Old Point Financial (OPOF) Risk Factors

From time to time, the Company or any of its subsidiaries, directors and management are, or may become, the subject of various claims and legal actions by customers, employees, stockholders, and others. The Company's insurance may not cover all claims that may be asserted against it in legal or administrative actions or costs that it may incur defending such actions, and any claims asserted against the Company, regardless of merit or eventual outcome may adversely affect the Company's reputation. Any judgments or settlements in any pending litigation or future claims, litigation or investigation could have a material adverse effect on our business, reputation, financial condition, and results of operations.

As a regulated financial institution and a publicly traded company, the Company is facing increasing scrutiny from customers, regulators, investors, and other stakeholders related to ESG practices and disclosure. Investor advocacy groups, investment funds, influential investors, and regulators are increasingly focused on these practices, especially as they relate to climate risk, hiring practices, the diversity of the work force, and racial and social justice issues. Views about ESG are diverse, dynamic, and rapidly changing. Failure to adapt to or comply with regulatory requirements or investor or stakeholder expectations and standards could negatively impact the Company's reputation, ability to attract and retain certain customers and employees, and stock price. New government regulations could also result in new or more stringent forms of ESG oversight and expanded mandatory and voluntary reporting, diligence, and disclosure. ESG related costs, including with respect to compliance with any additional regulatory or disclosure requirements or expectations, could adversely impact our results of operations. Failure to comply with the USA Patriot Act, OFAC, the Bank Secrecy Act and related FinCEN guidelines and related regulations could have a material impact on the Company. Bank regulatory agencies routinely examine financial institutions for compliance with the USA Patriot Act, OFAC, the Bank Secrecy Act and related FinCEN guidelines and related regulations. Failure to maintain and implement adequate programs as required by these obligations to combat terrorist financing, elder abuse, human trafficking, anti-money laundering and other suspicious activity and to fully comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the Company. For example, such a failure could cause a bank regulatory agency not to approve a merger or acquisition transaction or to prohibit such a transaction even if formal approval is not required to restrict the Company's ability to pay dividends or to require the Company to obtain regulatory approvals to proceed with certain aspects of its business. In addition, such a failure could result in a regulatory authority imposing a formal enforcement action or civil money penalty for regulatory violations. Current and to-be-effective laws and regulations addressing consumer privacy and data use and security could increase our costs and failure to comply with such laws and regulations could impact our business, financial condition, and reputation. The Company is subject to a number of laws concerning consumer privacy and data use and security, including information safeguard rules under the Gramm-Leach-Bliley Act. These rules require that financial institutions develop, implement, and maintain a written, comprehensive information security program containing safeguards that are appropriate to the financial institution's size and complexity, the nature and scope of the financial institution's activities and the sensitivity of any customer information at issue. The United States has experienced a heightened legislative and regulatory focus on privacy and data security, including requiring consumer notification in the event of a data breach. In addition, most states have enacted security breach legislation requiring varying levels of consumer notification in the event of certain types of security breaches, and certain states, including Virginia, have enacted significant new consumer data privacy protections that can significantly limit a company's use of customer financial data and impose significant compliance burdens on companies that collect or use that data. Additional new regulations in these areas may increase compliance costs, which could negatively impact the Company's earnings. In addition, failure to comply with these privacy and data use and security laws and regulations, including by reason of inadvertent disclosure of confidential information, could result in fines, sanctions, penalties, or other adverse consequences and loss of consumer confidence, which could materially adversely affect the Company's business, results of operations, and reputation.

At December 31, 2023, the Company had $578.1 million, or 53.5%, of total loans concentrated in commercial real estate, which includes, for purposes of this concentration, all construction loans, loans secured by multifamily residential properties, loans secured by farmland and loans secured by nonfarm, nonresidential properties. Commercial real estate loans are generally viewed as exposing the Company to a greater risk of loss than residential real estate and consumer loans. Commercial real estate loans typically involve larger loan balances to single borrowers or groups of related borrowers compared to residential real estate and consumer loans. Consequently, an adverse development with respect to one or a few commercial real estate loan or credit relationships could expose the Company to a significantly greater risk of loss compared to an adverse development with respect to one or a few residential real estate loans. Commercial real estate loans carry risks associated with the successful operation of a business if the properties are owner occupied. If the properties are non-owner occupied, the repayment of these loans may be dependent upon the profitability and cash flow from rent receipts. Repayment of commercial real estate loans may, to a greater extent than residential real estate loans, be subject to adverse conditions in the real estate market or economy. Weak economic or market conditions may impair a borrower's business operations, slow the execution of new leases and lead to turnover in existing leases. The combination of these factors could result in deterioration in value of some of the Company's loans. The deterioration of one or more of the Company's significant commercial real estate loans could cause a significant increase in nonaccrual loans. An increase in nonaccrual loans could result in a loss of interest income from those loans, an increase in the provision for loan losses, and an increase in loan charge-offs, all of which could have a material adverse effect on the Company's financial performance. The federal bank regulatory agencies have recently expressed concerns about weaknesses in the current commercial real estate market. Banking regulators generally give commercial real estate lending greater scrutiny and may require banks with higher levels of commercial real estate loans to implement enhanced risk management practices, including stricter underwriting, internal controls, risk management policies, more granular reporting, and portfolio stress testing, as well as possibly higher levels of allowances for losses and capital levels as a result of commercial real estate lending growth and exposures. If the Company's banking regulators determine that the Company's commercial real estate lending activities are particularly risky and are subject to such heightened scrutiny, the Company may incur significant additional costs or be required to restrict certain of our commercial real estate lending activities. Additionally, failures in the Company's risk management policies, procedures and controls could adversely affect its ability to manage this portfolio going forward and could result in an increased rate of delinquencies in, and increased losses from, this portfolio, which could have a material adverse effect on the Company's business, financial condition, and results of operations.

