10-K/A

UNITED STATES SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

_____________________________________________

FORM 10-K/A

(Amendment No. 1)

_____________________________________________

(Mark One)

☒ Annual Report Pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934

For the fiscal year ended December 31, 2023

or

☐ Transition Report Pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934

For the transition period from _____________ to _____________.

Commission file Number 0-15536

_____________________________________________

CODORUS VALLEY BANCORP, INC. 

(Exact name of registrant as specified in its charter)

Pennsylvania	23-2428543
(State or other jurisdiction of incorporation or organization)	(I.R.S. Employer Identification No.)

105 Leader Heights Road, York, Pennsylvania 17403 

(Address of principal executive offices)(Zip code)

Registrant’s telephone number, including area code: (717) 747-1519

 _____________________________________________

Securities registered pursuant to Section 12(b) of the Act:

Title of each class	Trading Symbol	Name of each exchange on which registered
Common Stock, $2.50 par value	CVLY	NASDAQ Global Market

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. ☐ Yes   ☒ No

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15 (d) of the Act. ☐ Yes   ☒ No

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. ☒ Yes  ☐ No

Indicate by check mark whether the registrant has submitted electronically and posted on its corporate Web site, if any, every Interactive Data File required to be submitted and posted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files). ☒ Yes  No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company or emerging growth company. See definition of “large accelerated filer,” “accelerated filer”, “smaller reporting company” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer ☐	Accelerated filer ☐
Non-accelerated filer ☒	Smaller reporting company ☒
	Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☐

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company as defined in Rule 12b-2 of the Exchange Act. ☐ Yes ☒ No

The aggregate market value of Codorus Valley Bancorp, Inc.’s voting stock held by non-affiliates was approximately $181,853,487 as of June 30, 2023.

As of March 1, 2024, Codorus Valley Bancorp, Inc. had 9,642,669 shares of common stock outstanding, par value $2.50 per share.

Auditor Name: Crowe LLP   Auditor Location: Columbus, OH  Auditor Firm ID: PCAOB 173

1

EXPLANATORY NOTE

Codorus Valley Bancorp, Inc. (the “Corporation”) is filing this Annual Report on Form 10-K/A (the “Amendment” or “Form 10-K/A”) to correct the Annual Report on Form 10-K for the year ended December 31, 2023, as filed with the Securities and Exchange Commission (“SEC”) on March 12, 2024 (the “Original Report”). This Amendment is being filed to include (i) “Item 1.C. Cybersecurity” to Part I of the Form 10-K/A and (ii) “Exhibit 97, Compensation Recovery (Clawback) Policy)” to Item 15. Exhibits to Part IV of the Form 10-K/A, which were previously omitted from the Original Report.

In addition, pursuant to Rule 12b-15 under the Securities Exchange Act of 1934, as amended, this Amendment includes new certifications of the Corporation’s principal executive officer and principal financial officer on Exhibits 31.1 and 31.2 as of the date of this Amendment. However, because no financial statements have been included in this Amendment and the Amendment does not contain or amend any disclosure with respect to Items 307 or 308 of Regulation S-K, paragraphs 3, 4 and 5 of the certifications have been omitted. We are not including the certifications under Section 906 of the Sarbanes-Oxley Act of 2002 as no financial statements are being filed with this Amendment.

This Amendment does not affect any other portion of the Original Report. Additionally, except as specifically referenced herein, this Amendment does not reflect any event after March 12, 2024, the filing date of the Original Report.

2

PART I

Item 1.C. Cybersecurity

Cybersecurity Governance

Cybersecurity risk is managed by the Corporation in a structure that vests primary responsibility with management, specifically, the Bank’s Information Security Officer, who reports to the Chief Risk Officer as well as to the Strategic Technology and Cybersecurity Committee, which is comprised of members of bank management, including the Bank’s Chief Executive Officer, Chief Risk Officer, Chief Financial Officer, Chief Lending Officer, Chief Administrative Officer, Network Manager, Director of Marketing and Client Experience and the General Counsel. The Bank’s Chief Information Officer and Information Security Officer are members of the Committee and also serve as Committee Chair and Vice Chair, respectively.

The Strategic Technology and Cybersecurity Committee is responsible for providing oversight and guidance regarding both information technology and cybersecurity related issues of strategic importance to the Corporation and the Bank. The Committee recognizes the importance of information technology to the financial services industry and its clients, as well as the increasing prevalence of cyber-attacks against instruments of our society and the critical importance of effective controls, as well as prevention and detection measures to mitigate the risks. The Committee met three (3) times in 2023.

Minutes of the proceedings of the Strategic Technology and Cybersecurity Committee are provided to the Board’s Risk Committee for review at its next following meeting, unless there should be an urgency to any given situation demanding immediate consultation. The Board’s Risk Committee has oversight responsibility for cybersecurity and receives reports from management on cybersecurity risk in accordance with its charter, which provides that the Committee shall review the Corporation’s cybersecurity and other information technology risks, controls and procedures, and its strategy to mitigate cybersecurity risks and potential breaches.

