PART I

Forward-Looking Statements

Certain statements in this Form 10-K of American National Bankshares, Inc. (the "Company") may constitute "forward-looking statements" within the meaning of the Private Securities Litigation Reform Act of 1995. Forward-looking statements include, without limitation, statements regarding anticipated changes in the interest rate environment, future economic conditions and the impacts of current economic uncertainties, and projections, predictions, expectations, or beliefs about future events or results, or otherwise are not statements of historical fact. Such forward-looking statements are based on certain assumptions as of the time they are made, and are inherently subject to known and unknown risks and uncertainties, some of which cannot be predicted or quantified, that may cause actual results, performance or achievements to be materially different from those expressed or implied by such forward-looking statements. Such statements are often characterized by the use of qualified words (and their derivatives) such as "expect," "believe," "estimate," "plan," "project," "anticipate," "intend," "will," "may," "view," "seek to," "opportunity," "potential," "continue," "confidence" or words of similar meaning, or other statements concerning opinions or judgment of our management about future events. Although we believe that our expectations with respect to forward-looking statements are based upon reasonable assumptions within the bounds of our existing knowledge of our business and operations, there can be no assurance that actual future results, performance, or achievements of, or trends affecting, us will not differ materially from any projected future results, performance, achievements or trends expressed or implied by such forward-looking statements. Actual future results, performance, achievements or trends may differ materially from historical results or those anticipated depending on a variety of factors, including, but not limited to, the effects of or changes in:

More information on risk factors that could affect our forward-looking statements is included under the section entitled "Risk Factors" set forth herein. All risk factors and uncertainties described herein should be considered in evaluating forward-looking statements, all forward- looking statements made in this Form 10-K are expressly qualified by the cautionary statements contained in this Form 10-K, and undue reliance should not be placed on such forward-looking statements. The actual results or developments anticipated may not be realized or, even if substantially realized, they may not have the expected consequences to or effects on our businesses or operations. Forward-looking statements speak only as of the date they are made. We do not intend or assume any obligation to update, revise or clarify any forward- looking statements that may be made from time to time by or on behalf of the Company, whether as a result of new information, future events or otherwise.

ITEM 1 – BUSINESS

Overview

American National Bankshares Inc. is a one-bank holding company organized under the laws of the Commonwealth of Virginia in 1984. On September 1, 1984, the Company acquired all of the outstanding capital stock of American National Bank and Trust Company (the "Bank"), a national banking association chartered in 1909 under the laws of the United States. American National Bank and Trust Company is the only banking subsidiary of the Company.

As of December 31, 2023, the operations of the Company were conducted at 26 banking offices in south central Virginia and north central North Carolina. Through these offices, the Company serves its primary market area of south central Virginia, the New River Valley and Roanoke, Virginia, and north central North Carolina. The Bank provides a full array of financial products and services, including commercial, mortgage, and consumer banking; trust and investment services; and insurance. Services are also provided through 34 Automated Teller Machines ("ATMs"), "Online Banking," and "Telephone Banking."

The Company has two reportable segments, (i) community banking and (ii) wealth management. For more financial data and other information about each of the Company's operating segments, refer to "Note 21 - Segment and Related Information" of the Consolidated Financial Statements contained in Item 8 of this Form 10-K.

Human Capital Resources

Profile

At December 31, 2023, the Company employed 334 full-time persons and 40 part-time persons. None of our employees are represented by a union or covered under a collective bargaining agreement. In the opinion of the management of the Company, relations with employees of the Company and the Bank are good.

As a holding company for a community bank, the Company is a relationship-driven organization. A key aspect of the Company's business strategy is for its senior officers to have primary contact with current and potential customers. The Company's growth and development are in large part a result of these personalized relationships with the customer base. The success of the Company also often depends on its ability to hire and retain qualified banking officers. The Company's senior officers have considerable experience in the banking industry and related financial services and are extremely valuable.

Corporate Culture 

The Company believes that as a regional community bank it is only as strong as the communities it serves, and has established core values to guide the organization. We are relationship focused establishing trust by respecting others and doing the right thing. We work together as a team and value diverse perspectives that help move us forward together. We fulfill commitments through responsive communication and service to and with our employees, shareholders and customers. We strive to embrace change as it comes and to continually work to be better. We work to be genuine in both words and actions. The Company has worked to utilize technology to allow for more digital transactions for our customers and more options for remote work and virtual meetings. We work with local organizations to provide financial education to the communities we serve and support various not-for-profit organizations. During the pandemic, we were ardent participants in the Paycheck Protection Program ("PPP"), assisting small businesses, their employees and their communities. 

Compensation and Benefits

The Company's senior officer compensation programs are designed to attract, retain and motivate bankers with the ability to generate strong business results and ensure the long-term success of the Company. The compensation committee of the Company's board of directors has established compensation programs that reflect and support the Company's strategic and financial performance goals, the primary goal being the creation of long-term value for the shareholders of the Company, while protecting the interests of the depositors of the Bank. In addition to competitive base and incentive compensation, the Company offers competitive benefits including paid vacation and sick leave, a 401(k) plan, health, dental, and vision plans, life and disability coverage, and a wellness plan. The Company has also entered into employment contracts with certain of its senior officers, and purchased key man life insurance policies to mitigate the risk of an unforeseen departure or death of certain of the senior officers.

 100% of our employees were eligible for an incentive opportunity in 2023. Incentive plans include a mix of individual and corporate goals that are measurable and defined.

Diversity, Equity and Inclusion

We are committed to hiring diverse talent and fostering, cultivating and preserving a culture of a diversity, equity and inclusion. We believe that the collective sum of the individual differences, life experiences, knowledge, inventiveness, innovation, self-expression, unique capabilities, and talent that our teammates invest in their work represents a significant part of not only our culture, but our reputation and achievement. We strive to foster a culture and workplace that, among other things, is inclusive and welcoming, treats everyone with respect and dignity, promotes people on their merits, and promotes diversity of thoughts, ideas, perspective and values. Our Board believes that diversity contributes to the overall effectiveness of the Board and generally conceptualizes diversity expansively to include, without limitation, concepts such as race, gender, ethnicity, sexual orientation, education, age, work experience, professional skills, geographic location and other qualities or attributes that support diversity. We have a Diversity, Equity and Inclusion Committee which includes a cross-functional group of teammates from diverse backgrounds, that manages our efforts to create a more diverse, equitable, and inclusive workplace.

Competition and Markets​​​​​​

Vigorous competition exists in the Company's service areas. The Company competes not only with national, regional, and community banks, but also with other types of financial institutions including finance companies, mutual and money market fund providers, financial technology companies, brokerage firms, wealth management firms, insurance companies, credit unions, and mortgage companies.

In addition, nonbank competitors are increasingly offering products and services that traditionally were only offered by banks. Many of these nonbank competitors are not subject to the same extensive federal regulations that govern bank holding companies and federally insured banks, which may allow them to offer greater lending limits and certain products and services that we do not provide.

The Company's primary market area is south central Virginia and north central North Carolina. The Company also has a significant presence in Roanoke, Virginia that increased substantially in connection with the acquisition of HomeTown Bankshares Corporation ("HomeTown") in 2019. The Company's Virginia banking offices are located in the cities of Danville, Lynchburg, Martinsville, Roanoke, and Salem and in the counties of Campbell, Franklin, Halifax, Henry, Montgomery, Pittsylvania and Roanoke. In North Carolina, the Company's banking offices are located in the cities of Burlington, Graham, Greensboro, Mebane, Raleigh, Winston-Salem, and Yanceyville, which are within the counties of Alamance, Caswell, Forsyth, Guilford, and Wake. 

Unemployment levels in each Virginia market the Company serves have remained low for the past twelve months. Based on Virginia Employment Commission data, the state's seasonally-adjusted unemployment rate was 3.0% as of December 31, 2023 and December 31, 2022 and continued to be below the national rate of 3.7% at December 31, 2023. North Carolina's unemployment rate was 3.5% as of December 31, 2023, compared to 3.9% at December 31, 2022 and slightly below the national rate of 3.7% at December 31, 2023.

Service sectors, financials, medical, manufacturing, construction, timber management and production, and technology related businesses have remained strong. Other important business industries include farming, tobacco and hemp processing and sales, and food processing. New businesses continue to move into the Company's Virginia and North Carolina footprints, which has been positive for economic growth.

The Company's market area in North Carolina includes larger metropolitan areas characterized by strong competition in attracting deposits and making loans. Its most direct competition for deposits comes from commercial banks and credit unions located in the market area, including many regional and national banks. The company has experienced strong loan growth in these markets, but has been more challenged in growing deposit market share.

Supervision and Regulation

The Company and the Bank are extensively regulated under federal and state law. The following description briefly addresses certain provisions of federal and state laws and regulations, and their potential effects on the Company and the Bank. Proposals to change the laws, regulations, and policies governing the banking industry are frequently raised in U.S. Congress, in state legislatures, and before the various bank regulatory agencies. The likelihood and timing of any changes and the impact such changes might have on the Company and the Bank are impossible to determine with any certainty. A change in applicable laws, regulations or policies, or a change in the way such laws, regulations or policies are interpreted by regulatory agencies or courts, may have a material impact on the business, operations, and earnings of the Company and the Bank.

American National Bankshares Inc.

American National Bankshares Inc. is qualified as a bank holding company ("BHC") within the meaning of the Bank Holding Company Act of 1956, as amended (the "BHC Act"), and is registered as such with the Board of Governors of the Federal Reserve System (the "FRB"). As a bank holding company, the Company is subject to supervision, regulation and examination by the FRB and is required to file various reports and additional information with the FRB. The Company is also registered under the bank holding company laws of Virginia and is subject to supervision, regulation and examination by the Bureau of Financial Institutions of the Virginia State Corporation Commission (the "SCC").

American National Bank and Trust Company

American National Bank and Trust Company is a federally chartered national bank and is a member of the Federal Reserve System. As a national bank, the Bank is subject to supervision, regulation and examination by the Office of the Comptroller of the Currency (the "OCC") and is required to file various reports and additional information with the OCC. The OCC has primary supervisory and regulatory authority over the operations of the Bank. Because the Bank accepts insured deposits from the public, it is also subject to examination by the Federal Deposit Insurance Corporation ("FDIC").

