in state legislatures, and before the various bank regulatory agencies. The likelihood and timing of any changes and the impact such changes might have on the Company and the Bank are impossible to determine with any certainty. A change in applicable laws or regulations, or a change in the way such laws or regulations are interpreted by regulatory agencies or courts, may have a material impact on the business, operations, and earnings of the Company and the Bank.

Parkway Acquisition Corp.

The Company is a bank holding company (“BHC”) within the meaning of the Bank Holding Company Act of 1956, as amended (the “BHC Act”), and is registered as such with the Board of Governors of the Federal Reserve System (the “Federal Reserve”). As a bank holding company, the Company is subject to supervision, regulation and examination by the Federal Reserve Bank of Richmond and is required to file various reports and additional information with the Federal Reserve. The Company is also registered under the bank holding company laws of Virginia and is subject to supervision, regulation and examination by the Virginia State Corporation Commission (the “SCC”).

3

Table of Contents

Skyline National Bank

The Bank is a federally chartered national bank. It is subject to federal regulation by the Office of the Comptroller of the Currency (the “OCC”) and the Federal Deposit Insurance Corporation (the “FDIC”).

The OCC conducts regular examinations of the Bank, reviewing such matters as the adequacy of loan loss reserves, quality of loans and investments, management practices, compliance with laws, and other aspects of its operations. In addition to these regular examinations, the Bank must furnish the OCC with periodic reports containing a full and accurate statement of its affairs. Supervision, regulation and examination of banks by these agencies are intended primarily for the protection of depositors rather than shareholders.

The regulations of the OCC, the FDIC and the FRB govern most aspects of the Company’s and the Bank’s business, including deposit reserve requirements, investments, loans, certain check clearing activities, issuance of securities, payment of dividends, branching, deposit interest rate ceilings, and numerous other matters. The OCC, the FDIC and the FRB have adopted guidelines and released interpretative materials that establish operational and managerial standards to promote the safe and sound operation of banks and bank holding companies. These standards relate to the institution’s key operating functions, including but not limited to capital management, internal controls, internal audit system, information systems and data and cybersecurity, loan documentation, credit underwriting, interest rate exposure and risk management, vendor management, executive management and its compensation, asset growth, asset quality, earnings, liquidity and risk management.

The Dodd-Frank Act

On July 21, 2010, President Obama signed into law the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”). The Dodd-Frank Act significantly restructures the financial regulatory regime in the United States and has a broad impact on the financial services industry as a result of the significant regulatory and compliance changes required under the act. While significant rulemaking under the Dodd-Frank Act has occurred, certain of the act’s provisions require additional rulemaking by the federal bank regulatory agencies, a process which will take years to fully implement. The Company believes that short- and long-term compliance costs for the Company will be greater because of the Dodd-Frank Act. In 2017 and early 2018, both the House of Representatives and Senate introduced legislation that would repeal or modify provisions of the Dodd-Frank Act and impact financial services regulation. Although the bills vary in content, certain key aspects include revisions to rules related to mortgage loans reform and simplification of certain Volcker Rule requirements and changes to capital requirements. The Company cannot predict whether any such legislation will be enacted and, if enacted, the effect that it, or any implementing regulations, would have on the financial condition or results of the Company or the Bank. Certain provisions of the Dodd-Frank Act, as currently in effect, that could impact the Company are set forth below:

4

Table of Contents

Deposit Insurance

The deposits of the Bank are insured by the DIF up to applicable limits and are subject to deposit insurance assessments to maintain the DIF. On April 1, 2011, the deposit insurance assessment base changed from total deposits to average total assets minus average tangible equity, pursuant to a rule issued by the FDIC as required by the Dodd-Frank Act.