In addition, the Board’s Audit Committee has oversight responsibility for audits related to information technology security, including network penetration and social engineering testing.

Processes for Assessing, Identifying and Managing Cybersecurity Risks

The Corporation maintains a comprehensive approach to cybersecurity risks, deploying a multi-layered program with a focus on risk assessment and management. The aim is to identify cybersecurity risks, deploy appropriate means of preventing and/or detecting intrusions; mitigating potential harm and remediating the effects if a breach were to occur.

Deterrence/Detection

A number of means are used to deter and detect cyber-activity as well as to detect cybersecurity vulnerabilities, including, among others, use of periodic comprehensive risk assessments; technologies and systems that monitor network activity and alert for suspicious or anomalous activity; vulnerability and patch management programs; multi-factor authentication; proactive access management; mobile device management; and annual network security penetration testing by a third-party vendor which serves as a basis for the Corporation to enhance its own capabilities with respect to the deterrence and detection of cyber-activity and detection of cybersecurity vulnerabilities.

Mitigation/Remediation

Risk mitigation and remediation are additional means of managing cybersecurity risk in the Corporation’s multi-layered approach. Security awareness training is provided to all of the Corporation’s associates throughout each year, as well as phishing exercises, which are performed on a regular schedule. In addition, the Information Security Officer organizes and conducts an annual Tabletop Cybersecurity exercise in which a mock cybersecurity incident scenario is presented to a selected group of the Corporation’s associates with the aim of providing enhanced training for relevant individuals to learn the proper actions to take in such a situation. This exercise is used to operationalize the Corporation’s Information Security Policies, Business Continuity Plan and Incident Response Plan, and to sensitize the participants to the latest cyber threat schemes and actors.

3

The Corporation also maintains comprehensive cyber insurance, which provides the potential for monetary recovery of certain expenses and damages incurred in connection with certain cyber breaches, as well as the services of a knowledgeable breach coach to assist the Corporation with the management and decisioning in connection with a cyber-incident, including for the hiring of expert forensic and legal assistance.

‎

4

PART IV

Item 15: Exhibits and financial statement schedules

(a)Documents filed as part of this Form 10-K/A.

1.Financial Statements

The following consolidated statements of Codorus Valley Bancorp, Inc. were included in Part II, Item 8 of the Original Report:

Reports of Independent Registered Public Accounting Firm

Consolidated Balance Sheets

Consolidated Statements of Income

Consolidated Statements of Comprehensive Income

Consolidated Statements of Cash Flows

Consolidated Statements of Changes in Shareholders’ Equity

Notes to Consolidated Financial Statements

2.Financial Statement Schedules

Required financial statement schedules are omitted. This information is either not

applicable, not required or is shown in the respective financial statements or in the notes thereto in the Original Report.

3.Exhibits filed as part of 10-K/A pursuant to Item 601 of Regulation S-K.

See Exhibit Index.

‎

5

Signatures

Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, the Registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized.

Codorus Valley Bancorp, Inc. (Registrant)

	/s/ Craig L. Kauffman
Date: March 14, 2024	Craig L. Kauffman,
	President and Chief Executive Officer

