UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, D.C. 20549

FORM 10-K

☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

FOR THE FISCAL YEAR ENDED December 31, 2024

OR

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

FOR THE TRANSITION PERIOD FROM TO .

Commission file number: 000-14549

FIRST US BANCSHARES, INC.

(Exact Name of Registrant as Specified in Its Charter)

(205) 582-1200

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☐ No ☒

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☐

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☒

State the aggregate market value of the voting and non-voting common equity held by non-affiliates computed by reference to the price at which the common equity was last sold, or the average bid and asked price of such common equity, as of the last business day of the registrant's most recently completed second fiscal quarter: $48,712,850.

As of March 3, 2025, the registrant had outstanding 5,762,262 shares of common stock.

Auditor Firm PCAOB ID: 213 Auditor Name: Carr, Riggs & Ingram, LLC Auditor Location: Atlanta, Georgia, United States

First US Bancshares, Inc.

Annual Report on Form 10-K

for the fiscal year ended

December 31, 2024

Table of Contents

* Portions of the definitive proxy statement for the registrant’s 2025 Annual Meeting of Shareholders to be held on May 1, 2025 are incorporated by reference into Part III of this Annual Report on Form 10-K.

FORWARD-LOOKING STATEMENTS

Statements contained in this Annual Report on Form 10-K that are not historical facts are forward-looking statements (as defined in the Private Securities Litigation Reform Act of 1995). In addition, First US Bancshares, Inc. (“Bancshares” and, together with its subsidiaries, the “Company”), through its senior management, from time to time makes forward-looking statements concerning our expected future operations and performance and other developments. The words “estimate,” “project,” “intend,” “anticipate,” “expect,” “believe,” “continues” and similar expressions are indicative of forward-looking statements. Such forward-looking statements are necessarily estimates reflecting the Company’s best judgment based on current information and involve a number of risks and uncertainties, and various factors could cause results to differ materially from those contemplated by such forward-looking statements. Such factors could include those identified from time to time in the Company’s Securities and Exchange Commission (“SEC”) filings and other public announcements, including the factors described in this Annual Report on Form 10-K for the year ended December 31, 2024. Such factors include, but are not limited to, risks related to the Company’s credit, including that if credit losses are greater than anticipated; increased risk from commercial real estate lending; the rate of growth (or lack thereof) in the economy generally and in the Company’s service areas; liquidity risks; weakness in the commercial or residential real estate markets; market conditions and investment returns; changes to the size, structure, power and operations of the federal government; strong competition in the bank industry; changes in interest rates; the effects of a potential government shutdown; technological changes in the banking and financial services industries; potential failures or interruptions in our information systems and those of our third-party service providers and cybersecurity and data privacy threats; the risks associated with the development and use of artificial intelligence; the increasing and uncertain costs of complying with governmental regulations applicable to the financial services industry; the impact of climate change and related legislative and regulatory initiatives; and risks related to acquisitions, including that the strategic benefits may not materialize and unforeseen integration difficulties may arise. Forward-looking statements speak only as of the date they are made, and the Company undertakes no obligation to revise forward-looking statements to reflect circumstances or events that occur after the dates on which the forward-looking statements are made, except as required by law.

In addition, our business is subject to a number of general and market risks that could affect any forward-looking statements, including the risks discussed under Item 1A herein entitled “Risk Factors.”

PART I

Item 1. Business.

First US Bancshares, Inc., a Delaware corporation (“Bancshares” and, together with its subsidiary, the “Company”), is a bank holding company formed in 1983 registered under the Bank Holding Company Act of 1956, as amended (the “BHCA”). Bancshares operates one wholly-owned banking subsidiary, First US Bank, an Alabama banking corporation (the “Bank”). Bancshares and the Bank are headquartered in Birmingham, Alabama. Previously, the Bank operated two additional wholly-owned subsidiaries, Acceptance Loan Company and FUSB Reinsurance, Inc., both of which were legally dissolved in 2023, and all remaining assets and liabilities of these entities were transferred to the Bank prior to December 31, 2023.

The Bank conducts a general commercial banking business and offers banking services such as demand, savings, individual retirement account and time deposits, personal and commercial loans, safe deposit box services and remote deposit capture. The Bank operates and serves its customers through 15 full-service banking offices located in Birmingham, Butler, Calera, Centreville, Gilbertown, Grove Hill, Harpersville, Jackson, Thomasville, Tuscaloosa and Woodstock, Alabama; Knoxville and Powell, Tennessee; and Rose Hill, Virginia; as well as loan production offices in Mobile, Alabama and the Chattanooga, Tennessee area. The Bank provides a wide range of commercial banking services to small- and medium-sized businesses, property managers, business executives, professionals and other individuals. The Bank also performs indirect lending through third-party retailers and currently conducts this lending in 17 states, including Alabama, Arkansas, Florida, Georgia, Indiana, Iowa, Kansas, Kentucky, Mississippi, Missouri, Nebraska, North Carolina, Oklahoma, South Carolina, Tennessee, Texas and Virginia. The Bank is the Company’s only reportable operating segment upon which management makes decisions regarding how to allocate resources and assess performance.

Strategy

Our strategy focuses on increasing franchise value by building and maintaining a strong and diversified balance sheet through continued loan and deposit growth that leverages our branch network, loan production offices, and digital market capabilities. We foster a culture that adheres to effective credit underwriting standards, pricing discipline, and expense control. Our longer-term growth strategy seeks to grow loan production offices to levels that support limited branching, expansion of our customer base through digital banking offerings, and consideration of acquisition opportunities to enter new markets.

Human Capital Resources

Bancshares has no employees, other than the executive officers discussed in the information incorporated by reference in Part III, Item 10 of this report. As of December 31, 2024, the Bank had 151 full-time equivalent employees. None of our employees are party to a collective bargaining agreement. Management believes that the Company’s employee relations are satisfactory.

To facilitate talent attraction and retention, we strive to make the Company an inclusive, safe and healthy workplace, with opportunities for our employees to grow and develop in their careers, supported by strong compensation, benefits, health and welfare programs. Our talent acquisition team uses internal and external resources to recruit highly skilled and talented workers across our markets, and we encourage employee referrals for open positions.

As part of our compensation philosophy, we believe that we must offer and maintain market competitive total rewards programs for our employees in order to attract and retain superior talent. In addition to healthy base wages, additional programs include bonus opportunities, Company matched 401(k) Plan, healthcare and insurance benefits, health savings and flexible spending accounts, vacation and paid time off, family and military leave, flexible work schedules and employee assistance programs.

The success of our business is fundamentally connected to the well-being of our people. Accordingly, we are committed to the health, safety and wellness of our employees. We provide our employees and their families with access to a variety of flexible and convenient health and welfare programs, including benefits that support their physical and mental health by providing tools and resources to help them improve or maintain their health status; and that offer choice where possible so they can customize their benefits to meet their needs and the needs of their families.

We strive to maintain an inclusive workplace and seek to foster an environment where all of our employees can thrive through active engagement in the ongoing success of our organization. It is essential to our business that we continually attract and retain a talented workforce, and our practices are designed to promote fairness in the hiring process. We encourage a customer-focused orientation that meets the diverse needs of consumers and businesses in the communities in which we serve.

Competition

We face strong competition in making loans, acquiring deposits and attracting customers for investment services. Competition among financial institutions is based on interest rates offered on deposit accounts, interest rates charged on loans, other credit and service charges relating to loans, the quality and scope of the services rendered, the convenience of banking facilities and, in the case of loans to commercial borrowers, relative lending limits. We compete with numerous other financial services providers, including commercial banks, online banks, credit unions, finance companies, mutual funds, insurance companies, investment banking companies, brokerage firms and other financial intermediaries operating in Alabama and elsewhere. Many of these competitors, some of which are affiliated with large bank holding companies, have substantially greater resources and lending limits than we do. In addition, many of our non-bank competitors are not subject to the same extensive federal regulations that govern bank holding companies and federally insured banks.

The financial services industry is likely to become more competitive as further technological advances enable more companies to provide financial services. These technological advances may diminish the importance of depository institutions and other financial intermediaries.

Supervision and Regulation

General

We are extensively regulated under both federal and state law. These laws restrict permissible activities and investments and require compliance with various consumer protection provisions applicable to lending, deposit, brokerage and fiduciary activities. They also impose capital adequacy requirements and condition Bancshares’ ability to repurchase stock or to receive dividends from the Bank. Bancshares is subject to comprehensive examination and supervision by the Board of Governors of the Federal Reserve System (the “Federal Reserve”), and the Bank and its subsidiaries are subject to comprehensive examination and supervision by the Alabama State Banking Department (the “ASBD”) and the Federal Deposit Insurance Corporation (the “FDIC”). These regulatory agencies generally have broad discretion to impose restrictions and limitations on our operations. This supervisory framework could materially impact the conduct and profitability of our activities. It is anticipated that the Trump administration and the current U.S. Congress likely will not increase the regulatory burden on community banking organizations and may seek to reduce and streamline certain prudential and regulatory requirements applicable to community banking organizations at a federal level based on statements made by relevant congressional leaders and the acting leaders of certain banking agencies. At this time, however, it is not possible to predict with any certainty the actual impact the Trump administration may have on the banking industry or our operations.

To the extent that the following information describes statutory and regulatory provisions, it is qualified in its entirety by reference to the text of such provisions. Proposals to change the laws and regulations governing the banking industry are frequently raised at both the state and federal level. The likelihood and timing of any changes in these laws and regulations, as well as the impact that such changes may have on us, are difficult to ascertain. A change in applicable laws and regulations, or in the manner in which such laws or regulations are interpreted by regulatory agencies or courts, may have a material effect on our business, operations and earnings.

Regulation of Bancshares

Bancshares is registered as a bank holding company and is subject to regulation and supervision by the Federal Reserve. The BHCA requires a bank holding company to secure the approval of the Federal Reserve before it owns or controls, directly or indirectly, more than five percent (5%) of the voting shares or substantially all of the assets of any bank or thrift, or merges or consolidates with another bank or thrift holding company. Further, under the BHCA, the activities of a bank holding company and any nonbank subsidiary are limited to: (1) those activities that the Federal Reserve determines to be so closely related to banking as to be a proper incident thereto and (2) investments in companies not engaged in activities closely related to banking, subject to quantitative limitations on the value of such investments. Prior approval of the Federal Reserve may be required before engaging in certain activities. In making such determinations, the Federal Reserve is required to weigh the expected benefits to the public, such as greater convenience, increased competition and gains in efficiency, against the possible adverse effects, such as undue concentration of resources, decreased or unfair competition, conflicts of interest, and unsound banking practices.

There are a number of restrictions imposed on us by law and regulatory policy that are designed to minimize potential losses to the depositors of the Bank and the Deposit Insurance Fund maintained by the FDIC (as discussed in more detail below) if the Bank should become insolvent. For example, the Federal Reserve requires bank holding companies to serve as a source of financial strength to their subsidiary depository institutions and to commit resources to support such institutions in circumstances in which they might not otherwise do so. The Federal Reserve also has the authority to require a bank holding company to terminate any activity or to relinquish control of a non-bank subsidiary upon the Federal Reserve’s determination that such activity or control constitutes a serious risk to the financial soundness and stability of any bank subsidiary of the bank holding company.

Any capital loan by Bancshares to the Bank is subordinate in right of payment to deposits and certain other indebtedness of the Bank. In addition, in the event of Bancshares’ bankruptcy, any commitment by Bancshares to a federal banking regulatory agency to maintain the capital of the Bank will be assumed by the bankruptcy trustee and entitled to a priority of payment.