The Federal Deposit Insurance Act (the “FDIA”), as amended by the Federal Deposit Insurance Reform Act and the Dodd-Frank Act, requires the FDIC to set a ratio of deposit insurance reserves to estimated insured deposits of at least 1.35%. The FDIC uses a risk-based system to calculate assessment rates and revised its methodology in April 2016 to calculate assessment rates for banks with under $10 billion in assets based upon certain financial measures of the bank and its supervisory ratings. Initial base assessment rates currently range from 3 to 30 basis points, subject to a decrease for certain unsecured debt. Once the reserve ratio reaches 2.0% or greater, initial base assessment rates will range from 2 to 28 basis points and, once the reserve ratio reaches 2.5% or greater, the initial base assessment rates will range from 1 to 25 basis points.

Capital Requirements

The FRB, the OCC and the FDIC have issued substantially similar risk-based and leverage capital guidelines applicable to all banks and bank holding companies. In addition, those regulatory agencies may from time to time require that a banking organization maintain capital above the minimum levels because of its financial condition or actual or anticipated growth.

Effective January 1, 2015, the federal banking regulators adopted rules to implement the Basel III regulatory capital reforms from the Basel Committee on Banking Supervision and certain provisions of the Dodd-Frank Act. The final rules required the Bank to comply with the following new minimum capital ratios: (i) a new common equity Tier 1 capital ratio of 4.5% of risk-weighted assets; (ii) a Tier 1 capital ratio of 6% of risk-weighted assets (increased from the prior requirement of 4%); (iii) a total capital ratio of 8% of risk-weighted assets (unchanged from the prior requirement); and (iv) a leverage ratio of 4% of total assets (unchanged from the prior requirement). When fully phased in on January 1, 2019, the rules will require the Company and the Bank to maintain (i) a minimum ratio of common equity Tier 1 to risk-weighted assets of at least 4.5%, plus a 2.5% “capital conservation buffer” (which is added to the 4.5% common equity Tier 1 ratio as that buffer is phased in, effectively resulting in a minimum ratio of common equity Tier 1 to risk-weighted assets of at least 7% upon full implementation), (ii) a minimum ratio of Tier 1 capital to risk-weighted assets of at least 6.0%, plus the 2.5% capital conservation buffer (which is added to the 6.0% Tier 1 capital ratio as that buffer is phased in, effectively resulting in a minimum Tier 1 capital ratio of 8.5% upon full implementation), (iii) a minimum ratio of total capital to risk-weighted assets of at least 8.0%, plus the 2.5% capital conservation buffer (which is added to the 8.0% total capital ratio as that buffer is phased in, effectively resulting in a minimum total capital ratio of 10.5% upon full implementation), and (iv) a minimum leverage ratio of 4%, calculated as the ratio of Tier 1 capital to average assets.

The capital conservation buffer requirement will be phased in beginning January 1, 2016, at 0.625% of risk-weighted assets, increasing by the same amount each year until fully implemented at 2.5% on January 1, 2019. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of common equity Tier 1 to risk-weighted assets above the minimum but below the conservation buffer will face constraints on dividends, equity repurchases, and compensation based on the amount of the shortfall.

The rules also revised the “prompt corrective action” regulations pursuant to Section 38 of the FDIA by (i) introducing a common equity Tier 1 capital ratio requirement at each level (other than critically undercapitalized), with the required ratio being 6.5% for well-capitalized status; (ii) increasing the minimum Tier 1 capital ratio requirement for each category, with the minimum ratio for well-capitalized status being 8.0% (as compared to the prior ratio of 6.0%); and (iii) eliminating the current provision that provides that a bank with a composite supervisory rating of 1 may have a 3.0% Tier 1 leverage ratio and still be well-capitalized. These new thresholds were effective for the Bank as of January 1, 2015. The minimum total capital to risk-weighted assets ratio (10.0%) and minimum leverage ratio (5.0%) for well-capitalized status were unchanged by the final rules.

5

Table of Contents

The new capital requirements also included changes in the risk weights of assets to better reflect credit risk and other risk exposures. These include a 150% risk weight (up from 100%) for certain high volatility commercial real estate acquisition, development and construction loans and nonresidential mortgage loans that are 90 days past due or otherwise on nonaccrual status, a 20% (up from 0%) credit conversion factor for the unused portion of a commitment with an original maturity of one year or less that is not unconditionally cancelable, a 250% risk weight (up from 100%) for mortgage servicing rights and deferred tax assets that are not deducted from capital, and increased risk-weights (from 0% to up to 600%) for equity exposures.

