UNITED STATES SECURITIES AND EXCHANGE COMMISSION

Codorus Valley Bancorp, Inc.

Form 10-K Index

CAUTIONARY NOTE REGARDING FORWARD-LOOKING STATEMENTS AND SUMMARY OF RISK FACTORS

Forward-looking Statements

This Annual Report on Form 10-K may contain forward-looking statements by Codorus Valley Bancorp, Inc. (the “Corporation”). Forward-looking statements may include information concerning the financial condition, results of operations and business of the Corporation and its subsidiaries and include, but are not limited to, statements regarding expectations or predictions of future financial or business performance or conditions relating to the Corporation and its operations. These forward-looking statements may include statements with respect to the Corporation’s beliefs, plans, objectives, goals, expectations, anticipations, estimates and intentions, that are subject to significant risks and uncertainties, and are subject to change based on various factors (some of which are beyond the Corporation’s control). Forward-looking statements may also include, but are not limited to, discussions of strategy, financial projections and estimates and their underlying assumptions, statements regarding plans, objectives, goals, expectations or consequences, and statements about future performance, expenses, operations, or products and services of the Corporation and its subsidiaries. Forward-looking statements can be identified by the use of words such as “may,” “should,” “will,” “could,” “believes,” “plans,” “expects,” “estimates,” “intends,” “anticipates,” “strives to,” “seeks,” ”intends,” “anticipates” or similar words or expressions.

Forward-looking statements are not historical facts, nor should they be relied upon as providing assurance of future performance. Forward-looking statements are based on current beliefs, expectations and assumptions regarding the future of the Corporation’s business, future plans and strategies, projections, anticipated events and trends, the economy and other future conditions. Because forward-looking statements relate to the future, they are subject to inherent uncertainties, risks, and changes in circumstances that are difficult to predict and many of which are outside of the Corporation’s control. Note that many factors, some of which are discussed elsewhere in this report and in the documents that are incorporated by reference, could affect the future financial results of the Corporation and its subsidiaries, both individually and collectively, and could cause those results to differ materially from those expressed in the forward-looking statements contained or incorporated by reference in this Form 10-K. Actual results could differ materially from those indicated in forward-looking statements due to, among others, the following factors:

changes in market interest rates and the persistence of the current inflationary environment in the U.S. and our market areas and the potential for an economic downturn or recession;

legislative and regulatory changes, and the uncertain impact of new laws and regulations;

monetary and fiscal policies of the federal government;

the effects of changes in accounting policies and practices;

ineffectiveness of the Corporation’s business strategy due to changes in current or future market conditions; changes in deposit flows, the cost of funds, demand for loan products and the demand for financial services;

the effects of the COVID-19 pandemic, including on the Corporation’s credit quality and operations as well as its impact on general economic conditions;

competition; market volatility, market downturns, changes in consumer behavior, business closures;

adverse changes in the quality or composition of the Corporation’s loan, investment and mortgage-backed securities portfolios, including from the effects of the current inflationary environment;

geographic concentration of the Corporation’s business;

deterioration of commercial real estate values;

the adequacy of loan loss reserves and the Corporation’s transition to the Current Expected Credit Loss (CECL) method of reserving for losses in its loan portfolio;

deterioration in the credit quality of borrowers;

the Company’s ability to attract and retain key personnel;

the impact of operational risks, including the risk of human error, failure or disruption of internal processes and systems, including of the Corporation’s information and other technology systems;

uncertainty surrounding the transition from LIBOR to an alternate reference rate;

failure or circumvention of our internal controls;

the Corporation’s ability to keep pace with technological changes;

breaches of security or failures of the Corporation to identify and adequately address cybersecurity and data breaches;

changes in government regulation and supervision and the potential for negative consequences resulting from regulatory examinations, investigations and violations;

the effects of adverse outcomes from claims and litigation;

occurrence of natural or man-made disasters or calamities, including health emergencies, the spread of infectious diseases, epidemics or pandemics, an outbreak or escalation of hostilities or other geopolitical instabilities, the effects of climate change or extraordinary events beyond the Corporation's control, and the Corporation’s ability to deal effectively with disruptions caused by the foregoing; and

economic, competitive, governmental and technological factors affecting the Corporation’s operations, markets, products, services and fees.

The Corporation does not commit to update or revise any forward-looking statements, whether written or oral, that may be made from time to time by or on behalf of the Corporation to reflect events or circumstances occurring after the date of this report.

Other Recent Developments

In March 2023, certain specialized banking institutions with elevated concentrations of uninsured deposits experienced large deposit outflows, resulting in the institutions being placed into FDIC receiverships. In the aftermath, there has been substantial market disruption and indications that deposit concerns could spread within the banking industry, leading to deposit outflows and other destabilizing results. The Corporation maintains a well-diversified deposit base and has a comparatively low level of uninsured deposits. As of December 31, 2022, 82% of our deposits are estimated to be FDIC-insured, and an additional 6% of deposit were fully collateralized. The average account size of our consumer deposits is less than $18,000, and the average account size of our business deposits is less than $89,000.

Summary of Risk Factors

Our business is subject to a number of risks that could cause actual financial results to differ materially from those indicated in this Form 10-K, including from the cautionary factors referenced in the Forward-Looking Statements herein, or the financial results presented elsewhere from time to time. The risks and uncertainties described below are not the only ones facing the Corporation. Additional risks and uncertainties that we are not aware of or focused on, or that we currently deem immaterial, may also adversely impact our business and results of operations. If any of these known or unknown risks or uncertainties actually occurs, our business, financial condition and results of operations could be materially and adversely affected. If this were to happen, the market price of our common stock could decline significantly, and you could lose all or part of your investment. These risks are discussed more fully in this Item 1A and included, without limitation, the following:

Risks Related to Macroeconomic Conditions

Difficult economic conditions or volatility in the financial markets would likely have an adverse effect on our business, financial position and results of operations.

If the U.S. Congress were not to act favorably on measures to raise the debt ceiling, the U.S. government could default on payment of its debt and other financial obligations. This could lead to a government shutdown and other consequences which could adversely affect the United States economy and financial institutions, including us.

Financial challenges at other banking institutions could lead to depositor concerns that spread within the banking industry causing disruptive deposit outflows and other destabilizing results.

The continuing COVID-19 pandemic has, and may continue to, adversely affect our business, financial condition, liquidity, capital and results of operations.

Risks Related to Market Interest Rates and Inflation

Ourbusinessissubjecttointerestraterisk,andvariationsininterestratesmaymateriallyandadverselyaffect our financial performance.

Inflation can have an adverse impact on our business and on our customers.

Risks Related to our Lending Activities

Our loan portfolio primarily consists of commercial-related loans, including commercial real estate and construction loans. These loans involve credit risks that could adversely affect our financial condition and results of operations.

Our emphasis on real estate loans exposes us to lending risks.

The geographic concentration of our loan portfolio and lending activities makes us vulnerable to a downturn in our local market area.

Our transition to the Current Expected Loss (CECL) method of reserving for losses in our loan portfolio is likely to cause the need for us to increase our reserve for credit losses.

If our allowance for loan losses is not sufficient to cover actual loan losses, our earnings could decrease.

The level of our commercial real estate loan portfolio may subject us to additional regulatory scrutiny.

Nonperforming assets take significant time to resolve, adversely affect our results of operations and financial condition, and could result in further losses in the future.

We engage in lending secured by real estate and may foreclose on the collateral and own the underlying real estate, subjecting us to the costs and potential risks associated with the ownership of real property, or consumer protection initiatives or changes in state or federal law may substantially raise the cost of foreclosure or prevent us from foreclosing at all.

We are exposed to the risk of environmental liability associated with lending activities or properties we own.

We are required to transition from the use of the LIBOR interest rate index in the future.

Risks related to Liquidity

Wearesubjecttoliquidityrisk,whichcouldadverselyaffectourfinancialconditionandresultsof operations.

Risks Related to Competitive Matters

Strong competition within our market areas may limit our growth and profitability.

Our asset size may make it more difficult for us to compete.

Risks Related to Laws and Regulations

Changes in laws and regulations and the cost of regulatory compliance with new laws and regulations may adversely affect our operations and/or increase our costs of operations and/or decrease our revenues.

Non-compliance with the USA PATRIOT Act, Bank Secrecy Act, or other laws and regulations could result in fines or sanctions.

The Federal Reserve Board may require us to commit capital resources to support PeoplesBank, and we may not have sufficient access to such capital resources.

Monetary policies and regulations of the Federal Reserve Board could adversely affect our business, financial condition and results of operations.

We may be required to raise additional capital in the future, but that capital may not be available when it is needed, or it may only be available on unacceptable terms, which could adversely affect our financial condition and results of operations.

We qualify as a “smaller reporting company” pursuant to regulations of the Securities and Exchange Commission, and any decision on our part to comply only with certain reduced reporting and disclosure requirements applicable to smaller reporting companies could make our common stock less attractive to investors.

Risks Related to Operational Matters

We face significant operational risks because of our reliance on technology. Our information technology systems may be subject to failure, interruption or security breaches.

We rely on third-party vendors, which could expose us to additional cybersecurity risks.

Thesoundnessofotherfinancialinstitutionscouldadverselyaffectus.

We may be subject to risks and losses resulting from fraudulent activities that could adversely impact our financial performance and results of operations.

Risks Related to Accounting Matters

Changes in accounting standards could affect our reported earnings.

Changes in management’s estimates and assumptions may have a material impact on our consolidated financial statements and our financial condition or operating results.

Other Risks Related to Our Business

We depend on our management team and other key personnel to implement our business strategy and execute successful operations and we could be harmed by the loss of their services or the inability to hire additional personnel.

Legal and regulatory proceedings and related matters could adversely affect us.

Societal responses to climate change could adversely affect our business and performance, including indirectly through impacts on our customers.

We are a community bank and our ability to maintain our reputation is critical to the success of our business, and the failure to do so may materially adversely affect our performance.

Risks Related to Our Business Strategy

We may not effectively execute on our expansion strategy, which may adversely affect our ability to maintain our historical growth and earnings trends.

We may grow through mergers or acquisitions, including branch acquisitions, a strategy that may not be successful or, if successful, may producerisksinsuccessfullyintegratingandmanagingthemergedcompaniesoracquisitionsandmaydiluteour stockholders.

Risks Related to Our Common Stock

The market price of our common stock may fluctuate significantly, and this may make it difficult for you to resell shares of common stock owned by you at times or at prices you find attractive.

The trading volume of our common stock may not provide adequate liquidity for investors and is less than that of other financial services companies.

We may issue additional common stock or other equity securities in the future which could dilute the ownership interest of existing stockholders.

Offerings of debt and/or preferred equity securities may adversely affect the market price of our common stock.

Our common stock is subordinate to our existing and future indebtedness and preferred stock, if issued, and effectively subordinated to all the indebtedness and other non-common equity claims against our subsidiaries.

Regulatory and contractual restrictions may limit or prevent us from paying dividends or repurchasing shares of our common stock, or we may choose not to pay dividends on or repurchase, our common stock.

If we defer payments of interest on our outstanding subordinated notes or junior subordinated debt securities or if certain defaults relating to those debt securities occur, we will be prohibited from declaring or paying dividends or distributions on, and from making liquidation payments with respect to, our common stock.

Our common stock is not insured by any governmental entity.

Anti-takeover provisions and restrictions on ownership could negatively impact our stockholders.

PART I

Item 1: Business

Codorus Valley Bancorp, Inc. (“Codorus Valley” or the “Corporation”) is a Pennsylvania business corporation, incorporated on October 7, 1986. On March 2, 1987, Codorus Valley became a bank holding company under the Bank Holding Company Act of 1956, as amended. PeoplesBank, A Codorus Valley Company (“PeoplesBank”) is its wholly owned bank subsidiary. The Corporation’s business consists primarily of managing PeoplesBank, and its principal source of income is dividends received from PeoplesBank. The Corporation also wholly-owns one non-bank subsidiary, SYC Realty Co., Inc., a subsidiary for holding certain foreclosed assets pending liquidation. On December 31, 2021,2022, Codorus Valley had total consolidated assets of $2.42$2.20 billion, total deposits and other liabilities of $2.22$2.02 billion, and total shareholders’ equity of $195,505,000.$177,300,000.

Bank Subsidiary

PeoplesBank, organized in 1934, is a Pennsylvania chartered bank that offers a full range of consumer, business, wealth management, and mortgage services at financial centers located in communities throughout South Central Pennsylvania and Central Maryland. In addition to the twenty-fivetwenty-two full service financial centers there areit has six financial centers located primarily within retirement communities that provide a full suite of services on a limited basis. PeoplesBank, with origins dating back to 1864, is focused on acquiring and nurturing financial relationships with small and mid-sized businesses. The Federal Deposit Insurance Corporation insures the deposits of PeoplesBank to the maximum extent provided by law. On December 31, 2021,2022, PeoplesBank had total gross loans of $1.53$1.63 billion, excluding loans held for sale, and total deposits of $2.14$1.94 billion. PeoplesBank had the second largest share of deposits in York County, Pennsylvania, with deposits totaling 14.514.6 percent of the market as of June 30, 2021,2022, the latest available measurement date.

PeoplesBank is not dependent on deposits of, or exposed to a loan concentration to, a single client, or a small group of clients. Therefore, the loss of a single client, or a small client group, would not have a material adverse effect on the financial condition of PeoplesBank. At December 31, 2021,2022, the largest indebtedness of a single PeoplesBank client was approximately $22,880,000$27,192,000 or 1.41.5 percent of the total loan portfolio, which was within PeoplesBank’s regulatory lending limit of $37,890,000.$39,996,000.

Most of the Corporation's business is with clients located within South Central Pennsylvania, principally York and Lancaster Counties and North Central Maryland, principally Harford County Baltimore County and Baltimore City.County. Although this market area may pose a concentration risk geographically, we believe that the diverse local economies and our detailed knowledge of the client base lessens this risk. At December 31, 2022, the Corporation had two industry concentrations that exceeded 10 percent of the total loan portfolio: commercial real estate investor represented 22.5 percent of the portfolio and residential real estate investor represented 16.1 percent of the portfolio. At December 31, 2021, the Corporation had three industry concentrations that exceeded 10 percent of the total loan portfolio: commercial real estate investor represented 21.1 percent of the portfolio, residential real estate investor represented 14.8 percent of the portfolio and builder and developer represented 10.2 percent of the portfolio. At December 31, 2020, the Corporation had two industry concentrations that exceeded 10 percent of the total loan portfolio: residential real estate investor represented 15.4 percent of the portfolio and commercial real estate investor represented 15.3 percent of the portfolio. Loans to borrowers within these industries are usually collateralized by real estate.

Nonbank Subsidiaries of PeoplesBank

PeoplesBank had four wholly-owned nonbank subsidiaries as of December 31, 2021,2022, that were consolidated for financial reporting purposes.

Codorus Valley Financial Advisors, Inc. d/b/a PeoplesWealth Advisors, a subsidiary that sells non-deposit investment products, began operations in January 2000, and previously operated as SYC Insurance Services, Inc. until the change to the current name in December 2005.

Periodically, PeoplesBank creates nonbank subsidiaries for the purpose of temporarily holding certain foreclosed assets pending liquidation. On December 31, 2021,2022, none of the three of these foreclosed asset subsidiaries was active.

Nonbank Subsidiaries of Codorus Valley Bancorp, Inc.

In 2006, Codorus Valley formed CVB Statutory Trust No. 2, a wholly-owned special purpose subsidiary whose sole purpose was to facilitate a pooled trust preferred debt issuance of $7,217,000. In 2004, Codorus Valley formed CVB

Statutory Trust No. 1 to facilitate a pooled trust preferred debt issuance of $3,093,000. The Corporation owns 100 percent of the common stock of these nonbank subsidiaries, which are not consolidated for financial reporting purposes. These obligations are reported as junior subordinated debt on the Corporation’s balance sheet.

In 1991, SYC Realty Co., Inc. was incorporated as a wholly owned subsidiary of Codorus Valley, and originally commenced operations in October 1995. Codorus Valley created this nonbank subsidiary primarily for the purpose of holding certain foreclosed properties obtained by PeoplesBank pending liquidation of those properties. SYC Realty was inactive during the entire reporting period of 2021.2022.

Human Capital Resources

At year-end 2021,2022, PeoplesBank employed 327315 full-time employees and 1824 part-time employees, which equated to approximately 328332 full-time equivalent employees, calculated on an hourly basis. Employees are not covered by a collective bargaining agreement, and PeoplesBank considers its relations with employees to be satisfactory. The Corporation monitors employee turnover as a critical measure of success and reported 25.524.9 percent and 18.925.5 percent employee turnover as of December 31, 20212022 and December 31, 2020,2021, respectively.

Segment Reporting

Management has determined that it operates in only one segment, community banking. The Corporation’s non-banking activities are not significant to the consolidated financial statements.

Competition

The banking industry in PeoplesBank’s service area, South Central Pennsylvania (principally, York and Lancaster Counties), and North Central Maryland (principally, Baltimore County, Baltimore City and Harford County), is highly competitive. PeoplesBank competes through service and price, and by leveraging its hometown image. It competes with commercial banks and other financial service providers, such as thrifts, credit unions, consumer finance companies, investment firms and mortgage companies. Some financial service providers operating in PeoplesBank’s service area operate on a national and regional scale and possess resources that are greater than PeoplesBank’s.

Supervision and RegulationSUPERVISION AND REGULATION

General

The Corporation is subject to extensive regulation under federal and Pennsylvania banking laws, regulations and policies, including prescribed standards relating to capital, earnings, dividends, the repurchase or redemption of shares, loans or extensions of credit to affiliates and insiders, internal controls, information systems, internal audit processes, loan documentation, credit underwriting, asset growth, impaired assets, and loan-to-value ratios. The bank regulatory framework is intended primarily for the protection of depositors, federal deposit insurance funds and the banking systems as a whole, and not for the protection of security holders.

The following summary sets forth certain of the material elements of the regulatory framework applicable to bank holding companies and their bank subsidiaries and provides certain specific information about Codorus Valley and PeoplesBank. It does not describe all of the provisions of the statutes, regulations and policies that are identified. To the extent that the following information describes statutory and regulatory provisions, it is qualified in its entirety by express reference to each of the particular statutory and regulatory provisions. A change in applicable statutes, regulations or regulatory policy may have a material effect on the business of the Corporation.

Bank Holding Company Regulations

Codorus Valley is registered as a bank holding company under the Bank Holding Company Act of 1956 (the “BHCA”) and is subject to regulation and supervision by the Board of Governors of the Federal Reserve System (“Federal Reserve”(the “Federal Reserve Board”), under and by the Bank Holding Company ActPennsylvania Department of 1956, as amended.Banking and Securities (the “PADOBS”). The Bank Holding Company Act requires bank holding companies to file periodic reportsCorporation files annually a report of its operations with, and subjects themis subject to examination by, the Federal Reserve. Reserve Board and the PADOBS. This regulation and oversight is generally intended to ensure that the Corporation limits its activities to those allowed by law and that it operates in a safe and sound manner without endangering the financial health of PeoplesBank.

The common stock of the Corporation is registered with the Securities and Exchange Commission (the “SEC”) under the Securities Exchange Act of 1934. The Corporation is subject to the proxy and tender offer rules, insider trading reporting requirements and restrictions, and certain other requirements of the Securities Exchange Act of 1934. The Corporation’s common stock is listed on the NASDAQ Global Market under the symbol “CVLY.” The NASDAQ Stock Market listing requirements impose additional requirements on the Corporation, including, among other things, rules relating to corporate governance and the composition and independence of its Board of Directors and various committees of the Board, such as the audit committee.