The Federal Deposit Insurance Act provides that, in the event of the “liquidation or other resolution” of an insured depository institution, the claims of depositors of the institution (including the claims of the FDIC as a subrogee of insured depositors) and certain claims for administrative expenses of the FDIC as a receiver will have priority over other general unsecured claims against the institution. If an insured depository institution fails, then insured and uninsured depositors, along with the FDIC, will have priority of payment over unsecured, non-deposit creditors, including the institution’s holding company, with respect to any extensions of credit that they have made to such insured depository institution.

Regulation of the Bank

The operations and investments of the Bank are limited by federal and state statutes and regulations. The Bank is subject to supervision and regulation by the ASBD and the FDIC and to various requirements and restrictions under federal and state law, including requirements to maintain reserves against deposits, restrictions on the types, amount and terms and conditions of loans that it may originate, and limits on the types of other activities in which the Bank may engage and the investments it may make.

The Bank is subject to federal laws that limit the amount of transactions between the Bank and its nonbank affiliates, including Bancshares. Under these provisions, transactions by the Bank with nonbank affiliates (such as loans or investments) are generally limited to 10% of the Bank’s capital and surplus for all covered transactions with any one affiliate and 20% of capital and surplus for all covered transactions with all affiliates. Any extensions of credit to affiliates, with limited exceptions, must be secured by eligible collateral in specified amounts. The Bank is also prohibited from purchasing any “low quality” assets from an affiliate. The Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) imposed additional requirements on transactions with affiliates, including an expansion of the definition of “covered transactions” and an increase in the length of time for which collateral requirements regarding covered transactions must be maintained.

In addition, the Dodd-Frank Act created the Consumer Financial Protection Bureau (the “CFPB”), an independent bureau with broad authority to regulate the consumer finance industry, including regulated financial institutions, non-banks and others involved in extending credit to consumers. The CFPB has authority through rulemaking, orders, policy statements, guidance and enforcement actions to administer and enforce federal consumer financial laws. Although the CFPB has the power to interpret, administer and enforce federal consumer financial laws, the Dodd-Frank Act provides that the federal banking regulatory agencies continue to have examination and enforcement powers over the financial institutions that they supervise relating to the matters within the jurisdiction of the CFPB if the supervised institutions have less than $10 billion in assets.

Over the last several years, the CFPB has taken an aggressive approach to the regulation (and supervision, where applicable) of providers of consumer financial products and services. For example, the CFPB has taken, or attempted to take, a proactive, multi-front approach to protect consumers from excessive overdraft and non-sufficient funds fees, including through proposed or final rules, interpretive opinions and enforcement actions. Given the increased number and expansive nature of its regulatory initiatives, the CFPB has been subject to lawsuits brought by the banking industry and other providers of consumer financial products and services. The CFPB’s approach may change under the Trump administration, but it remains unclear exactly what changes will occur or how quickly. In addition, certain rules that the Biden administration CFPB finalized may be subject to reversal by either the U.S. Congress or the new CFPB administration.

The Dodd-Frank Act requires the banking agencies and the SEC to establish joint rules or guidelines for financial institutions with more than $1 billion in assets which prohibit incentive compensation arrangements that the agencies determine to encourage inappropriate risks by the institution. The banking agencies issued proposed rules in 2011 and issued guidance on sound incentive compensation policies. In 2016, the Federal Reserve and the Office of Comptroller of the Currency also proposed rules that would, depending upon the assets of the institution, directly regulate incentive compensation arrangements and would require enhanced oversight and recordkeeping. As of December 31, 2024, these rules have not been implemented.

Lending Limits

Under Alabama law, the amount of loans that may be made by a bank in the aggregate to one person is limited. Alabama law provides that unsecured loans by a bank to one person may not exceed an amount equal to 10% of the capital and unimpaired surplus of the bank or 20% in the case of secured loans. For purposes of calculating these limits, loans to various business interests of the borrower, including companies in which a substantial portion of the stock is owned or partnerships in which a person is a partner, must be aggregated with those made to the borrower individually. Loans secured by certain readily marketable collateral are exempt from these limitations, as are loans secured by deposits and certain government securities.

Commercial Real Estate Concentration Limits

In December 2006, the U.S. bank regulatory agencies issued guidance entitled “Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices” to address increased concentrations in commercial real estate (“CRE”) loans. The guidance describes the criteria the agencies will use as indicators to identify institutions potentially exposed to CRE concentration risk. An institution that has (i) experienced rapid growth in CRE lending, (ii) notable exposure to a specific type of CRE, (iii) total reported loans for construction, land development, and other land representing 100% or more of the institution’s capital, or (iv) total CRE loans representing 300% or more of the institution’s capital, and the outstanding balance of the institution’s CRE portfolio has increased by 50% or more in the prior 36 months, may be identified for further supervisory analysis of the level and nature of its CRE concentration risk.

In December 2015, the U.S. bank regulatory agencies issued guidance titled “Statement on Prudent Risk Management for Commercial Real Estate Lending” to remind financial institutions of existing guidance on prudent risk management practices for CRE lending activity, including the 2006 guidance described above. In the 2015 guidance, the agencies noted their belief that financial institutions had eased CRE underwriting standards in recent years. The 2015 guidance went on to identify actions that financial institutions should take to protect themselves from CRE-related credit losses during difficult economic cycles. The 2015 guidance also indicated that the agencies would pay special attention in the future to potential risks associated with CRE lending.

In June 2023, in response to the increased risk relating to CRE loans, the federal banking agencies issued a final Interagency Policy Statement on Prudent Commercial Real Estate Loan Accommodations and Workouts. The new policy statement updates, expands on and supersedes existing guidance from 2009. Most notably, it (i) adds a new discussion of short-term loan accommodations, (ii) expands guidance regarding the evaluation and assessment of guarantors to also encompass loan sponsors, (iii) incorporates information about changes to accounting principles since 2009, and (iv) updates and expands the illustrative examples of CRE loan workouts. Furthermore, on December 18, 2023, the FDIC issued an advisory on Managing Commercial Real Estate Concentrations in a Challenging Economic Environment, which conveys certain key risk management practices for FDIC-supervised institutions to consider in managing CRE loan concentrations in the current economic environment.

Securities and Exchange Commission

Bancshares is under the jurisdiction of the Securities and Exchange Commission (“SEC”) for matters relating to the offer and sale of its securities and is subject to the SEC’s rules and regulations related to periodic reporting, reporting to shareholders, proxy solicitations and insider trading regulations.

Monetary Policy

Our earnings are and will be affected by domestic economic conditions and the monetary and fiscal policies of the United States government and its agencies. The monetary policies of the Federal Reserve have a substantial effect on the operating results of commercial banks, including the Bank. The Federal Reserve has a significant impact on the levels of bank loans, investments and deposits through its open market operations in United States government securities and through its regulation of, among other things, the discount rate on borrowings of member banks and the reserve requirements against member banks’ deposits. It is not possible to predict the nature and impact of future changes in monetary and fiscal policies.

Deposit Insurance

The Bank’s deposits are insured up to applicable limits by the Deposit Insurance Fund maintained by the FDIC. As a result, the Bank is required to pay periodic assessments to maintain insurance coverage for its deposits. Under the FDIC’s assessment system for banks with less than $10 billion in assets, the assessment rate is determined based on a number of factors, including the Bank’s CAMELS (supervisory) rating, leverage ratio, net income, non-performing loan ratios, other real estate owned (OREO) ratios, core deposit ratios, one-year organic asset growth and a loan mix index.

The FDIC has authority to increase insurance assessments. A significant increase in insurance assessments would likely have an adverse effect on our operating expense, results of operations, and cash flows. Management cannot predict what insurance assessment rates will be in the future. Furthermore, deposit insurance may be terminated by the FDIC upon a finding that the institution has engaged in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.

Dividend Restrictions

Under Delaware law, dividends may be paid only out of the amount calculated as the present fair value of the total assets of the corporation, minus the present fair value of the total liabilities of the corporation, minus the capital of the corporation. In the event that there is no such amount, dividends may be paid out of the net profits of the corporation for the fiscal year in which the dividend is

declared and/or the immediately preceding fiscal year. Dividends may not be paid, however, out of net profits of the corporation if the capital represented by the issued and outstanding stock of all classes having a preference on the distribution of assets is impaired. Further, the Federal Reserve permits bank holding companies to pay dividends only out of current earnings and only if future retained earnings would be consistent with the company’s capital, asset quality and financial condition.

Since it has no significant independent sources of income, Bancshares’ ability to pay dividends depends on its ability to receive dividends from the Bank. Under Alabama law, the Bank may not pay a dividend in excess of 90% of its net earnings unless its surplus is equal to at least 20% of capital. The Bank is also required by Alabama law to seek the approval of the Superintendent of the ASBD prior to the payment of dividends if the total of all dividends declared by the Bank in any calendar year will exceed the total of (1) the Bank’s net earnings for that year, plus (2) its retained net earnings for the preceding two years, less any required transfers to surplus. Alabama law defines net earnings as the remainder of all earnings from current operations plus actual recoveries on loans and investments and other assets, after deducting from the total thereof all current operating expenses, actual losses, accrued dividends on preferred stock, if any, and all federal, state and local taxes. The Bank must be able to satisfy the conditions described above in order to declare or pay a dividend to Bancshares without obtaining the prior approval of the Superintendent of the ASBD. In addition, the FDIC prohibits the payment of cash dividends if (1) as a result of such payment, the bank would be undercapitalized or (2) the bank is in default with respect to any assessment due to the FDIC, including a deposit insurance assessment. These restrictions could materially influence the Bank’s, and therefore Bancshares’, ability to pay dividends. The Federal Reserve, which has authority to prohibit a bank holding company from paying dividends or making other distributions, has issued a Supervisory Letter stating that a bank holding company should not pay cash dividends unless its net income available to common stockholders has been sufficient to fully fund the dividends, and the prospective rate of earnings retention appears to be consistent with the holding company’s capital needs, asset quality, and overall financial condition. The Dodd-Frank Act, Basel III (described below), and their respective implementing regulations impose additional restrictions on the ability of banking institutions to pay dividends.

Capital Adequacy

In July 2013, the federal banking regulatory agencies adopted regulations to implement the framework developed by the Basel Committee on Banking Supervision (“Basel Committee”) for strengthening international capital and liquidity, known as “Basel III” (the “Basel III Rule”). The Basel III Rule provides risk-based capital guidelines designed to make regulatory capital requirements more sensitive to differences in risk profiles among banks, to account for off-balance sheet exposures, and to minimize disincentives for holding liquid assets. Under these guidelines, assets and off-balance sheet items are assigned to broad risk categories, each with appropriate risk-weights. The net amount of assets remaining after applying the risk-weights to the gross asset values represents the institution’s total risk-weighted assets (“RWA”). An institution’s total RWA are used to calculate its regulatory capital ratios. The Basel III Rule establishes minimum capital and leverage ratios that supervised financial institutions are required to maintain, while also providing countercyclical capital requirements so that the required amount of capital increases in times of economic expansion and decreases in times of economic contraction, consistent with safety and soundness. Under the Basel III Rule, banks must maintain a specified capital conservation buffer above each of the required minimum capital levels in order to avoid limitations on paying dividends, engaging in share repurchases and paying certain discretionary bonuses.

In December 2017, the Basel Committee published the last version of the Basel III accord, generally referred to as “Basel IV.” The Basel Committee stated that a key objective of the revisions incorporated into the framework is to reduce excessive variability of risk-weighted assets, which will be accomplished by enhancing the robustness and risk sensitivity of the standardized approaches for credit risk and operational risk, which will facilitate the comparability of banks’ capital ratios; constraining the use of internally modeled approaches; and complementing the risk-weighted capital ratio with a finalized leverage ratio and a revised and robust capital floor. Leadership of the federal banking agencies who are tasked with implementing Basel IV has indicated that it is considering how to appropriately apply these revisions in the United States. Although it is uncertain at this time, some, if not all, of the Basel IV accord may be incorporated into the capital requirements framework applicable to Bancshares and the Bank.

Banking organizations must have appropriate capital planning processes, with proper oversight from the board of directors. Accordingly, pursuant to a separate, general supervisory letter from the Federal Reserve, bank holding companies are expected to conduct and document comprehensive capital adequacy analyses prior to the declaration of any dividends (on common stock, preferred stock, trust preferred securities or other Tier 1 capital instruments), capital redemptions or capital repurchases. Moreover, the federal banking agencies have adopted a joint agency policy statement, noting that the adequacy and effectiveness of a bank’s interest rate risk management process and the level of its interest rate exposures are critical factors in the evaluation of the bank’s capital adequacy.

In 2018, the U.S. Congress passed, and the President signed into law, the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 (the “Growth Act”) to modify or remove certain financial reform rules and regulations, including some of those implemented under the Dodd-Frank Act. While the Growth Act maintains most of the regulatory structure established by the Dodd-Frank Act, it amends certain aspects of the regulatory framework for small depository institutions with total assets of less than $10 billion and for large banks with total assets of more than $50 billion. The Growth Act, among other things, requires the federal banking agencies to issue regulations allowing community bank organizations with total assets of less than $10 billion and limited

amounts of certain assets and off-balance sheet exposures to access a simpler capital regime focused on a bank’s Tier 1 leverage capital levels rather than risk-based capital levels that are the focus of the capital rules issued under the Dodd-Frank Act implementing Basel III.

Among other changes, the Growth Act expands the definition of qualified mortgages that may be held by a financial institution and simplifies the regulatory capital rules for financial institutions and their holding companies with total consolidated assets of less than $10 billion by instructing the federal banking regulators to establish a single “Community Bank Leverage Ratio” of between 8% and 10% to replace the leverage and risk-based regulatory capital ratios. The Growth Act also includes regulatory relief for community banks regarding regulatory examination cycles, call reports, the Volcker Rule (proprietary trading prohibitions), mortgage disclosures, and risk weights for certain high-risk commercial real estate loans.

Pursuant to the Growth Act, in October 2019, the federal banking agencies adopted regulations that exempt a qualifying community bank and its holding company that have Tier 1 leverage ratios of greater than 9% from the risk-based capital requirements of the capital rules issued under the Dodd-Frank Act. A qualifying community organization is a depository institution or its holding company that has less than $10 billion in average total consolidated assets; has off-balance-sheet exposures of 25% or less of total consolidated assets; has trading assets plus trading liabilities of 5% or less of total consolidated assets; and is not an advanced approaches banking organization. A qualifying community banking organization and its holding company that have chosen the proposed framework will not be required to calculate the existing risk-based and leverage capital requirements. A qualifying community banking organization will also be considered to have met the capital ratio requirements to be well capitalized for the agencies’ prompt corrective action rules provided it has a community bank leverage ratio greater than 9%. The new community bank leverage ratio framework first became available for banking organizations to use on March 31, 2020. A qualifying community banking organization may opt into and out of the framework by completing the associated reporting requirements on its call report. We presently do not anticipate opting into the framework.

In July 2023, the federal banking regulators proposed revisions to the Basel III Capital Rules to implement the Basel Committee’s 2017 standards and make other changes to the Basel III Capital Rules. In September 2024, the federal banking regulators announced a reproposal of the revisions with some modifications. The proposed rules introduce revised credit risk, equity risk, operational risk, credit valuation adjustment risk and market risk requirements, among other changes. However, the revised capital requirements of the proposed rule would not apply to the Company or the Bank because they have less than $100 billion in total consolidated assets and trading assets and liabilities below the threshold for market risk requirements.

Prompt Corrective Action

In addition to the required minimum capital levels described above, federal law establishes a system of “prompt corrective actions” that federal banking agencies are required to take, and certain actions that they have discretion to take, based on the capital category into which a federally regulated depository institution falls. Regulations set forth detailed procedures and criteria for implementing prompt corrective action in the case of any institution that is not adequately capitalized. Each institution is assigned to one of five categories based on its capital ratios: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” or “critically undercapitalized.” Institutions categorized as “undercapitalized” or worse become subject to increasing levels of regulatory oversight and restrictions, which may include, among other things, limitations on growth and activities and payment of dividends.

As of December 31, 2024, the Bank was “well-capitalized” under the prompt corrective action rules. This classification is primarily for the purpose of applying the federal prompt corrective action provisions and is not intended to be, and should not be, interpreted as a representation of our overall financial condition or prospects.

Community Reinvestment Act

The Community Reinvestment Act (the “CRA”) requires the federal banking regulatory agencies to assess all financial institutions that they regulate to determine whether these institutions are meeting the credit needs of the communities that they serve, including their assessment area(s) (as established for these purposes in accordance with applicable regulations based principally on the location of the institution’s branch offices). Under the CRA, institutions are assigned a rating of “outstanding,” “satisfactory,” “needs to improve” or “unsatisfactory.” An institution’s record in meeting the requirements of the CRA is made publicly available and is taken into consideration in connection with any applications that it files with federal regulators to engage in certain activities, including approval of branches or other deposit facilities, mergers and acquisitions, office relocations or expansions into non-banking activities. The Bank received a “satisfactory” rating in its most recent CRA evaluation.

On October 24, 2023, the FDIC, the Federal Reserve Board, and the Office of the Comptroller of the Currency (the “OCC”) issued a final rule to strengthen and modernize the CRA regulations. Under the final rule, banks with assets of at least $600 million as of December 31 in both of the prior two calendar years and less than $2 billion as of December 31 in either of the prior two calendar

years will be an “intermediate bank,” and banks with assets of at least $2 billion as of December 31 in both of the prior two calendar years will be a “large bank.” The agencies will evaluate large banks under four performance tests: the Retail Lending Test, the Retail Services and Products Test, the Community Development Financing Test, and the Community Development Services Test. The agencies will evaluate intermediate banks under the Retail Lending Test and either the current community development test, referred to in the final rule as the Intermediate Bank Community Development Test, or, at the bank’s option, the Community Development Financing Test. The applicability date for the majority of the provisions in the CRA regulations is January 1, 2026, and additional requirements will be applicable on January 1, 2027. However, in March 2024, a federal district court issued a preliminary injunction of the regulations, and litigation addressing the constitutionality of the regulations is still pending.

Fair Access

On January 23, 2025, President Trump signed an Executive Order titled “Strengthening American Leadership in the Digital Financial Technology” (the “Order”). The primary focus of the Order is promoting U.S. developments in blockchain, digital assets and other emerging financial technologies, including cryptocurrency. The Order also states that one of the administration’s objectives is “protecting and promoting fair and open access to banking services for all law-abiding individual citizens and private-sector entities alike.” This objective appears to be related to a regulatory initiative in the first Trump administration that ultimately led to the OCC adopting a final rule on “Fair Access to Financial Services” (the “Fair Access Rule”) in the final days of that administration. The Fair Access Rule would require “covered banks” (generally, national banks with over $100 billion in assets) to:

The Trump administration expressed concern, in particular, for banks denying access due to political or social concerns. The Biden administration paused implementation of the Fair Access Rule, and it never became effective. The new Trump administration may revive the Fair Access Rule or enact similar regulations. Any such rule could impose a regulatory burden on covered banks to document compliance. The Company is not a covered bank under the existing version of the Fair Access Rule, but additional rulemaking could broaden its scope to apply to the Company.

Third-Party Risk Management

On June 9, 2023, the OCC, Federal Reserve, and FDIC issued final interagency guidance on risk management of third-party relationships, including third-party lending relationships. The interagency guidance is based, in part, on the OCC’s previously existing third-party risk management guidance from 2013 and seeks to, among other things, promote consistency in third-party risk management and provide sound risk management guidance for third-party relationships commensurate with a bank’s risk profile and complexity as well as the criticality of the activity. The final interagency guidance replaces each agency’s existing guidance on this topic (including the OCC's 2020 Frequently Asked Questions on Third-Party Relationships) and is directed to all banking organizations supervised by the OCC, Federal Reserve, and FDIC. Additionally, third party relationship risk management and banking as a service arrangements (including with respect to deposit products and services) have been topics of focus for federal bank regulators in 2024 and further rulemaking activity or guidance may be forthcoming.

Anti-Money Laundering Laws

Under various federal laws, including the Currency and Foreign Transactions Reporting Act (also known as the “Bank Secrecy Act”), as amended by the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act, financial institutions are subject to prohibitions against specified financial transactions and account relationships, as well as enhanced due diligence and “know your customer” standards in their dealings with foreign financial institutions and foreign customers. These laws also mandate that financial institutions establish anti-money laundering programs meeting certain standards and require the federal banking regulators to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions.

The Anti-Money Laundering Act of 2020 (“AMLA”), which amends the Bank Secrecy Act, was enacted in January 2021. The AMLA is intended to be a comprehensive reform and modernization to U.S. bank secrecy and anti-money laundering laws. Among other things, it codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the U.S. Department of the Treasury to promulgate priorities for anti-money laundering and countering the financing of terrorism policy; requires the development of standards for testing technology and internal processes for Bank Secrecy Act compliance; expands

enforcement- and investigation-related authority, including increasing available sanctions for certain Bank Secrecy Act violations; and expands Bank Secrecy Act whistleblower incentives and protections. Many of the statutory provisions in the AMLA will require additional rulemakings, reports and other measures, and the impact of the AMLA will depend on, among other things, rulemaking and implementation guidance. In June 2021, the Financial Crimes Enforcement Network ("FinCEN"), a bureau of the U.S. Department of the Treasury, issued the priorities for anti-money laundering and countering the financing of terrorism policy required under the AMLA. The priorities include: corruption, cybercrime, terrorist financing, fraud, transnational crime, drug trafficking, human trafficking and proliferation financing.

The Corporate Transparency Act (the “CTA”) was adopted as Title LXIV of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021. FinCEN adopted a final regulation as 31 C.F.R. 101.380 on September 30, 2022 to implement the CTA. This became effective on January 1, 2024. These regulations require entities to report information about their beneficial owners and the individuals who created the entity (together, “beneficial ownership information” or “BOI”). FinCEN explained that the proposed rule would help protect the U.S. financial system from illicit use by making it more difficult for bad actors to conceal their financial activities through entities with opaque ownership structures. FinCEN also explained that the proposed reporting obligations would provide essential information to law enforcement and others to help prevent corrupt actors, terrorists, and proliferators from hiding money or other property in the United States. The new rules expand financial institutions’ obligations under the Customer Due Diligence Rule (the “CDD Rule”) to collect information and verify the beneficial ownership of legal entities. The constitutionality of the CTA has been challenged in federal court, and enforcement of the CTA is subject to an injunction pending the outcome of the related litigation. Although the Company and the Bank are exempt from the CTA’s requirements to report their respective beneficial owners, the new CTA reporting requirements, if they become effective, may increase the Bank’s anti-money laundering diligence activities and costs.

The United States has imposed various sanctions upon various foreign countries, such as China, Iran, North Korea, Russia and Venezuela, and certain of their government officials and persons. Banks are required to comply with these sanctions which require additional customer screening and transaction monitoring.

Russia’s February 2022 invasion of Ukraine has generated a significant number of new sanctions on Russia, Russian persons and suppliers of military or dual-purpose products to Russia. Federal bank regulators have issued alerts that Russia and others may step up cyber-attacks and data intrusions following the invasion. FinCEN has issued four alerts on potential Russian illicit financial activity since February 2022. On January 25, 2023 FinCEN issued an alert to financial institutions on potential investments in the U.S. commercial real estate sector by sanctioned Russian elites, oligarchs, their family members, and the entities through which they act. The alert listed potential red flags and typologies involving attempted sanctions evasion in the commercial real estate sector, and reminds financial institutions of their Bank Secrecy Act (BSA) reporting obligations.

