We offerThe Company offers a broad range of commercial and consumer banking and financial products.  OurThe deposit base consists of deposits derived principally from the communities we serve.  We target ourserved.  The Company targets lending activities to consumers and smallsmall- and mid-sized companies in our immediateArrow's regional geographic areas.area. In addition, through an indirect lending program the Company acquires consumer loans from an extensive network of automobile dealers that operate in a larger area of upstate New York, and in central and southern Vermont. Through ourthe banks' trust operations, we providethe Company provides retirement planning, trust and estate administration services for individuals, and pension, profit-sharing and employee benefit plan administration for corporations.

Arrow engages in a wide range of lending activities, including commercial and industrial lending primarily to small and mid-sized companies; mortgage lending for residential and commercial properties; and consumer installment and home equity financing. We also maintain anAn active indirect lending program is maintained through ourArrow's sponsorship of automobile dealer programs under which we purchase dealer paper,consumer auto loans, primarily from dealers that meet pre-established specifications.specifications are purchased.  From time to time, we sell a portion of ourthe residential real estate loan originations are sold into the secondary market, primarily to the Federal Home Loan Mortgage Corporation ("Freddie Mac") and other governmental agencies. Normally, we retainthe Company retains the servicing rights on mortgage loans originated and sold by us into the secondary markets, subject to our periodic determinations on the continuing profitability of such activity.  

Generally, we continueArrow continues to implement lending strategies and policies that are intended to protect the quality of the loan portfolio, including strong underwriting and collateral control procedures and credit review systems. Loans are placed on nonaccrual status either due to the delinquency status of principal and/or interest or a judgment by management that the full repayment of principal and interest is unlikely. Home equity lines of credit, secured by real property, are systematically placed on nonaccrual status when 120 days past due, and residential real estate loans are placed on nonaccrual status when 150 days past due. Commercial and commercial real estate loans are evaluated on a loan-by-loan basis and are placed on nonaccrual status when 90 days past due if the full collection of principal and interest is uncertain. (See Part II, Item 7.C.II.c. "Risk Elements.") Subsequent cash payments on loans classified as nonaccrual may be applied allentirely to principal, although income in some cases may be recognized on a cash basis.

We lendArrow lends almost exclusively to borrowers within ourthe normal retail service area in northeastern New York State, with the exception of ourthe indirect consumer lending line of business, where we acquireArrow acquires retail paper from an extensive network of automobile dealers

The following generally describes the laws and regulations to which we areArrow is subject.  Bank holding companies, banks and their affiliates are extensively regulated under both federal and state law.  To the extent that the following information summarizes statutory or regulatory law, it is qualified in its entirety by reference to the particular provisions of the various statutes and regulations.  Any change in applicable law may have a material effect on our business operations, customers, prospects and investors.

Arrow is a registered bank holding company within the meaning of the Bank Holding Company Act of 1956 ("BHC Act") and as such is subject to regulation by the Board of Governors of the Federal Reserve System ("FRB").  As a "bank holding company" under New York State law, Arrow is also subject to regulation by the New York State Department of Financial Services.  OurArrow's two subsidiary banks are both national banks and are subject to supervision and examination by the Office of the Comptroller of the Currency ("OCC"). The banks are members of the Federal Reserve System and the deposits of each bank are insured by the Deposit Insurance Fund of the Federal Deposit Insurance Corporation ("FDIC").  The BHC Act generally prohibits Arrow from engaging, directly or indirectly, in activities other than banking, activities closely related to banking, and certain other financial activities.  Under the BHC Act, a bank holding company generally must obtain FRB approval before acquiring, directly or indirectly, voting shares of another bank or bank holding company, if after the acquisition the acquiror would own 5 percent or more of a class of the voting shares of that other bank or bank holding company.  Bank holding companies are able to acquire banks or other bank holding companies located in all 50 states, subject to certain limitations.  Bank holding companies that meet certain qualifications may choose to apply to the Federal Reserve BoardFRB for designation as "financial holding companies." If they obtain such designation, they will thereafter be eligible to acquire or otherwise affiliate with a much broader array of other financial institutions than "bank holding companies" are eligible to acquire or affiliate with, including insurance companies, investment banks and merchant banks. Arrow has not attempted to become, and has not been designated as, a financial holding company.  See Item 1.D., "Recent Legislative Developments."

