The Company has identified three business segments, consisting of banking, insurance and wealth management.

 

Banking services consist primarily of attracting deposits from the areas served by the Company’s 4 banking subsidiaries’ 66 banking offices (46 offices in New York and 20 offices in Pennsylvania),subsidiary and using those deposits to originate a variety of commercial loans, agricultural loans, consumer loans, real estate loans, and leases in those same areas. The Company’s lending function is managed within the guidelines of a comprehensive Board-approvedBoard of Directors-approved lending policy. Policies and procedures are reviewed on a regular basis. Reporting systems are in place to provide management with ongoing information related to loan production, loan quality, concentrations of credit, loan delinquencies and nonperforming and potential problem loans. The Company has an independent third party loan review process that reviews and validates the risk identification and assessment made by the lenders and credit personnel. The results of these reviews are presented to the Board of Directors of each of the Company’s banking subsidiaries,subsidiary, and the Company’s Audit and Examining Committee.

The Company’s principal expenses are interest on deposits, interest on borrowings, and operating and general administrative expenses, as well as provisions for loan and lease losses.credit loss expenses. Funding sources, other than deposits, include borrowings, securities sold under agreements to repurchase, and cash flow from lending and investing activities. The Company’s principal source of revenue is interest income on loans and securities.

 

The Company maintains a portfolio of securities such as U.S. Treasury securities, obligations of U.S. government agencies and U.S. government sponsored entities, obligations of states and political subdivisions thereof, and equity securities. Management typically invests in securities with short to intermediate average lives in order to better match the interest rate sensitivities of its assets and liabilities. Investment decisions are made within policy guidelines established by the Company’s Board of Directors. The investment policy is based on the asset/liability management goals of the Company, and is monitored by the Company’s Asset/Liability Management Committee. The intent of the policy is to establish a portfolio of high quality diversified securities, which optimizes net interest income within safety and liquidity limits deemed acceptable by the Asset/Liability Management Committee.

 

The Company has operated its insurance agency subsidiary, Tompkins Insurance, Agencies Inc., since 2001. Insurance services include property and casualty insurance, employee benefit consulting, life, long-term care and disability insurance. Tompkins Insurance is headquartered in Batavia, New York. Over the years, Tompkins Insurance has acquired smaller insurance agencies in the market areas served by the Company’s banking subsidiariesTompkins Community Bank and successfully consolidated them into Tompkins Insurance. Tompkins Insurance offers services to customers of the Company’s banking subsidiariesTompkins Community Bank by sharing offices with Tompkins Bank of Castile, the Trust Company, and Tompkins VISTCommunity Bank. In addition to these shared offices, Tompkins Insurance has five stand-alone offices in Western New York, and one stand-alone office in Tompkins County, New York.

 

 

Competition for commercial banking and other financial services is strong in the Company’s market areas. In one or more aspects of its business, the Company’s subsidiaries competeTompkins Community Bank competes with other commercial banks, savings and loan associations, credit unions, finance companies, Internet-basedinternet-based financial services companies, mutual funds, insurance companies, brokerage and investment banking companies, and other financial intermediaries. Some of these competitors have substantially greater resources and lending capabilities and may offer services that the Company does not currently provide. In addition, many of the Company’s non-bank competitors are not subject to the same extensive Federal regulations that govern financial holding companies and Federally-insured banks.

 

 

The Company’s banking subsidiaries areTompkins Community Bank is subject to examination and comprehensive regulation by various regulatory authorities, including the Federal Deposit Insurance Corporation (“FDIC”), and the New York State Department of Financial Services (“NYSDFS”), and the Pennsylvania Department of Banking and Securities (“PDBS”). Each of these agencies issuesissue regulations and requires the filing of reports describing the activities and financial condition of the entities under its jurisdiction. Likewise, such agencies conduct examinations on a recurring basis to evaluate the safety and soundness of the institutions, and to test compliance with various regulatory requirements, including: consumer protection, privacy, fair lending, the Community Reinvestment Act, the Bank Secrecy Act, sales of non-deposit investments, electronic data processing, and trust department activities.

The Company’s banking subsidiariesFederal Home Loan Banks (the FHLBs) are alsoa group of cooperatives that lending institutions use to finance housing and economic development in local communities. We are a member of the FHLB of New York ("FHLBNY"). FHLB members are required to maintain a minimum investment in capital stock of the applicable FHLB. The board of directors of the FHLBNY may increase the minimum investment requirements in the event it has concluded that additional capital is required to allow it to meet its own regulatory capital requirements. Any increase in the minimum investment requirements outside of specified ranges requires the approval of the Federal Home Loan Bank (“FHLB”), which providesHousing Finance Agency. Because the extent of any obligation to increase our investment in the FHLBNY depends entirely upon the occurrence of a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Company’s banking subsidiaries are subject tofuture event, the rules and requirementsamount of any future investment in the capital stock of the FHLB, including the requirement to acquire and hold shares of capital stock in the FHLB in an amount at least equal to the sum of 0.35% of the aggregate principal amount of its unpaid residential mortgage loans and similar obligations at the beginning of each year, up to a maximum of $25.0 million. The Company’s banking subsidiaries were in compliance with FHLB rules and requirements as of December 31, 2018.FHLBNY is not determinable.