Reputation risk, or the risk to the Company's business, financial condition, and results of operation from negative public opinion, is inherent in the financial services industry. Negative public opinion can result from actual or alleged conduct in any number of activities, including lending or foreclosure practices, regulatory compliance, corporate governance and sharing or inadequately protecting customer information, and from actions taken by government regulators and community organizations in response to those activities. Negative public opinion once was driven primarily by adverse news coverage in traditional media, but the widespread use of social media platforms facilitates the rapid dissemination of information or misinformation, which may increase the risk of negative public opinion and potential harm to the Company's reputation. Negative public opinion could adversely affect the Company's ability to keep and attract customers and employees, could impair the confidence of counterparties and business parties, could expose it to litigation and regulatory action, and could adversely affect its access to the capital markets. Damage to the Company's reputation could adversely affect deposits and loans and otherwise negatively affect the Company's business, financial condition, and results of operation.

Communications and information systems are essential to the conduct of the Company's businesses, as such systems are used to manage customer relationships, general ledger, deposits, and loans, as well as for other functions. While the Company has established policies and procedures to prevent or limit the impact of systems failures, interruptions and security breaches, the Company's information, security, and other systems may stop operating properly or become disabled or damaged as a result of a number of factors, including events beyond the Company's control, such as sudden increases in customer transaction volume, electrical or telecommunications outages, natural disasters, and cyber-attacks. Information security risks have increased in recent years and hackers, activists and other external parties have become more technically sophisticated and well-resourced. These parties use a variety of methods to attempt to breach security systems and access the data of financial services institutions and their customers. The Company may not have the resources or technical sophistication to anticipate or prevent rapidly evolving types of cyber-attacks. In addition, any compromise of the security systems could deter customers from using the Bank's website and online banking service, both of which involve the transmission of confidential information. The security and authentication precautions imposed by the Company and the Bank may not protect the systems from compromises or breaches of security, which would adversely affect the Company's results of operations and financial condition. In addition, the Company relies on third parties to provide key components of its business operations, such as data processing, recording, and monitoring transactions, online banking interfaces and services, internet connections and network access outsources certain data processing to certain third-party providers. Accordingly, the Company's operations are exposed to risk that these third-party providers will not perform in accordance with the contracted arrangements under service agreements. If the third-party providers encounter difficulties, or if the Company has difficulty in communicating with them, the Company's ability to deliver products and services to its customers and otherwise conduct its business could be adversely affected, and the Company's reputation may be harmed. Further, each of these third-party providers faces the risk of a cyber-attack, information breach or loss, or technology failure, and there is no assurance that they have not or will not experience a system or network breach, a breach of a third-party provider's technology may cause loss to the Company's customers. Any failure by a third-party provider to maintain performance, reliability and security of these systems could have a significant adverse effect on the Company's financial condition or results of operations. Replacing these third-party providers could also create significant delay and expense, and the Company cannot provide any assurance that it could negotiate terms with alternative service sources that are as favorable or could obtain similar services as found in the Company's existing systems without expending substantial resources. Consequently, use of such third parties creates an unavoidable inherent risk to the Company's business operations. Threats to information security also exist in the processing of customer information through various other vendors and their personnel. The occurrence of any systems failure, interruption or breach of security, or the failure of a third-party provider to perform its obligations, could expose the Company to risks of data loss or data misuse, could result in violations of applicable privacy and other laws, could damage the Company's reputation and result in a loss of customers and business, or could subject it to additional regulatory scrutiny, civil litigation, or possible financial liability and costly response measures. Any of these occurrences could have a material adverse effect on the Company's financial condition and results of operations. The Company and its subsidiaries, including the Bank, and its and their employees and customers may in the future be the target of criminal cyberattacks; and we could be exposed to liability and remedial costs, and our reputation and business could suffer. The Company's business relies on the secure processing, transmission, storage, and retrieval of confidential, proprietary, and other information in our computer and data management systems and networks, and in the computer and data management systems and networks of third parties. In addition, to access our network, products and services, the Company's customers and third parties may use personal mobile devices or computing devices that are outside of our network environment and are subject to their own cybersecurity risks. The Company, its customers, regulators and other third parties, including other financial services institutions and companies engaged in data processing, have been subject to, and are likely to continue to be the target of criminal cyber-attacks, phishing schemes and similar fraudulent activity and cyber incidents. One such event occurred during September 2022, when in a cybersecurity incident an email account of the Company was accessed by an authorized user, which may have compromised certain information about the Company and its customers. The Company expects these threats to continue. As the numerous and evolving cybersecurity threats, including advanced and persistent cyber-attacks and schemes, utilized by cybercriminals in attempts to obtain unauthorized access to our systems or our customers' accounts have become increasingly more complex and sophisticated and may be difficult to detect for periods of time, we– like many other major financial institutions – may not be able to anticipate, safeguard against, or respond to, these acts adequately.  