The FRB and the OCC have broad regulatory, examination and enforcement authority. The FRB and the OCC conduct regular examinations of the entities they regulate. In addition, banking organizations are subject to requirements for periodic reporting requirements to the regulatory authorities.  The FRB and OCC have the authority to implement various remedies if they determine that the financial condition, capital, asset quality, management, earnings, liquidity or other aspects of a banking organization's operations are unsatisfactory or if they determine the banking organization is violating or has violated any law or regulation. The authority of the FRB and the OCCfederal bank regulators over banking organizations includes, but is not limited to, prohibiting unsafe or unsound practices; requiring affirmative action to correct a violation or unsafe or unsound practice; issuing administrative orders; requiring the organization to increase capital; requiring the organization to sell subsidiaries or other assets; restricting dividends, distributions and repurchases of the organization's stock; restricting the growth of the organization; assessing civil money penalties; removing officers and directors; and terminating deposit insurance. The FDIC may terminate a depository institution's deposit insurance upon a finding that the institution's financial condition is unsafe or unsound or that the institution has engaged in unsafe or unsound practices for certain other reasons.

  

Transactions between banks and their "affiliates" are regulated by Sections 23A and 23B of the Federal Reserve Act (FRA). Each of our organization'sArrow's non-bank subsidiaries (other than the business trusts we formed to issue ourthe TRUPs) is a subsidiary of one of ourthe subsidiary banks, and also is an "operating subsidiary" under Sections 23A and 23B. This means the non-bank subsidiary is considered to be part of the bank that owns it and thus is not an affiliate of thethat bank for purposes of Section 23A and 23B. However, each of ourthe two banks is an affiliate of the other bank, under Section 23A, and ourArrow, the holding company, (Arrow) is also an affiliate of each bank.bank under both Sections 23A and 23B. Extensions of credit that a bank may make to affiliates, or to third parties secured by securities or obligations of the affiliates, are substantially limited by the FRA and the Federal Deposit Insurance Act (FDIA). Such acts further restrict the range of permissible transactions between a bank and any affiliate, including a bank affiliate. Furthermore, under the FRA, a bank may engage in certain transactions, including loans and purchases of assets, with a non-bank affiliate, only if certain special conditions, including collateral requirements

 

These Capital Rules like the rules they replaced, consist of two basic types of capital measures, a leverage ratio and set of risk-based capital measures. Within these two broad types of rules, however, significant changes were made in the revised Capital Rules, as discussed below.as follows.

Consistent with the general theme of higher capital levels, the revised Capital Rules also increased the minimum ratio for Tier 1 risk-based capital which wasfrom 4.0%, to 6.0%, effective January 1, 2015. The minimum level for total risk-based capital under the revised Capital Rules remained at 8.0%, the same level as under the old rules..

The revised Capital Rules incorporate a capital concept, the so-called "capital conservation buffer" (set at 2.5%, after full phase-in), which must be added to each of the minimum required risk-based capital ratios (i.e., the minimum CET1 ratio, the minimum Tier 1 risk-based capital ratio and the minimum total risk-based capital ratio). The capital conservation buffer is beingwas phased-in over four years beginning January 1, 2016 (see the table below). When, during economic downturns, an institution's capital begins to erode, the first deductions from a regulatory perspective would be taken against the conservation buffer. To the extent that such deductions should erode the buffer below the required level (2.5% of total risk-based assets)assets after full phase-in), the institution will not necessarily be required to replace the buffer deficit immediately, but will face restrictions on paying dividends and other negative consequences until the buffer is fully replenished.