Based on management’s understanding and interpretation of the new capital rules, it believes that, as of December 31, 2017, the Banks meet all capital adequacy requirements under such rules on a fully phased-in basis as if such requirements were in effect as of such date.

In September 2017, the federal bank regulatory agencies proposed to revise and simplify the capital treatment for certain deferred tax assets, mortgage servicing assets, investments in non-consolidated financial entities and minority interests for banking organizations, such as the Bank, that are not subject to the advanced approaches requirements. In November 2017, the regulatory agencies revised the capital rules enacted in 2013 to extend the current transitional treatment of these items for non-advanced approaches banking organizations until the September 2017 proposal is finalized. The September 2017 proposal would also change the capital treatment of certain commercial real estate loans under the standardized approach, which the Bank uses to calculate its capital ratios.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms (the standards are commonly referred to as “Basel IV”). Among other things, these standards revise the Basel Committee’s standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain “unconditionally cancellable commitments,” such as unused credit card lines of credit) and provide a new standardized approach for operational risk capital. Under the proposed framework, these standards will generally be effective on January 1, 2022, with an aggregate output floor phasing-in through January 1, 2027. Under the current capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not to the Company. The impact of Basel IV on the Company and the Bank will depend on the manner in which it is implemented by the federal bank regulatory agencies.

Dividends

The Company’s ability to distribute cash dividends depends primarily on the ability of the Bank to pay dividends to it. The Company is a legal entity, separate and distinct from its subsidiaries. A significant portion of the Company’s revenues result from dividends paid to it by the Bank. There are various legal limitations applicable to the payment of dividends by the Bank to the Company and to the payment of dividends by the Company to its shareholders. As a national bank, the Bank is subject to certain restrictions on its reserves and capital imposed by federal banking statutes and regulations. Under OCC regulations, a national bank may not declare a dividend in excess of its undivided profits. Additionally, a national bank may not declare a dividend if the total amount of all dividends, including the proposed dividend, declared by the national bank in any calendar year exceeds the total of the national bank’s retained net income of that year to date, combined with its retained net income of the two preceding years, unless the dividend is approved by the OCC. A national bank may not declare or pay any dividend if, after making the dividend, the national bank would be “undercapitalized,” as defined in regulations of the OCC.

In addition, under the current supervisory practices of the FRB, the Company should inform and consult with its regulators reasonably in advance of declaring or paying a dividend that exceeds earnings for the period (e.g., quarter) for which the dividend is being paid or that could result in a material adverse change to the Company’s capital structure.

Permitted Activities

As a bank holding company, the Company is limited to managing or controlling banks, furnishing services to or performing services for its subsidiaries, and engaging in other activities that the FRB determines by regulation or order to be so closely related to banking or managing or controlling banks as to be a proper incident thereto. In determining whether a particular activity is permissible, the FRB must consider whether the performance of such an activity

6

Table of Contents

reasonably can be expected to produce benefits to the public that outweigh possible adverse effects. Possible benefits include greater convenience, increased competition, and gains in efficiency. Possible adverse effects include undue concentration of resources, decreased or unfair competition, conflicts of interest, and unsound banking practices. Despite prior approval, the FRB may order a bank holding company or its subsidiaries to terminate any activity or to terminate ownership or control of any subsidiary when the FRB has reasonable cause to believe that a serious risk to the financial safety, soundness or stability of any bank subsidiary of that bank holding company may result from such an activity.