Depository institutions, including the Bank, are subject to extensive federal and state regulations that significantly affect their business and activities. Regulatory bodies have broad authority to implement standards and initiate proceedings designed to prohibit depository institutions from engaging in unsafe and unsound banking practices. The standards relate generally to operations and management, asset quality, interest rate exposure, and capital. The bank regulatory agencies are authorized to take action against institutions that fail to meet such standards.

As with other financial institutions, the earnings of the Bank are affected by general economic conditions and by the monetary policies of the FRB. The FRB exerts a substantial influence on interest rates and credit conditions, primarily through open market operations in U.S. Government securities, setting the reserve requirements of member banks, and establishing the discount rate on member bank borrowings. The policies of the FRB have a direct impact on loan and deposit growth and the interest rates charged and paid thereon. They also impact the source, cost of funds, and the rates of return on investments. Changes in the FRB's monetary policies have had a significant impact on the operating results of the Bank and other financial institutions and are expected to continue to do so in the future; however, the exact impact of such conditions and policies upon the future business and earnings cannot accurately be predicted.

Deposit Insurance

The deposits of the Bank are insured up to applicable limits by the DIF and are subject to deposit insurance assessments to maintain the DIF. The deposit insurance assessment base of the Bank is based on its average total assets minus average tangible equity, pursuant to a rule issued by the FDIC as required by the Dodd-Frank Wall Street Reform and Consumer Protection Act (the "Dodd-Frank Act"). The FDIC uses a "financial ratios method" based on CAMELS composite ratings to determine assessment rates for small established institutions with less than $10 billion in assets, such as the Bank. The CAMELS rating system is a supervisory rating system designed to take into account and reflect all financial and operational risks that a bank may face, including capital adequacy, asset quality, management capability, earnings, liquidity and sensitivity to market risk ("CAMELS"). CAMELS composite ratings set a maximum assessment for CAMELS 1 and 2 rated banks, and set minimum assessments for lower rated institutions.

 In March 2016, the FDIC implemented by final rule certain Dodd-Frank Act provisions by raising the DIF's minimum reserve ratio from 1.15% to 1.35%. The FDIC imposed a 4.5 basis point annual surcharge on insured depository institutions with total consolidated assets of $10 billion or more. The rule granted credits to smaller banks, such as the Bank, for the portion of their regular assessments that contributed to increasing the reserve ratio from 1.15% to 1.35%. In October 2022, the FDIC adopted a final rule to increase the assessment base rate schedules uniformly by two basis points beginning with the first quarterly assessment period of 2023. In 2023 and 2022, the Company recorded expense of $1.4 million and $903 thousand, respectively, for FDIC insurance premiums.

Capital Requirements

The FRB, the OCC and the FDIC have issued substantially similar capital guidelines applicable to all banks and bank holding companies. In addition, those regulatory agencies may from time to time require that a banking organization maintain capital above the minimum levels because of its financial condition or actual or anticipated growth.

Effective January 1, 2015, the Company and the Bank became subject to rules implementing the Basel III regulatory capital reforms from the Basel Committee on Banking Supervision (the "Basel Committee") and certain provisions of the Dodd-Frank Act (the "Basel III Capital Rules"). The Basel III Capital Rules require the Company and the Bank to comply with the following minimum capital ratios: (i) a ratio of common equity Tier 1 to risk-weighted assets ("CET1") of at least 4.5%, plus a 2.5% "capital conservation buffer" (effectively resulting in a minimum CET1 ratio of at least 7%), (ii) a ratio of Tier 1 capital to risk-weighted assets of at least 6.0%, plus the 2.5% capital conservation buffer (effectively resulting in a minimum Tier 1 capital ratio of 8.5%), (iii) a ratio of total capital to risk-weighted assets of at least 8.0%, plus the 2.5% capital conservation buffer (effectively resulting in a minimum total capital ratio of 10.5%), and (iv) a leverage ratio of 4%, calculated as the ratio of Tier 1 capital to average assets. The capital conservation buffer, which was phased in ratably over a four year period beginning January 1, 2016, is designed to absorb losses during periods of economic stress. Institutions with a CET1 ratio above the minimum (4.5%) but below the minimum plus the conservation buffer (7.0%) will face constraints on dividends, equity repurchases, and discretionary compensation paid to certain officers, based on the amount of the shortfall. 

With respect to the Bank, the "prompt corrective action" regulations pursuant to Section 38 of the Federal Deposit Insurance Act (the "FDIA") were also revised, effective as of January 1, 2015, to incorporate a CET1 ratio and to increase certain other capital ratios. To be well capitalized under the revised regulations, a bank must have the following minimum capital ratios: (i) a CET1 ratio of at least 6.5%; (ii) a Tier 1 capital to risk-weighted assets ratio of at least 8.0%; (iii) a total capital to risk-weighted assets ratio of at least 10.0%; and (iv) a leverage ratio of at least 5.0%. See "Prompt Corrective Action" below.

The Tier 1 and total capital to risk-weighted asset ratios of the Company were 12.81% and 13.82%, respectively, as of December 31, 2023, thus exceeding the minimum requirements. The CET 1 ratio of the Company was 11.70% and the Bank was 12.61% as of December 31, 2023. The Tier 1 and total capital to risk-weighted asset ratios of the Bank were 12.61% and 13.62%, respectively, as of December 31, 2023, also exceeding the minimum requirements.

The Basel III Capital Rules prescribe a standardized approach for risk weightings that expanded the risk-weighting categories from the general risk-based capital rules to a much larger and more risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. government and agency securities, to 600% for certain equity exposures (and higher percentages for certain other types of interests), and resulting in higher risk weights for a variety of asset categories. In November 2019, the federal banking agencies adopted a rule revising the scope of commercial real estate mortgages subject to a 150% risk weight.

On September 17, 2019, the federal banking agencies jointly issued a final rule required by the Economic Growth, Regulatory Relief and Consumer Protection Act of 2018 (the "EGRRCPA") that permits qualifying banks and bank holding companies that have less than $10 billion in consolidated assets to elect to be subject to a 9% leverage ratio (commonly referred to as the community bank leverage ratio or "CBLR"). Under the final rule, banks and bank holding companies that opt into the CBLR framework and maintain a CBLR of greater than 9% are not subject to other risk-based and leverage capital requirements under the Basel III Capital Rules and are deemed to have met the well capitalized ratio requirements under the "prompt corrective action" framework. In addition, a community bank that falls out of compliance with the framework has a two-quarter grace period to come back into full compliance, provided its leverage ratio remains above 8%, and will be deemed well-capitalized during the grace period. The CBLR framework was first available for banking organizations to use in their March 31, 2020 regulatory reports. The Company and the Bank do not currently expect to opt into the CBLR framework.

Dividends

The Company's principal source of cash flow, including cash flow to pay dividends to its shareholders, is dividends it receives from the Bank. Statutory and regulatory limitations apply to the Bank's payment of dividends to the Company. As a general rule, the amount of a dividend may not exceed, without prior regulatory approval, the sum of net income in the calendar year to date and the retained net earnings of the immediately preceding two calendar years. A depository institution may not pay any dividend if payment would cause the institution to become "undercapitalized" or if it already is "undercapitalized." The OCC may prevent the payment of a dividend if it determines that the payment would be an unsafe and unsound banking practice. The OCC also has advised that a national bank should generally pay dividends only out of current operating earnings.

Permitted Activities

As a bank holding company, the permitted activities of the Company are limited to managing or controlling banks, furnishing services to or performing services for its subsidiaries, and engaging in other activities that the FRB determines by regulation or order to be so closely related to banking or managing or controlling banks as to be a proper incident thereto. In determining whether a particular activity is permissible, the FRB must consider whether the performance of such an activity reasonably can be expected to produce benefits to the public that outweigh possible adverse effects. Possible benefits include greater convenience, increased competition, and gains in efficiency. Possible adverse effects include undue concentration of resources, decreased or unfair competition, conflicts of interest, and unsound banking practices. Despite prior approval, the FRB may order a bank holding company or its subsidiaries to terminate any activity or to terminate ownership or control of any subsidiary when the FRB has reasonable cause to believe that a serious risk to the financial safety, soundness or stability of any bank subsidiary of that bank holding company may result from such an activity.

Banking Acquisitions; Changes in Control

The BHC Act and related regulations require, among other things, the prior approval of the FRB in any case where a bank holding company proposes to (i) acquire direct or indirect ownership or control of more than 5% of the outstanding voting stock of any bank or bank holding company (unless it already owns a majority of such voting shares), (ii) acquire all or substantially all of the assets of another bank or bank holding company, or (iii) merge or consolidate with any other bank holding company. In determining whether to approve a proposed bank acquisition, the FRB will consider, among other factors, the effect of the acquisition on competition, the public benefits expected to be received from the acquisition, any outstanding regulatory compliance issues of any institution that is a party to the transaction, the projected capital ratios and levels on a post-acquisition basis, the financial condition of each institution that is a party to the transaction and of the combined institution after the transaction, the parties' managerial resources and risk management and governance processes and systems, the parties' compliance with the Bank Secrecy Act and anti-money laundering requirements, and the acquiring institution's performance under the Community Reinvestment Act of 1977, as amended (the "CRA"), and compliance with fair housing and other consumer protection laws.

Subject to certain exceptions, the BHC Act and the Change in Bank Control Act, together with the applicable regulations, require FRB approval (or, depending on the circumstances, no notice of disapproval) prior to any person or company acquiring "control" of a bank or bank holding company. A conclusive presumption of control exists if an individual or company acquires the power, directly or indirectly, to direct the management or policies of an insured depository institution or to vote 25% or more of any class of voting securities of any insured depository institution. A rebuttable presumption of control exists if a person or company acquires 10% or more but less than 25% of any class of voting securities of an insured depository institution and either the institution has registered its securities with the Securities and Exchange Commission (the "SEC") under Section 12 of the Securities Exchange Act of 1934 (the "Exchange Act") or no other person will own a greater percentage of that class of voting securities immediately after the acquisition. The Company's common stock is registered under Section 12 of the Exchange Act.

In addition, Virginia law requires the prior approval of the SCC for (i) the acquisition by a Virginia bank holding company of more than 5% of the voting shares of a Virginia bank or any holding company that controls a Virginia bank, or (ii) the acquisition by a Virginia bank holding company of a bank or its holding company domiciled outside Virginia.