Also under the revised Capital Rules, and as required under Dodd-Frank, TRUPs issued by small- to medium-sized banking organizations (such as ours)Arrow) that were outstanding on the Dodd-Frank grandfathering date for TRUPS (May 19, 2010) will continue to qualify as tier 1 capital, up to a limit of 25% of tier 1 capital, until the TRUPs mature or are redeemed.redeemed, subject to certain limitations. See the discussion of grandfathered TRUPs in section DSection E ("CAPITAL RESOURCES AND DIVIDENDS") of this item under "The Dodd-Frank Act."

The following is a summary of the revised definitions of capital under the various new risk-based measures in the revised Capital Rules:

The following table presents the transition scheduleCapital Rules applicable to our holding companyArrow and banks under the revised Capital Rules:its subsidiary banks:

These minimum capital ratios, especially the CET1 ratio (4.5%) and the enhanced Tier 1 risk-based capital ratio (6.0%), which began to apply to our organizationthe Company on January 1, 2015, represent a heightened and more restrictive capital regime than institutions like ours previously had to meet, and the four year phase-in of the regulatory capital buffer, which began January 1, 2016, will add to the stress on banks' profitability.meet.

As of December 31, 2016, our holding company2019, Arrow and both of ourits two subsidiary banks qualified as "well-capitalized" under the revised capital classification scheme.

In cases where banking regulators have significant concerns regarding the financial condition, assets or operations of a bank holding company or one of its banks, the regulators may take enforcement action or impose enforcement orders, formal or informal, against the holding company or the particular bank.  If the ratio of tangible equity to total assets of a bank falls to 2% or below, the bank will likely be closed and placed in receivership, with the FDIC as receiver.

In additionaladdition to the provisions in the Gramm-Leach-Bliley Act relating to data security (discussed below), Arrow and its subsidiaries are subject to many federal and state laws, regulations and regulatory interpretations which impose standards and requirements related to cybersecurity. For example, in February 2018, the Securities and Exchange Commission ("SEC") issued the "Commission Statement and Guidance on Public Company Cybersecurity Disclosures" to assist public companies in preparing disclosures about cybersecurity risks and incidents. With the increased frequency and magnitude of cybersecurity incidents, the SEC indicated that it is critical that public companies take all required actions to inform investors about material cybersecurity risks and incidents in a timely fashion. Additionally, in October 2018 the SEC issued the "Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934 Regarding Certain Cyber-Related Frauds Perpetrated Against Public Companies and Related Internal Controls Requirements" which cited business email compromises that led to the incidents and that internal accounting controls may need to be reassessed in light of these emerging risks.

In March 2015, federal regulators issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack. Financial institutions that fail to observe this regulatory guidance on cybersecurity may be subject to various regulatory sanctions, including financial penalties.

Under the Patriot Act (as defined below) and other federal law,anti-money laundering laws, financial institutions must maintain anti-money laundering programs that include established internal policies, procedures, and controls. Financial institutions are also prohibited from entering into specified financial transactions and account relationships and must meet enhanced standards for due diligence and customer identification. Financial institutions must take reasonable steps to conduct enhanced scrutiny of account relationships to guard against money laundering and to report any suspicious transactions. Law enforcement authorities have been granted increased access to financial information maintained by financial institutions. Bank regulators routinely examine institutions for compliance with these obligations and they must consider an institution's compliance in connection with the regulatory review of applications, including applications for banking mergers and acquisitions. The U.S. Department of the Treasury's Office of Foreign Assets Control, or "OFAC," is responsible for helping to insure that U.S. entities do not engage in transactions with certain prohibited parties, as defined by various Executive Orders and Acts of Congress. OFAC publishes lists of persons, organizations, and countries suspected of aiding, harboring or engaging in terrorist acts, known as Specially Designated Nationals and Blocked Persons. If Arrow finds a name on any transaction, account or wire transfer that is on an OFAC list, Arrow must freeze or block such account or transaction, file a suspicious activity report and notify the appropriate authorities. The U.S. Treasury Department's Financial Crises Enforcement Network ("FinCEN") issued a final rule in 2016 increasing customer due diligence requirements for banks, including adding a requirement to identify and verify the identity of beneficial owners of customers that are legal entities, subject to certain exclusions and exemptions. ComplianceThe Company has established procedures for compliance with this rule is required in May 2018.

