United Bancorp Inc: Form 10-K for the period ended Dec 31, 2025

General

All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business and address regulatory requirements, we take a comprehensive approach to cybersecurity risk management and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. We devote significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. Our cybersecurity risk management program is integrated into our overall enterprise risk management framework, ensuring that cybersecurity risks are evaluated alongside other operational, financial, and strategic risks facing the Company.

Legal Overview

Pursuant to the requirements of section 39 of the Federal Deposit Insurance Act (12 U.S.C. 1831p–1) and sections 501 and 505(b) of the Gramm-Leach-Bliley Act (15 U.S.C. 6801, 6805(b)), the federal bank regulatory agencies adopted the Interagency Guidelines Establishing Information Security Standards (the “Guidelines”). The requirements of the Guidelines apply to all FDIC-insured depository institutions, most subsidiaries of such entities, and to state savings associations. Federal law also mandates that information security procedures and controls be routinely evaluated by the Bank’s state and federal regulators as part of the standard safety and soundness examination process.

Bank Security Policy

To comply with all applicable federal requirements, the Bank’s Board of Directors has adopted the Unified Bank Information Security Policy (the “ISP”), which establishes a program that the Bank’s management and board can use to:

• Ensure the security and confidentiality of customer information;
• Protect against any anticipated threats or hazards to the security or integrity of such information; and
• Protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to any customer.

Under the ISP, the Board of Directors or an appropriate committee thereof is required to oversee all efforts with respect to the development, implementation and maintenance of an effective information security program. In addition, the ISP charges management with responsibility for identifying all reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration or destruction of Bank information, and directs management to develop and implement procedures and other controls designed to reduce or eliminate identified risks.

The Bank has also implemented controls designed to identify and mitigate cybersecurity threats associated with our use of the Bank’s critical third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and based on risk profile. A variety of inputs are used in such assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.

In addition to being subject to routine examination by the Bank’s state and federal regulators, the efficacy of the Bank’s information security program is also audited annually by an independent third-party auditing firm.

Incident Response

The Bank has established an incident response plan designed to facilitate the prompt detection, assessment, containment, and remediation of cybersecurity incidents. Upon detection of a potential incident, the Bank’s information security personnel assess the nature and scope of the threat and, where appropriate, engage third-party forensic specialists to assist in the investigation. The incident response plan includes escalation procedures to ensure that significant incidents are promptly reported to senior management and the Board of Directors, as well as to regulators and affected customers when required by applicable law. Following the resolution of any incident, the Bank conducts a post-incident review to identify lessons learned and implement any necessary enhancements to its cybersecurity controls.

Managerial and Board Oversight

To facilitate oversight, the Bank has established a front line committee, the Compliance Risk Assessment Committee, which is comprised of all members of senior management, the head of information security and certain other operationally significant employees. This Committee, which meets quarterly, is responsible for monitoring all key operational risks applicable to the Bank. Cyber risk assessments are routinely conducted and reported to the Audit Committee of the Board of Directors In addition, key members of senior management also meet annually with a cyber risk consultant who apprises management on emerging cyber threats and evaluates the Company’s adequacy of cyber risk insurance coverage. The findings of this meeting are also reported to the Executive Committee. All significant matters are reported by the Executive Committee to the full Board of Directors.

Cybersecurity Risks and Material Impact

As of the date of this Annual Report, we have not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, cybersecurity threats are constantly evolving, and there can be no assurance that our security measures will be sufficient to prevent all potential incidents. A successful cyberattack or other security breach could result in unauthorized access to customer data, disruption of our operations, regulatory penalties, litigation, and reputational harm.

The Company owns and operates its Main Office and stand alone operations center in Martins Ferry, Ohio a future Unified Center (new operations center) building in St Clairsville, Ohio and the following offices:

Management believes the properties described above to be in good operating condition for the purpose for which they are used. The properties are unencumbered by any mortgage or security interest and are, in management’s opinion, adequately insured.