Source of Strength

FRB policy has historically required bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. The Dodd-Frank Act codified this policy as a statutory requirement. Under this requirement, the Company is expected to commit resources to support the Bank, including at times when the Company may not be in a financial position to provide such resources. Any capital loans by a bank holding company to any of its subsidiary banks are subordinate in right of payment to depositors and to certain other indebtedness of such subsidiary banks. In the event of a bank holding company's bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Safety and Soundness

There are a number of obligations and restrictions imposed on bank holding companies and their subsidiary banks by law and regulatory policy that are designed to minimize potential loss to the depositors of such depository institutions and the FDIC insurance fund in the event of a depository institution insolvency, receivership or default. For example, under the Federal Deposit Insurance Corporation Improvement Act of 1991, to avoid receivership of an insured depository institution subsidiary, a bank holding company is required to guarantee the compliance of any subsidiary bank that may become "undercapitalized" with the terms of any capital restoration plan filed by such subsidiary with its appropriate federal bank regulatory agency up to the lesser of (i) an amount equal to 5% of the institution's total assets at the time the institution became undercapitalized or (ii) the amount that is necessary (or would have been necessary) to bring the institution into compliance with all applicable capital standards as of the time the institution fails to comply with such capital restoration plan.

Under the FDIA, the federal bank regulatory agencies have adopted guidelines prescribing safety and soundness standards. These guidelines establish general standards relating to capital management, internal controls and information systems, internal audit systems, data security, loan documentation, credit underwriting, interest rate exposure, risk management, vendor management, corporate governance, asset growth, and compensation, fees and benefits. In general, the guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines.

Prompt Corrective Action

The federal bank regulatory agencies possess broad powers to take prompt corrective action to resolve problems of insured depository institutions. The extent of these powers depends upon whether the institution is "well capitalized," "adequately capitalized," "undercapitalized," "significantly undercapitalized," or "critically undercapitalized," as defined by the law. "Well capitalized" institutions may generally operate without additional supervisory restriction. With respect to "adequately capitalized" institutions, such banks cannot normally pay dividends or make any capital contributions that would leave the bank undercapitalized; they cannot pay a management fee to a controlling person if after paying the fee, it would be undercapitalized; and they cannot accept, renew, or rollover any brokered deposit unless the bank has applied for and been granted a waiver by the FDIC.

Immediately upon becoming "undercapitalized," a depository institution becomes subject to the provisions of Section 38 of the FDIA, which: (i) restrict payment of capital distributions and management fees; (ii) require that the appropriate federal banking agency monitor the condition of the institution and its efforts to restore its capital; (iii) require submission of a capital restoration plan; (iv) restrict the growth of the institution's assets; and (v) require prior approval of certain expansion proposals. The appropriate federal banking agency for an undercapitalized institution also may take any number of discretionary supervisory actions if the agency determines that any of these actions is necessary to resolve the problems of the institution at the least possible long-term cost to the DIF, subject in certain cases to specified procedures. These discretionary supervisory actions include: (i) requiring the institution to raise additional capital; (ii) restricting transactions with affiliates; (iii) requiring divestiture of the institution or the sale of the institution to a willing purchaser; and (iv) any other supervisory action that the agency deems appropriate. These and additional mandatory and permissive supervisory actions may be taken with respect to significantly undercapitalized and critically undercapitalized institutions. Management believes, as of December 31, 2023 and 2022, the Bank met the requirements for being classified as "well capitalized."

Transactions with Affiliates

Pursuant to Sections 23A and 23B of the Federal Reserve Act and Regulation W, the authority of the Bank to engage in transactions with related parties or "affiliates" or to make loans to insiders is limited. Loan transactions with an affiliate generally must be collateralized and certain transactions between the Bank and its affiliates, including the sale of assets, the payment of money, or the provision of services, must be on terms and conditions that are substantially the same, or at least as favorable to the Bank, as those prevailing for comparable nonaffiliated transactions. In addition, the Bank generally may not purchase securities issued or underwritten by affiliates.

Loans to executive officers, directors or to any person who directly or indirectly, or acting through or in concert with one or more persons, owns, controls or has the power to vote more than 10% of any class of voting securities of a bank, are subject to Sections 22(g) and 22(h) of the Federal Reserve Act and their corresponding regulations (Regulation O) and Section 13(k) of the Exchange Act relating to the prohibition on personal loans to executives (which exempts financial institutions in compliance with the insider lending restrictions of Section 22(h) of the Federal Reserve Act). Among other things, these loans must be made on terms substantially the same as those prevailing on transactions made to unaffiliated individuals and certain extensions of credit to those persons must first be approved in advance by a disinterested majority of the entire board of directors. Section 22(h) of the Federal Reserve Act prohibits loans to any of those individuals where the aggregate amount exceeds an amount equal to 15% of an institution's unimpaired capital and surplus plus an additional 10% of unimpaired capital and surplus in the case of loans that are fully secured by readily marketable collateral, or when the aggregate amount on all of the extensions of credit outstanding to all of these persons would exceed the Bank's unimpaired capital and unimpaired surplus. Section 22(g) of the Federal Reserve Act identifies limited circumstances in which the Bank is permitted to extend credit to executive officers.

Consumer Financial Protection

The Company is subject to a number of federal and state consumer protection laws that extensively govern its relationship with its customers. These laws include the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Truth in Lending Act, the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Home Mortgage Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Fair Debt Collection Practices Act, the Service Members Civil Relief Act, laws governing flood insurance, federal and state laws prohibiting unfair and deceptive business practices, foreclosure laws, and various regulations that implement some or all of the foregoing. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must deal with customers when taking deposits, making loans, collecting loans and providing other services. If the Company fails to comply with these laws and regulations, it may be subject to various penalties. Failure to comply with consumer protection requirements may also result in failure to obtain any required bank regulatory approval for merger or acquisition transactions the Company may wish to pursue or being prohibited from engaging in such transactions even if approval is not required.

The Dodd-Frank Act centralized responsibility for consumer financial protection by creating a new agency, the Consumer Financial Protection Bureau (the "CFPB"), and giving it responsibility for implementing, examining, and enforcing compliance with federal consumer protection laws. The CFPB focuses on (i) risks to consumers and compliance with the federal consumer financial laws, (ii) the markets in which firms operate and risks to consumers posed by activities in those markets, (iii) depository institutions that offer a wide variety of consumer financial products and services, and (iv) non-depository companies that offer one or more consumer financial products or services.

The CFPB has broad rulemaking authority for a wide range of consumer financial laws that apply to all banks, including, among other things, the authority to prohibit "unfair, deceptive or abusive" acts and practices. Abusive acts or practices are defined as those that materially interfere with a consumer's ability to understand a term or condition of a consumer financial product or service or take unreasonable advantage of a consumer's (i) lack of financial savvy, (ii) inability to protect himself in the selection or use of consumer financial products or services, or (iii) reasonable reliance on a covered entity to act in the consumer's interests. The CFPB can issue cease-and-desist orders against banks and other entities that violate consumer financial laws. The CFPB may also institute a civil action against an entity in violation of federal consumer financial law in order to impose a civil penalty or injunction. Further regulatory positions taken by the CFPB may influence how other regulatory agencies may apply the subject consumer financial protection laws and regulations.

Community Reinvestment Act

The CRA requires the appropriate federal banking agency, in connection with its examination of a bank, to assess the bank's record in meeting the credit needs of the communities served by the bank, including low and moderate income neighborhoods. Furthermore, such assessment is also required of banks that have applied, among other things, to merge or consolidate with or acquire the assets or assume the liabilities of an insured depository institution, or to open or relocate a branch. In the case of a BHC applying for approval to acquire a bank or BHC, the record of each subsidiary bank of the applicant BHC is subject to assessment in considering the application. Under the CRA, institutions are assigned a rating of "outstanding," "satisfactory," "needs to improve," or "substantial non-compliance." The Bank was rated "satisfactory" in its most recent CRA evaluation.
 

On October 24, 2023, the federal bank regulatory agencies issued a final rule to modernize their respective CRA regulations. The revised rules substantially alter the methodology for assessing compliance with the CRA, with material aspects taking effect January 1, 2026 and revised data reporting requirements taking effect January 1, 2027. Among other things, the revised rules evaluate lending outside traditional assessment areas generated by the growth of non-branch delivery systems, such as online and mobile banking, apply a metrics-based benchmarking approach to assessment, and clarify eligible CRA activities. The final rules are likely to make it more challenging and/or costly for the Bank to receive a rating of at least "satisfactory" on its CRA evaluation.

Anti-Money Laundering Legislation

The Company is subject to several federal laws that are designed to combat money laundering, terrorist financing, and transactions with persons, companies or foreign governments designated by U.S. authorities ("AML laws"). This category of laws includes the Bank Secrecy Act of 1970, the Money Laundering Control Act of 1986, the USA PATRIOT Act of 2001, and the Anti-Money Laundering Act of 2020.

The AML laws and their implementing regulations require insured depository institutions, broker-dealers, and certain other financial institutions to have policies, procedures, and controls to detect, prevent, and report money laundering and terrorist financing. The AML laws and their regulations also provide for information sharing, subject to conditions, between federal law enforcement agencies and financial institutions, as well as among financial institutions, for counter-terrorism purposes. Federal banking regulators are required, when reviewing bank holding company acquisition and bank merger applications, to take into account the effectiveness of the anti-money laundering activities of the applicants. To comply with these obligations, the Company has implemented appropriate internal practices, procedures, and controls.

Office of Foreign Assets Control

The U.S. Treasury Department's Office of Foreign Assets Control ("OFAC") is responsible for administering and enforcing economic and trade sanctions against specified foreign parties, including countries and regimes, foreign individuals and other foreign organizations and entities. OFAC publishes lists of prohibited parties that are regularly consulted by the Company in the conduct of its business in order to assure compliance. The Company is responsible for, among other things, blocking accounts of, and transactions with, prohibited parties identified by OFAC, avoiding unlicensed trade and financial transactions with such parties and reporting blocked transactions after their occurrence. Failure to comply with OFAC requirements could have serious legal, financial and reputational consequences for the Company.