‎

6

Exhibit Index

Exhibit
Number	Description of Exhibit
3.1	Amended Articles of Incorporation (Incorporated by reference to Exhibit 3.1 of the Quarterly Report on Form 10-Q for June 30, 2018 filed with the Commission on August 6, 2018)
3.2	Amended By-laws – filed with Original Report
4.(vi)	Description of registrant’s securities (Incorporated by reference to Exhibit 4.(vi) of the Registrant’s Annual Report on Form 10-K for December 31, 2019, filed with the Commission on March 11, 2020)
4.1	Form of 4.50% Fixed-to-Floating Rate Subordinated Notes due 2030 of Codorus Valley Bancorp, Inc.(Incorporated by reference to Exhibit 4.1 to the Current Report on Form 8-K filed with the Commission on December 10, 2020)
10.1	Change of Control Agreement by and among Codorus Valley Bancorp, Inc., PeoplesBank, A Codorus Valley Company and Larry D. Pickett, dated August 9, 2018 (incorporated by reference to Exhibit 10.1 to the Registrant’s Current Report on Form 8-K filed with the Commission on August 9, 2018)*
10.2	2001 Employee Stock Bonus Plan (Incorporated by reference to Exhibit 99.1 of Registration Statement No. 333-68410 on Form S-8, filed with the Commission on August 27, 2001) *
10.3	Dividend Reinvestment and Stock Purchase Plan (Incorporated by reference to Exhibit 10.1 of Registration Statement No. 333-179179 on Form S-3D, filed with the Commission on January 26, 2012)
10.4	Form of Group Term Replacement Plan, dated January 1, 2009 pertaining to senior officers of the Corporation’s subsidiary, PeoplesBank, A Codorus Valley Company (Incorporated by reference to Exhibit 10.16 of the Registrant’s Annual Report on Form 10-K for December 31, 2014, filed with the Commission on March 10, 2015) *
10.5	Form of Director Group Term Replacement Plan, dated December 1, 1998, including Split Dollar Policy Endorsements pertaining to non-employee directors of the Corporation’s subsidiary, PeoplesBank, A Codorus Valley Company (Incorporated by reference to Exhibit 10.16 of the Registrant’s Annual Report on Form 10-K for December 31, 2014, filed with the Commission on March 10, 2015) *
10.6	Codorus Valley Bancorp, Inc. Change in Control and Supplemental Benefit Trust Agreement between Codorus Valley Bancorp, Inc., PeoplesBank, A Codorus Valley Company and Hershey Trust Company, dated January 25, 2006 and Resignation and Appointment of Trustee (Incorporated by reference to Exhibit 10.17 of the Registrant’s Annual Report on Form 10-K for December 31, 2015, filed with the Commission on March 8, 2016) *
10.7	Amended and Restated Declaration of Trust of CVB Statutory Trust No. 2, dated as of June 28, 2006, among Codorus Valley Bancorp, Inc., as sponsor, the Delaware and institutional trustee named therein, and the administrators named therein (Incorporated by reference to Exhibit 10.1 to the Registrant’s Current Report on Form 8-K filed with the Commission on June 30, 2006)
10.8	Indenture, dated as of June 28, 2006, between Codorus Valley Bancorp, Inc., as issuer, and the trustee named therein, relating to the Junior Subordinated Debt Securities due 2036 (Incorporated by reference to Exhibit 10.2 to the Registrant’s Current Report on Form 8-K filed with the Commission on June 30, 2006)

7

10.9	Guarantee Agreement, dated as of June 28, 2006, between Codorus Valley Bancorp, Inc. and guarantee trustee named therein (Incorporated by reference to Exhibit 10.3 to the Registrant’s Current Report on Form 8-K filed with the Commission on June 30, 2006)
10.10	2007 Long-Term Incentive Plan of Codorus Valley Bancorp, Inc. (Incorporated by reference to Exhibit A of the Registrant’s definitive proxy statement, dated April 6, 2012) *
10.11	2007 Employee Stock Purchase Plan (Incorporated by reference to Registration Statement No. 333-266222 on Form S-8, filed with the Commission on July 19, 2022) *
10.12	Executive Incentive Plan* – filed with Original Report**
10.13	Form of Change of Control Agreement dated June 23, 2016 by and among Codorus Valley Bancorp, Inc., PeoplesBank, A Codorus Valley Company and each of Diane E. Baker and Amy L. Doll (Incorporated by reference to Exhibit 10.1 to the Registrant’s Current Report on Form 8-K, filed with the Commission on June 28, 2016)
10.14	Employment Agreement by and among Codorus Valley Bancorp, Inc., PeoplesBank, A Codorus Valley Company and Craig L. Kauffman, dated August 6, 2018 (incorporated by reference to Exhibit 10.1 to the Registrant’s Current Report on Form 8-K filed with the Commission on August 16, 2018)*
10.15	Change of Control Agreement by and among Codorus Valley Bancorp, Inc., PeoplesBank, A Codorus Valley Company and Matthew A. Clemens, dated July 14, 2016 (Incorporated by reference to Exhibit 10.29 to the Registrant’s Current Report on Form 10-K, filed with the Commission on March, 15, 2017) *
10.16	Salary Continuation Agreement between PeoplesBank, A Codorus Valley Company and Matthew A. Clemens, dated October 1, 2002 (Incorporated by reference to Exhibit 10.30 to the Registrant’s Current Report on Form 10-K, filed with the Commission on March 15, 2017) *
10.17	Amendment to Salary Continuation Agreement between PeoplesBank, A Codorus Valley Company and Matthew A. Clemens, dated December 27, 2005 (Incorporated by reference to Exhibit 10.31 to the Registrant’s Current Report on Form 10-K, filed with the Commission on March 15, 2017) *
10.18	Second Amendment to Salary Continuation Agreement between PeoplesBank, A Codorus Valley Company and Matthew A. Clemens, dated December 23, 2008 (Incorporated by reference to Exhibit 10.32 to the Registrant’s Current Report on Form 10-K, filed with the Commission on March 15, 2017) *
10.19	Third Amendment to Salary Continuation Agreement between PeoplesBank, A Codorus Valley Company and Matthew A. Clemens, dated March 11, 2014 (Incorporated by reference to Exhibit 10.33 to the Registrant’s Current Report on Form 10-K, filed with the Commission on March 15, 2017) *
10.20	2017 Long Term Incentive Plan (Incorporated by reference to Exhibit 10.20 to the Registrant's Current Report on Form 10-K, filed with the Commission on March 14, 2023)
10.21	Supplemental Executive Retirement Plan by and among Codorus Valley Bancorp, Inc., PeoplesBank, A Codorus Valley Company and Diane Baker, dated January 29, 2019 (incorporated by reference to Exhibit 10.1 to the Registrant’s Current Report on Form 8-K filed with the Commission on February 4, 2019)*
10.22	Bank Contribution Deferred Compensation Agreement by and among Codorus Valley Bancorp, Inc., PeoplesBank, A Codorus Valley Company and Craig L. Kauffman, dated February 21, 2019 (incorporated by reference to Exhibit 10.1 to the Registrant’s Current Report on Form 8-K filed with the Commission on February 27, 2019)*
10.23	Elective Deferred Compensation Plan, dated February 21, 2019 (incorporated by reference to Exhibit 10.2 to the Registrant’s Current Report on Form 8-K filed with the Commission on February 27, 2019)*
10.24	First amendment to Employment Agreement between PeoplesBank, A Codorus Valley Company and Craig L. Kauffman, dated September 14, 2021 (Incorporated by reference to Exhibit 10.2 to the Registrant’s Current Report on Form 8-K filed with the Commission on September 15, 2021)*
14	Code of Ethics, dated March 13, 2018 (incorporated by reference to Exhibit 14 to the Registrant’s Current Report on Form 10-K, filed with the Commission on March 15, 2019)
21	List of subsidiaries of Codorus Valley Bancorp, Inc. – filed with Original Report
23	Consent of Independent Registered Public Accounting Firm – filed with Original Report
24	Power of Attorney – filed with Original Report
31.1	Certification of Principal Executive Officer Pursuant to Section 302 of the Sarbanes-Oxley Act of 2002 – filed herewith
31.2	Certification of Principal Financial Officer Pursuant to Section 302 of the Sarbanes-Oxley Act of 2002 – filed herewith
32	Certification of Principal Executive Officer and Principal Financial Officer Pursuant to Section 906 of the Sarbanes-Oxley Act of 2002 – filed with Original Report
97	Compensation Recovery Policy (Clawback Policy) – filed herewith