There are no material legal proceedings, other than ordinary routine litigation incidental to its business, to which the Company or its subsidiary is a party or to which any of its property is subject.

Refer to Pages 10-22, “Management’s Discussion and Analysis” of the 2025 Annual Report To Shareholders filed herewith as Exhibit 13, which section is incorporated herein by reference. For a comparison of results of operations between 2025 and 2024, see “Management’s Discussion and Analysis” in the 2024 Annual Report To Shareholders filed as Exhibit 13 to the Company’s annual report on 10-K for 2024.

Critical Accounting Policy

Allowance for Credit Losses:

Our allowances for credit losses represents management’s best estimate of probable losses inherent in our loan portfolios, excluding those loans accounted for under fair value.

The allowance for credit losses represents an estimate of expected credit losses, measured over the contractual life of a loan, that considers our historical loss experience, current conditions and forecasts of future economic conditions. Determination of an appropriate allowance for credit losses is inherently subjective and may have significant changes from period to period. The methodology for determining the allowance for credit losses has two main components: evaluation of expected credit losses for certain groups of homogeneous loans that share similar risk characteristics and evaluation of loans that do not share risk characteristics with other loans. The allowance for credit losses is measured on a collective (pool) basis when similar risk characteristics exist. The Company uses the call report classification as its segment breakout and measures the allowance for credit losses using the Weighted Average Remaining Maturity method for all loan segments.

Historical credit loss experience is the basis for the estimation of expected credit losses. We apply historical loss rates to pools of loans with similar risk characteristics. After consideration of the historic loss calculation, management applies qualitative adjustments to reflect the current conditions and reasonable and supportable forecasts not already reflected in the historical loss information at the balance sheet date. Our reasonable and supportable forecast adjustment is based on a 2 year unemployment forecast provided by Bloomberg and management judgment. For periods beyond our reasonable and supportable forecast, we revert back to historical annual loss rates for the remainder of the life of each pool after the forecast period. The qualitative adjustments for current conditions are based upon current level of inflation and the rapid increase in interest rates, changes in lending policies and practices, experience and ability of lending staff, quality of the Company’s loan review system, value of underlying collateral, the existence of and changes in concentrations and other external factors. These modified historical loss rates are multiplied by the outstanding principal balance of each loan to calculate a required reserve.

The process of determining the level of the allowance for credit losses requires a high degree of judgment. To the extent actual outcomes differ from our estimates, additional provision for loan and lease losses may be required that would reduce future earnings. Refer to Note 1 in the Notes to the Consolidated Financial Statements for further information.

The Company, under the supervision, and with the participation, of its management and its outsourced internal audit firm Greenestock Consulting LLC, including the Company’s principal executive and principal financial officers, evaluated the effectiveness of the design and operation of the Company’s disclosure controls and procedures as of December 31, 2025, pursuant to the requirements of Exchange Act Rule 13a-15. Based upon that evaluation, the Chief Executive Officer and Chief Financial Officer concluded that the Company’s disclosure controls and procedures were effective as of December 31, 2025, in timely alerting them to material information relating to the Company (including its consolidated subsidiaries) required to be included in the Company’s periodic SEC filings.

Management is responsible for establishing and maintaining adequate internal control over financial reporting for the Company. Under the supervision and with the participation of management, including our principal executive and principal financial officers, we conducted an evaluation of the effectiveness of our internal control over financial reporting based on the framework in Internal Control – Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission, as required by paragraph (c) of Exchange Act Rule13a-15. Based on the evaluation under Internal Control – Integrated Framework, management concluded that the Company’s internal control over financial reporting was effective as of December 31, 2025. This annual report does not include an attestation report of the Company’s registered public accounting firm regarding internal control over financial reporting. Management’s report was not subject to attestation by the Company’s independent registered public accounting firm.

There was no change in the Company’s internal control over financial reporting that occurred during the Company’s fiscal quarter ended December 31, 2025 that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial.