CNB Financial Corporation

ITEM 1A. RISK FACTORS

The Corporations financial condition and results of operations are subject to various risks inherent in its business. The material risks and uncertainties that management believes affect the Corporation are described below. If any of these risks actually occur, the Corporations business, financial condition, liquidity, results of operations and prospects could be materially and adversely affected. The following risks together with all of the other information in this Annual Report on Form 10-K should be considered.

11

Economic Risks

Economic conditions could adversely affect our business and financial results.

The Corporations financial condition and results of operations are impacted by global markets and economic conditions over which the Corporation has no control. Inflation has significantly increasedPeriods of high inflation since the start of 2021 anhave led to increased continues to remain at elevated levels compared to recsts for businesses and consumers. In addition, international trade disputes, including threatened or implement years prior to 2021, which has leed tariffs imposed by the U.S. and threatened or implemented to increasedariffs imposed by foreign countries in retaliation, costs for businuld result in further inflationary pressures andthat impact consumersts. An economic downturn or recession, including deterioration in the economic conditions in the U.S., or a slowing or stalled recovery therefrom, may have a material adverse effect on our business, financial condition or results of operations. Poor economic conditions have in the past adversely affected, and may in the future affect, the demand for the Corporations products, the creditworthiness of the Corporations borrowers and the value of the Corporations investment securities and other interest-earning assets. In particular, the Corporation may face the following risks in connection with the economic or market environment:

The Corporations and the Banks ability to borrow from other financial institutions or to access the debt or equity capital markets on favorable terms or at all could be adversely affected by disruptions in the capital markets or other events, including actions by rating agencies and deteriorating investor expectations.

The Corporation faces increased regulation of the banking and financial services industry. Compliance with such regulation may increase its costs and limit its ability to pursue business opportunities.

Market developments may affect customer confidence levels and may cause increases in loan delinquencies and default rates, which management expects would adversely impact the Banks charge-offs and provision for credit losses.

Market developments may adversely affect the Banks securities portfolio by causing other-than-temporary-impairments, prompting write-downs and securities losses.

Competition in the banking and financial services industry could intensify as a result of the consolidation of financial services companies in connection with current market conditions.

12

The Corporation may not be able to meet its cash flow needs on a timely basis at a reasonable cost, and the Corporations cost of funds for banking operations may significantly increase as a result of general economic conditions, interest rates and competitive pressures.

Liquidity is the ability to meet cash flow obligations as they come due and cash flow needs on a timely basis and at a reasonable cost. The liquidity of the Bank is used to make loans and to repay deposit and borrowing liabilities as they become due, or are demanded by customers and creditors. Many factors affect the Banks ability to meet liquidity needs, including variations in the markets served by its network of offices, its mix of assets and liabilities, reputation and standing in the marketplace, and general economic conditions.

The Banks primary source of funding is customer deposits, gathered throughout its network of banking offices. Periodically, the Corporation utilizes term borrowings from the Federal Home Loan Bank (the "FHLB") of Pittsburgh, of which the Bank is a member, and other lenders to meet funding obligations. In addition, the Bank also maintains borrowing capacity with the Federal Reserve Bank of Philadelphia. The Banks securities and loan portfolios provide a source of contingent liquidity that could be accessed in a reasonable time period through sales.

Significant changes in general economic conditions, market interest rates, competitive pressures or otherwise, could cause the Banks deposits to decrease relative to overall banking operations, and it would have to rely more heavily on brokered funds and borrowings in the future, which are typically more expensive than deposits.

The Corporation's management and Board of Directors, through the Asset-/Liability Committee (the "ALCO"), monitor liquidity and the ALCO establishes and monitors acceptable liquidity ranges. The Bank actively manages its liquidity position through target ratios. Continual monitoring of these ratios, both historical and through forecasts under multiple rate scenarios, allows the Bank to employ strategies necessary to maintain adequate liquidity.

Changes in economic conditions, including consumer savings habits and availability of or access to capital, could potentially have a significant impact on the Banks liquidity position, which in turn could materially impact the Corporations financial condition, results of operations and cash flows.

12

Credit and Interest Rate Risks

The Banks allowance for credit losses may not be adequate to cover loan losses which could have a material adverse effect on the Corporations business, financial condition and results of operations.

A significant source of risk for the Corporation arises from the possibility that losses will be sustained because borrowers, guarantors and related parties may fail to perform in accordance with the terms of their loan agreements. Most loans originated by the Bank are secured, but some loans are unsecured based upon managements evaluation of the creditworthiness of the borrowers. With respect to secured loans, the collateral securing the repayment of these loans principally includes a wide variety of real estate, and to a lesser extent commercial and personal property, either of which may be insufficient to cover the obligations owed under such loans.

Collateral values and the financial performance of borrowers may be adversely affected by changes in prevailing economic, environmental and other conditions, including declines in the value of real estate, changes in interest rates and debt service levels, changes in oil and gas prices, changes in monetary and fiscal policies of the federal government, widespread disease, terrorist activity, environmental contamination and other external events, which are beyond the control of the Bank. In addition, collateral appraisals that are out of date or that do not meet industry recognized standards might create the impression that a loan is adequately collateralized when in fact it is not. Although the Bank may acquire any real estate or other assets that secure defaulted loans through foreclosures or other similar remedies, the amounts owed under the defaulted loans may exceed the value of the assets acquired.

