UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

 Washington, D.C. 20549

FORM 10-K

☒             ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended December 31, 2021

☐             TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from                       to                                         .

Commission file number 001-13695

(Exact name of registrant as specified in its charter)

Delaware	16-1213679.
(State or other jurisdiction of incorporation or organization)	(I.R.S. Employer Identification No.)

5790 Widewaters Parkway, DeWitt, New York	13214-1883
(Address of principal executive offices)	(Zip Code)

Registrant’s telephone number, including area code: (315) 445-2282

Securities registered pursuant to Section 12(b) of the Act:

Title of each class	Trading Symbol(s)	Name of each exchange on which registered
Common Stock, $1.00 par value per share	CBU	New York Stock Exchange

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒     No  ☐ .

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐   No ☒ .

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒     No ☐ .

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒    No ☐ .

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer	☒	Accelerated filer	☐
Non-accelerated filer	☐	Smaller reporting company	☐
		Emerging growth company	☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act.☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐    No ☒.

The aggregate market value of the common stock, $1.00 par value per share, held by non-affiliates of the registrant computed by reference to the closing price as of the close of business on June 30, 2021 (the registrant’s most recently completed second fiscal quarter): $4,022,854,197.

The number of shares of the common stock, $1.00 par value per share, outstanding as of the close of business on January 31, 2022: 53,864,500

DOCUMENTS INCORPORATED BY REFERENCE.

Portions of the Definitive Proxy Statement for the Annual Meeting of the Shareholders to be held on May 18, 2022 (the “Proxy Statement”) is incorporated by reference in Part III of this Annual Report on Form 10-K.

1

TABLE OF CONTENTS

PART I		Page
Item 1	Business	3
Item 1A	Risk Factors	17
Item 1B	Unresolved Staff Comments	28
Item 2	Properties	28
Item 3	Legal Proceedings	28
Item 4	Mine Safety Disclosures	28
PART II
Item 5	Market for the Registrant’s Common Equity, Related Stockholders Matters and Issuer Purchases of Equity Securities	28
Item 6	[Reserved]	30
Item 7	Management’s Discussion and Analysis of Financial Condition and Results of Operations	31
Item 7A	Quantitative and Qualitative Disclosures about Market Risk	68
Item 8	Financial Statements and Supplementary Data:	70
	Consolidated Statements of Condition	71
	Consolidated Statements of Income	72
	Consolidated Statements of Comprehensive Income	73
	Consolidated Statements of Changes in Shareholders’ Equity	74
	Consolidated Statements of Cash Flows	75
	Notes to Consolidated Financial Statements	76
	Report on Internal Control over Financial Reporting	134
	Report of Independent Registered Public Accounting Firm	135
Item 9	Changes in and Disagreements with Accountants on Accounting and Financial Disclosure	137
Item 9A	Controls and Procedures	137
Item 9B	Other Information	137
Item 9C	Disclosure Regarding Foreign Jurisdictions that Prevent Inspections	137
PART III
Item 10	Directors, Executive Officers and Corporate Governance	137
Item 11	Executive Compensation	138
Item 12	Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters	138
Item 13	Certain Relationships and Related Transactions, and Director Independence	138
Item 14	Principal Accounting Fees and Services	138
PART IV
Item 15	Exhibits, Financial Statement Schedules	138
Item 16	Form 10-K Summary	143
	Signatures	144

2

Part I

This Annual Report on Form 10-K contains certain forward-looking statements with respect to the financial condition, results of operations and business of Community Bank System, Inc. These forward-looking statements by their nature address matters that involve certain risks and uncertainties. Factors that may cause actual results to differ materially from those contemplated by such forward-looking statements are set forth herein under the caption “Forward-Looking Statements.”

Item 1. Business

Community Bank System, Inc. (the “Company”) was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company is a registered financial holding company which wholly-owns two significant subsidiaries: Community Bank, N.A. (the “Bank” or “CBNA”), and Benefit Plans Administrative Services, Inc. (“BPAS”). As of December 31, 2021, BPAS owns five subsidiaries: Benefit Plans Administrative Services, LLC (“BPA”), a provider of defined contribution plan administration services; Northeast Retirement Services, LLC (“NRS”), a provider of institutional transfer agency, master recordkeeping services, fund administration, trust, and retirement plan services; BPAS Actuarial & Pension Services, LLC (“BPAS-APS”), a provider of actuarial and benefit consulting services; BPAS Trust Company of Puerto Rico, a Puerto Rican trust company; and Hand Benefits & Trust Company (“HB&T”), a provider of collective investment fund administration and institutional trust services. BPA owns one subsidiary, Fringe Benefits Design of Minnesota, Inc. (“FBD”), a provider of retirement plan administration and benefit consulting services. NRS owns one subsidiary, Global Trust Company, Inc. (“GTC”), a non-depository trust company which provides fiduciary services for collective investment trusts and other products. HB&T owns one subsidiary, Hand Securities, Inc. (“HSI”), an introducing broker-dealer.

The Bank’s business philosophy is to operate as a diversified financial services enterprise providing a broad array of banking and other financial services to retail, commercial and municipal customers. As of December 31, 2021, the Bank operates 206 full-service branches and 12 drive-thru only locations operating as Community Bank, N.A. throughout 42 counties of Upstate New York, six counties of Northeastern Pennsylvania, 12 counties of Vermont, and one county of Western Massachusetts, offering a range of commercial and retail banking services. The Bank owns the following operating subsidiaries: The Carta Group, Inc. (“Carta Group”), CBNA Preferred Funding Corporation (“PFC”), CBNA Treasury Management Corporation (“TMC”), Community Investment Services, Inc. (“CISI”), Nottingham Advisors, Inc. (“Nottingham”), OneGroup NY, Inc. (“OneGroup”), OneGroup Wealth Partners, Inc. (“Wealth Partners”) and Oneida Preferred Funding II LLC (“OPFC II”). OneGroup is a full-service insurance agency offering personal and commercial lines of insurance and other risk management products and services. PFC and OPFC II primarily act as investors in residential and commercial real estate activities. TMC provides cash management, investment, and treasury services to the Bank. CISI, Carta Group and Wealth Partners provide broker-dealer and investment advisory services. Nottingham provides asset management services to individuals, corporations, corporate pension and profit sharing plans, and foundations.

The Company maintains a website at cbna.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information posted on the website is not incorporated into or a part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC  20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at https://www.sec.gov.

Acquisition History (2019-2021)

Elmira Savings Bank – Pending Acquisition

On October 4, 2021, the Company announced that the Bank had entered into an agreement to acquire Elmira Savings Bank (“Elmira”), a twelve branch banking franchise headquartered in Elmira, New York, for $82.8 million in cash. The acquisition will enhance the Company’s presence in five counties in New York’s Southern Tier and Finger Lakes regions. Elmira had total assets of $632.2 million, total deposits of $541.0 million, and net loans of $458.6 million at December 31, 2021. The merger was approved by the shareholders of Elmira on December 14, 2021. The Company expects to complete the acquisition in the second quarter of 2022, subject to customary closing conditions, including required regulatory approval.

3

Thomas Gregory Associates Insurance Brokers, Inc.

On August 2, 2021, the Company, through its subsidiary OneGroup, completed its acquisition of certain assets of Thomas Gregory Associates Insurance Brokers, Inc. (“TGA”), a specialty-lines insurance broker based in the Boston, Massachusetts area for $13.1 million, including $11.6 million in cash and contingent consideration valued at $1.5 million. The Company recorded a $10.9 million customer list intangible asset and $2.2 million of goodwill in conjunction with the acquisition.

Fringe Benefits Design of Minnesota, Inc.