PeoplesBank is a Pennsylvania-chartered bank subject to extensive regulation and examination by the PADOBS and the Federal Deposit Insurance Corporation (the “FDIC”), and to certain requirements established by the Federal Reserve has issuedBoard. The federal and state laws and regulations which are applicable to banks regulate, among other things, the scope of their business, their investments, their reserves against deposits, the payment of dividends, the timing of the availability of deposited funds and the nature and amount of and collateral for certain loans. There are periodic examinations by the PADOBS and the FDIC to test PeoplesBank’s compliance with various regulatory requirements. This regulation and supervision establishes a comprehensive framework of activities in which an institution can engage and is intended primarily for the protection of the FDIC insurance fund and depositors. The regulatory structure also gives the regulatory authorities extensive discretion in connection with their supervisory and enforcement activities and examination policies, including policies with respect to the classification of assets and establishment of adequate loan loss reserves for regulatory purposes. Any change in such regulation, whether by the PADOBS, the FDIC, the Federal Reserve Board or the U.S. Congress could have a material adverse impact on the Corporation and PeoplesBank and their respective operations.

Federal law provides the federal banking regulators, including the FDIC and the Federal Reserve Board, with substantial enforcement powers. This enforcement authority includes, among other things, the ability to assess civil

money penalties, to issue cease-and-desist or removal orders, and to initiate injunctive actions against banking organizations and institution-affiliated parties, as defined. In general, these enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices. Other actions or inactions may provide the basis for enforcement action, including misleading or untimely reports filed with regulatory authorities.

Certain of the regulatory requirements that are applicable to the Corporation and PeoplesBank are described below. This description of statutes and regulations is not intended to be a complete explanation of such statutes and regulations and their effects on the Corporation and PeoplesBank and is qualified in its entirety by reference to the actual statutes and regulations.

2018 Regulatory Reform

In May 2018 the Economic Growth, Regulatory Relief and Consumer Protection Act (the “2018 Act”), was enacted to modify or remove certain financial reform rules and regulations, including some of those implemented under the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”) enacted in 2010. While the 2018 Act maintains most of the regulatory structure established by the Dodd-Frank Act, it amends certain aspects of the regulatory framework for small depository institutions with assets of less than $10 billion and for large banks with assets of more than $50 billion. Many of these changes resulted in meaningful regulatory relief for community banks such as PeoplesBank.

The 2018 Act, among other matters, expanded the definition of “qualified mortgages” which may be held by a financial institution and simplifies the regulatory capital rules for financial institutions and their holding companies with total consolidated assets of less than $10 billion by instructing the federal banking regulators to establish a single “Community Bank Leverage Ratio” of between 8 and 10 percent to replace the leverage and risk-based regulatory capital ratios. The 2018 Act also expanded the category of holding companies that may rely on the “Small Bank Holding Company and Savings and Loan Holding Company Policy Statement” (the “SBHC Policy”) by raising the maximum amount of assets a qualifying holding company may have from $1 billion to $3 billion. This expansion also excluded such holding companies from the minimum capital requirements of the Dodd-Frank Act. In addition, the 2018 Act included regulatory relief for community banks regarding regulatory examination cycles, call reports, the Volcker Rule (proprietary trading prohibitions), mortgage disclosures and risk weights for certain high-risk commercial real estate loans.

Regulation of the Corporation

Bank Holding Company Act that requireActivities and Other Limitations. Under the BHCA, the Corporation must obtain the prior approval of the Federal Reserve Board before it may acquire control of another bank or bank holding company, merge or consolidate with another bank holding company, acquire all or substantially all of the assets of another bank or bank holding company, or acquire direct or indirect ownership or control of any voting shares of any bank or bank holding company if, after such acquisition, the Corporation would directly or indirectly own or control more than 5% of such shares.

Federal statutes impose restrictions on the ability of a bank holding company and its nonbank subsidiaries to obtain extensions of credit from its subsidiary bank, on the subsidiary bank’s investments in the stock or securities of the holding company, and on the subsidiary bank’s accepting the holding company’s stock or securities as collateral for loans to any borrower. A bank holding company and its subsidiaries are also prevented from engaging in certain so-called “tie-in” arrangements in connection with any extension of credit, lease or sale of property, or furnishing of services by the subsidiary bank.

A bank holding company is required to serve as a source of financial and managerial strength to its subsidiary banks. As a result,banks and may not conduct its operations in an unsafe or unsound manner. In addition, it has been the policy of the Federal Reserve may require Codorus ValleyBoard that a bank holding company should stand ready to use itsavailable resources to provide adequate capital funds to PeoplesBankits subsidiary banks during periods of financial stress or adversity.

The Bank Holding Company Act prohibits Codorus Valley from acquiring directadversity and should maintain the financial flexibility and capital-raising capacity to obtain additional resources for assisting its subsidiary banks. A bank holding company’s failure to meet its obligations to serve as a source of strength to its subsidiary banks will generally be considered by the Federal Reserve Board to be an unsafe and unsound banking practice or indirect control of more than 5 percenta violation of the outstanding voting stock of any bank,Federal Reserve Board regulations, or substantially all of the assets of any bank, or merging withboth. The Dodd-Frank Act included a provision that directs federal regulators to require depository

another bank holding company, without the prior approval of the Federal Reserve. The Pennsylvania Department of Banking and Securities must also approve certain similar transactions. Pennsylvania law permits Pennsylvania bankinstitution holding companies to control an unlimited numberserve as a source of banks.strength for their depository institution subsidiaries. To date, no regulations have been promulgated to implement that provision.

Non-Banking Activities.

The Bank Holding Company Act restricts Codorus Valley tobusiness activities that the Federal Reserve has found to be closely related to banking, and which are expected to produce benefits for the public that will outweigh any potentially adverse effects. Therefore, the Bank Holding Company Act prohibits Codorus Valley from engaging in most nonbanking businesses, or acquiring ownership or control of more than 5 percent of the outstanding voting stock of any company engaged in a nonbanking business, unless the Federal Reserve has determined that the nonbanking business is closely related to banking. Under the Bank Holding Company Act, the Federal Reserve may requireCorporation, as a bank holding company, to end a nonbanking business if it constitutes a serious risk toare restricted by the financial soundnessBHCA. Under the BHCA and stability of any bank subsidiary of the Federal Reserve Board’s bank holding company.company regulations, bank holding companies may only engage in, or acquire or control voting securities or assets of a company engaged in:

banking or managing or controlling banks and other subsidiaries authorized under the BHCA; and

any BHCA activity the Federal Reserve Board has determined to be so closely related that it is incidental to banking or managing or controlling banks.

The Federal Reserve Act imposes restrictionsBoard has determined by regulation that certain activities are closely related to banking including operating a mortgage company, finance company, credit card company, factoring company, trust company or savings association; performing certain data processing operations; providing limited securities brokerage services; acting as an investment or financial advisor; acting as an insurance agent for certain types of credit-related insurance; leasing personal property on a subsidiary bank offull-payout, non-operating basis; providing tax planning and preparation services; operating a collection agency; and providing certain courier services. Moreover, as discussed below, certain other activities are permissible for a bank holding company suchthat becomes a financial holding company.

Financial Holding Companies. Bank holding companies may also engage in a broad range of activities under a regulatory designation known as PeoplesBank.a “financial holding company.” A financial holding company essentially is a bank holding company with significantly expanded powers. Financial holding companies are authorized by statute to engage in a number of financial activities previously impermissible for bank holding companies, including securities underwriting, dealing and market making; sponsoring mutual funds and investment companies; insurance underwriting and agency; and merchant banking activities. The restrictions affect extensionsFederal Reserve Board and the Department of creditthe Treasury are also authorized to permit additional activities for financial holding companies if the activities are “financial in nature” or “incidental” to financial activities. A bank holding company may become a financial holding company if each of its subsidiary banks is “well-capitalized”, “well-managed”, and has at least a “satisfactory” Community Reinvestment Act rating. A financial holding company must provide notice to the Federal Reserve Board within 30 days after commencing activities determined by statute or by the Federal Reserve Board and the Department of the Treasury to be permissible for financial holding companies. The Corporation has not commenced any such activities, or submitted such notices, however, it is not precluded from doing so in the future.

Regulatory Capital Requirements. The Federal Reserve Board has adopted capital adequacy guidelines pursuant to which it assesses the adequacy of capital in examining and supervising a bank holding company and its subsidiaries, investments in analyzing applications under the stock or other securitiesBHCA. The Federal Reserve Board’s capital adequacy guidelines for a bank holding company, on a consolidated basis, are similar to those imposed on PeoplesBank by the FDIC. See “-Regulation of PeoplesBank - Capital Requirements” below. Moreover, certain of the bank holding company and its subsidiaries, and taking such stock or securities as collateral for loans.

The Federal Reserve Act and Federal Reserve regulations also place limitations and reportingcapital requirements on extensions of creditpromulgated by a bank to the principal shareholders of its parent holding company, among others, and to related interests of such principal shareholders. In addition, such legislation and regulation may affect the terms upon which any person becoming a principal shareholder of a holding company may obtain credit from banks with which the subsidiary bank maintains a correspondent relationship.

PeoplesBank and the banking industry, in general, are affected by the monetary and fiscal policies of the U.S. Treasury and government agencies, including the Federal Reserve. Through open market securities transactions, and changes in its federal funds and discount rates and reserve requirements, the Federal Reserve exerts considerable influence overBoard in 2013 became effective as of January 1, 2017. Those requirements establish four minimum capital ratios that the cost and availabilityCorporation had to comply with as of funds for lending and investment.

Regulation of PeoplesBank

PeoplesBank is a Pennsylvania chartered bank that is not a member ofdate as set forth in the table below. However, in May 2016, amendments to the Federal Reserve System, and its depositsBoard’s SBHC Policy became effective which increased the asset threshold to qualify to utilize the provisions of the SBHC Policy from $500 million to $1.0 billion. Subsequently, as part of the 2018 Act, the threshold was increased to $3.0 billion. Bank holding companies which are insured (up to applicable limits) by the Federal Deposit Insurance Corporation (“FDIC”). Accordingly, PeoplesBank’s primary federal regulator is the FDIC, and PeoplesBank is subject to the extensive regulation and examination by the FDIC and the Pennsylvania Department of Banking and Securities.

State and federal banking laws and regulations govern such things as: the scope of a bank’s business; permissible investments; the reserves against deposits a bank must maintain; the types and terms of loans a bank may make and the collateral it may take; the activities of a bank with respect to mergers and consolidations; the establishment of branches; and the sale of non-deposit investment products by the bank and its subsidiaries.

As the primary federal regulator of PeoplesBank, the FDIC regularly examines banks in such areas as capital, asset quality, management, earnings, liquidity and sensitivity to market risk and other aspects of operations and requires that PeoplesBank furnish annual and quarterly reports. Examinations by the FDICSBHC Policy are designed for the protection of PeoplesBank’s depositors rather than Codorus Valley’s shareholders. The FDIC provides deposit insurance to banks, which covers all deposit accounts. The standard maximum insurance amount is $250,000 per depositor.

Effective January 1, 2012, PeoplesBank becamenot subject to FDIC regulation 363.3(b), which requires depository institutionscompliance with the regulatory capital requirements set forth in the table below until they exceed $3.0 billion in assets. As a consequence, as of December 31, 2022, the Corporation was not required to comply with the requirements set forth below and will not be subject to such requirements until such time that its consolidated total assets of $1exceed $3.0 billion or morethe Federal Reserve Board determines that the Corporation is no longer deemed to engage an independent public accountant to examine, attest to, and report onbe a small bank holding company. However, if the assertion of management concerning the institution’s internal control structure and procedures for financial reporting.

The Pennsylvania Insurance Department, the Securities and Exchange Commission (“SEC”) and the Financial Industry Regulatory Authority (“FINRA”) control and supervise the licensing and activities of employees engaged in the sale of non-deposit investment products.

Federal Deposit Insurance and Premiums

PeoplesBank pays deposit insurance premiumsCorporation had been subject to the FDIC based on a risk-based assessment formula established by the FDIC for Deposit Insurance Fund (DIF) member institutions. The amount each institution is assessed is basedrequirements, it would have been in compliance with such requirements.

uponThe Tier 1 Leverage Capital requirement is calculated as a varietypercentage of factors that include the level oftotal assets and tangible equity, and the conditionother three capital requirements are calculated as a percentage of PeolesBank (the degree of risk the institution posesrisk-weighted assets. In addition to the insurance fund). PeoplesBank pays an insurance premium intominimum capital requirements, if the DIF basedCorporation’s assets exceed $3.0 billion, to avoid becoming subject to restrictions on capital distributions and certain discretionary bonus payments to management, the Corporation would be required to also maintain a regulatory defined assessment calculation. Capital Conservation Buffer of at least 2.50%, consisting of Common Equity Tier 1 Capital to risk-weighted assets. For a more detailed discussion of the capital rules, see “Regulatory Capital Regulations” under “Regulation of PeoplesBank” below.

Restrictions on Dividends and Share Repurchases. The FDIC uses a risk-based premium system that assesses higher rates on those institutions that pose greater risksCorporation’s ability to the DIF. Institutions are classified into one of four risk categoriesdeclare and pay premiums according to perceived risk to the FDIC’s DIF. PeoplesBank has consistently been a risk category I institution, the least risky category. Institutionsdividends may depend in risk categories II, III and IV are assessed premiums at progressively higher rates.

The FDIC is required under the Dodd-Frank Act to establish assessment rates that will allow the DIF to achieve a reserve ratio of 1.35 percent of Insurance Fund insured deposits by September 2020. In addition, the FDIC has established a “designated reserve ratio” of 2 percent, a target ratio that, until it is achieved, will not likely result in the FDIC reducing assessment rates. In attempting to achieve the mandated 1.35 percent ratio, the FDIC is required to implement assessment formulas that charges banks over $10 billion in asset size more than banks under that size. These new formulas did not affect PeoplesBank as it was less than $10 billion in total asset size.

During the third quarter of 2019, PeoplesBankpart on dividends received notification of small bank assessment credits, which were fully utilized as of December 31, 2019.

Dividend Restrictions

The Corporation is a legal entity separate and distinct from PeoplesBank. Declaration and payment of cash dividends by the Corporation depends upon cash dividend payments to the Corporation by PeoplesBank, which is the Corporation’s primary source of revenue and cash flow. Accordingly, the right of the Corporation, and consequently the right of our creditors and shareholders, to participate in any distribution of the assets or earnings of any subsidiary is necessarily subject to the prior claims of creditors of the subsidiary, except to the extent that claims of the Corporation in its capacity as a creditor may be recognized.

As a Pennsylvania chartered bank, PeoplesBank is subject to regulatory restrictions on the payment and amounts of dividends under theThe Pennsylvania Banking Code of 1965 as amended. Further,regulates the abilitydistribution of banking subsidiariesdividends by banks and states, in part, that dividends may be declared and paid out of accumulated net earnings, provided that the bank continues to meet its surplus requirements. In addition, dividends may not be declared or paid if PeoplesBank is in default in payment of any assessment due the FDIC.

A Federal Reserve Board policy statement on the payment of cash dividends states that a bank holding company should pay cash dividends only to the extent that the holding company’s net income for the past year is sufficient to cover both the cash dividends and a rate of earnings retention that is consistent with the holding company’s capital needs, asset quality and overall financial condition. The Federal Reserve Board’s policy statement also provides that it would be inappropriate for a company experiencing serious financial problems to borrow funds to pay dividends. Furthermore, under the federal prompt corrective action regulations, the Federal Reserve Board may prohibit a bank holding company from paying any dividends if the holding company’s bank subsidiary is classified as “undercapitalized.” See “-Regulation of PeoplesBank - Prompt Corrective Action” below.

Section 225.4(b)(1) of Regulation Y promulgated by the Federal Reserve Board requires that a bank holding company that is not “well-capitalized” or “well-managed”, or that is subject to any unresolved supervisory issues, provide prior notice to the Federal Reserve Board for any repurchase or redemption of its equity securities for cash or other value that would reduce by 10 percent or more the bank holding company’s consolidated net worth aggregated over the preceding 12-month period. The Federal Reserve Bank may disapprove such a purchase or redemption if it determines that the proposal would constitute an unsafe or unsound practice or would violate any law, regulation, Federal Reserve Board order or any condition imposed by, or written agreement with, the Federal Reserve Board. As of December 31, 2022, neither the Corporation nor PeoplesBank were subject to any supervisory restrictions on their respective ability to pay dividends.

Federal Securities Laws and the Sarbanes-Oxley Act. The Corporation’s common stock is registered with the SEC under Section 12(b) of the Securities Exchange Act of 1934. The Corporation is subject to the proxy and tender offer rules, insider trading reporting requirements and restrictions, and certain other requirements under the Securities Exchange Act of 1934.

As a public company, the Corporation is also subject to their profitability, financial condition, capital expenditures and other cash flow requirements.

The payment of dividends by PeoplesBank and the Corporation may also be affected by other factors, such as the requirement to maintain adequate capital above regulatory guidelines. The federal banking agencies have indicated that paying dividends that deplete a depository institution’s capital base to an inadequate level would be an unsafe and unsound banking practice. Under the Federal Deposit Insurance Corporation Improvement Act of 1991, a depository institution may not pay any dividend if payment would cause it to become undercapitalized or if it is already undercapitalized. Moreover, the federal agencies have issued policy statements that provide that bank holding companies and insured banks should generally only pay dividends out of current operating earnings. Federal banking regulators have the authority to prohibit banks and bank holding companies from paying a dividend if the regulators deem such payment to be an unsafe and unsound practice. More information about dividend restrictions and capital requirements can be found in Note 9 – Regulatory Matters, to the consolidated financial statements.

Other Laws and Regulations Affecting the Corporation and PeoplesBank

Cybersecurity The federal banking agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a financial institution’s board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services. The federal banking agencies expect financial institutions to establish lines of defense and ensure that their risk management processes also address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack. If the Corporation or the Bank fails to meet the expectations set forth in this regulatory guidance, the Corporation or the Bank could be subject to various regulatory actions and any remediation efforts may require significant resources of the Corporation or the Bank. In addition, all federal and state banking agencies continue to increase focus on cybersecurity programs and risks as part of regular supervisory exams.

In October 2016, the federal banking agencies issued proposed rules on enhanced cybersecurity risk-management and resilience standards that would apply to very large financial institutions and to services provided by third parties to these institutions. The comment period for these proposed rules has closed and a final rule has not been published. Although the proposed rules would apply only to bank holding companies and banks with $50 billion or more in total consolidated assets, these rules could influence the federal banking agencies’ expectations and supervisory requirements for information security standards and cybersecurity programs of smaller financial institutions, such as the Bank.

On November 18, 2021, the federal bank regulatory agencies issued a final rule to improve the sharing of information about cyber incidents that may affect the U.S. banking system. The rule requires a banking organization to notify its primary federal regulator of any significant computer-security incident as soon as possible and no later than 36 hours after the banking organization determines that a cyber incident has occurred. Notification is required for incidents that have materially affected – or are reasonably likely to materially affect – the viability of a banking organization’s operations, its ability to deliver banking products and services, or the stability of the financial sector. In addition, the rule requires a bank service provider to notify affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has materially affected or is reasonably likely to materially affect banking organization customers for four or more hours. Compliance with the final rule is required by May 1, 2022. The Corporation and the Bank are currently assessing the impact of this rule, but do not anticipate any material impact to their respective operations at this time.

Coronavirus Aid, Relief and Economic Security Act (CARES Act) On March 27, 2020, the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) was enacted in response to the COVID-19 pandemic. Since that time banking regulators, the SEC and FASB have all issued additional guidance and clarification on various sections of the CARES Act. Section 4013 of the CARES Act provides the option to not apply ASC 310-40 (TDRs) to a loan modification, related specifically to COVID-19 hardships. Regulators have encouraged financial institutions to work constructively with borrowers in communities and industries affected by COVID-19 using prudent and proactive actions which are in the best interests of the financial institution, the borrower and the economy. The Corporation’s Board of Directors approved a number of options for loan modifications, including interest deferral, full payment deferral, additional extensions of credit, and SBA loan programs (i.e., Economic Injury Disaster Loans, Paycheck Protection Program). As of December 31, 2021 and 2020, the Corporation had remaining loan modifications totaling $35,046,000 and $25,897,000, respectively. The Corporation has been an active participant in the SBA Paycheck Protection Program, with outstanding PPP loans as of December 31, 2021 and 2020 of $24,973,000 and $143,145,000, respectively.