13

The allowance for credit losses is subject to a formal analysis by the Credit Administration and Finance Departments of the Corporation. Following the issuance by the Financial Accounting Standards Board ("FASB") of Accounting Standards Update ("ASU") 2016-13, "Measurement of Credit Losses on Financial Instruments," the Corporation adjusted its loan allowance methodology to reflect the new standard, which requires periodic estimates of lifetime expected credit losses on financial assets and categorizes expected credit losses as allowances for credit losses under the current expected credit loss ("CECL") methodology. The Corporation measures expected credit losses of financial assets on a collective (pool) basis, when the financial assets share similar risk characteristics. Depending on the nature of the pool of financial assets with similar risk characteristics, the models utilized by the Corporation to estimate expected credit losses include a discounted cash flow ("DCF") model that discounts instrument-level contractual cash flows, adjusted for prepayments and curtailments, incorporating loss expectations, and a weighted average remaining maturity model which contemplates expected losses at a pool-level, utilizing historic loss information. The Corporation's models for estimating the allowance for credit losses consider available relevant information about the collectability of cash flows, including information about past events, current conditions, and reasonable and supportable forecasts.

The Bank monitors delinquencies and losses on a monthly basis. The Bank has adopted underwriting and credit monitoring policies and procedures, including the review of borrower financial statements and collateral appraisals, which management believes are appropriate to mitigate the risk of loss by assessing the likelihood of borrower nonperformance and the value of available collateral. The Bank also manages credit risk by diversifying its loan portfolio. An ongoing independent review, subsequent to managements review, of individual credits is performed by an independent loan review function, which reports to the Loan Committee of the Corporations Board of Directors.

The determination of the appropriate level of the allowance for credit losses inherently involves a high degree of subjectivity and requires the Corporation to make significant estimates of current credit risks and future trends, all of which may undergo material changes. Although management believes that the processes in place for assessing the appropriate level of the allowance for credit losses are robust, such policies and procedures have limitations, including judgment errors in managements risk analysis, and may not prevent unexpected losses in the future. Moreover, the CECL methodology may create more volatility in the level of our allowance for credit losses from quarter to quarter as changes in the level of allowance for credit losses will be dependent upon, among other things, macroeconomic forecasts and conditions, loan portfolio volumes and credit quality. These factors could have a material adverse effect on the Corporations business, financial condition and results of operations.

Interest rate volatility could significantly reduce the Corporations profitability.

The Corporations earnings largely depend on the relationship between the yield on its earning assets, primarily loans and investment securities, and the cost of funds, primarily deposits and borrowings. This relationship, commonly known as the net interest margin, is susceptible to significant fluctuation and is affected by economic and competitive factors that influence the yields and rates, and the volume and mix of the Banks interest earning assets and interest bearing liabilities.

13

Interest rate risk can be defined as the sensitivity of net interest income and of the market value of financial instruments to the direction and frequency of changes in interest rates. Interest rate risk arises from the imbalance in the re-pricing, maturity, and/or cash flow characteristics of assets and liabilities. The Corporation is subject to interest rate risk to the degree that its interest bearing liabilities re-price or mature more slowly or more rapidly or on a different basis than its interest earning assets. Changes in interest rates, including those due to federal monetary policy, will affect the levels of income and expense recorded on a large portion of the Banks assets and liabilities, and fluctuations in interest rates will impact the market value of all interest sensitive assets. Significant fluctuations in interest rates could have a material adverse impact on the Corporations business, financial condition, results of operations, or liquidity.

In teresponse to high inflation, the Federal Reserve significantly increased the benchmark federal funds rate since t rates remain elevated compared to recent yearly 2022. These actions have significantls and may increased interest rates. As interest rates rise, we experience competitive pressures to increase the rates we pay on deposits, which may decrease our net interest income. Furthermore, these increases inelevated interest rates increase our cost of new debt or preferred capital.

The Banks interest rate risk measurement and management techniques incorporate the re-pricing and cash flow attributes of its balance sheet and off-balance sheet instruments as they relate to current and potential changes in interest rates. The level of interest rate risk, measured in terms of the potential future effect on earnings, is determined through the use of static gap analysis and earnings simulation modeling under multiple interest rate scenarios. Managements objectives are to measure, monitor, and develop strategies in response to the interest rate risk profile inherent in the Banks balance sheet in order to preserve the sensitivity of net interest income to actual or potential changes in interest rates. For further information on risk relating to interest rates, refer to Part I, Item 7a, "Quantitative and Qualitative Disclosures about Market Risk," herein.

14

The Corporations investment securities portfolio is subject to credit risk, market risk, and liquidity risk, and declines in value in its investment securities portfolio may require it to record impairment charges that could have a material adverse effect on its results of operations and financial condition.

The Corporations investment securities portfolio has risks beyond its control that can significantly influence the portfolios fair value. These factors include, but are not limited to, changes in interest rates, changes in prepayment speeds, changes in general economic conditions, rating agency downgrades of the securities, defaults of the issuers of the securities and market liquidity. Any change in current accounting principles or interpretations of these principles could impact the Corporations assessment of fair value and thus its determination of other-than-temporary impairment of the securities in its investment securities portfolio.

The Bank may be required to record other-than-temporary impairment charges on its investment securities if they suffer declines in value that are considered other-than-temporary. Numerous factors, including collateral deterioration underlying certain private label mortgage-backed securities, lack of liquidity for re-sales of certain investment securities, absence of reliable pricing information for certain investment securities, adverse changes in business climate, adverse actions by regulators, or unanticipated changes in the competitive environment could negatively affect the Banks securities portfolio in future periods. An other-than-temporary impairment charge could have a material adverse effect on the Corporations results of operations and financial condition.