On July 1, 2021, the Company, through its subsidiary BPA, completed its acquisition of Fringe Benefits Design of Minnesota, Inc. (“FBD”), a provider of retirement plan administration and benefit consulting services with offices in Minnesota and South Dakota, for $16.7 million, including $15.3 million in cash and contingent consideration valued at $1.4 million. As of December 31, 2021, the contingent consideration is valued at $1.6 million, resulting in a $0.2 million acquisition-related contingent consideration adjustment recorded in the consolidated statements of income in 2021. The Company recorded a $14.0 million customer list intangible asset and $2.1 million of goodwill in conjunction with the acquisition.

NuVantage Insurance Corp.

On June 1, 2021, the Company, through its subsidiary OneGroup, completed its acquisition of certain assets of NuVantage Insurance Corp. (“NuVantage”), an insurance agency headquartered in Melbourne, Florida. The Company paid $2.9 million in cash and recorded a $1.4 million customer list intangible asset and $1.5 million of goodwill in conjunction with the acquisition.

Steuben Trust Corporation

On June 12, 2020, the Company completed its merger with Steuben Trust Corporation (“Steuben”), parent company of Steuben Trust Company, a New York State chartered bank headquartered in Hornell, New York, for $98.6 million in Company stock and cash, comprised of $21.6 million in cash and the issuance of 1.36 million shares of common stock. The merger extended the Company’s footprint into two new counties in Western New York State, and enhanced the Company’s presence in four Western New York State counties in which it had already operated. In connection with the merger, the Company added 11 full-service offices to its branch service network and acquired $607.8 million of assets, including $339.7 million of loans and $180.5 million of investment securities, as well as $516.3 million of deposits. Goodwill of $20.0 million, a $2.9 million core deposit intangible asset and a $1.2 million customer list intangible asset were recognized as a result of the merger.

Financial Services Practice – Syracuse, NY

On September 18, 2019, the Company, through its subsidiary, CISI, completed its acquisition of certain assets of a practice engaged in the financial services business headquartered in Syracuse, New York. The Company paid $0.5 million in cash to acquire a customer list, and recorded a $0.5 million customer list intangible asset in conjunction with the acquisition.

Kinderhook Bank Corp.

On July 12, 2019, the Company completed its merger with Kinderhook Bank Corp. (“Kinderhook”), parent company of The National Union Bank of Kinderhook, headquartered in Kinderhook, New York, for $93.4 million in cash. The merger added 11 branch locations across a five county area in the Capital District of Upstate New York. The merger resulted in the acquisition of $642.8 million of assets, including $479.9 million of loans and $39.8 million of investment securities, as well as $568.2 million of deposits and $40.0 million in goodwill.

Wealth Resources Network, Inc.

On January 2, 2019, the Company, through its subsidiary, CISI, completed its acquisition of certain assets of Wealth Resources Network, Inc. (“Wealth Resources”), a financial services business headquartered in Liverpool, New York. The Company paid $1.2 million in cash to acquire a customer list from Wealth Resources, and recorded a $1.2 million customer list intangible asset in conjunction with the acquisition.

4

Services

Banking

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank's branches are generally located in smaller towns and cities within its geographic market areas of Upstate New York, Northeastern Pennsylvania, Vermont and Western Massachusetts. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch, regional levels and its digital banking service offerings, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System, the Federal Home Loan Bank of New York and the Federal Home Loan Bank of Boston (as a non-member bank) (collectively, referred to as “FHLB”), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Employee Benefit Services

Through BPAS and its subsidiaries, the Company operates a national practice that provides employee benefit trust, collective investment fund, retirement plan administration, fund administration, transfer agency, actuarial, VEBA/HRA and health and welfare consulting services to a diverse array of clients spanning the United States and Puerto Rico.

Wealth Management Services

Through the Bank’s trust department, CISI, Carta Group, Nottingham, and Wealth Partners, the Company provides wealth management, retirement planning, higher educational planning, fiduciary, risk management, trust services and personal financial planning services. The Company offers investment alternatives including stocks, bonds, mutual funds, insurance and advisory products.

Insurance Services

Through OneGroup, the Company offers personal and commercial lines of insurance and other risk management products and services. In addition, OneGroup offers employee benefit related services. OneGroup represents many leading insurance companies.

Segment Information

The Company has identified three reportable operating business segments:  Banking, Employee Benefit Services, and All Other. Included in the All Other segment are the smaller Wealth Management and Insurance operations. Information about the Company’s reportable business segments is included in Note U of the “Notes to Consolidated Financial Statements” filed herewith in Part II.

Competition

The banking and financial services industry is highly competitive in the New York, Pennsylvania, Vermont, and Massachusetts markets. The Company competes actively for loans, deposits, and financial services relationships with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, including, financial technology companies, insurance agencies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The Company’s employee benefit trust and plan administration business competes on a national scale and provides geographic diversification for the Company. Certain lines of business are marketed primarily through unaffiliated financial advisors, while others are marketed directly to plan sponsors and fund companies. In order to compete with large national firms, the Company stresses its consultative approach to complex engagements.

The table below summarizes the Bank’s deposits and market share by the 61 counties of New York, Pennsylvania, Vermont, and Massachusetts in which it had customer facilities as of June 30, 2021. Market share is based on deposits of all commercial banks, credit unions, savings and loan associations, and savings banks.

5

							Number of
		Deposits as of 6/30/2021(1)		Market Share					Towns/	Towns Where Company Has 1st or
County	State	(000's omitted)		(1)		Branches		ATM's	Cities	Towns Where Position
Grand Isle	VT	$	52,321	100.00	%	1		1	1	1
Allegany	NY		601,552	79.36	%	10		14	9	9
Lewis	NY		265,837	71.48	%	4		4	3	3
Hamilton	NY		71,146	60.02	%	2		2	2	2
Franklin	NY		470,650	54.81	%	6		5	4	4
Madison	NY		487,528	41.28	%	6		8	5	5
Cattaraugus	NY		775,070	40.17	%	9		11	7	6
Otsego	NY		404,353	27.76	%	9		9	6	5
Saint Lawrence	NY		640,699	25.56	%	10		12	9	8
Seneca	NY		167,514	24.69	%	3		3	3	2
Schuyler	NY		63,626	23.44	%	1		1	1	1
Jefferson	NY		608,321	22.83	%	7		7	6	5
Yates	NY		125,549	22.27	%	3		2	2	1
Clinton	NY		507,678	22.24	%	3		6	2	2
Livingston	NY		271,370	21.07	%	5		8	5	4
Wyoming	PA		167,967	20.31	%	3		3	3	2
Chautauqua	NY		509,708	19.24	%	11		11	10	6
Columbia	NY		282,507	17.38	%	4		3	4	3
Essex	NY		175,779	15.93	%	4		4	4	3
Oswego	NY		269,670	13.63	%	4		5	4	2
Steuben	NY		496,905	11.93	%	10		11	9	7
Wayne	NY		181,780	11.32	%	3		4	2	2
Addison	VT		93,039	10.66	%	2		2	2	1
Ontario	NY		327,002	10.45	%	7		13	5	3
Caledonia	VT		79,518	9.06	%	2		2	2	1
Bennington	VT		100,540	9.01	%	2		4	2	0
Orange	VT		37,758	8.97	%	1		1	1	1
Herkimer	NY		71,341	8.48	%	1		1	1	1
Tioga	NY		44,947	8.29	%	2		2	2	1
Delaware	NY		138,633	7.86	%	4		4	4	3
Chittenden	VT		697,821	7.44	%	9		10	7	3
Rutland	VT		139,639	7.20	%	3		4	2	1
Luzerne	PA		575,994	6.61	%	9		13	8	4
Montgomery	NY		68,033	6.48	%	2		2	2	1
Franklin	VT		56,963	6.44	%	2		2	2	0
Chemung	NY		87,440	6.11	%	2		2	1	0
Lackawanna	PA		508,313	5.98	%	10		9	7	4
Susquehanna	PA		74,756	5.65	%	2		1	2	1
Carbon	PA		58,543	5.34	%	2		2	2	1
Fulton	NY		59,392	5.26	%	1		1	1	0
Windham	VT		67,258	4.89	%	2		3	2	1
Windsor	VT		86,002	4.75	%	2		2	2	0
Schoharie	NY		27,203	4.53	%	1		1	1	0
Washington	NY		40,695	4.31	%	1		1	1	1
Oneida	NY		319,969	3.81	%	6		8	5	4
Lamoille	VT		34,904	3.79	%	1		1	1	1
Cayuga	NY		57,200	3.23	%	2		2	2	1
Washington	VT		112,528	2.92	%	3		4	3	1
Bradford	PA		42,574	2.69	%	2		2	2	1
Chenango	NY		30,599	2.38	%	2		2	1	0
Rensselaer	NY		63,535	2.08	%	1		2	1	0
Onondaga	NY		337,305	2.00	%	4		5	4	1
Warren	NY		45,378	1.59	%	1		1	1	1
Wyoming	NY		23,775	1.11	%	1		1	1	0
Ulster	NY		59,597	1.03	%	1		1	1	1
Broome	NY		36,875	0.45	%	1		1	1	0
Albany	NY		90,990	0.33	%	3		7	3	0
Erie	NY		216,878	0.32	%	5		5	4	2
Hampden	MA		46,080	0.28	%	1		1	1	0
Tompkins	NY		5,683	0.14	%	1		0	1	0
Monroe	NY		7,157	0.03	%	1		0	1	0
		$	12,569,387	4.47	%	223		259	193	124