Privacy Legislation

Several recent laws, including the Right to Financial Privacy Act, and related regulations issued by the federal bank regulatory agencies, also provide new protections against the transfer and use of customer information by financial institutions. A financial institution must provide to its customers information regarding its policies and procedures with respect to the handling of customers' personal information. Each institution must conduct an internal risk assessment of its ability to protect customer information. These privacy provisions generally prohibit a financial institution from providing a customer's personal financial information to unaffiliated parties without prior notice and approval from the customer.

In October 2023, the CFPB proposed a new rule that would require a provider of payment accounts or products, such as the Bank, to make certain data available to consumers upon request regarding the products or services they obtain from the provider. The proposed rule is intended to give consumers control over their financial data, including with whom it is shared, and encourage competition in the provision of consumer financial products and services. For banks with over $850 million and less than $50 billion in total assets, such as the Bank, compliance would be required approximately two and one-half years after adoption of the final rule.

Incentive Compensation

The Dodd-Frank Act requires the federal banking agencies and the SEC to establish joint regulations or guidelines prohibiting incentive-based payment arrangements at specified regulated entities with at least $1 billion in total consolidated assets, that encourage inappropriate risks by providing an executive officer, employee, director, or principal shareholder with excessive compensation, fees, or benefits that could lead to material financial loss to the entity. In 2016, the SEC and the federal banking agencies proposed rules that prohibit covered financial institutions (including bank holding companies and banks) from establishing or maintaining incentive-based compensation arrangements that encourage inappropriate risk taking by providing covered persons (consisting of senior executive officers and significant risk takers, as defined in the rules) with excessive compensation, fees, or benefits that could lead to material financial loss to the financial institution. The proposed rules outline factors to be considered when analyzing whether compensation is excessive and whether an incentive-based compensation arrangement encourages inappropriate risks that could lead to material loss to the covered financial institution, and establishes minimum requirements that incentive-based compensation arrangements must meet to be considered to not encourage inappropriate risks and to appropriately balance risk and reward. The proposed rules also impose additional corporate governance requirements on the boards of directors of covered financial institutions and impose additional record-keeping requirements. The comment period for these proposed rules has closed, and a final rule has not yet been published. If the rules are adopted as proposed, they will restrict the manner in which executive compensation is structured.

The Nasdaq Stock Market, LLC, the exchange on which our common stock is listed, enacted a rule that became effective in 2023 requiring listed companies to adopt policies mandating the recovery or "clawback" of excess incentive compensation earned by a current or former executive officer during the three fiscal years preceding the date the listed company is required to prepare an accounting restatement, including to correct an error that would result in a material misstatement if the error were corrected in the current period or left uncorrected in the current period. The company has adopted a clawback policy compliant with such rule, a copy of which is attached as Exhibit 97 to this From 10-K.

Mortgage Banking Regulation

In connection with making mortgage loans, the Bank is subject to rules and regulations that, among other things, establish standards for loan origination, prohibit discrimination, provide for inspections and appraisals of property, require credit reports on prospective borrowers, in some cases restrict certain loan features and fix maximum interest rates and fees, require the disclosure of certain basic information to mortgagors concerning credit and settlement costs, limit payment for settlement services to the reasonable value of the services rendered and require the maintenance and disclosure of information regarding the disposition of mortgage applications based on race, gender, geographical distribution and income level. The Bank is also subject to rules and regulations that require the collection and reporting of significant amounts of information with respect to mortgage loans and borrowers. The Bank's mortgage origination activities are subject to the FRB's Regulation Z, which implements the Truth in Lending Act. Certain provisions of Regulation Z require creditors to make a reasonable and good faith determination based on verified and documented information that a consumer applying for a mortgage loan has a reasonable ability to repay the loan according to its terms.

Cybersecurity

The federal bank regulatory agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a financial institution's board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services. The federal bank regulatory agencies expect financial institutions to establish lines of defense and to ensure that their risk management processes address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption and maintenance of the institution's operations after a cyberattack. If we fail to meet the expectations set forth in this regulatory guidance, we could be subject to various regulatory actions and any remediation efforts may require us to devote significant resources

On November 18, 2021, the federal bank regulatory agencies issued a final rule, effective April 1, 2022, imposing new notification requirements for cybersecurity incidents. The rule requires financial institutions to notify their primary federal regulator as soon as possible and no later than 36 hours after the institution determines that a cybersecurity incident has occurred that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the institution's: (i) ability to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base, in the ordinary course of business, (ii) business line(s), including associated operations, services, functions, and support, that upon failure would result in a material loss of revenue, profit, or franchise value, or (iii) operations, including associated services, functions and support, as applicable, the failure or discontinuance of which would pose a threat to the financial stability of the United States.

In July 2023, the SEC issued a final rule to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and incident reporting by public companies that are subject to the reporting requirements of the Exchange Act. Specifically, the final rule requires current reporting about material cybersecurity incidents, periodic disclosures about a registrant's policies and procedures to identify and manage cybersecurity risk, management's role in implementing cybersecurity policies and procedures, and the board of directors' cybersecurity expertise, if any, and its oversight of cybersecurity risk. See Item 1C. Cybersecurity of this Form 10-K for a discussion of the Company's cybersecurity risk management, strategy and governance.

To date, the Company has not experienced a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, but its systems and those of its customers and third-party service providers are under constant threat and it is possible that the Company could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by the Company and its customers.

Future Legislation and Regulation

Congress may enact legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of the proposed legislation could affect the regulatory structure under which the Company and the Bank operate and may significantly increase costs, impede the efficiency of internal business processes, require an increase in regulatory capital, require modifications to business strategy, and limit the ability to pursue business opportunities in an efficient manner. A change in statutes, regulations or regulatory policies applicable to the Company or the Bank could have a material adverse effect on the business, financial condition and results of operations of the Company and the Bank.

Effect of Governmental Monetary Policies

The Company's operations are affected not only by general economic conditions, but also by the policies of various regulatory authorities. In particular, the FRB regulates money and credit conditions and interest rates to influence general economic conditions. These policies have a significant impact on overall growth and distribution of loans, investments and deposits; they affect interest rates charged on loans or paid for time and savings deposits. FRB monetary policies have had a significant effect on the operating results of commercial banks, including the Company, in the past and are expected to do so in the future. As a result, it is difficult for the Company to predict the potential effects of possible changes in monetary policies upon its future operating results.

Internet Access to Company Documents

The Company provides access to its SEC filings through a link on the Investor Relations page of the Company's website at www.amnb.com. Reports available at no cost include the annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and all amendments to those reports as soon as reasonably practicable after the reports are filed electronically with the SEC. The information on the Company's website is not incorporated into this Annual Report on Form 10-K or any other filing the Company makes with the SEC. The SEC maintains an Internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC at www.sec.gov.

Executive Officers of the Company

The following table lists the executive officers of the Company, their ages, and their positions:

CREDIT RISK

The Company's credit standards and its on-going credit assessment processes might not protect it from significant credit losses.

The Company takes credit risk by virtue of making loans and extending loan commitments and letters of credit. The Company manages credit risk through a program of underwriting standards, the review of certain credit decisions and an on-going process of assessment of the quality of the credit already extended. The Company's exposure to credit risk is managed through the use of consistent underwriting standards that emphasize local lending while avoiding highly leveraged transactions as well as excessive industry and other concentrations. The Company's credit administration function employs risk management techniques to help ensure that problem loans are promptly identified. While these procedures are designed to provide the Company with the information needed to implement policy adjustments where necessary and to take appropriate corrective actions, and have proven to be reasonably effective to date, there can be no assurance that such measures will be effective in avoiding future undue credit risk.

LIQUIDITY RISK

Liquidity could be impaired by an inability to access the capital markets or an unforeseen outflow of cash.

Liquidity is essential to our business. Our access to funding sources in amounts adequate to finance our activities or on terms that are acceptable to us could be impaired by factors that affect us specifically or the financial services industry or economy generally. Factors that could reduce our access to liquidity sources include a downturn in the economy, difficult credit markets or the liquidity needs of our depositors. A substantial majority of our liabilities are demand, savings, interest checking and money market deposits, which are payable on demand or upon several days' notice, while a substantial portion of our assets are loans, which cannot be called or sold in the same time frame. We may not be able to replace maturing deposits and advances as necessary in the future, especially if a large number of our depositors sought to withdraw their accounts, regardless of the reason. Our access to deposits may be negatively impacted by, among other factors, changes in interest rates which could promote increased competition for deposits, including from new financial technology competitors, or provide customers with alternative investment options. Additionally, negative news about us or the banking industry in general could negatively impact market and/or customer perceptions of our company, which could lead to a loss of depositor confidence and an increase in deposit withdrawals, particularly among those with uninsured deposits. Furthermore, as many regional banking organizations experienced in 2023, the failure of other financial institutions may cause deposit outflows as customers spread deposits among several different banks so as to maximize their amount of FDIC insurance, move deposits to banks deemed "too big to fail" or remove deposits from the banking system entirely. As of December 31, 2023, approximately 40.5% of our deposits were uninsured and we rely on these deposits for liquidity. A failure to maintain adequate liquidity could have a material adverse effect on our business, financial condition and results of operations.

Unrealized losses in our securities portfolio could affect liquidity.

As market interest rates have increased, we have experienced significant unrealized losses on our available for sale securities portfolio. Unrealized losses related to available for sale securities are reflected in accumulated other comprehensive loss in our consolidated balance sheets and reduce the level of our book capital and tangible common equity. However, such unrealized losses do not affect our regulatory capital ratios. We actively monitor our available for securities portfolio and we do not currently anticipate the need to realize material losses from the sale of securities for liquidity purposes. Furthermore, we believe it is unlikely that we would be required to sell any such securities before recovery of their amortized cost bases, which may be at maturity. Nonetheless, our access to liquidity sources could be affected by unrealized losses if securities must be sold at a loss; tangible capital ratios continue to decline from an increase in unrealized losses or realized credit losses; the Federal Home Loan Bank of Atlanta or other funding sources reduce capacity; or bank regulators impose restrictions on us that impact the level of interest rates we may pay on deposits or our ability to access brokered deposits. Additionally, significant unrealized losses could negatively impact market and/or customer perceptions of our company, which could lead to a loss of depositor confidence and an increase in deposit withdrawals, particularly among those with uninsured deposits.

Recent negative developments affecting the banking industry, and resulting media coverage, have eroded customer confidence in the banking system.