A substantial decline in the value of the Banks FHLB common stock may adversely affect the Corporations results of operations, liquidity and financial condition.

As a requirement of membership in the FHLB of Pittsburgh, the Bank must own a minimum required amount of FHLB stock, calculated periodically based primarily on its level of borrowings from the FHLB. Borrowings from the FHLB represent the Banks primary source of short-term and long-term wholesale funding.

In an extreme situation, it is possible that the capitalization of an FHLB, including the FHLB of Pittsburgh, could be substantially diminished or reduced to zero. Consequently, given that there is no trading market for the Banks FHLB common stock, the Corporations management believes that there is a risk that the Corporations investment could be deemed impaired at some time in the future. If this occurs, it may adversely affect the Corporations results of operations and financial condition.

If the capitalization of the FHLB of Pittsburgh is substantially diminished, the Banks liquidity may be adversely impacted if it is not able to obtain alternative sources of funding.

There are 11 FHLB banks, including the FHLB of Pittsburgh, in the FHLB system. The 11 FHLB banks are jointly liable for the consolidated obligations of the FHLB system. To the extent that one FHLB bank cannot meet its obligations to pay its share of the systems debt, other FHLB banks can be called upon to make the payment. The Corporation cannot assure you, however, that the FHLB system will be able to meet these obligations.

14

The Bank could be held responsible for environmental liabilities relating to properties acquired through foreclosure, resulting in significant financial loss.

In the event the Bank forecloses on a defaulted commercial or residential mortgage loan to recover its investment, it may be subject to environmental liabilities in connection with the underlying real property, which could significantly exceed the value of the real property. Although the Bank exercises due diligence to discover potential environmental liabilities prior to acquiring any property through foreclosure, hazardous substances or wastes, contaminants, pollutants, or their sources may be discovered on properties during its ownership or after a sale to a third party. The Corporation cannot assure you that the Bank would not incur full recourse liability for the entire cost of any removal and cleanup on an acquired property, that the cost of removal and cleanup would not exceed the value of the property, or that the Bank could recover any of the costs from any third party. Losses arising from environmental liabilities could have a material adverse impact on the Corporations business, financial condition, results of operations, or liquidity.

15

Replacement of theLIBORbenchmark interest rate could adversely affect our business, financial condition, and results of operations.

In March 2021, the United Kingdoms Financing Conduct Authority and the Intercontinental Exchange Benchmark Administration, the administrator for the London Interbank Offered Rate (LIBOR), concurrently announced that certain settings of LIBOR would no longer be published on a representative basis after December 31, 2021, and the most commonly used U.S. dollar LIBOR settings would no longer be published on a representative basis after June 30, 2023. The Federal Reserve Board and the Federal Reserve Bank of New York organized the Alternative Reference Rates Committee, which identified the Secured Overnight Financing Rate ("SOFR") as its preferred alternative to LIBOR in derivatives and other financial contracts.

We have a number of loans, derivative contracts, borrowings, and oisks Related to an Investment in ther financial instruments with attributes that are either directly or indirectly dependent onLIBOR. With the transition from LIBOR to SOFR as the preferred alternative to LIBOR, we have transitioned and amended our contracts and financial instruments to reference the SOFR rate where required. Since proposed alternative rates (including SOFR) are calculated differently, payments under contracts referencing new rates will differ from those referencingLIBOR. The future performance of SOFR, including how changes in SOFR rates may differ from other rates during different economic conditions, cannot be predicted based on the limited historical performance. Further, we cannot predict how SOFR will perform in comparison to LIBOR in changing market conditions, what the effect of such rates implementation may be on the markets for floating-rate financial instruments or whether such rates will be vulnerable to manipulation. The transition will change our market risk profiles, requiring changes to risk and pricing models, valuation tools, product design, and hedging strategies. Furthermore, failure to adequately manage this transition process with our customers could adversely impact our reputation and could have a material adverse effect on our business, financial condition and results of operations.

Risks Related to an Investment in the  Corporations Securities

Some provisions contained in the Corporations articles of incorporation and its bylaws and under Pennsylvania law could deter a takeover attempt or delay changes in control or management of the Corporation.

Certain anti-takeover provisions of the Pennsylvania Business Corporation Law of 1988, as amended, apply to Pennsylvania registered corporations (e.g., publicly traded companies) including, but not limited to, those relating to (1)control share acquisitions, (2)disgorgement of profits by certain controlling persons, (3)business combination transactions with interested shareholders, and (4)the rights of shareholders to demand fair value for their stock following a control transaction. Pennsylvania law permits corporations to opt-out of these anti-takeover provisions, but the Corporation has not done so. Such provisions could have the effect of deterring takeovers or delaying changes in control or management of the Corporation. Additionally, such provisions could limit the price that some investors might be willing to pay in the future for shares of the Corporations common stock.

For example, the Corporations amended and restated articles of incorporation require the affirmative vote of 66% of the outstanding shares entitled to vote to effect a business combination. In addition, the Corporations amended and restated articles of incorporation, subject to the limitations prescribed in such articles and subject to limitations prescribed by Pennsylvania law, authorize the Corporations Board of Directors, from time to time by resolution and without further shareholder action, to provide for the issuance of shares of preferred stock, in one or more series, and to fix the designation, powers, preferences and other rights of the shares and to fix the qualifications, limitations and restrictions thereof. As a result of its broad discretion with respect to the creation and issuance of preferred stock without shareholder approval, the Corporation's Board of Directors could adversely affect the voting power and other rights of the holders of common stock and, by issuing shares of preferred stock with certain voting, conversion and/or redemption rights, could discourage any attempt to obtain control of the Corporation.