(1) Deposits and Market Share data as of June 30, 2021, the most recent information available from S&P Global Market Intelligence. Deposit amounts include $230.4 million of intercompany balances that are eliminated upon consolidation.

6

Human Capital Resources

As of December 31, 2021, the Company had 2,927 total employees, which included 2,728 full-time employees and 199 part-time and temporary employees. Of the Company’s 2,927 employees, 2,268 are in the Banking segment (2,083 full-time employees and 185 part-time and temporary employees), 396 employees are in the Employee Benefit Services segment (388 full-time employees and 8 part-time and temporary employees), and 263 employees are in the All Other segment (257 full-time employees and 6 part-time and temporary employees). The Company considers its relationship with its employees to be good. The Company has not experienced any material employment-related issues or interruptions of services due to labor disagreements. None of the Company’s employees are represented by a labor union or are represented by a collective bargaining agreement.

Compensation and Benefits

The success and growth of the Company’s business is largely dependent on its ability to attract, develop, and retain a population of talented and high-performing employees with a diversity of background and skill sets at all levels of our organization. Accordingly, the Company strives to offer competitive salaries and benefits that are consistent with employee positions, skill levels, experience, and geographic location. The Company is proud to offer an array of incentive compensation in which all employees have an opportunity to earn various forms of supplemental pay as a reward for their overall contributions towards the Company’s financial objectives. Additionally, the Company offers a wellness program aimed at providing tools, resources, and encouragement to support its employees’ physical and mental well-being.

Growth and Development

The Company continues to broaden the scope of its talent development initiatives across its widening geographically diverse footprint in order to sustain a value-driven and growth-oriented environment where employees can perform at their peak and the next generation of leaders are prepared to lead. In 2021, the Company implemented a new HR operating system which includes several features to support talent development, enhanced performance management tools and other features that provide a more streamlined employee experience for various transactions. The Company offers an array of programs and continuing education dedicated to strengthen employee engagement, personal accountability, productivity, and emotional well-being including customized programs supporting an overall strategy of strong workforce planning, growth-focused coaching sessions, career-path roadmaps and curated learning resources. The Company is committed to enabling a culture that celebrates talent sharing, career development and agility across the Company and generally posts all roles internally first before sharing them externally.

Culture and Diversity

The Company is committed to fostering a workforce in an inclusive environment that enhances the culture of shared identity, civility, dignity, and respect. The Company has a company-wide Culture and Diversity Council that supports this effort and provides strategic direction and advocacy for these initiatives. The Council’s members play a vital role in creating the Company’s culture and diversity initiatives and are comprised of employees from various areas of the Company’s business and geographic locations. The Council members, along with other employees who volunteer to act as “Council Ambassadors,” are responsible for advancing the Council’s message within their own network of employees. Their efforts demonstrate the Company’s commitment to creating a work environment where everyone feels welcomed, valued, and fully engaged to contribute their unique talents and transform that deeper understanding into the organization’s culture. The Culture and Diversity Council has developed a set of initiatives to increase focus on diversity, equity, and inclusion across the key areas of talent acquisition and retention; employee community service spotlights; senior leadership composition; a collaborative learning and development campaign centered on greater awareness of unconscious bias; and vendor selection monitoring.

7

Engagement

The Company is committed to creating a world class workplace filled with highly satisfied and engaged employees. The Company believes that open and honest communication among employees, managers and executive leadership fosters an open and collaborative work environment where everyone can participate, develop and thrive. In 2021, the Company launched a Company-wide engagement process called “MyVoice” which was initiated with an engagement survey to gauge employee sentiment in areas like culture, career development, manager performance and inclusivity with 83% employee participation. The collective results from the survey highlighted that engagement, performance, and employee development are interlinked and interdependent. The Company’s primary objective in 2022 will be to equip managers with the tools to take daily responsibility for engagement and development by identifying and building individual team action plans from the engagement and performance data garnered from the survey results. These action plans will be created at the local level by having frequent, meaningful conversations with individuals on their teams to identify and then take ownership of improving the workplace experience for their team.

Health and Safety

As the COVID-19 events continued throughout 2021, the Company continued to implement various plans, strategies and protocols to protect its employees, customers and stakeholders, among other objectives. In order to protect its employees and assure workforce continuity and operational redundancy, the Company continued and adjusted as appropriate many of its protocols in order to conduct the Company’s operations in a safe and efficient manner. The safety of its customers, employees, stakeholders and communities will always remain the Company’s top priority.

Supervision and Regulation

General

The banking industry is highly regulated with numerous statutory and regulatory requirements that are designed primarily for the protection of depositors and the financial system. Set forth below is a description of the material laws and regulations applicable to the Company and the Bank. This summary is not complete and the reader should refer to these laws and regulations for more detailed information. The Company’s and the Bank’s failure to comply with applicable laws and regulations could result in a range of sanctions and administrative actions imposed upon the Company and/or the Bank, including restriction to merger and acquisition activity, the imposition of civil money penalties, formal agreements and cease and desist orders. Changes in applicable law or regulations, and in their interpretation and application by regulatory agencies, cannot be predicted, and may have a material effect on the Company’s business and results.

The Company and its subsidiaries are subject to the laws and regulations of the federal government and where applicable the states and jurisdictions in which they conduct business. The Company, as a bank holding company, is subject to extensive regulation, supervision and examination by the Board of Governors of the Federal Reserve System (“FRB”) as its primary federal regulator. The Bank is a nationally-chartered bank and is subject to extensive regulation, supervision and examination by the Office of the Comptroller of the Currency (“OCC”) as its primary federal regulator, and as to certain matters, the FRB, the Consumer Financial Protection Bureau (“CFPB”), and the Federal Deposit Insurance Corporation (“FDIC”).

The Company is also subject to the jurisdiction of the SEC and is subject to disclosure and regulatory requirements under the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended. The Company’s common stock is listed on the New York Stock Exchange (“NYSE”) and it is subject to NYSE’s rules for listed companies. Affiliated entities, including BPAS, GTC, HB&T, HSI, BPAS Trust Company of Puerto Rico,FBD, Nottingham, CISI, OneGroup, Carta Group, and Wealth Partners are subject to the jurisdiction of certain state and federal regulators and self-regulatory organizations including, but not limited to, the SEC, the Texas Department of Banking, the State of Maine Bureau of Financial Institutions, the Financial Industry Regulatory Authority (“FINRA”), Puerto Rico Office of the Commissioner of Financial Institutions, the U.S. Department of Labor, and state securities and insurance regulators.

8

Federal Bank Holding Company Regulation

The Company became a financial holding company effective September 30, 2015. As a financial holding company, the Company can affiliate with securities firms and insurance companies and engage in other activities that are “financial in nature” or “incidental” or “complementary” to activities that are financial in nature, as long as it continues to meet the eligibility requirements for financial holding companies (including requirements that the financial holding company and its depository institution subsidiary maintain their status as “well capitalized” and “well managed”).

Generally, FRB approval is not required for the Company to acquire a company (other than a bank holding company, bank or savings association) engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the FRB. Prior notice to the FRB may be required, however, if the company to be acquired has total consolidated assets of $10 billion or more. Prior FRB approval is required before the Company may acquire the beneficial ownership or control of more than 5% of the voting shares or substantially all of the assets of a bank holding company, bank or savings association.

Because the Company is a financial holding company, if the Bank were to receive a rating under the Community Reinvestment Act of 1977, as amended (“CRA”), of less than Satisfactory, the Company will be prohibited, until the rating is raised to Satisfactory or better, from engaging in new activities or acquiring companies other than bank holding companies, banks or savings associations, except that the Company could engage in new activities, or acquire companies engaged in activities, that are considered “closely related to banking” under the Bank Holding Company Act of 1956, (the “BHC Act”). The Bank’s most recent CRA rating was “Satisfactory”. In addition, if the FRB determines that the Company or the Bank is not well capitalized or well managed, the Company would be required to enter into an agreement with the FRB to comply with all applicable capital and management requirements and may contain additional limitations or conditions. Until corrected, the Company could be prohibited from engaging in any new activity or acquiring companies engaged in activities that are not closely related to banking, absent prior FRB approval.

Federal Reserve System Regulation

Because the Company is a financial holding company, it is subject to regulatory capital requirements and required by the FRB to, among other things, maintain cash reserves against its deposits. Effective on March 26, 2020, the FRB reduced this cash reserve requirement to zero percent to help support lending to households and businesses as a result of the impacts of the COVID-19 pandemic. The Bank is under similar capital requirements administered by the OCC as discussed below. FRB policy has historically required a financial holding company to act as a source of financial and managerial strength to its subsidiary banks. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) codifies this historical policy as a statutory requirement. To the extent the Bank is in need of capital, the Company could be expected to provide additional capital, including borrowings from the FRB for such purpose. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors’ funds.

The FRB also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the FRB, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust its strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond its control.

The Office of the Comptroller of the Currency Regulation (“OCC”)

The Bank is supervised and regularly examined by the OCC. The various laws and regulations administered by the OCC affect the Company’s practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects the Bank’s business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and the location of its offices. The OCC generally prohibits a depository institution from making any capital distributions, including the payment of a dividend, or paying any management fee to its parent holding company if the depository institution would become undercapitalized due to the payment. Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the OCC. The Bank is well capitalized under regulatory standards administered by the OCC. For additional information on our capital requirements see “Management’s Discussion and Analysis of Financial Condition and Results of Operations – Shareholders’ Equity” and Note P to the Financial Statements.

9

Federal Home Loan Bank (“FHLB”)

The Bank is a member of the FHLB, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to the rules and requirements of the FHLB, including the purchase of shares of FHLB activity-based stock in the amount of 4.5% of the dollar amount of outstanding advances and FHLB capital stock in an amount equal to the greater of $1,000 or the sum of 0.15% of the mortgage-related assets held by the Bank based upon the previous year-end financial information. The Bank was in compliance with the rules and requirements of the FHLB at December 31, 2021.

Deposit Insurance

Deposits of the Bank are insured up to the applicable limits by the Deposit Insurance Fund (“DIF”) and are subject to deposit insurance assessments to maintain the DIF. The Dodd-Frank Act permanently increased the maximum amount of deposit insurance to $250,000 per deposit category, per depositor, per institution. A depository institution’s DIF assessment is calculated by multiplying its assessment rate by the assessment base, which is defined as the average consolidated total assets less the average tangible equity of the depository institution. The initial base assessment rate is based on its capital level and supervisory ratings (its “CAMELS ratings”), certain financial measures to assess an institution’s ability to withstand asset related stress and funding related stress and, in some cases, additional discretionary adjustments by the FDIC to reflect additional risk factors. The Bank’s deposit insurance assessment is based on a large institution classification.

For large insured depository institutions, generally defined as those with at least $10 billion in total assets, the FDIC has eliminated risk categories when calculating the initial base assessment rates and now combine CAMELS ratings and financial measures into two scorecards to calculate assessment rates, one for most large insured depository institutions and another for highly complex insured depository institutions (which are generally those with more than $50 billion in total assets that are controlled by a parent company with more than $500 billion in total assets). Each scorecard has two components - a performance score and loss severity score, which are combined and converted to an initial assessment rate. The FDIC has the ability to adjust a large or highly complex insured depository institution’s total score by a maximum of 15 points, up or down, based upon significant risk factors that are not captured by the scorecard. Under the current assessment rate schedule, the initial base assessment rate for large and highly complex insured depository institutions ranges from three to 30 basis points, and the total base assessment rate, after applying the unsecured debt and brokered deposit adjustments, ranges from one and one-half to 40 basis points. The Bank’s FDIC insurance for 2021 was based on an assessment rate of three basis points.

In October 2010, the FDIC adopted a DIF restoration plan to ensure that the fund reserve ratio reached 1.35% by September 30, 2020, as required by the Dodd-Frank Act. In September 2018, the DIF reserve ratio reached 1.36%, exceeding the required reserve ratio of 1.35% ahead of the September 30, 2020 deadline. Since the DIF reserve ratio remained above 1.35% in 2019, the Bank was permitted to offset its FDIC insurance assessments in 2019 with Small Bank Assessment Credits issued by the FDIC in January 2019. The Bank offset $1.5 million of FDIC insurance assessments in 2019 with Small Bank Assessment Credits. FDIC insurance expense net of Small Bank Assessment Credits in 2021 totaled $4.1 million, compared to $2.7 million in 2020 and $1.4 million in 2019.

Under the Federal Deposit Insurance Act, if the FDIC finds that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, the FDIC may determine that such violation or unsafe or unsound practice or condition require the termination of deposit insurance.

Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

On July 21, 2010, the Dodd-Frank Act was signed into law, which resulted in significant changes to the banking industry. As discussed further throughout this section, certain aspects of the Dodd-Frank Act are subject to implementing rules that have been taking effect over several years.

10

The Dodd-Frank Act contains numerous provisions that affect all banks and bank holding companies and impacts how the Company and the Bank handle their operations. The Dodd-Frank Act requires various federal agencies, including those that regulate the Company and the Bank, to promulgate new rules and regulations and to conduct various studies and reports for Congress. The federal agencies have either completed or are in the process of completing these rules and regulations and have been given significant discretion in drafting such rules and regulations. Several of the provisions of the Dodd-Frank Act may have the consequence of increasing the Bank’s expenses, decreasing its revenues, and changing the activities in which it chooses to engage. The specific impact of the Dodd-Frank Act on the Company’s current activities or new financial activities the Company may consider in the future, the Company’s financial performance, and the markets in which the Company operates depends on the manner in which the relevant agencies continue to develop and implement the required rules and regulations and the reaction of market participants to these regulatory developments.

Pursuant to FRB regulations mandated by the Dodd-Frank Act, interchange fees on debit card transactions are limited to a maximum of $0.21 per transaction plus 5 basis points of the transaction amount. A debit card issuer may recover an additional one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements prescribed by the FRB. The FRB also adopted requirements in the final rule that issuers include two unaffiliated networks for routing debit transactions that are applicable to the Company and the Bank.