The closures of Silicon Valley Bank and Signature Bank in March 2023, and First Republic Bank in May 2023, and concerns about similar future events, have generated significant market volatility among publicly traded bank holding companies and, in particular, regional banks. More recently, concerns about commercial real estate concentrations at regional and community banks have exacerbated this volatility. These market developments have negatively impacted customer confidence in the safety and soundness of regional banks. As a result, customers may choose to maintain deposits with larger financial institutions or invest in higher yielding short-term fixed income securities, all of which could materially adversely impact the Company's liquidity, loan funding capacity, net interest margin, capital and results of operations. While federal bank regulators took action to ensure that depositors of the failed banks had access to their deposits, including uninsured deposit accounts, there is no guarantee that such actions will be successful in restoring customer confidence in regional banks and the banking system more broadly. Furthermore, there is no guarantee that regional bank failures or bank runs similar to the ones that occurred in 2023 will not occur in the future and, if they were to occur, they may have a material and adverse impact on customer and investor confidence in regional banks negatively impacting the Company's liquidity, capital, results of operations and stock price.

TECHNOLOGY RISK

The Company's operations may be adversely affected by cybersecurity risks.

The Company relies heavily on communications and information systems to conduct business. Our computer systems and network infrastructure and those of third parties, on which we are highly dependent, are subject to security risks and could be susceptible to cyber-attacks, such as denial of service attacks, hacking, social engineering attacks targeting our employees and customers, malware intrusion or data corruption attempts, terrorist activities or identity theft. Any failure, interruption, or breach in security of these systems could result in failures or disruptions in the Company's internet banking, deposit, loan, and other systems. While the Company has policies and procedures designed to prevent or limit the effect of such failure, interruption, or security breach of the Company's information systems, there can be no assurance that they will not occur or, if they do occur, that they will be adequately addressed. Further, to access the Company's products and services, its customers may use computers and mobile devices that are beyond the Company's security control systems. The occurrence of any failure, interruption or security breach of the Company's communications and information systems could damage the Company's reputation, result in a loss of customer business, subject the Company to additional regulatory scrutiny, or expose the Company to civil litigation and possible financial liability. Additionally, the Company outsources its data processing to a third-party. If the Company's third party provider encounters difficulties or if the Company has difficulty in communicating with such third party, it will significantly affect the Company's ability to adequately process and account for customer transactions, which would significantly affect its business operations.

In the ordinary course of business, the Company collects and stores sensitive data, including proprietary business information and personally identifiable information of its customers and employees in systems and on networks. The secure processing, maintenance and use of this information is critical to operations and the Company's business strategy. The Company has invested in accepted technologies, and annually reviews processes and practices that are designed to protect its networks, computers and data from damage or unauthorized access. Despite these security measures, the Company's computer systems and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance or other disruptions. A breach of any kind could compromise systems, and the information stored there could be accessed, damaged or disclosed. A breach in security could result in legal claims, regulatory penalties, disruption in operations, and damage to the Company's reputation, which could adversely affect the Company's business. Furthermore, as cyberattacks continue to evolve and increase, the Company may be required to expend significant additional resources to modify or enhance its protective measures, or to investigate and remediate any identified information security vulnerabilities.

Multiple major U.S. retailers, financial institutions, government agencies and departments have experienced data systems incursions reportedly resulting in the thefts of credit and debit card information, online account information, and other financial data of tens of millions of individuals and customers. Retailer incursions affect cards issued and deposit accounts maintained by many financial institutions, including the Bank. Although neither the Company's nor the Bank's systems are breached in government or retailer incursions, these events can cause the Bank to reissue a significant number of cards and take other costly steps to avoid significant theft loss to the Bank and its customers. In some cases, the Bank may be required to reimburse customers for the losses they incur. Other possible points of intrusion or disruption not within the Company's nor the Bank's control include internet service providers, electronic mail portal providers, social media portals, distant-server (so called "cloud") service providers, electronic data security providers, personal computers and mobile phones, telecommunications companies, and mobile phone manufacturers.

Consumers may increasingly decide not to use the Bank to complete their financial transactions because of technological and other changes, which would have a material adverse impact on the Company's financial condition and operations.

Technology and other changes are allowing parties to complete financial transactions through alternative methods that historically have involved banks. In particular, the activity of fintech companies has grown significantly over recent years and is expected to continue to grow. Fintech companies have and may continue to offer bank or bank-like products and some fintech companies have applied for bank charters. In addition, other fintech companies have partnered with existing banks to allow them to offer deposit products to their customers. For example, consumers can now maintain funds that would have historically been held as bank deposits in brokerage accounts, mutual funds or general-purpose reloadable prepaid cards. Consumers can also complete transactions such as paying bills and/or transferring funds directly without the assistance of banks. The process of eliminating banks as intermediaries, known as "disintermediation," could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits. The loss of these revenue streams and the lower cost of deposits as a source of funds could have a material adverse effect on the Company's financial condition and results of operations.

OPERATIONAL RISK

The Company is dependent on key personnel and the loss of one or more of those key personnel may materially and adversely affect the Company's operations and prospects.

The Company is a relationship-driven organization. A key aspect of the Company's business strategy is for its senior officers to have primary contact with current and potential customers. The Company's growth and development are in large part a result of these personalized relationships with the customer base. The success of the Company also often depends on its ability to hire and retain qualified banking officers.

The Company's senior officers have considerable experience in the banking industry and related financial services and are extremely valuable and would be difficult to replace. The loss of the services of these officers could have a material adverse effect upon future prospects. Although the Company has entered into employment contracts with certain of its senior executive officers, and purchased key man life insurance policies to mitigate the risk of an unforeseen departure or death of certain of the senior executive officers, it cannot offer any assurance that they and other key employees will remain employed by the Company. The unexpected loss of services of one or more of these key employees could have a material adverse effect on operations and possibly result in reduced revenues.

Failure to maintain effective systems of internal and disclosure control could have a material adverse effect on the Company's results of operation and financial condition.

Effective internal and disclosure controls are necessary for the Company to provide reliable financial reports and effectively prevent fraud and to operate successfully as a public company. If the Company cannot provide reliable financial reports or prevent fraud, its reputation and operating results would be harmed. As part of the Company's ongoing monitoring of internal control, it may discover material weaknesses or significant deficiencies in its internal control that require remediation. A "material weakness" is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of a company's annual or interim financial statements will not be prevented or detected on a timely basis.

The Company has in the past discovered, and may in the future discover, areas of its internal controls that need improvement. Even so, the Company is continuing to work to improve its internal controls. The Company cannot be certain that these measures will ensure that it implements and maintains adequate controls over its financial processes and reporting in the future. Any failure to maintain effective controls or to timely effect any necessary improvement of the Company's internal and disclosure controls could, among other things, result in losses from fraud or error, harm the Company's reputation or cause investors to lose confidence in the Company's reported financial information, all of which could have a material adverse effect on the Company's results of operation and financial condition.

The carrying value of goodwill may be adversely impacted.

When the Company completes an acquisition, generally goodwill is recorded on the date of acquisition as an asset. Current accounting guidance requires for goodwill to be tested for impairment, which the Company performs an impairment analysis at least annually, rather than amortizing it over a period of time. A significant adverse change in expected future cash flows or sustained adverse change in the Company's common stock could require the asset to become impaired. If impaired, the Company would incur a non-cash charge to earnings that would have a significant impact on the results of operations. The carrying value of goodwill was approximately $85.0 million at December 31, 2023.

The Company relies on other companies to provide key components of the Company's business infrastructure.

Third parties provide key components of the Company's business operations such as data processing, recording and monitoring transactions, online banking interfaces and services, Internet connections and network access. While the Company has selected these third-party vendors carefully, it does not control their actions. Any problem caused by these third-parties, including those resulting from disruptions in communication services provided by a vendor, failure of a vendor to handle current or higher volumes, cybersecurity breaches, failure of a vendor to provide services for any reason or poor performance of services, could adversely affect the Company's ability to deliver products and services to its customers and otherwise conduct its business. Financial or operational difficulties of a third-party vendor could also hurt the Company's operations if those difficulties interface with the vendor's ability to serve the Company. Replacing these third party vendors could also create significant delay and expense. Accordingly, use of such third parties creates an unavoidable inherent risk to the Company's business operations.

LEGAL, REGULATORY AND COMPLIANCE RISK

The Company is subject to extensive regulation which could adversely affect its business.

The Company's operations as a publicly traded corporation, a bank holding company, and a parent company to an insured depository institution are subject to extensive regulation by federal, state, and local governmental authorities and are subject to various laws and judicial and administrative decisions imposing requirements and restrictions on part or all of the Company's operations. Because the Company's business is highly regulated, the laws, rules, and regulations applicable to it are subject to frequent and sometimes extensive change. Such changes could include higher capital requirements, increased insurance premiums, increased compliance costs, reductions of non-interest income and limitations on services that can be provided. Actions by regulatory agencies or significant litigation against the Company could cause it to devote significant time and resources to defend itself and may lead to liability or penalties that materially affect the Company and its shareholders. Any future changes in the laws, rules or regulations applicable to the Company may negatively affect the Company's business and results of operations.

Regulatory capital standards may have an adverse effect on the Company's profitability, lending, and ability to pay dividends on the Company's securities.

The Company is subject to capital adequacy guidelines and other regulatory requirements specifying minimum amounts and types of capital that the Company and the Bank must maintain. From time to time, regulators implement changes to these regulatory capital adequacy guidelines. If the Company fails to meet these minimum capital guidelines and/or other regulatory requirements, its financial condition would be materially and adversely affected. The Basel III Capital Rules require bank holding companies and their subsidiaries to maintain significantly more capital as a result of higher required capital levels and more demanding regulatory capital risk weightings and calculations. The Bank must also comply with the capital requirements set forth in the "prompt corrective action" regulations pursuant to Section 38 of the FDIA. Satisfying capital requirements may require the Company to limit its banking operations, retain net income or reduce dividends to improve regulatory capital levels, which could negatively affect its business, financial condition and results of operations.

Regulations issued by the CFPB could adversely impact earnings due to, among other things, increased compliance costs or costs due to noncompliance.