The Corporations bylaws, as amended and restated, provide for the division of the Corporations Board of Directors into three classes of directors, with each serving staggered terms. In addition, any amendment to the Corporations bylaws must be approved by the affirmative vote of a majority of the votes cast by all shareholders entitled to vote thereon and, if any shareholders are entitled to vote thereon as a class, upon receiving the affirmative vote of a majority of the votes cast by the shareholders entitled to vote as a class.

Any of the foregoing provisions may have the effect of deterring takeovers or delaying changes in control or management of the Corporation.

16

The price of the Corporations common stock may fluctuate significantly, and this may make it difficult for you to resell shares of common stock owned by you at times or at prices you find attractive.

The price of the Corporations common stock on the Global Select Market of The NASDAQ Stock Market LLC ("NASDAQ") constantly changes. The Corporation expects that the market price of its common stock will continue to fluctuate, and the Corporation cannot give you any assurances regarding any trends in the market prices for its common stock.

15

The Corporations stock price may fluctuate as a result of a variety of factors, many of which are beyond its control. These factors include the Corporations:

past and future dividend practice;

financial condition, performance, creditworthiness, and prospects;

quarterly variations in the Corporations operating results or the quality of the Corporations assets;

operating results that vary from the expectations of management, securities analysts, and investors;

changes in expectations as to the Corporations future financial performance;

announcements of innovations, new products, strategic developments, significant contracts, acquisitions, and other material events by the Corporation or its competitors;

the operating and securities price performance of other companies that investors believe are comparable to the Corporation;

future sales of the Corporations equity or equity-related securities;

the credit, mortgage and housing markets, the markets for securities relating to mortgages or housing, and developments with respect to financial institutions generally; and

instability in global financial markets and global economies and general market conditions, such as interest or foreign exchange rates, stock, commodity or real estate valuations or volatility, budget deficits or sovereign debt level concerns and other geopolitical, regulatory or judicial events.

The Corporations ability to pay dividends is limited by law and regulations.

The future declaration of dividends by the Corporations Board of Directors will depend on a number of factors, including capital requirements, regulatory limitations, the Corporations operating results and financial condition and general economic conditions. As a bank holding company, the Corporations principal assets and sources of income are derived from the Bank and, as a result, the Corporations ability to pay dividends depends primarily on the receipt of dividends from the Bank. Dividend payments from the Bank are subject to legal and regulatory limitations, generally based on retained earnings, imposed by bank regulatory agencies. The ability of the Bank to pay dividends is also subject to financial condition, regulatory capital requirements, capital expenditures, and other cash flow requirements. The Corporation cannot assure you that the Bank will be able to pay dividends to the Corporation in the future. If the Corporation were unable to receive dividends from the Bank, it would materially and adversely affects the Corporations liquidity and its ability to service its debt, pay its other obligations, or pay cash dividends on its common stock. The Corporation may decide to limit the payment of dividends to its stockholders even when the Corporation has the legal ability to pay them in order to retain earnings for use in the Corporations business.

Operational and Strategic Risks

The Banks loans are principally concentrated in certain areas of Pennsylvania, Ohio, New York and Virginia, and adverse economic conditions in those markets could adversely affect the Corporations business, financial condition and results of operations.

The Corporations success is dependent to a significant extent upon general economic conditions in the United States and, in particular, the local economies in Central and Northwest Pennsylvania, Central and Northeast Ohio, Western New York and Southwest Virginia - the primary markets served by the Bank. The Bank is particularly exposed to real estate and economic factors in these geographic areas, as most of its loan portfolio is concentrated among borrowers in these markets. Furthermore, because a substantial portion of the Banks loan portfolio is secured by real estate in these areas, the value of the associated collateral is also subject to regional real estate market conditions.

17

The Bank is not immune to negative consequences arising from overall economic weakness and, in particular, a sharp downturn in the local real estate markets served by the Bank. While the Banks loan portfolio has not shown significant signs of credit quality deterioration despite continued challenges in the U.S. economy, we cannot assure you that no deterioration will occur. An economic recession in the markets served by the Bank, and the nation as a whole, could negatively impact household and corporate incomes. This impact could lead to decreased loan demand and increase the number of borrowers who fail to pay the Bank interest or principal on their loans, and accordingly, could have a material adverse effect on the Corporations business, financial condition, results of operations, or liquidity.

16

Severe weather, flooding and other effects of climate change and other natural disasters, such as earthquakes, could adversely affect our financial condition, results of operations or liquidity.

Our branch locations and our customers properties may be adversely impacted by flooding, wildfires, prolonged periods of extreme temperature, high winds and other effects of severe weather conditions that may be caused or exacerbated by climate change. These events can force property closures, result in property damage and/or result in delays in expansion, development or renovation of our properties and those of our customers. Even if these events do not directly impact our properties or our customers properties, they may impact us and our customers through increased insurance, energy or other costs. In addition, changes in laws or regulations, including federal, state or city laws, relating to climate change could result in increased capital expenditures to improve the energy efficiency of our branch locations and/or our customers properties. We also face investor-related climate risks. Investors are increasingly taking into account environmental, social, and governance factors, including climate risks, in determining whether to invest in companies. Our reputation and investor relationships could be damaged as a result of our involvement with activities perceived to be causing or exacerbating climate change, as well as any decisions we make to continue to conduct or change our activities in response to considerations relating to climate change.