May 2018 Banking Reform Legislation On May 24, 2018, the Economic Growth, Regulatory Relief, and Consumer Protection Act (the “Regulatory Relief Act”), amended certain provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, as well as certain other statutes administered by the federal banking agencies. Some of the key provisions of the Regulatory Relief Act as it relates to community banks and bank holding companies include: (i) designating mortgages held in portfolio and “qualified mortgages” for banks with less than $10 billion in assets, subject to certain documentation and product limitations; (ii) exempting banks with less than $10 billion in assets (and total trading assets and trading liabilities of 5% or less of total assets) from Volcker Rule requirements relating to proprietary trading; (iii) simplifying capital calculations for banks with less than $10 billion in assets by requiring federal banking agencies to establish a community bank leverage ratio of tangible equity to average consolidated assets of not less than 8% or more than 10%, and provide that banks that maintain tangible equity in excess of such ratio will be deemed to be in compliance with risk-based capital and leverage requirements; (iv) assisting smaller banks with obtaining stable funding by providing an exception for reciprocal deposits from FDIC restrictions on acceptance of brokered deposits; (v) raising the eligibility for use of short-form Call Reports from $1 billion to $5 billion in assets; (vi) clarifying definitions pertaining to high volatility commercial real estate loans (HVCRE), which requires higher capital allocations, so that only loans with increased risk are subject to higher risk weightings; and (vii) changing the eligibility for use of the small bank holding company policy statement from institutions with under $1 billion in assets to institutions with under $3 billion in assets.

Section 201 of the Regulatory Relief Act directed the federal banking agencies to develop a community bank leverage ratio (“CBLR”) of not less than 8% and not more than 10% for qualifying community banks and bank holding companies with total consolidated assets of less than $10 billion. Qualifying community banking organizations that exceed the CBLR level established by the agencies, and that elect to be covered by the CBLR framework, will be considered to have met: (i) the generally applicable leverage and risk-based capital requirements under the banking agencies’ capital rules; (ii) the capital ratio requirements necessary to be considered “well capitalized” under the

banking agencies’ prompt corrective action framework in the case of insured depository institutions; and (iii) any other applicable capital or leverage requirements.

On September 17, 2019, the Office of the Comptroller of the Currency, the Board of Governors of the Federal Reserve Board, and the FDIC adopted a rule to implement the provisions of Section 201 of the Regulatory Relief Act. Under the rule, a qualifying community banking organization would be defined as a deposit institution or depository institution holding company with less than $10 billion in assets and specified limited amounts of off-balance sheet exposures, trading assets and liabilities, mortgage servicing assets, and certain temporary difference deferred tax assets. A qualifying community banking organization would be permitted to elect the CBLR framework if its CBLR is greater than 9%. The rule also addresses opting in and opting out of the CBLR framework by a community banking organization, the treatment of a community banking organization that falls below the CBLR requirements, and the effect of various CBLR levels for purposes of the prompt corrective action categories applicable to insured depository institutions. Advanced approaches banking organizations (generally, institutions with $250 billion or more in consolidated assets) are not eligible to use the CBLR framework.

The Company continues to analyze the changes implemented by the Regulatory Relief Act, including the CBLR framework included in the recently adopted rule. The Company does not believe, however, that such changes will materially impact the Company’s business, operations, or financial results.

Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) In July 2010, the Dodd-Frank Act was enacted to improve accountability and transparency in the financial system, to attempt to end “too big to fail” pertaining to large, troubled financial institutions, to protect the American taxpayer by ending governmental bailouts, to protect consumers from abusive financial services practices, and for other purposes. The Dodd-Frank Act is broad and complex legislation that puts in place a sweeping new financial services regime that will have significant regulatory and legal consequences for banks now and for years to come. The effects of the Dodd-Frank Act on the financial services industry will depend, in large part, upon the extent to which regulators exercise the authority granted to them under the Dodd-Frank Act and the approaches taken in implementing regulations. Additional uncertainty regarding the effect of the Dodd-Frank Act exists due to the potential for additional legislative changes to the Dodd-Frank Act. The Corporation, like all financial institutions, has been and will continue to be impacted by the Dodd-Frank Act in the areas of corporate governance, deposit insurance assessments, capital requirements, risk management, stress testing, and regulation under consumer protection laws.

Among other things, the Dodd-Frank Act:

Provides extensive authority to the federal bank regulatory agencies and, in particular, the Federal Reserve, to take proactive steps to reduce or eliminate threats to the safety of the financial system, impose strict controls on large bank holding companies ($50 billion or more) and nonbank financial companies to limit their risk, and take direct control of troubled financial companies considered systemically significant;

Increases bank supervision by restructuring the supervision of holding companies and depository institutions; establishes the equivalent of a prompt corrective action program for large bank holding companies; requires that capital requirements for holding companies be at least as strict as capital requirements for depository institutions; disallows new issuances of trust preferred securities from qualifying for Tier 1 capital treatment; directs federal bank regulators to develop specific capital requirements for holding companies and depository institutions that address activities that pose risk to the financial system, such as significant activities in higher risk areas, or concentrations in assets whose reported values are based on models;

Established the Consumer Financial Protection Bureau as an independent entity within the Federal Reserve System that has assumed responsibility for supervision and enforcement of most consumer protection laws, and has authority to supervise, examine and take enforcement action with respect to depository institutions with more than $10 billion in assets and nonbank mortgage industry participants and other designated nonbank providers of consumer financial services;

Places certain limitations on investment and other activities by depository institutions, holding companies and their affiliates. Expands the coverage of Section 23A of the Federal Reserve Act to include the credit exposure related to additional transactions, including derivatives; and

Significantly increases the regulation of residential mortgage lending and servicing by banks and nonbanks by requiring, among other things, mortgage originators to ensure that the consumer will have the capacity to repay the loan; and requires mortgage loan securitizers to retain a certain amount of risk, unless the mortgages conform to the new regulatory standards as qualified residential mortgages.

Sarbanes-Oxley Act of 2002 The Sarbanes-Oxley Act (“SOA”) was signed into law in July 2002 and applies, which is applicable to all companies, both U.S. and non-U.S,non-U.S., that file periodic reports under the Securities Exchange Act of 1934. The stated goals of the SOA were to increase corporate responsibility, to provide for enhanced penalties for accounting and auditing improprieties at publicly traded companies and to protect investors by improving the accuracy and reliability of corporate disclosures pursuant to the securities laws. The SEC is responsible for establishing rules to implement various provisions of the SOA. The SOA includes specific disclosure requirements and corporate governance rules, requires the SEC and securities exchanges to adopt extensive additional disclosure, corporate governance and other related rules and mandates further studies of certain issues by the SEC. The SOA represents significant regulation of the accounting profession and corporate governance practices, such as the relationship between a board of directors and management and between a board of directors and its committees. Section 404

As directed by the SOA, the Corporation’s principal executive officer and principal financial officer are required to certify that the Corporation’s quarterly and annual reports do not contain any untrue statement of a material fact. The

rules adopted by the SEC under the SOA have several requirements, including having these officers certify that: they are responsible for establishing, maintaining and regularly evaluating the effectiveness of our internal control over financial reporting; they have made certain disclosures to the Corporation’s auditors and the audit committee of the SOA requires publicly held companies to document, test and certify that theirBoard of Directors about the Corporation’s internal control systemsover financial reporting; and they have included information in the Corporation’s quarterly and annual reports about their evaluation and whether there have been changes in the Corporation’s internal control over financial reporting are effective.

or in other factors that could materially affect the Corporation’s internal control over financial reporting.

On March 12, 2020, the SEC issued a final rule under the final ruling on the proposalSOA – Amendments to the Accelerated Filer and Large Accelerated Filer Definitions. As a result of the amendments, certain low revenue filers will remain obligated to provide a report by management assessing the effectiveness of the Corporation’s internal control over financial reporting (“ICFR”), but willare not requirerequired to provide an attestation report from the Corporation’s independent auditor assessing the effectiveness of the Corporation’s ICFR. The Corporation meets the amended definition and willis not be required to provide an attestation report from its independent auditor assessing the effectiveness of its ICFR. PeoplesBank remains subject to independent auditor attestation under FDIC regulation 363.3(b).

Volcker Rule Regulations. Regulations have been adopted by the federal banking agencies to implement the provisions of the Dodd-Frank Act commonly referred to as the Volcker Rule. The regulations contain prohibitions and restrictions on the ability of financial institutions holding companies and their affiliates to engage in proprietary trading and to hold certain interests in, or to have certain relationships with, various types of investment funds, including hedge funds and private equity funds. However federal regulations exclude from the Volcker Rule restrictions community banks with $10 billion or less in total consolidated assets and total trading assets and liabilities of five percent or less of total consolidated assets. The Corporation qualifies for the exclusion from the Volcker Rule restrictions.

USA Patriot ActLimitations on Transactions with Affiliates. Transactions between insured financial institutions and any affiliate are governed by Sections 23A and 23B of 2001 the Federal Reserve Act. An affiliate of an insured financial institution is any company or entity which controls, is controlled by or is under common control with the insured financial institution. In Octobera bank holding company context, the bank holding company of 2001,an insured financial institution (such as the USA Patriot ActCorporation) and any companies which are controlled by such holding company are affiliates of 2001 was enactedthe insured financial institution. Generally, Section 23A limits the extent to strengthen U.S. law enforcement’swhich the insured financial institution or its subsidiaries may engage in “covered transactions” with any one affiliate to an amount equal to 10% of such institution’s capital stock and surplus, and contains an aggregate limit on all such transactions with all affiliates to an amount equal to 20% of such capital stock and surplus. Section 23B applies to “covered transactions” as well as certain other transactions and requires that all transactions be on terms substantially the same, or at least as favorable to the insured financial institution, as those provided to a non-affiliate. The term “covered transaction” includes the making of loans to, purchase of assets from and issuance of a guarantee to an affiliate and similar transactions. Section 23B transactions also include the provision of services and the intelligence communities’ abilitiessale of assets by an insured financial institution to work cohesivelyan affiliate.

Limitations on Loans to combat terrorismInsiders. Sections 22(g) and (h) of the Federal Reserve Act place restrictions on loans to executive officers, directors and principal stockholders. Under Section 22(h), loans to a director, an executive officer and to a greater than 10% stockholder of an insured financial institution, and certain affiliated interests of either, may not exceed, together with all other outstanding loans to such person and affiliated interests, the insured financial institution’s loans to one borrower limit (generally equal to 15% of the institution’s unimpaired capital and surplus). Section 22(h) also requires that loans to directors, executive officers and principal stockholders be made on terms substantially the same as offered in comparable transactions to other persons unless the loans are made pursuant to a benefit or compensation program that (i) is widely available to employees of the institution and (ii) does not give preference to any director, executive officer or principal stockholder, or certain affiliated interests of either, over other employees of the insured financial institution. Section 22(h) also requires prior board approval for certain loans. In addition, the aggregate amount of extensions of credit by an insured financial institution to all insiders cannot exceed the institution’s unimpaired capital and surplus. Furthermore, Section 22(g) places additional restrictions on loans to executive officers. At December 31, 2022, PeoplesBank was in compliance with the above restrictions.

Regulation of PeoplesBank

Pennsylvania Banking Law. The Pennsylvania Banking Code of 1965 (the “PA Banking Code”) contains detailed provisions governing the organization, location of offices, rights and responsibilities of directors, officers, employees and members, as well as corporate powers, savings and investment operations and other aspects of PeoplesBank and its affairs. The Banking Code delegates extensive rulemaking power and administrative discretion to the PADOBS so

that the supervision and regulation of state-chartered banks may be flexible and readily responsive to changes in economic conditions and in savings and lending practices.

One of the purposes of the PA Banking Code is to provide banks with the opportunity to be competitive with each other and with other financial institutions existing under other Pennsylvania laws and other state, federal and foreign laws. A Pennsylvania bank may locate or change the location of its principal place of business and establish an office anywhere in Pennsylvania, with the prior approval of the PADOBS.

The PADOBS generally examines each bank not less frequently than once every two years. Although the PADOBS may accept the examinations and reports of the FDIC in lieu of its own examination, the present practice is for the PADOBS to alternate conducting examinations with the FDIC. The PADOBS may order any bank to discontinue any violation of law or unsafe or unsound business practice and may direct any director, trustee, officer, attorney or employee of a bank engaged in an objectionable activity, after the PADOBS has ordered the activity to be terminated, to show cause at a hearing before the PADOBS why such person should not be removed.

Insurance of Accounts. The deposits of PeoplesBank are insured to the maximum extent permitted by the Deposit Insurance Fund and are backed by the full faith and credit of the U.S. Government. The Dodd-Frank Act increased deposit insurance on most accounts to $250,000. As insurer, the FDIC is authorized to conduct examinations of, and to require reporting by, insured institutions. It also may prohibit any insured institution from engaging in any activity determined by regulation or order to pose a serious threat to the FDIC. The FDIC also has the authority to initiate enforcement actions against savings institutions.

The FDIC assesses deposit insurance premiums on the assessment base of a depository institution, which is its average total assets reduced by the amount of its average tangible equity. For a small institution (one with assets of less than $10 billion) that has been federally insured for at least five years, effective July 1, 2016, the initial base assessment rate ranges from 3 to 30 basis points, based on the institution’s CAMELS composite and component ratings and certain financial ratios; its leverage ratio; its ratio of net income before taxes to total assets; its ratio of nonperforming loans and leases to gross assets; its ratio of other real estate owned to gross assets; its brokered deposits ratio (excluding reciprocal deposits if the institution is well-capitalized and has a CAMELS composite rating of 1 or 2); its one year asset growth ratio (which penalizes growth adjusted for mergers in excess of 10%); and its loan mix index (which penalizes higher risk loans based on historical industry charge off rates).  The initial base assessment rate is subject to downward adjustment (not below 1.5%) based on the ratio of unsecured debt the institution has issued to its assessment base and to upward adjustment (which can cause the rate to exceed 30 basis points) based on its holdings of unsecured debt issued by other insured institutions. Institutions with assets of $10 billion or more are assessed using a scorecard method.

The FDIC may terminate the deposit insurance of any insured depository institution, including PeoplesBank, if it determines after a hearing that the institution has engaged or is engaging in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, order or any condition imposed by an agreement with the FDIC. It also may suspend deposit insurance temporarily during the hearing process for the permanent termination of insurance if the institution has no tangible capital. If insurance of accounts is terminated, the accounts at the institution at the time of the termination, less subsequent withdrawals, shall continue to be insured for a period of six months to two years, as determined by the FDIC. Management is not aware of any existing circumstances which could result in termination of PeoplesBank’s deposit insurance.

Regulatory Capital Requirements. Unless a community bank qualifies and elects to comply with the community bank leverage ratio requirement described below, federal regulations require FDIC-insured depository institutions to meet several minimum capital standards: a common equity Tier 1 capital to risk-based assets ratio of 4.5%, a Tier 1capital to risk-based assets of 6.0%, a total capital to risk-based assets ratio of 8.0% and a Tier 1 capital to average assets leverage ratio of 4.0%. In addition, in order to make capital distributions and pay discretionary bonuses to executive officers without restriction, an institution must also maintain greater than 2.5% in common equity attributable to a capital conservation buffer. The existing capital requirements were effective January 1, 2015 and were the result of a final rule implementing regulatory amendments based on recommendations of the Basel Committee on Banking Supervision and certain requirements of the Dodd-Frank Act.

Effective January 1, 2020, qualifying community banking organizations may elect to comply with a greater than 9% community bank leverage ratio (the “CBLR”) requirement in lieu of the currently applicable requirements for

calculating and reporting risk-based capital ratios. The CBLR is equal to Tier 1 capital divided by average total consolidated assets. In order to qualify for the CBLR election, a community bank must (i) have a leverage capital ratio greater than 9 percent, (2) have less than $10 billion in average total consolidated assets, (3) not exceed certain levels of off-balance sheet exposure and trading assets plus trading liabilities and (4) not be an advanced approaches banking organization. A community bank that meets the above qualifications and elects to utilize the CBLR is considered to have satisfied the risk-based and leverage capital requirements in the generally applicable capital rules and is also considered to be “well-capitalized” under the prompt corrective action rules. As of December 31, 2022, PeoplesBank had not elected to be subject to the CBLR requirement.

Common equity Tier 1 capital is generally defined as common stockholders’ equity and retained earnings.  Tier 1 capital is generally defined as common equity Tier 1 and additional Tier 1 capital.  Additional Tier 1 capital includes certain noncumulative perpetual preferred stock and related surplus and minority interests in equity accounts of consolidated subsidiaries.  Total capital includes Tier 1 capital (common equity Tier 1 capital plus additional Tier 1 capital) and Tier 2 capital.  Tier 2 capital is comprised of capital instruments and related surplus, meeting specified requirements, and may include cumulative preferred stock and long-term perpetual preferred stock, mandatory convertible securities, intermediate preferred stock and subordinated debt.  Also included in Tier 2 capital is the allowance for loan and lease losses limited to a maximum of 1.25% of risk-weighted assets and, for institutions that have exercised an opt-out election regarding the treatment of Accumulated Other Comprehensive Income (“AOCI”), up to 45% of net unrealized gains on available-for-sale equity securities with readily determinable fair market values.  Institutions that have not exercised the AOCI opt-out have AOCI incorporated into common equity Tier 1 capital (including unrealized gains and losses on available-for-sale-securities).  PeoplesBank exercised its AOCI opt-out election. Calculation of all types of regulatory capital is subject to deductions and adjustments specified in the regulations.

In determining the amount of risk-weighted assets for purposes of calculating risk-based capital ratios, all assets, including certain off-balance sheet assets (e.g., recourse obligations, direct credit substitutes, residual interests) are multiplied by a risk weight factor assigned by the regulations based on the risks believed inherent in the type of asset.  Higher levels of capital are required for asset categories believed to present greater risk.  For example, a risk weight of 0% is assigned to cash and U.S. government securities, a risk weight of 50% is generally assigned to prudently underwritten first lien one- to four-family residential real estate loans, a risk weight of 100% is assigned to commercial and consumer loans, a risk weight of 150% is assigned to certain past due loans and a risk weight of between 0% to 600% is assigned to permissible equity interests, depending on certain specified factors.

At December 31, 2022, PeoplesBank exceeded all of its regulatory capital requirements, with Tier 1 leverage (to average assets), Tier 1 common equity (to risk-weighted assets), Tier 1 (to risk-weighted assets) and Total risk-based capital ratios of 10.96%, 14.15%, 14.15% and 15.34%, respectively. Additional information can be found in Note 9 – Regulatory Matters.

Any bank that fails any of the capital requirements is subject to possible enforcement action by the FDIC. Such action could include a capital directive, a cease and desist order, civil money penalties, the establishment of restrictions on the institution’s operations, termination of federal deposit insurance and the appointment of a conservator or receiver. The FDIC’s capital regulations provide that such actions, through enforcement proceedings or otherwise, could require one or more of a variety of fronts.corrective actions.

PADOBS Capital Requirements. PeoplesBank is also subject to more stringent PADOBS capital guidelines. Although not adopted in regulation form, the PADOBS utilizes capital standards requiring a minimum of 6% leverage capital and 10% risk-based capital. The Patriotcomponents of leverage and risk-based capital are substantially the same as those defined by the FDIC. At December 31, 2022, PeoplesBank’s capital ratios exceeded each of the regulatory capital requirements.

