UNITED STATES SECURITIES AND EXCHANGE COMMISSION

Codorus Valley Bancorp, Inc.

Form 10-K Index

PART I

Item 1: BusinessBusiness

The disclosures set forth in this Item are qualified by the section captioned “Cautionary Note Regarding Forward-Looking Statements and Risk Factors” contained in Part I, Items 1A, and other cautionary statements set forth elsewhere in this report.

Codorus Valley Bancorp, Inc.

Codorus Valley Bancorp, Inc. (“Codorus Valley” or the “Corporation”) is a Pennsylvania business corporation, incorporated on October 7, 1986. On March 2, 1987, Codorus Valley became a bank holding company under the Bank Holding Company Act of 1956, as amended. PeoplesBank, A Codorus Valley Company (“PeoplesBank”) is its wholly owned bank subsidiary. The Corporation’s business consists primarily of managing PeoplesBank, and its principal source of income is dividends received from PeoplesBank. The Corporation also wholly-owns one non-bank subsidiary, SYC Realty Co., Inc., a subsidiary for holdingthat is used, as needed, to hold certain foreclosed assets pending liquidation. On December 31, 2020,2023, Codorus Valley had total consolidated assets of $2.16$2.19 billion, total deposits and other liabilities of $1.96$2.00 billion, and total shareholders’ equity of $197,960,000.$199,605,000.

Proposed Transaction

On December 12, 2023, Codorus Valley Bancorp, Inc. and Orrstown Financial Services, Inc., a Pennsylvania corporation (“Orrstown”) entered into an Agreement and Plan of Merger (the “Merger Agreement”) pursuant to which Codorus Valley will be merged with and into Orrstown, with Orrstown as the surviving corporation (the “Merger”). Promptly following the Merger, PeoplesBank will be merged with and into Orrstown Bank, a Pennsylvania chartered bank,, which is the wholly-owned subsidiary of Orrstown, with Orrstown Bank as the surviving bank (the “Bank Merger”). The Merger and the Bank Merger are collectively referred to in the Form 10-K as the “Proposed Transaction.”

The Proposed Transaction has been approved by the board of directors of Codorus Valley and Orrstown and is expected to close in the third quarter of 2024, subject to satisfaction of customary closing conditions, including receipt of required regulatory approvals and approvals from Orrstown and Codorus Valley shareholders. Upon completion of the Proposed Transaction, Orrstown shareholders are expected to own approximately 56% of the outstanding shares of the combined company and Codorus Valley shareholders are expected to own approximately 44% of the outstanding shares of the combined company. A copy of the Merger Agreement is included as Exhibit 2.1 to the Current Report on Form 8-K filed by Codorus Valley Bancorp, Inc. with the Securities and Exchange Commission on December 12, 2023.

BankPeoplesBank Subsidiary

PeoplesBank, organized in 1934, is a Pennsylvania chartered bank that offers a full range of consumer, business, wealth management, and mortgage services at financial centers located in communities throughout South Central Pennsylvania and Central Maryland. In addition to the twenty-sixtwenty-two full service financial centers, there are sevenit has eight financial centers located primarily within retirement communities that provide a full suite of services on a limited basis.services. PeoplesBank, with origins dating back to 1864, is focused on acquiring and nurturing financial relationships with small and mid-sized businesses. The Federal Deposit Insurance Corporation insures the deposits of PeoplesBank to the maximum extent provided by law. On December 31, 2020,2023, PeoplesBank had total gross loans of $1.54$1.71 billion, excluding loans held for sale, and total deposits of $1.86$1.87 billion. PeoplesBank had the second largest share of deposits in York County, Pennsylvania, with deposits totaling 15.215.1 percent of the market as of June 30, 2020,2023, the latest available measurement date.

PeoplesBank is not dependent on deposits of, or exposed to a loan concentration to, a single client, or a small group of clients. Therefore, the loss of a single client, or a small client group, would not have a material adverse effect on the financial condition of PeoplesBank. At December 31, 2020,2023, the largest indebtedness of a single PeoplesBank client was approximately $23,047,000$26,683,000 or 1.4 percent of the total loan portfolio, which was within PeoplesBank’s regulatory lending limit of $32,971,000.$42,821,000. Also at December 31, 2023, 83% of deposits are estimated to be FDIC-insured and an additional 7% were fully collateralized.

Most of the Corporation's business is with clients located within South Central Pennsylvania, principally York and Lancaster Counties and North Central Maryland, principally Harford County Baltimore County and Baltimore City.County. Although this

market area may pose a concentration risk geographically, we believe that the diverse local economies and our detailed knowledge of the client base lessens this risk. At December 31, 2020, the Corporation had two industry concentrations that exceeded 10 percent of the total loan portfolio: residential real estate investor represented 15.4 percent of the portfolio and commercial real estate investor represented 15.3 percent of the portfolio. At December 31, 2019, the Corporation had three industry concentrations that exceeded 10 percent of the total loan portfolio: residential real estate investor represented 16.5 percent of the portfolio; commercial real estate investor represented 13.8 percent of the portfolio; and builder and developer represented 10.6 percent of the portfolio. Loans to borrowers within these industries are usually collateralized by real estate.

Nonbank Subsidiaries of PeoplesBank

PeoplesBank had four wholly-owned nonbank subsidiaries as of December 31, 2020,2023, that were consolidated for financial reporting purposes.

One such subsidiary, Codorus Valley Financial Advisors, Inc. d/b/a PeoplesWealth Advisors, a subsidiary that sells non-deposit investment products, began operations in January 2000, and previously operated as SYC Insurance Services, Inc. until the change to the current name in December 2005.

Periodically, PeoplesBank creates nonbank subsidiaries for the purpose of temporarily holding certain foreclosed assets pending liquidation. On December 31, 2020,2023, none of the three of these foreclosed asset subsidiaries was active.

Nonbank Subsidiaries of Codorus Valley Bancorp, Inc.

In 2006, Codorus Valley formed CVB Statutory Trust No. 2, a wholly-owned special purpose subsidiary whose sole purpose was to facilitate a pooled trust preferred debt issuance of $7,217,000. In 2004, Codorus Valley formed CVB

Statutory Trust No. 1 to facilitate a pooled trust preferred debt issuance of $3,093,000. The Corporation owns 100 percent of the common stock of these nonbank subsidiaries, which are not consolidated for financial reporting purposes. These obligations are reported as junior subordinated debt on the Corporation’s balance sheet.

In 1991, SYC Realty Co., Inc. was incorporated as a wholly owned subsidiary of Codorus Valley, and originally commenced operations in October 1995. Codorus Valley created this nonbank subsidiary primarily for the purpose of holding certain foreclosed properties obtained by PeoplesBank pending liquidation of those properties. SYC Realty was inactive during the entire reporting period of 2020.2023.

Human Capital Resources

At year-end 2020, PeoplesBankAs of December 31, 2023, the Corporation employed 320317 full-time employeesassociates and 2624 part-time employees, which equatedassociates, compared to approximately 343318 full-time equivalent employees. Employees are not covered by a collective bargaining agreement, and PeoplesBank considers its relations with employees to be satisfactory. The Corporation monitors employee turnover as a critical measure of success and reported 18.9 percent and 20.9 percent employee turnover23 part-time associates as of December 31, 20202022. Average tenure of our associate base is 7.33 years. The Board and December 31, 2019, respectively.Executive Leadership Team have established the following mission, vision and values for the Corporation:

Approximately 50 percentMission: To be community builders with an unwavering commitment to:

Helping our clients achieve their dreams and live confidently

Cultivating a work environment where our associates can thrive and make a difference

Delivering value and prosperity for our shareholders

Vision: To attract lifetime clients by being best in class

Values: Act Honorably, Care Deeply & Go Further, Create Opportunities, Pursue Growth, Drive Performance and Live We Before Me

We recognize that our ability to create value on a consistent basis is highly dependent upon the effectiveness of our team. The Corporation’s key human capital management objectives are to attract and retain diverse talent that aligns with our values and culture. Our talent strategy focuses on acquiring new associates through branding and outreach programs, developing associates through an extensive onboarding program, ongoing learning and development, mentoring and performance management and retaining associates through recognition, engagement and a competitive total rewards package.

Communication and Engagement

The Corporation believes in the Company’simportance of associate communication and engagement. We utilize several methods to foster engagement, including activities such as recognition programs, service awards, yearly associate meetings, engagement surveys and community service programs. We believe keeping our team well informed, connected and appreciated, adds to the success of our organization. Our annual associate engagement survey scores appear to reflect

our success in achieving these engagement goals, as our associate engagement scores have consistently exceeded 80%, with over 90% of our associates continueparticipating annually.

Diversity, Equity and Inclusion

Creating an environment in which our differences are appreciated is critical to our ongoing success. Through our Diversity, Equity, and Inclusion plan, and in partnership with our DE&I Advisory Team and our senior leaders, the Corporation continues to advance a variety of initiatives including training, development, and awareness programs, as well as providing resources and soliciting ongoing feedback. Diversity, Equity and Inclusion are not just about who we are, but also the way in which we carry out our mission. This includes the way we work together; the way we think about and solve problems; the way we engage our associates and tap into the unique strengths each of us brings to the workplace; and the way we ensure a safe and sound place to work off-premise since mid-March 2020and grow.

To attract a more ethnically diverse workforce, the Corporation seeks to develop new relationships and to enhance existing ones with a variety of community-based, non-profit organizations and educational institutions. Additionally, through programs such as our Student Banker Apprenticeship and our internship programs, we seek to attract a diverse population of young adults to careers in financial services and at PeoplesBank. As of December 31, 2023, our workforce reflected the startfollowing:

Ethnic minorities in workforce – 13%

Women in workforce – 71%

Ethnic minorities in management – 11%

Women in management – 56%

Ethnic minorities on the Board – 10%

Women on the Board – 11%

Compensation and Benefits

The Corporation offers competitive compensation to attract and retain talent. Our generous total rewards package includes market-competitive salaries, bonuses or sales commissions, equity incentives, healthcare and retirement benefits and paid time off. Associates have regular performance reviews and merit salary adjustments commensurate with performance.

Learning and Development

The Corporation provides an extensive learning and development program that supports our culture, prepares associates for their immediate role, and seeks to support their personal development and help them to achieve long-term success. We offer leadership development, personal development, PeoplesBank Mission, Vision & Values and ongoing technical and compliance training throughout the year. Associates also have access to additional educational and development opportunities including tuition reimbursement and certification programs. The success of the COVID-19 pandemic. A phased approachour development programs is evidenced by our internally posted and a comprehensive plan to safely return associates working remotely has been developed, and will be implemented as the numberfilled positions, representing nearly 28% of COVID-19 cases decline. A detailed protocol for the safety of associates and clients has been followed, including notifying clients, based on CDC guidelines, who may have come into close contact with an associate who has tested positive.positions filled in 2023.

Segment Reporting

Management has determined that it operates in only one segment, community banking. The Corporation’s non-banking activities are not significant to the consolidated financial statements.

Competition

The banking industry in PeoplesBank’s service area, South Central Pennsylvania (principally, York and Lancaster Counties), and North Central Maryland (principally, Baltimore County, Baltimore City and Harford County), is highly competitive. PeoplesBank competes through service and price, and by leveraging its hometown image. It competes with commercial banks and other financial service providers, such as thrifts, credit unions, consumer finance companies, investment firms and mortgage companies. Some financial service providers operating in PeoplesBank’s service area operate on a national and regional scale and possess resources that are greater than PeoplesBank’s.

SUPERVISION AND REGULATION

General

The following summary sets forth certain of the material elements of the regulatory framework applicable to bank holding companies and their bank subsidiaries and provides certain specific information about Codorus Valley and PeoplesBank. It does not describe all of the provisions of the statutes, regulations and policies that are identified. To the extent that the following information describes statutory and regulatory provisions, it is qualified in its entirety by express reference to each of the particular statutory and regulatory provisions. A change in applicable statutes, regulations or regulatory policy may have a material effect on the business of the Corporation.

Bank Holding Company Regulations

Codorus ValleyCorporation is registered as a bank holding company under the Bank Holding Company Act of 1956 (the “BHCA”) and is subject to regulation and supervision by the Board of Governors of the Federal Reserve System (“Federal Reserve”(the “Federal Reserve Board”), under and by the Bank Holding Company ActPennsylvania Department of 1956, as amended.Banking and Securities (the “PADOBS”). The Bank Holding Company Act requires bank holding companies to file periodic reportsCorporation files annually a report of its operations with, and subjects themis subject to examination by, the Federal Reserve. Reserve Board and the PADOBS. This regulation and oversight is generally intended to ensure that the Corporation limits its activities to those allowed by law and that it operates in a safe and sound manner without endangering the financial health of PeoplesBank.

The common stock of the Corporation is registered with the Securities and Exchange Commission (the “SEC”) under the Securities Exchange Act of 1934. The Corporation is subject to the proxy and tender offer rules, insider trading reporting requirements and restrictions, and certain other requirements of the Securities Exchange Act of 1934. The Corporation’s common stock is listed on the NASDAQ Global Market under the symbol “CVLY.” The NASDAQ Stock Market listing requirements impose additional requirements on the Corporation, including, among other things, rules relating to corporate governance and the composition and independence of its Board of Directors and various committees of the Board, such as the audit committee.

PeoplesBank is a Pennsylvania-chartered bank subject to extensive regulation and examination by the PADOBS and the Federal Deposit Insurance Corporation (the “FDIC”), and to certain requirements established by the Federal Reserve has issuedBoard. The federal and state laws and regulations which are applicable to banks regulate, among other things, the scope of their business, including the activities in which they engage, their investments, their reserves against deposits, the payment of dividends, the timing of the availability of deposited funds and the nature and amount of and collateral for certain loans. There are periodic examinations by the PADOBS and the FDIC to test PeoplesBank’s compliance with various regulatory requirements. This regulation and supervision establishes a comprehensive framework of activities in which an institution can engage and is intended primarily for the protection of the FDIC insurance fund and depositors. The regulatory structure also gives the regulatory authorities extensive discretion in connection with their supervisory and enforcement activities and examination policies, including policies with respect to the classification of assets and establishment of adequate loan loss reserves for regulatory purposes. Any change in such regulation, whether by the PADOBS, the FDIC, the Federal Reserve Board or the U.S. Congress could have a material adverse impact on the Corporation and PeoplesBank and their respective operations.

Federal law provides the federal banking regulators, including the FDIC and the Federal Reserve Board, with substantial enforcement powers. This enforcement authority includes, among other things, the ability to assess civil money penalties, to issue cease-and-desist or removal orders, and to initiate injunctive actions against banking organizations and institution-affiliated parties, as defined. In general, these enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices. Other actions or inactions may provide the basis for enforcement action, including misleading, inaccurate or untimely reports filed with regulatory authorities.

Certain of the regulatory requirements that are applicable to the Corporation and PeoplesBank are described below. This description of statutes and regulations is not intended to be a complete explanation of such statutes and regulations and their effects on the Corporation and PeoplesBank and is qualified in its entirety by reference to the actual statutes and regulations.

2018 Regulatory Reform

In May 2018 the Economic Growth, Regulatory Relief and Consumer Protection Act (the “2018 Act”), was enacted to modify or remove certain financial reform rules and regulations, including some of those implemented under the Bank Holding CompanyDodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”) enacted in 2010. While the 2018 Act maintains most of the regulatory structure established by the Dodd-Frank Act, it amends certain aspects of the regulatory framework for small depository institutions with assets of less than $10 billion and for large banks with assets of more than $50 billion. Many of these changes resulted in meaningful regulatory relief for community banks such as PeoplesBank.

The 2018 Act, among other matters, expanded the definition of “qualified mortgages” which may be held by a financial institution and simplifies the regulatory capital rules for financial institutions and their holding companies with total consolidated assets of less than $10 billion by instructing the federal banking regulators to establish a single “Community Bank Leverage Ratio” of between 8 and 10 percent to replace the leverage and risk-based regulatory capital ratios. The 2018 Act also expanded the category of holding companies that requiremay rely on the “Small Bank Holding Company and Savings and Loan Holding Company Policy Statement” (the “SBHC Policy”) by raising the maximum amount of assets a qualifying holding company may have from $1 billion to $3 billion. This expansion also excluded such holding companies from the minimum capital requirements of the Dodd-Frank Act. In addition, the 2018 Act included regulatory relief for community banks regarding regulatory examination cycles, call reports, the Volcker Rule (proprietary trading prohibitions), mortgage disclosures and risk weights for certain high-risk commercial real estate loans.

Regulation of the Corporation

Bank Holding Company Act Activities and Other Limitations. Under the BHCA, the Corporation must obtain the prior approval of the Federal Reserve Board before it may acquire control of another bank or bank holding company, merge or consolidate with another bank holding company, acquire all or substantially all of the assets of another bank or bank holding company, or acquire direct or indirect ownership or control of any voting shares of any bank or bank holding company if, after such acquisition, the Corporation would directly or indirectly own or control more than 5% of such shares.

Federal statutes impose restrictions on the ability of a bank holding company and its nonbank subsidiaries to obtain extensions of credit from its subsidiary bank, on the subsidiary bank’s investments in the stock or securities of the holding company, and on the subsidiary bank’s accepting the holding company’s stock or securities as collateral for loans to any borrower. A bank holding company and its subsidiaries are also prevented from engaging in certain so-called “tie-in” arrangements in connection with any extension of credit, lease or sale of property, or furnishing of services by the subsidiary bank.

A bank holding company is required to serve as a source of financial and managerial strength to its subsidiary banks. As a result,banks and may not conduct its operations in an unsafe or unsound manner. In addition, it has been the policy of the Federal Reserve may require Codorus ValleyBoard that a bank holding company should stand ready to use itsavailable resources to provide adequate capital funds to PeoplesBankits subsidiary banks during periods of financial stress or adversity.

The Bank Holding Company Act prohibits Codorus Valley from acquiring direct or indirect control of more than 5 percent ofadversity and should maintain the outstanding voting stock of any bank, or substantially all of the assets of any bank, or merging with anotherfinancial flexibility and capital-raising capacity to obtain additional resources for assisting its subsidiary banks. A bank holding company, without the prior approvalcompany’s failure to meet its obligations to serve as a source of the Federal Reserve. The Pennsylvania Department of Banking and Securities must also approve certain similar transactions. Pennsylvania law permits Pennsylvania bank holding companiesstrength to control an unlimited number of banks.

The Bank Holding Company Act restricts Codorus Valley to activities thatits subsidiary banks will generally be considered by the Federal Reserve has foundBoard to be closely related to banking, and which are expected to produce benefits for the public that will outweigh any potentially adverse effects. Therefore, the Bank Holding Company Act prohibits Codorus Valley from engaging in most nonbanking businesses, or acquiring ownership or control of more than 5 percent of the outstanding voting stock of any company engaged in a nonbanking business, unless the Federal Reserve has determined that the nonbanking business is closely related to banking. Under the Bank Holding Company Act, the Federal Reserve may require a bank holding company to end a nonbanking business if it constitutes a serious risk to the financial soundness and stability of any bank subsidiary of the bank holding company.

The Federal Reserve Act imposes restrictions on a subsidiary bank of a bank holding company, such as PeoplesBank. The restrictions affect extensions of credit to the bank holding company and its subsidiaries, investments in the stock or other securities of the bank holding company and its subsidiaries, and taking such stock or securities as collateral for loans.

The Federal Reserve Act and Federal Reserve regulations also place limitations and reporting requirements on extensions of credit by a bank to the principal shareholders of its parent holding company, among others, and to related interests of such principal shareholders. In addition, such legislation and regulation may affect the terms upon which any person becoming a principal shareholder of a holding company may obtain credit from banks with which the subsidiary bank maintains a correspondent relationship.

PeoplesBank and the banking industry, in general, are affected by the monetary and fiscal policies of the U.S. Treasury and government agencies, including the Federal Reserve. Through open market securities transactions, and changes in its federal funds and discount rates and reserve requirements, the Federal Reserve exerts considerable influence over the cost and availability of funds for lending and investment.

Regulation of PeoplesBank

PeoplesBank is a Pennsylvania chartered bank that is not a member of the Federal Reserve System, and its deposits are insured (up to applicable limits) by the Federal Deposit Insurance Corporation (“FDIC”). Accordingly, PeoplesBank’s primary federal regulator is the FDIC, and PeoplesBank is subject to the extensive regulation and examination by the FDIC and the Pennsylvania Department of Banking and Securities.

State and federal banking laws and regulations govern such things as: the scope of a bank’s business; permissible investments; the reserves against deposits a bank must maintain; the types and terms of loans a bank may make and the collateral it may take; the activities of a bank with respect to mergers and consolidations; the establishment of branches; and the sale of non-deposit investment products by the bank and its subsidiaries.

As the primary federal regulator of PeoplesBank, the FDIC regularly examines banks in such areas as capital, asset quality, management, earnings, liquidity and sensitivity to market risk and other aspects of operations and requires that PeoplesBank furnish annual and quarterly reports. Examinations by the FDIC are designed for the protection of PeoplesBank’s depositors rather than Codorus Valley’s shareholders. The FDIC provides deposit insurance to banks, which covers all deposit accounts. The standard maximum insurance amount is $250,000 per depositor.

Effective January 1, 2012, PeoplesBank became subject to FDIC regulation 363.3(b), which requires depository institutions with total assets of $1 billion or more to engage an independent public accountant to examine, attest to, and report on the assertion of management concerning the institution’s internal control structure and procedures for financial reporting.

The Pennsylvania Insurance Department, the Securities and Exchange Commission (“SEC”) and the Financial Industry Regulatory Authority (“FINRA”) control and supervise the licensing and activities of employees engaged in the sale of non-deposit investment products.

Federal Deposit Insurance and Premiums

PeoplesBank pays deposit insurance premiums to the FDIC based on a risk-based assessment formula established by the FDIC for Deposit Insurance Fund (DIF) member institutions. Institutions are classified into one of four risk categories and pay premiums according to perceived risk to the FDIC’s DIF. PeoplesBank has consistently been a risk category I institution, the least risky category. Institutions in risk categories II, III and IV are assessed premiums at progressively higher rates.

In February 2011, the FDIC announced its final rule pertaining to, among other things, changes in the computation of risk-based insurance premiums as mandated by the Dodd-Frank Wall Street Reform and Consumer Protection Act. The final rule, which took effect April 1, 2011, changed the assessment base from domestic deposits to average assets minus average tangible equity, i.e., Tier 1 capital, and lowered assessment rates. For insured member institutions below $10 billion in total assets, the four risk categories framework mentioned earlier continues to apply. For the least risky category I institutions, such as PeoplesBank, the assessment rate range of 7 to 24 basis points on domestic deposits decreased to 2.5 to 9 basis points on total average assets minus average tangible equity. The final rule eliminated risk categories for large institutions with total assets of $10 billion or more. Instead, their assessment rates are now calculated using a scorecard that combines regulatory ratings and certain forward financial measures to assess the risk a large institution poses to the DIF.

On April 26, 2016, the FDIC adopted a rule amending small institution pricing for deposit insurance, which is effective the quarter after the Reserve Ratio reaches 1.15 percent. The reserve ratio reached 1.15 percent effective June 30, 2016, so the lower rates became effective July 1, 2016. The initial base assessment rates for all insured institutions were reduced from 5 to 35 basis points to 3 to 30 basis points. Total base assessment rates after possible adjustments were reduced from 2.5 to 45 basis points to 1.5 to 40 basis points. For insured institutions under $10 billion in total assets, the new pricing system eliminates all risk categories and uses the Financial Ratios Method to determine assessment rates. CAMELS composite ratings are used to set minimum and maximum assessment rates for an institution. In addition, the new pricing system revises the Financial Ratios Method so that it is based on a statistical method eliminating the probability of failure over three years; and updates the financial measures used in the financial Ratios Method so the measures are consistent with the statistical method. Generally, the change in the assessment methodology by the FDIC lowered deposit insurance premiums for community banks like PeoplesBank.

On January 24, 2019, the FDIC provided preliminary notification of small bank assessment credits. On September 30, 2018, the Deposit Insurance Fund (DIF) reserve ratio reached 1.36 percent. Because the reserve ratio exceeded 1.35 percent, small banks were awarded assessment credits for the portion of their assessments that contributed to the growth in the reserve ratio from 1.15 percent to 1.35 percent, to be applied when the reserve ratio is at least 1.38 percent. The DIF reserve ratio as of June 30, 2019 was 1.40 percent. Because the reserve ratio exceeded the 1.38 percent, small bank assessment credits were applied beginning with the invoice payment for the second quarter assessment period of 2019. The small bank assessment credits issued to the Corporation were fully utilized as of December 31, 2019.

Dividend Restrictions

The Corporation is a legal entity separate and distinct from PeoplesBank. Declaration and payment of cash dividends by the Corporation depends upon cash dividend payments to the Corporation by PeoplesBank, which is the Corporation’s primary source of revenue and cash flow. Accordingly, the right of the Corporation, and consequently the right of our creditors and shareholders, to participate in any distribution of the assets or earnings of any subsidiary is necessarily subject to the prior claims of creditors of the subsidiary, except to the extent that claims of the Corporation in its capacity as a creditor may be recognized.

As a Pennsylvania chartered bank, PeoplesBank is subject to regulatory restrictions on the payment and amounts of dividends under the Pennsylvania Banking Code of 1965, as amended. Further, the ability of banking subsidiaries to pay dividends is also subject to their profitability, financial condition, capital expenditures and other cash flow requirements.

The payment of dividends by PeoplesBank and the Corporation may also be affected by other factors, such as the requirement to maintain adequate capital above regulatory guidelines. The federal banking agencies have indicated

that paying dividends that deplete a depository institution’s capital base to an inadequate level would be an unsafe and unsound banking practice. Under the Federal Deposit Insurance Corporation Improvement Act of 1991,practice or a depository institution may not pay any dividend if payment would cause it to become undercapitalized or if it is already undercapitalized. Moreover, the federal agencies have issued policy statements that provide that bank holding companies and insured banks should generally only pay dividends out of current operating earnings. Federal banking regulators have the authority to prohibit banks and bank holding companies from paying a dividend if the regulators deem such payment to be an unsafe and unsound practice. More information about dividend restrictions and capital requirements can be found in Note 9 – Regulatory Matters, to the consolidated financial statements.

Other Laws and Regulations Affecting the Corporation and PeoplesBank

May 2018 Banking Reform Legislation On May 24, 2018, the Economic Growth, Regulatory Relief, and Consumer Protection Act (the “Regulatory Relief Act”), amended certain provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, as well as certain other statutes administered by the federal banking agencies Some of the key provisions of the Regulatory Relief Act as it relates to community banks and bank holding companies include: (i) designating mortgages held in portfolio and “qualified mortgages” for banks with less than $10 billion in assets, subject to certain documentation and product limitations; (ii) exempting banks with less than $10 billion in assets (and total trading assets and trading liabilities of 5% or less of total assets) from Volcker Rule requirements relating to proprietary trading; (iii) simplifying capital calculations for banks with less than $10 billion in assets by requiring federal banking agencies to establish a community bank leverage ratio of tangible equity to average consolidated assets of not less than 8% or more than 10%, and provide that banks that maintain tangible equity in excess of such ratio will be deemed to be in compliance with risk-based capital and leverage requirements; (iv) assisting smaller banks with obtaining stable funding by providing an exception for reciprocal deposits from FDIC restrictions on acceptance of brokered deposits; (v) raising the eligibility for use of short-form Call Reports from $1 billion to $5 billion in assets; (vi) clarifying definitions pertaining to high volatility commercial real estate loans (HVCRE), which requires higher capital allocations, so that only loans with increased risk are subject to higher risk weightings; and (vii) changing the eligibility for use of the small bank holding company policy statement from institutions with under $1 billion in assets to institutions with under $3 billion in assets.

Section 201 of the Regulatory Relief Act directed the federal banking agencies to develop a community bank leverage ratio (“CBLR”) of not less than 8% and not more than 10% for qualifying community banks and bank holding companies with total consolidated assets of less than $10 billion. Qualifying community banking organizations that exceed the CBLR level established by the agencies, and that elect to be covered by the CBLR framework, will be considered to have met: (i) the generally applicable leverage and risk-based capital requirements under the banking agencies’ capital rules; (ii) the capital ratio requirements necessary to be considered “well capitalized” under the banking agencies’ prompt corrective action framework in the case of insured depository institutions; and (iii) any other applicable capital or leverage requirements.

On September 17, 2019, the Office of the Comptroller of the Currency, the Board of Governorsviolation of the Federal Reserve Board and the FDIC adoptedregulations, or both. The Dodd-Frank Act included a ruleprovision that directs federal regulators to implement the provisions of Section 201 of the Regulatory Relief Act. Under the rule, a qualifying community banking organization would be defined as a deposit institution orrequire depository institution holding company with less than $10 billion in assets and specified limited amountscompanies to serve as a source of off-balance sheet exposures, trading assets and liabilities, mortgage servicing assets, and certain temporary difference deferred tax assets. A qualifying community banking organization would be permittedstrength for their depository institution subsidiaries. To date, no regulations have been promulgated to elect the CBLR framework if its CBLR is greater than 9%. implement that provision.

Non-Banking Activities. The rule also addresses opting in and opting outbusiness activities of the CBLR frameworkCorporation, as a bank holding company, are restricted by a community banking organization, the treatmentBHCA. Under the BHCA and the Federal Reserve Board’s bank holding company regulations, bank holding companies may only engage in, or acquire or control voting securities or assets of a community banking organization that falls below the CBLR requirements, and the effect of various CBLR levels for purposes of the prompt corrective action categories applicable to insured depository institutions. Advanced approaches banking organizations (generally, institutions with $250 billion or more in consolidated assets) are not eligible to use the CBLR framework.company engaged in:

banking or managing or controlling banks and other subsidiaries authorized under the BHCA; and

any BHCA activity the Federal Reserve Board has determined to be so closely related that it is incidental to banking or managing or controlling banks.

The Company continuesFederal Reserve Board has determined by regulation that certain activities are closely related to analyze the changes implemented by the Regulatory Relief Act,banking including the CBLR framework included in the recently adopted rule. The Company does not believe, however, that such changes will materially impact the Company’s business, operations,operating a mortgage company, finance company, credit card company, factoring company, trust company or savings association; performing certain data processing operations; providing limited securities brokerage services; acting as an investment or financial results.

Dodd-Frank Wall Street Reformadvisor; acting as an insurance agent for certain types of credit-related insurance; leasing personal property on a full-payout, non-operating basis; providing tax planning and Consumer Protection Act (Dodd-Frank Act) In July 2010, the Dodd-Frank Act was enacted to improve accountabilitypreparation services; operating a collection agency; and transparency in theproviding certain courier services. Moreover, as discussed below, certain other activities are permissible for a bank holding company that becomes a financial system, to attempt to end “too big to fail” pertaining to large, troubled financial institutions, to protect the American taxpayer by ending governmental bailouts, to protect consumers from abusive financial services practices, and for other purposes. The Dodd-Frank Act is broad and complex legislation that puts in place a sweeping new financial services regime that will have significantholding company.

Financial Holding Companies. Bank holding companies may also engage in a broad range of activities under a regulatory designation known as a “financial holding company.” A financial holding company essentially is a bank holding company with significantly expanded powers. Financial holding companies are authorized by statute to engage in a number of financial activities previously impermissible for bank holding companies, including securities underwriting, dealing and legal consequences for banks nowmarket making; sponsoring mutual funds and for years to come.investment companies; insurance underwriting and agency; and merchant banking activities. The effectsFederal Reserve Board and the Department of the Dodd-FrankTreasury are also authorized to permit additional activities for financial holding companies if the activities are “financial in nature” or “incidental” to financial activities. A bank holding company may become a financial holding company if each of its subsidiary banks is “well-capitalized”, “well-managed”, and has at least a “satisfactory” Community Reinvestment Act onrating. A financial holding company must provide notice to the Federal Reserve Board within 30 days after commencing activities determined by statute or by the Federal Reserve Board and the Department of the Treasury to be permissible for financial services industry will depend,holding companies. The Corporation has not commenced any such activities, or submitted such notices; however, it is not precluded from doing so in large part, upon the extentfuture.

Regulatory Capital Requirements. The Federal Reserve Board has adopted capital adequacy guidelines pursuant to which regulators exerciseit assesses the authority granted to themadequacy of capital in examining and supervising a bank holding company and in analyzing applications under the Dodd-Frank ActBHCA. The Federal Reserve Board’s capital adequacy guidelines for a bank holding company, on a consolidated basis, are similar to those imposed on PeoplesBank by the FDIC. See “-Regulation of PeoplesBank - Capital Requirements” below. Moreover, certain of the bank holding company capital requirements promulgated by the Federal Reserve Board in 2013 became effective as of January 1, 2017. Those requirements establish four minimum capital ratios that the Corporation had to comply with as of that date as set forth in the table below. However, subsequent amendments to the Federal Reserve Board’s SBHC Policy increased the asset threshold to qualify to utilize the provisions of the SBHC Policy to $3.0 billion. Bank holding companies which are subject to the SBHC Policy are not subject to compliance with the regulatory capital requirements set forth in the table below until they exceed $3.0 billion in assets. As a consequence, as of December 31, 2023, the Corporation was not required to comply with the requirements set forth below and will not be subject to such requirements until such time that its consolidated total assets exceed $3.0 billion or the approaches takenFederal Reserve Board determines that the Corporation is no longer deemed to be a small bank holding company. However, if the Corporation had been subject to the requirements, it would have been in implementing regulations. Additional uncertainty regardingcompliance with such requirements.

________________________

⁽¹⁾ Does not reflect the effect of the Dodd-Frank Act exists dueCapital Conservation Buffer discussed below.

The Tier 1 Leverage Capital requirement is calculated as a percentage of total assets and the other three capital requirements are calculated as a percentage of risk-weighted assets. In addition to the potential for additional legislative changesminimum capital requirements, if the Corporation’s assets exceed $3.0 billion, to avoid becoming subject to restrictions on capital distributions and certain discretionary bonus payments to management, the Corporation would be required to also maintain a Capital Conservation Buffer of at least 2.50%, consisting of Common Equity Tier 1 Capital to risk-weighted assets. For a more detailed discussion of the capital rules, see “Regulatory Capital Regulations” under “Regulation of PeoplesBank” below.

Restrictions on Dividends and Share Repurchases. The Corporation’s ability to declare and pay dividends depends in part on dividends received from PeoplesBank. The Pennsylvania Banking Code of 1965 (the “PA Banking Code”) regulates the distribution of dividends by banks and states, in part, that dividends may be declared and paid out of accumulated net earnings, provided that the bank continues to meet its surplus requirements. In addition, dividends may not be declared or paid if PeoplesBank is in default in payment of any assessment due the FDIC. The FDIC also imposes restrictions on the payment of dividends in certain situations.

A Federal Reserve Board policy statement on the payment of cash dividends states that a bank holding company should pay cash dividends only to the Dodd-Frank Act.extent that the holding company’s net income for the past year is sufficient to cover both the cash dividends and a rate of earnings retention that is consistent with the holding company’s capital needs, asset quality and overall financial condition. The Corporation, like allFederal Reserve Board’s policy statement also provides that it would be inappropriate for a company experiencing serious financial institutions, has been and will continueproblems to be impacted by the Dodd-Frank Act in the areas of corporate governance, deposit insurance assessments, capital requirements, risk management, stress testing, and regulation under consumer protection laws.borrow funds to pay dividends.

Among other things, the Dodd-Frank Act:

Provides extensive authority toFurthermore, under the federal bank regulatory agencies and, in particular,prompt corrective action regulations, the Federal Reserve to take proactive steps to reduce or eliminate threats to the safety of the financial system, impose strict controls on largeBoard may prohibit a bank holding companies ($50 billion or more) and nonbank financial companies to limit their risk, and take direct controlcompany from paying any dividends if the holding company’s bank subsidiary is classified as “undercapitalized.” See “-Regulation of troubled financial companies considered systemically significant;PeoplesBank - Prompt Corrective Action” below.

Increases bank supervisionSection 225.4(b)(1) of Regulation Y promulgated by restructuring the supervision of holding companies and depository institutions; establishes the equivalent of a prompt corrective action program for large bank holding companies; requires that capital requirements for holding companies be at least as strict as capital requirements for depository institutions; disallows new issuances of trust preferred securities from qualifying for Tier 1 capital treatment; directs federal bank regulators to develop specific capital requirements for holding companies and depository institutions that address activities that pose risk to the financial system, such as significant activities in higher risk areas, or concentrations in assets whose reported values are based on models;

Established the Consumer Financial Protection Bureau as an independent entity within the Federal Reserve SystemBoard requires that has assumed responsibility for supervision and enforcement of most consumer protection laws, and has authoritya bank holding company that is not “well-capitalized” or “well-managed”, or that is subject to supervise, examine and take enforcement action with respectany unresolved supervisory issues, provide prior notice to depository institutions with more than $10 billion in assets and nonbank mortgage industry participants and other designated nonbank providers of consumer financial services;

Places certain limitations on investment and other activities by depository institutions, holding companies and their affiliates. Expands the coverage of Section 23A of the Federal Reserve ActBoard for any repurchase or redemption of its equity securities for cash or other value that would reduce by 10 percent or more the bank holding company’s consolidated net worth aggregated over the preceding 12-month period. The Federal Reserve Bank may disapprove such a purchase or redemption if it determines that the proposal would constitute an unsafe or unsound practice or would violate any law, regulation, Federal Reserve Board order or any condition imposed by, or written agreement with, the Federal Reserve Board. As of December 31, 2023, neither the Corporation nor PeoplesBank were subject to include the credit exposure relatedany supervisory restrictions on their respective ability to additional transactions, including derivatives; andpay dividends.

Federal Securities Laws and the Sarbanes-Oxley Act.Significantly increases The Corporation’s common stock is registered with the regulationSEC under Section 12(b) of residential mortgage lending and servicing by banks and nonbanks by requiring, among other things, mortgage originators to ensure that the consumer will have the capacity to repay the loan; and requires mortgage loan securitizers to retain a certain amountSecurities Exchange Act of risk, unless the mortgages conform1934. The Corporation is subject to the new regulatory standards as qualified residential mortgages.proxy and tender offer rules, insider trading reporting requirements and restrictions, and certain other requirements under the Securities Exchange Act of 1934.

As a public company, the Corporation is also subject to the Sarbanes-Oxley Act of 2002 The Sarbanes-Oxley Act (“SOA”) was signed into law in July 2002 and applies, which is applicable to all companies, both U.S. and non-U.S,non-U.S., that file periodic reports under the Securities Exchange Act of 1934. The stated goals of the SOA were to increase corporate responsibility, to provide for enhanced penalties for accounting and auditing improprieties at publicly traded companies and to protect investors by improving the accuracy and reliability of corporate disclosures pursuant to the securities laws. The SEC is responsible for establishing rules to implement various provisions of the SOA. The SOA includes specific disclosure requirements and corporate governance rules, requires the SEC and securities exchanges to adopt extensive additional disclosure, corporate governance and other related rules and mandates further studies of certain issues by the SEC. The SOA represents significant regulation of the accounting profession and corporate governance practices, such as the relationship between a board of directors and management and between a board of directors and its committees. Section 404

As directed by the SOA, the Corporation’s principal executive officer and principal financial officer are required to certify that the Corporation’s quarterly and annual reports do not contain any untrue statement of a material fact. The rules adopted by the SEC under the SOA have several requirements, including having these officers certify that: they are responsible for establishing, maintaining and regularly evaluating the effectiveness of our internal control over financial reporting; they have made certain disclosures to the Corporation’s auditors and the audit committee of the SOA requires publicly held companies to document, test and certify that theirBoard of Directors about the Corporation’s internal control systemsover financial reporting; and they have included information in the Corporation’s quarterly and annual reports about their evaluation and whether there have been changes in the Corporation’s internal control over financial reporting are effective.

or in other factors that could materially affect the Corporation’s internal control over financial reporting.

On March 12, 2020, the SEC issued a final rule, effective April 27, 2020, under the final ruling on the proposalSOA – Amendments to the Accelerated Filer and Large Accelerated Filer Definitions. As a result of the amendments, certain low revenue and/or low public float filers will remain obligated to provide a report by management assessing the effectiveness of the Corporation’s internal control over financial reporting (“ICFR”), but willare not requirerequired to provide an attestation report from the Corporation’s independent auditor assessing the effectiveness of the Corporation’s ICFR. The Corporation meets the amended definition and willis not be required to provide an attestation report from its independent auditor assessing the effectiveness of its ICFR. PeoplesBank remains subject to independent auditor attestation required under FDIC regulation 363.3(b)regulations set forth at 12 C.F.R. §363.3(b).

Volcker Rule Regulations.

USA Patriot Regulations adopted by the federal banking agencies to implement the provisions of the Dodd-Frank Act of 2001 In October of 2001,commonly referred to as the USA Patriot ActVolcker Rule contain prohibitions and restrictions on the ability of 2001 was enacted to strengthen U.S. law enforcement’s and the intelligence communities’ abilities to work cohesively to combat terrorism on a variety of fronts. The Patriot Act contains sweeping anti-money laundering and financial transparency laws and imposes various regulations on financial institutions, holding companies and their affiliates to engage in proprietary trading and to hold certain interests in, or to have certain relationships with, various types of investment funds, including standardshedge funds and private equity funds. However federal regulations exclude from the Volcker Rule restrictions community banks with $10 billion or less in total consolidated assets and total trading assets and liabilities of five percent or less of total consolidated assets. The Corporation qualifies for verifying client identification at account opening, andthe exclusion from the Volcker Rule restrictions.

rules to promote cooperation among

Limitations on Transactions with Affiliates. Transactions between insured financial institutions regulators and law enforcement entitiesany affiliate are governed by Sections 23A and 23B of the Federal Reserve Act. An affiliate of an insured financial institution is any company or entity which controls, is controlled by or is under common control with the insured financial institution. In a bank holding company context, the bank holding company of an insured financial institution (such as the Corporation) and any companies which are controlled by such holding company are affiliates of the insured financial institution. Generally, Section 23A limits the extent to which the insured financial institution or its subsidiaries may engage in identifying parties“covered transactions” with any one affiliate to an amount equal to 10% of such institution’s capital stock and surplus, and contains an aggregate limit on all such transactions with all affiliates to an amount equal to 20% of such capital stock and surplus. Section 23B applies to “covered transactions” as well as certain other transactions and requires that all transactions be on terms substantially the same, or at least as favorable to the insured financial institution, as those provided to a non-affiliate. The term “covered transaction” includes the making of loans to, purchase of assets from and issuance of a guarantee to an affiliate and similar transactions. Section 23B transactions also include the provision of services and the sale of assets by an insured financial institution to an affiliate.

Limitations on Loans to Insiders. Sections 22(g) and (h) of the Federal Reserve Act place restrictions on loans to executive officers, directors and principal stockholders. Under Section 22(h), loans to a director, an executive officer and to a greater than 10% stockholder of an insured financial institution, and certain affiliated interests of either, may not exceed, together with all other outstanding loans to such person and affiliated interests, the insured financial institution’s loans to one borrower limit (generally equal to 15% of the institution’s unimpaired capital and surplus). Section 22(h) also requires that loans to directors, executive officers and principal stockholders be made on terms substantially the same as offered in comparable transactions to other persons unless the loans are made pursuant to a benefit or compensation program that (i) is widely available to employees of the institution and (ii) does not give preference to any director, executive officer or principal stockholder, or certain affiliated interests thereof, over other employees of the insured financial institution. Section 22(h) also requires prior board approval for the issuance of certain loans. In addition, the aggregate amount of extensions of credit by an insured financial institution to all insiders cannot exceed the institution’s unimpaired capital and surplus. Furthermore, Section 22(g) places additional restrictions on loans to executive officers. At December 31, 2023, PeoplesBank was in compliance with the above restrictions.

Regulation of PeoplesBank

Pennsylvania Banking Law. The PA Banking Code contains detailed provisions governing the organization, location of offices, rights and responsibilities of directors, officers and employees, as well as corporate powers, savings and investment operations and other aspects of PeoplesBank and its affairs. The Banking Code delegates extensive rulemaking power and administrative discretion to the PADOBS so that the supervision and regulation of state-chartered banks may be involvedflexible and readily responsive to changes in terrorismeconomic conditions and in savings and lending practices.

One of the purposes of the PA Banking Code is to provide banks with the opportunity to be competitive with each other and with other financial institutions existing under other Pennsylvania laws and other state, federal and foreign laws. A Pennsylvania bank may locate or money laundering.change the location of its principal place of business and establish an office anywhere in Pennsylvania, with the prior approval of the PADOBS.

The PADOBS generally examines each bank under its jurisdiction not less frequently than once every two years. Although the PADOBS may accept the examinations and reports of the FDIC in lieu of its own examination, the present practice is for the PADOBS to alternate conducting examinations with the FDIC. The PADOBS may order any bank to discontinue any violation of law or unsafe or unsound business practice and may direct any director, trustee, officer, attorney or employee of a bank engaged in an objectionable activity, after the PADOBS has ordered the activity to be terminated, to show cause at a hearing before the PADOBS why such person should not be removed.