The Dodd-Frank Act established the CFPB and empowered it to exercise broad rulemaking, supervision, and enforcement authority for a wide range of consumer protection laws. Since the Bank’s total consolidated assets exceed $10 billion, the Bank is subject to the direct supervision of the CFPB. The CFPB has issued numerous regulations and amendments under which the Company and the Bank may continue to incur additional expense in connection with its ongoing compliance obligations. Significant recent CFPB developments that may affect operations and compliance costs include:

●continued focus on fair lending, including promoting racial and economic equity for underserved, vulnerable and marginalized communities;

●focused efforts on enforcing certain compliance obligations the CFPB deems a priority, such as automobile loan servicing, debt collection, deposit, overdraft and other services fees, mortgage origination and servicing, and remittances, among others; and

●rulemaking plans concerning, among others, consumers’ access to their financial information and requirements for financial institutions to collect, report and make public certain information concerning credit applications made by women-owned, minority-owned and small businesses.

The final rules issued by the FRB, SEC, OCC, FDIC, and Commodity Futures Trading Commission implementing Section 619 of the Dodd-Frank Act (commonly known as the Volcker Rule) prohibit insured depository institutions and companies affiliated with insured depository institutions from engaging in short-term proprietary trading of certain securities, derivatives, commodity futures and options on these instruments, for their own account. The final rules also imposes limits on banking entities’ investments in, and other relationships with, hedge funds or private equity funds. The final rules of the Volcker Rule are not material to the Company's investing and trading activities.

On January 30, 2020, the five federal agencies proposed additional amendments to the Volcker Rule related to the restrictions on ownership interests and relationships with covered funds. On June 25, 2020, a final rule was finalized which modified the Volcker Rule by streamlining the covered funds portion of the rule, addressing the extraterritorial treatment of certain foreign funds and permitting banking entities to offer financial services and engage in other activities that do not raise concerns that the Volcker rule was intended to address. These modifications became effective on October 1, 2020 and were not material to the Company’s investing and trading activities.

11

The ongoing effects of the Dodd-Frank Act, as well as the recent and possible future changes to the regulatory framework as a result of the Economic Growth Act and future proposals make it difficult to assess the overall financial impact of the Dodd-Frank Act and related regulatory developments on the Company and the banking industry. As a result, the Company cannot predict the ultimate impact of the Dodd-Frank Act on the Company or the Bank, including the extent to which it could increase costs or limit the Company’s ability to pursue business opportunities in an efficient manner, or otherwise adversely affect its business, financial condition and results of operations. Nor can the Company predict the impact or substance of other future legislation or regulation. However, it is expected that future legislation or regulation at a minimum will increase the Company’s and the Bank’s operating and compliance costs. As rules and regulations continue to be implemented or issued, the Company may need to dedicate additional resources to ensure compliance, which may increase its costs of operations and adversely impact the Company’s earnings.

Capital Requirements

The Company and the Bank are required to comply with applicable capital adequacy standards established by the federal banking agencies (the “Capital Rules”) which are based on the Basel Committee on Banking Supervision’s (the “Basel Committee”) December 2010 final capital framework for strengthening international capital standards, referred to as “Basel III”.

The Capital Rules, among other things, impose a capital measure called “Common Equity Tier 1,” (“CET1”) to which most deductions/adjustments to regulatory capital measures be made. In addition, the Capital Rules specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting certain specified requirements.

Under the Capital Rules, the minimum capital ratios are as follows:

● 4.5% CET1 to total risk-weighted assets;

● 6.0% Tier 1 capital (CET1 plus Additional Tier 1 capital) to total risk-weighted assets;

● 8.0% Total capital (Tier 1 Capital plus Tier 2 capital) to total risk-weighted assets;

● 4.0% Tier 1 capital to total adjusted quarterly average assets (known as “leverage ratio”)

The Capital Rules require the Company and the Bank to maintain a “capital conservation buffer” composed entirely of CET1. Banking organizations are required to maintain a minimum capital conservation buffer of 2.5% (CET1 to Total risk-weighted assets), in addition to the minimum risk-based capital ratios. Therefore, to satisfy both the minimum risk-based capital ratios and the capital conservation buffer, a banking organization is required to maintain the following: (i) CET1 to total risk-weighted assets of at least 7%, (ii) Tier 1 capital to total risk-weighted assets of at least 8.5%, and (iii) Total capital (Tier 1 capital plus Tier 2 capital) to total risk-weighted assets of at least 10.5%. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions that do not maintain a capital conservation buffer of 2.5% or more will face constraints on dividends, common share repurchases and incentive compensation based on the amount of the shortfall.

The Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, deferred tax assets dependent upon future taxable income and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. Under the Capital Rules, the effects of certain accumulated other comprehensive income or loss items are not excluded for the purposes of determining regulatory capital; however, banks not using the advanced approach, including the Company and the Bank, were permitted to, and in the case of the Company and the Bank they did, make a one-time permanent election to continue to exclude these items.

Consistent with Section 171 of the Dodd-Frank Act, the Capital Rules allow certain bank holding companies to include certain hybrid securities, such as trust preferred securities, in Tier 1 capital if they had less than $15 billion in assets as of December 31, 2009 and the securities were issued before May 19, 2010. Accordingly, the trust preferred securities on the Company’s balance sheet were included as Tier 1 capital while they were outstanding.

With respect to the Bank, the Capital Rules also revised the prompt corrective action (“PCA”) regulations established pursuant to Section 38 of the Federal Deposit Insurance Act, establishing the CET1 ratio at 6.5% for well-capitalized status and the Tier 1 capital ratio at 8.0% for well-capitalized status. The Capital Rules do not change the Total risk-based PCA capital requirement for any capital category.

12

The Capital Rules prescribe a standardized approach for risk weighted-assets that expands the risk-weight categories from the four Basel I-derived categories (0%, 20%, 50% and 100%) to a larger and more risk-sensitive number of categories, depending on the nature of the asset. The risk-weight categories generally range from 0% for U.S. government and agency securities, to 1,250% for certain securitized exposures, and result in higher risk weights for a variety of asset categories. The standardized approach requires financial institutions to transition assets that are 90 days or more past due or on nonaccrual from their original risk weight to 150 percent. Additionally, loans designated as high volatility commercial real estate (“HVCRE”) are assigned a risk-weighting of 150 percent.

Requirements to maintain higher levels of capital or to maintain higher levels of liquid assets could adversely impact the Company’s net income and return on equity. The current requirements and the Company’s actual capital levels are detailed in Note P of “Notes to Consolidated Financial Statements” filed in Part II, Item 8, “Financial Statements and Supplementary Data.”

Consumer Protection Laws

In connection with its banking activities, the Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending to various sectors of the economy. These laws include but are not limited to the Equal Credit Opportunity Act, the Gramm-Leach-Bliley Act (“GLB Act”), the Fair Credit Reporting Act (“FCRA”), the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”), Electronic Funds Transfer Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Dodd-Frank Act, the Real Estate Settlement Procedures Act, the Secure and Fair Enforcement for Mortgage Licensing Act (“SAFE”), the Servicemembers Civil Relief Act (“SCRA”), the Military Lending Act (“MLA”), and various state law counterparts.

The Dodd-Frank Act created the CFPB with broad powers to supervise and enforce consumer protection laws, including laws that apply to banks in order to prohibit unfair, deceptive or abusive acts or practices. The CFPB has examination authority over all banks and savings institutions with more than $10 billion in assets. The Dodd-Frank Act also weakens the federal preemption rules that are applicable to national banks and gives attorney generals for the states certain powers to enforce federal consumer protection laws. Further, under the Dodd-Frank Act, it is unlawful for any provider of consumer financial products or services to engage in any unfair, deceptive, or abusive acts or practices (“UDAAP”). A violation of the consumer protection and privacy laws, and in particular UDAAP, could have serious legal, financial, and reputational consequences.