Banking Acquisitions; Changes in Control

The BHC Act requires, among other things, the prior approval of the FRB in any case where a bank holding company proposes to (i) acquire direct or indirect ownership or control of more than 5% of the outstanding voting stock of any bank or bank holding company (unless it already owns a majority of such voting shares), (ii) acquire all or substantially all of the assets of another bank or bank holding company, or (iii) merge or consolidate with any other bank holding company. In determining whether to approve a proposed bank acquisition, the FRB will consider, among other factors, the effect of the acquisition on competition, the public benefits expected to be received from the acquisition, the projected capital ratios and levels on a post-acquisition basis, and the acquiring institution’s performance under the Community Reinvestment Act of 1977 (the “CRA”) and its compliance with fair housing and other consumer protection laws.

Subject to certain exceptions, the BHC Act and the Change in Bank Control Act, together with the applicable regulations, require FRB approval (or, depending on the circumstances, no notice of disapproval) prior to any person or company acquiring “control” of a bank or bank holding company. A conclusive presumption of control exists if an individual or company acquires the power, directly or indirectly, to direct the management or policies of an insured depository institution or to vote 25% or more of any class of voting securities of any insured depository institution. A rebuttable presumption of control exists if a person or company acquires 10% or more but less than 25% of any class of voting securities of an insured depository institution and either the institution has registered its securities with the Securities and Exchange Commission under Section 12 of the Securities Exchange Act of 1934 (the “Exchange Act”) or no other person will own a greater percentage of that class of voting securities immediately after the acquisition. The Company’s common stock currently is not registered under Section 12 of the Exchange Act.

In addition, Virginia law requires the prior approval of the SCC for (i) the acquisition of more than 5% of the voting shares of a Virginia bank or any holding company that controls a Virginia bank, or (ii) the acquisition by a Virginia bank holding company of a bank or its holding company domiciled outside Virginia.

Source of Strength

Federal Reserve policy has historically required bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. The Dodd-Frank Act codified this policy as a statutory requirement. Under this requirement, the Company is expected to commit resources to support the Bank, including at times when the Company may not be in a financial position to provide such resources. Any capital loans by a bank holding company to any of its subsidiary banks are subordinate in right of payment to depositors and to certain other indebtedness of such subsidiary banks. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Safety and Soundness

There are a number of obligations and restrictions imposed on bank holding companies and their subsidiary banks by law and regulatory policy that are designed to minimize potential loss to the depositors of such depository institutions and the FDIC insurance fund in the event of a depository institution default. For example, under the Federal Deposit Insurance Corporation Improvement Act of 1991, to avoid receivership of an insured depository institution subsidiary, a bank holding company is required to guarantee the compliance of any subsidiary bank that may become “undercapitalized” with the terms of any capital restoration plan filed by such subsidiary with its appropriate federal bank regulatory agency up to the lesser of (i) an amount equal to 5% of the institution’s total assets at the time the institution became undercapitalized or (ii) the amount that is necessary (or would have been necessary) to bring the institution into compliance with all applicable capital standards as of the time the institution fails to comply with such capital restoration plan.

7

Table of Contents

Under the FDIA, the federal bank regulatory agencies have adopted guidelines prescribing safety and soundness standards. These guidelines establish general standards relating to internal controls and information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth and compensation, fees and benefits. In general, the guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines.

The Federal Deposit Insurance Corporation Improvement Act

Under the Federal Deposit Insurance Corporation Improvement Act of 1991 (“FDICIA”), the federal bank regulatory agencies possess broad powers to take prompt corrective action to resolve problems of insured depository institutions. The extent of these powers depends upon whether the institution is “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” or “critically undercapitalized,” as defined by the law.