The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) placed U.S. banksby way of example, contains a comprehensive set of provisions designed to govern the practices and oversight of financial services firms under enhanced regulationinstitutions and oversight. While many provisionsother

participants in the Dodd- Frank Act are currently effective, certain provisions of the legislation are still subject to further rulemaking, guidance and interpretation by the federal regulatory agencies.financial markets. The Dodd-Frank Act was amended on May 24, 2018, whenmade extensive changes in the President signedregulation of financial institutions and their holding companies. Some of the changes brought about by the Dodd-Frank Act have been modified by the Economic Growth, Regulatory Relief, and Consumer Protection Act (“EGRRCPA”of 2018 (the "Regulatory Relief Act"), signed into law. The EGRRCPA amended certain provisions of the Dodd-Frank Act and provided targeted modifications to other post-financial-crisis regulatory requirements. In addition, the legislation establishes new consumer protections and amends various securities-related and investment company-related requirements. Some EGRRCPA provisions were immediately effective, some have later-specified effective dates and still others are open-ended and subject to implementation by federal regulatory agency rule-making. EGRRCPA includes a variety of provisions that are likely to affect the Company, including the following:law on May 24, 2018.

FRB regulations mandated by the Dodd-Frank Act limit interchange fees on debit cards to a maximum of 21 cents per transaction plus 5 basis points of the transaction amount. Issuers that, together with their affiliates, have less than $10 billion in assets, such as the Company, are exempt from the debit card interchange fee standards. However, FRB regulations prohibit all card issuers, including     the Company and its banking subsidiaries,Tompkins Community Bank, from restricting the number of networks over which electronic debit transactions may be processed to fewer than two unaffiliated networks, or inhibiting a merchant's ability to direct the routing of the electronic debit transaction over any network that the card issuer has enabled to process them.

The Dodd-Frank Act required the federal financial regulatory agencies to adopt rules that prohibit banks and their affiliates from engaging in proprietary trading and investing in and sponsoring certain unregistered investment companies (defined as hedge funds and private equity funds).covered funds. The statutory provision is commonly called the “Volcker Rule.Rule,” and is not applicable to depository institutions and their holding companies whose total assets do not exceed $10 billion. As of December 31, 2018,2021, the Company had outstanding investments of approximately $600,000 in covered funds (the "Legacy Investments") which we would have been required to divest no later than July 2022 per our agreement with the FRB. However, under the newly-enacted EGRRCPA, the Company, as a financial institution with less than $10 billion in total consolidated assets, is exempt from meeting the Volcker Rule's proprietary trading requirements. Therefore, no further Volcker Rule divestitures are required unless the Company crosses the $10 billion inCompany's total assets threshold.on a consolidated basis did not exceed $10 billion.

We are a bank holding company subject to regulation under the BHC Act and the examination and reporting requirements of the FRB. In general, the BHC Act limits the business of bank holding companies to banking, managing or controlling banks and other activities that the FRB has determined to be so closely related to banking as to be a proper incident thereto.banking. In addition, we qualified for the status of andhave elected to be treated as a financial holding company under the BHC Act and therefore may engage in any activity, or acquire and retain the shares of a company engaged in any activity, that is either (i) financial in nature or incidental to such financial activity (as determined by the FRB in consultation with the Secretary of the Treasury) or (ii) complementary to a financial activity and does not pose a substantial risk to the safety and soundness of depository institutions or the financial system generally (as solely determined by the FRB), without prior approval of the FRB.