Overdrafts

Federal bank regulators have updated their guidance several times on overdrafts, including overdrafts incurred at automated teller machines and point of sale terminals. Overdrafts also have been a CFPB concern, and in 2021, this entity began refocusing on this issue with a view to “insure that banks continue to evolve their businesses to reduce reliance on overdraft and not sufficient funds fees.” Among other things, federal regulators require banks to monitor accounts and to limit the use of overdrafts by customers as a form of short-term, high-cost credit, including, for example, giving customers who overdraw their accounts on more than six occasions where a fee is charged in a rolling 12 month period a reasonable opportunity to choose a less costly alternative and decide whether to continue with fee-based overdraft coverage. It also encourages placing daily limits on overdraft fees, and asks banks to consider eliminating overdraft fees for transactions that overdraw an account by a de minimis amount. Overdraft policies, processes, fees and disclosures are frequently the subject of litigation against banks in various jurisdictions. Federal bank regulators have been considering responsible small dollar lending, including overdrafts and related fee issues. In May 2020, they issued principals for offering small-dollar loans in a responsible manner.

CFPB Consumer Financial Protection Circular 2022-06 (Oct. 26, 2022) concluded that overdraft fee practices must comply with Regulation Z, Regulation E, and the prohibition against unfair, deceptive, and abusive acts or practices in Section 1036 of the Consumer Financial Protection Act. Further, overdraft fees assessed by financial institutions on transactions that a consumer would not reasonably anticipate are likely unfair even if these comply with these other consumer laws and regulations. The CFPB proposed on February 6, 2019 to rescind its mandatory underwriting standards for loans covered by its 2017 Payday, Vehicle Title and Certain High-Cost Installment Loans rule, and has separately proposed delaying the effectiveness of such 2017 rule.

The CFPB has a broad mandate to regulate consumer financial products and services, whether or not offered by banks or their affiliates. The CFPB has the authority to adopt regulations and enforce various laws, including fair lending laws, the Truth in Lending Act, the Electronic Funds Transfer Act, mortgage lending rules, the Truth in Savings Act, the Fair Credit Reporting Act and Privacy of Consumer Financial Information rules. Although the CFPB does not examine or supervise banks with less than $10 billion in assets, banks of all sizes are affected by the CFPB’s regulations, and the precedents set in CFPB enforcement actions and interpretations.

Brokered Deposits

The FDIC limits the ability to accept brokered deposits to those insured depository institutions that are well capitalized. Institutions that are less than well capitalized cannot accept, renew or roll over any brokered deposit unless they have applied for and been granted a waiver by the FDIC. The FDIC has defined the “national rate” for all interest-bearing deposits held by less-than-well-capitalized institutions as “a simple average of rates paid by all insured depository institutions and branches for which data are available” and has stated that its presumption is that this national rate is the prevailing rate in any market. As such, institutions that are less than well capitalized that are permitted to accept, renew or roll over brokered deposits via a FDIC waiver generally may not pay an interest rate in excess of the national rate plus 75 basis points on such brokered deposits. As of December 31, 2024, the Bank categorized $72.4 million, or 7.4% of its deposit liabilities, as brokered deposits.

On December 15, 2020, the FDIC issued a final rule establishing a new framework for analyzing whether bank deposits obtained through third-party arrangements are brokered deposits pursuant to Section 29 of the Federal Deposit Insurance Act. Generally, a person is a "deposit broker" if it is "engaged in the business of placing deposits, or facilitating the placement of deposits, of third parties with insured depository institutions or the business of placing deposits with insured depository institutions for the purpose of selling interests in those deposits to third parties." The final rule clarifies what it means to be in the business of placing deposits and facilitating the placement of deposits for purpose of the deposit broker definition.

Section 29 provides, in particular, that a person with an exclusive deposit placement arrangement with one insured depository institution will not be considered a deposit broker because it is not in the business of placing deposits or facilitating the placement of deposits.

The final rule also clarifies application of the “primary purpose exception” to Section 29 by identifying a number of common business relationships described as “designated exceptions” and meeting the primary purpose exception. Many of these designated exceptions are arrangements previously addressed in advisory opinions and include: certain investment-related deposits; property management service deposits; deposits for cross-border clearing services; deposits related to real estate and mortgage servicing activities; retirement and 529 deposits; deposits related to employee benefits programs; deposits held to secure credit card loans; and deposits placed by agencies to disburse government benefits. As a result of this final rule, the Company's deposits that were classified as brokered deposits reduced significantly beginning with the June 30, 2021 reporting period.

On July 30, 2024, the FDIC proposed a rule that would amend the current rules governing brokered deposits. The proposed rule as drafted would, among other things, (1) amend the definition of “deposit broker”; (2) eliminate the exclusive deposit placement arrangement exception; (3) eliminate the enabling transactions designated business exception; (4) revise the “25 percent test” designated business exception for a primary purpose exception to be available only to broker-dealers and investment advisers and only if less than 10 percent of the total assets that the broker-dealer or investment adviser has under management for its customers is placed at one or more insured depository institutions; (5) revise the interpretation of the primary purpose exception to consider the third party’s intent in placing customer funds at a particular insured depository institution; (6) allow only insured depository institutions to file notices and applications for primary purpose exceptions; and (7) clarify how an insured depository institution that loses its “agent institution” status regains that status. The Company is currently evaluating the effect of the proposed rule on the Company were it to be adopted as a final rule and monitoring the status of this rulemaking. Based on recent statements from the new Acting Chairman of the FDIC, the proposed rule is unlikely to be adopted as proposed due to the change in Presidential administration and the prospects and timing for any re-proposal or supervisory action in this area remain uncertain at this time.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley”) comprehensively revised the laws affecting corporate governance, auditing, executive compensation and corporate reporting for entities with equity or debt securities registered under the Securities Exchange Act of 1934, as amended (the “Exchange Act”). Among other things, Sarbanes-Oxley and its implementing regulations established new membership requirements and additional responsibilities for audit committees, imposed restrictions on the relationships between public companies and their outside auditors (including restrictions on the types of non-audit services that auditors may provide), imposed additional responsibilities for public companies’ external financial statements on the chief executive officer and chief financial officer, and expanded the disclosure requirements for corporate insiders. The requirements are intended to allow stockholders to more easily and efficiently monitor the performance of companies and directors. We and our Board of Directors have, as appropriate, adopted or modified our policies and practices in order to comply with these regulatory requirements and to enhance our corporate governance practices.

As required by Sarbanes-Oxley, we have adopted a Code of Business Conduct and Ethics applicable to our Board, executives and employees. This Code of Business Conduct can be found on our website at http://www.fusb.com under the tabs “About – Investor Relations – FUSB Policies.”

Privacy of Customer Information

The Financial Services Modernization Act of 1999 (also known as the “Gramm-Leach-Bliley Act” or the “GLBA”) and the implementing regulations issued by federal banking regulatory agencies require financial institutions to adopt policies and procedures regarding the disclosure of nonpublic personal information about their customers to non-affiliated third parties. In general, financial institutions are required to explain to customers their policies and procedures regarding the disclosure of such nonpublic personal information, and, unless otherwise required or permitted by law, financial institutions are prohibited from disclosing such information except as provided in their policies and procedures. Specifically, the GLBA established certain information security guidelines that require each financial institution, under the supervision and ongoing oversight of its board of directors or an appropriate committee thereof, to develop, implement, and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, to protect against anticipated threats or hazards to the security or integrity of such information, and to protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer.

The GLBA and related regulations require banks and their affiliated companies to adopt and disclose privacy policies, including policies regarding the sharing of personal information with third parties. The GLBA also permits bank subsidiaries to engage in financial activities, which are similar to those permitted to financial holding companies. In December 2015, Congress amended the GLBA as part of the Fixing America’s Surface Transportation Act. This amendment provided financial institutions, which meet certain conditions, an exemption from the requirement to deliver an annual privacy notice. On August 10, 2018, the CFPB announced that it had finalized conforming amendments to its implementing regulation, Regulation P.

On October 22, 2024, the CFPB issued a final rule to implement Section 1033 of the Dodd-Frank Act, which gives individuals the right to obtain data regarding consumer financial products and services they have obtained. The final rule requires certain entities, including the Bank, to comply with an established framework to govern consumer access to electronic financial data. Compliance with the rule will be phased in over several years with the Bank required to be in compliance by April 1, 2030. Following the issuance of this rule, two trade associations and a national bank headquartered in Kentucky filed a lawsuit challenging the rule in the United States District Court for the Eastern District of Kentucky. In this lawsuit, the plaintiffs alleged that the CFPB exceeded its statutory authority in adopting the rule.

A variety of federal and state privacy laws govern the collection, safeguarding, sharing and use of customer information, and require that financial institutions have policies regarding information privacy and security. Some state laws also protect the privacy of information of state residents and require adequate security of such data, and certain state laws may, in some circumstances, require us to notify affected individuals of security breaches of computer databases that contain their personal information. These laws may also require us to notify law enforcement, regulators or consumer reporting agencies in the event of a data breach, as well as businesses and governmental agencies that own data. In March 2021, Virginia adopted the Consumer Data Protection Act (the “VCDPA”), which imposes certain restrictions and requirements on businesses that collect consumer data for at least 100,000 consumers in Virginia. The Bank currently has fewer than 100,000 customers in Virginia but may become subject to the VCDPA if its customer base grows above that level. The Company could face enforcement actions by the Virginia Attorney General and penalties for noncompliance with the VCDPA.

Cybersecurity

The Cybersecurity Information Sharing Act of 2015 (“CISA”) was intended to improve cybersecurity in the United States by enhanced sharing of information about security threats among the U.S. government and private sector entities, including financial institutions. CISA also authorizes companies to monitor their own systems notwithstanding any other provision of law and allows companies to carry out cybersecurity defensive measures on their own systems. The law includes liability protections for companies that share cyber threat information with third parties so long as such sharing activity is conducted in accordance with CISA.

In October 2016, the federal bank regulatory agencies issued an Advance Notice of Proposed Rulemaking regarding enhanced cyber risk management standards which would apply to a wide range of large financial institutions and their third-party service providers, including Bancshares and the Bank. The proposed standards would expand existing cybersecurity regulations and guidance to focus on cyber risk governance and management, management of internal and external dependencies, and incident response, cyber resilience, and situational awareness. In addition, the proposal contemplates more stringent standards for institutions with systems that are critical to the financial sector.

The federal banking regulators regularly issue guidance regarding cybersecurity intended to enhance cyber risk management standards among financial institutions. A financial institution is expected to establish multiple lines of defense and to ensure its risk management processes address the risk posed by potential threats to the institution. A financial institution’s management is expected to maintain sufficient processes to effectively respond and recover the institution’s operations after a cyber-attack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations if a critical service provider of the institution falls victim to this type of cyber-attack.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments in the states in which our customers are located.

In November 2021, federal bank regulatory agencies adopted a rule regarding notification requirements for banking organizations related to significant computer security incidents. Under the final rule, a bank holding company, such as the Company, and an FDIC-supervised insured depository institution, such as the Bank, are required to notify the Federal Reserve or FDIC, respectively, within 36 hours of incidents that have materially disrupted or degraded, or are reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. Service providers are required under the rule to notify any affected bank client it provides services to as soon as possible when it determines it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided by that entity to the bank for four or more hours.

Furthermore, once administrative rules are adopted by the CISA, the Cyber Incident Reporting for Critical Infrastructure Act, enacted in March 2022, will require certain covered entities, including those in the financial services industry, to report a covered cyber incident to CISA within 72 hours once the covered entity reasonably believes an incident has occurred. Separate reporting to CISA will also be required within 24 hours if a ransom payment is made as a result of a ransomware attack.