The USA Patriot Act, initially adopted in 2001 and re-adopted by the U.S. Congress in 2006 with certain changes (the "Patriot Act"), imposes substantial record-keeping and due diligence obligations on banks and other financial institutions, with a particular focus on detecting and reporting money-laundering transactions involving domestic or international customers.  The U.S. Treasury Department has issued and will continue to issue regulations clarifying the Patriot Act's requirements.  The Patriot Act requires all financial institutions, including banks, to maintain certain anti-money laundering compliance, customer identification and due diligence programs.  TheCompliance with the provisions of the Patriot Act imposeresults in substantial costs on all financial institutions.

Arrow and its subsidiaries are subject to a variety of laws that regulate customer privacy and confidentiality. The Gramm-Leach-Bliley Act requires financial institutions to adopt privacy policies, to restrict the sharing of nonpublic customer information with nonaffiliated parties upon the request of the customer, and to implement data security measures to protect customer information. Certain state laws may impose additional privacy and confidentiality restrictions. The Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactions Act of 2003, regulates use of credit reports, providing of information to credit reporting agencies and sharing of customer information with affiliates, and sets identity theft prevention standards.

Dodd-Frank significantly changed the regulatory structure for financial institutions and their holding companies, for example, through provisions requiring the Capital Rules. Among other provisions, Dodd-Frank implemented corporate governance revisions that apply to all public companies, not just financial institutions, permanently increased the FDIC’s standard maximum deposit insurance amount to $250,000, changed the FDIC insurance assessment base to assets rather than deposits and increased the reserve ratio for the deposit insurance fund to ensure the future strength of the fund. The federal prohibition on the payment of interest on certain demand deposits was repealed, thereby permitting depository institutions to pay interest on business transaction accounts. Dodd-Frank established a new federal agency, the Consumer Financial Protection Bureau (the “CFPB”), centralizing significant aspects of consumer financial protection under this agency. Limits were imposed for debit card interchange fees for issuers that have assets greater than $10 billion, which also could affect the amount of interchange fees collected by financial institutions with less than $10 billion in assets. Dodd-Frank also imposed new requirements related to mortgage lending, including ours.prohibitions against payment of steering incentives and provisions relating to underwriting standards, disclosures, appraisals and escrows. The Volcker Rule prohibited banks and their affiliates from engaging in proprietary trading and investing in certain unregistered investment companies.

The FRB will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Company, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

In August of 2016, the FDIC announced that the reserve ratio reached 1.17% at the end of June 2016. This represents the highest level the ratio has reached in more than eight years. The reduction in assessment rates went into effect in the third quarter of 2016. We areArrow is unable to predict whether or to what extent the FDIC may elect to impose additional special assessments on insured institutions in upcoming years, if bank failures should once again become a significant problem.

Various proposals have been discussed for consideration that would substantially modify various health care laws. At present, we arethe Company is not able to estimate the likelihood of adoption of any such provisions or the potential impact thereof if adopted.

From time to time, various legislative and regulatory initiatives are introduced in Congress and state legislatures, as well as by regulatory authorities. These initiatives may include proposals to expand or contract the powers of bank holding companies and depository institutions or proposals to change the financial institution regulatory environment. Such legislation could change banking laws and the operating environment of our companyCompany in substantial, but unpredictable ways. WeArrow cannot predict whether any such legislation will be enacted, and, if enacted, the effect that it, or any implementing regulations would have on ourthe Company's financial condition or results of operations.