Prompt Corrective Action. The following table shows the amount of capital associated with the different capital categories set forth in the FDIC’s prompt corrective action regulations (and does not take into account the potential determination to elect to use the CBLR).

In addition, an institution is “critically undercapitalized” if it has a ratio of tangible equity to total assets that is equal to or less than 2.0%. Under specified circumstances, a federal banking agency may reclassify a “well-capitalized” institution as adequately capitalized and may require an adequately capitalized institution or an undercapitalized institution to comply with supervisory actions as if it were in the next lower category (except that the FDIC may not reclassify a significantly undercapitalized institution as critically undercapitalized).

An institution generally must file a written capital restoration plan which meets specified requirements within 45 days of the date that the institution receives notice or is deemed to have notice that it is undercapitalized, significantly undercapitalized or critically undercapitalized. A federal banking agency must provide the institution with written notice of approval or disapproval within 60 days after receiving a capital restoration plan, subject to extensions by the agency. An institution which is required to submit a capital restoration plan must concurrently submit a performance guaranty by each company that controls the institution. In addition, undercapitalized institutions are subject to various regulatory restrictions, and the appropriate federal banking agency also may take any number of discretionary supervisory actions.

At December 31, 2022, PeoplesBank was deemed to be a “well-capitalized” institution for purposes of the prompt corrective action regulations and as such is not subject to the above mentioned restrictions.

Activities and Investments of Insured State-Chartered Banks. The activities and equity investments of FDIC-insured, state-chartered banks are generally limited to those that are permissible for national banks or a federal savings association. Under regulations dealing with equity investments, an insured state bank generally may not directly or indirectly acquire or retain any equity investment of a type, or in an amount, that is not permissible for a national bank or a federal savings association.

The FDIC has adopted regulations pertaining to the other activity restrictions imposed upon insured state-chartered banks and their subsidiaries. Pursuant to such regulations, insured state banks engaging in impermissible activities may seek approval from the FDIC to continue such activities, and state banks not engaging in such activities but that desire to engage in otherwise impermissible activities either directly or through a subsidiary may apply for approval from the FDIC to do so.

Restrictions on Capital Distributions. Under federal rules, an insured depository institution may not pay any dividend if making such payments would cause it to become undercapitalized or if it is already undercapitalized. In addition, federal regulators have the authority to restrict or prohibit the payment of dividends for safety and soundness reasons. The FDIC also prohibits an insured depository institution from paying dividends on its capital stock or interest on its capital notes or debentures (if such interest is required to be paid only out of net profits) or distributing any of its capital assets while it remains in default in the payment of any assessment due the FDIC. PeoplesBank is currently not in default in any assessment payment to the FDIC. The PA Banking Code also restricts the payment and amount of dividends, including the requirement that dividends be paid only out of accumulated net earnings.

Incentive Compensation. Guidelines adopted by the federal banking agencies pursuant to the Federal Deposit Insurance Act contains sweeping anti-money launderingprohibit payment of excessive compensation as an unsafe and financial transparency lawsunsound practice and imposes variousdescribe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal stockholder.

In June 2010, the federal banking agencies issued comprehensive guidance on incentive compensation policies (the “Incentive Compensation Guidance”) intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The Incentive Compensation Guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors. Any deficiencies in compensation practices that are identified may be incorporated into the organization’s supervisory ratings, which can affect its ability to make acquisitions or perform other actions. The Incentive Compensation Guidance provides that enforcement actions may be taken against a banking organization if its incentive compensation arrangements or related risk-management control or governance processes pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

Standards for Safety and Soundness. As required by statute, the federal banking agencies adopted final regulations and Interagency Guidelines Establishing Standards for Safety and Soundness. The guidelines set forth the safety and soundness standards that the federal banking agencies use to identify and address problems at insured depository institutions before capital becomes impaired. The guidelines address internal controls and information systems, internal audit systems, credit underwriting, loan documentation, interest rate exposure, asset growth, asset quality, earnings and compensation, fees and benefits. The agencies have also established standards for safeguarding customer information. If the relevant federal banking agency determines that an institution fails to meet any standard prescribed by the guidelines, the agency may require the institution to submit to the agency an acceptable plan to achieve compliance with the standard.

Privacy Requirements. Federal law places limitations on financial institutions including standards for verifying client identification at account opening, and rules to promote cooperation amonglike PeoplesBank regarding the sharing of consumer financial information with unaffiliated third parties. Specifically, these provisions require all financial institutions regulatorsoffering financial products or services to retail customers to provide such customers with the financial institution’s privacy policy and provide such customers the opportunity to “opt out” of the sharing of personal financial information with unaffiliated third parties. PeoplesBank currently has a privacy protection policy in place and believes such policy complies with applicable regulations.

Anti-Money Laundering. Federal anti-money laundering rules impose various requirements on financial institutions to prevent the use of the U.S. financial system to fund terrorist activities. These provisions include a requirement that financial institutions operating in the United States have anti-money laundering compliance programs, due diligence policies and controls in place to ensure the detection and reporting of money laundering. Such compliance programs supplement existing compliance requirements, also applicable to financial institutions, under the Bank Secrecy Act and the Office of Foreign Assets Control Regulations. PeoplesBank has established policies and procedures to ensure compliance with the federal anti-money laundering provisions.

PeoplesBank is also subject to the USA PATRIOT Act, which gave federal agencies additional powers to address terrorist threats through enhanced domestic security measures, expanded surveillance powers, increased information sharing, and broadened anti-money laundering requirements. By way of amendments to the Bank Secrecy Act, Title III of the USA PATRIOT Act provided measures intended to encourage information sharing among bank regulatory agencies and law enforcement entitiesbodies. Further, certain provisions of Title III impose affirmative obligations on a broad range of financial institutions, including banks, thrifts, brokers, dealers, credit unions, money transfer agents, and parties registered under the Commodity Exchange Act.

Cybersecurity. The federal banking agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a financial institution’s board of directors. These guidelines, along with related regulatory materials, and supervisory examinations (by federal and state regulators) increasingly focus on risk management and processes related to information technology and the use of third parties in identifying partiesthe provision of financial products and services. The banking agencies expect financial institutions to establish lines of defense and ensure that their risk management processes also address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack. If the Corporation and PeoplesBank fail to meet the expectations set forth in this regulatory guidance, they could be subject to various regulatory actions as well as remediation efforts which may cause them to incur significant

expense. In addition, in 2021, the federal banking agencies adopted a rule to establish computer-security incident notification requirements for bank holding companies, banks and their service providers. Under the rule, banking organizations are required to notify their primary federal regulators within 36 hours of any incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver banking services to a material portion of its client base, jeopardize the viability of key operations, or impact the financial stability of the financial sector. The rule also imposes certain notification requirements on third-party bank service providers when they experience a computer-security incident that has caused, or is likely to cause a material service disruption or degradation for four or more hours. In such case, the service provider is required to notify its bank-designated point of contact as soon as possible upon discovery of the incident.

UDAP and UDAAP. Recently, banking regulatory agencies have increasingly used a general consumer protection statute to address “unethical” or otherwise “bad” business practices that may be involvednot necessarily fall directly under the purview of a specific banking or consumer finance law. The law of choice for enforcement against such business practices has been Section 5 of the Federal Trade Commission Act (the “FTC Act”), which is the primary federal law that prohibits unfair or deceptive acts or practices, referred to as UDAP, and unfair methods of competition in terrorism or money laundering.affecting commerce. “Unjustified consumer injury” is the principal focus of the FTC Act. Prior to the Dodd- Frank Act, there was little formal guidance to provide insight to the parameters for compliance with UDAP laws and regulations. However, UDAP laws and regulations have been expanded under the Dodd-Frank Act to apply to “unfair, deceptive or abusive acts or practices,” referred to as UDAAP, which have been delegated to the CFPB for supervision. The CFPB has published its first Supervision and Examination Manual that addresses compliance with and the examination of UDAAP. The potential reach of the CFPB’s broad new rulemaking powers and UDAAP authority on the operations of financial institutions offering consumer financial products or services, including PeoplesBank, is currently unknown.

Community Reinvestment Act. All insured depository institutions have a responsibility under the Community Reinvestment Act (“CRA”) and related regulations to help meet the credit needs of their communities, including low- and moderate-income neighborhoods. An institution’s failure to comply with the provisions of the CRA could result in restrictions on its activities. The CRA does not establish specific lending requirements or programs for financial institutions nor does it limit an institution’s discretion to develop the types of products and services that it believes are best suited to its particular community, consistent with the CRA. The CRA requires the FDIC, in connection with its examination of a state bank, to assess the institution’s record of meeting the credit needs of its community and to take such record into account in its evaluation of certain applications by such institution, including applications to acquire branches and other financial institutions. PeoplesBank received a “satisfactory” CRA rating in its most recently completed examination in 2021.

Consumer Protection and Fair Lending Regulations. Pennsylvania-chartered banks are subject to a variety of federal statutes and regulations that are intended to protect consumers and prohibit discrimination in the granting of credit. These statutes and regulations provide for a range of sanctions for non-compliance with their terms, including the imposition of administrative fines and remedial orders, and referral to the Attorney General for prosecution of a civil action for actual and punitive damages and injunctive relief. Certain of these statutes authorize private individual and class action lawsuits and the award of actual, statutory and punitive damages and attorneys’ fees for certain types of violations.

Commercial Real Estate Guidance. Under guidance issued by the federal banking agencies, the agencies have expressed concerns with institutions that ease commercial real estate underwriting standards and have directed financial institutions to maintain underwriting discipline and exercise risk management practices to identify, measure and monitor lending risks. The agencies have also issued guidance that requires a financial institution to employ enhanced risk management practices if the institution is exposed to significant concentration risk. Under that guidance, an institution is potentially exposed to significant concentration risk if: (i) total reported loans for construction, land development, and other land represent 100% or more of total capital or (ii) total reported loans secured by multi-family and non-farm residential properties, loans for construction, land development, and other land loans otherwise sensitive to the general commercial real estate market, including loans to commercial real estate related entities, represent 300% or more of total capital, and the outstanding balance of the institution's commercial real estate loan portfolio has increased by 50% or more during the prior 36 months.

Other Regulations. Interest and other charges collected or contracted for by PeoplesBank are subject to state usury laws and federal laws concerning interest rates. Loan operations are also subject to state and federal laws applicable to credit transactions, such as the:

Home Mortgage Disclosure Act of 1975, requiring financial institutions to provide information to enable the public and public officials to determine whether a financial institution is fulfilling its obligation to help meet the housing needs of the community it serves;

Equal Credit Opportunity Act, prohibiting discrimination on the basis of race, creed or other prohibited factors in extending credit;

Fair Credit Reporting Act of 1978, governing the use and provision of information to credit reporting agencies; and

Rules and regulations of the various federal and state agencies charged with the responsibility of implementing such federal and state laws.

The deposit operations of PeoplesBank also are subject to, among others, the:

Right to Financial Privacy Act, which imposes a duty to maintain the confidentiality of consumer financial records and prescribes procedures for complying with administrative subpoenas of financial records;

Check Clearing for the 21st Century Act (also known as “Check 21”), which gives “substitute checks,” such as digital check images and copies made from that image, the same legal standing as the original paper check; and

Electronic Funds Transfer Act and Regulation E promulgated thereunder, which govern automatic deposits to and withdrawals from deposit accounts and customers’ rights and liabilities arising from the use of automated teller machines and other electronic banking services.

The Coronavirus Aid, Relief and Economic Security Act (the “CARES Act”). The CARES Act, which became law on March 27, 2020, provided over $2 trillion to combat the coronavirus disease (COVID-19) and stimulate the economy. The law had several provisions relevant to financial institutions, including:

Allowing institutions to not characterize loan modifications relating to the COVID-19 pandemic as a troubled debt restructuring and also allowing them to suspend the corresponding impairment determination for accounting purposes;

The establishment of the Paycheck Protection Program, a specialized low-interest forgivable loan program funded by the U.S. Treasury and administered through the SBA’s 7(a) loan guaranty program to support businesses affected by the COVID-19 pandemic; and

The ability of a borrower of a federally-backed mortgage loan (VA, FHA, USDA, Freddie Mac and Fannie Mae) experiencing financial hardship due, directly or indirectly, to the COVID-19 pandemic, to request forbearance from paying their mortgage by submitting a request to the borrower’s servicer affirming their financial hardship during the COVID-19 emergency. Such a forbearance could be granted for up to 180 days, subject to extension for an additional 180-day period upon the request of the borrower. During that time, no fees, penalties or interest beyond the amounts scheduled or calculated as if the borrower made all contractual payments on time and in full under the mortgage contract could accrue on the borrower’s account.  Except for vacant or abandoned property, the servicer of a federally-backed mortgage was prohibited from taking any foreclosure action, including any eviction or sale action, for not less than the 60-day period beginning March 18, 2020, subsequently extended by federal mortgage-backing agencies.

Federal Home Loan Bank System. PeoplesBank is a member of the Federal Home Loan Bank of Pittsburgh, which is one of 11 regional Federal Home Loan Banks. Each Federal Home Loan Bank serves as a reserve or central bank for its members within its assigned region. It is funded primarily from proceeds from the sale of consolidated obligations of the Federal Home Loan Bank System. It makes loans to members (i.e., advances) in accordance with policies and procedures established by the board of directors of the Federal Home Loan Bank.

As a member, PeoplesBank is required to purchase and maintain stock in the Federal Home Loan Bank of Pittsburgh in an amount in accordance with the Federal Home Loan Bank’s capital plan and sufficient to ensure that the Federal Home Loan Bank remains in compliance with its minimum capital requirements. At December 31, 2022, PeoplesBank was in compliance with this requirement.

Federal Reserve Board. The Federal Reserve Board requires all depository institutions to maintain non-interest bearing reserves at specified levels against their transaction accounts, which are primarily checking and NOW accounts, and non-personal time deposits. The balances maintained to meet the reserve requirements imposed by the Federal Reserve Board may be used to satisfy the liquidity requirements that are imposed by the PADOB. In 2020, due to a change in its approach to monetary policy due to COVID-19, the Federal Reserve Board implemented a final rule to amend its reserve requirements and reduce reserve requirement ratios to zero. The Federal Reserve Board has indicated that it has no plans to re-impose reserve requirements, but may do so in the future if conditions warrant.

Future Laws and RegulationsRegulations.

Periodically, various federal and state legislation is proposed that could result in additional regulation of, and restrictions on, the business of Codorus Valley and PeoplesBank. It cannot be predicted whether such legislation will be adopted or, if adopted, how such legislation would affect the business of Codorus Valley and its subsidiaries. As a consequence of the extensive regulation of commercial banking activities in the United States, Codorus Valley’s and PeoplesBank’s business is particularly susceptible to being affected by federal legislation and regulations. The general cost of compliance with numerous federal and state laws and regulations has had, and in the future may have, a negative impact on Codorus Valley’s results of operations.

Other Information

This Annual Report on Form 10-K is filed with the Securities and Exchange Commission (SEC). Copies of this document, the Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, amendments to those reports and other filings by Codorus Valley with the SEC may be obtained electronically at PeoplesBank’s website at www.peoplesbanknet.com (select “Your Life” or “Your Business”, then select “Investor Relations”, then select “Filings”, then select “Documents”), or the SEC’s website at www.sec.gov. Copies can also be obtained without charge by writing to: Treasurer, Codorus Valley Bancorp, Inc., 105 Leader Heights Road, York, PA 17403.

Where we have included web addresses in this report, such as the Corporation’s web address, we have included these web addresses as inactive text references only. Except as specifically incorporated by reference into this report, information on those websites is not part hereof.

Item 1A: Risk Factors

Before investing in our common stock, you should carefully consider the risks described below, in addition to the other information contained in this report and in our other filings with the SEC. Unless the context otherwise requires, references to “we,” “us,” “our,” “Codorus Valley Bancorp, Inc.,” “Codorus Valley” or the “Corporation” refer to Codorus Valley Bancorp, Inc. and its direct or indirect owned subsidiaries, and references to the “Bank” refer“PeoplesBank” refers to PeoplesBank, aA Codorus Valley Company, the wholly-ownedwholly owned banking subsidiary of the Corporation.

The risksRisks Related to Macroeconomic Conditions

Difficult economic conditions or volatility in the financial markets would likely have an adverse effect on our business, financial position and uncertainties described belowresults of operations.

As a financial services company, our business and overall financial performance are notvulnerable to the only ones facingimpact of poor or weak economic conditions, particularly in the United States but also to some extent in the global economy. Recessionary economic conditions, particularly if they are severe, are likely to have a negative financial impact across the financial services industry, including on Codorus Valley. Recessionary economic conditions can also lead to turmoil and volatility in financial markets, which can increase the adverse impact on financial institutions such as the Corporation. Additional risksA return to recessionary economic conditions in the United States would likely adversely affect us, our business and uncertainties that we arefinancial performance. In addition, if the U.S. Congress were not awareto act favorably on measures to raise the debt ceiling, the U.S. government could default on payment of or focused on, or that we currently deem immaterial, may also impact ourits debt. This could lead to a government shutdown and other consequences which could adversely affect the United States economy and financial institutions, including us.

Financial challenges at other banking institutions could lead to depositor concerns that spread within the banking industry causing disruptive deposit outflows and other destabilizing results.

In March 2023, certain specialized banking institutions with elevated concentrations of uninsured deposits experienced large deposit outflows, resulting in the institutions being placed into FDIC receiverships. In the aftermath, there has been substantial market disruption and indications that deposit concerns could spread within the banking industry, leading to deposit outflows and other destabilizing results. The Corporation maintains a well-diversified deposit base and has a comparatively low level of uninsured deposits. As of December 31, 2022, 82% of our deposits are estimated to be FDIC-insured, and an additional 6% of deposit were fully collateralized. The average account size of our consumer deposits is less than $18,000, and the average account size of our business deposits is less than $89,000.

The continuing COVID-19 pandemic has, and may continue to, adversely affect our business, financial condition, liquidity, capital and results of operations. If

The extent and duration to which the continuing COVID-19 pandemic will affect our business in the future is unknown and will depend on future developments, which are highly uncertain and outside our control. These developments include the duration and severity of the pandemic (including the possibility of further surges of COVID-19 variants of concern), supply chain disruptions, decreased demand for our products and services or those of our borrowers, which could increase our credit risk, rising inflation, our ability to maintain sufficient qualified personnel due to labor shortages, talent attrition, employee illness, quarantine, willingness to return to work, face-coverings and other safety requirements, or travel and other restrictions, and the actions taken by governments, businesses and individuals to contain the impact of COVID-19, as well as further actions taken by governmental authorities to limit the resulting economic impact. It is also possible that the pandemic and its aftermath will lead to a prolonged economic slowdown in sectors disproportionately affected by the pandemic or recession in the U.S. economy or the world economy in general.

Risks Related to Market Interest Rates and Inflation

Ourbusinessissubjecttointerestraterisk,andvariationsininterestratesmaymateriallyandadverselyaffect our financial performance.

Changes in the interest rate environment may reduce our profits. It is expected that we will continue to realize income fromthedifferentialor“spread”betweentheinterestearnedonloans,securitiesandotherinterest-earningassets,andthe interest paid on deposits, borrowings andother interest-bearing liabilities.Net interestspreads areaffected, inpart, by the difference between the maturities and repricing characteristics of interest-earning assets and interest-bearing liabilities. Changes in market interest rates generally affect loan volume, loan yields, funding sources and funding costs. Our net interest spread depends on many factors that are partly or completely out of our control, including competition, general economic conditions, and federal economic monetary and fiscal policies, and in particular, the Federal Reserve Board’s policy determinations with respect to interest rates. After the Federal the Federal Reserve System’s Open Market Committee (“FOMC”) steadily increased the target federal funds rate in 2017 and 2018, the FOMC in 2019 decreased the target federal funds rate by 75 basis points, and in response to the COVID-19 pandemic in March 2020, effected an additional 150 basis point decrease to a range of 0.00% to 0.25% as of March 31, 2020whereithadremaineduntiltheFOMCincreasedthetargetfederalfundsrateby25basispointstoarange of0.25%to0.50%inMarch2022.From March through December 2022, in response to inflation, the FOMC increased the targeted federal funds rate seven separate times, raising the rate by 425 basis points to a range of 4.25% to 4.50%. The FOMC has indicated further increases are to be expected in 2023 but the exact timing and extent remain unknown and are largely subject to economic conditions.