8

101	Interactive data file containing the following financial statements of Codorus Valley Bancorp, Inc. formatted in XBRL: (i) Consolidated Balance Sheets at December 31, 2023 and 2022, (ii) Consolidated Statements of Income for the years ended December 31, 2023 and 2022, (iii) Consolidated Statements of Comprehensive Income for the years ended December 31, 2023 and 2022, (iv) Consolidated Statements of Cash Flows for the years ended December 31, 2023 and 2022, (v) Consolidated Statements of Changes in Shareholders’ Equity for the years ended December 31, 2023 and 2022, and (vi) Notes to Consolidated Financial Statements – filed with Original Report.
104	Cover page interactive data file (formatted as inline XBRL and contained in Exhibit 101)
	* Management contract or compensation plan or arrangement required to be filed or incorporated as an exhibit. **Portions of this exhibit which are not material have been omitted because they would likely cause competitive harm to the registrant if publicly disclosed.

9

EX-31.1

EXHIBIT 31.1

Certification of Principal Executive Officer

Pursuant to Section 302 of the Sarbanes-Oxley Act of 2002

I, Craig L. Kauffman, certify that:

1.     I have reviewed this annual report on Form 10-K/A of Codorus Valley Bancorp, Inc.; and

2.    Based on my knowledge, this report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by this report.

3.    [Intentionally omitted]

4.    [Intentionally omitted]

5.    [Intentionally omitted]

Date:   March 14, 2024	/s/ Craig L. Kauffman
	Craig L. Kauffman,
	President and Chief Executive Officer

EX-31.2

EXHIBIT 31.2

Certification of Principal Financial Officer

Pursuant to Section 302 of the Sarbanes-Oxley Act of 2002

I, Larry D. Pickett, certify that:

1. I have reviewed this annual report on Form 10-K/A of Codorus Valley Bancorp, Inc.; and

2. Based on my knowledge, this report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by this report.

3. [Intentionally omitted]

4. [Intentionally omitted]

5. [Intentionally omitted]

Date:   March 14, 2024	/s/ Larry D. Pickett
	Larry D. Pickett
	Treasurer

EX-97

Exhibit 97

CODORUS VALLEY BANCORP, INC.