The GLB Act requires all financial institutions to adopt privacy policies, restrict the sharing of nonpublic customer data with nonaffiliated parties and establishes procedures and practices to protect customer data from unauthorized access. In addition, the FCRA, as amended by the FACT Act, includes provisions affecting the Company, the Bank, and their affiliates, including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. The FACT Act requires persons subject to FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the Federal Trade Commission have extensive rulemaking authority under the FACT Act, and the Company and the Bank are subject to the rules that have been created under the FACT Act, including rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate certain identity theft red flags. The SCRA protects persons called to active military service and their dependents from undue hardship resulting from their military service, and the MLA extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The SCRA applies to all debts incurred prior to the commencement of active duty and limits the amount of interest, including service and renewal charges and any other fees or charges (other than bona fide insurance) that are related to the obligation or liability. The MLA applies to certain consumer loans and extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The Bank is also subject to data security standards and data breach notice requirements issued by the OCC and other regulatory agencies. The Bank has created policies and procedures to comply with these consumer protection requirements.

13

The CFPB has implemented the ability-to-repay and qualified mortgage (QM) provisions of the Truth in Lending Act (the “QM Rule”) and has recently taken steps to modify the QM Rule. The ability-to-repay provision requires creditors to make reasonable, good faith determinations that borrowers are able to repay their mortgages before extending credit based on a number of factors and consideration of financial information about the borrower derived from reasonably reliable third-party documents. Under the Dodd-Frank Act and the QM Rule, loans meeting the definition of “qualified mortgage” are entitled to a presumption that the lender satisfied the ability-to-repay requirements. The presumption is a conclusive presumption/safe harbor for loans meeting the QM requirements, and a rebuttable presumption for higher-priced loans meeting the QM requirements. The Bank has created policies and procedures to comply with these consumer protection requirements and continues to monitor developments relative to future changes to the QM Rule.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The USA Patriot Act also encourages information-sharing among financial institutions, regulators, and law enforcement authorities by providing an exemption from the privacy provisions of the GLB Act for financial institutions that comply with the provision of the Act. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the institution. The Company has approved policies and procedures that are designed to comply with the USA Patriot Act and its regulations.

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others administrated by the Treasury’s Office of Foreign Assets Control (“OFAC”). The OFAC administered sanctions can take many different forms; however, they generally contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, entity or individual, including prohibitions against direct or indirect imports and exports and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments, or providing investment related advice or assistance; and (ii) a blocking of assets in which the government or specially designated nationals have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934, as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) new requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) additional responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) the creation of an independent accounting oversight board for the accounting industry; (iv) new standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on non-preferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violations of the securities laws.

Electronic Fund Transfer Act

Among other provisions, the federal banking rule under the Electronic Fund Transfer Act prohibits financial institutions from charging consumers fees for paying overdrafts on automated teller machines and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions. The rule does not govern overdraft fees on the payment of checks and certain other forms of bill payments.

14

Community Reinvestment Act of 1977

Under the CRA, the Bank is required to help meet the credit needs of its communities, including low- and moderate-income neighborhoods. Although the Bank must follow the requirements of CRA, it does not limit the Bank’s discretion to develop products and services that are suitable for a particular community or establish lending requirements or programs. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibits discrimination in lending practices. The Bank’s failure to comply with the provisions of the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s failure to comply with the Equal Credit Opportunity Act and the Fair Housing Act could result in enforcement actions against it by its regulators as well as other federal regulatory agencies and the Department of Justice. The Bank’s most recent CRA rating was “Satisfactory”.

The Bank Secrecy Act

The Bank Secrecy Act (“BSA”) requires all financial institutions, including banks and securities broker-dealers, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. The BSA includes a variety of recordkeeping and reporting requirements (such as currency transaction and suspicious activity reporting), as well as due diligence/know-your-customer documentation requirements. The Company has established a bank secrecy act /anti-money laundering program and taken other appropriate measures in order to comply with BSA requirements.

15

Information about Our Executive Officers

The executive officers of the Company and the Bank who are elected by the Board of Directors are as follows:

Name	Age	Position
Mark E. Tryniski	61	Director, President and Chief Executive Officer. Mr. Tryniski assumed his current position in August 2006. He served as Executive Vice President and Chief Operating Officer from March 2004 to July 2006 and as the Treasurer and Chief Financial Officer from June 2003 to March 2004. He previously served as a partner in the Syracuse office of PricewaterhouseCoopers LLP.
Joseph E. Sutaris	54	Executive Vice President and Chief Financial Officer. Mr. Sutaris assumed his current position in June 2018. He served as Senior Vice President, Finance and Accounting from November 2017 to June 2018, as the Bank’s Director of Municipal Banking from September 2016 to November 2017 and as the Senior Vice President of the Central Region of the Bank from April 2011 to September 2016. Mr. Sutaris joined the Company in April 2011 as part of the acquisition of Wilber National Bank where he served as the Executive Vice President, Chief Financial Officer, Treasurer and Secretary.
George J. Getman	65	Executive Vice President and General Counsel. Mr. Getman assumed his current position in January 2008. Prior to joining the Company, he was a partner with Bond, Schoeneck & King, PLLC and served as corporate counsel to the Company.
Maureen Gillan-Myer	54	Executive Vice President and Chief Human Resources Officer. Ms. Gillan-Myer assumed her current position in October 2021. Prior to joining the Company, she served as the Chief Human Resources Officer of HSBC US from February 2016 through September 2021 and as its Senior Vice President- Talent Acquisition from May 2009 through February 2016.
Dimitar A. Karaivanov	40	Executive Vice President of Financial Services and Corporate Development. Mr. Karaivanov assumed his current position in June 2021. Prior to joining the Company, he served as Managing Director of Lazard Middle Market’s Financial Institutions Group from June 2018 through June 2021. Prior to Lazard, he was the Managing Director of RBC Capital Markets’ Financial Institutions Group from April 2011 through June 2018.
Jeffrey M. Levy	60	President, Commercial Banking. Mr. Levy assumed his current position in January 2022. He served as the Bank’s Senior Vice President, Commercial Banking Sales Executive from June 2021 to December 2021, as Senior Vice President, Regional President of Capital Region from June 2019 to June 2021, and as Senior Vice President, Commercial Banking Team Leader from January 2018 to June 2019. Prior to joining the Bank, he served as the Executive Vice President and President of Commercial Banking at NBT Bank, N.A. from December 2006 to August 2016.
Joseph F. Serbun	61	President, Retail Banking. Mr. Serbun assumed his current position in January 2022. He served as the Company’s and the Bank’s Executive Vice President and Chief Banking Officer from March 2020 to December 2021, as the Bank’s Executive Vice President and Chief Credit Officer from June 2018 to March 2020, as Senior Vice President and Chief Credit Officer from June 2010 to June 2018 and as Vice President and Commercial Team Leader of the Bank from January 2008 until June 2010. Prior to joining the Company, he served as Vice President at JPMorgan Chase Bank, N.A.

16

Item 1A. Risk Factors

There are risks inherent in the Company’s business. The material risks and uncertainties that management believes affect the Company are described below. Adverse experience with these could have a material impact on the Company’s financial condition and results of operations.

Risks Related to the Company’s Business

Interest Rate Risk

Changes in interest rates affect our profitability, assets and liabilities.