In July 2023, the SEC adopted amendments to its rules to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and incident reporting by public companies that are subject to the reporting requirements of the Exchange Act. Specifically, the amendments require current reporting about material cybersecurity incidents, periodic disclosures about a registrant’s policies and procedures to identify and manage cybersecurity risk, management’s role in implementing cybersecurity policies and procedures, management's cybersecurity expertise, if any, and the board of directors oversight of cybersecurity risk. Additionally, the rules require registrants to provide updates about previously reported cybersecurity incidents in their periodic reports.

On October 19, 2023, the CFPB announced a proposed rule to adopt a regulation regarding personal financial data rights that is designed to promote “open banking.” If enacted as proposed, the regulation would require, among other things, that data providers, including any financial institution, make available to consumers and certain authorized third parties upon request certain covered transaction, account and payment information.

On October 30, 2023, the Biden administration issued an Executive Order on Safe, Secure and Trustworthy Development and Use of AI, emphasizing the need for transparency, accountability and fairness in the development and use of AI. The order seeks to balance innovation with addressing risks associated with AI by providing eight guiding principles and priorities, such as ensuring that consumers are protected from fraud, discrimination and privacy risks related to AI. The Executive Order also requires certain federal agencies, including the CFPB, to address potential discrimination in the housing and consumer financial markets relating to the use by financial institutions of AI technologies. Prior to the issuance of the Executive Order, the CFPB published a report addressing the use by financial institutions of AI chatbots in the provision of financial products and services, which report also highlighted the limitations and various risks posed by such activity. States have also started to regulate the use of AI technologies. For example, the California Privacy Protection Agency ("CCPA") is currently in the process of finalizing regulations under the CCPA regarding the use of automated decision making.

Regulation of Lending Practices

Our lending practices are subject to a number of federal and state laws, as supplemented by the rules and regulations of the various agencies charged with the responsibility of implementing these laws. These include, among others, the following:

The CFPB has adopted a number of rules that impact our lending practices, including, among other things, (1) requiring financial institutions to make a “reasonable and good faith determination” that a consumer has a “reasonable ability” to repay a residential mortgage loan before making such a loan, (2) requiring sponsors of asset-backed securities to retain at least 5% of the credit risk of the assets underlying the securities (and generally prohibiting sponsors from transferring or hedging that credit risk), and (3) imposing a number of new and enhanced requirements on the mortgage servicing industry, including rules regarding communications with borrowers, maintenance of customer account records, procedures for responding to written borrower requests and complaints of errors, servicing delinquent loans, and conducting foreclosure proceedings, among other measures.

Regulation of Deposit Operations

Our deposit operations are subject to federal laws applicable to depository accounts, including, among others, the following:

Federal Home Loan Bank Membership

The Bank is a member of the Federal Home Loan Bank of Atlanta (“FHLBA”). Each member of the FHLBA is required to maintain a minimum investment in the Class B stock of the FHLBA. The Board of Directors of the FHLBA can increase the minimum investment requirements if it concludes that additional capital is required to allow it to meet its own regulatory capital requirements. Any increase in the minimum investment requirements outside of specified ranges requires the approval of the Federal Housing Finance Agency. Because the extent of any obligation to increase the level of investment in the FHLBA depends entirely on the occurrence of a future event, we are unable to determine the extent of future required potential payments to the FHLBA at this time. Additionally, in the event that a member financial institution fails, the right of the FHLBA to seek repayment of funds loaned to that institution will take priority over the rights of all other creditors.

Climate-Related Regulation and Risk Management

In recent years, the federal banking agencies have increased their focus on climate-related risks impacting the operations of banks, the communities they serve and the broader financial system. Accordingly, the agencies have begun to enhance their supervisory expectations regarding the climate risk management practices of larger banking organizations, including by encouraging such banks to: ensure that management of climate-related risk exposures has been incorporated into existing governance structures; evaluate the potential impact of climate-related risks on the bank’s financial condition, operations and business objectives as part of its strategic planning process; account for the effects of climate change in stress testing scenarios and systemic risk assessments; revise expectations for credit portfolio concentrations based on climate-related factors; consider investments in climate-related initiatives and lending to communities disproportionately impacted by the effects of climate change; evaluate the impact of climate change on the bank’s borrowers and consider possible changes to underwriting criteria to account for climate-related risks to mortgaged properties; incorporate climate-related financial risk into the bank’s internal reporting, monitoring and escalation processes; and prepare for the transition risks to the bank associated with the adjustment to a low-carbon economy and related changes in laws, regulations, governmental policies, technology, and consumer behavior and expectations.

On October 21, 2021, the Financial Stability Oversight Council published a report identifying climate-related financial risks as an “emerging threat” to financial stability. On December 16, 2021, the Office of the Comptroller of the Currency (the “OCC”) issued proposed principles for climate-related financial risk management for national banks with more than $100 billion in total assets. Although these risk management principles, if adopted as proposed, would not apply to the Bank directly based upon our current size, the OCC has indicated that all banks, regardless of their size, may have material exposures to climate-related financial and other risks that require prudent management. The federal banking agencies, either independently or on an interagency basis, are expected to adopt a more formal climate risk management framework for larger banking organizations in the coming months. As climate-related supervisory guidance is formalized, and relevant risk areas and corresponding control expectations are further refined, we may be required to expend significant capital and incur compliance, operating, maintenance and remediation costs in order to conform to such requirements.

In March 2024, the SEC adopted final rules for "The Enhancement and Standardization of Climate-Related Disclosures for Investors,” which would have required issuers to provide climate-related disclosures. In April 2024, the SEC stayed the effectiveness of the final rules pending the outcome of certain legal challenges.

Website Information

The Bank’s website address is https://www.fusb.com. Bancshares does not maintain a separate website. Bancshares makes available free of charge on or through the Bank’s website, under the tabs “Investors – SEC filings,” its Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and all amendments to those reports filed or furnished pursuant to Section 13(a) of the Exchange Act as soon as reasonably practicable after such material is electronically filed with the SEC. These reports are also available on the SEC’s website, https://www.sec.gov. Bancshares will provide paper copies of these reports to shareholders free of charge upon written request. Bancshares is not including the information contained on or available through the Bank’s website as a part of, or incorporating such information into, this Annual Report on Form 10-K.

Item 1A. Risk Factors.

Making or continuing an investment in our common stock involves certain risks that you should carefully consider. The risks and uncertainties described below are not the only risks that may have a material adverse effect on us. Additional risks and uncertainties also could adversely affect our business, consolidated financial condition, results of operations and cash flows. If any of the following risks actually occurs, our business, financial condition or results of operations could be negatively affected, the market price of your common stock could decline, and you could lose all or a part of your investment. Further, to the extent that any of the information contained in this Annual Report on Form 10-K constitutes forward-looking statements, the risk factors set forth below also are cautionary statements identifying important factors that could cause our actual results to differ materially from those expressed in any forward-looking statements made by us or on our behalf.

Risks Related to Credit and Liquidity

If loan losses are greater than anticipated, our earnings may be adversely affected.

As a lender, we are exposed to the risk that customers will be unable to repay their loans according to their terms and that any collateral securing the payment of their loans may not be sufficient to assure repayment. Credit losses are inherent in the business of making loans. Our credit risk with respect to our real estate and construction loan portfolio relates principally to the creditworthiness of individuals and the value of the real estate serving as security for the repayment of loans, and the credit risk with respect to our commercial and consumer loan portfolio relates principally to the general creditworthiness of businesses and individuals within the local markets in which we operate. We make various assumptions and judgments about the collectability of our loan portfolio and

provide an allowance for potential credit losses based on a number of factors. We believe that our allowance for credit losses is adequate. However, if estimates, assumptions or judgments used in calculating this allowance are incorrect, the allowance for credit losses may not be sufficient to cover our actual loan losses. Deterioration of economic conditions affecting borrowers, new information regarding existing loans, inaccurate management assumptions, identification of additional problem loans and other factors, both within and outside of our control, may result in higher levels of nonperforming assets and charge-offs and loan losses in excess of our current allowance for credit losses, requiring us to make material additions to our allowance for credit losses, which could have a material adverse effect on our business, consolidated financial condition, results of operations and cash flows. The actual amount of future provisions for credit losses cannot be determined at this time and may vary from the amounts of past provisions. In addition, banking regulators periodically review our allowance for credit losses and may require us to increase our provision for credit losses or recognize further charge-offs if the regulators’ judgments are different than those of our management. Material additions to the allowance could materially decrease our net income.

CRE lending may expose us to increased lending risks.

Our policy generally has been to originate CRE loans primarily in the states in which the Bank operates. At December 31, 2024, CRE loans, including owner occupied, investor, and real estate construction loans, totaled $293.3 million or 35.6%, of our total loan portfolio. As a result of our growth in this portfolio over the past several years and planned future growth, these loans require more ongoing evaluation and monitoring and we are implementing enhanced risk management policies, procedures and controls. CRE loans generally involve a greater degree of credit risk than residential mortgage loans because they typically have larger balances and are more affected by adverse conditions in the economy. Because payments on loans secured by CRE often depend upon the successful operation and management of the properties and the businesses which operate from within them, repayment of such loans may be affected by factors outside the borrower’s control, such as adverse conditions in the real estate market or the economy or changes in government regulation. In recent years, CRE markets have been experiencing substantial growth, and increased competitive pressures have contributed significantly to historically low capitalization rates and rising property values. However, CRE markets have been facing downward pressure since 2022 due in large part to increasing interest rates and declining property values. Accordingly, the federal banking agencies have expressed concerns about weaknesses in the current CRE market and have applied increased regulatory scrutiny to institutions with CRE loan portfolios that are fast growing or large relative to the institutions' total capital. To address supervisory expectations with respect to financial institutions' handling of CRE borrowers who are experiencing financial difficulty, in June of 2023, the federal banking agencies, including the OCC, issued an interagency policy statement addressing prudent CRE loan accommodations and workouts. Our failure to adequately implement enhanced risk management policies, procedures and controls could adversely affect our ability to increase this portfolio going forward and could result in an increased rate of delinquencies in, and increased losses from, this portfolio. At December 31, 2024, the Company had no CRE loans on nonaccrual status.

Weakness in the residential real estate markets could adversely affect our performance.

As of December 31, 2024, 1-4 family residential real estate loans represented approximately 9% of our total loan portfolio. A general decline in home values would adversely affect the value of collateral securing the residential real estate that we hold, as well as the volume of loan originations and the amount we realize on the sale of real estate loans. Additionally, if insurance obtained by our borrowers is insufficient to cover any losses sustained to the collateral, the decreases in the value of collateral securing our loans as a result of natural disasters or other related events could adversely impact our financial condition and results of operations. If insurance coverage is unavailable to our borrowers due to the reluctance of insurance companies to renew policies covering the collateral or due to other factors, the resulting increase in cost of home ownership could affect the ability of borrowers to repay loans. These factors could result in higher delinquencies and greater charge-offs in future periods, which could materially adversely affect our business, financial condition or results of operations.

Our business is subject to liquidity risk, which could disrupt our ability to meet financial obligations.

Liquidity risk refers to the ability of the Company to ensure that sufficient cash flow and liquid assets are available to satisfy current and future financial obligations, including demand for loans and deposit withdrawals, funding operating costs and other corporate purposes. Liquidity risk arises whenever the maturities of financial instruments included in assets and liabilities differ or when assets cannot be liquidated at fair market value as needed. The Company obtains funding through deposits and various short-term and long-term wholesale borrowings, including federal funds purchased and securities sold under repurchase agreements, the Federal Reserve Discount Window and Federal Home Loan Bank (FHLB) advances. Any restriction or disruption of the Company’s ability to obtain funding from these or other sources could have a negative effect on the Company’s ability to satisfy its current and future financial obligations, which could materially affect the Company’s condition or results of operations.

Liquidity risks could affect our operations and jeopardize our financial condition.