The Corporation depends on the accuracy and completeness of information about customers and counterparties.

In deciding whether to extend credit or enter into other transactions with customers and counterparties, we rely on information furnished to us by or on behalf of customers and counterparties, including financial statements and other financial information. We also rely on representations of customers and counterparties as to the accuracy and completeness of that information and, with respect to financial statements, on reports of independent auditors. For example, in deciding whether to extend credit to clients, we may assume that a customer's audited financial statements conform to U.S. generally accepted accounting principles ("GAAP") and present fairly, in all material respects, the financial condition, results of operations and cash flows of the customer. Our earnings are significantly affected by our ability to properly originate, underwrite and service loans. Our financial condition, results of operations and capital could be negatively impacted to the extent we incorrectly assess the creditworthiness of our borrowers, fail to detect or respond to deterioration in asset quality in a timely manner, or rely on financial statements that do not comply with GAAP or are materially misleading.

The risks presented by acquisitions could adversely affect our financial condition and results of operations.

Any acquisitions will be accompanied by the risks commonly encountered in acquisitions including, among other things: our ability to realize anticipated cost savings and avoid unanticipated costs relating to the merger, the difficulty of integrating operations and personnel, the potential disruption of our or the acquired companys ongoing business, the inability of our management to maximize our financial and strategic position, the inability to maintain uniform standards, controls, procedures and policies, and the impairment of relationships with the acquired companys employees and customers as a result of changes in ownership and management. These risks may prevent the Corporation from fully realizing the anticipated benefits of an acquisition or cause the realization of such benefits to take longer than expected.

18

Strong competition within the Corporations markets and technological change may have a material adverse impact on its profitability.

The Corporation competes with an ever-increasing array of financial service providers. As noted above, as a financial holding company and state-chartered financial institution, respectively, the Corporation and the Bank are subject to extensive regulation and supervision, including, in many cases, regulations that limit the type and scope of activities. The non-bank financial service providers that compete with the Corporation and the Bank may not be subject to such extensive regulation, supervision, and tax burden. Competition from nationwide banks, as well as local institutions, is strong in the Corporations markets.

The financial services industry is undergoing rapid technological change, and technological advances are , including those related to artificial intelligence, are likely to intensify competition. In addition to improving customer services, effective use of technology increases efficiency and enables financial institutions to reduce costs. Accordingly, the Corporations future success will depend in part on its ability to address customer needs by using technology. The Corporation cannot assure you that it will be able to successfully take advantage of technological changes or advances or develop and market new technology driven products and services to its customers. Failure to keep pace with technological change affecting the financial services industry could have a material adverse effect on the Corporation's financial condition, results of operations, or liquidity.

17

Many regional, national, and international competitors have far greater assets and capitalization than the Corporation has and greater resources to invest in technology and access to capital markets and can consequently offer a broader array of financial services than the Corporation can. We cannot assure you that we will continue to be able to compete effectively with other financial institutions in the future. Developments increasing the nature or level of competition could have a material adverse effect on the Corporations business, financial condition, results of operations, or liquidity. For further information on competition, refer to Part I, Item1, "Competition," herein.

The soundness of other financial institutions with which the Corporation does business could adversely affect the Corporations business, financial condition or results of operations.

Our ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial institutions are interrelated as a result of trading, clearing, counterparty, investment or other relationships. The Corporation routinely executes transactions with counterparties in the financial services industry such as commercial banks, brokers and dealers, investment banks and other institutional clients for a range of transactions including loan participations, derivatives, and hedging transactions. In addition, the Corporation invests in securities or loans originated or issued by financial institutions or supported by the loans they originate. As a result, defaults by, or even rumors or questions about, one or more financial institutions, or the financial industry generally, have led to, or could in the future lead to, market-wide liquidity problems and could lead to losses or defaults by us or other institutions. Many of these transactions expose the Corporation to credit or investment risk in the event of default by the Corporations counterparty. In addition, the Corporations credit risk may be exacerbated if the collateral it holds cannot be realized or is liquidated at prices not sufficient to recover the full amount of the loan or other exposure to the Corporation. The Corporation could incur losses to its securities portfolio as a result of these issues. These types of losses may have a material adverse effect on the Corporations business, financial condition or results of operation.

The Corporations operations may be adversely affected if its external vendors do not perform as expected or if its access to third-party services is interrupted.

The Corporation relies on certain external vendors to provide products and services necessary to maintain the day-to-day operations of the Corporation. Some of the products and services provided by vendors include key components of our business infrastructure including data processing and storage and internet connections and network access, among other products and services. Accordingly, the Corporations operations are exposed to the risk that these vendors will not perform in accordance with the contracted arrangements or under service level agreements. The failure of an external vendor to perform in accordance with the contracted arrangements or under service level agreements, because of changes in the vendors organizational structure, financial condition, support for existing products and services or strategic focus or for any other reason, could disrupt the Corporations operations. If we are unable to find alternative sources for our vendors services and products quickly and cost-effectively, the failures of our vendors could have a material adverse impact on the Corporations business and, in turn, the Corporations financial condition and results of operations.