We faceArrow faces intense competition in all markets we serve.served.  Competitors include traditional local commercial banks, savings banks and credit unions, non-traditional internet-based lending alternatives, as well as local offices of major regional and money center banks.  Like all banks, we encounterthe Company encounters strong competition in the mortgage lending space from a wide variety of other mortgage originators, all of whom are principally affected in this business by the rate and terms set, and the lending practices established from time-to-time by the very large government sponsored enterprises ("GSEs") engaged in residential mortgage lending, most importantly, “Fannie Mae” and “Freddie Mac.” For many years, these GSEs have purchased and/or guaranteed a very substantial percentage of all newly-originated mortgage loans in the U.S., and in recent years, a large majority of such originations.U.S.. Additionally, non-banking financial organizations, such as consumer finance companies, insurance companies, securities firms, money market funds, mutual funds, credit card companies and wealth management enterprises and Fintech companies offer substantive equivalents of the various other types of loan and financial products and services and transactional accounts that we offer,are offered, even though these non-banking organizations are not subject to the same regulatory restrictions and capital requirements that apply to us.Arrow.  Under federal banking laws, such non-banking financial organizations not only may offer products and services comparable to those offered by commercial banks, but also may establish or acquire their own commercial banks.

The names and ages of the executive officers of Arrow and positions held by each are presented in the following table.  Officers are elected annually by the Board of Directors.

OurArrow's financial results and the market price of ourits stock are subject to risks arising from many factors, including the risks listed below, as well as other risks and uncertainties. Any of these risks could materially and adversely affect ourArrow's business, financial condition or results of operations. (Please note that the discussion below regarding the potential impact on Arrow of certain of these factors that may develop in the future is not meant to provide predictions by Arrow's management that such factors will develop, but to acknowledge the possible negative consequences to our companythe Company and business if certain conditions develop.materialize.)

The computer systems and network infrastructure that we useArrow uses are always vulnerable to unforeseen disruptions, including theft of confidential customer information (“identity theft”) and interruption of service as a result of fire, natural disasters, explosion, general infrastructure failure, cyberattacks or cyber attacks.other security problems. These disruptions may arise in ourArrow's internally developed systems, or the systems of our third-party service providers or may originate from the actions of our consumer and business customers who access our systems from their own networks or digital devices to process transactions. Information security and cyber security risks have increased significantly in recent years because of consumer demand to use the Internet and other electronic delivery channels to conduct financial transactions. Cybersecurity risk isand other security problems are a major concern to financial services regulators and all financial service providers, including our company.Arrow. These risks are further exacerbated due to the increased sophistication and activities of organized crime, hackers, terrorists and other disreputable parties. WeArrow regularly assessassesses and test ourtests security systems and disaster preparedness, including back-up systems, but the risks are substantially escalating. As a result, cybersecurity and the continued enhancement of ourArrow's controls and processes to protect ourits systems, data and networks from attacks or unauthorized access remain a priority. Accordingly, weArrow may be required to expend additional resources to enhance ourits protective measures or to investigate and remediate any information security vulnerabilities or exposures. Any breach of ourArrow's system security could result in disruption of ourits operations, unauthorized access to confidential customer information, significant regulatory costs, litigation exposure and other possible damages, loss or liability. Such costs or losses could exceed the amount of available insurance coverage, if any, and would adversely affect ourArrow's earnings. Also, any failure to prevent a security breach or to quickly and effectively deal with such a breach could negatively impact customer confidence, damaging ourArrow's reputation and undermining ourits ability to attract and keep customers. In addition, if we failArrow fails to observe any of the cybersecurity requirements in federal or state laws, regulations or regulatory guidance, weArrow could be subject to various sanctions, including financial penalties.