The Company’s income and cash flow depends to a great extent on the difference between the interest earned on loans and investment securities, and the interest paid on deposits and borrowings. Interest rates are highly sensitive to many factors that are beyond the Company’s control, including general economic conditions and policies of various governmental and regulatory agencies and, in particular, the FRB. Changes in monetary policy, including changes in interest rates, could influence not only the interest the Company receives on loans and securities and the amount of interest it pays on deposits and borrowings, but such changes could also affect (1) its ability to originate loans and obtain deposits, which could reduce the amount of fee income generated, (2) the fair value of its financial assets and liabilities, and (3) the average duration of the Company’s various categories of earning assets. Earnings could be adversely affected if the interest rates received on loans and investments fall more quickly than the interest rates paid on deposits and other borrowings. If the interest rates paid on deposits and other borrowings increase at a faster rate than the interest rates received on loans and investments, the Company’s net interest income could also be adversely affected, which in turn could negatively affect the Company’s earnings. Increases in interest rates would likely cause an increase in the unrealized loss position on certain investments, which could negatively affect the Company’s earnings if the need to liquidate these investments arose. Although management believes it has implemented asset and liability management strategies to reduce the potential effects of changes in interest rates on the results of operations, any substantial, unexpected, prolonged change in market interest rates could have a material adverse effect on the financial condition and results of operations.

Reforms to and uncertainty regarding the London Interbank Offered Rate (“LIBOR”) may adversely affect LIBOR-based financial arrangements of the Company.

The Company has certain mortgage loans, hedging transactions, and floating-rate commercial loans that determine their applicable interest rate or payment amount by reference to LIBOR. The U.K. Financial Conduct Authority, which regulates LIBOR, has announced that it will no longer persuade or compel banks to submit rates for the calculation of LIBOR after 2021. In November 2020, it was announced that the rate would continue to be published through June 2023. However, the FRB has urged banks to make the transition as soon as practicable and that no new contracts should include LIBOR after the original end date of December 31, 2021.

Regulators, industry groups and certain committees, such as the Alternative Reference Rates Committee (“ARRC”) have, among other things, published recommended fallback language for LIBOR-linked financial instruments, identified recommended alternatives for certain LIBOR rates, such as the Secured Overnight Financing Rate (“SOFR”) as the recommended alternative to LIBOR, and proposed implementations of the recommended alternatives in floating rate financial instruments. It is currently unknown the extent to which these recommendations and proposals will be broadly accepted, whether they will continue to evolve, and what the effect of their implementation may be on the markets for floating-rate financial instruments.

Uncertainty as to the nature of alternative reference rates, and as to potential changes or other reforms to LIBOR, may adversely affect LIBOR rates and the value of LIBOR-based financial arrangements of the Company. While not expected to be material to the Company due to its insignificant exposure to LIBOR-based loans and financial instruments, the implementation of an alternative index or indices for the Company’s financial arrangements may result in the Company incurring expenses in effecting the transition, may result in reduced loan balances if borrowers do not accept the substitute index or indices and may result in disputes or litigation with customers over the appropriateness or comparability of the alternative index to LIBOR, which could have an adverse effect on the Company’s results of operations.

17

Liquidity Risk

The Company must maintain adequate sources of funding and liquidity to meet regulatory expectations, support its operations and fund outstanding liabilities.

The Company liquidity and ability to fund and run its business could be materially adversely affected by a variety of conditions and factors, including financial and credit market disruptions and volatility, a lack of market or customer confidence in financial markets in general, or deposit competition based on interest rates, which may result in a loss of customer deposits or outflows of cash or collateral and/or adversely affect the Company’s ability to access capital markets on favorable terms. Other conditions and factors that could materially adversely affect the Company’s liquidity and funding include a lack of market or customer confidence in, or negative news about, the Company or the financial services industry generally which also may result in a loss of deposits and/or negatively affect the Company’s ability to access the capital markets; the loss of customer deposits to alternative investments; counterparty availability; interest rate fluctuations; general economic conditions; and the legal, regulatory, accounting and tax environments governing the Company’s funding transactions. Many of the foregoing conditions and factors may be caused by events over which the Company has little or no control. There can be no assurance that significant disruption and volatility in the financial markets will not occur in the future. Further, the Company’s customers may be adversely impacted by such conditions, which could have a negative impact on the Company’s business, financial condition and results of operations.

The Company is uncertain as to whether the relatively high levels of deposits in recent periods will be maintained, spent down, or increased further by additional inflows of funds associated with COVID-19 related government stimulus programs. If these deposits were to be spent down at levels exceeding expectations, or if the Company is unable to continue to fund assets through customer bank deposits or access funding sources on favorable terms, or if the Company suffers an increase in borrowing costs or otherwise fails to manage liquidity effectively, the Company’s liquidity, operating margins, financial condition and results of operations may be materially adversely affected.

18

Credit and Lending Risk

The allowance for credit losses may be insufficient.

The Company’s business depends on the creditworthiness of its customers. The Company reviews the allowance for credit losses quarterly for adequacy considering historical credit loss experience, current loan-specific risk characteristics such as differences in underwriting standards, portfolio mix, delinquency levels, risk ratings as well as changes in macroeconomic conditions. If the Company’s assumptions prove to be incorrect, the Company’s allowance for credit losses may not be sufficient to cover losses inherent in the Company’s loan portfolio, resulting in additions to the allowance. Material additions to the allowance would materially decrease its net income. It is possible that over time the allowance for credit losses will be inadequate to cover credit losses in the portfolio because of unanticipated adverse changes in the economy, market conditions or events adversely affecting specific customers, industries or markets. On January 1, 2020, the Company adopted ASU No. 2016-13, Financial Instruments – Credit Losses (Topic 326), also referred to as CECL. Under this new standard, the Company’s required allowance for credit losses may fluctuate more significantly from period to period due to changes in economic conditions, changes in the composition of the Company’s loan portfolios, changes in historical loss rates and changes in other credit factors, including the level of delinquent loans.

Mortgage banking income may experience significant volatility.

Mortgage banking income is highly influenced by the level and direction of mortgage interest rates, real estate and refinancing activity and elections made by the Company to sell or retain mortgage production. In lower interest rate environments, the demand for mortgage loans and refinancing activity will tend to increase. Increases in mortgage loan sales would have the effect of increasing fee income, but could adversely impact the estimated fair value of the Company’s mortgage servicing rights as the rate of loan prepayments increase. In higher interest rate environments, the demand for mortgage loans and refinancing activity will generally be lower. Decreases in mortgage loan sales would have the effect of decreasing fee income opportunities.

Legal, Regulatory, and Compliance Risk

The Company is or may become involved in lawsuits, legal proceedings, information-gathering requests, investigations, and proceedings by governmental agencies or other parties that may lead to adverse consequences.

As a participant in the financial services industry, many aspects of the Company’s business involve substantial risk of legal liability. The Company and its subsidiaries have been named or threatened to be named as defendants in various lawsuits arising from its or its subsidiaries’ business activities (and in some cases from the activities of acquired companies). In addition, the Company is, or may become, the subject of governmental and self-regulatory agency information-gathering requests, reviews, investigations and proceedings and other forms of regulatory inquiry by, including but not limited to, bank regulatory agencies, the SEC, the U.S. Department of Labor, state insurance regulators and law enforcement authorities. The results of such proceedings could lead to delays in or prohibition to acquire other companies, significant penalties, including monetary penalties, damages, adverse judgments, settlements, fines, injunctions, restrictions on the way in which the Company conducts its business, or reputational harm.

Although the Company establishes accruals for legal proceedings when information related to the loss contingencies represented by those matters indicates both that a loss is probable and that the amount of loss can be reasonably estimated, the Company does not have accruals for all legal proceedings where it faces a risk of loss. In addition, due to the inherent subjectivity of the assessments and unpredictability of the outcome of legal proceedings, amounts accrued may not represent the ultimate loss to the Company from the legal proceedings in question. Thus, the Company’s ultimate losses may be higher than the amounts accrued for legal loss contingencies, which could adversely affect the Company’s financial condition and results of operations.

19

The Company operates in a highly regulated environment and may be adversely affected by changes in laws and regulations or the interpretation and examination of existing laws and regulations.