While an increase in interest rates may increase our loan yield, it may adversely affect the ability of certain borrowers with variable-rate loans to pay the contractual interest and principal due to us. Following an increase in interest rates, our abilitytomaintainapositivenetinterestspreadisdependentonourabilitytoincreaseourloanofferingrates,replaceloans thatmatureandrepayorthatprepaybeforematuritywithneworiginationsathigherrates,minimizeincreasesonourdeposit rates,and maintain anacceptable level andcomposition offunding. We cannot provide assurances that we will be able to increase our loan offering rates and continue to originate loans due to the competitive landscape in which we operate. Additionally, we cannot provide assurances that we can minimize the increases in our deposit rates while maintaining an acceptable level of deposits. Finally, we cannot provide any assurances that we can maintain our current levels of noninterest-bearing deposits as customers may seek higher-yielding products when interest rates increase.

Accordingly, changes in levels of interest rates could materially and adversely affect our net interest margin, asset quality, loan origination volume, average loan portfolio balance, liquidity, and overall profitability.

Furthermore, a sustained increase in market interest rates could adversely affect our earnings. A significant portion of our loans have fixed interest rates and longer terms than our deposits and borrowings. As is the case with many other financial institutions, our emphasis on increasing the development of core deposits, which bear no or a relatively low rate of interest with no stated maturity date, has resulted in our having a significant amount of these knowndeposits that have a shorter duration than our assets. At December 31, 2022, we had $262.9 million in certificates of deposit that mature within one year and $1.56 billion in checking, savings, and money market accounts. We incur a higher cost of funds to retain these deposits in a rising interest rate environment, such as the current one, and our net interest income could be adversely affected if the rates we pay on deposits and borrowings increase more rapidly than the rates we earn on loans and other investments.

Changes in interest rates also affect the value of our interest-earning assets and in particular our debt securities portfolio. Generally, the fair value of fixed-rate debt securities fluctuates inversely with changes in interest rates. Unrealized gains and losses on debt securities available for sale are reported as a separate component of equity, net of tax. Decreases in the fair value of debt securities available for sale resulting from increases in interest rates could have an adverse effect on stockholders’ equity.

We monitor our interest rate sensitivity using a simulation model which generates estimates of the changes in our net interest income over a range of interest rate scenarios. As of December 31, 2022, in the event of an instantaneous 100 basis point increase in interest rates, we estimate that we would experience a 3.27% increase in net interest income. For further discussion of how changes in interest rates could impact us, see “Item 7A-Quantitative and Qualitative Disclosures About Market Risk.”

Inflation can have an adverse impact on our business and on our customers.

Inflation risk is the risk that the value of assets or unknownincome from investments will be worth less in the future as inflation decreases the value of money. Recently, there have been market indicators of a pronounced rise in inflation and the Federal Reserve Board has raised certain benchmark interest rates in an effort to combat inflation. As discussed above under “—Fluctuating interest rates can adversely affect our profitability,” as inflation increases and market interest rates rise the value of our investment securities, particularly those with longer maturities, decreases, although this effect can be less pronounced for floating-rate instruments. In addition, inflation generally increases the cost of goods and services we use in our business operations, such as electricity and other utilities, which increases our noninterest expenses. Furthermore, our customers are also affected by inflation and the rising costs of goods and services used in their households and businesses, which could have a negative impact on their ability to repay their loans with us.

Risks Related to our Lending Activities

Our loan portfolio primarily consists of commercial-related loans, including commercial real estate and construction loans. These loans involve credit risks that could adversely affect our financial condition and results of operations.

At December 31, 2022, commercial-related loans totaled $1.37 billion, or uncertainties actually occurs,84.2% of our total loan portfolio, including commercial real estate, commercial and industrial, construction and land acquisition and development loans. Given their generally larger balances and the complexity of the underlying collateral, commercial-related loans generally have more risk than the owner-occupied one-to-four family residential real estate loans that we also originate. Because the repayment of commercial-related loans often depends on the successful management and operation of the borrower’s properties or related businesses, repayment of such loans can be affected by adverse conditions in the local real estate market or economy. If we foreclose on these loans (for those having real estate collateral), our holding period for the collateral typically is longer than for a one-to-four family residential property because there are fewer potential purchasers of the collateral. In addition, because commercial-related loans, and commercial real estate loans in particular, typically involve larger loan balances to single borrowers or groups of related borrowers compared to one-to-four family residential loans, charge-offs on commercial-related loans may be larger on a per loan basis than those incurred with our residential or consumer loan portfolios.

As our commercial-related loan portfolio increases, the corresponding risks and potential for losses from these loans may also increase, which would adversely affect our business, financial condition and results of operations could be materially and adversely affected. If this were.

Our emphasis on real estate loans exposes us to happen, the market pricelending risks.

At December 31, 2022, approximately $1.43 billion, or 87.3%, of our common stock could decline significantly, and you could lose all or part of your investment.

Risks Related to Our Businesstotal loan portfolio, was secured by real estate, most of which is located in our primary lending market areas of South Central Pennsylvania, primarily York and Industry

Weakness in the economy may materially adversely affect our businessLancaster Counties, and results of operations.

 Our results of operations are materially affected by conditions in the economy generally, which continue to be uncertainNorth Central Maryland, primarily Baltimore and include uneven economic growth, accompanied by low interest rates. DramaticHartford Counties. Future declines in the housing market following the 2008 financial crisis, with falling home pricesreal estate values in our primary lending markets and increasing foreclosures and unemployment, resulted in significant write-downs of asset values by financial institutions. While conditions have improved, a return to a recessionary or excessive inflationary economy could result in financial stress on our borrowers that would adversely affect consumer confidence, a reduction in general business activity and increased market volatility. The resulting economic pressure on consumers and businesses and the lack of confidence in the financialsurrounding markets could adversely affectsignificantly impair the value of the collateral securing our loans and our ability to sell the collateral upon foreclosure for an amount necessary to satisfy the borrower’s obligations to us. This could require us to increase our allowance for loan losses, which could have a material adverse effect on our business, financial condition, results of operations and stock price. Our ability to properly assess the creditworthinessgrowth prospects.

The geographic concentration of our clientsloan portfolio and lending activities makes us vulnerable to estimate the losses inherent in our credit exposure would be made more complex by these difficult market and economic conditions. Accordingly, if market conditions worsen, we may experience increases in foreclosures, delinquencies, write-offs and client bankruptcies, as well as more restricted access to funds.

Deteriorationa downturn in our local and regional economy or real estate market may adversely affect our business.area.

 Substantially all ofUnlike larger financial institutions that are more geographically diversified, our business is with clients located within South Central Pennsylvania, principally York and Lancaster Counties and North Central Maryland, principally Harford County, Baltimore County and Baltimore City. As a result of this geographic concentration, our results depend largelyprofitability depends primarily on the general economic conditions in these and surroundingour primary market areas. Deterioration inLocal economic conditions inhave a significant impact on our commercial real estate, commercial and industrial, construction, residential real estate and consumer lending, including, the ability of borrowers to repay these markets could:

increase loan delinquencies;

increase problem assetsloans and foreclosures;

increase claims and lawsuits;

decrease the demand for our products and services; and

decrease the value of the collateral for loans, especially real estate, in turn reducing clients’ borrowing power, the value of assets associated with nonperforming loans and collateral coverage.

Generally,securing these loans. Furthermore, we generally make loans to small and mid-sized businesses whose success depends on the regional economy. These businesses generally have fewer financial resources in terms of capital or borrowing capacity than larger entities. Adverse economic and business conditions in our market area could reduce our growth rate, materially and adversely affect our borrowers’ ability to repay their loans and, consequently, adversely affect our financial condition and performance. For example, we place substantial reliance

Moreover, a significant decline in general economic conditions, caused by inflation, acts of terrorism, an outbreak of hostilities or other international or domestic calamities, such as the ongoing war in Ukraine, or other factors beyond our control could further impact these local economic conditions and could further negatively affect our financial performance. In addition, deflationary pressures, while possibly lowering our operating costs, could have a significant negative effect on real estate as collateral for our loan portfolio. A sharp downturn in real estateborrowers, especially our business borrowers, and the values in our market area could leave many of our loans inadequately collateralized. If we are required to liquidate theunderlying collateral securing a loan to satisfy the debt during a period of reduced real estate values,loans, which could negatively affect our earnings could be adversely affected.financial performance.

If our allowance for loan and lease losses is not sufficient to cover actual loan and lease losses, our earnings wouldcould decrease.

We are exposed tomake various assumptions and judgments about the risk thatcollectability of our loan portfolio, including the creditworthiness of our borrowers may default on their obligations. To absorb probable, incurred loan and lease losses that we may realize, we recognize an allowancethe value of the real estate and other assets serving as collateral for loan and lease losses based on, among other things, national and regional economic conditions, historical loss experience, and delinquency trends. However, we cannot estimate loan and lease losses with certainty, and we cannot assure you that charge-offs in future periods will not exceedthe repayment of many of our loans. In determining the amount of the allowance for loan losses, we review our loans and lease losses.our loss and delinquency experience, and we evaluate economic conditions. If charge-offs exceedour assumptions or the results of our analyses are incorrect, our allowance for loan losses may not be sufficient to cover losses inherent in our earnings would decrease.loan portfolio, resulting in additions to our allowance. In addition, regulatory agencies,our emphasis on loan growth, including our portfolio of commercial-related loans, as an integral partwell as any future credit deterioration, including as a result of their examination process,the ongoing COVID-19 pandemic and the possible recessionary pressures, could require us to increase our allowance for loan losses in the future. At December 31, 2022, our allowance for loan losses was 1.27% of total loans and 189.02% of nonperforming loans. Material additions to our allowance would materially decrease our net income.

The Financial Accounting Standards Board’s Current Expected Credit Losses, or CECL, standard will be effective for Codorus Valley on January 1, 2023. CECL will require financial institutions to determine periodic estimates of lifetime expected credit losses on loans, and to recognize the expected credit losses as allowances for credit losses. This will change the current method of providing allowances for loan losses that are incurred or probable, which would likely require us to increase our allowance for credit losses, and to greatly increase the types of data we will need to collect and review to determine the appropriate level of the allowance for credit losses.

In addition, bank regulators periodically review our allowance for loan and lease losses and, as a result of such reviews, we may require additionsbe required to the allowance based on their judgment about information available to them at the time of their examination. Factors that require anincrease our provision for loan losses or recognize further loan charge-offs. Any increase in our allowance for loan and lease losses suchor loan charge-offs as a prolonged economic downturnresult of such review or continued weakening in general economic conditions such as inflation, recession, unemployment or other factors beyondotherwise may have a material adverse effect on our control, could reduce our earnings.financial condition and results of operations.

The level of our commercial real estate loan portfolio may subject us to additional regulatory scrutiny.

OurThe FDIC and the other federal bank regulatory agencies have promulgated joint guidance on sound risk management practices for financial institutions with concentrations in commercial real estate lending. Under the guidance, a financial institution that, like us, is actively involved in commercial real estate lending should perform a risk assessment to identify concentrations. A financial institution may have a concentration in commercial real estate lending if, among other factors, (i) total reported loans for construction, land acquisition and development, and other land represent 100% or more of the institution’s total capital, or (ii) total reported loans secured by multi-family and non-farm residential properties, loans for construction, land acquisition and development and other land, and loans otherwise sensitive to the general commercial real estate market, including loans to commercial real estate related entities, represent 300% or more of total capital. Based on these factors, we have concluded that we currently do not have a concentration in commercial real estate lending, as such loans represent 72% and 271%, respectively, of total bank capital as of December 31, 2022.

The particular focus of the guidance is on exposure to creditcommercial real estate loans that are dependent on the cash flow from the real estate held as collateral and that are likely to be at greater risk whichto conditions in the commercial real estate market (as opposed to real estate collateral held as a secondary source of repayment or in an abundance of caution). The purpose of the guidance is to guide banks in developing risk management practices and determining capital levels commensurate with the level and nature of real estate concentrations. The guidance states that management should employ heightened byrisk management practices including board and management oversight and strategic planning, development of underwriting standards, risk assessment and monitoring through market analysis and stress testing. While we believe we have implemented policies and procedures with respect to our focus on commercial real estate loan portfolio consistent with this guidance, bank regulators could require us to implement additional policies and procedures consistent with their interpretation of the guidance that may result in additional costs to us or that may result in the curtailment of our commercial real estate lending couldthat would adversely affect our earningsloan originations and profitability.

Nonperforming assets take significant time to resolve, adversely affect our results of operations and financial condition.condition, and could result in further losses in the future.

 There

Our nonperforming assets adversely affect our net income in various ways. We do not record interest income on nonaccrual loans or OREO, thereby adversely affecting our net income and returns on assets and equity, increasing our loan administration costs and adversely affecting our efficiency ratio. When we take collateral in foreclosure and similar proceedings, we are certainrequired to mark the collateral to its then-fair market value, which may result in a loss. These nonperforming loans and OREO also increase our risk profile and the level of capital our regulators believe is appropriate for us to maintain in light of such risks. The resolution of nonperforming assets requires significant time commitments from management and can be detrimental to the performance of their other responsibilities. If we experience increases in nonperforming loans and nonperforming assets, our net interest income may be negatively impacted and our loan administration costs could increase, each of which could have an adverse effect on our net income and related ratios, such as return on assets and equity.

We engage in lending secured by real estate and may foreclose on the collateral and own the underlying real estate, subjecting us to the costs and potential risks associated with the ownership of real property, or consumer protection initiatives or changes in state or federal law may substantially raise the cost of foreclosure or prevent us from foreclosing at all.

Since we originate loans secured by real estate, we may have to foreclose on the collateral property to recover our investment and may thereafter own and operate such property, in which case we would be exposed to the risks inherent in making loans. These risks include interest rate changes over the time period in which loansownership of real estate. The amount that we, as a mortgagee, may be repaid, risks resulting from changes inrealize after a foreclosure depends on factors outside of our control, including, but not limited to, general or local economic conditions, environmental cleanup liabilities, various assessments relating to the economy, risks inherent in dealing with borrowers and, in the case of a loan backed by collateral, risks resulting from uncertainties about the future valueownership of the collateral if a disposition is necessary.

Commercial loans, including commercialproperty, interest rates, real estate are generally viewed as having a higher credit risk than residentialtax rates, operating expenses of the mortgaged properties, our ability to obtain and maintain adequate occupancy of the properties, zoning laws, governmental and regulatory rules, and natural disasters. Our inability to manage the amount of costs or size of the risks associated with the ownership of real estate, or consumer loans because they usually involve larger loan balances to a single borrower and are more susceptible to a risk of default during an economic downturn. Our consolidated commercial lending operations include commercial, financial and agricultural lending, real estate construction lending, and commercial mortgage lending. Construction financing typically involves a higher degree of credit risk than commercial mortgage lending. Risk of loss on a construction loan depends largely on the accuracy of the initial estimate of the property’s value at completion of construction compared to the estimated cost (including interest) of construction. If the estimated property value proves to be inaccurate, the loan may be inadequately collateralized.

Because our loan portfolio contains a significant number of commercial real estate, commercial and industrial loans, and construction loans, the deterioration of these loans may cause a significant increase in nonperforming loans. An increase in nonperforming loans could cause an increase in loan related legal fees and expenses, loan charge-offs and a corresponding increasewrite-downs in the provision for loan losses, whichvalue of OREO, could adversely impacthave an adverse effect on our business, financial condition, and results of operations.

We depend primarily on net interest income for our earnings, andAdditionally, consumer protection initiatives or changes in interest ratesstate or federal law may substantially increase the time and expenses associated with the residential foreclosure process or prevent us from foreclosing at all. A number of states in recent years have either considered or adopted foreclosure reform laws that make it substantially more difficult and expensive for lenders to foreclose on residential properties in default. Furthermore, federal regulators have prosecuted a number of mortgage servicing companies for alleged consumer law violations. If new state or

federal laws or regulations are ultimately enacted that significantly raise the cost of residential foreclosures or raise outright barriers, they could adversely impacthave an adverse effect on our business, financial condition, and results of operations.operations.

 Our ability to make a profit, like that of most financial institutions, substantially depends upon our net interest income, which is the difference between the interest income earned on interest earning assets, such as loans and investment securities, and the interest expense paid on interest-bearing liabilities, such as deposits and borrowings. Changes in interest rates can increase or reduce net interest income and net income.

Different types of assets and liabilities may react differently, and at different times, to changes in market interest rates. When interest-bearing liabilities mature or reprice more quickly than interest-earning assets in a period, an increase in market rates of interest could reduce net interest income. When interest-earning assets mature or reprice more quickly than interest-bearing liabilities, falling interest rates could reduce net interest income. Changes in market interest rates are affected by many factors beyond our control, including inflation, unemployment, money supply, international events, and events in the United States and other financial markets.

We attemptare exposed to managethe risk from changes in market interest rates, in part,of environmental liability associated with lending activities or properties we own.

A significant portion of our loan portfolio is secured by controlling the mix of interest rate sensitive assetsreal estate, and interest rate sensitive liabilities. However, interest rate risk management techniques are not exact and a rapid increase or decrease in interest rateswe could adversely affect our financial performance. In the event thatbecome subject to environmental liabilities with respect to one or more of these factors wereproperties, or with respect to resultproperties that we own in operating our business. During the ordinary course of business, we may foreclose on and take title to properties securing defaulted loans. In doing so, there is a decrease inrisk that hazardous or toxic substances could be found on these properties. If hazardous conditions or toxic substances are found on these properties, we may be liable for remediation costs, as well as for personal injury and property damage, civil fines and criminal penalties regardless of when the hazardous conditions or toxic substances first affected any particular property. The costs associated with investigation or remediation activities could be substantial. Environmental laws may require us to incur substantial expenses to address unknown liabilities and may materially reduce the affected property’s value or limit our net interest income, we doability to use or sell the affected property. In addition, future laws or more stringent interpretations or enforcement policies with respect to existing laws may increase our exposure to environmental liability. Our practice, which is to obtain an environmental review before initiating any foreclosure action on nonresidential real property, may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have significant sources of fee income to make up for decreases in net interest income.a material adverse effect on us.

The planned phasing outWe are required to transition from the use of the LIBOR as a financial benchmark presents risks tointerest rate index in the financial instruments originated or held by the Corporation.future.

The London Interbank Offered Rate ("LIBOR") is the reference rate used for many of the Corporation's transactions, including variable and adjustableadjustable-rate loans, derivative contracts, borrowings and other financial instruments. The LIBOR index will be discontinued for U.S. Dollar settings effective June 30, 2023, unless the deadline were to be extended. The language in our LIBOR-based contracts and other financial instruments has developed over time and may have various events that trigger when a successor rate loansto the designated rate would be selected. If a trigger is satisfied, contracts and borrowings. However, a reduced volume of interbank unsecured term borrowing, coupled with recent legal and regulatory proceedings related to rate manipulation by certainother financial institutions, has led to international reconsideration of LIBOR as a financial benchmark. The United Kingdom Financial Conduct Authority ("FCA"), which regulatesinstruments may give the process for establishing LIBOR, announced in July 2017 thatcalculation agent discretion over the sustainability of LIBOR cannot be guaranteed. Accordingly, the FCA intends to stop persuading,substitute index or compelling, banks to submit ratesindices for the calculation of LIBOR after 2021.interest rates to be selected. Since alternative rates are calculated differently, the transition may change our market risk profile, requiring changes to risk and pricing models

. Other LIBOR-based contracts and financial instruments do not have such triggers and any means for selection of alternative rates to LIBOR.