The CFPB has broad rulemaking authority to administer and carry out the provisions of the Dodd-Frank Act with respect to financial institutions that offer covered financial products and services to consumers. As an independent bureau within the Federal Reserve System, the CFPB may impose requirements more severe than the previous bank regulatory agencies. The CFPB has also been directed to write rules identifying practices or acts that are unfair, deceptive or abusive in connection with any transaction with a consumer for a consumer financial product or service, or the offering of a consumer financial product or service. The CFPB has recently pursued a more aggressive enforcement policy with respect to a range of regulatory compliance matters, specifically including fair lending, loan servicing, financial institution sales and marketing practices, and financial institution consumer fee and account management practices. For example, in 2023, the CFPB brought enforcement actions against a number of financial institutions for overdraft practices that the CFPB alleged to be unlawful and ordered each of these institutions to pay a substantial civil money penalty in addition to customer restitution. Despite our ongoing compliance efforts, we may become subject to regulatory enforcement actions with respect to our programs and practices. The costs and limitations related to this additional regulatory scrutiny with respect to consumer product offerings and services may adversely affect the Company's profitability.

Changes in accounting standards could impact reported earnings.

From time to time, with increasing frequency, there are changes in the financial accounting and reporting standards that govern the preparation of the Company's financial statements. These changes can materially impact how the Company records and reports its financial condition and results of operations. In some instances, the Company could be required to apply a new or revised standard retroactively, resulting in the restatement of prior period financial statements. Refer to Note 1 of the Consolidated Financial Statements contained in Item 8 of this Form 10-K for a discussion of recent accounting pronouncements.

Current and proposed regulation addressing consumer privacy and data use and security could increase the Company's costs and impact its reputation.

The Company is subject to a number of laws concerning consumer privacy and data use and security, including information safeguard rules under the Gramm-Leach-Bliley Act. These rules require that financial institutions develop, implement and maintain a written, comprehensive information security program containing safeguards that are appropriate to the financial institution's size and complexity, the nature and scope of the financial institution's activities, and the sensitivity of any customer information at issue. The United States has experienced a heightened legislative and regulatory focus on privacy and data security, including requiring consumer notification in the event of a data breach. In addition, most states have enacted security breach legislation requiring varying levels of consumer notification in the event of certain types of security breaches. New regulations in these areas may increase the Company's compliance costs, which could negatively impact earnings. In addition, failure to comply with the privacy and data use and security laws and regulations to which the Company is subject, including by reason of inadvertent disclosure of confidential information, could result in fines, sanctions, penalties or other adverse consequences and loss of consumer confidence, which could materially adversely affect the Company's results of operations, overall business, and reputation.

The Company is subject to claims and litigation pertaining to fiduciary responsibility.

From time to time, customers make claims and take legal action pertaining to the performance of the Company's fiduciary responsibilities. Whether customer claims and legal action related to the performance of the Company's fiduciary responsibilities are founded or unfounded, if such claims and legal actions are not resolved in a manner favorable to the Company, they may result in significant financial liability and/or adversely affect the market perception of the Company and its products and services, as well as impact customer demand for those products and services. Any financial liability or reputation damage could have a material adverse effect on the Company's business, which, in turn, could have a material adverse effect on the Company's financial condition and results of operations.

Increasing scrutiny and evolving expectations from customers, regulators, investors, and other stakeholders with respect to ESG practices may impose additional costs on the Company or expose it to new or additional risks.

Companies are facing increasing scrutiny from customers, regulators, investors, and other stakeholders related to ESG practices and disclosure. Investor advocacy groups, investment funds and influential investors are also increasingly focused on these practices, especially as they relate to climate risk, hiring practices, the diversity of the work force, and racial and social justice issues. Increased ESG related compliance costs could result in increases to the Company's overall operational costs. Failure to adapt to or comply with regulatory requirements or investor or stakeholder expectations and standards could negatively impact the Company's reputation, ability to do business with certain partners, and the Company's stock price. New government regulations could also result in new or more stringent forms of ESG oversight and expanding mandatory and voluntary reporting, diligence, and disclosure.

STRATEGIC RISK

The Company faces strong competition from financial services companies and other companies that offer banking and other financial services, which could negatively affect the Company's business.

The Company encounters substantial competition from other financial institutions in its market area. Ultimately, the Company may not be able to compete successfully against current and future competitors. Many competitors offer the same banking services that the Company offers. These competitors include national, regional, and community banks. The Company also faces competition from many other types of financial institutions, including finance companies, mutual and money market fund providers, financial technology ("fintech") companies, brokerage firms, insurance companies, credit unions, financial subsidiaries of certain industrial corporations, and mortgage companies. In particular, competitors include several major financial companies whose greater resources may afford them a marketplace advantage by enabling them to maintain numerous banking locations and ATMs and conduct extensive promotional and advertising campaigns. Increased competition may result in reduced business for the Company.

Additionally, banks and other financial institutions with larger capitalization and financial intermediaries not subject to bank regulatory restrictions have larger lending limits and are thereby able to serve the credit needs of larger customers. These institutions also may have differing pricing and underwriting standards, which may adversely affect the Company through the loss of business or causing a misalignment in the Company's risk-return relationship. Areas of competition include interest rates for loans and deposits, efforts to obtain loans and deposits, and range and quality of products and services provided, including new technology-driven products and services. Technological innovation continues to contribute to greater competition in domestic financial services markets as technological advances enable more companies to provide financial services. If the Company is unable to attract and retain banking customers, it may be unable to continue to grow loan and deposit portfolios and its results of operations and financial condition may be adversely affected.

RISKS RELATING TO OUR SECURITIES

While the Company's common stock is currently traded on the Nasdaq Global Select Market, it has less liquidity than stocks for larger companies quoted on a national securities exchange.

The trading volume in the Company's common stock on the Nasdaq Global Select Market has been relatively low when compared with larger companies listed on the Nasdaq Global Select Market or other stock exchanges. There is no assurance that a more active and liquid trading market for the common stock will exist in the future. Consequently, shareholders may not be able to sell a substantial number of shares for the same price at which shareholders could sell a smaller number of shares. In addition, the Company cannot predict the effect, if any, that future sales of the Company's common stock in the market, or the availability of shares of common stock for sale in the market, will have on the market price of the common stock.

Economic and other conditions may cause volatility in the price of the Company's common stock.

In the current economic environment, the prices of publicly traded stocks in the financial services sector have been volatile. However, even in a more stable economic environment the price of the Company's common stock can be affected by a variety of factors such as expected or actual results of operations, changes in analysts' recommendations or projections, announcements of developments related to its businesses, operating and stock performance of other companies deemed to be peers, news or expectations based on the performance of others in the financial services industry, and expected impacts of a changing regulatory environment. These factors not only impact the price of the Company's common stock but could also affect the liquidity of the stock given the Company's size, geographical footprint, and industry. The price for shares of the Company's common stock may fluctuate significantly in the future, and these fluctuations may be unrelated to the Company's performance. General market price declines or market volatility in the future could adversely affect the price for shares of the Company's common stock, and the current market price of such shares may not be indicative of future market prices.

Future issuances of the Company's common stock could adversely affect the market price of the common stock and could be dilutive.

The Company is not restricted from issuing additional shares of common stock, including any securities that are convertible into or exchangeable for, or that represent the right to receive, shares of common stock. Issuances of a substantial number of shares of common stock, or the expectation that such issuances might occur could materially adversely affect the market price of the shares of the common stock and could be dilutive to shareholders. Because the Company's decision to issue common stock in the future will depend on market conditions and other factors, it cannot predict or estimate the amount, timing or nature of possible future issuances of its common stock. Accordingly, the Company's shareholders bear the risk that future issuances will reduce the market price of the common stock and dilute their stock holdings in the Company.

The primary source of the Company's income from which it pays cash dividends is the receipt of dividends from its subsidiary bank.

The availability of dividends from the Company is limited by various statutes and regulations. It is possible, depending upon the financial condition of the Bank and other factors, that the OCC could assert that payment of dividends or other payments is an unsafe or unsound practice. In the event the Bank was unable to pay dividends to the Company, or be limited in the payment of such dividends, the Company would likely have to reduce or stop paying common stock dividends. The Company's reduction, limitation or failure to pay such dividends on its common stock could have a material adverse effect on the market price of the common stock.

The Company's governing documents and Virginia law contain anti-takeover provisions that could negatively impact its shareholders.

The Company's Articles of Incorporation and Bylaws and the Virginia Stock Corporation Act contain certain provisions designed to enhance the ability of the Company's Board of Directors to deal with attempts to acquire control of the Company. These provisions and the ability to set the voting rights, preferences and other terms of any series of preferred stock that may be issued, may be deemed to have an anti-takeover effect and may discourage takeovers (which certain shareholders may deem to be in their best interest). To the extent that such takeover attempts are discouraged, temporary fluctuations in the market price of the Company's common stock resulting from actual or rumored takeover attempts may be inhibited. These provisions also could discourage or make more difficult a merger, tender offer, or proxy contest, even though such transactions may be favorable to the interests of shareholders, and could potentially adversely affect the market price of the Company's common stock.

GENERAL RISK

Changes in economic conditions could materially and negatively affect the Company's business.

The Company's business is directly impacted by economic, political, and market conditions, broad trends in industry and finance, legislative and regulatory changes, changes in government monetary and fiscal policies, and inflation, all of which are beyond the Company's control. A deterioration in economic conditions, whether caused by global, national or local events (including inflation, the COVID-19 pandemic, rising wages in a tight labor market, geopolitical instability and supply chain complications), especially within the Company's market area, could result in potentially negative material consequences such as the following, among others: loan delinquencies increasing; problem assets and foreclosures increasing; demand for products and services decreasing; low cost or noninterest bearing deposits decreasing; and collateral for loans, especially real estate, declining in value, in turn reducing customers' borrowing power, and reducing the value of assets and collateral associated with existing loans. Each of these consequences may have a material adverse effect on the Company's financial condition and results of operations.

Wealth management income is a major source of non-interest income for the Company. Trust and brokerage fee revenue is largely dependent on the fair market value of assets under management and on trading volumes in the brokerage business. General economic conditions and their subsequent effect on the securities markets tend to act in correlation. When general economic conditions deteriorate, securities markets generally decline in value, and the Company's trust and brokerage fee revenue is negatively impacted as asset values and trading volumes decrease.

The Company's exposure to operational, technological and organizational risk may adversely affect the Company.

The Company is exposed to many types of operational risks, including reputation, legal, and compliance risk, the risk of fraud or theft by employees or outsiders, unauthorized transactions by employees or operational errors, clerical or record-keeping errors, and errors resulting from faulty or disabled computer or telecommunications systems.