The Company and its subsidiaries are subject to extensive state and federal regulation, supervision and legislation that govern nearly every aspect of its operations. The Company, as a financial holding company, is subject to regulation by the FRB and its banking subsidiary is subject to regulation by the OCC. These regulations affect deposit and lending practices, capital levels and structure, investment practices, dividend policy, and growth. These regulatory authorities have extensive discretion in connection with their supervisory and enforcement activities, including the imposition of restrictions on the operation of a bank, the classification of assets by a bank, and the adequacy of a bank’s allowance for credit losses. In addition, the non-bank subsidiaries are engaged in providing services including, but not limited to, retirement plan administration, fiduciary services to collective investment funds, investment management and insurance brokerage services, which industries are also heavily regulated at both a state and federal level, including by state banking and insurance agencies, the U.S. Department of Labor and the SEC. Such regulators govern the activities in which the Company and its subsidiaries may engage. Any change in such regulation and oversight, whether in the form of regulatory policy, regulations, legislation, interpretation or application, could have a material impact on the Company and its operations. Changes to the regulatory laws governing these businesses could affect the Company’s ability to deliver or expand its services and adversely impact its operating and financial condition.

The Dodd-Frank Act, as amended by the Economic Growth Act, instituted major changes to the banking and financial institutions regulatory regimes in the financial services sector. The ongoing effects of the Dodd-Frank Act, as well as continued rule-making and possible future changes to the regulatory requirements, may substantially impact the Company’s and the Bank’s operations. The implications of the Dodd-Frank Act depend to a large extent on the implementation of the legislation by the FRB, the CFPB, and other agencies as well as how market practices and structures change in response to the requirements of such rule making. New initiatives and proposed rulemaking by the CFPB may significantly limit the fees the Company may charge for its services and such proposed rulemaking may have a material impact on the Company’s fee income. Changes in regulations could subject the Company, among other things, to additional costs for compliance and limit the types of financial services and products it can offer and/or increase the ability of non-banks to offer competing financial services and products.

The Company is also directly subject to the requirements of entities that set and interpret the accounting standards such as the Financial Accounting Standards Board, and indirectly subject to the actions and interpretations of the Public Company Accounting Oversight Board, which establishes auditing and related professional practice standards for registered public accounting firms and inspects registered firms to assess their compliance with certain laws, rules, and professional standards in public company audits. These regulations, along with the currently existing tax, accounting, securities, insurance, and monetary laws, regulations, rules, standards, policies and interpretations, control the methods by which financial institutions and their holding companies conduct business, engage in strategic and tax planning, implement strategic initiatives, and govern financial reporting.

The Company’s failure to comply with laws, regulations or policies could result in civil or criminal sanctions, restrictions to its business model, and money penalties by state and federal agencies, and/or reputation damage, which could have a material adverse effect on the Company’s business, financial condition and results of operations. See “Supervision and Regulation” for more information about the regulations to which the Company is subject.

The Company depends on dividends from its banking subsidiary for cash revenues to support common dividend payments and other uses, but those dividends are subject to restrictions.

The ability of the Company to satisfy its obligations and pay cash dividends to its shareholders is primarily dependent on the earnings of and dividends from the subsidiary bank. However, payment of dividends by the bank subsidiary is limited by dividend restrictions and capital requirements imposed by bank regulations.

20

The Company’s total consolidated assets exceed $10 billion and is therefore subject to additional regulation and increased supervision including the CFPB.

The Dodd-Frank Act imposes additional regulatory requirements on institutions with $10 billion or more in assets. Since 2017, when the Company surpassed the $10 billion threshold, the Company has become subject to changes, including but not limited to, the following: (1) supervision, examination and enforcement by the CFPB with respect to consumer financial protection laws, (2) a modified methodology for calculating FDIC insurance assessments and potentially higher assessment rates, (3) limitations on interchange fees for debit card transactions, (4) heightened compliance standards under the Volcker Rule, and (5) enhanced supervision as a larger financial institution. The imposition of these regulatory requirements and increased supervision may continue to require additional commitment of financial resources to regulatory compliance and may increase the Company’s cost of operations and provide greater limitations on the products and services that can be offered by the Company and the Bank.

Basel III capital rules generally require insured depository institutions and their holding companies to hold more capital, which could limit our ability to pay dividends, engage in share repurchases and pay discretionary bonuses.

The FRB, the FDIC, and the OCC adopted final rules for the Basel III capital framework which substantially amended the regulatory risk-based capital rules applicable to the Company. The rules phased in over time and became fully effective in 2019. A capital conservation buffer was phased in over three years, ultimately resulting in a requirement of 2.5% on top of the common Tier 1, Tier 1 and total capital requirements, resulting in a required common Tier 1 equity ratio of 7%, a Tier 1 ratio of 8.5%, and a total capital ratio of 10.5%. Failure to satisfy any of these three capital requirements will result in limits on paying dividends, engaging in share repurchases and paying discretionary bonuses. These limitations establish a maximum percentage of eligible retained income that could be utilized for such actions and potentially limit the Company’s ability to pay dividends, engage in share repurchases and pay discretionary bonuses.

Increased regulation and stakeholder expectations related to Environmental, Social, and Governance factors could negatively affect our operating results.

There is increased public awareness and concern by investors, customers, and governmental and nongovernmental organizations on a variety of environmental, social, and sustainability matters. This increased awareness may include more restrictive or expansive environmental standards, more prescriptive reporting of environmental, social, and governance metrics, and other compliance requirements. The Company may face increased costs to address and report on these matters, which could have an adverse impact on the Company’s business and financial condition. If the Company is unable to adequately address environmental, social, and governance matters that are of importance to investors and customers, it could negatively impact the Company’s reputation and the Company’s business results.

Operational Risk

The Company continually encounters technological change and the failure to understand and adapt to these changes could have a negative impact on the business.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions to better serve customers and to reduce costs. The Company's future success depends, in part, upon its ability to address the needs of its customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in the Company's operations. Many of the Company's competitors have substantially greater resources to invest in technological improvements. The Company may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to its customers and the costs of this technology may negatively impact the Company’s results of operations. Failure to successfully keep pace with technological changes affecting the financial services industry could have a material adverse impact on the Company's financial condition and results of operations.

21

The Company is exposed to fraud in many aspects of the services and products that it provides.

The Company offers a wide variety of products and services. When account credentials and other access tools are not adequately protected by its customers, risks and potential costs may increase. As (a) sales of services and products expand, (b) those who are committing fraud become more sophisticated and more determined, and (c) services and product offerings expand, the Company's operational losses could increase.

The Company is subject to a variety of operational risks, including reputational risk, legal and compliance risk, the risk of fraud or theft by employees or outsiders, which may adversely affect the Company’s business and results of operations.

The Company is exposed to many types of operational risks, including reputational risk, legal and compliance risk, the risk of fraud or theft by employees or outsiders, unauthorized transactions by employees, or operational errors, including clerical or record keeping errors or those resulting from faulty or disabled computer or telecommunications systems or disclosure of confidential proprietary information of its customers. Negative public opinion can result from actual or alleged conduct in any number of activities, including lending practices, sales practices, customer treatment, corporate governance and acquisitions and from actions taken by government regulators and community organizations in response to those activities. Negative public opinion can adversely affect the Company’s ability to attract and keep customers and can expose the Company to litigation and regulatory action. Actual or alleged conduct by the Company can result in negative public opinion about its business and financial loss.

If personal, nonpublic, confidential, or proprietary information of customers in the Company’s possession were to be mishandled or misused, the Company could suffer significant regulatory consequences, reputational damage, and financial loss. Such mishandling or misuse could include, for example, if such information were erroneously provided to parties who are not permitted to have the information, either by fault of its systems, employees, or counterparties, or where such information is intercepted or otherwise inappropriately taken by third parties.

Because the nature of the financial services business involves a high volume of transactions, certain errors may