Insurance of Accounts. The deposits of PeoplesBank are insured to the maximum extent permitted by the Deposit Insurance Fund and are backed by the full faith and credit of the U.S. Government. The Dodd-Frank Act increased deposit insurance on most accounts to $250,000. As insurer, the FDIC is authorized to conduct examinations of, and to require reporting by, insured institutions. It also may prohibit any insured institution from engaging in any activity determined by regulation or order to pose a serious threat to the FDIC. The FDIC also has the authority to initiate enforcement actions against savings institutions.

Coronavirus Aid, Relief

The FDIC assesses deposit insurance premiums on the assessment base of a depository institution, which is its average total assets reduced by the amount of its average tangible equity. For a small institution (one with assets of less than $10 billion) that has been federally insured for at least five years, effective July 1, 2016, the initial base assessment rate ranges from 3 to 30 basis points, based on the institution’s CAMELS composite and Economic Securitycomponent ratings (for Capital adequacy, Asset quality, Management, Earnings, Liquidity and Sensitivity), and certain financial ratios; its leverage ratio; its ratio of net income before taxes to total assets; its ratio of nonperforming loans and leases to gross assets; its ratio of other real estate owned to gross assets; its brokered deposits ratio (excluding reciprocal deposits if the institution is well-capitalized and has a CAMELS composite rating of 1 or 2); it’s one year asset growth ratio (which penalizes growth adjusted for mergers in excess of 10%); and its loan mix index (which penalizes higher risk loans based on historical industry charge off rates).  The initial base assessment rate is subject to downward adjustment (not below 1.5%) based on the ratio of unsecured debt the institution has issued to its assessment base and to upward adjustment (which can cause the rate to exceed 30 basis points) based on its holdings of unsecured debt issued by other insured institutions. Institutions with assets of $10 billion or more are assessed using a scorecard method.

In October 2022, the FDIC finalized a rule that increased the initial base deposit insurance assessment rates by 2 basis points, beginning with the first quarterly assessment period of 2023 (January 1, 2023 through March 31, 2023). The FDIC, as required under the Federal Deposit Insurance Act (CARES Act) On March 27,(the “FDIA”), established a plan in September 2020 (the “Restoration Plan”) to restore the Coronavirus Aid, Relief,Deposit Insurance Fund reserve ratio to meet or exceed the statutory minimum of 1.35% within eight years. The Restoration Plan did not include an increase in the deposit insurance assessment rate. Based on the FDIC’s recent projections, however, the FDIC determined that the Deposit Insurance Fund reserve ratio is at risk of not reaching the statutory minimum by the statutory deadline of September 30, 2028 without increasing the deposit insurance assessment rates. The increased assessment would improve the likelihood that the Deposit Insurance Fund reserve ratio would reach the required minimum by the statutory deadline, consistent with the FDIC’s amended Restoration Plan. The FDIC also concurrently maintained the Designated Reserve Ratio (“DDR”) for the Deposit Insurance Fund at 2% for 2023. The new assessment rate schedules will remain in effect unless and Economic Security Act (CARES Act) was enacteduntil the reserve ratio meets or exceeds 2% in responseorder to support growth in the COVID-19 pandemic. SinceDeposit Insurance Fund in progressing toward the FDIC’s long-term goal of a 2% DRR. Progressively lower assessment rate schedules will take effect when the reserve ratio reaches 2%, and again when it reaches 2.5%. The revised assessment rate schedule will remain in effect unless and until the reserve ratio meets or exceeds 2% absent further action by the FDIC.

The FDIC may terminate the deposit insurance of any insured depository institution if it determines after a hearing that time banking regulators, the SEC and FASB have all issued additional guidance and clarification on various sectionsinstitution has engaged or is engaging in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, order or any condition imposed by an agreement with the FDIC. It also may suspend deposit insurance temporarily during the hearing process for the permanent termination of insurance if the institution has no tangible capital. If insurance of accounts is terminated, the accounts at the institution at the time of the CARES Act. Section 4013termination, less subsequent withdrawals, shall continue to be insured for a period of six months to two years, as determined by the FDIC. Management is not aware of any existing circumstances which could result in termination of PeoplesBank’s deposit insurance.

The FDIA provides that, in the event of the CARES Act provides“liquidation or other resolution” of an insured depository institution, the option to not apply ASC 310-40 (TDRs) to a loan modification, related specifically to COVID-19 hardships. Regulators have encouraged financial institutions to work constructively with borrowers in communities and industries affected by COVID-19 using prudent and proactive actions which are in the best interestsclaims of depositors of the financial institution (including the borrowerclaims of the FDIC as subrogee of insured depositors) and certain claims for administrative expenses of the economy. The Corporation’s BoardFDIC as a receiver will have priority over other general unsecured claims against the institution. Insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of Directors approved a number of options for loan modifications,unsecured, non-deposit creditors, including interest deferral, full payment deferral, additionalPeoplesBank, with respect to any extensions of credit they have made to such insured depository institution.

Regulatory Capital Requirements. Unless a community bank qualifies and SBA loan programs (i.e.elects to comply with the community bank leverage ratio requirement described below, federal regulations require FDIC-insured depository institutions to meet several minimum capital standards: a common equity Tier 1 capital to risk-based assets ratio of 4.5%, Economic Injury Disaster Loans, Paycheck Protection Program)a Tier 1capital to risk-based assets of 6.0%, a total capital to risk-based assets ratio of 8.0% and a Tier 1 capital to average assets leverage ratio of 4.0%. In addition, in order to make capital distributions and pay discretionary bonuses to executive officers without restriction, an institution must also maintain greater than 2.5% in common equity attributable to a capital conservation buffer. The existing capital requirements were effective January 1, 2015 and were the result of a final rule implementing regulatory amendments based on recommendations of the Basel Committee on Banking Supervision and certain requirements of the Dodd-Frank Act.

Effective January 1, 2020, qualifying community banking organizations may elect to comply with a greater than 9% community bank leverage ratio (the “CBLR”) requirement in lieu of the currently applicable requirements for

calculating and reporting risk-based capital ratios. The CBLR is equal to Tier 1 capital divided by average total consolidated assets. In order to qualify for the CBLR election, a community bank must (i) have a leverage capital ratio greater than 9 percent, (2) have less than $10 billion in average total consolidated assets, (3) not exceed certain levels of off-balance sheet exposure and trading assets plus trading liabilities and (4) not be an advanced approaches banking organization. A community bank that meets the above qualifications and elects to utilize the CBLR is considered to have satisfied the risk-based and leverage capital requirements in the generally applicable capital rules and is also considered to be “well-capitalized” under the prompt corrective action rules. As of December 31, 2020,2023, PeoplesBank had not elected to be subject to the CBLR requirement.

Common equity Tier 1 capital is generally defined as common stockholders’ equity and retained earnings.  Tier 1 capital is generally defined as common equity Tier 1 and additional Tier 1 capital.  Additional Tier 1 capital includes certain noncumulative perpetual preferred stock and related surplus and minority interests in equity accounts of consolidated subsidiaries.  Total capital includes Tier 1 capital (common equity Tier 1 capital plus additional Tier 1 capital) and Tier 2 capital.  Tier 2 capital is comprised of capital instruments and related surplus, meeting specified requirements, and may include cumulative preferred stock and long-term perpetual preferred stock, mandatory convertible securities, intermediate preferred stock and subordinated debt.  Also included in Tier 2 capital is the allowance for loan and lease losses limited to a maximum of 1.25% of risk-weighted assets and, for institutions that have exercised an opt-out election regarding the treatment of Accumulated Other Comprehensive Income (“AOCI”), up to 45% of net unrealized gains on available-for-sale equity securities with readily determinable fair market values.  Institutions that have not exercised the AOCI opt-out have AOCI incorporated into common equity Tier 1 capital (including unrealized gains and losses on available-for-sale-securities).  PeoplesBank exercised its AOCI opt-out election. Calculation of all types of regulatory capital is subject to deductions and adjustments specified in the regulations.

In determining the amount of risk-weighted assets for purposes of calculating risk-based capital ratios, all assets, including certain off-balance sheet assets (e.g., recourse obligations, direct credit substitutes, residual interests) are multiplied by a risk weight factor assigned by the regulations based on the risks believed inherent in the type of asset.  Higher levels of capital are required for asset categories believed to present greater risk.  For example, a risk weight of 0% is assigned to cash and U.S. government securities, a risk weight of 50% is generally assigned to prudently underwritten first lien one- to four-family residential real estate loans, a risk weight of 100% is assigned to commercial and consumer loans, a risk weight of 150% is assigned to certain past due loans and a risk weight of between 0% to 600% is assigned to permissible equity interests, depending on certain specified factors.

At December 31, 2023, PeoplesBank exceeded all of its regulatory capital requirements, with Tier 1 leverage (to average assets), Tier 1 common equity (to risk-weighted assets), Tier 1 (to risk-weighted assets) and Total risk-based capital ratios of 11.98%, 14.89%, 14.89% and 16.04%, respectively. Additional information can be found in Note 8 – Regulatory Matters.

Any bank that fails any of the capital requirements is subject to possible enforcement action by the FDIC. Such action could include a capital directive, a cease and desist order, civil money penalties, the establishment of restrictions on the institution’s operations, termination of federal deposit insurance and the appointment of a conservator or receiver. The FDIC’s capital regulations provide that such actions, through enforcement proceedings or otherwise, could require one or more of a variety of corrective actions.

PADOBS Capital Requirements. PeoplesBank is also subject to more stringent PADOBS capital guidelines. Although not adopted in regulation form, the PADOBS utilizes capital standards requiring a minimum of 6% leverage capital and 10% risk-based capital. The components of leverage and risk-based capital are substantially the same as those defined by the FDIC. At December 31, 2023, PeoplesBank’s capital ratios exceeded each of the regulatory capital requirements.

Prompt Corrective Action. The following table shows the amount of capital associated with the different capital categories set forth in the FDIC’s prompt corrective action regulations (and does not take into account the potential determination to elect to use the CBLR).

In addition, an institution is “critically undercapitalized” if it has a ratio of tangible equity to total assets that is equal to or less than 2.0%. Under specified circumstances, a federal banking agency may reclassify a “well-capitalized” institution as adequately capitalized and may require an adequately capitalized institution or an undercapitalized institution to comply with supervisory actions as if it were in the next lower category (except that the FDIC may not reclassify a significantly undercapitalized institution as critically undercapitalized).

An institution generally must file a written capital restoration plan which meets specified requirements within 45 days of the date that the institution receives notice or is deemed to have notice that it is undercapitalized, significantly undercapitalized or critically undercapitalized. A federal banking agency must provide the institution with written notice of approval or disapproval within 60 days after receiving a capital restoration plan, subject to extensions by the agency. An institution which is required to submit a capital restoration plan must concurrently submit a performance guaranty by each company that controls the institution. In addition, undercapitalized institutions are subject to various regulatory restrictions, and the appropriate federal banking agency also may take any number of discretionary supervisory actions.

At December 31, 2023, PeoplesBank was deemed to be a “well-capitalized” institution for purposes of the prompt corrective action regulations and as such is not subject to the above mentioned restrictions.

Activities and Investments of Insured State-Chartered Banks. The activities and equity investments of FDIC-insured, state-chartered banks are generally limited to those that are permissible for national banks or a federal savings association. Under regulations dealing with equity investments, an insured state bank generally may not directly or indirectly acquire or retain any equity investment of a type, or in an amount, that is not permissible for a national bank or a federal savings association. The FDIC will not approve the activity unless the state-chartered bank meets its minimum capital requirements and the FDIC determines that the activity does not present a significant risk to the Deposit Insurance Fund. Certain activities of subsidiaries that are engaged in activities permitted for national banks only through a “financial subsidiary” are subject to additional restrictions.

The FDIC has adopted regulations pertaining to the other activity restrictions imposed upon insured state-chartered banks and their subsidiaries. Pursuant to such regulations, insured state-chartered banks engaging in impermissible activities may seek approval from the FDIC to continue such activities, and state-chartered banks not engaging in such activities but that desire to engage in otherwise impermissible activities either directly or through a subsidiary may apply for approval from the FDIC to do so. The FDIC will not approve the activity unless the state-chartered bank meets its minimum capital requirements and the FDIC determines that the activity does not present a significant risk to the Deposit Insurance Fund. Certain activities of subsidiaries that are engaged in activities permitted for national banks only through a “financial subsidiary” are subject to additional restrictions.

Restrictions on Capital Distributions. Under federal rules, an insured depository institution may not pay any dividend if making such payments would cause it to become undercapitalized or if it is already undercapitalized. In addition, federal regulators have the authority to restrict or prohibit the payment of dividends for safety and soundness reasons. The FDIC also prohibits an insured depository institution from paying dividends on its capital stock or interest on its capital notes or debentures (if such interest is required to be paid only out of net profits) or distributing any of its capital assets while it remains in default in the payment of any assessment due the FDIC or if it has negative retained earnings. PeoplesBank is currently neither in default in any assessment payment to the FDIC nor has negative retained earnings. The PA Banking Code also restricts the payment and amount of dividends, including the requirement that dividends be paid only out of accumulated net earnings.

Incentive Compensation. Guidelines adopted by the federal banking agencies pursuant to the FDIA prohibit payment of excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the

amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal stockholder.

In June 2010, the federal banking agencies issued comprehensive guidance on incentive compensation policies (the “Incentive Compensation Guidance”) intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The Incentive Compensation Guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors. Any deficiencies in compensation practices that are identified may be incorporated into the organization’s supervisory ratings, which can affect its ability to make acquisitions or perform other actions. The Incentive Compensation Guidance provides that enforcement actions may be taken against a banking organization if its incentive compensation arrangements or related risk-management control or governance processes pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

The Dodd-Frank Act requires the federal banking agencies and the SEC to establish joint regulations or guidelines prohibiting incentive-based payment arrangements at specified regulated entities, such as us, having at least $1 billion in total assets that encourage inappropriate risk-taking by providing an executive officer, employee, director or principal shareholder with excessive compensation, fees, or benefits or that could lead to material financial loss to the entity. In addition, these regulators must establish regulations or guidelines requiring enhanced disclosure to regulators of incentive-based compensation arrangements. The federal banking agencies proposed such regulations in April 2011 and issued a second proposed rule in April 2016. The second proposed rule would apply to all banks, among other institutions, with at least $1 billion in average total consolidated assets. Final regulations have not been adopted as of the date of this Form 10-K. If adopted, these or other similar regulations would impose limitations on the manner in which we may structure compensation for our executives and other employees that go beyond the requirements of Incentive Compensation Guidance. The scope and content of the federal banking agencies’ policies on incentive compensation are continuing to develop and are likely to continue evolving, but the timeframe for finalization of such policies is not known at this time.

Standards for Safety and Soundness. As required by statute, the federal banking agencies adopted final regulations and Interagency Guidelines Establishing Standards for Safety and Soundness. The guidelines set forth the safety and soundness standards that the federal banking agencies use to identify and address problems at insured depository institutions before capital becomes impaired. The guidelines address internal controls and information systems, internal audit systems, credit underwriting, loan documentation, interest rate exposure, asset growth, asset quality, earnings and compensation, fees and benefits. The agencies have also established standards for safeguarding customer information. If the relevant federal banking agency determines that an institution fails to meet any standard prescribed by the guidelines, the agency may require the institution to submit to the agency an acceptable plan to achieve compliance with the standard.

Privacy Requirements. Federal law places limitations on financial institutions like PeoplesBank regarding the sharing of consumer financial information with unaffiliated third parties. Specifically, these provisions require all financial institutions offering financial products or services to retail customers to provide such customers with the financial institution’s privacy policy and provide such customers the opportunity to “opt out” of the sharing of personal financial information with unaffiliated third parties. PeoplesBank currently has a privacy protection policy in place and believes such policy complies with applicable regulations.

Anti-Money Laundering. Federal anti-money laundering rules impose various requirements on financial institutions to prevent the use of the U.S. financial system to fund terrorist activities. These provisions include a requirement that financial institutions operating in the United States have anti-money laundering compliance programs, due diligence policies and controls in place to ensure the detection and reporting of money laundering. Such compliance programs supplement existing compliance requirements, also applicable to financial institutions, under the Bank Secrecy Act and the Office of Foreign Assets Control Regulations. PeoplesBank has established policies and procedures to ensure compliance with the federal anti-money laundering provisions.

PeoplesBank is also subject to the USA PATRIOT Act, which gave federal agencies additional powers to address terrorist threats through enhanced domestic security measures, expanded surveillance powers, increased information sharing, and broadened anti-money laundering requirements. By way of amendments to the Bank Secrecy Act, Title III of the USA PATRIOT Act provided measures intended to encourage information sharing among bank regulatory agencies and law enforcement bodies. Further, certain provisions of Title III impose affirmative obligations on a broad range of financial institutions, including banks, thrifts, brokers, dealers, credit unions, money transfer agents, and parties registered under the Commodity Exchange Act.

Cybersecurity. The federal banking agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a financial institution’s board of directors. These guidelines, along with related regulatory materials, and supervisory examinations (by federal and state regulators) increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services. The banking agencies expect financial institutions to establish lines of defense and ensure that their risk management processes also address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack. If the Corporation and PeoplesBank fail to meet the expectations set forth in this regulatory guidance, they could be subject to various regulatory actions as well as remediation efforts which may cause them to incur significant expense. In addition, in November 2021, the federal banking agencies adopted a rule to establish computer-security incident notification requirements for bank holding companies, banks and their service providers. Under the rule, banking organizations are required to notify their primary federal regulators within 36 hours of any incident that has remaining loan modifications totaling approximately $26 million.materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver banking services to a material portion of its client base, jeopardize the viability of key operations, or impact the financial stability of the financial sector. The rule also imposes certain notification requirements on third-party bank service providers when they experience a computer-security incident that has caused, or is likely to cause a material service disruption or degradation for four or more hours. In such case, the service provider is required to notify its bank-designated point of contact as soon as possible upon discovery of the incident. In July 2023 the SEC adopted similar incident notification rules which require public companies such as the Corporation to report on Form 8-K any cybersecurity incident they determine to be material, describing the material aspects of the incident, notably, its reasonably likely impact to the company.

UDAP and UDAAP. Recently, banking regulatory agencies have increasingly used a general consumer protection statute to address “unethical” or otherwise “bad” business practices that may not necessarily fall directly under the purview of a specific banking or consumer finance law. The law of choice for enforcement against such business practices has been Section 5 of the Federal Trade Commission Act (the “FTC Act”), which is the primary federal law that prohibits unfair or deceptive acts or practices, referred to as UDAP, and unfair methods of competition in or affecting commerce. “Unjustified consumer injury” is the principal focus of the FTC Act. Prior to the Dodd- Frank Act, there was little formal guidance to provide insight to the parameters for compliance with UDAP laws and regulations. However, UDAP laws and regulations have been expanded under the Dodd-Frank Act to apply to “unfair, deceptive or abusive acts or practices,” referred to as UDAAP, which have been delegated to the Consumer Financial Protection Bureau (“CFPB”) for supervision. The CFPB has published its first Supervision and Examination Manual that addresses compliance with and the examination of UDAAP. The potential reach of the CFPB’s broad new rulemaking powers and UDAAP authority on the operations of financial institutions offering consumer financial products or services, including PeoplesBank, is currently unknown.

The CFPB has broad rulemaking authority for a wide range of consumer protection laws that apply to all banks and savings institutions, including the authority to prohibit “unfair, deceptive or abusive” acts and practices. In this regard, the CFPB has several rules that implement various provisions of the Dodd-Frank Act that were specifically identified as being enforced by the CFPB. While PeoplesBank is subject to the CFPB regulations, because it has less than $10 billion in total consolidated assets, the FDIC and the PADOBS are responsible for examining and supervising PeopleBank’s compliance with these consumer financial laws and regulations.

Community Reinvestment Act. All insured depository institutions have a responsibility under the Community Reinvestment Act (“CRA”) and related regulations to help meet the credit needs of their communities, including low- and moderate-income neighborhoods. An institution’s failure to comply with the provisions of the CRA could result in restrictions on its activities. The CRA does not establish specific lending requirements or programs for financial institutions nor does it limit an active participantinstitution’s discretion to develop the types of products and services that it believes are best suited to its particular community, consistent with the CRA. The CRA requires the FDIC, in connection with its

examination of a state bank, to assess the institution’s record of meeting the credit needs of its community and to take such record into account in its evaluation of certain applications by such institution, including applications to acquire branches and other financial institutions. PeoplesBank received a “satisfactory” CRA rating in its most recently completed examination in 2022.

On October 24, 2023, the federal banking agencies jointly issued a final rule to revise the regulations implementing the CRA. The final rule takes effect on April 1, 2024, with staggered compliance dates; the applicability date for most of the provisions is January 1, 2026. The changes are designed to encourage banks to expand access to credit, investment and banking services in low and moderate income communities, adapt to changes in the SBA Paycheckbanking industry including mobile and internet banking, provide greater clarity and consistency in the application of the CRA regulations and tailor CRA evaluations and data collection to bank size and type. The final rule implements a revised regulatory framework that, like the current framework, is based on bank asset size and business model. Under the final rule, a new “Retail Lending Test” is established. The Retail Lending Test evaluates a bank’s record of helping to meet the credit needs of its community through the origination and purchase of residential mortgage, multi-family, small business, small farm and, in certain cases, automobile loans. Banks of all sizes will maintain the option to elect to be evaluated under a strategic plan with the final rule updating the standards for obtaining approval for such plan. The final rule continues the current approach of requiring banks to delineate specific “facility-based assessment areas,” which comprise the areas around a bank’s main office, branches, and deposit-taking remote service facilities (e.g., ATMs). The final rule allows banks to receive CRA credit for any qualified community development activity, regardless of location.

Consumer Protection Program,and Fair Lending Regulations. Pennsylvania-chartered banks are subject to a variety of federal statutes and regulations that are intended to protect consumers and prohibit discrimination in the granting of credit. These statutes and regulations provide for a range of sanctions for non-compliance with their terms, including the imposition of administrative fines and remedial orders, and referral to the Attorney General for prosecution of a civil action for actual and punitive damages and injunctive relief. Certain of these statutes authorize private individual and class action lawsuits and the award of actual, statutory and punitive damages and attorneys’ fees for certain types of violations.

Commercial Real Estate Guidance. Under guidance issued by the federal banking agencies, the agencies have expressed concerns with institutions that ease commercial real estate underwriting standards and have directed financial institutions to maintain underwriting discipline and exercise risk management practices to identify, measure and monitor lending risks. The agencies have also issued guidance that requires a financial institution to employ enhanced risk management practices if the institution is exposed to significant concentration risk. Under that guidance, an institution is potentially exposed to significant concentration risk if: (i) total reported loans for construction, land development, and other land represent 100% or more of total capital or (ii) total reported loans secured by multi-family and non-farm residential properties, loans for construction, land development, and other land loans otherwise sensitive to the general commercial real estate market, including loans to commercial real estate related entities, represent 300% or more of total capital, and the outstanding PPP loans asbalance of the institution's commercial real estate loan portfolio has increased by 50% or more during the prior 36 months. As of December 31, 20202023, PeoplesBank’s aggregate recorded loan balances for construction, land development and land loans amounted to 72% of approximately $143 million.its total regulatory capital. In addition, at December 31, 2023, PeoplesBank’s commercial real estate loans, as defined by the guidance, were 279% of its total regulatory capital.

Other Regulations. Interest and other charges collected or contracted for by PeoplesBank are subject to state usury laws and federal laws concerning interest rates. Loan operations are also subject to state and federal laws applicable to credit transactions, such as the:

TheTruth-In-LendingAct,governingdisclosuresofcredittermstoconsumer borrowers;

The Real Estate Settlement Procedures Act, requiring that borrowers for mortgage loans for one-to four-family residential real estate receive various disclosures, including good faith estimates of settlement costs, lender servicing and escrow account practices, and prohibiting certain practices that increase the cost of settlement services;

Home Mortgage Disclosure Act of 1975, requiring financial institutions to provide information to enable the public and public officials to determine whether a financial institution is fulfilling its obligation to help meet the housing needs of the community it serves;

Equal Credit Opportunity Act, prohibiting discrimination on the basis of race, creed or other prohibited factors in extending credit;

Fair Credit Reporting Act of 1978, governing the use and provision of information to credit reporting agencies; and

Rules and regulations of the various federal and state agencies charged with the responsibility of implementing such federal and state laws.

The deposit operations of PeoplesBank also are subject to, among others, the:

TheTruthinSavingsAct,whichspecifiesdisclosurerequirementswithrespecttodeposit accounts;

Right to Financial Privacy Act, which imposes a duty to maintain the confidentiality of consumer financial records and prescribes procedures for complying with administrative subpoenas of financial records;

Check Clearing for the 21st Century Act (also known as “Check 21”), which gives “substitute checks,” such as digital check images and copies made from that image, the same legal standing as the original paper check; and

Electronic Funds Transfer Act and Regulation E promulgated thereunder, which govern automatic deposits to and withdrawals from deposit accounts and customers’ rights and liabilities arising from the use of automated teller machines and other electronic banking services.

Federal Home Loan Bank System. PeoplesBank is a member of the Federal Home Loan Bank of Pittsburgh, which is one of 11 regional Federal Home Loan Banks. Each Federal Home Loan Bank serves as a reserve or central bank for its members within its assigned region. It is funded primarily from proceeds from the sale of consolidated obligations of the Federal Home Loan Bank System. It makes loans to members (i.e., advances) in accordance with policies and procedures established by the board of directors of the Federal Home Loan Bank.

As a member, PeoplesBank is required to purchase and maintain stock in the Federal Home Loan Bank of Pittsburgh in an amount in accordance with the Federal Home Loan Bank’s capital plan and sufficient to ensure that the Federal Home Loan Bank remains in compliance with its minimum capital requirements. At December 31, 2023, PeoplesBank was in compliance with this requirement.

Federal Reserve Board. The Federal Reserve Board requires all depository institutions to maintain non-interest bearing reserves at specified levels against their transaction accounts, which are primarily checking and NOW accounts, and non-personal time deposits. The balances maintained to meet the reserve requirements imposed by the Federal Reserve Board may be used to satisfy the liquidity requirements that are imposed by the PADOB. In 2020, due to a change in its approach to monetary policy due to COVID-19, the Federal Reserve Board implemented a final rule to amend its reserve requirements and reduce reserve requirement ratios to zero. The Federal Reserve Board has indicated that it has no plans to re-impose reserve requirements, but may do so in the future if conditions warrant.

Future Laws and RegulationsRegulations.

Periodically, various federal and state legislation is proposed that could result in additional regulation of, and restrictions on, the business of Codorus Valley and PeoplesBank. It cannot be predicted whether such legislation will be adopted or, if adopted, how such legislation would affect the business of Codorus Valley and its subsidiaries. As a consequence of the extensive regulation of commercial banking activities in the United States, Codorus Valley’s and PeoplesBank’s business is particularly susceptible to being affected by federal legislation and regulations. The general cost of compliance with numerous federal and state laws and regulations has had, and in the future may have, a negative impact on Codorus Valley’s results of operations.

Other Information

This Annual Report on Form 10-K is filed with the Securities and Exchange Commission (SEC). Copies of this document, the Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, amendments to those reports and other

filings by Codorus Valley with the SEC may be obtained electronically at PeoplesBank’s website at www.peoplesbanknet.com (select “Your Life” or “Your Business”“About Us”, then select “Investor Relations”, then select “Filings”, then select “Documents”), or the SEC’s website at www.sec.gov. Copies can also be obtained without charge by writing to: Treasurer, Codorus Valley Bancorp, Inc., 105 Leader Heights Road, York, PA 17403.

Where we have included web addresses in this report, such as the Corporation’s web address, we have included these web addresses as inactive text references only. Except as specifically incorporated by reference into this report, information on those websites is not part hereof.

CAUTIONARY NOTE REGARDING FORWARD-LOOKING STATEMENTS AND SUMMARY OF RISK FACTORS

Forward-looking Statements

This Annual Report on Form 10-K (“Form 10-K”) may contain forward-looking statements by Codorus Valley Bancorp, Inc. (the “Corporation”). Forward-looking statements may include information concerning the financial condition, results of operations and business of the Corporation and its subsidiaries and include, but are not limited to, statements regarding expectations or predictions of future financial or business performance or conditions relating to the Corporation and its operations. These forward-looking statements may include statements with respect to the Corporation’s beliefs, plans, objectives, goals, expectations, anticipations, estimates and intentions, that are subject to significant risks and uncertainties, and are subject to change based on various factors (some of which are beyond the Corporation’s control). Forward-looking statements may also include, but are not limited to, discussions of strategy, financial projections and estimates and their underlying assumptions, statements regarding plans, objectives, goals, expectations or consequences, and statements about future performance, expenses, operations, or products and services of the Corporation and its subsidiaries. Forward-looking statements can be identified by the use of words such as “may,” “should,” “could,” “will,” “could,” “believes,” “plans,” “expects,” “estimates,” “forecasts,” “intends,” “anticipates,” “projects,” “strives to,” “seeks,” “intends” or similar words or expressions.

Forward-looking statements are not historical facts, nor should they be relied upon as providing assurance of future performance. Forward-looking statements are based on current beliefs, expectations and assumptions regarding the future of the Corporation’s business, including with respect to its pending Merger with Orrstown, future plans and strategies, projections, anticipated events and trends, the economy and other future conditions. Because forward-looking statements relate to the future, they are subject to inherent uncertainties, risks, and changes in circumstances that are difficult to predict and many of which are outside of the Corporation’s control. Note that many factors, some of which are discussed elsewhere in this report and in the documents that are incorporated by reference, could affect the future financial results of the Corporation and its subsidiaries, both individually and collectively, and could cause those results to differ materially from those expressed in the forward-looking statements contained or incorporated by reference in this Form 10-K. Actual results could differ materially from those indicated in forward-looking statements due to, among others, the following factors:

changes or volatility in market interest rates and the persistence of an inflationary environment in the U.S. and our market areas and the potential for an economic downturn or recession;

the effects of financial challenges at other banking institutions that could lead to depositor concerns that spread within the banking industry causing disruptive deposit outflows and other destabilizing results;

legislative and regulatory changes, and the uncertain impact of new laws and regulations;

monetary and fiscal policies of the federal government;

the effects of changes in accounting policies and practices;

ineffectiveness of the Corporation’s business strategy due to changes in current or future market conditions;

changes in deposit flows, the cost of funds, demand for loan products and the demand for financial services;

the remaining effects of the COVID-19 pandemic, including on the Corporation’s credit quality and operations as well as its impact on general economic conditions;

competition; market volatility, market downturns, changes in consumer behavior, business closures;

adverse changes in the quality or composition of the Corporation’s loan, investment and mortgage-backed securities portfolios, including from the effects of the recent inflationary environment;

geographic concentration of the Corporation’s business;

deterioration of commercial real estate values;

the adequacy of loan loss reserves;

deterioration in the credit quality of borrowers;

the Company’s ability to attract and retain key personnel, especially in light of the Proposed Transaction with Orrstown;

the impact of operational risks, including the risk of human error, failure or disruption of internal processes and systems, including of the Corporation’s information and other technology systems;

failure or circumvention of our internal controls;

the Corporation’s ability to keep pace with technological changes;

breaches of security or failures of the Corporation to identify and adequately address cybersecurity and data breaches;

changes in government regulation and supervision and the potential for negative consequences resulting from regulatory examinations, investigations and violations, in particular, the effect that such occurrences could have on the pending transaction with Orrstown; 

the effects of adverse outcomes from claims and litigation;

occurrence of natural or man-made disasters or calamities, including health emergencies, the spread of infectious diseases, epidemics or pandemics, an outbreak or escalation of hostilities or other geopolitical instabilities, the effects of climate change or extraordinary events beyond the Corporation's control, and the Corporation’s ability to deal effectively with disruptions caused by the foregoing; and

economic, competitive, governmental and technological factors affecting the Corporation’s operations, markets, products, services and fees.

In addition to the foregoing factors with respect to the Corporation’s business, the following factors and uncertainties exist with respect to the pending Merger with Orrstown:

the occurrence of any event, change or other circumstances that could give rise to the right of one or both of the parties to terminate the definitive agreement and plan of merger between the Corporation and Orrstown;

the outcome of any legal proceedings that may be instituted against the Corporation or Orrstown;

delays in completing the Proposed Transaction;

the failure to obtain necessary regulatory approvals (and the risk that such approvals may result in the imposition of conditions that could adversely affect the combined company or the expected benefits of the Proposed Transaction) or shareholder approvals;

the failure to satisfy any of the other conditions to the Proposed Transaction on a timely basis or at all, including the ability of the Corporation or Orrstown to meet expectations regarding the timing, completion and accounting and tax treatments of the Proposed Transaction;

the possibility that the anticipated benefits of the Proposed Transaction are not realized when expected or at all, including as a result of the impact of, or problems arising from, the integration of the two companies or as a result of the strength of the economy and competitive factors in the areas where the Corporation and Orrstown do business;

the possibility that the Proposed Transaction may be more expensive to complete than anticipated, including as a result of unexpected factors or events;

the possibility that revenues following the Proposed Transaction may be lower than expected; the impact of certain restrictions during the pendency of the Proposed Transaction on the parties’ ability to pursue certain business opportunities and strategic transactions;

diversion of management’s attention from ongoing business operations and opportunities;

potential adverse reactions or changes to business or employee relationships, including those resulting from the announcement or the completion of the Proposed Transaction;

the ability to complete the Proposed Transaction and integration of the Corporation and Orrstown successfully;

the dilution caused by Orrstown’s issuance of additional shares of its capital stock in connection with the Proposed Transaction; and

the potential impact of general economic, political or market factors on the companies or the Proposed Transaction and other factors that may affect future results of the Corporation or Orrstown.

The Corporation does not commit to update or revise any forward-looking statements, whether written or oral, that may be made from time to time by or on behalf of the Corporation to reflect events or circumstances occurring after the date of this report.

Summary of Risk Factors

Our business is subject to a number of risks that could cause actual financial results to differ materially from those indicated in this Form 10-K, including from the cautionary factors referenced in the Forward-Looking Statements herein, or the financial results presented elsewhere from time to time. The risks and uncertainties described below are not the only ones facing the Corporation. Additional risks and uncertainties that we are not aware of or focused on, or that we currently deem immaterial, may also adversely impact our business and results of operations. If any of these known or unknown risks or uncertainties actually occurs, our business, financial condition and results of operations could be materially and adversely affected. If this were to happen, the market price of our common stock could decline significantly, and you could lose all or part of your investment. These risks are discussed more fully in this Item 1A and included, without limitation, the following:

Risks Related to Macroeconomic Conditions

Difficult economic conditions or volatility in the financial markets would likely have an adverse effect on our business, financial position and/or results of operations.

If the U.S. Congress were not to act favorably on measures to raise the debt ceiling, the U.S. government could default on payment of its debt and other financial obligations. This could lead to a government shutdown and other consequences which could adversely affect the United States economy and financial institutions, including us.

Financial difficulties at other banking institutions could lead to depositor concerns that spread within the banking industry causing disruptive deposit outflows and other destabilizing results.

Insufficient liquidity could impair our ability to fund operations and jeopardize our financial condition, growth and prospects.

The continuing COVID-19 pandemic has, and may continue to, adversely affect our business, financial condition, liquidity, capital and results of operations.

Risks Related to Market Interest Rates and Inflation

Ourbusinessissubjecttointerestraterisk,andvariations or volatility ininterestratesmaymateriallyandadverselyaffect our financial performance.

Inflation can have an adverse impact on our business and on our customers.

Risks Related to our Lending Activities

Our loan portfolio primarily consists of commercial-related loans, including commercial real estate and construction loans. These loans involve credit risks that could adversely affect our financial condition and results of operations.

Our emphasis on real estate loans exposes us to lending risks.

The geographic concentration of our loan portfolio and lending activities makes us vulnerable to a downturn in our local market area.

If our allowance for credit losses is not sufficient to cover actual loan losses, our earnings could decrease.

The level of our commercial real estate loan portfolio may subject us to additional regulatory scrutiny.

Nonperforming assets take significant time to resolve, adversely affect our results of operations and financial condition, and could result in further losses in the future.

We engage in lending secured by real estate and may foreclose on the collateral and own the underlying real estate, subjecting us to the costs and potential risks associated with the ownership of real property, or consumer protection initiatives or changes in state or federal law may substantially raise the cost of foreclosure or prevent us from foreclosing at all.

We are exposed to the risk of environmental liability associated with lending activities or properties we own.

The transition from the use of LIBOR may adversely impact interest rates paid on certain financial instruments.

Risks related to Liquidity

Wearesubjecttoliquidityrisk,whichcouldadverselyaffectourfinancialconditionandresultsof operations.

Risks Related to Competitive Matters

Strong competition within our market areas may limit our growth and profitability.

Our asset size may make it more difficult for us to compete.

Risks Related to Laws and Regulations

Changes in laws and regulations and the cost of regulatory compliance with new laws and regulations may adversely affect our operations and/or increase our costs of operations and/or decrease our revenues.

Non-compliance with the USA PATRIOT Act, Bank Secrecy Act, or other laws and regulations could result in fines or sanctions.

The Federal Reserve Board may require us to commit capital resources to support PeoplesBank, and we may not have sufficient access to such capital resources.

Monetary policies and regulations of the Federal Reserve Board could adversely affect our business, financial condition and results of operations.

We may be required to raise additional capital in the future, but that capital may not be available when it is needed, or it may only be available on unacceptable terms, which could adversely affect our financial condition and results of operations.

We qualify as a “smaller reporting company” pursuant to regulations of the Securities and Exchange Commission, and any decision on our part to comply only with certain reduced reporting and disclosure requirements applicable to smaller reporting companies could make our common stock less attractive to investors.

Risks Related to Operational Matters

We face significant operational risks because of our reliance on technology. Our information technology systems may be subject to failure, interruption or security breaches.

We face significant operational risks because the nature of the financial services business involves a high volume of transactions.

We rely on third-party vendors, which could expose us to additional cybersecurity risks.

Thesoundnessofotherfinancialinstitutionscouldadverselyaffectus.

We may be subject to risks and losses resulting from fraudulent activities that could adversely impact our financial performance and results of operations.

We continually encounter technological change, and we may have fewer resources than many of our competitors to invest in technological improvements.

Risks Related to Accounting Matters

Changes in accounting standards could affect our reported earnings.

Changes in management’s estimates and assumptions may have a material impact on our consolidated financial statements and our financial condition or operating results.

Other Risks Related to Our Business

We depend on our management team and other key personnel to implement our business strategy and execute successful operations and we could be harmed by the loss of their services or the inability to hire additional personnel.

Legal and regulatory proceedings and related matters could adversely affect us.

Societal responses to climate change could adversely affect our business and performance, including indirectly through impacts on our customers.

We are a community bank and our ability to maintain our reputation is critical to the success of our business, and the failure to do so may materially adversely affect our performance.

Risks Related to Our Pending Merger with Orrstown

Regulatory approval of the Merger may not be received, may take longer than expected or may impose conditions that are not presently anticipated or cannot be met.

The ability of the Corporation and Orrstown to complete the Merger is subject to the satisfaction (or waiver by the parties) of the closing conditions set forth in the Merger Agreement, some of which are outside of the parties’ control.

The Merger Agreement contains provisions that may discourage other companies from pursuing, announcing or submitting a business combination proposal to the Corporation that might result in greater value to the Corporation’s stockholders.

Stockholder litigation could prevent or delay the closing of the proposed Merger with Orrstown or otherwise negatively affect the Corporation‏’‏s business and operations.

Because the market price of Orrstown‏’‏s common stock may fluctuate, the Corporation‏’‏s stockholders cannot be certain of the precise value of the merger consideration they may receive in our proposed Merger with Orrstown.

Codorus Valley will be subject to business uncertainties and contractual restrictions while the Merger is pending.

Failure of the Merger to be completed, the termination of the Merger Agreement or a significant delay in the consummation of the Merger could negatively impact the Corporation.

The Corporation will incur transaction and integration costs in connection with the Merger and, if the Merger is not completed, the Corporation will have incurred substantial expenses without realizing the expected benefits of the Merger.

The combined company may be unable to retain the Corporation’s and/or Orrstown’s personnel successfully after the Merger is completed.

The future results of the combined company following the Merger may suffer if the combined company does not effectively manage its expanded operations.

Combining the Corporation with Orrstown may be more difficult, costly or time-consuming than expected, and the Corporation and Orrstown may fail to realize the anticipated benefits of the Merger.

Risks Related to Our Common Stock

The market price of our common stock may fluctuate significantly, and this may make it difficult for you to resell shares of common stock owned by you at times or at prices you find attractive.

The trading volume of our common stock may not provide adequate liquidity for investors and is less than that of other financial services companies.

If our pending merger with Orrstown does not proceed, we may issue additional common stock or other equity securities in the future which could dilute the ownership interest of existing stockholders.

Offerings of debt and/or preferred equity securities may adversely affect the market price of our common stock.

Our common stock is subordinate to our existing and future indebtedness and preferred stock, if issued, and effectively subordinated to all the indebtedness and other non-common equity claims against our subsidiaries.

Regulatory and contractual restrictions may limit or prevent us from paying dividends or repurchasing shares of our common stock, or we may choose not to pay dividends on or repurchase, our common stock.

If we defer payments of interest on our outstanding subordinated notes or junior subordinated debt securities or if certain defaults relating to those debt securities occur, we will be prohibited from declaring or paying dividends or distributions on, and from making liquidation payments with respect to, our common stock.

Our common stock is not insured by any governmental entity.

Anti-takeover provisions and restrictions on ownership could negatively impact our stockholders.

Item 1A: Risk Factors

Before investing in our common stock, you should carefully consider the risks described below, in addition to the other information contained in this report and in our other filings with the SEC. Unless the context otherwise requires, references to “we,” “us,” “our,” “Codorus Valley Bancorp, Inc.,” “Codorus Valley” or the “Corporation” refer to Codorus Valley Bancorp, Inc. and its direct or indirect owned subsidiaries, and references to the “Bank” refer“PeoplesBank” refers to PeoplesBank, aA Codorus Valley Company, the wholly-ownedwholly owned banking subsidiary of the Corporation.

Risks Related to Macroeconomic Conditions

Difficult economic conditions or volatility in the financial markets would likely have an adverse effect on our business, financial position and uncertainties described below are not the only ones facing the Corporation. Additional risks and uncertainties that we are not awareresults of or focused on, or that we currently deem immaterial, may also impactoperations.

As a financial services company, our business and resultsoverall financial performance are vulnerable to the impact of operations. If anypoor or weak economic conditions, particularly in the United States but also to some extent in the global economy. Recessionary economic conditions, particularly if they are severe, are likely to have a negative financial impact across the financial services industry, including on Codorus Valley. Recessionary economic conditions can also lead to turmoil and volatility in financial markets, which can increase the adverse impact on financial institutions such as the Corporation. A return to recessionary economic conditions in the United States would likely adversely affect us, our business and financial performance. In addition, if the U.S. Congress in the future were not to act favorably on measures to raise the debt ceiling, the U.S. government could default on payment of its debt. This could lead to a government shutdown and other consequences which could adversely affect the United States economy and financial institutions, including us.

Financial difficulties at other banking institutions could lead to depositor concerns that spread within the banking industry causing disruptive deposit outflows and other destabilizing results.

The failures of Silicon Valley Bank in California, Signature Bank in New York and First Republic Bank in California during the first and second quarters of 2023 caused an element of panic and uncertainty in the investor community and among bank customers generally, including, specifically, deposit customers. While the Corporation does not believe that the circumstances of these knownthree failures, including, in several cases, the elevated concentrations of uninsured deposits, are necessarily indicators of broader issues for concern with all other banks or unknown riskswith the banking system itself, the failures are likely to continue to have an adverse effect on customer confidence and the availability of funding and liquidity, as well as possibly lead to increased regulatory requirements and costs and negative reputational ramifications for institutions in the banking industry, including, possibly, the Corporation and its PeoplesBank subsidiary. The Corporation will continue to closely monitor the ongoing events and volatility in the financial services industry, together with responsive measures by the banking regulators to mitigate or uncertainties actually occurs,manage the concerns of bank customers regarding FDIC deposit insurance coverage and the safety and soundness of community banks. The Corporation maintains a well-diversified deposit base and has a comparatively low level of uninsured deposits. As of December 31, 2023, 83% of our deposits are estimated to be FDIC-insured, and an additional 7% of deposits were fully collateralized.

Insufficient liquidity could impair our ability to fund operations and jeopardize our financial condition, growth and prospects.