Liquidity is essential to our business. An inability to raise funds through deposits, borrowings, the repayment or sale of loans and other sources could have a substantial negative effect on our liquidity. Our funding sources include federal funds, purchased

securities sold under repurchase agreements, core and non-core deposits, and short- and long-term debt. We maintain a portfolio of securities that can be used as a source of liquidity. In addition, certain loans in the Company's loan portfolio may be pledged to the FHLB or Federal Reserve Bank ("FRB") as a source of liquidity. Other sources of liquidity are available should they be needed, such as through our acquisition of additional non-core deposits. Bancshares may be able, depending on market conditions, to issue and sell debt securities and preferred or common equity securities in public or private transactions. Our access to funding sources in amounts adequate to finance or capitalize our activities or on acceptable terms could be impaired by factors that affect us specifically or the financial services industry or economy in general, such as further disruption in the financial markets, negative views and expectations about the prospects for the financial services industry, deterioration within the credit markets, or the financial condition, liquidity or profitability of the financial institutions with which we transact.

Risks Related to Our Market and Industry

Our business and operations may be materially adversely affected by national and local market economic conditions.

Our business and operations, which primarily consist of banking activities, including lending money to customers in the form of loans and borrowing money from customers in the form of deposits, are sensitive to general business and economic conditions in the United States generally, and in our local markets in particular. If economic conditions in the United States or any of our local markets weaken, our growth and profitability from our operations could be constrained. The current economic environment is characterized by high inflation levels and interest rates. These conditions impact our ability to attract deposits and to generate attractive earnings through our loan and investment portfolios. All of these factors can individually or in the aggregate be detrimental to our business, and the interplay between these factors can be complex and unpredictable. Unfavorable market conditions can result in a deterioration in the credit quality of our borrowers and the demand for our products and services, an increase in the number of delinquencies, defaults and charge-offs, additional provisions for loan losses, a decline in the value of our collateral, and an overall material adverse effect on the quality of our loan portfolio. Additionally, national financial markets may be adversely affected by sustained high levels of inflation, the current or anticipated impact of military conflict, including the current conflicts in the Middle East and Ukraine, terrorism, and other geopolitical events.

The economic conditions in our local markets may be different from the economic conditions in the United States as a whole. Our success depends to a certain extent on the general economic conditions of the geographic markets that we serve in Alabama, Tennessee and Virginia, as well as other states in which our indirect lending team operates. Local economic conditions in these areas have a significant impact on our commercial, real estate and construction loans, the ability of borrowers to repay these loans and the value of the collateral securing these loans. Adverse changes in the economic conditions of the southeastern United States in general or any one or more of these local markets could negatively impact the financial results of our banking operations and have a negative effect on our profitability.

Significant changes to the size, structure, powers and operations of the federal government may cause economic disruptions that could, in turn, adversely impact our business, results of operations and financial condition.

The Trump administration has commenced efforts to implement significant changes to the size and scope of the federal government and reform its operations to achieve stated goals that include reducing the federal budget deficit and national debt, improving the efficiency of government operations, and promoting innovation and economic growth. To date, these efforts have been carried out through a mix of executive actions aimed at eliminating or modifying federal agency and federal program funding, reducing the size of the federal workforce, reducing or altering the scope of activities conducted by, and possibly eliminating, various federal agencies and bureaus, and encouraging the use of AI and other advanced technologies within the public and private sectors. These changes, if implemented and taken as a whole, may have varied effects on the economy that are difficult to predict. For instance, the delivery of government services and the distribution of federal program funds and benefits may be disrupted or, in some cases, eliminated as a result of funding cuts or recasting of federal agency mandates. Further, a substantial reduction of the federal workforce could adversely affect regional and local economies, both directly and indirectly, in geographies with significant concentrations of federal employees and contractors. It is possible that such comprehensive changes to the federal government may be materially adverse to the regional and local economies where we conduct business and to our customers, which, in turn, could be materially adverse to our business, financial condition and results of operations.

The banking industry is highly competitive, which could result in loss of market share and adversely affect our business.

We encounter strong competition in making loans, acquiring deposits and attracting customers for investment services. We compete with commercial banks, online banks, credit unions, finance companies, mutual funds, insurance companies, investment banking companies, brokerage firms and other financial intermediaries operating in our markets and elsewhere in various segments of the financial services market. Many of these competitors, some of which are affiliated with large bank holding companies, have substantially greater resources and lending limits than we do. In addition, many of our non-bank competitors are not subject to the

same extensive federal regulations that govern bank holding companies and federally insured banks, and, as a result, may be able to offer certain products and services at a lower cost than we are able to offer, which could adversely affect our business.

Rapid and significant changes in market interest rates may adversely affect our performance.

Most of our assets and liabilities are monetary in nature and are therefore subject to significant risks from changes in interest rates. Our profitability depends to a large extent on net interest income, and changes in interest rates can impact our net interest income as well as the valuation of our assets and liabilities. Our consolidated results of operations are affected by changes in interest rates and our ability to manage interest rate risks. Changes in market interest rates, changes in the relationships between short-term and long-term market interest rates and changes in the relationships between different interest rate indices can affect the interest rates charged on interest-earning assets differently than the interest rates paid on interest-bearing liabilities. These differences could result in an increase in interest expense relative to interest income or a decrease in our interest rate spread. Significant increases in market interest rates on loans, or the perception that an increase may occur, could adversely affect both our ability to originate new loans and our ability to grow.

Beginning in early 2022, in response to growing signs of inflation, the FRB increased interest rates rapidly, causing the federal funds rate to reach a 22-year high. Although the FRB reduced its benchmark rates in the latter part of 2024, the inflationary outlook in the United States is currently uncertain. Rapid changes in interest rates make it difficult for the Bank to balance its loan and deposit portfolios, which may adversely affect our results of operations by, for example, reducing asset yields or spreads, creating operating and system issues, or having other adverse impacts on our business. Persistent inflation could lead to higher interest rates, which could, in turn, increase the borrowing costs of our customers, making it more difficult for them to repay their loans or other obligations. High interest rates could also push down asset prices and weaken economic activity. For a more detailed discussion of these risks and our management strategies for these risks, see “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations.” Our net interest margin depends on many factors that are partly or completely out of our control, including competition, federal economic monetary and fiscal policies and general economic conditions. Despite the implementation of strategies to manage interest rate risks, changes in interest rates may have a material adverse impact on our profitability.

The performance of our investment portfolio is subject to fluctuations due to changes in interest rates and market conditions.

Changes in interest rates can negatively affect the performance of most of our investments. Interest rate volatility can reduce gains or create losses in our investment portfolios. Interest rates are highly sensitive to many factors, including governmental monetary policies, domestic and international economic and political conditions and other factors beyond our control. Fluctuations in interest rates affect returns on, and the market value of, investment securities. The fair market value of the securities in our portfolio and the investment income from these securities also fluctuate depending on general economic and market conditions. In addition, actual net investment income and/or cash flows from investments that carry prepayment risk, such as mortgage-backed and other asset-backed securities, may differ from those anticipated at the time of investment as a result of interest rate fluctuations. The potential effect of these factors is heightened due to the current conditions in the financial markets and economic conditions generally.

Fiscal challenges facing the U.S. government could negatively impact financial markets which in turn could have an adverse effect on our financial position or results of operations.

Federal budget deficit concerns and the potential for political conflict over legislation to fund U.S. government operations and raise the U.S. government’s debt limit may increase the possibility of a default by the U.S. government on its debt obligations, related credit-rating downgrades, or an economic recession in the United States. On January 21, 2025, the U.S. Treasury began taking extraordinary measures to prevent a default on U.S. government debt, which measures are expected to continue until such time as the U.S. Congress increases the debt ceiling. However, it is unclear how long such extraordinary measures will forestall a default in the event of extended Congressional negotiations or inaction. Many of our investment securities are issued by the U.S. government and government agencies and sponsored entities. As a result of uncertain domestic political conditions, including potential future federal government shutdowns, the possibility of the federal government defaulting on its obligations for a period of time due to debt ceiling limitations or other unresolved political issues, investments in financial instruments issued or guaranteed by the federal government pose liquidity risks. In connection with prior political disputes over U.S. fiscal and budgetary issues leading to the U.S. government shutdown in 2011, S&P lowered its long-term sovereign credit rating on the U.S. from AAA to AA+. In 2023, Congress narrowly averted two separate government shutdowns by passing continuing resolutions. In part due to repeated debt-limit political standoffs and last-minute resolutions, in 2023 a rating agency downgraded the U.S. long-term foreign-currency issuer default rating to AA+ from AAA. A further downgrade, or a downgrade by other rating agencies, as well as sovereign debt issues facing the governments of other countries, could have a material adverse impact on financial markets and economic conditions in the U.S. and worldwide and, therefore, materially adversely affect our business, financial condition and results of operations.

Any government shutdown could adversely affect the U.S. and global economy and our liquidity, financial condition and earnings.

Disagreement over the federal budget has previously caused the U.S. federal government to shut down for periods of time. On December 21, 2024, President Biden signed a bipartisan continuing resolution to extend federal spending and avert a government shutdown through March 14, 2025. Accordingly, without a final agreement regarding the federal budget in place prior to the expiration of the continuing resolution, or another continuing resolution, it is still possible that a partial shutdown of the U.S. government may occur. An extended period of shutdown of portions of the U.S. federal government could negatively impact the financial performance of certain customers and could negatively impact customers’ future access to certain loan and guaranty programs. Continued adverse political and economic conditions could have a material adverse effect on our business, financial condition and results of operations. During any protracted federal government shutdown, we may not be able to close certain loans and we may not be able to recognize non-interest income on the sale of loans. In addition, we believe that some borrowers may decide not to proceed to close on their loans, which would result in a permanent loss of the related non-interest income. A federal government shutdown could also result in reduced income for government employees or employees of companies that engage in business with the federal government, which could result in greater loan delinquencies, increased in our non-performing, criticized, and classified assets, and a decline in demand for our products and services.

Changes in the policies of monetary authorities and other government action could adversely affect our profitability.

Our consolidated results of operations are affected by credit policies of monetary authorities, particularly the Federal Reserve. The instruments of monetary policy employed by the Federal Reserve include open market operations in United States government securities, changes in the discount rate or the federal funds rate on bank borrowings and changes in reserve requirements against bank deposits. In view of changing conditions in the national economy and in the money markets, we cannot predict future changes in interest rates, deposit levels, loan demand or our business and earnings. Furthermore, the actions of the United States government and other governments in responding to such conditions may result in currency fluctuations, exchange controls, market disruption and other adverse effects.

Risks Related to Privacy and Technology

Technological changes in the banking and financial services industries may negatively impact our results of operations and our ability to compete.

The banking and financial services industries are undergoing rapid changes, with frequent introductions of new technology-driven products and services. In addition to enhancing the level of service provided to customers, the effective use of technology increases efficiency and enables financial institutions to reduce costs. To remain competitive, financial institutions must continuously evaluate changing customer preferences with respect to emerging technologies and develop plans to address such changes in the most cost-effective manner possible. Our future success will depend, in part, on our ability to use technology to offer products and services that provide convenience to customers and create additional efficiencies in operations, and our failure to do so could negatively impact our business. Additionally, our competitors may have greater resources to invest in technological improvements than we do, and we may not be able to effectively implement new technology-driven products and services, which could reduce our ability to effectively compete.

Our information systems may experience a failure or interruption.

We rely heavily on communications and information systems to conduct our business. Any failure or interruption in the operation of these systems could impair or prevent the effective operation of our customer relationship management, general ledger, deposit, lending or other functions. While we have policies and procedures designed to prevent or limit the effect of a failure or interruption in the operation of our information systems, there can be no assurance that any such failures or interruptions will not occur or, if they do occur, that they will be adequately addressed. The occurrence of any failures or interruptions impacting our information systems could damage our reputation, result in a loss of customer business, and expose us to additional regulatory scrutiny, civil litigation and possible financial liability, any of which could have a material adverse effect on our business, consolidated financial condition, results of operations and cash flows.