COMPENSATION RECOVERY POLICY

The Board of Directors (the “Board”) of Codorus Valley Bancorp, Inc. (the “Company”) believes that it is in the best interests of the Company and its shareholders to adopt this Compensation Recovery Policy (the “Policy”), which provides for the recovery of certain incentive compensation in the event of an Accounting Restatement (as defined below) or the commission of Misconduct (as defined below) by a Covered Executive (as defined below). This Policy is designed to comply with, and shall be interpreted to be consistent with, Section 10D of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), Rule 10D-1 promulgated under the Exchange Act (“Rule 10D-1”) and Nasdaq Listing Rule 5608 (the “Listing Standards”). The Policy supersedes that certain Clawback Policy on Recapture of Incentive Compensation adopted by the Board as of January 12, 2016 (the “Prior Policy”).

1. Administration

Except as specifically set forth herein, this Policy shall be administered by the  Compensation Committee of the Board of Directors of the Company (the “Administrator”). The Administrator is authorized to interpret and construe this Policy and to make all determinations necessary, appropriate or advisable for the administration of this Policy. Any determinations made by the Administrator shall be final and binding on all affected individuals and need not be uniform with respect to each individual covered by the Policy. In the administration of this Policy, the Administrator is authorized and directed to consult with the (i) full Board or such other committees of the Board, such as the Company’s Audit Committee, as may be necessary or appropriate as to matters within the scope of such other committees’ responsibility and authority and/or (ii) the Company’s counsel.

Subject to any limitation of applicable law, the Administrator may authorize and empower any officer or employee of the Company to take any and all actions necessary or appropriate to carry out the purpose and intent of this Policy (other than with respect to any recovery under this Policy involving such officer or employee).

2. Definitions

As used in this Policy, the following definitions shall apply:

“Accounting Restatement” means an accounting restatement of the Company’s financial statements due to the Company’s material noncompliance with any financial reporting requirement under U.S. securities laws, including (i) any required accounting restatement to correct error(s) that are material to previously issued financial statement (commonly referred to as “Big R” restatements), or (ii) any restatement that corrects error(s) that are not material to previously issued financial statements, but would result in a material misstatement if the errors were either (a) corrected in the current period or (b) left uncorrected in the current period (commonly referred to as “little r” restatements).  [By way of further explanation, a “little r” restatement differs from a “Big R” restatement primarily in the reason for the error correction (as noted above), the form and timing of reporting, and the disclosure required. For example, a “Big R” restatement requires the company to file an Item 4.02 Form 8–K and to amend its SEC filings promptly to restate the previously issued financial statements. In contrast, a “little r” restatement generally does not trigger an Item 4.02 Form 8–K, and the company is generally permitted to make any corrections the next time the company files the prior year financial statements.] 

“Administrator” has the meaning set forth in Section 1 hereof.

“Applicable Period” means the three completed fiscal years immediately preceding the earlier of (i) the date the Board or the Company’s Audit Committee, concludes (or reasonably should have concluded) that an Accounting Restatement is required or (ii) the date a regulator, court or other legally authorized entity directs the Company to undertake an Accounting Restatement. The “Applicable Period” also includes any transition period (that results from a change in the Company’s fiscal year) within or immediately following the three completed fiscal years identified in the preceding sentence; except that a transition period that comprises a period of at least nine months shall count as a completed fiscal year.

“Covered Executives” means the Company’s current and former executive officers, as determined by the Administrator in accordance with the definition of “executive officer” set forth in Rule 10D-1 and the Listing Standards and such other officers as may be determined in the discretion of the Administrator or the Board.

“Erroneously Awarded Compensation” has the meaning set forth in Section 5 of this Policy.

“Financial Reporting Measure” is any measure that is determined and presented in accordance with the accounting principles used in preparing the Company’s financial statements, and any measure that is derived wholly or in part from such measure and includes “non-GAAP” measures for purposes of Regulation G promulgated under the Exchange Act. Financial Reporting Measures include but are not limited to the following (and any measures derived from the following): Company stock price; total shareholder return (“TSR”); revenues; net income; operating income; operating net income, operating pre-tax pre-provision income, tangible book value, tangible book value without accumulated other comprehensive income (“AOCI”), tangible book value per share, tangible book value per share without AOCI, profitabilityor growthof one or more reportable segments; financial ratios (e.g., yield on loans, rates on deposits, efficiency ratio, net overhead ratio, nonperforming loans to total loans, nonperforming assets to total assets, loans to assets ratio, loans to deposits ratio; allowance for credit losses to total loans, net loan charge-offs to average loans); liquidity measures (e.g.,capital, operating cash flow); return measures (e.g., net interest margin, return on assets, return on equity); earnings measures (e.g., earnings per share); any of such financial reporting measures relative to a peer group, where the Company’s financial reporting measure is subject to an Accounting Restatement; and tax basis income. A Financial Reporting Measure need not be presented within the Company’s financial statements or included in a filing with the Securities and Exchange Commission.