We require sufficient liquidity to fund loan commitments, satisfy depositor withdrawal requests, make payments on our debt obligations as they become due, and meet other cash commitments. Liquidity risk is the potential that we will be unable to meet our obligations as they become due because of an inability to liquidate assets or obtain adequate funding at a reasonable cost, in a timely manner and without adverse conditions or consequences. Our sources of liquidity consist primarily of cash, assets readily convertible to cash (such as investment securities), increases in deposits, borrowings, as needed, from the Federal Home Loan Bank of Pittsburgh and the Federal Reserve Bank of Philadelphia, and other borrowings. Our access to funding sources in amounts adequate to finance our activities or on acceptable terms could be impaired by factors that affect our organization specifically or the financial services industry or economy in general. Any substantial, unexpected, and/or prolonged change in the level or cost of liquidity could impair our ability to fund operations and meet our obligations as they become due and could have a material adverse effect on our business, financial condition and results of operations could be materially and adversely affected. If this were to happen, the market price of our common stock could decline significantly, and you could lose all or part of your investment.operations.

Risks RelatedThe continuing COVID-19 pandemic has, and may continue to, Our Businessand Industry

Weakness in the economy may materially adversely affect our business, financial condition, liquidity, capital and results of operations.

Our resultsThe COVID-19 pandemic has adversely impacted the global and national economy and certain industries and geographies in which our customers operate. Given its ongoing and dynamic nature, it is difficult to predict the full impact of operationsthe continuing COVID-19 pandemic on the business of the Corporation, its customers, employees and third-party service providers. The extent of such impact will depend on future developments, which are materially affected by conditionshighly uncertain. Additionally, the responses of various governmental and non-governmental authorities and consumers to the on-going pandemic may have material long-term effects on Codorus Valley and our subsidiary PeoplesBank and its customers which are difficult to quantify in the economy generally, which continue to be uncertain and include uneven economic growth, accompanied by low interest rates. Dramatic declines in the housingnear-term or long-term.

Risks Related to Market Interest Rates and Inflation

Ourbusinessissubjecttointerestraterisk,andvariations and/or volatility ininterestratesmaymateriallyandadverselyaffect our financial performance.

Changes in the interest rate environment may reduce our profits. It is expected that we will continue to realize income fromthedifferentialor“spread”betweentheinterestearnedonloans,securitiesandotherinterest-earningassets,andthe interest paid on deposits, borrowings andother interest-bearing liabilities.Our interestspread isaffected, inpart, by the difference between the maturities and repricing characteristics of interest-earning assets and interest-bearing liabilities. Changes in market followinginterest rates generally affect loan volume, loan yields, funding sources and funding costs. Our net interest spread depends on many factors that are partly or completely out of our control, including competition, general economic conditions, and federal economic monetary and fiscal policies, and in particular, the 2008Federal Reserve Board’s policy determinations with respect to interest rates.

While an increase in interest rates may increase our loan yield, it may adversely affect the ability of certain borrowers with variable-rate loans to pay the contractual interest and principal due to us. Following an increase in interest rates, our abilitytomaintainapositivenetinterestspreadisdependentonourabilitytoincreaseourloanofferingrates,replaceloans thatmatureandrepayorthatprepaybeforematuritywithneworiginationsathigherrates,minimizeincreasesonourdeposit rates,and maintain anacceptable level andcomposition offunding. We cannot provide assurances that we will be able to increase our loan offering rates and continue to originate loans due to the competitive landscape in which we operate. Additionally, we cannot provide assurances that we can minimize the increases in our deposit rates while maintaining an acceptable level of deposits. Finally, we cannot provide any assurances that we can maintain our desirable levels of noninterest-bearing deposits as customers may seek higher-yielding products when interest rates increase.

Accordingly, changes in levels of interest rates could materially and adversely affect our net interest spread, net interest margin, asset quality, loan origination volume, average loan portfolio balance, liquidity, and overall profitability.

Furthermore, a sustained increase in market interest rates could adversely affect our earnings. A significant portion of our loans have fixed interest rates and longer terms than our deposits and borrowings. As is the case with many other financial crisis,institutions, our emphasis on increasing the development of core deposits, which bear no or a relatively low rate of interest with falling home prices and increasing foreclosures and unemployment,no stated maturity date, has resulted in our having a significant write-downsamount of asset values by financial institutions. While conditionsthese deposits that have improved, a returnshorter duration than our assets. At December 31, 2023, we had $360.4 million in certificates of deposit that mature within one year and $1.42 billion in checking, savings, and money market accounts. We incur a higher cost of funds to retain these deposits in a recessionary or excessive inflationary economyrising interest rate environment, such as was experienced throughout 2023, and our net interest income could resultbe adversely affected if the rates we pay on deposits and borrowings increase more rapidly than the rates we earn on loans and other investments.

Changes in financial stressinterest rates also affect the value of our interest-earning assets and in particular our debt securities portfolio. Generally, the fair value of fixed-rate debt securities fluctuates inversely with changes in interest rates. Unrealized gains and losses on debt securities available for sale are reported as a separate component of equity, net of tax. Decreases in the fair value of debt securities available for sale resulting from increases in interest rates could have an adverse effect on the amount of our stockholders’ equity.

We monitor our interest rate sensitivity using a simulation model which generates estimates of the changes in our net interest income over a range of interest rate scenarios. As of December 31, 2023, in the event of an instantaneous 100 basis point increase in interest rates, we estimate that we would experience a 1.6% decrease in net interest income. For further discussion of how changes in interest rates could impact us, see “Item 7A-Quantitative and Qualitative Disclosures About Market Risk.”

Inflation can have an adverse impact on our business and on our customers.

Inflation risk is the risk that the value of assets or income from investments will be worth less in the future as inflation decreases the value of money. Since 2021, there have been market indicators of a pronounced rise in inflation and the Federal Reserve Board raised certain benchmark interest rates 11 times in 2022 and 2023 in an effort to combat inflation. As discussed above under “—Our business is subject to interest rate risk, and variations and/or volatility in

interest rates may materially and adversely affect our financial performance,” as inflation increases and market interest rates rise the value of our investment securities, particularly those with longer maturities, decreases, although this effect can be less pronounced for floating-rate instruments. In addition, inflation generally increases the cost of goods and services we use in our business operations, such as electricity and other utilities, which increases our noninterest expenses. Furthermore, our customers are also affected by inflation and the rising costs of goods and services used in their households and businesses, which could have a negative impact on their ability to repay their loans with us.

Risks Related to our Lending Activities

Our loan portfolio primarily consists of commercial-related loans, including commercial real estate and construction loans. These loans involve credit risks that could adversely affect our financial condition and results of operations.

At December 31, 2023, commercial loans and commercial real estate loans totaled $1.14 billion, or 67.0% of our total loan portfolio. Given their generally larger balances and the complexity of the underlying collateral, commercial-related loans generally have more risk than the owner-occupied one-to-four family residential real estate loans that we also originate. In addition, recent years have witnessed substantial growth in commercial real estate markets, compounded by intensified competitive pressures that have led to historically low capitalization rates and surging property valuations. The economic disruption spurred by the continuing COVID-19 pandemic has particularly affected commercial real estate markets. Additionally, the pandemic has accelerated the adoption of remote work options, potentially influencing the long-term performance of certain office properties within our commercial real estate portfolio. Because the repayment of commercial-related loans often depends on the successful management and operation of the borrower’s properties or related businesses, repayment of such loans can be affected by adverse conditions in the local real estate market or economy. If we foreclose on these loans (for those having real estate collateral), our holding period for the collateral typically is longer than for a one-to-four family residential property because there are fewer potential purchasers of the collateral. In addition, because commercial-related loans, and commercial real estate loans in particular, typically involve larger loan balances to single borrowers thator groups of related borrowers compared to one-to-four family residential loans, charge-offs on commercial-related loans may be larger on a per loan basis than those incurred with our residential or consumer loan portfolios.

As our commercial-related loan portfolio increases, the corresponding risks and potential for losses from these loans may also increase, which would adversely affect consumer confidence, a reductionour business, financial condition and results of operations.

Our emphasis on real estate loans exposes us to lending risks.

At December 31, 2023, approximately $1.54 billion, or 90.2%, of our total loan portfolio,was secured by real estate, most of which is located in general business activityour primary lending market areas of South Central Pennsylvania, primarily York and increased market volatility. The resulting economic pressure on consumersLancaster Counties, and businessesNorth Central Maryland, primarily Baltimore and the lack of confidenceHartford Counties. Future declines in the financialreal estate values in our primary lending markets and surrounding markets could adversely affectsignificantly impair the value of the collateral securing our loans and our ability to sell the collateral upon foreclosure for an amount necessary to satisfy the borrower’s obligations to us. This could require us to increase our allowance for loan losses, which could have a material adverse effect on our business, financial condition, results of operations and stock price. Our ability to properly assess the creditworthinessgrowth prospects.

The geographic concentration of our clientsloan portfolio and lending activities makes us vulnerable to estimate the losses inherent in our credit exposure would be made more complex by these difficult market and economic conditions. Accordingly, if market conditions worsen, we may experience increases in foreclosures, delinquencies, write-offs and client bankruptcies, as well as more restricted access to funds.

Deteriorationa downturn in our local and regional economy or real estate market may adversely affect our business.area.

Substantially all ofUnlike larger financial institutions that are more geographically diversified, our business is with clients located within South Central Pennsylvania, principally York and Lancaster Counties and North Central Maryland, principally Harford County, Baltimore County and Baltimore City. As a result of this geographic concentration, our results depend largelyprofitability depends primarily on the general economic conditions in these and surroundingour primary market areas. Deterioration inLocal economic conditions inhave a significant impact on our commercial real estate, commercial and industrial, construction, residential real estate and consumer lending, including, the ability of borrowers to repay these markets could:

increase loan delinquencies;

increase problem assetsloans and foreclosures;

increase claims and lawsuits;

decrease the demand for our products and services; and

decrease the value of the collateral for loans, especially real estate, in turn reducing clients’ borrowing power, the value of assets associated with nonperforming loans and collateral coverage.

Generally,securing these loans. Furthermore, we generally make loans to small and mid-sized businesses whose success depends on the regional economy. These businesses generally have fewer financial resources in terms of capital or borrowing capacity than larger entities. Adverse economic and business conditions in our market area could reduce our growth rate, materially and adversely affect our borrowers’ ability to repay their loans and, consequently, adversely affect our financial condition and performance. For example, we place substantial reliance

Moreover, a significant decline in general economic conditions, caused by inflation, acts of terrorism, an outbreak of hostilities or other international or domestic calamities, such as the ongoing war in Ukraine and in Gaza, or other factors beyond our control could further impact these local economic conditions and could further negatively affect

our financial performance. In addition, deflationary pressures, while possibly lowering our operating costs, could have a significant negative effect on real estate as collateral for our loan portfolio. A sharp downturn in real estateborrowers, especially our business borrowers, and the values in our market area could leave many of our loans inadequately collateralized. If we are required to liquidate theunderlying collateral securing a loan to satisfy the debt during a period of reduced real estate values,loans, which could negatively affect our earnings could be adversely affected.financial performance.

If our allowance for loan and leasecredit losses is not sufficient to cover actual loan and lease losses, our earnings wouldcould decrease.

We are exposed tomake various assumptions and judgments about the risk thatcollectability of our loan portfolio, including the creditworthiness of our borrowers may default on their obligations. To absorb probable, incurred loan and lease losses that we may realize, we recognize an allowancethe value of the real estate and other assets serving as collateral for loan and lease losses based on, among other things, national and regional economic conditions, historical loss experience, and delinquency trends. However, we cannot estimate loan and lease losses with certainty, and we cannot assure you that charge-offs in future periods will not exceedthe repayment of many of our loans. In determining the amount of the allowance for loancredit losses, we review our loans and lease losses.our loss and delinquency experience, and we evaluate economic conditions. If charge-offs exceedour assumptions or the results of our analyses are incorrect, our allowance for credit losses may not be sufficient to cover losses inherent in our earnings would decrease.loan portfolio, resulting in additions to our allowance. In addition, regulatory agencies,our emphasis on loan growth, including our portfolio of commercial-related loans, as an integral partwell as any future credit deterioration, including as a result of their examination process,the possible recessionary pressures, could require us to increase our allowance for credit losses in the future. At December 31, 2023, our allowance for credit losses was 1.20% of total loans and 568.28% of nonperforming loans. Material additions to our allowance would materially decrease our net income.

The Financial Accounting Standards Board’s Current Expected Credit Losses, or CECL, standard was effective for Codorus Valley on January 1, 2023. CECL requires financial institutions to determine periodic estimates of lifetime expected credit losses on loans, and to recognize the expected credit losses as allowances for credit losses. The adoption of the CECL standard changed the prior method of providing allowances for loan losses that are incurred or probable. The change to the CECL standard increased the types of data we need to collect and review in order to determine the appropriate level of the allowance for credit losses.

In addition, bank regulators periodically review our allowance for loan and leasecredit losses and, as a result of such reviews, we may require additionsbe required to the allowance based on their judgment about information available to them at the time of their examination. Factors that require anincrease our provision for credit losses or recognize further loan charge-offs. Any increase in our allowance for loan and leasecredit losses such as a prolonged economic downturn or continued weakening in general economic conditions such as inflation, recession, unemployment or other factors beyond our control, could reduce our earnings.

Our exposure to credit risk, which is heightened by our focus on commercial lending, could adversely affect our earnings and financial condition.

There are certain risks inherent in making loans. These risks include interest rate changes over the time period in which loans may be repaid, risks resulting from changes in the economy, risks inherent in dealing with borrowers and, in the case of a loan backed by collateral, risks resulting from uncertainties about the future value of the collateral if a disposition is necessary.

Commercial loans, including commercial real estate, are generally viewed as having a higher credit risk than residential real estate or consumer loans because they usually involve larger loan balances to a single borrower and are more susceptible to a risk of default during an economic downturn. Our consolidated commercial lending

operations include commercial, financial and agricultural lending, real estate construction lending, and commercial mortgage lending. Construction financing typically involves a higher degree of credit risk than commercial mortgage lending. Risk of loss on a construction loan depends largely on the accuracy of the initial estimate of the property’s value at completion of construction compared to the estimated cost (including interest) of construction. If the estimated property value proves to be inaccurate, the loan may be inadequately collateralized.

Because our loan portfolio contains a significant number of commercial real estate, commercial and industrial loans, and construction loans, the deterioration of these loans may cause a significant increase in nonperforming loans. An increase in nonperforming loans could cause an increase in loan related legal fees and expenses, loan charge-offs and a corresponding increase in the provision for loan losses, which could adversely impact our financial condition and results of operations.

We depend primarily on net interest income for our earnings, and changes in interest rates could adversely impact our financial condition and results of operations.

Our ability to make a profit, like that of most financial institutions, substantially depends upon our net interest income, which is the difference between the interest income earned on interest earning assets, such as loans and investment securities, and the interest expense paid on interest-bearing liabilities, such as deposits and borrowings. Changes in interest rates can increase or reduce net interest income and net income.

Different types of assets and liabilities may react differently, and at different times, to changes in market interest rates. When interest-bearing liabilities mature or reprice more quickly than interest-earning assets in a period, an increase in market rates of interest could reduce net interest income. When interest-earning assets mature or reprice more quickly than interest-bearing liabilities, falling interest rates could reduce net interest income. Changes in market interest rates are affected by many factors beyond our control, including inflation, unemployment, money supply, international events, and events in the United States and other financial markets.

We attempt to manage risk from changes in market interest rates, in part, by controlling the mix of interest rate sensitive assets and interest rate sensitive liabilities. However, interest rate risk management techniques are not exact and a rapid increase or decrease in interest rates could adversely affect our financial performance. In the event that one or more of these factors were to result in a decrease in our net interest income, we do not have significant sources of fee income to make up for decreases in net interest income.

The planned phasing out of LIBOR as a financial benchmark presents risks to the financial instruments originated or held by the Corporation.

The London Interbank Offered Rate ("LIBOR") is the reference rate used for many of the Corporation's transactions, including variable and adjustable rate loans and borrowings. However, a reduced volume of interbank unsecured term borrowing, coupled with recent legal and regulatory proceedings related to rate manipulation by certain financial institutions, has led to international reconsideration of LIBOR as a financial benchmark. The United Kingdom Financial Conduct Authority ("FCA"), which regulates the process for establishing LIBOR, announced in July 2017 that the sustainability of LIBOR cannot be guaranteed. Accordingly, the FCA intends to stop persuading, or compelling, banks to submit rates for the calculation of LIBOR after 2021.

Regulators, industry groups and certain communities (e.g., the Alternative Reference Rates Committee) have, among other things, published recommended fallback language LIBOR-linked financial instruments, identified recommended alternatives for certain LIBOR rates (e.g., the Secured Overnight Financing Rate (“SOFR”) as the recommended alternative to U.S. Dollar LIBOR), and proposed implementations of the recommended alternatives in floating rate instruments. At this time, it is not possible to predict whether these recommendations and proposals will be broadly accepted, whether they will continue to evolve, and what the effect of their implantation may be on the markets for floating rate financial instruments. The uncertainty surrounding potential reforms, including the use of alternative reference rates and changes to the methods and processes used to calculate rates, may have an adverse effect on the trading market for LIBOR-based securities, loan yields, and the amount received and paid on derivative contracts and other financial instruments. In addition, the implementation of LIBOR reform proposals may result in increased compliance and operational costs.

We operate in a highly regulated environment and may be adversely affected by changes in laws and regulations.

The banking industry is heavily regulated, and such regulations are intended primarily for the protection of depositors and the federal deposit insurance fund, not shareholders. As a bank holding company, we are subject to regulation by the Federal Reserve. Our bank subsidiary is also regulated by the Federal Deposit Insurance Corporation, or FDIC, and is subject to regulation by the Pennsylvania Department of Banking and Securities and recently, by regulations promulgated by the Consumer Financial Protection Bureau (CFPB) as to consumer financial services and products. These regulations affect lending practices, capital structure, investment practices, dividend policy, and growth. In addition, we have non-bank operating subsidiaries from which we derive income. One of these non-bank subsidiaries, Codorus Valley Financial Advisors, Inc. d/b/a PeoplesWealth Advisors, engages in providing investment management and insurance brokerage services, industries that are also heavily regulated on both a state and federal level. In addition, newly enacted and amended laws, regulations, and regulatory practices affecting the financial service industry may result in higher capital requirements, higher insurance premiums and limit the manner in which we may conduct our business. Such changes may adversely affect us, including our ability to offer new products and services, obtain financing, attract deposits, make loans and leases and achieve satisfactory spreads, and may also result in the imposition of additional costs on us. As a public corporation, we are also subject to the corporate governance standards set forth in the Sarbanes-Oxley Act of 2002, as well as any applicable rules or regulations promulgated by the SEC and The NASDAQ Global Market.

Compliance with such current and potential regulation and scrutiny may significantly increase our costs, impede the efficiency of our internal business processes, affect retention of key personnel, require us to increase our regulatory capital, require us to invest significant management attention and resources and limit our ability to pursue business opportunities in an efficient manner.

We recently became subject to more stringent capital requirements.

The Dodd-Frank Act required the federal banking agencies to establish minimum leverage and risk-based capital requirements for insured banks and their holding companies. The federal banking agencies issued a joint final rule, or the Final Capital Rule, that implements the Basel III capital standards and establishes the minimum capital levels required under the Dodd-Frank Act. Certain capital requirements mandated by the Final Capital Rule became effective January 1, 2015. The Final Capital Rule establishes a minimum common equity Tier I capital ratio of 6.5 percent of risk-weighted assets for a “well capitalized” institution and increases the minimum Tier I capital ratio for a “well capitalized” institution from 6 percent to 8 percent. Additionally, the Final Capital Rule requires an institution to maintain a 2.5 percent common equity Tier I capital conservation buffer over the 6.5 percent minimum risk-based capital requirement for “adequately capitalized” institutions, or face restrictions on the ability to pay dividends, discretionary bonuses, and engage in share repurchases. For bank holding companies under $15 billion in assets as of December 31, 2009, the Final Capital Rule permanently grandfathers trust preferred securities issued before May 19, 2010, subject to a limit of 25 percent of Tier I capital. The Final Capital Rule increases the required capital for certain categories of assets, including high-volatility construction real estate loans and certain exposures related to securitizations; however, the Final Capital Rule retains the current capital treatment of residential mortgages. Implementation of these standards, or any other new regulations, may adversely affect our ability to pay dividends, or require us to reduce business levels or raise capital, including in ways that may adversely affect our results of operations or financial condition.

The soundness of other financial services institutions may adversely affect our credit risk.

Our ability to engage in funding transactions could be adversely affected by the actions and failure of other financial institutions. Financial services institutions are interrelated as a result of trading, clearing, counterparty,such review or other relationships. We have exposure to many different industries and counterparties, and we routinely execute transactions with counterparties in the financial services industry, including brokers and dealers, commercial banks, investment banks, mutual funds, and other institutional clients. As a result, defaults by, or even questions or rumors about, one or more financial services institutions, or the financial services industry generally, have led to market-wide liquidity problems and could lead to losses or defaults by us or other institutions. Many of these transactions expose us to operational and credit risk in the event of default of our counterparty or client. In addition, our credit risk may be exacerbated when the collateral held by us cannot be realized upon or is liquidated at prices not sufficient to recover the full amount of the loan or derivative exposure due us. Losses related to these credit risks could materially and adversely affect our results of operations or earnings.

We are required to make a number of judgments in applying accounting policies and different estimates and assumptions in the application of these policies could result in a decrease in capital and/or other material changes to our reports of financial condition and results of operations.

Material estimates that are particularly susceptible to significant change relate to the determination of the allowance for loan losses and reserve for unfunded lending commitments, the effectiveness of derivatives and other hedging activities, and the fair value of certain financial instruments (securities, derivatives, and privately held investments), income tax assets or liabilities (including deferred tax assets and any related valuation allowance), and share-based compensation. While we have identified those accounting policies that are considered critical and have procedures in place to facilitate the associated judgments, different assumptions in the application of these policies could result in a decrease to net income and, possibly, capital andotherwise may have a material adverse effect on our financial condition and results of operations.

The level of our commercial real estate loan portfolio may subject us to additional regulatory scrutiny.

FromThe FDIC and the other federal bank regulatory agencies have promulgated joint guidance on sound risk management practices for financial institutions with concentrations in commercial real estate lending. Under the guidance, a financial institution that, like us, is actively involved in commercial real estate lending should perform a risk assessment to identify concentrations. A financial institution may have a concentration in commercial real estate lending if, among other factors, (i) total reported loans for construction, land acquisition and development, and other land represent 100% or more of the institution’s total capital, or (ii) total reported loans secured by multi-family and non-farm residential properties, loans for construction, land acquisition and development and other land, and loans otherwise sensitive to the general commercial real estate market, including loans to commercial real estate related entities, represent 300% or more of total capital and the outstanding balance of the institution’s commercial real estate portfolio has increased by 50% or more in the prior 36 months. Based on these factors, we have concluded that we currently do not have a concentration in commercial real estate lending, as such loans represent 72% and 279%, respectively, of total bank capital as of December 31, 2023.