We use information technology in our operations and offer online banking services to our customers, and unauthorized access to our customers’ confidential or proprietary information as a result of a cyber-attack or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers.

Information security risks for financial institutions have generally increased in recent years, in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased

sophistication and activities of organized crime, hackers, terrorists, activists and other external parties. We are under continuous threat of loss due to hacking and cyber-attacks, especially as we continue to expand customer capabilities to utilize the internet and other remote channels to transact business. Our risk and exposure to these matters remains heightened because of the evolving nature and complexity of these threats from cybercriminals and hackers, our plans to continue to provide internet banking channels, and our plans to develop additional remote connectivity solutions to serve our customers. Therefore, the secure processing, transmission and storage of information in connection with our online banking services are critical elements of our operations. However, our network could be vulnerable to unauthorized access, computer viruses and other malware, phishing schemes or other security failures. In addition, our customers may use personal smartphones, tablet PCs or other mobile devices that are beyond our control systems in order to access our products and services. Our technologies, systems and networks, and our customers’ devices, may become the target of cyber-attacks, electronic fraud or information security breaches that could result in the unauthorized release, gathering, monitoring, use, loss or destruction of our or our customers’ confidential, proprietary and other information, or otherwise disrupt our or our customers’ or other third parties’ business operations. As cyber threats continue to evolve, we may be required to spend significant capital and other resources to protect against these threats or to alleviate or investigate problems caused by such threats. To the extent that our activities or the activities of our customers involve the processing, storage or transmission of confidential customer information, any breaches or unauthorized access to such information could present significant regulatory costs and expose us to litigation and other possible liabilities. Any inability to prevent these types of security threats could also cause existing customers to lose confidence in our systems and could adversely affect our reputation and ability to generate deposits. In addition, we may not have adequate insurance coverage to compensate for losses from a cyber threat event. While we have not experienced any material losses relating to cyber-attacks or other information security breaches to date, we may suffer such losses in the future. The occurrence of any cyber-attack or information security breach could result in potential legal liability, reputational harm, damage to our competitive position, additional compliance costs, and the disruption of our operations, all of which could adversely affect our business, consolidated financial condition, results of operations and cash flows.

We depend on outside third parties for the processing and handling of our records and data, which exposes us to additional risk for cybersecurity breaches and regulatory action.

We rely on software and internet-based platforms developed by third-party vendors to process various transactions. In some cases, we have contracted with third parties to run their proprietary software on our behalf. These systems include, but are not limited to, general ledger, payroll, employee benefits, loan and deposit processing and securities portfolio accounting. If these third-party service providers experience difficulties, are subject to cybersecurity breaches or terminate their services, and we are unable to replace them with other service providers on a timely basis, our operations could be interrupted. If an interruption were to continue for a significant period of time, our business, consolidated financial condition and results of operations could be adversely affected. While we perform a review of controls instituted by the applicable vendors over these programs in accordance with industry standards and perform our own testing of user controls, we must rely on the continued maintenance of controls by these third-party vendors, including safeguards over the security of customer data. In addition, we maintain, or contract with third parties to maintain, daily backups of key processing outputs in the event of a failure on the part of any of these systems. Nonetheless, we may incur a temporary disruption in our ability to conduct business or process transactions, or damage to our reputation, if the third-party vendor fails to adequately maintain internal controls or institute necessary changes to systems. Such a disruption or breach of security could have a material adverse effect on our business.

In addition, federal regulators have issued guidance outlining their expectations for third-party service provider oversight and monitoring by financial institutions. Any failure to adequately oversee the actions of our third-party service providers could result in regulatory actions against us, which could adversely affect our business, consolidated financial condition, results of operations and cash flows.

The development and use of Artificial Intelligence (“AI”) presents risks and challenges that may adversely impact our business.

We or our third-party (or fourth party) vendors, clients or counterparties may develop or incorporate AI technology in certain business processes, services, or products. The development and use of AI presents a number of risks and challenges to our business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the U.S. and internationally, and includes regulatory schemes targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment, and other laws applicable to the use of AI. These evolving laws and regulations could require changes in our implementation of AI technology and increase our compliance costs and the risk of non-compliance. AI models, particularly generative AI models, may produce output or take action that is incorrect, that reflects biases included in the data on which they are trained, that results in the release of private, confidential, or proprietary information, that infringes on the intellectual property rights of others, or that is otherwise harmful. In addition, the complexity of many AI models makes it difficult to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias, and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, we may rely on AI

models developed by third parties, and, to that extent, would be dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which we may have limited visibility. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures.

Risks Related to Legal, Reputational and Compliance Matters

We are subject to extensive governmental regulation, and the costs of complying with such regulation could have an adverse impact on our operations.

The financial services industry is extensively regulated and supervised under both federal and state law. We are subject to the supervision and regulation of the Federal Reserve, the FDIC and the ASBD. These regulations are intended primarily to protect depositors, the public and the FDIC’s Deposit Insurance Fund, rather than shareholders. Additionally, we are subject to supervision, regulation and examination by other regulatory authorities, such as the SEC and state securities and insurance regulators. If, as a result of an examination, the Federal Reserve, the FDIC or the ASBD were to determine that our financial condition, capital resources, asset quality, earnings prospects, management, liquidity or other aspects of any of our operations had become unsatisfactory, or that we were in violation of any law or regulation, they may take a number of different remedial actions as they deem appropriate. These actions include the power to require us to remediate any such adverse examination findings. We are also subject to changes in federal and state laws, as well as regulations and governmental policies, income tax laws and accounting principles. Regulations affecting banks and other financial institutions are undergoing continuous change, and the ultimate effect of such changes cannot be predicted. Regulations and laws may be modified at any time, and new legislation may be enacted that could affect us.

The recent turnover of the Presidential administration will result in certain changes in the leadership and senior staffs of the FDIC, the CFPB, the SEC, the Treasury Department, and other agencies. These changes are expected to impact the rulemaking, supervision, examination and enforcement priorities and policies of the agencies, including the possible reversal of a number of final and proposed rules and policy statements promulgated under the Biden administration. The potential impact of any changes in agency personnel, policies and priorities on the financial services sector, including the Bank, cannot be predicted at this time. We cannot assure you that any changes in regulations or new laws will not adversely affect our performance or consolidated results of operations. Our regulatory framework is discussed in greater detail under “Item 1. Business – Supervision and Regulation.”

We are subject to laws regarding the privacy, information security and protection of personal information, and any violation of these laws or unauthorized disclosure of such information could damage our reputation and otherwise adversely affect our operations and financial condition.

Our business requires the collection and retention of large volumes of customer data, including personally identifiable information in various information systems that we maintain and in those maintained by third parties with whom we contract to provide data services. We also maintain important internal data, such as personally identifiable information about our employees and information relating to our operations. We are subject to complex and evolving laws and regulations governing the privacy and protection of personal information of individuals (including customers, employees, suppliers and other third parties). For example, our business is subject to the Gramm-Leach-Bliley Act, which, among other things: (1) imposes certain limitations on our ability to share nonpublic personal information about our customers with nonaffiliated third parties; (2) requires us to provide certain disclosures to customers about our information collection, sharing and security practices and to afford customers the right to “opt out” of any information sharing by us with nonaffiliated third parties (with certain exceptions); and (3) requires us to develop, implement and maintain a written comprehensive information security program containing appropriate safeguards based on our size and complexity, the nature and scope of our activities, and the sensitivity of customer information we process, as well as plans for responding to data security breaches. Various state and federal banking regulators and state legislatures have also enacted data security breach notification requirements with varying levels of individual, consumer, regulatory or law enforcement notification in the event of a security breach. Ensuring that our collection, use, transfer and storage of personal information complies with all applicable laws and regulations can increase our costs. Furthermore, we may not be able to ensure that all of our clients, suppliers, counterparties and other third parties have appropriate controls in place to protect the confidentiality of the information that they exchange with us, particularly where such information is transmitted by electronic means. If personal, confidential or proprietary information of customers or others were to be mishandled or misused (in situations where, for example, such information was erroneously provided to unauthorized persons, or where such information was intercepted or otherwise compromised by third parties), we could be exposed to litigation or regulatory sanctions under applicable laws and regulations. Concerns about the effectiveness of our measures to safeguard personal information could cause us to lose customers or potential customers for our products and services and thereby reduce our revenues. Accordingly, any failure or perceived failure to comply with applicable privacy or data protection laws and regulations may subject us to inquiries, examinations and investigations that could result in requirements to modify or cease certain operations or practices or in

significant liabilities, fines or penalties, and could damage our reputation and otherwise adversely affect our business, consolidated financial condition, results of operations and cash flows.

Our FDIC deposit insurance premiums and assessments may increase and thereby adversely affect our financial results.

The Bank’s deposits are insured by the FDIC up to legal limits, and, accordingly, the Bank is subject to periodic insurance assessments by the FDIC. The Bank’s regular assessments are determined by its risk classification, which is based on its regulatory capital levels and the level of supervisory concern that it poses. Numerous bank failures during the financial crisis and increases in the statutory deposit insurance limits increased resolution costs to the FDIC and put significant pressure on the Deposit Insurance Fund. The FDIC has authority to increase insurance assessments, and any significant increase in insurance assessments would likely have an adverse effect on us.

We face a risk of noncompliance and enforcement action under the Bank Secrecy Act and other anti-money laundering statutes and regulations.

The Bank Secrecy Act of 1970, the USA PATRIOT Act and other laws and regulations require financial institutions, among other duties, to institute and maintain an effective anti-money laundering program and to file reports such as suspicious activity reports and currency transaction reports. We are required to comply with these and other anti-money laundering requirements. Our federal and state banking regulators, the Financial Crimes Enforcement Network and other government agencies are authorized to impose significant civil money penalties for violations of anti-money laundering requirements. We are also subject to increased scrutiny with respect to our compliance with the regulations issued and enforced by the Office of Foreign Assets Control. If our program is deemed deficient, we could be subject to liability, including fines, civil money penalties and other regulatory actions, which may include restrictions on our business operations and our ability to pay dividends, restrictions on mergers and acquisitions activity, restrictions on expansion, and restrictions on entering new business lines. Failure to maintain and implement adequate programs to combat money laundering and terrorist financing could also have significant reputational consequences for us. Any of these circumstances could have a material adverse effect on our business, consolidated financial condition, results of operations and cash flows.

We are subject to numerous laws designed to protect consumers, including the CRA and fair lending laws, and a failure to comply with these laws could lead to a wide variety of sanctions.

The CRA, the Equal Credit Opportunity Act, the Fair Housing Act, and other fair lending laws and regulations (collectively, “fair lending laws”) impose community investment and nondiscriminatory lending requirements on financial institutions. The CFPB, the Department of Justice and other federal and state agencies are responsible for enforcing these federal laws and regulations and comparable state provisions. Various federal banking agencies have recently completed significant changes to their respective CRA regulations. Federal, state or local consumer lending laws may restrict our ability to originate certain mortgage loans or increase our risk of liability with respect to such loans. A successful regulatory challenge to an institution's performance under the fair lending laws could result in a wide variety of sanctions, including damages and civil money penalties, injunctive relief, restrictions on mergers and acquisitions, restrictions on expansion and restrictions on entering new business lines. Private parties may also have the ability to challenge an institution's performance under fair lending laws in private class action litigation. Such actions could have a material adverse effect on our business, financial condition and results of operations.

Bancshares’ liquidity is subject to various regulatory restrictions applicable to its subsidiaries.

There are various regulatory restrictions on the ability of Bancshares’ subsidiaries to pay dividends or to make other payments to Bancshares. In addition, Bancshares’ right to participate in any distribution of assets of any of its subsidiaries upon a subsidiary’s liquidation or otherwise will be subject to the prior claims of creditors of that subsidiary, except to the extent that any of Bancshares’ claims as a creditor of such subsidiary may be recognized.