“Incentive-Based Compensation” means any compensation that is granted, earned or vested based wholly or in part upon the attainment of a Financial Reporting Measure. Incentive-Based Compensation is “received” for purposes of this Policy in the Company’s fiscal period during which the Financial Reporting Measure specified in the Incentive-Based Compensation award is attained, even if the payment or grant of such Incentive-Based Compensation occurs after the end of that period. Examples of “Incentive-Based Compensation” include, but are not limited to: non-equity incentive plan awards that are earned based wholly or in part on satisfying a Financial Reporting Measure performance goal; bonuses paid from a “bonus pool,” the size of which is determined based wholly or in part on satisfying a Financial Reporting Measure performance goal; other cash awards based on satisfaction of a Financial Reporting Measure performance goal; restricted stock awards, restricted stock units, performance share awards or units, stock options and stock appreciation rights that are granted or become vested based wholly or in part on satisfying a Financial Reporting Measure performance goal; and proceeds received upon the sale of shares acquired through an incentive plan that were granted or vested based wholly or in part on satisfying a Financial Reporting Measure performance goal. Examples of compensation that is not “incentive-based compensation” include, but are not limited to: salaries (except to the extent a salary increase is earned wholly or in part based on the attainment of a Financial Reporting Measure performance goal); bonuses paid solely at the

2

discretion of the Compensation Committee or Board that are not paid from a “bonus pool” that is determined by satisfying a Financial Reporting Measure performance goal; bonuses paid solely upon satisfying one or more subjective standards (e.g., demonstrated leadership) and/or completion of a specified employment period; non-equity incentive plan awards earned solely upon satisfying one or more strategic measures (e.g., consummating a merger or branch acquisition or divestiture), or operational measures (e.g., opening a specified number of branches, completion of a project, increase in market share); and equity awards for which the grant is not contingent upon achieving any Financial Reporting Measure performance goal and vesting is contingent solely upon completion of a specified employment period and/or attaining one or more nonfinancial reporting measures.

“Misconduct” means fraud, commission of a felony, willful violation of any law, rule or regulation (other than traffic violations or similar offenses) or final cease-and-desist order, material violation of any written agreement with or policies of the Company, or any other material breach of fiduciary duty injurious to the Company.

3. Covered Executives; Incentive-Based Compensation

This Policy applies to Incentive-Based Compensation received by a Covered Executive (a) after beginning service as a Covered Executive; (b) if that person served as a Covered Executive at any time during the performance period for such Incentive-Based Compensation; and (c) while the Company had a listed class of securities on a national securities exchange. This Policy does not apply to Incentive-Based Compensation received by a Covered Executive (x) while that person was serving in a non-executive capacity prior to becoming a Covered Executive or (y) who is a Covered Executive on the date on which the Company is required to prepare an Accounting Restatement but who was not a Covered Executive at any time during the performance period for which the Incentive-Based Compensation is received.

4. Required Recoupment of Erroneously Awarded Compensation in the Event of an Accounting Restatement

In the event the Company is required to prepare an Accounting Restatement, the Company shall reasonably promptly recoup the amount of any Erroneously Awarded Compensation received by any Covered Executive, as calculated pursuant to Section 5 hereof, relating to the Applicable Period.

5. Erroneously Awarded Compensation: Amount Subject to Recovery

The amount of “Erroneously Awarded Compensation” subject to recovery under the Policy, as determined by the Administrator, is the amount of Incentive-Based Compensation received by the Covered Executive that exceeds the amount of Incentive-Based Compensation that would have been received by the Covered Executive had such compensation been determined based on the restated amounts.

Erroneously Awarded Compensation shall be computed by the Administrator without regard to any taxes paid by the Covered Executive in respect of the Erroneously Awarded Compensation. By way of example, with respect to any compensation plans or programs that take into account Incentive-Based Compensation, the amount of Erroneously Awarded Compensation subject to recovery hereunder includes, but is not limited to, the amount contributed to any notional account based on Erroneously Awarded Compensation and any earnings accrued to date on that notional amount.

For Incentive-Based Compensation based on stock price or TSR: (a) the Administrator shall determine the amount of Erroneously Awarded Compensation based on a reasonable estimate of the effect of the Accounting Restatement on the stock price or TSR upon which the Incentive-Based Compensation was received; and (b) the Company shall maintain documentation of the determination

3

of that reasonable estimate and provide such documentation to The Nasdaq Stock Market (“Nasdaq”) and the Covered Executive(s).

6. Method of Recoupment

The Administrator shall determine, in its sole discretion, the timing and method for reasonably promptly recouping Erroneously Awarded Compensation hereunder, which may include without limitation (a) seeking reimbursement of all or part of any cash or equity-based award, (b) cancelling prior cash or equity-based awards, whether vested or unvested or paid or unpaid, (c) cancelling or offsetting against any planned future cash or equity-based awards, (d) forfeiture of deferred compensation, subject to compliance with Section 409A of the Internal Revenue Code of 1986, as amended (“IRC”) and the regulations promulgated thereunder, and (e) any other method authorized by applicable law or contract. Subject to compliance with any applicable law, the Administrator may affect recovery under this Policy from any amount otherwise payable to the Covered Executive, including amounts payable to such individual under any otherwise applicable Company plan, program or contract, including base salary, bonuses or commissions and compensation previously deferred by the Covered Executive.