The particular focus of the guidance is on exposure to commercial real estate loans that are dependent on the cash flow from the real estate held as collateral and that are likely to be at greater risk to conditions in the commercial real estate market (as opposed to real estate collateral held as a secondary source of repayment or in an abundance of caution). The purpose of the guidance is to guide banks in developing risk management practices and determining capital levels commensurate with the level and nature of real estate concentrations. The guidance states that management should employ heightened risk management practices including board and management oversight and strategic planning, development of underwriting standards, risk assessment and monitoring through market analysis and stress testing. While we believe we have implemented policies and procedures with respect to our commercial real estate loan portfolio consistent with this guidance, bank regulators could require us to implement additional policies and procedures consistent with their interpretation of the guidance that may result in additional costs to us or that may result in the curtailment of our commercial real estate lending that would adversely affect our loan originations and profitability.

Nonperforming assets take significant time to time,resolve, adversely affect our results of operations and financial condition, and could result in further losses in the Financial Accounting Standards Board,future.

Our nonperforming assets adversely affect our net income in various ways. We do not record interest income on nonaccrual loans or FASB,OREO, thereby adversely affecting our net income and returns on assets and equity, increasing our loan administration costs and adversely affecting our efficiency ratio. When we take collateral in foreclosure and similar proceedings, we are required to mark the collateral to its then-fair market value, which may result in a loss. These nonperforming loans and OREO also increase our risk profile and the SEC changelevel of capital our regulators believe is appropriate for us to maintain in light of such risks. The resolution of nonperforming assets requires significant time commitments from management and can be detrimental to the performance of their other responsibilities. If we experience increases in nonperforming loans and nonperforming assets, our net interest income may be negatively impacted and our loan administration costs could increase, each of which could have an adverse effect on our net income and related performance ratios, such as return on assets and equity.

We engage in lending secured by real estate and may foreclose on the collateral and own the underlying real estate, subjecting us to the costs and potential risks associated with the ownership of real property, or consumer protection initiatives or changes in state or federal law may substantially raise the cost of foreclosure or prevent us from foreclosing at all.

Since we originate loans secured by real estate, we may have to foreclose on the collateral property to recover our investment and may thereafter own and operate such property, in which case we would be exposed to the risks inherent in the ownership of real estate. The amount that we, as a mortgagee, may realize after a foreclosure depends on factors outside of our control, including, but not limited to, general or local economic conditions, environmental cleanup liabilities, various assessments relating to the ownership of the property, interest rates, real estate tax rates, operating expenses of the foreclosed properties, our ability to obtain and maintain adequate occupancy of the properties, zoning laws, governmental and regulatory rules, and natural disasters. Our inability to manage the amount of costs or size of the risks associated with the ownership of real estate, or write-downs in the value of OREO, could have an adverse effect on our business, financial condition, and results of operations.

Additionally, consumer protection initiatives or changes in state or federal law may substantially increase the time and expenses associated with the residential foreclosure process or prevent us from foreclosing at all. A number of states in recent years have either considered or adopted foreclosure reform laws that make it substantially more difficult and expensive for lenders to foreclose on residential properties in default. Furthermore, federal regulators have prosecuted a number of mortgage servicing companies for alleged consumer law violations. If new state or federal laws or regulations are ultimately enacted that significantly raise the cost of residential foreclosures or raise outright barriers, they could have an adverse effect on our business, financial condition, and results of operations.

We are exposed to the risk of environmental liability associated with lending activities or properties we own.

A significant portion of our loan portfolio is secured by real estate, and we could become subject to environmental liabilities with respect to one or more of these properties, or with respect to properties that we own in operating our business. During the ordinary course of business, we may foreclose on and take title to properties securing defaulted loans. In doing so, there is a risk that hazardous or toxic substances could be found on these properties. If hazardous conditions or toxic substances are found on these properties, we may be liable for remediation costs, as well as for personal injury and property damage, civil fines and criminal penalties regardless of when the hazardous conditions or toxic substances first affected any particular property. The costs associated with investigation or remediation activities could be substantial. Environmental laws may require us to incur substantial expenses to address unknown liabilities and may materially reduce the affected property’s value or limit our ability to use or sell the affected property. In addition, future laws or more stringent interpretations or enforcement policies with respect to existing laws may increase our exposure to environmental liability. Our practice, which is to obtain an environmental review before initiating any foreclosure action on nonresidential real property, may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on us.

The transitionfromtheuseofLIBORmayadverselyimpacttheinterestratespaidoncertainfinancial instruments.

LIBOR was used as a reference rate for certain of the Corporation’s adjustable-rate commercial loans, as well as some of its related derivative debt instruments. In 2017, the U.K. Financial Conduct Authority, which regulates LIBOR, announced that the publication of LIBOR would not be guaranteed beyond 2021. In December 2020, the administrator of LIBOR announced its intention to (i) cease the publication of the one-week and two-month U.S. dollar LIBOR afterDecember 31, 2021, and (ii) cease the publication of all other tenors of U.S. dollar LIBOR (one, three, six and 12 month LIBOR) after June 30, 2023.

There are ongoing efforts to establish an alternative reference rate. The Federal Reserve Board, in conjunction with the Alternative Reference Rates Committee, a steering committee comprised of large U.S. financial institutions, supports replacingLIBORwithSOFR,anewindexcalculatedbyshort-termrepurchaseagreementsbackedbyTreasurysecurities.The Corporation adopted SOFR as its preferred benchmark as an alternative to LIBOR for use in new contracts beginning on or after January 1, 2022.

While theAdjustable Interest Rate (LIBOR)Act and implementing regulations will help to transition legacy LIBOR contractstoanewbenchmarkrate,thesubstitutionofSOFRforLIBORmayhavepotentiallysignificanteconomicimpactson parties to affected contracts. SOFR is different from LIBOR in that it is a retrospective-looking secured rate rather than a forward-looking unsecured rate. Additionally, while SOFR appears to be the preferred replacement rate for LIBOR, it is not possible to predict whether SOFR will ultimately prevail in the market as the definitive replacement for LIBOR. Uncertaintyas to the nature of alternative reference rates, and as to potential changes or other reforms related to the transition fromLIBOR, may adversely affect the value of LIBOR-based financial arrangements of the Corporation.

Risks related to Liquidity

Wearesubjecttoliquidityrisk,whichcouldadverselyaffectourfinancialconditionandresultsof operations.

Effectiveliquiditymanagementisessentialfortheoperationofourbusiness.Althoughwehaveimplementedstrategies to maintain sufficient and diverse sources of funding to accommodate planned, as well as unanticipated, liquidity needs (includingchangesinassets,liabilities,andoff-balancesheetcommitmentsundervariouseconomicconditions),aninability to raise funds through deposits, borrowings, the sale of investment securities and other sources could have a material adverse effect on our liquidity. Our access to funding sources in amounts adequate to finance our activities could be impaired byfactorsthataffectusspecificallyorthefinancialservicesindustryingeneral.Factorsthatcoulddetrimentallyimpact our accesstoliquiditysourcesincludeadecreaseinthelevelofourbusinessactivitydueto amarketdisruption,adecreasein theborrowingcapacityassignedtoourpledgedassetsbyoursecuredcreditors,competitionfromotherfinancialinstitutions, inflation whichcoulddriveupthecostsofdepositsoradverseregulatoryaction takenagainstus.Deteriorationineconomicconditionsand thelossofconfidenceinfinancialinstitutionsmay also increaseourcostoffundingandlimitouraccesstosomeofourcustomary sources of liquidity, including, but not limited to, inter-bank borrowings and borrowings from the Federal Home Loan Bank of Pittsburgh and the Federal Reserve Bank of Philadelphia. Our ability to acquire deposits or borrow could also be impaired by factors that are not specific to us, such as a severe disruption of the financial accountingmarkets or negative views and reporting guidanceexpectations about the prospects for the financial services industry generally as a result of conditions faced by banking organizations in the domestic and international credit markets. Any decline in available funding or increased costs of liquidity could adverselyimpactourability tooriginateloans,investinsecurities,meetourexpensesorfulfillobligationssuchasrepaying ourborrowingsormeetingdepositwithdrawaldemands,anyofwhichcould,inturn,haveanadverseeffectonourbusiness, financial condition, and results of operations.

Risks Related to Competitive Matters

Strong competition within our market areas may limit our growth and profitability.

Competition in the banking and financial services industry is intense. In our market area, we compete with commercial banks, savings institutions, mortgage brokerage firms, credit unions, finance companies, mutual funds, insurance companies, and securities brokerage firms as well as certain unregulated or less regulated non-banking entities, operating locally and elsewhere. Many of these competitors have substantially greater resources and higher lending

limits than we have and offer certain services that governs the preparationwe do not or cannot provide. If we must raise interest rates paid on deposits or lower interest rates charged on our loans to be competitive, our net interest margin and profitability could be adversely affected. In addition, some of our competitors offer loans with lower interest rates on more attractive terms than loans we offer. Competition also makes it increasingly difficult and costly to attract and retain qualified employees. Our profitability depends upon our continued ability to successfully compete in our market area.

The financial statements.services industry could become even more competitive as a result of new legislative, regulatory and technological changes and continued consolidation in the industry. Banks, securities firms and insurance companies can merge under the umbrella of a financial holding company, which can offer virtually any type of financial service, including banking, securities underwriting, insurance (both agency and underwriting) and merchant banking. Also, technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. Many of our competitors have fewer regulatory constraints and may have lower cost structures. Additionally, due to their size, many competitors may be able to achieve economies of scale and, as a result, may offer a broader range of products and services as well as better pricing for those products and services than we can. We expect competition to increase in the future as a result of legislative, regulatory and technological changes and the continuing trend of consolidation in the financial services industry.

Our asset size may make it more difficult for us to compete.

Our asset size may make it more difficult to compete with other financial institutions that are larger and can more easily afford to invest in the marketing and technologies needed to attract and retain customers. Because our principal source of income is the net interest income we earn on our loans and investments after deducting interest paid on deposits and other sources of funds, our ability to generate the revenues needed to cover our expenses and finance such investments is limited by the size of our loan and investment portfolios. Accordingly, we are not always able to offer new products and services as quickly as our competitors. Our lower earnings may also make it more difficult to offer competitive salaries and benefits. In addition, our smaller customer base may make it difficult to generate meaningful noninterest income from non-traditional banking activities. Finally, as a smaller institution, we are disproportionately affected by the continually increasing costs of compliance with new banking and other regulations.

Risks Related to Laws and Regulations

Changes in laws and regulations and the cost of regulatory compliance with new laws and regulations may adversely affect our operations and/or increase our costs of operations and/or decrease our revenues.

PeoplesBank is subject to extensive regulation, supervision and examination by the PADOBS and the FDIC, and the Corporation is subject to extensive regulation, supervision and examination by the Federal Reserve Board. Such regulation and supervision govern the activities in which an institution and its holding company may engage and are intended primarily for the protection of the federal deposit insurance fund and the depositors and borrowers of PeoplesBank, rather than for our stockholders.

Regulatory authorities have extensive discretion in their supervisory and enforcement activities, including the imposition of restrictions on our operations, the classification of our assets and influence of the level of our allowance for credit losses. These regulations, along with existing tax, accounting, securities, insurance and monetary laws, rules, standards, policies, and interpretations, control the methods by which financial institutions conduct business, implement strategic initiatives and tax compliance, and govern financial reporting and disclosures. Any change in such regulation and oversight, whether in the form of regulatory policy, regulations, legislation or supervisory action, may have a material impact on our operations. These changes are beyond our control, can be difficult to predict, and could materially impact, potentially even retroactively, how we report our financial condition and results of operations. WeFor example, in the interest of consumer protection, the Consumer Financial Protection Bureau (“CFPB”), has in recent periods been active in pursuing actions against financial institutions for charging certain fees that they have characterized as “junk fees.” These fees can take a number of forms, including without limitation, fees related to late loan payments, fees for insufficient funds, repossession fees and processing fees. In a number of instances the CFPB has challenged the imposition of fees by the involved financial institution without regard to whether such fees appropriately compensate the financial institution for the service provided and were disclosed to the customer. Although PeoplesBank is not regulated by the CFPB, the actions of the CFPB can have an influential impact on the supervisory actions of other bank regulators at the federal and state level, in particular, in PeoplesBank’s case, the FDIC as its primary federal banking regulator.

Non-compliance with the USA PATRIOT Act, Bank Secrecy Act, or other laws and regulations could result in fines or sanctions.

The USA PATRIOT and Bank Secrecy Acts require financial institutions to develop programs to prevent financial institutions from being used for money laundering and terrorist activities. If such activities are detected, financial institutions are obligated to file suspicious activity reports with the U.S. Treasury’s Office of Financial Crimes Enforcement Network. These rules require financial institutions to establish procedures for identifying and verifying the identity of customers seeking to open new financial accounts. Failure to comply with these regulations could result in fines or sanctions, including restrictions on pursuing acquisitions or establishing new branches. The policies and procedures we have adopted that are designed to assist in compliance with these laws and regulations may not be effective in preventing violations of these laws and regulations.

The Federal Reserve Board may require us to commit capital resources to support PeoplesBank, and we may not have sufficient access to such capital resources.

Federal law requires that a holding company act as a source of financial and managerial strength to its subsidiary bank and to commit resources to support such subsidiary bank. Under the “source of strength” doctrine, the Federal Reserve Board may require a holding company to make capital injections into a troubled subsidiary bank and may charge the holding company with engaging in unsafe and unsound practices for failure to commit resources to a subsidiary bank. A capital injection may be required at times when the holding company may not have the resources to provide it and therefore may be required to apply newattempt to borrow the funds or revised guidance retrospectively, which may result inraise capital. Thus, any borrowing that must be done by the revisionCorporation to make a required capital injection becomes more difficult and expensive and could have an adverse effect on our business, financial condition and results of prior financial statements by material amounts. The implementation of newoperations. Moreover, it is possible that we will be unable to borrow funds or revised guidance could result in material adverse effects to our reported capital.

otherwise raise capital at a time when it is needed.

We may elect or needbe required to seekraise additional capital in the future, but that capital may not be available when needed.

it is needed, or it may only be available on unacceptable terms, which could adversely affect our financial condition and results of operations.

We are required by federal and state regulatory authorities to maintain adequate levels of capital to support our operations. In the future, weWe may elect orat some point, however, need to raise additional capital.capital to support continued growth or be required by our regulators to increase our capital resources. Our ability to raise additional capital, if needed, will depend on conditions in the capital markets at that time, which are outside of our control, and on our financial performance. Accordingly, we cannot assure you of our abilitymay not be able to raise additional capital, if needed, on terms acceptable terms.to us. If we cannot raise additional capital when needed, our ability to further expand our operations through internaland pursue our growth or acquisitionsstrategy could be materially impaired.impaired and our financial condition and liquidity could be materially and adversely affected. In addition, if we are unable to raise additional capital when required by our bank regulators, we may be subject to adverse regulatory action.

Monetary policies and regulations of the Federal Reserve Board could adversely affect our business, financial condition and results of operations.

In addition to being affected by general economic conditions, our earnings and growth are affected by the policies of the Federal Reserve Board. An important function of the Federal Reserve Board is to regulate the money supply and credit conditions. Among the instruments used by the Federal Reserve Board to implement these objectives are open market purchases and sales of U.S. government securities, adjustments of the discount rate and changes in banks’ reserve requirements against bank deposits. These instruments are used in varying combinations to influence overall economic growth and the distribution of credit, bank loans, investments and deposits. Their use also affects interest rates charged on loans or paid on deposits.

The monetary policies and regulations of the Federal Reserve Board have had a significant effect on the operating results of financial institutions in the past and are expected to continue to do so in the future. The effects of such policies upon our business, financial condition and results of operations cannot be predicted.

We qualify as a “smaller reporting company” pursuant to regulations of the Securities and Exchange Commission (“SEC”), and any decision on our part to comply only with certain reduced reporting and disclosure requirements applicable to smaller reporting companies could make our common stock less attractive to investors.

We are a smaller reporting company, and, for as long as we continue to qualify as a smaller reporting company, we may choose to take advantage of exemptions from various reporting requirements applicable to other public companies but not to smaller reporting companies, including, but not limited to, reduced disclosure obligations regarding executive compensation in our periodic reports and proxy statements and two years of audited financial statements in our annual report instead of three years. As long as we are a smaller reporting company that is also not an accelerated filer, we will not be subject to Section 404(b) of the Sarbanes-Oxley Act, which would require that our independent registered public accounting firm review and attest as to the effectiveness of our internal control over financial reporting. In addition, as a non-accelerated filer, we have longer deadlines to file our periodic reports with the SEC.

We will remain a smaller reporting company and a non-accelerated filer for so long as our voting and non-voting equity held by non-affiliates (“public float”) is less than $250 million, or our annual revenues are less than $100 million and our public float is less than $700 million. Annual revenues for the year ending December 31, 2023 exceeded $100 million. As a result, we will become an accelerated filer beginning in the reporting period ending March 31, 2024, and at that time will become subject to Section 404(b) of the Sarbanes-Oxley Act and shorter deadlines to file our periodic reports with the SEC.

As a result of our current smaller reporting company status and non-accelerated filer status, our stockholders may not have access to certain information they may deem important, and investors may find our common stock less attractive if we choose to rely on these provisions allowing for reduced or scaled disclosures. This could result in a less active trading market for our common stock and the price of our common stock may be more volatile.

Risks associated with system failures, interruptions,Related to Operational Matters

We face significant operational risks because of our reliance on technology. Our information technology systems may be subject to failure, interruption or breaches of security could negatively affect our earnings. cybersecurity attacks or breaches.

Information technology systems are critical to our business.

Our business requires us to collect, process, transmit and store significant amounts of confidential information regarding our customers, employees and our own business, operations, plans and business strategies. We use various technology systems to manage our clientcustomer relationships, general ledger, securities investments, deposits, and loans. Business disruptions can occur dueOur computer systems, data management and internal processes, as well as those of third parties, are integral to forces beyond our performance. Our operational risks include the risk of malfeasance by employees or persons outside our company, errors relating to transaction processing and technology, systems failures or interruptions, breaches of our internal control such as severe weather, powersystems and compliance requirements, and business continuation and disaster recovery. There have been increasing efforts by third parties to breach data security at financial institutions. Such attacks include computer viruses, malicious or telecommunications loss, accidents, cyberattacks, terrorism, health emergencies, the spreaddestructive code, ransomware attacks, phishing attacks, denial of infectious diseasesservice or pandemics. We have established policies and procedures to preventinformation or limit the impact of system failures, interruptions, andother security breaches (including privacy breachesthat could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary and cyber-attacks), but such events may still occurother information, damages to systems, or may not be adequately addressed if they do occur. In addition, any compromise of our systems could deter clients from using our products and services.other material disruptions to network access or business operations. Although we take protective measures and believe that we have not experienced any of the data breaches described above, the security of our computer systems, software, and networks may be vulnerable to breaches, unauthorized access, misuse, computer viruses, or other malicious code and cyber-attacks that could have an impact on information security.

Because the methods used to cause security attacks and data breaches change frequently, the measures we take to prevent or counteract these attacks and data breaches may not be adequate to prevent them.

In addition, we outsourcethe event of a significant amountbreakdown in our internal control systems, improper operation of our systems or improper employee actions, or a breach of our security systems, including if confidential or proprietary information were to be mishandled, misused or lost, we could suffer financial loss, loss of customers and damage to our reputation, and face regulatory action or civil litigation. Any of these events could have a material adverse effect on our financial condition and results of operations. Our insurance coverage may not adequately address such losses, or if it does, such losses may exceed insurance limits. Furthermore, such events could adversely affect our reputation and thus adversely affect our business.

Wefacesignificantoperationalrisksbecausethenatureofthefinancialservicesbusinessinvolvesahighvolumeof transactions.

Weoperatein several diversemarketsandrelyontheabilityofouremployeesandsystemstoprocessahighnumberoftransactions.Operationalriskistherisk oflossresultingfromouroperations,includingbutnotlimitedto,theriskoffraudbyemployeesorpersonsoutsidethe Corporation,theexecutionofunauthorized transactions by employees, errors relating to transaction processing and technology, breaches of our internal control systems and compliance requirements. Insurance coverage may not be available for such losses, or where available, such losses may exceed insurance limits.This risk of loss also includes potential legal actions that could arise as a result of operational deficiencies or as a result of non-compliance with applicable regulatory standards, adverse business decisionsortheirimplementation,orcustomerattritionduetopotentialadverse publicity.Intheeventofabreakdowninourinternalcontrolsystems,improper operation of systems or improper employee actions, we could suffer financial loss, face regulatory action, and/or suffer damage to our reputation.

We rely on third-party vendors, which could expose us to additional cybersecurity risks.

Third-party vendors provide key components of our business infrastructure, including certain data processing and information services. Accordingly, our operations are exposed to certainrisk that these vendors will not perform in accordance with our contractual agreements with them, or we also could be adversely affected if such an agreement is not renewed by the third-party providers.vendor or is renewed on terms less favorable to us. If theseour third-party providers encounter difficulties, or if we have difficulty communicating with them,those service providers, our ability to adequately process and account for transactions could be affected, and our business operations could be adversely affected. While we have selected these third party vendors carefully, we do not control their actions. Any problems caused by these third parties, including as a result of their not providing us their services for any reason or their performing their services poorly, could adversely affect our ability to deliver products and services to our clients or otherwise conduct our business efficiently and effectively. Replacing these third party vendors could also entail significant delay and expense. Threats to information security also exist in the processing of client information through various other vendors and their personnel.

There have been increasing efforts on the part of third parties, including through cyber-attacks, to breach data security at financial institutions or with respect to financial transactions. There have been several recent instances involving financial services and consumer-based companies reporting the unauthorized disclosure of client or customer information or the destruction or theft of corporate data. In addition, because the techniques used to cause such security breaches change frequently, often are not recognized until launched against a target and may originate from less regulated and remote areas around the world, we may be unable to proactively address these techniques or to implement adequate preventative measures. The ability of our clients to bank remotely, including online and through

mobile devices, requires secure transmission of confidential information and increases the risk of data security breaches.

The occurrence of any system failures, interruption, or breach of security could damage our reputation and result in a loss of clients and business thereby subjecting us to additional regulatory scrutiny, or could expose us to litigation and possible financial liability. Any of these eventsaffected, which could have a material adverse effect on our financial condition and results of operations. We also rely on the integrity and security of a variety of third-party processors, payment, clearing and settlement systems, as well as the various participants involved in these systems, many of which have no direct relationship with us. Failure by these participants or their systems to protect our customers' transaction data may put us at risk for possible losses due to fraud or operational disruption. To our knowledge, to date, the services and programs provided to us by third parties have not resulted in any personal data of clients of PeoplesBank being compromised. However, the existence of cyber-attacks or security breaches at third parties with access to our data, such as vendors, may not be disclosed to us in a timely manner.

Thesoundnessofotherfinancialinstitutionscouldadverselyaffectus.

Ourabilitytoengageinroutinefundingtransactionscouldbeadverselyaffectedbytheactionsandcommercialsoundnessofotherfinancialinstitutions. Financial services institutions are interrelated as a result of trading, clearing, counterparty or other relationships.We have exposure to many differentindustries and counterparties, and we routinely execute transactions with counterparties in the financial industry.As a result, defaults by, or even rumors orquestionsabout,oneormorefinancialservicesinstitutions,orthefinancialservicesindustrygenerally,haveledtomarket-wideliquidityproblemsandcouldlead to losses or defaults by us or by other institutions. Many of these transactions expose us to credit risk in the event of default of our counterparty or client. Inaddition, our credit risk may be exacerbated when the collateral we hold cannot be realized upon or is liquidated at prices insufficient to recover the full amount of the loan. We cannot assure you that any such losses would not materially and adversely affect our business, financial condition or results of operations.

We may be subject to risks and losses resulting from fraudulent activities that could adversely impact our financial performance and results of operations.

OurAs a bank, we are susceptible to fraudulent activity that may be committed against us or our clients, which may result in financial losses or increased costs to us or our clients, disclosure or misuse of our information or our client information, misappropriation of assets, privacy breaches against our clients, litigation or damage to our reputation. We are most exposed to fraud and compliance risk in connection with the origination of loans, ACH transactions, wire transactions, ATM transactions, checking transactions, and debit cards that we have issued to our customers and through our online banking portals.

We maintain a system of internal controls and procedures may fail or could be circumvented.

Management regularly reviewsinsurance coverage to mitigate against such risks, including data processing system failures and updateserrors, and customer fraud. If our internal controls disclosure controls and procedures, and corporate governance policies and procedures in orderfail to ensure accurate financial control and reporting. Any system of controls, no matter how well designed and operated, can only provide reasonable,prevent or detect any such

occurrence, or if any resulting loss is not absolute assurance that the objectives of the system are met. Any failureinsured or circumvention of our controls and/or proceduresexceeds applicable insurance limits, it could have a material adverse effect on our business, financial condition and results of operation and financial condition.

We may incur fines, penalties and other negative consequences from regulatory violations, possibly even inadvertent or unintentional violations.

We maintain systems and procedures designed to ensure that we comply with applicable laws and regulations. However, some legal/regulatory frameworks provide for the imposition of fines or penalties for noncompliance even though the noncompliance was inadvertent or unintentional and even though there was in place at the time systems and procedures designed to ensure compliance. For example, we are subject to regulations issued by the Office of Foreign Assets Control, or OFAC, that prohibit financial institutions from participating in the transfer of property belonging to the governments of certain foreign countries and designated nationals of those countries. OFAC may impose penalties for inadvertent or unintentional violations even if reasonable processes are in place to prevent the violations. There may be other negative consequences resulting from a finding of noncompliance, including restrictions on certain activities. Such a finding may also damage our reputation as described below and could restrict the ability of institutional investment managers to invest in our securities.

The inability to hire or retain key personnel could adversely affect our business.

Our success is dependent upon our ability to attract and retain highly skilled individuals. We face intense competition from various other financial institutions, as well as from non-bank providers of financial services, such as credit unions, brokerage firms, insurance agencies, consumer finance companies and government organizations, for the attraction and retention of key personnel, specifically those who generate and maintain our client relationships and serve in other key operation positions in the areas of finance, credit oversight and administration, and wealth management. These competitors may offer greater compensation and benefits, which could result in the loss of potential and/or existing substantial client relationships and may adversely affect our ability to compete effectively. The unexpected loss of services of one or more of these or other key personnel could have a material adverse impact on our business because of their skills, knowledge of the markets in which we operate, years of industry experience and the difficulty of promptly finding qualified replacement personnel.

Damage to our reputation could significantly harm our business, including our competitive position and business prospects.

We are dependent on our reputation within our market area, as a trusted and responsible financial corporation, for all aspects of our relationships with clients, employees, vendors, third-party service providers, and others, with whom we conduct business or potential future business. Our ability to attract and retain clients and employees could be adversely affected if our reputation is damaged. Our actual or perceived failure to address various issues could give rise to reputational risk that could cause harm to us and our business prospects. These issues also include, but are not limited to, legal and regulatory requirements; properly maintaining client and employee personal information; record keeping; money-laundering; sales and trading practices; ethical issues; appropriately addressing potential conflicts of interest; and the proper identification of the legal, reputational, credit, liquidity and market risks inherent in our products. Failure to appropriately address any of these issues could also give rise to additional regulatory restrictions and legal risks, which could, among other consequences, increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties and incur related costs and expenses.

operations.

We continually encounter technological change, and we may have fewer resources than many of our competitors to continue to invest in technological improvements, which couldimprovements.

The financial services industry is undergoing rapid technological changes with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions to better serve customers and to reduce costs. Our future success will depend, in part, upon our ability to effectively compete.

Our future success depends, in part, on our ability to effectively embrace technological efficiencies to better serve clients and reduce costs. Manyaddress the needs of our competitorsclients by using technology to provide products and services that will satisfy client demands for convenience, as well as to create additional efficiencies in our operations. Many national vendors provide turn-key services to community banks, such as internet banking and remote deposit capture that allow smaller banks to compete with institutions that have substantially greater resources to invest in technological improvements. There canWe may not be no assurance that we will be able, however, to effectively implement new technology-driven products and services whichor be successful in marketing these products and services to our customers.

Risks Related to Accounting Matters

Changes in accounting standards could reduceaffect reported earnings.

The Financial Accounting Standards Board, SEC and other regulatory bodies, that are responsible for establishing accounting and reporting standards, periodically change the financial accounting and reporting guidance that governs the preparation of our financial statements. These changes can be hard to predict and can involve judgment and discretion in their interpretation by us and our independent accounting firm. These changes could materially impact, potentially even retroactively, how we report our financial condition and results of operations.

Changes in management’s estimates and assumptions may have a material impact on our consolidated financial statements and our financial condition or operating results.

In preparing the periodic reports that we are required to file with the SEC under the Securities Exchange Act of 1934, as amended, including our consolidated financial statements, our management is required under applicable rules and regulations to make estimates and assumptions as of a specified date. These estimates and assumptions are based on management’s best estimates and experience as of that date and are subject to substantial risk and uncertainty. Materially different results may occur as circumstances change and additional information becomes known. Areas requiring significant estimates and assumptions by management include, among others, our evaluation of the adequacy of our allowance for credit losses, the calculation of our deferred tax assets and our determinations with respect to the fair values of financial instruments.

Other Risks Related to Our Business

We depend on our management team and other key personnel to implement our business strategy and execute successful operations and we could be harmed by the loss of their services or the inability to hire additional personnel.

We depend on the services of the members of our senior management team who direct our strategy and operations. Our executive officers and lending personnel possess substantial expertise as well as extensive knowledge of our markets and key business relationships. Any one of them could be difficult to replace. Our loss of these persons, or our inability to hire additional qualified personnel, could impact our ability to effectively compete. Failure to keep pace with technological changeimplement our business strategy and could potentially have ana material adverse effect on our business operations and financial condition.

Competition from other financial institutions in originating loans, attracting deposits and providing various financial services may adversely affect our profitability.

Our banking subsidiary faces substantial competition in originating loans, both commercial and consumer. This competition comes principally from other banks, savings institutions, mortgage banking companies, and other lenders. Many of our competitors enjoy advantages over us, including greater financial resources and higher lending limits, a wider geographic presence, more accessible branch office locations, the ability to offer a wider array of services or more favorable pricing alternatives, as well as lower origination and operating costs. This competition could reduce our net income by decreasing the number and size of loans that our banking subsidiary originates and the interest rates it may charge on these loans.

In attracting business and consumer deposits, our bank subsidiary faces substantial competition from other insured depository institutions such as banks, savings institutions and credit unions, as well as institutions offering uninsured investment alternatives, including money market funds. Many of our competitors enjoy advantages over us, including greater financial resources, more aggressive marketing campaigns and better brand recognition and more branch locations. These competitors may offer higher interest rates than we do, which could decrease the deposits that we attract or require us to increase our rates to retain existing deposits or attract new deposits. Increased deposit competition could adversely affect our ability to generate the funds necessary for lending operations. As a result, we may need to seek other sources of funds that may be more expensive to obtain and could increase our cost of funds.

Our banking and non-banking subsidiaries also compete with non-bank providers of financial services, such as brokerage firms, consumer finance companies, credit unions, insurance companies and governmental organizations which may offer more favorable terms. Some of our non-bank competitors are not subject to the same extensive regulations that govern our banking operations. As a result, such non-bank competitors may have advantages over our banking and non-banking subsidiaries in providing certain products and services. This competition may reduce or limit our margins on banking and non-banking services, reduce our market share, and adversely affect our earnings and financial condition.

We may not be able to successfully maintain and manage our growth.

We continue to execute on our acquisition and organic branching initiatives, which are intended to develop our branch infrastructure in a manner more consistent with the expansion of lending markets and to fill in and grow our branch footprint. As we continue to grow through our acquisitions, branching and other strategic initiatives, we cannot be certain as to our ability to manage increased levels of assets and liabilities. We may be required to make additional investments in equipment and personnel to manage higher asset levels and loans balances, which may adversely impact our efficiency ratio, earnings and shareholder returns.

The financial impact and difficulties in integrating future acquisitions could adversely affect our business.

The efficient and effective integration of any businesses we acquire into our organization is critical to the financial success of an acquisition transaction. Any future acquisitions involve numerous risks, including difficulties in integrating the culture, operations, technologies and personnel of the acquired companies, the diversion of management’s attention from other business concerns and the potential loss of clients. Failure to successfully integrate the operations of any future acquisitions could also harm our business, results of operations and cash flows.ability to compete in our markets.

Legal and regulatory proceedings and related matters could adversely affect us.

The impactsWe have been and may in the future become involved in legal and regulatory proceedings. We consider most of COVID-19 pandemic

the proceedings to be in the normal course of our business or typical for the industry; however, it is inherently difficult to assess the outcome of these matters, and we may not prevail in any proceedings or litigation. In December 2019, a coronavirus (COVID-19) was reported in China,addition, should we become subject to any more significant legal or regulatory proceedings, such as potential litigation with regard to our pending Merger with Orrstown, we could incur substantial expense and in March 2020, the World Health Organization declared it a pandemic. Since first being reported in China, the coronavirus has spread to additional countries including the United States. On March 13, 2020, President Trump declared the ongoing COVID–19management diversion, and any adverse

pandemicdetermination could have a materially adverse effect on our business, brand or image, or our financial condition and results of sufficient severityour operations.

Societal responses to climate change could adversely affect our business and magnitudeperformance, including indirectly through impacts on our customers.

Concerns over the long-term impacts of climate change have led and will continue to warrant an emergency declarationlead to governmental efforts around the world to mitigate those impacts. Consumers and businesses also may change their behavior on their own as a result of these concerns. We and our customers will need to respond to new laws and regulations as well as consumer and business preferences resulting from climate change concerns. We and our customers may face cost increases, asset value reductions and operating process changes. The impact on our customers will likely vary depending on their specific attributes, including their reliance on or their involvement in carbon intensive activities. Among the impacts to us could be a drop in demand for all states, territories,our products and services, particularly in certain sectors. In addition, we could face reductions in creditworthiness on the part of some customers or in the value of assets securing loans. Our efforts to take these risks into account in making lending and other decisions, including by increasing our business with climate-friendly companies, may not be effective in protecting us from the negative impact of new laws and regulations or changes in consumer or business behavior.

We are a community bank and our ability to maintain our reputation is critical to the success of our business, and the Districtfailure to do so may materially adversely affect our performance.

We are a community bank, and our reputation is one of Columbia.the most valuable components of our business. A key component of our business strategy is to rely on our reputation for customer service and knowledge of local markets to expand our presence by capturing new business opportunities from existing and prospective customers in our market area and contiguous areas. As such, we strive to conduct our business in a manner that enhances our reputation. This is done, in part, by recruiting, hiring and retaining employees or by retaining, appointing or electing directors who share our core values of being an integral part of the communities we serve, delivering superior service to our customers and caring about our customers and employees. If our reputation is negatively affected by the actions of our employees or directors, by our inability to conduct our operations in a manner that is appealing to current or prospective customers, or otherwise, our business and, therefore, our operating results may be materially adversely affected.

Risks Related to our Pending Merger with Orrstown

In response, many state and local governments,Regulatoryapprovals of the Merger maynotbereceived,maytakelongerthanexpectedormayimposeconditionsthatarenotpresently anticipated or cannot be met.

Before the transactions contemplated by the Merger Agreement, including the Commonwealth of PennsylvaniaMerger and the StateBank Merger, may be completed,variousapprovalsmustbeobtainedfrombankregulatoryauthorities. In determining whether to grant these approvals, the applicable regulatory authorities consider a variety of Maryland, have instituted emergency restrictions that have substantially limitedfactors, including the operation of non-essential businesses and the activities of individuals. It has been widely reported that these restrictions have resulted in significant adverse effects for many different types of businesses, particularly those in the travel, hospitality and food and beverage industries, among many others, and has resulted in a significant number of layoffs and furloughs of employees nationwide and in the regions in which the Corporation operates. The ultimate effect of COVID-19 on the local or broader economy is not known nor is the ultimate length of the restrictions described and any accompanying effects. Moreover, the Federal Reserve has taken action to lower the Federal Funds rate, which has negatively affected interest income and, therefore, earnings. Given the ongoing and dynamic nature of the circumstances, it is difficult to predict the fullcompetitive impact of the coronavirus outbreak,proposal in the relevant geographic markets; financial, managerial and there is no guarantee that the Corporation’s efforts to address the adverse impactsother supervisory considerations of each party; convenience and needs of the coronavirus willcommunities to be effective. Theserved and the record of the insured depository institution subsidiaries under the Community Reinvestment Act of 1977 and the regulations promulgated thereunder; effectiveness of the parties in combating money laundering activities; any significant outstanding supervisory matters; and the extent to which the proposal would result in greater or more concentrated risks to the stability of the United States banking or financial system. Thesegovernmentalentitiesmayimpose conditions on the granting of such impact will dependapprovals. If the approval of the Merger includes conditions that Orrstown deems in its reasonable opinion to constitute a Burdensome Condition, as such term is defined in the Merger Agreement, Orrstown may refuse to proceed to consummate the Merger. Furthermore, conditions imposed by regulatory authorities, even if they are not deemed to constitute a Burdensome Condition, and the process of obtaining regulatory approvals could have the effect of delaying completion of the Merger or the Bank Merger or of imposing additional costs or limitations on future developments, which OrrstownorOrrstownBankfollowingtheMergerorthe Bank Merger.Theregulatoryapprovalsmaynotbereceivedatall,may notbereceivedinatimelyfashion,andmaycontainconditionsonthecompletionoftheMergerthatare highly uncertain andnotanticipatedor cannot be predicted, including new information which may emerge concerning the severitymet. If consummation of the coronavirus and actions taken to containMerger or the coronavirus or its impact, among others.

The effectBank Merger is delayed, including by a delay in receipt of COVID-19 and related events, including those described above and those not yet known or knowable, could have a negative effect onnecessary governmental approvals, the Corporation's business, prospects, financial condition and results of operations of each of Codorus Valley and Orrstown may also be materially adversely affected.

The ability of the Corporation and Orrstown to complete the Merger is subject to the satisfaction (or waiver by the parties) of the closing conditions set forth in the MergerAgreement, some of which are outside of the parties’control.

In addition to receipt of all necessary regulatory approvals, the Merger Agreement is subject to a number of conditions which must be fulfilled in order to complete the Merger. Those conditions include, among others: (i) approval of the Merger Agreement by Codorus Valley’s and the approval by Orrstown’s stockholders of the issuance of the shares of common stock of Orrstown as the consideration for the Merger and (ii) the absence of any governmental order, decree or injunction or law or regulation prohibiting completion of the Merger.

The obligation of each party to consummate the Merger is also conditioned upon (i) subject to certain exceptions, the accuracy of the representations and warranties of the other party, (ii) performance in all material respects by the other party of its obligations under the merger agreement, (iii) receipt by such party of a tax opinion to the effect that theMerger will qualify as a reorganization within the meaning of Section 368(a) of the Code and (iv) the effective registration with the SEC of the shares of common stock of Orrstown to be issued the Corporation’s stockholders in the Merger.

In addition, if the Merger is not completed by December 31, 2024, either the Corporation or Orrstown may choose not to proceed with the Merger. In addition, the parties can mutually decide to terminate the Merger Agreement at any time, before or after receipt of stockholder approval by the Corporation and/or Orrstown.

These conditions to the consummation of the Merger may not be fulfilled and, accordingly, the Merger may not be completed. If the Merger is not consummated, the ongoing business, financial condition and results of operation of the Corporation may be materially adversely affected and the market price of the Corporation’s common stock may decline significantly, particularly to the extent that the current market price reflects a market assumption that the Merger will be consummated. In addition, if the Merger Agreement is terminated and Corporation’s board of directors seeks another merger or business combination, the Corporation’s stockholders cannot be certain that the Corporation will be able to find a party willing to engage in a transaction on more attractive terms than the Proposed Transaction with Orrstown.

The Merger Agreement contains provisions that may discourage other companies from pursuing, announcing or submitting a business combination proposal to the Corporation that might result in greater value to the Corporation’s stockholders.

The Merger Agreement contains provisions that may discourage a third party from pursuing, announcing or submitting a business combination proposal to the Corporation that might result in greater value to the Corporation’s stockholders than the Proposed Transaction with Orrstown. These provisions include a general prohibition on the Corporation from soliciting, or, subject to certain exceptions, entering into discussions with any third party regarding any acquisition proposal or offers for competing transactions. Furthermore, if the Merger Agreement, is terminated, under certain circumstances, the Corporation may be required to pay to Orrstown a termination fee equal to $8.3 million. The Corporation also has an obligation to submit its merger-related proposals to a vote by its stockholders, unless the Merger Agreement is terminated by the Corporation under certain conditions described in the Merger Agreement.

Stockholder litigation could prevent or delay the closing of the proposed Merger with Orrstown or otherwise negatively affect the Corporation’s business and operations.

The Corporation may incur additional costs in connection with the defense or settlement of any stockholder lawsuits filed in connectionwithitsproposedmergerwithOrrstown.SuchlitigationcouldhaveanadverseeffectontheCorporation’sfinancial condition and results of operations and could prevent or delay the consummation of the Merger. Moreover, any litigation could be time consuming and expensive, and could divert attention of the Corporation’s and Orrstown’s respective management teams away from their companies’ regular business. Any lawsuit adversely resolved against the Corporation, Orrstown or members of their respective boards of directors, could have a material adverse effect on each party’s business, financial condition and results of operations.

Because the market price of Orrstown’s common stock may fluctuate, the Corporation’s stockholders cannot be certain of the precise value of the merger consideration they may receive in our proposed Merger with Orrstown.

At the time the Proposed Transaction is completed, each issued and outstanding share of the Codorus Valley’s common stock will be converted into the right to receive a combination of0.875 shares of Orrstown’s common stock. There will be a time lapse between each of the date of the proxy statement/prospectus for the special stockholders’ meetings to approve the Merger and the issuance of the merger consideration, the date on which the Corporation’s and Orrstown stockholders vote to approve the Merger (with regard to the Corporation) and the issuance of the merger consideration (with regard to Orrstown), and the date on which the Corporation’s stockholders entitled to receive shares of Orrstown’s common stock actually receive such shares. The market value of Orrstown’s common stock may fluctuate during these periods as a result of quarantines;a variety of factors, including general market volatility; market downturns;and economic conditions, changes in consumer behavior; business closures; deteriorationOrrstown’s and Codorus Valley’s businesses, operations and prospects, the volatility in the credit qualityprices of borrowerssecurities in global financial markets and regulatory considerations. Many of these factors are outside of both the Corporation’s and Orrstown’scontrol.TheactualvalueofthesharesofOrrstown’scommonstockreceivedbyourstockholderswilldependonthe market value of shares of Orrstown’s common stock at the time the Merger is completed.

Codorus ValleywillbesubjecttobusinessuncertaintiesandcontractualrestrictionswhiletheMergeris pending.

UncertaintyabouttheeffectoftheMergeronemployees,customers,suppliersandvendorsmayhaveanadverseeffecton the business, financial condition and results of operations of the Corporation. These uncertainties may impair the Corporation’s ability to attract, retain and motivate key personnel and customers pending the consummation of the Merger, as such personnel and customers may experience uncertainty about their future roles following the consummation of the Merger.Additionally, these uncertainties and contemplated changes could cause customers, suppliers, vendors and others who deal with the Corporation to seek to change existing business relationships with the Corporation or fail to extend an existing relationship with the inability of borrowers to satisfy their obligations (and any related forbearances or restructuringsCorporation. In addition, competitors may target the Corporation’s existing customers by highlighting potential uncertainties and integration difficulties that may be implemented); changesresult from the merger.

Codorus Valleyhasalimitednumberofkeypersonnel.ThepursuitoftheMergerandthepreparationfortheintegrationmay place a burden on the Corporation’s management and internal resources.Any significant diversion of management attention away from ongoing business concerns and any difficulties encountered in the valuetransition and integration process couldhave a material adverse effect on the Corporation’s business, financial condition and results of collateral securing outstanding loans; changes in the value of the investment securities portfolio; effects on key employees, including operational management personnel and those charged with preparing, monitoring and evaluating the Corporation's financial reporting and internal controls; declines in the demand for loans and other banking services and products; declines in demand resulting from adverse impacts of the disease on businesses deemed to be "non-essential" by governments; and branch or office closures and business interruptions.

operations.

In addition, the adverse economic effectsMergerAgreement restricts the Corporation from taking certain actions without Orrstown’s consent while the Merger is pending. These restrictions may, among other matters, and subject to certain exceptions, prevent Codorus Valley from pursuing otherwise attractive business opportunities, selling assets, incurring indebtedness, engaging in significant capital expenditures, entering into other transactions or making other changes to the Corporation’s business prior to consummation of the coronavirus may lead to an increase in credit riskMerger or termination of the Merger Agreement. These restrictions could have a material adverse effect on the Corporation’s commercialbusiness, financial condition and residential loan portfolios. Likewise,results of operations.