19

Additionally, our information technology and telecommunications systems interface with and depend on third-party systems, and we could experience service denials if demand for such services exceeds capacity, or such third-party systems fail or experience interruptions. If sustained or repeated, a system failure or service denial could result in a deterioration of our ability to process new and renewal loans, gather deposits and provide customer service, compromise our ability to operate effectively, damage our reputation, result in a loss of customer business and subject us to additional regulatory scrutiny and possible financial liability, any of which could have a material adverse effect on our financial condition and results of operations.

18

A failure in or breach of the Corporations or any of its subsidiaries information technology network and systems, or those of third party vendors and other service providers, including as a result of cyber attacks, could disrupt the Corporations or any of its subsidiaries businesses, result in the unauthorized disclosure or misuse of confidential or proprietary information, damage its reputation, increase its costs, and/or cause losses.

The Corporation, primarily through the Bank, depends on its information technology networks and systems to continuously process, record and monitor a large number of customer transactions and to process, transmit and store proprietary and confidential information, including personal information of employees and customers. Accordingly, the Corporations and its subsidiaries information technology networks and systems must continue to be safeguarded and monitored for potential failures, vulnerabilities, disruptions and breakdowns. We face cybersecurity threats, including system, network or internet failures, cyber- attacks, ransomware and other malware, social engineering, phishing schemes and workforce member error, negligence, or fraud. Although the Corporation has business continuity plans and other safeguards in place, any such cybersecurity incident, including those impacting personal information, could result in customer attrition, regulatory fines, penalties or intervention, reputational damage, reimbursement or other compensation costs, and/or additional compliance costs, any of which could materially adversely affect the Corporations results of operations or financial condition. Furthermore, increased regulation of data collection, use and retention practices, including self-regulation and industry standards, changes in existing laws and regulations, enactment of new law, new technologies such as and regulations, increased enforcement activity, and changes in interpretation of laws, could increase our cost of compliancrtificial intelligence may be more capable and operation, limit our ability to grow our business or ot evading therwise harm the Corporation.safeguard measures.

In addition, significant disruptions of our third party vendors and/or service providers security systems or infrastructure, or other similar data security incidents, could adversely affect our business operations and/or result in the loss, misappropriation, and/or unauthorized access, use or disclosure of, or the prevention of access to, regulated personal or confidential information, which could harm our business. While we may be entitled to damages if our third -party service providers fail to satisfy their security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

Although to date s of December 31, 2024, the Corporation has not experienced any material losses relating to cyber attacks orrisks from cybersecurity threats, including as a result of any previous cybersecurity incidents, there can be no assurance or threats, that have materially affected that it or its subsidiaries will not suffer such losses in the futue business strategy, results of operations or financial condition of the Corporation. However, there and our informcan be no assurance that the Corporation systems or its subsidiaries will remain a target of cyber attacksunaffected in the future. Given the evolving nature of security threats and evolving safeguards, there can be no assurance that any preventive, protective, or remedial data security measures that we or our third -party service providers implement are or will be adequate to detect or prevent all cybersecurity incidents. Additionally, while we have implemented security measures that we believe are appropriate, a regulator could deem our security measures not to be appropriate given the lack of prescriptive measures in certain data protection laws.  The Corporation continues to enhance its data security systems, technology platforms, employee education and risk management processes, in an effort to underpin its business strategy as well as in response to the evolving threat landscape and any incidents we experience. In connection with these efforts, we have incurred costs and expect to incur additional costs as we continue to enhance our data security infrastructure and take further steps to prevent unauthorized access to our systems and the data we maintain. In addition, any actual or perceived failure by the Corporation or our vendors or business partners to comply with our privacy, confidentiality, or data security-related legal or other obligations to third parties may result in claims by third parties that we have breached our privacy- or confidentiality-related obligations, which could materially and adversely affect our business and prospects.

The Corporations risk and exposure to these matters, including future "phishing" attempts like the 2020 incident, which was disclosed in the Corporation's Annual Form 10-K for the year ended December 31, 2020, remain heightened because of, among other things, the evolving nature of these threats, our plans to continue to implement our Internet banking and mobile banking channel strategies and develop additional remote connectivity solutions to serve our customers when and how they want to be served. As a result, cybersecurity and the continued development and enhancement of the Corporations controls, processes and practices designed to protect its and its subsidiaries systems, computers, software, data and networks from attack, damage or unauthorized access remain a priority for the Corporation. As cyber threats continue to evolve, the Corporation may be required to expend further significant resources to continue to modify or enhance its protective measures or to investigate and remediate future information security vulnerabilities. 

20

Additionally, while we have implemented security measures that we believe are appropriate, a regulator could deem our security measures not to be appropriate given the lack of prescriptive measures in certain data protection laws. Furthermore, increased regulation of data collection, use and retention practices, including self-regulation and industry standards, changes in existing laws and regulations, enactment of new laws and regulations, increased enforcement activity, and changes in interpretation of laws, could increase our cost of compliance and operation, limit our ability to grow our business or otherwise harm the Corporation.

19

While we have purchased cybersecurity insurance, there are no assurances that the coverage would be adequate in relation to any incurred losses. Moreover, as cyber attacks increase in frequency and magnitude, we may be unable to obtain cybersecurity insurance in amounts and on terms we view as adequate for our operations. Further information relating to cybersecurity risk management is discussed in Item 1C. Cybersecurity of this report.