The Company is authorized and directed pursuant to this Policy to recoup Erroneously Awarded Compensation in compliance with this Policy unless the Compensation Committee of the Boardhas determined that recovery would be impracticable solely for the following limited reasons, and subject to the following procedural and disclosure requirements:

· The direct expense paid to a third party to assist in enforcing the Policy would exceed the amount to be recovered. Before concluding that it would be impracticable to recover any amount of Erroneously Awarded Compensation based on expense of enforcement, the Administrator must make a reasonable attempt to recover such Erroneously Awarded Compensation, document such reasonable attempt(s) to recover and provide that documentation to Nasdaq;

· Recovery would violate any law of the United States that was adopted prior to November 28, 2022. Before concluding that it would be impracticable to recover any amount of Erroneously Awarded Compensation based on a violation of law, the Administrator must satisfy the applicable opinion and disclosure requirements of Rule 10D-1 and the Listing Standards; or

· Recovery would likely cause an otherwise tax-qualified retirement plan, under which benefits are broadly available to employees of the Company, to fail to meet the requirements of Sections 401(a)(13) or 411(a) of the IRC and the regulations thereunder.

If litigation becomes necessary to collect any Erroneously Awarded Compensation recoverable under this Policy, the Company shall be entitled to recover from the Covered Executive(s) all of its reasonable attorneys’ fees and costs of enforcement or collection.

7. Recovery Due to Misconduct

If the Administrator determines that a Covered Executive has committed Misconduct but such Misconduct does not result in an Accounting Restatement, the amount to be recovered and subject to recoupmentor forfeited with respect to Incentive-Based Compensation not yet earned or received shall be determined by the Administrator and approved by the Board. The Administrator shall determine in its discretion, subject to Board approval, the timing and method for reasonably promptly recouping such Incentive-Based Compensation as a result of such Misconduct and effect recovery of such Incentive-Based Compensation from any amount payable to the Covered Executive including (a) seeking reimbursement of all or part of any cash or equity-based award, (b) cancelling prior cash or

4

equity-based awards, whether vested or unvested or paid or unpaid, (c) cancelling or offsetting against any planned future cash or equity-based awards, (d) forfeiture of deferred compensation, subject to compliance with Section 409A of the IRC and the regulations promulgated thereunder, and (e) any other method authorized by applicable law or contract.

If litigation becomes necessary to collect any Incentive-Based Compensation being recouped as a result of a determination of the occurrence of Misconduct by a Covered Executive recoverable under this Policy, the Company shall be entitled to recover from the Covered Executive(s) all of its reasonable attorneys’ fees and costs of enforcement or collection.

8. No Additional Payments

In no event shall the Company be required to award Covered Executives an additional payment if the Accounting Restatement results in a higher Incentive-Based Compensation payment.

9. No Indemnification or Reimbursement of Covered Executives

Notwithstanding the terms of any other policy, program, agreement or arrangement, in no event will the Company or any of its affiliates indemnify or reimburse a Covered Executive for any loss under this Policy and in no event will the Company or any of its affiliates pay premiums or reimburse the Covered Executive for premiums he or she paid on any insurance policy that would cover a Covered Executive’s potential obligations with respect to Erroneously Awarded Compensation under this Policy.

10. Administrator Indemnification

Any members of the Administrator, and any other members of the Board or officers of the Company who assist in the administration of this Policy, shall not be personally liable for any action, determination or interpretation made with respect to this Policy and shall be fully indemnified by the Company to the fullest extent under applicable law and Company policy with respect to any such action, determination or interpretation. The foregoing sentence shall not limit any other rights to indemnification of the members of the Board under applicable law or Company policy.

11. Effective Date; Retroactive Application

This Policy shallbe effective as of December  1,2023  (the “Effective Date”). The terms of this Policy shall apply to any Incentive-Based Compensation that is received by Covered Executives on or after October 2, 2023, even if such Incentive-Based Compensation was approved, awarded or granted to Covered Executives prior to October 2, 2023. Without limiting the generality of Section 6 hereof, and subject to applicable law, the Administrator may affect recovery under this Policy from any amount of compensation approved, awarded, granted, payable or paid to the Covered Executive prior to, on or after the Effective Date. This Policy shall supersede and replace any existing policy, including, but not limited to, the Prior Policy, regarding the recovery of Erroneously Awarded Compensation or Incentive-Based Compensation subject to recovery or forfeiture due to Misconduct, previously approved by the Board.