If a bank holding company seekselects to engage in the broader range of activities permitted under the BHC Act forbe treated as a financial holding companies,company, as we do,have, (i) the bank holding company and all of its depository institution subsidiaries must be “well-capitalized” and “well-managed,” as defined in the FRB's Regulation Y and (ii) itthe bank holding company must file a declaration with the FRB that it elects to be a “financial holding company.company,” Ifwhich we cease to meet these requirements, the Company will not be in compliance with the BHC Act’s requirements and the FRB may impose limitations or conditions on the conduct of its activities to encourage compliance. If the Company does not return to compliance within 180 days, the FRB may require divestiture of our depository institutions, among other potential penalties and limitations.have done. To maintain financial holding company status, a financial holding company and all of its depository institution subsidiaries must be “well capitalized” and “well managed.” A depository institution subsidiary is considered to be “well capitalized” if it satisfies the requirements for this status discussed in the section captioned “Capital Adequacy and Prompt Corrective Action,” below. A depository institution subsidiary is considered “well managed” if it received a composite rating and management rating of at least “satisfactory” in its most recent examination. A financial holding company’s status will also depend upon it maintaining its status as “well capitalized” and “well managed” under applicable FRB regulations. If a financial holding company ceases to meet these capital and management requirements, the FRB’s regulations provide that the financial holding company must enter into an agreement with the FRB to comply with all applicable capital and management requirements. Until the financial holding company returns to compliance, the FRB may impose limitations or conditions on the conduct of its activities, and the company may not commence any of the broader financial activities permissible for financial holding companies or acquire a company engaged in such financial activities without prior approval of the FRB. If the company does not return to compliance within 180 days, the FRB may require divestiture of the holding company’s depository institutions. Bank holding companies and banks must also be “well-capitalized” and “well-managed” in order to acquire banks located outside their home state.

In order for a financial holding company to commence any new activity permitted by the BHC Act or to acquire a company engaged in any new activity permitted by the BHC Act, each insured depository institution subsidiary of the financial holding company must have received a rating of at least “satisfactory” in its most recent examination under the Community Reinvestment Act (“CRA”). See the section captioned “Community Reinvestment Act”, below.

The FRB has the power to order any bank holding company or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the FRB has reasonable grounds to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company.

Under FRB regulations,The ability of the Company may not, without providing prior notice to the FRB, purchase or redeem its own common stock if the gross consideration for the purchase or redemption, combined with the net consideration paid for all such purchases or redemptions during the preceding twelve months, is equal to ten percent or more of the Company’s consolidated net worth.

Notification to Tompkins. Member banksthe FRB is required prior to our declaring and paying a cash dividend to our stockholders during any period in which our quarterly and/or cumulative twelve‑month net earnings are insufficient to fund the dividend amount, among other requirements. Under such circumstances, we may not declare or pay a dividend duringshould the FRB object until such time as we receive approval from the FRB or no longer need to provide notice under applicable regulations. In addition, prior approval of the FRB may be required in certain circumstances prior to our repurchasing shares of our common stock.

The Company's primary source of liquidity is the receipt of cash dividends from Tompkins Community Bank. Various statutes and regulations limit the availability of cash dividends from Tompkins Community Bank and the dividends paid by Tompkins Community Bank are regulated by the NYSDFS and the FDIC under their general supervisory authority as it relates to a bank''s capital requirements. Tompkins Community Bank may declare a dividend without the approval of the NYSDFS and FDIC as long as the total dividends declared in a calendar year do not exceed the net income for the current calendarfiscal year, that exceeds the sum of the bank's net income during the current calendar year andplus the retained net income offor the prior two calendarfiscal years, unless approved by the pertinent regulatory agencies..

There are Federal laws and regulations that govern transactionsTransactions between the Company’s non-bank subsidiariesTompkins Community Bank and its affiliates are regulated under federal banking subsidiaries, including Sections 23A and 23B oflaw. Subject to certain exceptions set forth in the Federal Reserve Act and relatedits implementing regulations. These laws establish certain quantitative limitsfound at Regulation W, a bank may enter into "covered transactions" with its affiliates if the aggregate amount of the covered transactions with any single affiliate does not exceed 10 percent of the bank's capital stock and surplus or 20 percent of the bank's capital stock and surplus for covered transactions with all affiliates. Covered transactions include, among other prudent requirements for loans, purchasesthings, extension of credit, the investment in securities, the purchase of assets, and certain other transactions betweenthe acceptance of collateral or the issuance of a member bank and its affiliates. In general, transactions between the Company’s banking subsidiaries and its non-bank subsidiaries must be on terms and conditions, including credit standards, that are substantially the same or at least as favorable to the banking subsidiaries as those prevailing at the time for comparable transactions involving non-affiliated companies.guaranty. The Dodd-Frank Act significantly expanded the coverage and scope of the limitations on affiliate transactions within a banking organization. Additionally, most transactions that a bank engages in with an affiliate, including where an affiliate performs a service for the bank, must be on similar terms and conditions as the bank would agree to with a non-affiliate.

Tompkins Community Bank's authority to extend credit to its directors, executive officers and 10% shareholders (collectively, "Reg O Insiders"), as well as to entities controlled by such persons, is governed by the requirements of Sections 22(g) and 22(h) of the Federal Reserve Act and Regulation O as promulgated by the FRB. Among other things, these provisions require that extensions of credit to insidersReg O Insiders (i) be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with unaffiliated persons or entities that are not Reg O Insiders (or their related parties), and that do not involve more than the normal risk of repayment or present other unfavorable features; and (ii) not exceed certain limitations on the amount of credit extended to such persons, individually and in the aggregate, which limits are based, in part, on the amount of the Bank’sbank’s capital. In addition, extensions of credit in excess of certain limits must be approved by the Bank’sbank’s board of directors. Additional restrictions apply to extensions of credit to executive officers of Tompkins Community Bank.