A pandemic and measures intended to prevent its spread, could have a material adverse effect on our business, results of operations, cash flows, and financial condition.

A pandemic, such as the COVID-19 pandemic, and emergence of new variants co could negatively impact the global economy, disrupt financial markets and international trade, and result in varying unemployment levels, all of which could negatively impact our business, results of operations, cash flows, and financial condition. Pandemic outbreaks could lead (In response to pand theemic outbreak of COVID-19 led) s, governments and other authorities around the world, including federal, state and local authorities in the United States, to ihave imposed, and may in the future impose measures intended to mitigate its spread, including restrictions on freedom of movement and business operations such as issuing guidelines, travel bans, border closings, business closures and quarantine orders.

Our business and financial performance could be adversely affected, directly or indirectly, by terrorist activities, international hostilities or domestic civil unrest.

Neither the occurrence nor the potential impact of geopolitical instabilities, terrorist activities, international hostilities or other extraordinary events beyond the Corporations control can be predicted. However, these occurrences could adversely impact us, for example, by preventing us from conducting our business in the ordinary course. Also, their impact on our borrowers, depositors, other customers, suppliers or other counterparties could result in indirect adverse effects on us. Other indirect adverse consequences from these occurrences could result from impacts to the financial markets, the economy in general or in any region, or key parts of the infrastructure (such as the power grid) on which we and our customers rely. These types of indirect effects, whether specific to our counterparties or more generally applicable, could lead, for example, to an increase in delinquencies, bankruptcies or defaults that could result in the Corporation experiencing higher levels of nonperforming assets, net charge-offs and provisions for credit losses. They could also cause a reduction in demand for lending or other services that we provide.

Our use of artificial intelligence could expose us to various risks.

We have begun to utilize artificial intelligence technologies in various aspects of our business, including internal training material creation. Artificial intelligence technologies are susceptible to errors and other malfunctions which could lead to operational challenges and reputational risks. In addition, we may be subject to increasing regulations related to our use of artificial intelligence, including regulations related to privacy, data security, and intellectual property rights, which could expose us to legal risks.

Risks Related to Legal and Compliance Matters

The Corporation is subject to extensive government regulation and supervision, which may affect its ability to conduct its business and may negatively impact its financial results.

The Corporation, primarily through the Bank and its non-bank subsidiary, is subject to extensive federal and state regulation and supervision. Banking regulations are primarily intended to protect depositors funds, the Federal Deposit Insurance Fund and the safety and soundness of the banking system as a whole, not stockholders. These regulations affect the Corporations lending practices, capital structure, investment practices, dividend policy and growth, among other things. Congress and federal regulatory agencies continually review banking laws, regulations and policies for possible changes. Furthermore, political and policy goals of elected officials may change over time, which could impact the rulemaking, supervision, examination and enforcement priorities of federal banking agencies. Changes to statutes, regulations or regulatory policies, including changes in interpretation or implementation of statutes, regulations or policies, could affect the Corporation in substantial and unpredictable ways. Such changes could subject it to additional costs, limit the types of financial services and products the Corporation may offer, and/or limit the pricing it may charge on certain banking services, among other things.

20

Failure to comply with laws, including the Bank Secrecy Act and USA Patriot Act, regulations or policies could result in sanctions by regulatory agencies, restrictions, civil money penalties and/or reputation damage, which could have a material adverse effect on the Corporations business, financial condition and results of operations and/or cause the Corporation to lose its financial holding company status. While the Corporation has policies and procedures designed to prevent any such violations, there can be no assurance that such violations will not occur. See the section captioned "Supervision and Regulation" in Part I, Item 1 of this report for further information.

21

Federal and state governments could pass legislation responsive to current credit conditions which could cause the Corporation to experience higher credit losses.

The Corporation could experience higher credit losses because of federal or state legislation or regulatory action that reduces the amount the Banks borrowers are otherwise contractually required to pay under existing loan contracts. Also, the Corporation could experience higher credit losses because of federal or state legislation or regulatory action that limits the Banks ability to foreclose on property or other collateral or makes foreclosure less economically feasible. The Corporation cannot assure you that future legislation will not significantly and adversely impact its ability to collect on its current loans or foreclose on collateral.

General Risk Factors

The Corporation relies on its management and other key personnel, and the loss of any of them may adversely affect its operations.

The Corporation is and will continue to be dependent upon the services of its executive management team. In addition, it will continue to depend on its ability to retain and recruit key client relationship managers. The unexpected loss of services of any key management personnel, or the inability to recruit and retain qualified personnel in the future, could have an adverse effect on its business and financial condition.

The Corporation's risk management framework may not be effective in mitigating risk and loss.

The Corporation maintains an enterprise risk management program that is designed to identify, quantify, monitor, report, and control the risks that it faces. These risks include, but are not limited to: strategic, interest-rate, credit, liquidity, operations, pricing, reputation, compliance, litigation, and cybersecurity. While the Corporation assesses and improves this program on an ongoing basis, there can be no assurance that its approach and framework for risk management and related controls will effectively mitigate all risk and limit losses in its business. If conditions or circumstances arise that expose flaws or gaps in the Corporation's risk-management program, or if its controls break down, the Corporation's results of operations and financial condition may be adversely affected.

Risks Related to the Merger with ESSA

The market price of the Corporations common stock may decline as a result of the Merger and the market price of the Corporations common stock after the consummation of the Merger may be affected by factors different from those affecting the price of the Corporations common stock before the Merger.