The internal controls that we have implemented to mitigate risks inherent to the business of banking might fail or be circumvented.

Management regularly reviews and updates our internal controls and procedures that are designed to manage the various risks in our business, including credit risk, operational risk, financial risk, compliance risk and interest rate risk. No system of controls, however well-designed and operated, can provide absolute assurance that the objectives of the system will be met. If such a system fails or is circumvented, there could be a material adverse effect on our business, consolidated financial condition, results of operations and cash flows.

Changes in tax laws and interpretations and tax challenges may adversely affect our financial results.

The enactment of federal tax reform has had, and is expected to continue to have, far reaching and significant effects on us, our customers and the United States economy. Further, the income tax treatment of corporations may at any time be clarified and/or

modified through legislation, administration or judicial changes or interpretations. These changes or interpretations could adversely affect us, either directly or as a result of the effects on our customers.

In the course of our business, we are sometimes subject to challenges from taxing authorities, including the Internal Revenue Service, individual states and municipalities, regarding amounts due. These challenges may result in adjustments to the timing or amount of taxable income or deductions or allocation of income among tax jurisdictions, all of which may require a greater provisioning for taxes or otherwise negatively affect our financial results.

Climate change and related legislative and regulatory initiatives may result in operational changes and expenditures that could significantly impact the Company’s business.

Political and social attention to the issue of climate change has increased in recent years. Federal and state legislatures and regulatory agencies have continued to propose and advance numerous legislative and regulatory initiatives seeking to mitigate the effects of climate change. The federal banking agencies, including the OCC, have emphasized that climate-related risks are faced by banking organizations of all types and sizes and are in the process of enhancing supervisory expectations regarding banks’ risk management practices. In December 2021, the OCC published proposed principles for climate risk management by banking organizations with more than $100 billion in assets. The OCC also has appointed its first ever Climate Change Risk Officer and established an internal climate risk implementation committee in order to assist with these initiatives and to support the agency’s efforts to enhance its supervision of climate change risk management. Similar and even more expansive initiatives are expected, including potentially increasing supervisory expectations with respect to banks’ risk management practices, accounting for the effects of climate change in stress testing scenarios and systemic risk assessments, revising expectations for credit portfolio concentrations based on climate-related factors and encouraging investment by banks in climate-related initiatives and lending to communities disproportionately impacted by the effects of climate change. In March 2024, the SEC adopted final rules for "The Enhancement and Standardization of Climate-Related Disclosures for Investors,” which would have required issuers to provide climate-related disclosures. In April 2024, the SEC stayed the effectiveness of the final rules pending the outcome of certain legal challenges. To the extent that these initiatives lead to the promulgation of new regulations or supervisory guidance applicable to the Company or the Bank, we would likely experience increased compliance costs and other compliance-related risks. The lack of empirical data surrounding the credit and other financial risks posed by climate change render it impossible to predict how specifically climate change may impact the Company’s financial condition and results of operations.

Risks Related to Strategic Planning

We intend to engage in acquisitions of other banking institutions from time to time. These acquisitions may not produce revenue or earnings enhancements or cost savings at levels, or within time frames, originally anticipated and may result in unforeseen integration difficulties.

We regularly evaluate opportunities to strengthen our current market position through acquisitions, subject to regulatory approval. Such transactions could, individually or in the aggregate, have a material effect on our operating results and financial condition, including short and long-term liquidity. Our acquisition activities could be material to our business. These activities could require us to use a substantial amount of cash or other liquid assets and/or incur debt. In addition, if goodwill recorded in connection with acquisitions were determined to be impaired, then we would be required to recognize a charge against our earnings, which could materially and adversely affect our results of operations during the period in which the impairment was recognized. Our acquisition activities could involve a number of additional risks, including the risks of:

Depending on the condition of any institutions or assets that are acquired, any acquisition may, at least in the near term, materially adversely affect our capital and earnings and, if not successfully integrated following the acquisition, may continue to have such effects.

Generally, any acquisition of target financial institutions, banking centers or other banking assets by us may require approval by, and cooperation from, a number of governmental regulatory agencies, possibly including the Federal Reserve and the FDIC, as well as state banking regulators. Such regulators could deny our application based on their regulatory criteria or other considerations, which could restrict our growth, or the regulatory approvals may not be granted on terms that are acceptable to us. For example, we could be required to sell banking centers as a condition to receiving regulatory approvals, and such a condition may not be acceptable to us or may reduce the benefit of any acquisition.

We cannot assure you that we will be successful in overcoming these risks or any other problems encountered in connection with pending or potential acquisitions. Our inability to overcome these risks could have an adverse effect on levels of reported net income, return on equity and return on assets and the ability to achieve our business strategy and maintain market value.

We may not be able to maintain consistent growth, earnings or profitability.

There can be no assurance that we will be able to continue to grow and to remain profitable in future periods, or, if profitable, that our overall earnings will remain consistent with our prior results of operations or increase in the future. Our growth in recent years has been driven by a number of factors, including strong growth in our indirect lending portfolio and demand in the commercial and real estate loan markets in certain of the communities that we serve. A downturn in economic conditions in our markets, heightened competition from other financial services providers, an inability to retain or grow our core deposit base, regulatory and legislative considerations, and failure to attract and retain high-performing talent, among other factors, could limit our ability to grow our assets or increase our profitability to the same extent as in recent periods. Sustainable growth requires that we manage our risks by following prudent loan underwriting standards, balancing loan and deposit growth without materially increasing interest rate risk or compressing our net interest margin, maintaining adequate capital, hiring and retaining qualified employees and successfully implementing our strategic initiatives. A failure to sustain our recent rate of growth or adequately manage the factors that have contributed to our growth or successfully enter new markets could have a material adverse effect on our earnings and profitability and, therefore on our business, consolidated financial condition, results of operations and cash flows.

General Risks

We cannot guarantee that we will pay dividends in the future.

Dividends from the Bank are Bancshares’ primary source of funds for the payment of dividends to its shareholders, and there are various legal and regulatory limits regarding the extent to which the Bank may pay dividends or otherwise supply funds to Bancshares. The ability of both the Bank and Bancshares to pay dividends will continue to be subject to and limited by the results of operations of the Bank and by certain legal and regulatory restrictions. Further, any lenders making loans to Bancshares or the Bank may impose financial covenants that may be more restrictive than the legal and regulatory requirements with respect to the payment of dividends. There can be no assurance as to whether or when Bancshares may pay dividends to its shareholders.

Extreme weather could cause a disruption in our operations, which could have an adverse impact on our profitability.

Some of our operations are located in areas near the Gulf of America, a region that is susceptible to hurricanes and other forms of extreme weather. Such weather events could disrupt our operations and have a material adverse effect on our overall results of operations. Further, a hurricane, tornado or other extreme weather event in any of our market areas could adversely impact the ability of borrowers to timely repay their loans and may adversely impact the value of collateral that we hold.

Securities issued by us, including our common stock, are not insured.

Securities issued by us, including our common stock, are not savings or deposit accounts or other obligations of any bank and are not insured by the Deposit Insurance Fund maintained by the FDIC or by any other governmental agency or instrumentality, or any private insurer, and are subject to investment risk, including the possible loss of principal.

Future issuances of additional securities by us could result in dilution of your ownership.

We may decide from time to time to issue additional securities in order to raise capital, support growth or fund acquisitions. Further, we may issue stock options or other stock grants to retain and motivate employees. Such issuances of securities by us would dilute the respective ownership interests of our shareholders.

Our common stock price could be volatile, which could result in losses for individual shareholders.

The market price of our common stock may be subject to significant fluctuations in response to a variety of factors, including, but not limited to:

Due to these factors, you may not be able to sell your stock at or above the price you paid for it, which could result in substantial losses.

Our performance and results of operations depend in part on the soundness of other financial institutions.

Our ability to engage in routine investment and banking transactions, as well as the quality and value of our investments in equity securities and obligations of other financial institutions, could be adversely affected by the actions, financial condition and profitability of such other financial institutions with which we transact, including, without limitation, the FHLBA and our correspondent banks. Financial services institutions are interrelated as a result of shared credits, trading, clearing, counterparty and other relationships. As a result, defaults by, or even rumors or questions about, one or more financial institutions, or the financial services industry generally, could lead to market-wide liquidity problems and losses of depositor, creditor or counterparty confidence in certain institutions, and could lead to losses or defaults by other institutions. Any defaults by, or failures of, the institutions with whom we transact could adversely affect our debt and equity holdings in such other institutions, our participation interests in loans originated by other institutions, and our business, including our liquidity, consolidated financial condition and earnings.

We depend on the services of our management team and board of directors, and the unexpected loss of key officers or directors may adversely affect our operations.

A departure of any of our executive officers, other key personnel or directors could adversely affect our operations. The community involvement of our executive officers and directors and our directors’ diverse and extensive business relationships are

important to our success. A material change in the composition of our management team or board of directors could cause our business to suffer.

Item 1B. Unresolved Staff Comments.

None.

Item 1C. Cybersecurity.

Item 2. Properties.

With the exception of its offices located in Knoxville and Powell, Tennessee, and Mobile, Alabama, which are leased, the Bank owns all of its offices, including its executive offices, without encumbrances. Bancshares does not separately own any property, and to the extent that its activities require the use of physical office facilities, such activities are conducted at the offices of the Bank. We believe that our properties are sufficient for our operations at the current time.

Item 3. Legal Proceedings.

We are party to certain ordinary course litigation, and we intend to vigorously defend ourselves in all such litigation. In the opinion of management, based on a review and consultation with our legal counsel, the outcome of such ordinary course litigation should not have a material adverse effect on our consolidated financial statements or results of operation.

Item 4. Mine Safety Disclosures.

Not applicable.

PART II

Item 5. Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities.

Bancshares’ common stock is listed on the Nasdaq Capital Market under the symbol “FUSB.” Prior to our name change on October 11, 2016, our common stock was listed on the Nasdaq Capital Market under the symbol “USBI.” As of March 3, 2025, there were approximately 616 record holders of Bancshares’ common stock (excluding any participants in any clearing agency and “street name” holders).

Bancshares declared total dividends of $0.22 per common share and $0.20 per common share during the years ended December 31, 2024 and 2023, respectively. Bancshares expects to continue to pay comparable cash dividends in the future, subject to the results of operations of Bancshares and the Bank, legal and regulatory requirements and potential limitations imposed by financial covenants with third parties. See Note 14, "Shareholders' Equity," in the consolidated financial statements for additional information on dividend restrictions.

Share Repurchases

The following table sets forth purchases made by or on behalf of Bancshares or any “affiliated purchaser,” as defined in Rule 10b-18(a)(3) of the Exchange Act, of shares of Bancshares’ common stock during the fourth quarter of 2024.

Securities Authorized for Issuance under Equity Compensation Plans

Information regarding securities authorized for issuance under our equity compensation plans is incorporated by reference to Item 12 of this Annual Report on Form 10-K.

Item 6. Reserved

Item 7. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

Forward-Looking Statements

You should read the following discussion of our financial condition and results of operations in conjunction with the “Selected Financial Data” and our financial statements and the related notes included elsewhere in this Annual Report on Form 10-K for the year

ended December 31, 2024. This discussion and analysis contains forward-looking statements that involve risks, uncertainties and assumptions, and our actual results may differ materially from those anticipated in these forward-looking statements as a result of many factors, including but not limited to those discussed under Item 1A “Risk Factors” and elsewhere in this Annual Report.

Selected Financial Data

The selected consolidated financial and other data of the Company set forth below does not purport to be complete and should be read in conjunction with, and is qualified in its entirety by, the more detailed information, including the consolidated financial statements and related notes, appearing elsewhere herein.