5

12. Acknowledgement by Covered Executives; Condition to Eligibility for Incentive-Based Compensation.

The Company will provide notice and seek acknowledgement of this Policy from each Covered Executive in the form attached hereto as Exhibit A, provided that the failure to provide such notice or obtain such acknowledgement will have no impact on the applicability or enforceability of this Policy. After the Effective Date, the Company must be in receipt of a Covered Executive’s acknowledgement as a condition to such Covered Executive’s eligibility to receive Incentive-Based Compensation awarded or received after such date. All Incentive-Based Compensation subject to this Policy will not be earned (other than for income tax purposes), even if already paid, until the Policy ceases to apply to such Incentive-Based Compensation and any other vesting conditions applicable to such Incentive-Based Compensation are satisfied.

13. Amendment; Termination

The Board may amend, modify, supplement, rescind or replace all or any portion of this Policy at any time and from time to time in its discretion, and shall amend this Policy as it deems necessary to comply with applicable law or any rules or standards adopted by a national securities exchange on which the Company’s securities are listed.

14. Other Recoupment Rights; Company Claims

The Board intends that this Policy shall be applied to the fullest extent of the law. Any right of recoupment under this Policy is in addition to, and not in lieu of, any other remedies or rights of recoupment that may be available to the Company under applicable law or pursuant to the terms of any similar policy in any employment agreement, equity award agreement, or similar agreement and any other legal remedies available to the Company.

Nothing contained in this Policy, and no recoupment or recovery as contemplated by this Policy, shall limit any claims, damages or other legal remedies the Company or any of its affiliates may have against a Covered Executive arising out of or resulting from any actions or omissions by the Covered Executive.

15. Successors

This Policy shall be binding and enforceable against all Covered Executives and their beneficiaries, heirs, executors, administrators or other legal representatives.

16. Exhibit Filing Requirement

A copy of this Policy and any amendments thereto shall be posted on the Company’s website and filed as an exhibit to the Company’s Annual Report on Form 10-K.

6

EXHIBIT A

TO BE SIGNED BY THE COMPANY’S EXECUTIVE OFFICERS:

Compensation Recovery Policy Acknowledgment

The undersigned agrees and acknowledges that I am fully bound by, and subject to, all of the terms and conditions of the Codorus Valley Bancorp, Inc. (the “Company”) Compensation Recovery Policy (as may be amended, restated, supplemented or otherwise modified from time to time, the “Policy”). Further, the undersigned agrees and acknowledges that the Policy supersedes that certain Clawback Policy on Recoupment of Incentive Compensation previously adopted by the Company as of January 12, 2016 (the “Prior Policy”). In the event of any inconsistency between the Policy and the terms of any employment agreement to which I am a party, the terms of the Prior Policy or the terms of any compensation plan, program or agreement under which any compensation has been granted, awarded, earned or paid, including but not limited to the 2017 Long-Term Incentive Plan, as amended, of the Company, the terms of the Policy shall govern. In the event it is determined by the Administrator that any amounts granted, awarded, earned or paid to me must be forfeited or reimbursed to the Company, I will promptly take any action necessary to effectuate such forfeiture and/or reimbursement. Any capitalized terms used in this Acknowledgment without definition shall have the meaning set forth in the Policy.

By: __________________________________________________________________

[Name]Date

[Title]

XML

Document And Entity Information - USD ($)	12 Months Ended
	Dec. 31, 2023	Mar. 01, 2024	Jun. 30, 2023
Document And Entity Information [Abstract]
Document Type	10-K/A
Document Annual Report	true
Document Fiscal Period Focus	FY
Current Fiscal Year End Date	--12-31
Document Period End Date	Dec. 31, 2023
Document Fiscal Year Focus	2023
Document Transition Report	false
Entity File Number	0-15536
Entity Registrant Name	CODORUS VALLEY BANCORP, INC.
Entity Incorporation, State or Country Code	PA
Entity Tax Identification Number	23-2428543
Entity Address, Address Line One	105 Leader Heights Road
Entity Address, City or Town	York
Entity Address, State or Province	PA
Entity Address, Postal Zip Code	17403
City Area Code	717
Local Phone Number	747-1519
Title of 12(b) Security	Common Stock, $2.50 par value
Trading Symbol	CVLY
Security Exchange Name	NASDAQ
Entity Well-known Seasoned Issuer	No
Entity Voluntary Filers	No
Entity Current Reporting Status	Yes
Entity Interactive Data Current	Yes
Entity Filer Category	Non-accelerated Filer
Entity Small Business	true
Entity Emerging Growth Company	false
ICFR Auditor Attestation Flag	false
Document Financial Statement Error Correction [Flag]	false
Entity Shell Company	false
Entity Public Float			$ 181,853,487
Entity Common Stock, Shares Outstanding		9,642,669
Entity Central Index Key	0000806279
Amendment Flag	false
Auditor Firm ID	173
Auditor Name	Crowe LLP
Auditor Location	Columbus, OH