The market price of the Corporations common stock may decline as a result of the Merger if the Corporation does not achieve the perceived benefits of the Merger or the effect of the Merger on the Corporations financial results is not consistent with the expectations of financial or industry analysts.

In addition, the consummation of the Merger will result in the combination of two companies that currently operate as independent companies. The business of the Corporation and the business of ESSA differ. As a result, while the Corporation expects to benefit from certain synergies following the Merger, the Corporation may also encounter new risks and liabilities associated with these differences. Following the Merger, shareholders of the Corporation and ESSA will own interests in a combined company operating an expanded business and may not wish to continue to invest in the Corporation, or for other reasons may wish to dispose of some or all of their shares of the Corporations common stock. If, following the effective time of the Merger, large amounts of the Corporations common stock are sold, the price of the Corporations common stock could decline.

21

Further, the results of operations of the Corporation and the market price of the Corporations common stock after the Merger may be affected by factors different from those currently affecting the independent results of operations of each of the Corporation and ESSA and the market price of the Corporations common stock. Accordingly, the Corporations historical market prices and financial results may not be indicative of these matters for the Corporation after the Merger.

The Merger Agreement may be terminated in accordance with its terms and the Merger may not be completed.

The Corporation and ESSA can mutually agree to terminate the Merger Agreement at any time before the Merger has been completed, and either company can terminate the Merger Agreement if:

any regulatory approval required for consummation of the Merger and the other transactions contemplated by the Merger Agreement has been denied by final, nonappealable action of any regulatory authority, or an application for regulatory approval has been permanently withdrawn at the request of a governmental authority;

the required approval of the issuance of common stock of the Corporation in connection with the Merger by the Corporations shareholders or the required approval of the Merger Agreement by the ESSA shareholders are not obtained;

the other party materially breaches any of its representations, warranties, covenants or other agreements set forth in the Merger Agreement (provided that the terminating party is not then in material breach of any representation, warranty, covenant or other agreement contained in the Merger Agreement), which breach is not cured within 30 days of written notice of the breach, or by its nature cannot be cured prior to the closing of the Merger, and such breach would entitle the non-breaching party not to consummate the Merger; or

the Merger is not consummated by January 9, 2026, unless the failure to consummate the Merger by such date is due to a material breach of the Merger Agreement by the terminating party.

In addition, the Corporation may terminate the Merger Agreement if:

ESSA breaches the non-solicitation provisions in the Merger Agreement; or

the ESSA Board of Directors:

fails to recommend approval of the Merger Agreement, or withdraws, modifies or changes such recommendation in a manner adverse to the Corporations interests; or

recommends, proposes or publicly announces its intention to recommend or propose to engage in an acquisition transaction with any person other than the Corporation or any of its subsidiaries; or

ESSA fails to call, give notice of, convene and hold its special meeting.

ESSA may terminate the Merger Agreement, subject to its compliance with the Merger Agreement, if ESSA has received an acquisition proposal, and the ESSA Board of Directors has made a determination that such proposal is a superior proposal and has determined to accept such proposal.

Failure to complete the Merger could negatively impact the stock price of the Corporation and its future business and financial results.

Completion of the Merger is subject to the satisfaction or waiver of a number of conditions, including approval by ESSA shareholders of the Merger. The Corporation cannot guarantee when or if these conditions will be satisfied or that the Merger will be successfully completed. The consummation of the Merger may be delayed, the Merger may be consummated on terms different than those contemplated by the Merger Agreement, or the Merger may not be consummated at all. If the Merger is not completed, the ongoing business of the Corporation may be adversely affected, and the Corporation will be subject to several risks, including the following:

the Corporation could incur substantial costs relating to the proposed Merger, such as legal, accounting, financial advisor, filing, printing and mailing fees; and

the Corporations management and employees attention may be diverted from their day-to-day business and operational matters as a result of efforts relating to the attempt to consummate the Merger.

22

In addition, if the Merger is not completed, the Corporation may experience negative reactions from the financial markets and from its customers and employees. The Corporation also could be subject to litigation related to any failure to complete the Merger or to enforcement proceedings commenced against the Corporation to perform its obligations under the Merger Agreement. If the Merger is not completed, the Corporation cannot assure its stockholders that the risks described above will not materialize and will not materially affect the Corporations business and financial results or the stock price of the Corporation.

The integration of the Corporation and ESSA will present significant challenges and expenses that may result in the combined business not operating as effectively as expected, or in the failure to achieve some or all of the anticipated benefits of the transaction.

The benefits and synergies expected to result from the proposed Merger will depend in part on whether the operations of ESSA can be integrated in a timely and efficient manner with those of the Corporation. The Corporation will face challenges and costs in consolidating its functions with those of ESSA, and integrating the organizations, procedures and operations of the two businesses. The integration of the Corporation and ESSA will be complex and time-consuming, and the management of both companies will have to dedicate substantial time and resources to it. These efforts could divert managements focus and resources from serving existing customers or other strategic opportunities and from day-to-day operational matters during the integration process. Failure to successfully integrate the operations of the Corporation and ESSA could result in the failure to achieve some of the anticipated benefits from the transaction, including cost savings and other operating efficiencies, and the Corporation may not be able to capitalize on the existing relationships of ESSA to the extent anticipated, or it may take longer, or be more difficult or expensive than expected to achieve these goals. This could have an adverse effect on the business, results of operations, financial condition or prospects of the Corporation and/or the Bank after the transaction.