Negative public opinion can result from the actual or alleged conduct in any number of activities, including lending practices, corporate governance, and acquisitions, and from actions taken by government regulators and community organizations in response to those activities. Negative public opinion can adversely affect the Company's ability to attract and retain customers and can expose it to litigation and regulatory action.

Certain errors may be repeated or compounded before they are discovered and successfully rectified. The Company's necessary dependence upon automated systems to record and process its transactions may further increase the risk that technical system flaws or employee tampering or manipulation of those systems will result in losses that are difficult to detect. The Company may also be subject to disruptions of its operating systems arising from events that are wholly or partially beyond its control (for example, computer viruses or electrical or telecommunications outages), which may give rise to disruption of service to customers and to financial loss or liability. The Company is further exposed to the risk that its external vendors may be unable to fulfill their contractual obligations (or will be subject to the same risk of fraud or operational errors by their respective employees as is the Company) and to the risk that the Company's (or its vendors') business continuity and data security systems prove to be inadequate.

The Company's risk-management framework may not be effective in mitigating risk and loss.

The Company maintains an enterprise risk management program that is designed to identify, quantify, monitor, report, and control the risks that it faces. These risks include, but are not limited to: strategic, interest-rate, credit, liquidity, operations, pricing, reputation, compliance, litigation and cybersecurity. While the Company assesses and improves this program on an ongoing basis, there can be no assurance that its approach and framework for risk management and related controls will effectively mitigate all risk and limit losses in its business. If conditions or circumstances arise that expose flaws or gaps in the Company's risk-management program, or if its controls break down, the Company's results of operations and financial condition may be adversely affected.

Negative perception of the Company through media may adversely affect the Company's reputation and business.

The Company's reputation is critical to the success of its business. The Company believes that its brand image has been well received by customers, reflecting the fact that the brand image, like the Company's business, is based in part on trust and confidence. The Company's reputation and brand image could be negatively affected by rapid and widespread distribution of publicity through social and traditional media channels. The Company's reputation could also be affected by the Company's association with clients affected negatively through social and traditional media distribution, or other third parties, or by circumstances outside of the Company's control. Negative publicity, whether deserved or undeserved, could affect the Company's ability to attract or retain customers, or cause the Company to incur additional liabilities or costs, or result in additional regulatory scrutiny.

Climate change and related legislative and regulatory initiatives may result in operational changes and expenditures that could significantly impact the Company's business.

The current and anticipated effects of climate change are creating an increasing level of concern for the state of the global environment. As a result, political and social attention to the issue of climate change has increased. Federal and state legislatures and regulatory agencies have continued to propose and advance numerous legislative and regulatory initiatives seeking to mitigate the effects of climate change. The federal banking agencies, including the OCC, have emphasized that climate-related risks are faced by banking organizations of all types and sizes and are in the process of enhancing supervisory expectations regarding banks' risk management practices. In December 2021, the OCC published proposed principles for climate risk management by banking organizations with more than $100 billion in assets. The OCC also has appointed its first ever Climate Change Risk Officer and established an internal climate risk implementation committee in order to assist with these initiatives and to support the agency's efforts to enhance its supervision of climate change risk management. Similar and even more expansive initiatives are expected, including potentially increasing supervisory expectations with respect to banks' risk management practices, accounting for the effects of climate change in stress testing scenarios and systemic risk assessments, revising expectations for credit portfolio concentrations based on climate-related factors and encouraging investment by banks in climate-related initiatives and lending to communities disproportionately impacted by the effects of climate change. To the extent that these initiatives lead to the promulgation of new regulations or supervisory guidance applicable to the Company, the Company would likely experience increased compliance costs and other compliance-related risks.

The lack of empirical data surrounding the credit and other financial risks posed by climate change render it impossible to predict how specifically climate change may impact the Company's financial condition and results of operations; however, the physical effects of climate change may also directly impact the Company. Specifically, unpredictable and more frequent weather disasters may adversely impact the value of real property securing the loans in the Bank's loan portfolio. Additionally, if insurance obtained by borrowers is insufficient to cover any losses sustained to the collateral, or if insurance coverage is otherwise unavailable to borrowers, the collateral securing loans may be negatively impacted by climate change, which could impact the Company's financial condition and results of operations. Further, the effects of climate change may negatively impact regional and local economic activity, which could lead to an adverse effect on customers and impact the communities in which the Company operates. Overall, climate change, its effects and the resulting, unknown impact could have a material adverse effect on the Company's financial condition and results of operations.

Severe weather, natural disasters, acts of war or terrorism, geopolitical instability, public health issues, and other external events could significantly impact the Company's business.

Severe weather, natural disasters, acts of war or terrorism, geopolitical instability, public health issues, and other adverse external events could have a significant impact on the Company's ability to conduct business. In addition, such events could affect the stability of the Company's deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue, and/or cause the Company to incur additional expenses. The occurrence of any such event in the future could have a material adverse effect on the Company's business, which, in turn, could have a material adverse effect on its financial condition and results of operations.

ITEM 1B – UNRESOLVED STAFF COMMENTS

None.

ITEM 1C. CYBERSECURITY

Overview

The cybersecurity threat environment is volatile and dynamic, requiring a robust and dynamic framework to reduce and mitigate cybersecurity risk. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other things:

We had no material cybersecurity incidents in 2023.

 ​

Risk Management and Strategy

Our cybersecurity risk management strategy is integrated into our risk management practices and is embedded in each of our three lines of defense, as detailed below. We use a combination of management expertise and Board oversight, as discussed below, as well as outside consultants to assist us in overseeing our cybersecurity risk management program. We deploy safeguards designed to protect customer information and our own corporate information and technology. We have programs and processes in place designed to mitigate known attacks, and we use both internal and external resources to scan for vulnerabilities in our applications, systems, and platforms. We implement backup and recovery systems and require the same of our third-party service providers.

We use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines. We also engage with outside risk experts and industry groups to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. We generally have agreements in place with our service providers that include requirements related to cybersecurity and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information. Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them.

While to date, we have not experienced a significant compromise, attack, or loss of data related to cybersecurity attacks, due to the nature of our business, we are under constant threat of an attack and could experience a significant cybersecurity event in the future. Potential risks we could face from a cybersecurity event are discussed in "Risk Factors" above.

Governance

Through established governance structures, including our problem and incident management process and cyber incident response plan, we have processes and procedures to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures enable our three lines of defense and management to review and manage cybersecurity risks, monitor threats, and provide for further escalation to executive management, our board-level Technology and Information Security Subcommittee reporting to our board-level Risk and Compliance Committee, or to the full Board, as appropriate.

Role of the Board of Directors

Our Board of Directors plays a critical role in the oversight of risk, including risks from cybersecurity threats, and has established a risk oversight structure that seeks to ensure that cybersecurity risks are identified, monitored, assessed, and mitigated appropriately. In that regard, our Board is actively engaged in the oversight of our cyber risk profile, which includes risks from cybersecurity threats, enterprise cyber strategy, and key cyber initiatives. Our Board regularly receives reports on such matters from our Chief Information Officer, Chief Information Security Officer, and other relevant personnel. Our Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters.

Our board-level Risk Committee is responsible for assisting the Board in its oversight of risk, including cybersecurity threats, and for overseeing our enterprise risk management framework. The Risk Committee actively engages with our risk group and other members of management to discuss major risk exposures, establish risk management principles, and determine our risk appetite, and regularly reports on its activities, and makes recommendations to, the full Board. The Risk Committee receives a quarterly summary analysis of cybersecurity risks, threats, and incidents. In addition, the Risk Committee is engaged, as needed, in accordance with our Cybersecurity Incident Response Plan.

Role of Management

Our cybersecurity risk management program is built on three lines of defense, which collectively are designed to assess, identify, assess, and manage our material risks from cybersecurity threats.

Our Information Security department, which is our first line of defense, operates under our Chief Information Security Officer, who manages preventative and detective controls to protect against cybersecurity risks and responds to cyber incidents and data breaches. At least annually, the first line conducts mandatory teammate training on information security and provides ongoing information security education and awareness for teammates, such as online training classes, mock phishing attacks and information security awareness materials. Our cybersecurity risk management program is designed to maintain and challenge our information security defense system, as well as monitor, respond, evaluate, and escalate cyber threats.

The second line of defense independently evaluates, monitors, and challenges our risk mitigation efforts to proactively identify cybersecurity risks, including early-stage engagement and risk management with emerging threats. Second line teammates provide effective challenge to the cybersecurity risk management efforts of the first line through ongoing engagement in problem incidents, regular reviews of cybersecurity risk reporting, and inquiries into the sufficiency of risk management activities. Our second line of defense is led by our management-level Enterprise Risk Committee which governs our technology and operational risk tolerances, including cybersecurity and third and/or fourth party provider risks. This committee includes the Information Security Officer and is co-sponsored by the Chief Information Officer and the Chief Operating Officer. These individuals have relevant financial, technical, and business degrees, hold relevant certifications, and each have over 20 years of experience in their respective areas of expertise, with a minimum of 10 years in leadership roles, including multiple years at financial institutions. The Committee is responsible for escalating key risks to our Management Risk Committee, which includes all members of our Executive Leadership Team.

Internal Audit serves as the third line of defense and provides independent assurance on how effectively we are mitigating, managing, and challenging our cybersecurity risks.

ITEM 2 – PROPERTIES

As of December 31, 2023, the Company maintained 26 banking offices that are used in the normal course of business. The principal executive offices of the Company are located at 628 Main Street in the business district of Danville, Virginia. This building is owned by the Company. The Company leases certain space located at 202 S. Jefferson Street, Roanoke, Virginia as a result of the merger with HomeTown. This office serves as the Virginia banking headquarters. The Company leases an office at 703 Green Valley Road in Greensboro, North Carolina. This building serves as the head office for the Company's North Carolina banking headquarters. 

The Company owns 22 other offices for a total of 23 owned buildings. There are no mortgages or liens against any of the properties owned by the Company. The Company operates 34 ATMs on owned or leased facilities. The Company leases five other offices for a total of seven leased office locations and leases one storage warehouse. Management believes that upon expiration of each of the Company's leases it will be able to extend the lease on satisfactory terms or relocate to another acceptable location.