Regulators, industry groups and certain communities (e.g., the Alternative Reference Rates Committee) have, among other things, published recommended, fallback languageso-called “fallback language” for LIBOR-linked contracts and other financial instruments, identified recommended alternatives for certain LIBOR rates (e.g., the Secured Overnight Financing Rate (“SOFR”) as the recommended alternative to U.S. Dollar LIBOR), and proposed implementationsimplementation of the recommended alternatives for use in floating rate instruments. At this time, it

The Corporation has nearly completed the process of transitioning away from LIBOR. Its enterprise-wide, cross-functional project team overseeing the transition completed an inventory of existing LIBOR-indexed products, added LIBOR fallback language to new loans, and, with respect to existing loans, managed the transition to non-LIBOR based adjustable-rate mortgages, floating-rate commercial loans and related derivative instruments. The project team selected SOFR as the replacement rate for LIBOR. The team is working with the Corporation’s bond trustees on the LIBOR transition for certain of its capital markets instruments.

In addition, on March 15, 2022, President Biden signed the LIBOR Act. The LIBOR Act establishes a uniform replacement rate for LIBOR in agreements that either do not possiblecontain a fallback provision, or do not identify a specific benchmark replacement and a person with authority to predict whether these recommendations and proposalsdetermine the benchmark replacement. The replacement rate in such agreements will be broadly accepted, whether they will continuethe benchmark replacement identified by the Federal Reserve Board that is based on SOFR, including a “tenor” spread adjustment appropriate for each tenor of LIBOR that is consistent with the International Swaps and Derivatives Association’s IBOR Fallbacks protocol. In December 2022, the Federal Reserve published final regulations implementing the LIBOR Act and adopting SOFR-based benchmark rates to evolve,replace overnight 1-, 3-, 6- and 12-month U.S. Dollar LIBOR for agreements specified in the LIBOR Act.

We cannot predict what the effect of their implementationthe transition away from LIBOR to alternative rates, including SOFR, may be on the markets for various floating rate financial instruments. The uncertainty surrounding potential reforms, including the use of alternative

reference rates and changes to the methods and processes used to calculate rates, may have an adverse effect on the trading market for LIBOR-based securities, loan yields, and the amount received and paid on derivative contracts and other financial instruments. In

addition, the implementationcontinued evolution of the LIBOR transition and related reform proposals may result in increased compliance and operational costs.

The Corporation formed an enterprise-wide, cross-functional project teamRisks related to oversee Liquidity

Wearesubjecttoliquidityrisk,whichcouldadverselyaffectourfinancialconditionandresultsof operations.

Effectiveliquiditymanagementisessentialforthe transition. The project team reportsoperationofourbusiness.Althoughwehaveimplementedstrategies to Managementmaintain sufficient and the Board on a periodic basis. The project team is organized around key work streams, which cover the products, systems, and operational processes impacted by the transitiondiverse sources of funding to accommodate planned, as well as client communications. Since its formation,unanticipated, liquidity needs (includingchangesinassets,liabilities,andoff-balancesheetcommitmentsundervariouseconomicconditions),aninability to raise funds through deposits, borrowings, the project teamsale of investment securities and other sources could have a material adverse effect on our liquidity. Our access to funding sources in amounts adequate to finance our activities could be impaired byfactorsthataffectusspecificallyorthefinancialservicesindustryingeneral.Factorsthatcoulddetrimentallyimpact our accesstoliquiditysourcesincludeadecreaseinthelevelofourbusinessactivitydueto amarketdisruption,adecreasein theborrowingcapacityassignedtoourpledgedassetsbyoursecuredcreditors,competitionfromotherfinancialinstitutions and inflation whichcoulddriveupthecostsofdepositsoradverseregulatoryactionagainstus.Deteriorationineconomicconditionsand thelossofconfidenceinfinancialinstitutionsmay also increaseourcostoffundingandlimitouraccesstosomeofourcustomary sources of liquidity, including, but not limited to, inter-bank borrowings and borrowings from the Federal Home Loan Bank of Pittsburgh and the Federal Reserve Bank of Philadelphia. Our ability to acquire deposits or borrow could also be impaired by factors that are not specific to us, such as a severe disruption of the financial markets or negative views and expectations about the prospects for the financial services industry generally as a result of conditions faced by banking organizations in the domestic and international credit markets. Any decline in available funding or increased costs of liquidity could adverselyimpactourability tooriginateloans,investinsecurities,meetourexpensesorfulfillobligationssuchasrepaying ourborrowingsormeetingdepositwithdrawaldemands,anyofwhichcould,inturn,haveanadverseeffectonourbusiness, financial condition, and results of operations.

Risks Related to Competitive Matters

Strong competition within our market areas may limit our growth and profitability.

Competition in the banking and financial services industry is intense. In our market area, we compete with commercial banks, savings institutions, mortgage brokerage firms, credit unions, finance companies, mutual funds, insurance companies, and securities brokerage firms as well as certain unregulated or less regulated non-banking entities, operating locally and elsewhere. Many of these competitors have substantially greater resources and higher lending limits than we have and offer certain services that we do not or cannot provide. If we must raise interest rates paid on deposits or lower interest rates charged on our loans to be competitive, our net interest margin and profitability could be adversely affected. In addition, some of our competitors offer loans with lower interest rates on more attractive terms than loans we offer. Competition also makes it increasingly difficult and costly to attract and retain qualified employees. Our profitability depends upon our continued ability to successfully compete in our market area.

The financial services industry could become even more competitive as a result of new legislative, regulatory and technological changes and continued consolidation in the industry. Banks, securities firms and insurance companies can merge under the umbrella of a financial holding company, which can offer virtually any type of financial service, including banking, securities underwriting, insurance (both agency and underwriting) and merchant banking. Also, technology has completed an inventorylowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. Many of existing LIBOR-indexedour competitors have fewer regulatory constraints and may have lower cost structures. Additionally, due to their size, many competitors may be able to achieve economies of scale and, as a result, may offer a broader range of products whichand services as well as better pricing for those products and services than we can. We expect competition to increase in the future as a result of legislative, regulatory and technological changes and the continuing trend of consolidation in the financial services industry.

Our asset size may make it more difficult for us to compete.

Our asset size may make it more difficult to compete with other financial institutions that are larger and can more easily afford to invest in the marketing and technologies needed to attract and retain customers. Because our principal source of income is monitoredthe net interest income we earn on an ongoing basis, added LIBOR fallback language to newour loans and overseen the transition to non-LIBOR based adjustable rate mortgages and floating rate commercial loans. The project team has selected SOFR as a replacement rate for LIBOR.investments after deducting interest paid on

We operate indeposits and other sources of funds, our ability to generate the revenues needed to cover our expenses and finance such investments is limited by the size of our loan and investment portfolios. Accordingly, we are not always able to offer new products and services as quickly as our competitors. Our lower earnings may also make it more difficult to offer competitive salaries and benefits. In addition, our smaller customer base may make it difficult to generate meaningful noninterest income from non-traditional banking activities. Finally, as a highly regulated environment and may be adverselysmaller institution, we are disproportionately affected by changesthe continually increasing costs of compliance with new banking and other regulations.

Risks Related to Laws and Regulations

Changes in laws and regulations.regulations and the cost of regulatory compliance with new laws and regulations may adversely affect our operations and/or increase our costs of operations and/or decrease our revenues.

 The banking industryPeoplesBank is heavily regulated,subject to extensive regulation, supervision and such regulationsexamination by the PADOBS and the FDIC, and the Corporation is subject to extensive regulation, supervision and examination by the Federal Reserve Board. Such regulation and supervision govern the activities in which an institution and its holding company may engage and are intended primarily for the protection of depositors and the federal deposit insurance fund not shareholders. As a bank holding company, we are subject to regulation byand the Federal Reserve. Our bank subsidiary is also regulated by the Federal Deposit Insurance Corporation, or FDIC,depositors and is subject to regulation by the Pennsylvania Departmentborrowers of BankingPeoplesBank, rather than for our stockholders.

Regulatory authorities have extensive discretion in their supervisory and Securities and recently, by regulations promulgated by the Consumer Financial Protection Bureau (CFPB) as to consumer financial services and products. These regulations affect lending practices, capital structure, investment practices, dividend policy, and growth. In addition, we have non-bank operating subsidiaries from which we derive income. One of these non-bank subsidiaries, Codorus Valley Financial Advisors, Inc. d/b/a PeoplesWealth Advisors, engages in providing investment management and insurance brokerage services, industries that are also heavily regulated on both a state and federal level. In addition, newly enacted and amended laws, regulations, and regulatory practices affecting the financial service industry may result in higher capital requirements, higher insurance premiums and limit the manner in which we may conduct our business. Such changes may adversely affect us,enforcement activities, including our ability to offer new products and services, obtain financing, attract deposits, make loans and leases and achieve satisfactory spreads, and may also result in the imposition of additional costsrestrictions on us. As a public corporation, we are also subject toour operations, the corporate governance standards set forth in the Sarbanes-Oxley Act of 2002, as well as any applicable rules or regulations promulgated by the SEC and The NASDAQ Global Market.

Compliance with such current and potential regulation and scrutiny may significantly increase our costs, impede the efficiencyclassification of our internal business processes, affect retention of key personnel, require us to increase our regulatory capital, require us to invest significant management attentionassets and resources and limit our ability to pursue business opportunities in an efficient manner.

We recently became subject to more stringent capital requirements.

The Dodd-Frank Act required the federal banking agencies to establish minimum leverage and risk-based capital requirements for insured banks and their holding companies. The federal banking agencies issued a joint final rule, or the Final Capital Rule, that implements the Basel III capital standards and establishes the minimum capital levels required under the Dodd-Frank Act. Certain capital requirements mandated by the Final Capital Rule became effective January 1, 2015. The Final Capital Rule establishes a minimum common equity Tier I capital ratio of 6.5 percent of risk-weighted assets for a “well capitalized” institution and increases the minimum Tier I capital ratio for a “well capitalized” institution from 6 percent to 8 percent. Additionally, the Final Capital Rule requires an institution to maintain a 2.5 percent common equity Tier I capital conservation buffer over the 6.5 percent minimum risk-based capital requirement for “adequately capitalized” institutions, or face restrictions on the ability to pay dividends, discretionary bonuses, and engage in share repurchases. For bank holding companies under $15 billion in assets as of December 31, 2009, the Final Capital Rule permanently grandfathers trust preferred securities issued before May 19, 2010, subject to a limit of 25 percent of Tier I capital. The Final Capital Rule increases the required capital for certain categories of assets, including high-volatility construction real estate loans and certain exposures related to securitizations; however, the Final Capital Rule retains the current capital treatment of residential mortgages. Implementation of these standards, or any other new regulations, may adversely affect our ability to pay dividends, or require us to reduce business levels or raise capital, including in ways that may adversely affect our results of operations or financial condition.

The soundness of other financial services institutions may adversely affect our credit risk.

Our ability to engage in funding transactions could be adversely affected by the actions and failure of other financial institutions. Financial services institutions are interrelated as a result of trading, clearing, counterparty, or other relationships. We have exposure to many different industries and counterparties, and we routinely execute transactions with counterparties in the financial services industry, including brokers and dealers, commercial banks, investment banks, mutual funds, and other institutional clients. As a result, defaults by, or even questions or rumors about, one or more financial services institutions, or the financial services industry generally, have led to market-wide liquidity problems and could lead to losses or defaults by us or other institutions. Many of these transactions expose us to operational and credit risk in the event of default of our counterparty or client. In addition, our credit risk may be exacerbated when the collateral held by us cannot be realized upon or is liquidated at prices not sufficient to recover the full amount of the loan or derivative exposure due us. Losses related to these credit risks could materially and adversely affect our results of operations or earnings.

We are required to make a number of judgments in applying accounting policies and different estimates and assumptions in the application of these policies could result in a decrease in capital and/or other material changes to our reports of financial condition and results of operations.

Material estimates that are particularly susceptible to significant change relate to the determination of the level of our allowance for loan losseslosses. These regulations, along with existing tax, accounting, securities, insurance and reserve for unfunded lending commitments,monetary laws, rules, standards, policies, and interpretations, control the effectiveness of derivativesmethods by which financial institutions conduct business, implement strategic initiatives and other hedging activities,tax compliance, and the fair value of certaingovern financial instruments (securities, derivatives,reporting and privately held investments), income tax assets or liabilities (including deferred tax assetsdisclosures. Any change in such regulation and any related valuation allowance), and share-based compensation. While we have identified those accounting policies that are considered critical and have procedures in place to facilitate the associated judgments, different assumptionsoversight, whether in the applicationform of these policies could result in a decrease to net income and, possibly, capital andregulatory policy, regulations, legislation or supervisory action, may have a material adverse effectimpact on our financial condition and results of operations.

From time to time, the Financial Accounting Standards Board, or FASB, and the SEC change the financial accounting and reporting guidance that governs the preparation of our financial statements. These changes are beyond our control, can be difficult to predict, and could materially impact, potentially even retroactively, how we report our financial condition and results of operations. WeFor example, in the interest of consumer protection, the Consumer Financial Protection Bureau (“CFPB”), has recently been active in pursuing actions against financial institutions for charging certain fees that they have characterized as “junk fees.” These fees can take a number of forms, including without limitation, fees related to late loan payments, fees for insufficient funds, repossession fees and processing fees. In a number of instances the CFPB has challenged the imposition of fees by the involved financial institution without regard to whether such fees appropriately compensate the financial institution for the service provided and were disclosed to the customer. Although PeoplesBank is not regulated by the CFPB, the actions of the CFPB can have an influential impact on the supervisory actions of other bank regulators at the federal and state level, in particular, in PeoplesBank’s case, the FDIC as its primary federal banking regulator.

Non-compliance with the USA PATRIOT Act, Bank Secrecy Act, or other laws and regulations could result in fines or sanctions.

The USA PATRIOT and Bank Secrecy Acts require financial institutions to develop programs to prevent financial institutions from being used for money laundering and terrorist activities. If such activities are detected, financial institutions are obligated to file suspicious activity reports with the U.S. Treasury’s Office of Financial Crimes Enforcement Network. These rules require financial institutions to establish procedures for identifying and verifying the identity of customers seeking to open new financial accounts. Failure to comply with these regulations could result in fines or sanctions, including restrictions on pursuing acquisitions or establishing new branches. The policies and procedures we have adopted that are designed to assist in compliance with these laws and regulations may not be effective in preventing violations of these laws and regulations.

The Federal Reserve Board may require us to commit capital resources to support PeoplesBank, and we may not have sufficient access to such capital resources.

Federal law requires that a holding company act as a source of financial and managerial strength to its subsidiary bank and to commit resources to support such subsidiary bank. Under the “source of strength” doctrine, the Federal Reserve Board may require a holding company to make capital injections into a troubled subsidiary bank and may charge the holding company with engaging in unsafe and unsound practices for failure to commit resources to a subsidiary bank. A capital injection may be required at times when the holding company may not have the resources to provide it and therefore may be required to apply newattempt to borrow the funds or revised guidance retrospectively, which may resultraise capital. Thus, any borrowing that must be done by the Corporation to make a required capital injection becomes more difficult and expensive and could have an adverse

effect on our business, financial condition and results of operations. Moreover, it is possible that we will be unable to borrow funds or otherwise raise capital at a time when it is needed.

Monetary policies and regulations of the Federal Reserve Board could adversely affect our business, financial condition and results of operations.

In addition to being affected by general economic conditions, our earnings and growth are affected by the policies of the Federal Reserve Board. An important function of the Federal Reserve Board is to regulate the money supply and credit conditions. Among the instruments used by the Federal Reserve Board to implement these objectives are open market purchases and sales of U.S. government securities, adjustments of the discount rate and changes in banks’ reserve requirements against bank deposits. These instruments are used in varying combinations to influence overall economic growth and the distribution of credit, bank loans, investments and deposits. Their use also affects interest rates charged on loans or paid on deposits.

The monetary policies and regulations of the Federal Reserve Board have had a significant effect on the operating results of financial institutions in the revisionpast and are expected to continue to do so in the future. The effects of priorsuch policies upon our business, financial statements by material amounts. The implementationcondition and results of new or revised guidance could result in material adverse effects to our reported capital.

operations cannot be predicted.

We may elect or needbe required to seekraise additional capital in the future, but that capital may not be available when needed.it is needed, or it may only be available on unacceptable terms, which could adversely affect our financial condition and results of operations.

We are required by federal and state regulatory authorities to maintain adequate levels of capital to support our operations. In the future, weWe may elect orat some point, however, need to raise additional capital.capital to support continued growth or be required by our regulators to increase our capital resources. Our ability to raise additional capital, if needed, will depend on conditions in the capital markets at that time, which are outside of our control, and on our financial performance. Accordingly, we cannot assure you of our abilitymay not be able to raise additional capital, if needed, on terms acceptable terms.to us. If we cannot raise additional capital when needed, our ability to further expand our operations through internaland pursue our growth or acquisitionsstrategy could be materially impaired.impaired and our financial condition and liquidity could be materially and adversely affected. In addition, if we are unable to raise additional capital when required by our bank regulators, we may be subject to adverse regulatory action.

We qualify as a “smaller reporting company” pursuant to regulations of the Securities and Exchange Commission (“SEC”), and any decision on our part to comply only with certain reduced reporting and disclosure requirements applicable to smaller reporting companies could make our common stock less attractive to investors.

We are a smaller reporting company, and, for as long as we continue to qualify as a smaller reporting company, we may choose to take advantage of exemptions from various reporting requirements applicable to other public companies but not to smaller reporting companies, including, but not limited to, reduced disclosure obligations regarding executive compensation in our periodic reports and proxy statements and two years of audited financial statements in our annual report instead of three years. As long as we are a smaller reporting company that is also not an accelerated filer, we will not be subject to Section 404(b) of the Sarbanes-Oxley Act, which would require that our independent registered public accounting firm review and attest as to the effectiveness of our internal control over financial reporting. In addition, as a non-accelerated filer, we have longer deadlines to file our periodic reports with the SEC.

We will remain a smaller reporting company and a non-accelerated filer for so long as our voting and non-voting equity held by non-affiliates (“public float”) is less than $250 million, or our annual revenues are less than $100 million and our public float is less than $700 million. The public float for this purpose is not determined at the end of the fiscal year involved, but as of the end of the company’s second fiscal quarter.

As a result of our smaller reporting company status and non-accelerated filer status, our stockholders may not have access to certain information they may deem important, and investors may find our common stock less attractive if we choose to rely on these exemptions. This could result in a less active trading market for our common stock and the price of our common stock may be more volatile.

Risks associated with system failures, interruptions,Related to Operational Matters

We face significant operational risks because of our reliance on technology. Our information technology systems may be subject to failure, interruption or breaches of security could negatively affect our earnings. cybersecurity attacks or breaches.

Information technology systems are critical to our business.

Our business requires us to collect, process, transmit and store significant amounts of confidential information regarding our customers, employees and our own business, operations, plans and business strategies. We use various technology systems to manage our clientcustomer relationships, general ledger, securities investments, deposits, and loans. Business disruptions can occur dueOur computer systems, data management and internal processes, as well as those of third parties, are integral to forces beyond our performance. Our operational risks include the risk of malfeasance by employees or persons outside our company, errors relating to transaction processing and technology, systems failures or interruptions, breaches of our internal control such as severe weather, powersystems and compliance requirements, and business continuation and disaster recovery. There have been increasing efforts by third parties to breach data security at financial institutions. Such attacks include computer viruses, malicious or telecommunications loss, accidents, cyberattacks, terrorism, health emergencies, the spreaddestructive code, ransomware attacks, phishing attacks, denial of infectious diseasesservice or pandemics. We have established policies and procedures to preventinformation or limit the impact of system failures, interruptions, andother security breaches (including privacy breachesthat could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary and cyber-attacks), but such events may still occurother information, damages to systems, or may not be adequately addressed if they do occur. In addition, any compromise of our systems could deter clients from using our products and services.other material disruptions to network access or business operations. Although we take protective measures and believe that we have not experienced any of the data breaches described above, the security of our computer systems, software, and networks may be vulnerable to breaches, unauthorized access, misuse, computer viruses, or other malicious code and cyber-attacks that could have an impact on information security.