Reflecting changes under the new Basel III capital requirements, the relevant capital measures that became effective on January 1, 2015 for prompt corrective action are the total capital ratio, the common equity Tier 1 capital ratio, the Tier 1 capital ratio and the leverage ratio. A bank will be (i) “well capitalized” if the institution has a total risk-based capital ratio of 10.0% or greater, a common equity Tier 1 capital ratio of 6.5% or greater, a Tier 1 risk-based capital ratio of 8.0% or greater, and a leverage ratio of 5.0% or greater, and is not subject to any capital directive order; (ii) “adequately capitalized” if the institution has a total risk-based capital ratio of 8.0% or greater, a common equity Tier 1 capital ratio of 4.5% or greater, a Tier 1 risk-based capital ratio of 6.0% or greater, and a leverage ratio of 4.0% or greater and is not “well capitalized”; (iii) “undercapitalized” if the institution has a total risk-based capital ratio that is less than 8.0%, a common equity Tier 1 capital ratio less than 4.5%, a Tier 1 risk-based capital ratio of less than 6.0% or a leverage ratio of less than 4.0%; (iv) “significantly undercapitalized” if the institution has a total risk-based capital ratio of less than 6.0%, a common equity Tier 1 capital ratio less than 3.0%, a Tier 1 risk-based capital ratio of less than 4.0% or a leverage ratio of less than 3.0%; and (v) “critically undercapitalized” if the institution’s tangible equity is equal to or less than 2.0% of average quarterly tangible assets. An institution may be downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios if it is determined to be in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters. A bank’s capital category is determined solely for the purpose of applying prompt corrective action regulations, and the capital category may not constitute an accurate representation of the bank’s overall financial condition or prospects for other purposes. Management believes, as of December 31, 2017 and 2016, the Company met the requirements for being classified as “well capitalized.”

As required by FDICIA, the federal bank regulatory agencies also have adopted guidelines prescribing safety and soundness standards relating to, among other things, internal controls and information systems, internal audit systems, loan documentation, credit underwriting, and interest rate exposure. In general, the guidelines require appropriate systems and practices to identify and manage the risks and exposures specified in the guidelines. In addition, the agencies adopted regulations that authorize, but do not require, an institution which has been notified that it is not in compliance with safety and soundness standard to submit a compliance plan. If, after being so notified, an institution fails to submit an acceptable compliance plan, the agency must issue an order directing action to correct the deficiency and may issue an order directing other actions of the types to which an undercapitalized institution is subject under the prompt corrective action provisions described above.

Branching

The Riegle-Neal Interstate Banking and Branching Efficiency Act of 1994, as amended (the “Interstate Banking Act”), generally permits well capitalized bank holding companies to acquire banks in any state, and preempts all state laws restricting the ownership by a bank holding company of banks in more than one state. The Interstate Banking Act also permits a bank to merge with an out-of-state bank and convert any offices into branches of the resulting bank if both states have not opted out of interstate branching; and permits a bank to acquire branches from an out-of-state bank if the law of the state where the branches are located permits the interstate branch acquisition. Under the Dodd-Frank Act, a

8

Table of Contents

bank holding company or bank must be well capitalized and well managed to engage in an interstate acquisition. Bank holding companies and banks are required to obtain prior Federal Reserve approval to acquire more than 5% of a class of voting securities, or substantially all of the assets, of a bank holding company, bank or savings association. The Interstate Banking Act and the Dodd-Frank Act permit banks to establish and operate de novo interstate branches to the same extent a bank chartered by the host state may establish branches.

Transactions with Affiliates

Pursuant to Sections 23A and 23B of the Federal Reserve Act and Regulation W, the authority of the Bank to engage in transactions with related parties or “affiliates” or to make loans to insiders is limited. Loan transactions with an affiliate generally must be collateralized and certain transactions between the Bank and its affiliates, including the sale of assets, the payment of money or the provision of services, must be on terms and conditions that are substantially the same, or at least as favorable to the Bank, as those prevailing for comparable nonaffiliated transactions. In addition, the Bank generally may not purchase securities issued or underwritten by affiliates.