As these threats continue to evolve and increase, we – like many other major financial institutions – may be required to devote significant additional resources in order to modify and enhance our security controls and to identify and remediate any security vulnerabilities. The Company and the Bank also face indirect technology, cybersecurity and operational risks relating to the customers, clients and other third parties with whom the Company and the Bank do business or upon whom the Company and the Bank rely to facilitate or enable business activities, including, for example, financial counterparties, regulators, providers of critical infrastructure such as internet access, and software providers. As a result of increasing consolidation, interdependence and complexity of financial entities and technology systems, a technology failure, cyber-attack or other information or security breach that significantly degrades, deletes, or compromises the systems or data of one or more financial entities could have a material impact on counterparties or other market participants, including the Company and the Bank. This consolidation, interconnectivity and complexity increases the risk of operational failure, on both individual and industry-wide bases, as disparate systems need to be integrated, often on an accelerated basis. Any third-party technology failure, cyber-attack or other information or security breach, termination or constraint could, among other things, adversely affect the Company and the Bank's ability to effect transactions, service their clients, manage their exposure to risk or expand their business. Though it is difficult to determine what, if any, harm may directly result from any specific cyber incident or cyber-attack, any failure to maintain the security of, or any actual or perceived loss or unauthorized disclosure or use of, customer or account information may result in a material loss or have material consequences. The public perception that a cyber-attack on the Bank's systems have been successful, whether or not this perception is correct, may damage the Bank's reputation with customers and third parties with whom the Bank does business. Actual or perceived loss or unauthorized disclosure or use of personal information and identify theft risks, in particular could cause serious reputational harm. Damage to our reputation could adversely affect deposits and loans and otherwise negatively affect the Company's business, financial condition, and results of operations. In addition, it is possible that a cyber incident and any material fraudulent activity, cyber-attacks, breaches of our information security or successful penetration or circumvention of our system security may cause us significant negative consequences, including loss of Bank customers and financial assets and business opportunities, disruption to our operations and business, or misappropriation of our and/or our customers' confidential information, and may expose us to additional regulatory scrutiny or may result in a violation of applicable privacy laws and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our security measures, reputational damage, reimbursement or other compensatory costs, devotion of substantial management time, costs associated with customer notification and credit monitoring services, increased costs to maintain insurance coverage (including increased deposit insurance premiums), or additional compliance costs, all of which could adversely impact our business, financial condition, liquidity and results of operations.

The banking business in Virginia, and in the Company's primary service area in the Hampton Roads MSA, is highly competitive and dominated by a relatively small number of large banks. Competition for qualified employees and personnel in the banking industry is intense and there are a limited number of qualified persons with knowledge of and experience in the Virginia community banking industry, which could increase labor costs. In addition, the Company's ability to attract and retain employees could be impacted by changing workforce concerns, expectations, practices, and preferences, including remote and hybrid work preferences, labor shortages and competition for labor, which could increase labor costs. The Company's success depends to a significant degree upon its ability to attract and retain qualified management, loan origination, administrative, marketing, and technical personnel and upon the continued contributions of and customer relationships developed by management and other key personnel. In particular, the Company believes that its success is highly dependent upon the capabilities of its senior executive management. The Company believes that its management team, comprised of individuals who have worked in the banking industry for many years, is integral to implementing the Company's business plan. The loss of any of the Company's senior executive management could disrupt the Company's operations and have a material adverse effect on the Company's ability to build on the efforts they have undertaken, and the Company may not be able to find adequate replacements. Most recently, the Company hired a new Chief Financial Officer in October 2023. Management transitions may create uncertainty and involve a diversion of resources and management attention, be disruptive to the Company's daily operations or impact public or market perception, any of which could negatively impact our ability to operate effectively or execute our strategies and result in a material adverse impact on the Company's business, financial condition, results of operations or cash flows. The Company has entered into employment agreements with certain members of executive management, and the loss of the services of one or more of them could harm the Company's business.