Because the methods used to cause security attacks and data breaches change frequently, the measures we take to prevent or counteract these attacks and data breaches may not be adequate to prevent them.

In addition, we outsourcethe event of a significant amountbreakdown in our internal control systems, improper operation of our systems or improper employee actions, or a breach of our security systems, including if confidential or proprietary information were to be mishandled, misused or lost, we could suffer financial loss, loss of customers and damage to our reputation, and face regulatory action or civil litigation. Any of these events could have a material adverse effect on our financial condition and results of operations. Our insurance coverage may not adequately address such losses, or if it does, such losses may exceed insurance limits.

We rely on third-party vendors, which could expose us to additional cybersecurity risks.

Third-party vendors provide key components of our business infrastructure, including certain data processing and information services. Accordingly, our operations are exposed to certainrisk that these vendors will not perform in accordance with our contractual agreements with them, or we also could be adversely affected if such an agreement is not renewed by the third-party providers.vendor or is renewed on terms less favorable to us. If theseour third-party providers encounter difficulties, or if we have difficulty communicating with them,those service providers, our ability to adequately process and account for transactions could be affected, and our business operations could be adversely affected. While we have selected these third party vendors carefully, we do not control their actions. Any problems caused by these third parties, including as a result of their not providing us their services for any reason or their performing their services poorly, could adversely affect our ability to deliver products and services to our clients or otherwise conduct our business efficiently and effectively. Replacing these third party vendors could also entail significant delay and expense. Threats to information security also exist in the processing of client information through various other vendors and their personnel.

There have been increasing efforts on the part of third parties, including through cyber-attacks, to breach data security at financial institutions or with respect to financial transactions. There have been several recent instances involving financial services and consumer-based companies reporting the unauthorized disclosure of client or customer information or the destruction or theft of corporate data. In addition, because the techniques used to cause such security breaches change frequently, often are not recognized until launched against a target and may originate from less regulated and remote areas around the world, we may be unable to proactively address these techniques or to implement adequate preventative measures. The ability of our clients to bank remotely, including online and through mobile devices, requires secure transmission of confidential information and increases the risk of data security breaches.

The occurrence of any system failures, interruption, or breach of security could damage our reputation and result in a loss of clients and business thereby subjecting us to additional regulatory scrutiny, or could expose us to litigation and possible financial liability. Any of these eventsaffected, which could have a material adverse effect on our financial condition and results of operations. Threats to information security also exist in the processing of customer information through various other vendors and their personnel. To our knowledge, the services and programs provided to us by third parties have not experienced any material security breaches. However, the existence of cyber-attacks or security breaches at third parties with access to our data, such as vendors, may not be disclosed to us in a timely manner.

Thesoundnessofotherfinancialinstitutionscouldadverselyaffectus.

Ourabilitytoengageinroutinefundingtransactionscouldbeadverselyaffectedbytheactionsandcommercialsoundnessofotherfinancialinstitutions. Financial services institutions are interrelated as a result of trading, clearing, counterparty or other relationships.We have exposure to many differentindustries and counterparties, and we routinely execute transactions with counterparties in the financial industry.As a result, defaults by, or even rumors orquestionsabout,oneormorefinancialservicesinstitutions,orthefinancialservicesindustrygenerally,haveledtomarket-wideliquidityproblemsandcouldlead to losses or defaults by us or by other institutions. Many of these transactions expose us to credit risk in the event of default of our counterparty or client. Inaddition, our credit risk may be exacerbated when the collateral we hold cannot be realized upon or is liquidated at prices insufficient to recover the full amount of the loan. We cannot assure you that any such losses would not materially and adversely affect our business, financial condition or results of operations.

OurWe may be subject to risks and losses resulting from fraudulent activities that could adversely impact our financial performance and results of operations.

As a bank, we are susceptible to fraudulent activity that may be committed against us or our clients, which may result in financial losses or increased costs to us or our clients, disclosure or misuse of our information or our client information, misappropriation of assets, privacy breaches against our clients, litigation or damage to our reputation. We are most exposed to fraud and compliance risk in connection with the origination of loans, ACH transactions, wire transactions, ATM transactions, checking transactions, and debit cards that we have issued to our customers and through our online banking portals.

We maintain a system of internal controls and procedures may fail or could be circumvented.

Management regularly reviewsinsurance coverage to mitigate against such risks, including data processing system failures and updateserrors, and customer fraud. If our internal controls disclosure controls and procedures, and corporate governance policies and procedures in orderfail to ensure accurate financial control and reporting. Any system of controls, no matter how well designed and operated, can only provide reasonable,prevent or detect any such occurrence, or if any resulting loss is not absolute assurance that the objectives of the system are met. Any failureinsured or circumvention of our controls and/or proceduresexceeds applicable insurance limits, it could have a material adverse effect on our business, financial condition and results of operation and financial condition.operations.

Risks Related to Accounting Matters

Changes in accounting standards could affect reported earnings.

The Financial Accounting Standards Board, SEC and other regulatory bodies, that are responsible for establishing accounting and reporting standards, periodically change the financial accounting and reporting guidance that governs the preparation of our financial statements. These changes can be hard to predict and can involve judgment and discretion in their interpretation by us and our independent accounting firm. These changes could materially impact, potentially even retroactively, how we report our financial condition and results of operations.

Changes in management’s estimates and assumptions may have a material impact on our consolidated financial statements and our financial condition or operating results.

In preparing the periodic reports that we are required to file with the SEC under the Securities Exchange Act of 1934, as amended, including our consolidated financial statements, our management is required under applicable rules and regulations to make estimates and assumptions as of a specified date. These estimates and assumptions are based on management’s best estimates and experience as of that date and are subject to substantial risk and uncertainty. Materially different results may occur as circumstances change and additional information becomes known. Areas requiring significant estimates and assumptions by management include, among others, our evaluation of the adequacy of our allowance for loan losses, the calculation of our deferred tax assets and our determinations with respect to the fair values of financial instruments.

Other Risks Related to Our Business

We depend on our management team and other key personnel to implement our business strategy and execute successful operations and we could be harmed by the loss of their services or the inability to hire additional personnel.

We depend on the services of the members of our senior management team who direct our strategy and operations. Our executive officers and lending personnel possess substantial expertise as well as extensive knowledge of our markets and key business relationships. Any one of them could be difficult to replace. Our loss of these persons, or our inability to hire additional qualified personnel, could impact our ability to implement our business strategy and could have a material adverse effect on our results of operations and ability to compete in our markets.

Legal and regulatory proceedings and related matters could adversely affect us.

We have been and may in the future become involved in legal and regulatory proceedings. We consider most of the proceedings to be in the normal course of our business or typical for the industry; however, it is inherently difficult to assess the outcome of these matters, and we may not prevail in any proceedings or litigation. In addition, should we become subject to any more significant legal or regulatory proceedings, we could incur substantial expense and

management diversion, and any adverse determination could have a materially adverse effect on our business, brand or image, or our financial condition and results of our operations.

Societal responses to climate change could adversely affect our business and performance, including indirectly through impacts on our customers.

Concerns over the long-term impacts of climate change have led and will continue to lead to governmental efforts around the world to mitigate those impacts. Consumers and businesses also may change their behavior on their own as a result of these concerns. We and our customers will need to respond to new laws and regulations as well as consumer and business preferences resulting from climate change concerns. We and our customers may face cost increases, asset value reductions and operating process changes. The impact on our customers will likely vary depending on their specific attributes, including their reliance on or their involvement in carbon intensive activities. Among the impacts to us could be a drop in demand for our products and services, particularly in certain sectors. In addition, we could face reductions in creditworthiness on the part of some customers or in the value of assets securing loans. Our efforts to take these risks into account in making lending and other decisions, including by increasing our business with climate-friendly companies, may not be effective in protecting us from the negative impact of new laws and regulations or changes in consumer or business behavior.

We are a community bank and our ability to maintain our reputation is critical to the success of our business, and the failure to do so may materially adversely affect our performance.

We are a community bank, and our reputation is one of the most valuable components of our business. A key component of our business strategy is to rely on our reputation for customer service and knowledge of local markets to expand our presence by capturing new business opportunities from existing and prospective customers in our market area and contiguous areas. As such, we strive to conduct our business in a manner that enhances our reputation. This is done, in part, by recruiting, hiring and retaining employees or by retaining, appointing or electing directors who share our core values of being an integral part of the communities we serve, delivering superior service to our customers and caring about our customers and employees. If our reputation is negatively affected by the actions of our employees or directors, by our inability to conduct our operations in a manner that is appealing to current or prospective customers, or otherwise, our business and, therefore, our operating results may be materially adversely affected.

Risks Related to Our Business Strategy

We may not effectively execute on our expansion strategy, which may adversely affect our ability to maintain our historical growth and earnings trends.

Our primary expansion strategy focuses on organic growth, supplemented by branch expansion and acquisitions of financial institutions and banking teams; however, we may not be able to successfully execute on these aspects of our expansion strategy, which may causeour futuregrowthrateto decline belowour recenthistorical levels,or prevent us fromgrowingatall.More specifically,wemaynotbeabletogeneratesufficientnewloansanddepositswithinacceptableriskandexpensetolerances or obtain the personnel or funding necessary for additional growth. Various factors, such as economic conditions and competitionwithotherfinancialinstitutions,mayimpedeorrestrictthegrowthofouroperations.Further,wemaybeunable to attract and retain experienced bankers, which could adversely affect our growth. The success of our strategy also dependsonourabilitytomanageourgrowtheffectively,whichinturndependson many factors,includingourability to adapt our credit, operational, technology, risk management, internal controls and governance infrastructure to accommodate expanded operations. Even if we are successful in continuing our growth, such growth may not offer the samelevels ofpotentialprofitability,andwemay notbesuccessfulincontrollingcosts andmaintainingassetquality inthe face of that growth. Accordingly, our inability to maintain growth or to effectively manage growth could have an adverse effect on our business, financial condition and results of operations.

We may incur fines, penalties and other negative consequences from regulatory violations, possibly even inadvertentgrow through mergers or unintentional violations.

We maintain systems and procedures designed to ensureacquisitions, including branch acquisitions, a strategy that we comply with applicable laws and regulations. However, some legal/regulatory frameworks provide for the imposition of finesmay not be successful or, penalties for noncompliance even though the noncompliance was inadvertent or unintentional and even though there was in place at the time systems and procedures designed to ensure compliance. For example, we are subject to regulations issued by the Office of Foreign Assets Control, or OFAC, that prohibit financial institutions from participating in the transfer of property belonging to the governments of certain foreign countries and designated nationals of those countries. OFACif successful, may impose penalties for inadvertent producerisksinsuccessfullyintegratingandmanagingthemergedcompaniesor unintentional violations even if reasonable processes are in place to prevent the violations. There acquisitionsandmay be other negative consequences resulting from a finding of noncompliance, including restrictions on certain activities. Such a finding may also damage diluteour reputation as described below and could restrict the ability of institutional investment managers to invest in our securities.

stockholders.

The inabilityAs part of our growth strategy, we may pursue mergers and acquisitions of banks and non-bank financial services companieswithinoroutsideourprincipalmarketareasthatwe believe will supportourbusinessandmakefinancialandstrategicsense.Wemayhavedifficultyidentifyingsuitableacquisition candidatesorexecutingonacquisitionsthatwepursue,andwemaynotrealizetheanticipatedbenefitsofanytransactions we complete. Additionally, for any acquisition we consider, we expect to hire or retain key personnel could adversely affect our business.

Our success is dependent upon our ability to attract and retain highly skilled individuals. We face intensesignificant competition from variousnumerous other financial services institutions, as well as from non-bank providersmany of which will have greater financial services, such as credit unions, brokerage firms, insurance agencies, consumer finance companies and government organizations, for the attraction and retention of key personnel, specifically those who generate and maintain our client relationships and serve in other key operation positions in the areas of finance, credit oversight and administration, and wealth management. These competitorsresources than we do. Accordingly, attractive acquisition opportunities may offer greater compensation and benefits, which could result in the loss of potential and/or existing substantial client relationships and may adversely affect our ability to compete effectively. The unexpected loss of services of one or more of these or other key personnel could have a material adverse impact on our business because of their skills, knowledge of the markets in which we operate, years of industry experience and the difficulty of promptly finding qualified replacement personnel.

Damage to our reputation could significantly harm our business, including our competitive position and business prospects.

We are dependent on our reputation within our market area, as a trusted and responsible financial corporation, for all aspects of our relationships with clients, employees, vendors, third-party service providers, and others, with whom we conduct business or potential future business. Our ability to attract and retain clients and employees couldnot be adversely affected if our reputation is damaged. Our actual or perceived failure to address various issues could give rise to reputational risk that could cause harmavailable to us, and our business prospects. These issues also include, but are not limited to, legal and regulatory requirements; properly maintaining client and employee personal information; record keeping; money-laundering; sales and trading practices; ethical issues; appropriately addressing potential conflicts of interest; and the proper identification of the legal, reputational, credit, liquidity and market risks inherent in our products. Failure to appropriately address any of these issues could also give rise to additional regulatory restrictions and legal risks, which could, among other consequences, increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties and incur related costs and expenses.

We continually encounter technological change, and we may have fewer resources than our competitors to continue to invest in technological improvements, which could reduce our ability to effectively compete.

Our future success depends, in part, on our ability to effectively embrace technological efficiencies to better serve clients and reduce costs. Many of our competitors have substantially greater resources to invest in technological improvements. Therethere can be no assurance that we will be ablesuccessful in identifying or completing any future acquisitions.

Mergersandacquisitionsinvolvenumerousrisks,anyofwhichcouldharmourbusiness, including:

thepossibilitythatexpectedbenefitsmaynotmaterializeinthetimeframeexpectedoratall,ormaybemorecostly to effectively implement new technology-drivenachieve, or that the acquired business will not perform to our expectations;

time, expense and difficulties in integrating the operations, management, products and services, technologies, existing contracts, accounting processes and personnel of the target and realizing the anticipated synergies of the combined businesses;

incurring the time and expense associated with identifying and evaluating potential acquisitions and merger partners and negotiating potential transactions, resulting in management’s attention being diverted from the operation of our existing business;

difficulties in supporting and transitioning customers of the target and disruption of our ongoing banking business;

the price we pay or other resources that we devote may exceed the value we realize, or the value we could have realized if we had allocated the purchase consideration or other resources to another opportunity;

entering new markets or areas in which we have limited or no experience;

the possibility that our culture is disrupted as a result of an acquisition;

potential loss of key personnel and customers from either our business or the target’s business;

assumption of unanticipated problems, claims or other liabilities of the acquired business;

an inability to realize expected synergies or returns on investment;

the possibility of regulatory approval for the acquisition being delayed, impeded, restrictively conditioned or denied due to existing or new regulatory issues surrounding us, the target institution or the proposed combined entity and the possibility that any such issues associated with the target institution, of which we may or may not be aware at the time of the acquisition, could adversely impact the combined entity after completion of the acquisition;

the possibility that the acquisition may not be timely completed, if at all;

the need to raise capital; and

inability togeneratesufficientrevenuetooffsetacquisition costs.

Our acquisition activities, should they materialize, could require us to use a substantial amount of cash, other liquid assets, and/or incur debt. Also, if we finance acquisitions by issuing equity securities, our existing stockholders’ ownership may be diluted, which could reducenegatively affect the market price of our abilitycommon stock. Additionally, if the goodwill recorded in connection with our potential future acquisitions were determined to effectively compete. Failurebe impaired, then we would be required to keep pace with technological changerecognize a charge against our earnings, which could potentially have an adverse effect on our business operationsmaterially and financial condition.

Competition from other financial institutions in originating loans, attracting deposits and providing various financial services may adversely affect our profitability.results of operations during the period in which the impairment was recognized. Acquisitions may also involve the payment of a premium over book and market values and, therefore, some dilution of our tangible book value and net income per common share may occur in connection with any future transaction.

Our banking subsidiary faces substantial competition in originating loans, both commercial and consumer. This competition comes principally from other banks, savings institutions, mortgage banking companies, and other lenders. Many of our competitors enjoy advantages over us, including greater financial resources and higher lending limits, a wider geographic presence, more accessible branch office locations, the ability to offer a wider array of services or more favorable pricing alternatives, as well as lower origination and operating costs. This competition could reduce our net income by decreasing the number and size of loans that our banking subsidiary originates and the interest rates it may charge on these loans.

In attracting business and consumer deposits, our bank subsidiary faces substantial competition from other insured depository institutions such as banks, savings institutions and credit unions, as well as institutions offering uninsured investment alternatives, including money market funds. Many of our competitors enjoy advantages over us, including greater financial resources, more aggressive marketing campaigns and better brand recognition and more branch locations. These competitors may offer higher interest rates than we do, which could decrease the deposits that we attract or require us to increase our rates to retain existing deposits or attract new deposits. Increased deposit competition could adversely affect our ability to generate the funds necessary for lending operations. As a result, we may need to seek other sourcesnot achieve the anticipated benefits of funds thatany such merger or acquisition, and we may be more expensive to obtain and could increase our costincur costs in excess of funds.

what we anticipate. Our banking and non-banking subsidiaries also compete with non-bank providers of financial services, such as brokerage firms, consumer finance companies, credit unions, insurance companies and governmental organizations which may offer more favorable terms. Some of our non-bank competitors are not subject to the same extensive regulations that govern our banking operations. As a result, such non-bank competitors may have advantages over our banking and non-banking subsidiaries in providing certain products and services. This competition may reduce or

limit our margins on banking and non-banking services, reduce our market share, and adversely affect our earnings and financial condition.

We may not be ablefailure to successfully maintainevaluate and manage our growth.

We continue to execute on our acquisition and organic branching initiatives, which are intended to develop our branch infrastructure in a manner more consistent with the expansion of lending markets and to fill in and grow our branch footprint. As we continue to grow through ourmergers, acquisitions branching and other strategic initiatives, we cannot be certain as to our ability to manage increased levels of assets and liabilities. We may be required to make additionalor investments in equipment and personnel to manage higher asset levels and loans balances, which may adversely impact our efficiency ratio, earnings and shareholder returns.or otherwise

The financial impact adequatelyaddressand difficulties in integrating future acquisitions managetherisksassociatedwithsuchtransactionscould adversely affect our business.

The efficient and effective integration of any businesses we acquire into our organization is critical to the financial success of an acquisition transaction. Any future acquisitions involve numerous risks, including difficulties in integrating the culture, operations, technologies and personnel of the acquired companies, the diversion of management’s attention from other business concerns and the potential loss of clients. Failure to successfully integrate the operations of any future acquisitions could also harmhaveamaterialadverseeffect on our business, results of operations and cash flows.

The impacts of COVID-19 pandemic

In December 2019, a coronavirus (COVID-19) was reported in China, and, in March 2020, the World Health Organization declared it a pandemic. Since first being reported in China, the coronavirus has spread to additional countries including the United States. On March 13, 2020, President Trump declared the ongoing COVID–19 pandemic of sufficient severity and magnitude to warrant an emergency declaration for all states, territories, and the District of Columbia.