Loans to executive officers, directors or to any person who directly or indirectly, or acting through or in concert with one or more persons, owns, controls or has the power to vote more than 10% of any class of voting securities of a bank (a “10% Shareholders”), are subject to Sections 22(g) and 22(h) of the Federal Reserve Act and their corresponding regulations (Regulation O) and Section 13(k) of the Exchange Act relating to the prohibition on personal loans to executives (which exempts financial institutions in compliance with the insider lending restrictions of Section 22(h) of the Federal Reserve Act). Among other things, these loans must be made on terms substantially the same as those prevailing on transactions made to unaffiliated individuals and certain extensions of credit to those persons must first be approved in advance by a disinterested majority of the entire board of directors. Section 22(h) of the Federal Reserve Act prohibits loans to any of those individuals where the aggregate amount exceeds an amount equal to 15% of an institution’s unimpaired capital and surplus plus an additional 10% of unimpaired capital and surplus in the case of loans that are fully secured by readily marketable collateral, or when the aggregate amount on all of the extensions of credit outstanding to all of these persons would exceed the Bank’s unimpaired capital and unimpaired surplus. Section 22(g) of the Federal Reserve Act identifies limited circumstances in which the Bank is permitted to extend credit to executive officers.

Consumer Financial Protection

The Company is subject to a number of federal and state consumer protection laws that extensively govern its relationship with its customers. These laws include the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Truth in Lending Act, the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Home Mortgage Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Fair Debt Collection Practices Act, the Service Members Civil Relief Act, laws governing flood insurance, federal and state laws prohibiting unfair and deceptive business practices, foreclosure laws ,and various regulations that implement some or all of the foregoing. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must deal with customers when taking deposits, making loans, collecting loans and providing other services. If the Company fails to comply with these laws and regulations, it may be subject to various penalties. Failure to comply with consumer protection requirements may also result in failure to obtain any required bank regulatory approval for merger or acquisition transactions the Company may wish to pursue or being prohibited from engaging in such transactions even if approval is not required.

The Dodd-Frank Act centralized responsibility for consumer financial protection by creating a new agency, the CFPB, and giving it responsibility for implementing, examining, and enforcing compliance with federal consumer protection laws. The CFPB focuses on (i) risks to consumers and compliance with the federal consumer financial laws, (ii) the markets in which firms operate and risks to consumers posed by activities in those markets, (iii) depository institutions that offer a wide variety of consumer financial products and services, and (iv) non-depository companies that offer one or more consumer financial products or services. The CFPB has broad rule making authority for a wide range of consumer financial laws that apply to all banks, including, among other things, the authority to prohibit “unfair, deceptive or abusive” acts and practices. Abusive acts or practices are defined as those that materially interfere with a consumer’s ability to understand a term or condition of a consumer financial product or service or take unreasonable advantage of a consumer’s (i) lack of financial savvy, (ii) inability to protect himself in the selection or use of consumer financial

9

Table of Contents

products or services, or (iii) reasonable reliance on a covered entity to act in the consumer’s interests. The CFPB can issue cease-and-desist orders against banks and other entities that violate consumer financial laws. The CFPB may also institute a civil action against an entity in violation of federal consumer financial law in order to impose a civil penalty or injunction.

Community Reinvestment Act

The CRA requires the appropriate federal banking agency, in connection with its examination of a bank, to assess the bank’s record in meeting the credit needs of the communities served by the bank, including low and moderate income neighborhoods. Furthermore, such assessment is also required of banks that have applied, among other things, to merge or consolidate with or acquire the assets or assume the liabilities of an insured depository institution, or to open or relocate a branch. In the case of a BHC applying for approval to acquire a bank or BHC, the record of each subsidiary bank of the applicant BHC is subject to assessment in considering the application. Under the CRA, institutions are assigned a rating of “outstanding,” “satisfactory,” “needs to improve,” or “substantial non-compliance.” The Company was rated “outstanding” in its most recent CRA evaluation.

Anti-Money Laundering Legislation

The Company is subject to the Bank Secrecy Act and other anti-money laundering laws and regulations, including the USA Patriot Act of 2001. Among other things, these laws and regulations require the Company to take steps to prevent the use of the Company for facilitating the flow of illegal or illicit money, to report large currency transactions, and to file suspicious activity reports. The Company is also required to carry out a comprehensive anti-money laundering compliance program. Violations can result in substantial civil and criminal sanctions. In addition, provisions of the USA Patriot Act require the federal bank regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and BHC acquisitions.