Failure of the Corporation is also monitoringMerger to be completed, the fluctuationstermination of the Merger Agreement or a significant delay in the markets as it pertains to interest rates and fair value of our investments for other than temporary impairment (OTTI). To curtail the spreadconsummation of the virus, we are currently operating with modified branch access and taking other precautionary measures.Merger could negatively impact the Corporation.

On March 27, 2020,If the Coronavirus Aid, ReliefMerger is not consummated, the Corporation’s ongoing business, financial condition and Economic Security (CARES) Act was signed into law. Section 4013results of operations may be materiallyadverselyaffectedandthemarketpriceoftheCorporation’scommonstockmaydecline significantly,particularly to the extent that the current market price reflects a market assumption that the Merger will be consummated. If the consummation of the CARES Act, “Temporary Relief From Troubled Debt Restructurings,” provides banksMerger is delayed, including by the option to temporarily suspend certain requirements under U.S. GAAP related to trouble debt restructurings (TDR) forreceipt of a limited periodcompeting acquisition proposal, the business, financial condition and results of time to account for the effects of COVID-19. Section 541operations of the Consolidated Appropriations Act, 2021 (CAA) was signed into law on December 27, 2020, extendingCorporation may be materially adversely affected.

Additionally, the provisions in Section 4013business of the CARES ActCorporation may be adversely impacted by the failure to January 1, 2022.pursue other beneficial opportunities due to the focus of management on the Merger, without realizing any of the anticipated benefits of completing the Merger, and the market price of the Corporation’s common stock might change to the extent that the

Whilecurrent market price reflects a market assumption that the Merger will be completed. If the MergerAgreement is terminated and the Corporation continuesseeks another merger or business combination, such Corporation’s stockholders cannot be certain that the Corporation will be able to evaluatefind a party willing to engage in a transaction on more attractive terms than the disruption causedMerger.

The Corporation will incur transaction and integration costs in connection with the Merger and, if the Merger is not completed, the Corporation will have incurred substantial expenses without realizing the expected benefits of the Merger.

Codorus Valley has incurred and will incur substantial expenses in connection with the negotiation and completion of the transactions contemplated by the pandemic and impactMerger Agreement. If the Merger is not completed, the Corporation would have to recognize these expenses, including, in the case of the CARES Act, these events may haveCorporation under certain circumstances, a material adverse impacttermination fee, without realizing the expected benefits of the transaction. Any of the foregoing, or other risks arising in connection with thefailure of or delay in consummating the Merger, including the diversion of management attention from pursuing other opportunities and the constraints in the Merger Agreement on the Corporation’s ongoing business during the pendency oftheMerger,couldhaveamaterialadverseeffectontheCorporation’sbusiness,financialconditionandresultsofoperations.

The combined company may be unable to retain the Corporation’s and/or Orrstown’s personnel successfully after the Merger is completed.

The success of the Merger will depend in part on the combined company’s ability to retain the talents and dedication of key employees currently employed by the Corporation and Orrstown. It is possible that these employees may decide not to remain with or the Corporation or Orrstown, as applicable, while the Merger is pending or with the combined company after the Merger is consummated. If the Corporation or Orrstown are unable to retain key employees, including management, who are critical to the successful integration and future operations of the companies, they could face disruptions in their operations, loss of existing customers, loss of key information, expertise or know-how and unanticipated additional recruitment costs. In addition, following the Merger, if key employees terminate their employment, the combined company’s business activities may be adversely affected, and management’s attention may be diverted from successfully hiring suitable replacements, all of which may cause the combined company’s business to suffer. The Corporation and Orrstown also may not be able to locate or retain suitable replacements for any key employees who leave either company.

The future results of the combined company following the Merger may suffer if the combined company does not effectively manage its expanded operations.

Following the Merger, the size of the business of the combined company will increase beyond the current size of either the Corporation’s or Orrstown’s business. The combined company’s future success will depend, in part, upon its ability to manage this expanded business, which may pose challenges for management, including challenges related to the management and monitoring of new operations and associated increased costs and complexity. The combined company may also face increased scrutiny from governmental authorities as a result of the increased size of its business. There can be no assurances that the combined company will be successful or that it will realize the expected operating efficiencies, revenue enhancement or other benefits currently anticipated from the Merger.

Combining the Corporation with Orrstown may be more difficult, costly or time-consuming than expected, and the Corporation and Orrstown may fail to realize the anticipated benefits of the Merger.

The Merger will combine two financial position, capital,institutions of relatively similar asset size. The success of the Merger will depend, in part, on the ability to realize the anticipated cost savings from combining the businesses of the Corporation and liquidityOrrstown. To realize the anticipated benefits and cost savings from the Merger, the Corporation and Orrstown must successfully integrate and combine their businesses in fiscal year 2020. Further, a decreasemanner that permits those cost savings to be realized, without adversely affecting current revenues and future growth. If the Corporation and Orrstown are not able to successfully achieve these objectives, the anticipated benefits of the Merger may not be realized fully or at all or may take longer to realize than expected. In addition, the actual cost savings of the Merger could be less than anticipated, and integration may result in additional and unforeseen expenses.

An inability to realize the full extent of the anticipated benefits of the Merger and the other transactions contemplated by the Merger Agreement, as well as any delays encountered in the integration process, could have an adverse effect upon the revenues, levels of expenses and operating results of future operationsthe combined company following the completion of the merger, which may place a strainadversely affect the value of the common stock of the combined company following the completion of the Merger.

The Corporation and Orrstown have operated and, until the completion of the Merger, must continue to operate, independently. It is possible that the integration process could result in the loss of key employees, the disruption of each company’s ongoing businesses or inconsistencies in standards, controls, procedures and policies that adversely affect the companies’ ability to maintain relationships with clients, customers, depositors and employees or to achieve the anticipated benefits and cost savings of the Merger. Integration efforts between the two companies may also divert management attention and resources. These integration matters could have an adverse effect on each of Orrstown and the Corporation during this transition period and on the Corporation’s capital reserve ratios.combined company for an undetermined period after completion of the merger.

Furthermore, the board of directors and executive leadership of the combined company will consist of former directors and executive officers from each of the Corporation and Orrstown. Combining the boards of directors and management teams of each company into a single board and a single management team could require the reconciliation of differing priorities and philosophies.

Risks Related to Our Common Stock

The market price of our common stock may fluctuate significantly, and this may make it difficult for you to resell shares of common stock owned by you at times or at prices you find attractive.

The market price of our common stock on the NASDAQ Global Market constantly changes. We expect that the market price of our common stock will continue to fluctuate and theremay fluctuate to a greater degree due to our pending merger with Orrstown. There can be no assurance about the market prices for our common stock.

Stock price volatility may make it difficult for you to resell your common stock when you want and at prices you find attractive. Our stock price may fluctuate significantly as a result of a variety of factors, many of which are beyond our control. These factors include, among others:

the pending Merger with Orrstown;

actual or anticipated variations in quarterly results of operations or quality of our assets;

recommendations byopinions of securities analysts;analysts about our stock as an investment;

institutional and other investor interest in purchasing, holding or selling our stock;

operating and stock price performance of other companies that investors deem comparable to us;

any failure to pay dividends on our common stock or a reduction in cash dividends;

continued levels of loan quality and volume origination;

the adequacy of loan loss reserves;the allowance for credit losses;

the willingness of clients to substitute competitors’ products and services for our products and services and vice versa, based on price, quality, relationship or otherwise;

interest rate, market and monetary fluctuations;

declines in the fair value of our available-for-sale securities that are deemed to be other-than-temporarily impaired;

the timely development of competitive new products and services by us and the acceptance of such products and services by clients;

changes in consumer spending and saving habits relative to the financial services we provide;

our relationships with major clients;

our ability to continue to grow our business internally and through acquisition and successful integration of new or acquired entities while controlling costs;

news reports relating to trends, concerns and other issues in the financial services industry, including the failures of other financial institutions in the current economic downturn;

perceptions in the marketplace regarding us and/or our competitors;

rapidly changing technology, or new technology used, or services offered, by competitors;

deposit flows;

changes in accounting principles, policies and guidelines;

significant acquisitions or business combinations, strategic partnerships, joint ventures or capital commitments by or involving us or our competitors;

failure to integrate acquisitions or realize anticipated benefits from acquisitions;

changes in and compliance with laws and government regulations of federal, state and local agencies;

effects of climate change;

geopolitical conditions such as acts or threats of terrorism or military conflicts;

natural disasters or severe weather conditions;

health emergencies, the spread of infectious diseases or pandemics;

cybercybersecurity attacks or breaches or breaches of physical premises, including data centers;

failure to retain or attract key personnel;

operating results that vary from the expectations of management, analysts and investors;

future sales of our equity or equity-related securities;

the credit, mortgage and housing markets, the markets for securities relating to mortgages or housing, and developments with respect to financial institutions generally; and

the relatively low trading volume of our common stock.

General market fluctuations, industry factors and general economic and political conditions and events, such as economic slowdowns or recessions, interest rate changes or credit loss trends, could also cause our stock price to decrease regardless of operating results as evidenced by the currentrecent volatility and disruption of capital and credit markets.

The trading volume of our common stock may not provide adequate liquidity for investors and is less than that of other financial services companies.

Our common stock is listed under the symbol “CVLY” on the NASDAQ Global Market. The average daily trading volume for shares of our common stock is less than that of larger financial institutions. As a result, sales of our common stock may place significant downward pressure on the market price of our common stock. Furthermore, it may be difficult for holders to resell their shares at prices they find attractive, or at all.

WeIf our pending Merger with Orrstown does not proceed, we may issue additional common stock or other equity securities in the future which could dilute the ownership interest of existing shareholders.stockholders.

InIf our pending Merger with Orrstown does not proceed, in order to maintain our capital at desired or regulatory-required levels or to replace existing capital, we may be required to, or otherwise determine it advantageous to issue additional shares of common stock, or securities convertible into, exchangeable for or representing rights to acquire shares of common stock. Generally, we are not restricted from issuing such additional shares.shares (we are currently restricted from engaging in additional issuances under the terms of the Merger Agreement with Orrstown). We may sell any shares that we issue at prices below the current market price of our common stock, and the sale of these shares may significantly dilute shareholderstockholder ownership. We could also issue additional shares in connection with acquisitions of other financial institutions or in connection with our equity compensation plans. Additional equity offerings may dilute the holdings of our existing shareholdersstockholders or reduce the market price of our common stock, or both.

Offerings of debt and/or preferred equity securities may adversely affect the market price of our common stock.

WeIf our proposed Merger with Orrstown is not consummated, we may attempt to increase our capital resources or, if our or our subsidiary bank’sPeoplesBank’s capital ratios fall below the required regulatory minimums, we could be forced to raise additional capital by making additional offerings of debt or preferred equity securities, including medium-term notes, trust preferred securities, senior or subordinated notes and preferred stock. Upon liquidation, holders of our debt securities and shares of preferred stock and lenders with respect to other borrowings are likely to receive distributions of our available assets prior to the holders of our common stock. Additional equity offerings may dilute the holdings of our existing shareholdersstockholders or reduce the market price of our common stock, or both. Holders of our common stock are not entitled to preemptive rights or other protections against dilution. Under the terms of the Merger Agreement with Orrstown, we are not permitted to issue additional debt or preferred equity securities during the pendency of the Merger.

Our board of directors is authorized to issue one or more classes or series of preferred stock from time to time without any action on the part of the shareholders.stockholders. Our board of directors also has the power, without shareholderstockholder approval, to

set the terms of any such classes or series of preferred stock that may be issued, including voting rights, dividend rights, and preferences over our common stock with respect to dividends or upon our dissolution, winding up and liquidation and other terms. If we issue preferred stock in the future, in the event our proposed merger with Orrstown does not proceed, that has a preference over our common stock with respect to the payment of dividends or upon our liquidation, dissolution or winding up, or if we issue preferred stock with voting rights that dilute the voting power of our common stock, the rights of holders of our common stock or the market price of our common stock could be adversely affected.

Our common stock is subordinate to our existing and future indebtedness and preferred stock, if issued, and effectively subordinated to all the indebtedness and other non-common equity claims against our subsidiaries.

Shares of our common stock are equity interests in usthe Corporation and do not constitute indebtedness. As such, shares of our common stock rank junior to all of our indebtedness and to other non-equity claims against us and our assets available to satisfy claims against us, including in our liquidation. Additionally, holders of our common stock could be subject to the prior dividend and liquidation rights of holders of our preferred stock. Furthermore, our right to participate in a distribution of assets upon any of our subsidiaries’ liquidation or reorganization is subject to the prior claims of that subsidiary’s creditors.

WeIf the proposed Merger with Orrstown is not consummated, we may attempt to increase our capital resources or, if our or the Bank’sPeoplesBank’s capital ratios fall below the required regulatory minimums, we could be forced to raise additional capital by making additional offerings of debt or preferred equity securities, including medium-term notes, trust-preferred securities, senior or subordinated notes andand/or preferred stock. Upon liquidation, holders of our debt securities and shares of preferred stock and lenders with respect to other borrowings are likely to receive distributions of our available assets prior to the holders of our common stock.

We are currently authorized to issue up to 30,000,000 shares of common stock of which 9,820,8829,642,851 shares were outstanding as of December 31, 2020,2023, and up to 1,000,000 shares of preferred stock, none of which were outstanding as of December 31, 2020.2023. Our board of directors has authority, without action or vote of the shareholdersstockholders of common stock, to issue all or part of the authorized but unissued shares. Authorized but unissued shares of our common stock or preferred stock could be issued on terms or in circumstances that could dilute the interests of other shareholders.stockholders. Furthermore, under the terms of the Merger Agreement, we have agreed to not issue additional equity securities or debt securities.

Regulatory and contractual restrictions may limit or prevent us from paying dividends or repurchasing shares of our common stock, or we may choose not to pay dividends on or repurchase, our common stock.

The CompanyCorporation is an entity separate and distinct from its principal subsidiary, PeoplesBank, and we derive substantially all of our revenue in the form of dividends from that subsidiary. Accordingly, we are and will be dependent upon

dividends from PeoplesBank to pay the principal of and interest on our indebtedness, to satisfy our other cash needs and to pay dividends on our common and preferred stock. The Bank’sstock, if any. PeoplesBank’s ability to pay dividends is subject to its ability to earn net income and to meet certain regulatory requirements. In the event PeoplesBank is unable to pay dividends to us, we may not be able to pay dividends on our common or preferred stock.stock, if any. Also, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors, including those of its depositors.

As described below in the next risk factor, the terms of our outstanding junior subordinated debt securities prohibit us from paying dividends on or repurchasing our common stock at any time when we have elected to defer the payment of interest on such debt securities or certain events of default under the terms of those debt securities have occurred and are continuing. These restrictions could have a negative effect on the value of our common stock. Moreover, holders of our common stock are entitled to receive dividends only when, as and if declared by our board of directors.

Although we have historically paid cash dividends on our common stock, we are not required to do so and our board of directors could reduce, suspend or eliminate our common stock cash dividend in the future. No determination has been made by our board of directors regarding whether or what amount of dividends will be paid in future quarters. Under the terms of the Merger Agreement with Orrstown, we are permitted to continue to pay quarterly dividends at the current level of $ 0.17 per share. Additionally, there can be no assurance that regulatory approval will be granted by the Federal Reserve Board to pay dividends. Future payment of cash dividends, if any, will be at the discretion of our board of directors and will be dependent upon our financial condition, results of operations, capital requirements and such other factors as the board may deem relevant and will be subject to applicable federal and state laws that

impose restrictions on our and our bank subsidiary’sPeoplesBank’s ability to pay dividends, as well as guidance issued from time to time by regulatory authorities.

Under guidance issued by the Federal Reserve Board, as a bank holding company we are expected to consult the Federal Reserve before declaring dividends in certain situations, and may require its prior approval, and we are to strongly consider eliminating, deferring, or reducing dividends we pay to our shareholdersstockholders if (1) our net income available to shareholdersstockholders for the past four quarters, net of dividends previously paid during that period, is not sufficient to fully fund the dividends, (2) our prospective rate of earnings retention is not consistent with our capital needs and overall current and prospective financial condition, or (3) we will not meet, or are in danger of not meeting, our minimum regulatory capital adequacy ratios.

If we defer payments of interest on our outstanding subordinated notes or junior subordinated debt securities or if certain defaults relating to those debt securities occur, we will be prohibited from declaring or paying dividends or distributions on, and from making liquidation payments with respect to, our common stock.

As of December 31, 2020,2023, we had $31,000,000 outstanding aggregate principal amount of subordinated debt evidenced by subordinated notes and note purchase agreements and $10,310,000 outstanding aggregate principal amount of junior subordinated debt securities issued in connection with the sale of trust preferred securities by certain of our subsidiaries that are statutory business trusts. We have also guaranteed those trust preferred securities. There are currently two separate series of these junior subordinated debt securities outstanding, each series having been issued under a separate indenture and with a separate guarantee. The note purchase agreements and each of these indentures, together with the related guarantee, prohibits us, subject to limited exceptions, from declaring or paying any dividends or distributions on, or redeeming, repurchasing, acquiring or making any liquidation payments with respect to, any of our capital stock at any time when (i) there shall have occurred and be continuing an event of default under the note purchase agreement or indenture or any event, act or condition that with notice or lapse of time or both would constitute an event of default under the note purchase agreement or indenture; or (ii) we are in default with respect to payment of any obligations under the related guarantee; or (iii) we have deferred payment of interest on the junior subordinated debt securities outstanding under that indenture. In that regard, we are entitled, at our option but subject to certain conditions, to defer payments of interest on the junior subordinated debt securities of each series from time to time for up to five years.

Events of default under each note purchase agreement and indenture generally consists of our failure to pay interest on the subordinated notes or junior subordinated debt securities outstanding under the indenture under certain circumstances, our failure to pay any principal of or premium on such subordinated notes or junior subordinated debt securities when due, our failure to comply with certain covenants under the note purchase agreements or indenture, and certain events of bankruptcy, insolvency or liquidation relating to us or the Bank.PeoplesBank.

As a result of these provisions, if we were to elect to defer payments of interest on any series of junior subordinated debt securities, or if any of the other events described in clause (i) or (ii) of the first paragraph of this risk factor were to occur, we would be prohibited from declaring or paying any dividends on our common stock, from redeeming, repurchasing or otherwise acquiring any of our common stock, and from making any payments to holders of our

common stock in the event of our liquidation, which would likely have a material adverse effect on the market value of our common stock. Moreover, without notice to or consent from the holders of our common stock, we may issue additional series of subordinated notes or junior subordinated debt securities in the future with terms similar to those of our existing subordinated notes or junior subordinated debt securities or enter into other financing agreements that limit our ability to purchase or to pay dividends or distributions on our capital stock, including our common stock.

Under the terms of the Merger Agreement with Orrstown, Orrstown will assume our existing outstanding debt.

Our common stock is not insured by any governmental entity.

Our common stock is not insured by any governmental entity. Our common stock is not a deposit account or other obligation of any bank and, therefore, is not insured against loss by the FDIC, any other deposit insurance fund, any other governmental entity or by any other public or private entity. Investment in our common stock is inherently risky for the reasons described in this “Risk Factors” section and elsewhere in this document and our other filings with the SEC and is subject to the same market forces that affect the price of common stock in any company. As a result, if you acquire our common stock, you may lose some or all of your investment.

Anti-takeover provisions and restrictions on ownership could negatively impact our shareholders.stockholders.

Provisions of federal and Pennsylvania law and our amended and restated articles of incorporation and bylaws could make it more difficult for a third party to acquire control of us or have the effect of discouraging a third party from attempting to acquire control of us. These provisions could make it more difficult for a third party to acquire us even if an acquisition might be in the best interest of our shareholders.stockholders. In addition, the Bank Holding Company Act of 1956, as amended, or the BHCA, requires any bank holding company to obtain the approval of the Federal Reserve Board prior to acquiring more than 5five percent of our outstanding common stock. Any person other than a bank holding company is required to obtain prior approval of the Federal Reserve Board to acquire 10 percent or more of our outstanding common stock under the Change in Bank Control Act. Any holder of 25 percent or more of our outstanding common stock or more than one-third of our equity, other than an individual, iswould be deemed to conclusively control us and be subject to regulation as a bank holding company under the BHCA.

Our articles of incorporation and bylaws contain certain provisions that may have the effect of deterring or discouraging an attempt to take control of the Company.Corporation. Among other things, these provisions:

empower our board of directors, without shareholderstockholder approval, to issue shares of our common or preferred stock the terms of which, including voting power, are set by our board;

divide our board of directors into three classes serving staggered three yearthree-year terms;

authorize our board of directors to oppose a tender or other offer for the Company’sCorporation’s securities if the board determines that such an offer should be rejected;

require the affirmative vote of holders of at least 75 percent of the outstanding shares of our common stock to approve the merger, consolidation, liquidation or dissolution of the Company,Corporation, or any sale or other disposition of all or substantially all of the assets of the Company,Corporation, excepting transactions described above that are approved by at least 80 percent of the members of the Boardboard of Directors,directors, where such transactions shall only require shareholderstockholder approval by a majority of the votes cast at the shareholders meeting;meeting of stockholders held to consider and act upon such transaction;

eliminate cumulative voting in the election of directors; and

require advance notice of nominations for the election of directors and the presentation of shareholderstockholder proposals at meetings of shareholders. stockholders. 

If the Merger with Orrstown is completed, stockholders of the Corporation as of the completion of the Merger will become stockholders of Orrstown and will be subject to the provisions of the articles of incorporation and bylaws of Orrstown, some of the provisions of which may have the effect of deterring or discouraging attempt to take control of Orrstown.

Item 1B: Unresolved Staff Comments

Not applicable.

Item 2: Properties

Codorus Valley owns the Codorus Valley Corporate Center (“Corporate Center”), located at 105 Leader Heights Road, York, PA 17403, subject to a first lien held by ACNB Bank. The first lien held by ACNB Bank supports a $3,000,000 line of credit. No draws have been made on the line and on December 31, 2020,2023, the balance was zero. This facility serves as the corporate headquarters and is approximately 40,000 square feet, a portion of which is leased to third-parties.third parties. The Corporate Center is adjacent to PeoplesBank’s Data Operations Center and the Leader Heights financial center and is approximately one halfone-half mile from PeoplesBank’s Administrative Services Centers.

PeoplesBank owns and leases properties in York, Cumberland and Lancaster Counties, Pennsylvania and Baltimore and Harford Counties and Baltimore City in Maryland as shown below.