In response, many state and local governments, including the Commonwealth of Pennsylvania and the State of Maryland, have instituted emergency restrictions that have substantially limited the operation of non-essential businesses and the activities of individuals. It has been widely reported that these restrictions have resulted in significant adverse effects for many different types of businesses, particularly those in the travel, hospitality and food and beverage industries, among many others, and has resulted in a significant number of layoffs and furloughs of employees nationwide and in the regions in which the Corporation operates. The ultimate effect of COVID-19 on the local or broader economy is not known nor is the ultimate length of the restrictions described and any accompanying effects. Moreover, the Federal Reserve has taken action to lower the Federal Funds rate, which has negatively affected interest income and, therefore, earnings. Given the ongoing and dynamic nature of the circumstances, it is difficult to predict the full impact of the coronavirus outbreak, and there is no guarantee that the Corporation’s efforts to address the adverse impacts of the coronavirus will be effective. The extent of such impact will depend on future developments, which are highly uncertain and cannot be predicted, including new information which may emerge concerning the severity of the coronavirus and actions taken to contain the coronavirus or its impact, among others.

The effect of COVID-19 and related events, including those described above and those not yet known or knowable, could have a negative effect on the Corporation's business prospects, financial condition, including short-term and results of operations, as a result of quarantines; market volatility; market downturns; changes in consumer behavior; business closures; deterioration in the credit quality of borrowers or the inability of borrowers to satisfy their obligations (and any related forbearances or restructurings that may be implemented); changes in the value of collateral securing outstanding loans; changes in the value of the investment securities portfolio; effects on key employees, including operational management personnel and those charged with preparing, monitoring and evaluating the Corporation's financial reporting and internal controls; declines in the demand for loans and other banking services and products; declines in demand resulting from adverse impacts of the disease on businesses deemed to be "non-essential" by governments; and branch or office closures and business interruptions.

In addition, the adverse economic effects of the coronavirus may lead to an increase in credit risk on the Corporation’s commercial and residential loan portfolios. Likewise, the Corporation is also monitoring the fluctuations in the markets as it pertains to interest rates and fair value of our investments for other than temporary impairment (OTTI). To curtail the spread of the virus, we are currently operating with modified branch access and taking other precautionary measures.

On March 27, 2020, the Coronavirus Aid, Relief and Economic Security (CARES) Act was signed into law. Section 4013 of the CARES Act, “Temporary Relief From Troubled Debt Restructurings,” provides banks the option to temporarily suspend certain requirements under U.S. GAAP related to trouble debt restructurings (TDR) for a limited

period of time to account for the effects of COVID-19. Section 541 of the Consolidated Appropriations Act, 2021 (CAA) was signed into law on December 27, 2020, extending the provisions in Section 4013 of the CARES Act to January 1, 2022.

While the Corporation continues to evaluate the disruption caused by the pandemic and impact of the CARES Act, these events may have a material adverse impact on the Corporation’s results of future operations, financial position, capital, and liquidity in fiscal year 2022. Further, a decrease in results of future operations may place a strain on the Corporation’s capital reserve ratios.

Our business could be adversely impacted by a potential proxy contest for the election of directors at our 2022 Annual Meeting of Shareholders and/or the actions of activist shareholders.

In February 2022, Driver Company Management (“DCM”) notified the Corporation of its intent to nominate three candidates for election to our Board of Directors at our 2022 Annual Meeting of Shareholders. Although our Board of Directors has not made its recommendation with respect to the director election at the 2022 Annual Meeting of Shareholders, it is possible that a proxy contest involving DCM will ensure, or that we could become engaged in a proxy contest with another activist shareholder in the future. A potential proxy contest for the election of directors or related activities on the part of DCM or other activist shareholders could be time-consuming and may result in the Corporation incurring substantial costs, including proxy solicitation, public relations, and legal and advisory fees. Further, such a proxy contest or related activities could divert the attention of our Board of Directors, senior management, and employees. The actions of DCM and other activist shareholders may also create perceived uncertainties as to the future direction of our business or strategy, which may be exploited by our competitors and may make it more difficult to attract and retain qualified personnel, may make it more difficult to pursue strategic initiatives and may impact our relationship with investors, business partners, customers and other third parties. We may choose to initiate, or may become subject to, litigation as a result of a proxy contest or matters arising from a proxy contest, which would serve as a further distraction to our Board of Directors, senior management and employees and would require us to incur significant additional costs. A proxy contest or related activities could also impact the market price and the volatility of our common stock.

long-term liquidity.

Risks Related to Our Common Stock

The market price of our common stock may fluctuate significantly, and this may make it difficult for you to resell shares of common stock owned by you at times or at prices you find attractive.

The market price of our common stock on the NASDAQ Global Market constantly changes. We expect that the market price of our common stock will continue to fluctuate and there can be no assurance about the market prices for our common stock.

Stock price volatility may make it difficult for you to resell your common stock when you want and at prices you find attractive. Our stock price may fluctuate significantly as a result of a variety of factors, many of which are beyond our control. These factors include, among others:

actual or anticipated variations in quarterly results of operations or quality of our assets;

recommendations byopinions of securities analysts;analysts about our stock as an investment;

institutional and other investor interest in purchasing, holding or selling our stock;

operating and stock price performance of other companies that investors deem comparable to us;

any failure to pay dividends on our common stock or a reduction in cash dividends;

continued levels of loan quality and volume origination;

the adequacy of loan loss reserves;

the willingness of clients to substitute competitors’ products and services for our products and services and vice versa, based on price, quality, relationship or otherwise;

interest rate, market and monetary fluctuations;

declines in the fair value of our available-for-sale securities that are deemed to be other-than-temporarily impaired;

the timely development of competitive new products and services by us and the acceptance of such products and services by clients;

changes in consumer spending and saving habits relative to the financial services we provide;

our relationships with major clients;

our ability to continue to grow our business internally and through acquisition and successful integration of new or acquired entities while controlling costs;

news reports relating to trends, concerns and other issues in the financial services industry, including the failures of other financial institutions in the current economic downturn;

perceptions in the marketplace regarding us and/or our competitors;

rapidly changing technology, or new technology used, or services offered, by competitors;

deposit flows;

changes in accounting principles, policies and guidelines;

significant acquisitions or business combinations, strategic partnerships, joint ventures or capital commitments by or involving us or our competitors;

failure to integrate acquisitions or realize anticipated benefits from acquisitions;

changes in and compliance with laws and government regulations of federal, state and local agencies;

effects of climate change;

geopolitical conditions such as acts or threats of terrorism or military conflicts;

natural disasters or severe weather conditions;

health emergencies, the spread of infectious diseases or pandemics;

cybercybersecurity attacks or breaches or breaches of physical premises, including data centers;

failure to retain or attract key personnel;

operating results that vary from the expectations of management, analysts and investors;

future sales of our equity or equity-related securities;

the credit, mortgage and housing markets, the markets for securities relating to mortgages or housing, and developments with respect to financial institutions generally; and

the relatively low trading volume of our common stock.

General market fluctuations, industry factors and general economic and political conditions and events, such as economic slowdowns or recessions, interest rate changes or credit loss trends, could also cause our stock price to decrease regardless of operating results as evidenced by the currentrecent volatility and disruption of capital and credit markets.

The trading volume of our common stock may not provide adequate liquidity for investors and is less than that of other financial services companies.

Our common stock is listed under the symbol “CVLY” on the NASDAQ Global Market. The average daily trading volume for shares of our common stock is less than larger financial institutions. As a result, sales of our common stock may place significant downward pressure on the market price of our common stock. Furthermore, it may be difficult for holders to resell their shares at prices they find attractive, or at all.

We may issue additional common stock or other equity securities in the future which could dilute the ownership interest of existing shareholders.stockholders.

In order to maintain our capital at desired or regulatory-required levels or to replace existing capital, we may be required to, or otherwise determine it advantageous to issue additional shares of common stock, or securities convertible into, exchangeable for or representing rights to acquire shares of common stock. Generally, we are not restricted from issuing such additional shares. We may sell any shares that we issue at prices below the current market price of our common stock, and the sale of these shares may significantly dilute shareholderstockholder ownership. We could also issue additional shares in connection with acquisitions of other financial institutions or in connection with our equity compensation plans. Additional equity offerings may dilute the holdings of our existing shareholdersstockholders or reduce the market price of our common stock, or both.

Offerings of debt and/or preferred equity securities may adversely affect the market price of our common stock.

We may attempt to increase our capital resources or, if our or our subsidiary bank’sPeoplesBank’s capital ratios fall below the required regulatory minimums, we could be forced to raise additional capital by making additional offerings of debt or preferred equity securities, including medium-term notes, trust preferred securities, senior or subordinated notes and preferred stock. Upon liquidation, holders of our debt securities and shares of preferred stock and lenders with respect to other borrowings are likely to receive distributions of our available assets prior to the holders of our common stock. Additional equity offerings may dilute the holdings of our existing shareholdersstockholders or reduce the market price of our common stock, or both. Holders of our common stock are not entitled to preemptive rights or other protections against dilution.

Our board of directors is authorized to issue one or more classes or series of preferred stock from time to time without any action on the part of the shareholders.stockholders. Our board of directors also has the power, without shareholderstockholder approval, to

set the terms of any such classes or series of preferred stock that may be issued, including voting rights, dividend rights, and preferences over our common stock with respect to dividends or upon our dissolution, winding up and liquidation and other terms. If we issue preferred stock in the future that has a preference over our common stock with respect to the payment of dividends or upon our liquidation, dissolution or winding up, or if we issue preferred stock with voting rights that dilute the voting power of our common stock, the rights of holders of our common stock or the market price of our common stock could be adversely affected.

Our common stock is subordinate to our existing and future indebtedness and preferred stock, if issued, and effectively subordinated to all the indebtedness and other non-common equity claims against our subsidiaries.

Shares of our common stock are equity interests in usthe Corporation and do not constitute indebtedness. As such, shares of our common stock rank junior to all of our indebtedness and to other non-equity claims against us and our assets available to satisfy claims against us, including in our liquidation. Additionally, holders of our common stock could be subject to the prior dividend and liquidation rights of holders of our preferred stock. Furthermore, our right to participate in a distribution of assets upon any of our subsidiaries’ liquidation or reorganization is subject to the prior claims of that subsidiary’s creditors.

We may attempt to increase our capital resources or, if our or the Bank’sPeoplesBank’s capital ratios fall below the required regulatory minimums, we could be forced to raise additional capital by making additional offerings of debt or preferred equity securities, including medium-term notes, trust-preferred securities, senior or subordinated notes andand/or preferred stock. Upon liquidation, holders of our debt securities and shares of preferred stock and lenders with respect to other borrowings are likely to receive distributions of our available assets prior to the holders of our common stock.

We are currently authorized to issue up to 30,000,000 shares of common stock of which 9,472,4049,581,230 shares were outstanding as of December 31, 2021,2022, and up to 1,000,000 shares of preferred stock, none of which were outstanding as of December 31, 2021.2022. Our board of directors has authority, without action or vote of the shareholdersstockholders of common stock, to issue all or part of the authorized but unissued shares. Authorized but unissued shares of our common stock or preferred stock could be issued on terms or in circumstances that could dilute the interests of other shareholders.stockholders.

Regulatory and contractual restrictions may limit or prevent us from paying dividends or repurchasing shares of our common stock, or we may choose not to pay dividends on or repurchase, our common stock.

The CompanyCorporation is an entity separate and distinct from its principal subsidiary, PeoplesBank, and we derive substantially all of our revenue in the form of dividends from that subsidiary. Accordingly, we are and will be dependent upon dividends from PeoplesBank to pay the principal of and interest on our indebtedness, to satisfy our other cash needs and to pay dividends on our common and preferred stock. The Bank’sstock, if any. PeoplesBank’s ability to pay dividends is subject to its ability to earn net income and to meet certain regulatory requirements. In the event PeoplesBank is unable to pay dividends to us, we may not be able to pay dividends on our common or preferred stock.stock, if any. Also, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors, including those of its depositors.

As described below in the next risk factor, the terms of our outstanding junior subordinated debt securities prohibit us from paying dividends on or repurchasing our common stock at any time when we have elected to defer the payment of interest on such debt securities or certain events of default under the terms of those debt securities have occurred and are continuing. These restrictions could have a negative effect on the value of our common stock. Moreover, holders of our common stock are entitled to receive dividends only when, as and if declared by our board of directors.

Although we have historically paid cash dividends on our common stock, we are not required to do so and our board of directors could reduce, suspend or eliminate our common stock cash dividend in the future. No determination has been made by our board of directors regarding whether or what amount of dividends will be paid in future quarters. Additionally, there can be no assurance that regulatory approval will be granted by the Federal Reserve Board to pay dividends. Future payment of cash dividends, if any, will be at the discretion of our board of directors and will be dependent upon our financial condition, results of operations, capital requirements and such other factors as the board may deem relevant and will be subject to applicable federal and state laws that impose restrictions on our and our bank subsidiary’sPeoplesBank’s ability to pay dividends, as well as guidance issued from time to time by regulatory authorities.

Under guidance issued by the Federal Reserve Board, as a bank holding company we are expected to consult the Federal Reserve before declaring dividends in certain situations, and may require its prior approval, and we are to strongly consider eliminating, deferring, or reducing dividends we pay to our shareholdersstockholders if (1) our net income available to shareholdersstockholders for the past four quarters, net of dividends previously paid during that period, is not sufficient to fully fund the dividends, (2) our prospective rate of earnings retention is not

consistent with our capital needs and overall current and prospective financial condition, or (3) we will not meet, or are in danger of not meeting, our minimum regulatory capital adequacy ratios.

If we defer payments of interest on our outstanding subordinated notes or junior subordinated debt securities or if certain defaults relating to those debt securities occur, we will be prohibited from declaring or paying dividends or distributions on, and from making liquidation payments with respect to, our common stock.

As of December 31, 2021,2022, we had $31,000,000 outstanding aggregate principal amount of subordinated debt evidenced by subordinated notes and note purchase agreements and $10,310,000 outstanding aggregate principal amount of junior subordinated debt securities issued in connection with the sale of trust preferred securities by certain of our subsidiaries that are statutory business trusts. We have also guaranteed those trust preferred securities. There are currently two separate series of these junior subordinated debt securities outstanding, each series having been issued under a separate indenture and with a separate guarantee. The note purchase agreements and each of these indentures, together with the related guarantee, prohibits us, subject to limited exceptions, from declaring or paying any dividends or distributions on, or redeeming, repurchasing, acquiring or making any liquidation payments with respect to, any of our capital stock at any time when (i) there shall have occurred and be continuing an event of default under the note purchase agreement or indenture or any event, act or condition that with notice or lapse of time or both would constitute an event of default under the note purchase agreement or indenture; or (ii) we are in default with respect to payment of any obligations under the related guarantee; or (iii) we have deferred payment of interest on the junior subordinated debt securities outstanding under that indenture. In that regard, we are entitled, at our option but subject to certain conditions, to defer payments of interest on the junior subordinated debt securities of each series from time to time for up to five years.

Events of default under each note purchase agreement and indenture generally consists of our failure to pay interest on the subordinated notes or junior subordinated debt securities outstanding under the indenture under certain circumstances, our failure to pay any principal of or premium on such subordinated notes or junior subordinated debt

securities when due, our failure to comply with certain covenants under the note purchase agreements or indenture, and certain events of bankruptcy, insolvency or liquidation relating to us or the Bank.PeoplesBank.

As a result of these provisions, if we were to elect to defer payments of interest on any series of junior subordinated debt securities, or if any of the other events described in clause (i) or (ii) of the first paragraph of this risk factor were to occur, we would be prohibited from declaring or paying any dividends on our common stock, from redeeming, repurchasing or otherwise acquiring any of our common stock, and from making any payments to holders of our common stock in the event of our liquidation, which would likely have a material adverse effect on the market value of our common stock. Moreover, without notice to or consent from the holders of our common stock, we may issue additional series of subordinated notes or junior subordinated debt securities in the future with terms similar to those of our existing subordinated notes or junior subordinated debt securities or enter into other financing agreements that limit our ability to purchase or to pay dividends or distributions on our capital stock, including our common stock.

Our common stock is not insured by any governmental entity.

Our common stock is not a deposit account or other obligation of any bank and, therefore, is not insured against loss by the FDIC, any other deposit insurance fund, any other governmental entity or by any other public or private entity. Investment in our common stock is inherently risky for the reasons described in this “Risk Factors” section and elsewhere in this document and our other filings with the SEC, and is subject to the same market forces that affect the price of common stock in any company. As a result, if you acquire our common stock, you may lose some or all of your investment.

Anti-takeover provisions and restrictions on ownership could negatively impact our shareholders.stockholders.

Provisions of federal and Pennsylvania law and our amended and restated articles of incorporation and bylaws could make it more difficult for a third party to acquire control of us or have the effect of discouraging a third party from attempting to acquire control of us. These provisions could make it more difficult for a third party to acquire us even if an acquisition might be in the best interest of our shareholders.stockholders. In addition, the Bank Holding Company Act of 1956, as amended, or the BHCA, requires any bank holding company to obtain the approval of the Federal Reserve Board prior to acquiring more than 5five percent of our outstanding common stock. Any person other than a bank holding company is required to obtain prior approval of the Federal Reserve Board to acquire 10 percent or more of our outstanding common stock under the Change in Bank Control Act. Any holder of 25 percent or more of our outstanding common stock or more than one-third of our equity, other than an individual, is subject to regulation as a bank holding company under the BHCA.

Our articles of incorporation and bylaws contain certain provisions that may have the effect of deterring or discouraging an attempt to take control of the Company. Among other things, these provisions:

empower our board of directors, without shareholderstockholder approval, to issue shares of our common or preferred stock the terms of which, including voting power, are set by our board;

divide our board of directors into three classes serving staggered three yearthree-year terms;

authorize our board of directors to oppose a tender or other offer for the Company’sCorporation’s securities if the board determines that such an offer should be rejected;

require the affirmative vote of holders of at least 75 percent of the outstanding shares of our common stock to approve the merger, consolidation, liquidation or dissolution of the Company,Corporation, or any sale or other disposition of all or substantially all of the assets of the Company,Corporation, excepting transactions described above that are approved by at least 80 percent of the members of the Boardboard of Directors,directors, where such transactions shall only require shareholderstockholder approval by a majority of the votes cast at the shareholders meeting;meeting of stockholders held to consider and act upon such transaction;

eliminate cumulative voting in the election of directors; and

require advance notice of nominations for the election of directors and the presentation of shareholderstockholder proposals at meetings of shareholders.stockholders. 

Item 1B: Unresolved Staff Comments

Not applicable.

Item 2: Properties

Codorus Valley owns the Codorus Valley Corporate Center (“Corporate Center”), located at 105 Leader Heights Road, York, PA 17403, subject to a first lien held by ACNB Bank. The first lien held by ACNB Bank supports a $3,000,000 line of credit. No draws have been made on the line and on December 31, 2021,2022, the balance was zero. This facility serves as the corporate headquarters and is approximately 40,000 square feet, a portion of which is leased to third-parties. The Corporate Center is adjacent to PeoplesBank’s Data Operations Center and the Leader Heights financial center and is approximately one half mile from PeoplesBank’s Administrative Services Centers.

PeoplesBank owns and leases properties in York, Cumberland and Lancaster Counties, Pennsylvania and Baltimore and Harford Counties and Baltimore City in Maryland as shown below.

PART II

Item 5: Market for Registrant’s Common Equity, Related Shareholder Matters and Issuer Purchases of Equity Securities

Market Information

Codorus Valley Bancorp, Inc. stock is listed on the NASDAQ Global Market under the symbol CVLY. Codorus Valley had approximately 1,8932,080 holders of record as of February 25, 2022.22, 2023. The closing price per share of Codorus Valley’s common stock on February 25, 2022,22, 2023, was $22.02.$25.06. The following table sets forth high and low sales prices and dividends paid per common share for Codorus Valley as reported by NASDAQ during the periods indicated.