Privacy Legislation

Several recent laws, including the Right to Financial Privacy Act, and related regulations issued by the federal bank regulatory agencies, also provide new protections against the transfer and use of customer information by financial institutions. A financial institution must provide to its customers information regarding its policies and procedures with respect to the handling of customers’ personal information. Each institution must conduct an internal risk assessment of its ability to protect customer information. These privacy provisions generally prohibit a financial institution from providing a customer’s personal financial information to unaffiliated parties without prior notice and approval from the customer.

Incentive Compensation

In June 2010, the federal bank regulatory agencies issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of financial institutions do not undermine the safety and soundness of such institutions by encouraging excessive risk-taking. The Interagency Guidance on Sound Incentive Compensation Policies, which covers all employees that have the ability to materially affect the risk profile of a financial institutions, either individually or as part of a group, is based upon the key principles that a financial institution’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the institution’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the financial institution’s board of directors.

The OCC will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of financial institutions, such as the Bank, that are not “large, complex banking organizations.” These reviews will be tailored to each financial institution based on the scope and complexity of the institution’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the institution’s supervisory ratings, which can affect the institution’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a financial institution if its incentive compensation arrangements, or related risk-management control or governance processes, pose

10

Table of Contents

a risk to the institution’s safety and soundness and the financial institution is not taking prompt and effective measures to correct the deficiencies. At December 31, 2017, the Company had not been made aware of any instances of non-compliance with the final guidance.

Volcker Rule

The Volcker Rule under the Dodd-Frank Act prohibits banks and their affiliates from engaging in proprietary trading and investing in and sponsoring hedge funds and private equity funds. The Volcker Rule, which became effective in July 2015, does not significantly impact the operations of the Company or the Bank, as they do not have any significant engagement in the businesses prohibited by the Volcker Rule.

Ability-to-Repay and Qualified Mortgage Rule

Pursuant to the Dodd-Frank Act, the CFPB issued a final rule on January 10, 2013 (effective on January 10, 2014), amending Regulation Z as implemented by the Truth in Lending Act, requiring mortgage lenders to make a reasonable and good faith determination based on verified and documented information that a consumer applying for a mortgage loan has a reasonable ability to repay the loan according to its terms. Mortgage lenders are required to determine consumers’ ability to repay in one of two ways. The first alternative requires the mortgage lender to consider the following eight underwriting factors when making the credit decision: (i) current or reasonably expected income or assets; (ii) current employment status; (iii) the monthly payment on the covered transaction; (iv) the monthly payment on any simultaneous loan; (v) the monthly payment for mortgage-related obligations; (vi) current debt obligations, alimony, and child support; (vii) the monthly debt-to-income ratio or residual income; and (viii) credit history. Alternatively, the mortgage lender can originate “qualified mortgages,” which are entitled to a presumption that the creditor making the loan satisfied the ability-to-repay requirements. In general, a “qualified mortgage” is a mortgage loan without negative amortization, interest-only payments, balloon payments, or terms exceeding 30 years. In addition, to be a qualified mortgage the points and fees paid by a consumer cannot exceed 3% of the total loan amount. Qualified mortgages that are “higher-priced” (e.g. subprime loans) garner a rebuttable presumption of compliance with the ability-to-repay rules, while qualified mortgages that are not “higher-priced” (e.g. prime loans) are given a safe harbor of compliance.

Cybersecurity

In March 2015, federal regulators issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack. If the Company fails to observe the regulatory guidance, it could be subject to various regulatory sanctions, including financial penalties.

Effect of Governmental Monetary Policies

The Company’s operations are affected not only by general economic conditions, but also by the policies of various regulatory authorities. In particular, the FRB regulates money and credit conditions and interest rates to influence general economic conditions. These policies have a significant impact on overall growth and distribution of loans, investments and deposits; they affect interest rates charged on loans or paid for time and savings deposits. FRB monetary policies have had a significant effect on the operating results of commercial banks, including the Company, in the past and are expected to do so in the future. As a result, it is difficult for the Company to predict the potential effects of possible changes in monetary policies upon its future operating results.

11

Table of Contents