ITEM 3 – LEGAL PROCEEDINGS

In the ordinary course of operations, the Company and the Bank are parties to various legal proceedings. Based upon information currently available, management believes that such legal proceedings, in the aggregate, will not have a material adverse effect on the business, financial condition, or results of operations of the Company.

ITEM 4 – MINE SAFETY DISCLOSURES

None.

PART II

ITEM 5 – MARKET FOR REGISTRANT'S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES

Market and Dividend Information

The Company's common stock is traded on the Nasdaq Global Select Market under the symbol "AMNB." At December 31, 2023, the Company had 3,686 shareholders of record. 

The Company's future dividend policy is subject to the discretion of the Boards of Directors of the Company and the Bank and will depend upon a number of factors, including future earnings, financial condition, cash requirements and general business conditions. The Company and the Bank are also subject to certain restrictions imposed by the reserve and capital requirements of federal and state statutes and regulations. See "Part I, Item 1. Business - Supervision and Regulation - Dividends," for information on regulatory restrictions on dividends.

Stock Compensation Plans

The Company's 2018 Stock Incentive Plan was adopted by the Board of Directors of the Company on February 20, 2018 and approved by shareholders on May 15, 2018 at the Company's 2018 Annual Meeting of Shareholders. The plan and stock compensation in general are discussed in Note 13 of the Consolidated Financial Statements contained in Item 8 of this Form 10-K.

The following table summarizes information, as of December 31, 2023, relating to the Company's equity based compensation plans, pursuant to which grants of options to acquire shares of common stock have been and may be granted from time to time.

Stock Repurchase Program

ITEM 6 - SELECTED FINANCIAL DATA

The following table sets forth selected financial data for the Company for the last five years:

Comparative Stock Performance

The following graph compares the Company's cumulative total return to its shareholders with the returns of two indexes for the five-year period ended December 31, 2023. The cumulative total return was calculated taking into consideration changes in stock price, cash dividends, stock dividends, and stock splits since December 31, 2018. The indexes are the Nasdaq Composite Index and the SNL Bank $1 Billion - $5 Billion Index, which includes bank holding companies with assets of $1 billion to $5 billion and is published by SNL Financial, LC.

ITEM 6 - RESERVED

ITEM 7 - MANAGEMENT'S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

The main purpose of this discussion is to focus on significant changes in the financial condition and results of operations of the Company during the past three years. The discussion and analysis are intended to supplement and highlight information contained in the accompanying Consolidated Financial Statements and the selected financial data presented elsewhere in this Annual Report on Form 10-K.

RECLASSIFICATION

In certain circumstances, reclassifications have been made to prior period information to conform to the 2023 presentation. There were no material reclassifications.

CRITICAL ACCOUNTING POLICIES

The accounting and reporting policies followed by the Company conform with GAAP and to general practices within the banking industry. The Company's critical accounting policies, which are summarized below, relate to (1) the allowance for credit losses, and (2) goodwill and intangible assets. A summary of the Company's significant accounting policies is set forth in Note 1 to the Consolidated Financial Statements.

The financial information contained within the Company's financial statements is, to a significant extent, financial information that is based on measures of the financial effects of transactions and events that have already occurred. A variety of factors could affect the ultimate value that is obtained when earning income, recognizing an expense, recovering an asset, or relieving a liability. In addition, GAAP itself may change from one previously acceptable method to another method.

Allowance for Credit Losses ("ACL") - Loans

The purpose of the ACL is to provide for probable expected losses inherent in the loan portfolio. The allowance is increased by the provision for credit losses and by recoveries of previously charged-off loans. Loan charge-offs decrease the allowance.

The goal of the Company is to maintain an appropriate, systematic, and consistently applied process to determine the amounts of the ACL and the provision for or recovery of credit loss expense.

The Company uses certain practices to manage its credit risk. These practices include (1) appropriate lending limits for loan officers, (2) a loan approval process, (3) careful underwriting of loan requests, including analysis of borrowers, cash flows, collateral, and market risks, (4) regular monitoring of the portfolio, including diversification by type and geography, (5) review of loans by the Loan Review department, which operates independently of loan production (the Loan Review function consists of a co-sourced arrangement using both internal personnel and external vendors to provide the Company with a more robust review function of the loan portfolio), (6) regular meetings of the Credit Committee to discuss portfolio and policy changes and make decisions on large or unusual loan requests, and (7) regular meetings of the Asset Quality Committee which reviews the status of individual loans.

Risk grades are assigned as part of the loan origination process. From time to time, risk grades may be modified as warranted by the facts and circumstances surrounding the credit.

Calculation and analysis of the ACL is prepared quarterly by the Finance Department with input from the Credit Department. The Company's Credit Committee, Risk and Compliance Committee, Audit Committee, and the Board of Directors review the allowance for adequacy.

The Company's ACL consists of quantitative and qualitative allowances and an allowance for loans that are individually assessed for credit losses. Each of these components is determined based upon estimates and judgments. The quantitative allowance uses historical default and loss experience as well as estimates for weighted average lives to calculate lifetime expected losses, along with various qualitative factors, including the effects of changes in risk selection, underwriting standards, and lending policies; expected economic conditions throughout a reasonable and supportable period of 24 months; experience of lending staff; quality of the loan review system; and changes in the regulatory, legal, and competitive environment and an assessment of peer loss experience. The Company considers economic forecasts from highly recognized third-parties for the model inputs. Loans are segmented based on the type of loan and internal risk ratings. The Company utilizes two calculation methodologies to estimate the collective quantitative allowance: the vintage method and the non-discounted cash flow method. Allowance estimates for residential real estate loans are determined by a vintage method which pools loans by date of origination and applies historical average loss rates based on the age of the loans. Allowance estimates for all other loan types are determined by a non-discounted cash flow method which applies historical probabilities of default and loss given default rates to model expected cash flows for each loan through its life and forecast future expected losses.

Loans that do not share risk characteristics are evaluated on an individual basis. The individual reserve component relates to loans that have shown substantial credit deterioration as measured by risk rating and/or delinquency status. In addition, the Company has elected the practical expedient that would include loans for individual assessment consideration if the repayment of the loan is expected substantially through the operation or sale of collateral because the borrower is experiencing financial difficulty. Where the source of repayment is the sale of collateral, the ACL is based on the fair value of the underlying collateral, less selling costs, compared to the amortized cost basis of the loan. If the ACL is based on the operation of the collateral, the reserve is calculated based on the fair value of the collateral calculated as the present value of expected cash flows from the operation of the collateral, compared to the amortized cost basis. If the Company determines that the value of a collateral dependent loan is less than the recorded investment in the loan, the Company charges off the deficiency if it is determined that such amount is deemed to be a confirmed loss.

No single statistic, formula, or measurement determines the adequacy of the allowance. Management makes subjective and complex judgments about matters that are inherently uncertain, and different amounts would be reported under different conditions or using different assumptions. For analytical purposes, management allocates a portion of the allowance to specific loan categories and specific loans. However, the entire allowance is used to absorb credit losses inherent in the loan portfolio, including identified and unidentified losses.

The relationships and ratios used in calculating the allowance, including the qualitative factors, may change from period to period as facts and circumstances evolve. Furthermore, management cannot provide assurance that in any particular period the Bank will not have sizable credit losses in relation to the amount reserved. Management may find it necessary to significantly adjust the allowance, considering current factors at the time.

On January 1, 2023, the Company adopted ASU No. 2016-13, Financial Instruments - Credit Losses (Topic 326): Measurement of Credit Losses on Financial Instruments. The new accounting standard replaced the incurred loss model used for the calculations for the years ended December 31, 2022 and 2021.

Goodwill and Intangible Assets

The Company follows Accounting Standards Codification ("ASC") 350, Goodwill and Other Intangible Assets, which prescribes the accounting for goodwill and intangible assets subsequent to initial recognition. Goodwill resulting from business combinations prior to January 1, 2009 represents the excess of the purchase price over the fair value of the net assets of businesses acquired. Goodwill resulting from business combinations after January 1, 2009 is generally determined as the excess of the fair value of the consideration transferred, plus the fair value of any noncontrolling interests in the acquiree, over the fair value of the net assets acquired and liabilities assumed as of the acquisition date. Goodwill and intangible assets acquired in a purchase business combination and determined to have an indefinite useful life are not amortized, but tested for impairment at least annually or more frequently if events and circumstances exist that indicate that a goodwill impairment test should be performed. The Company records as goodwill the fair value of the consideration transferred, plus the fair value of any noncontrolling interests in the acquiree, over the fair value of the net assets acquired and liabilities assumed as of the acquisition date. Impairment testing is performed annually, as well as when an event triggering impairment may have occurred. The Company performs its annual analysis on June 30 of each fiscal year. No indicators of impairment were noted for the years ended December 31, 2023, 2022, and 2021. Intangible assets with definite useful lives are amortizing over their estimated useful lives of 5 to 10 years. Goodwill is the only intangible asset with an indefinite life on the Company's consolidated balance sheets.

NON-GAAP PRESENTATIONS

Non-GAAP presentations are provided because the Company believes these may be valuable to investors. These include (1) the calculation of the efficiency ratio, (2) the analysis of net interest income presented on a taxable equivalent basis to facilitate performance comparisons among various taxable and tax-exempt assets, (3) return on average tangible common equity, (4) tangible common equity to tangible assets ratio, and (5) tangible book value per share. Such information is not prepared in accordance with GAAP and should not be construed as such. Management believes, however, such financial information is meaningful to the reader in understanding operating performance but cautions that such information not be viewed as a substitute for GAAP information. In addition, the Company's non-GAAP financial measures may not be comparable to non-GAAP financial measures of other companies. The Company, in referring to its net income, is referring to income under GAAP.

The efficiency ratio is calculated by dividing noninterest expense excluding (1) gains or losses on the sale of other real estate owned ("OREO"), and (2) core deposit intangible amortization, and (3) merger related expenses by net interest income including tax equivalent income on nontaxable loans and securities and noninterest income and excluding gains or losses on securities and gains or losses on sale or disposal of premises and equipment. The efficiency ratio for 2023, 2022, and 2021 was 62.31%, 57.37%, and 51.05%, respectively. The efficiency ratio is a non-GAAP financial measure that the Company believes provides investors with important information regarding operational efficiency. The components of the efficiency ratio calculation are summarized in the following table (dollars in thousands):