The BHC Act, the Bank Merger Act, the Change in Bank Control Act and other federal and state statutes regulate acquisitions of interests in commercial banks. The BHC Act requires the prior approval of the FRB for the direct or indirect acquisition by a bank holding company of more than 5.0% of the voting shares of a commercial bank or its parent holding company and for a person, other than a bank holding company, to acquire 25% or more of any class of voting securities of a bank or bank holding company. Under the Bank Merger Act, the prior approval of the FRB or other appropriate bank regulatory authorityagencies is required for a member bank to merge with another bank or purchase the assets or assume the deposits of another bank. In reviewing applications seeking approval of merger and acquisition transactions, the bank regulatory authorities will consider, among other things, the competitive effect and public benefits of the transactions, the capital position of the combined organization, the risks to the stability of the U.S. banking or financial system, the applicant’s performance record under the CRA (see the section captioned “Community

“Community Reinvestment Act” included elsewhere in this item) and fair housing laws and the effectiveness of the subject organizations in combating money laundering activities.

 

The Dodd-Frank Act requires bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. Under this requirement, Tompkins is expected to commit resources to support its banking subsidiaries,Tompkins Community Bank, including at times when it may not be advantageous for Tompkins to do so. Any capital loans by a bank holding company to any of itsa subsidiary banksbank are subordinated in right of payment to deposits and to certain other indebtedness of such subsidiary banks. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Bank holding companies and banks are subject to various regulatory capital requirements administered by state and federal agencies. These agencies may establish higher minimum requirements if, for example, a banking organization previously has received special attention or has a high susceptibility to interest rate risk. Risk-based capital requirements determine the adequacy of capital based on the risk inherent in various classes of assets and off-balance sheet items. Under the Dodd-Frank Act, the Federal Reserve must apply consolidated capital requirements to depository institution holding companies that are no less stringent than those currently applied to depository institutions. The Basel III Capital Rules were implemented byDodd-Frank Act additionally requires capital requirements to be counter-cyclical so that the FRBrequired amount of capital increases in 2013, became effective for Tompkins ontimes of economic expansion and decreases in times of economic contraction, consistent with safety and soundness.

Under federal regulations, bank holding companies and banks must meet certain risk-based capital requirements. Effective as of January 1, 2015, and were subject to a phase-in period that concluded on January 1, 2019.

As fully phased in on January 1, 2019, the Basel III Capital Rules require Tompkins to maintain (i) a minimum ratio of CET1 to risk-weighted assets of at least 4.5%, plus a 2.5% capital conservation buffer (which when fully phased in, effectively results(resulting in a minimum ratio of CET1 to risk-weighted assets of at least 7.0%), (ii) a minimum ratio of Tier 1 capital to risk- weighted assets of at least 6.0%, plus the capital conservation buffer (which when fully phased-in, effectively results(resulting in a minimum Tier 1 capital ratio of 8.5%), (iii) a minimum ratio of Total capital (that is, Tier 1 plus Tier 2) to risk-weighted assets of at least 8.0%, plus the capital conservation buffer (which when fully phased in, effectively results(resulting in a minimum total capital ratio of 10.5%), and (iv) a minimum leverage ratio of 4.0%, calculated as the ratio of Tier 1 capital to average assets. If we have a ratio of CET1Banking institutions that fail to risk-weighted assets abovemeet the effective minimum but belowratios once the conservation buffer (or below the combined capital conservation buffer and countercyclical capital buffer, when the latter is applied), wetaken into account, as detailed above, will facebe subject to constraints on capital distributions, including dividends equityand share repurchases, and compensation basedcertain discretionary executive compensation. The severity of the constraints depends on the amount of the shortfall.shortfall and the institution’s “eligible retained income” (that is, the greater of (i) net income for the preceding four quarters, net of distributions and associated tax effects not reflected in net income and (ii) average net income over the preceding four quarters).

The Basel III Capital Rules also provide for a “countercyclical capital buffer” that is applicable to only certain covered institutions and is not expected to apply to Tompkins for the foreseeable future.

The Basel III Capital Rules imposed stricter regulatory capital deductions from and adjustments to capital, with most deductions and adjustments taken against CET1 capital. These include, for example, the requirement that (i) mortgage servicing assets, net of associated deferred tax liabilities; (ii) deferred tax assets, which cannot be realized through net operating loss carrybacks, net

Under the Basel III Capital Rules, the effect of certain accumulated other comprehensive items are not excluded, which could result in significant variations in the level of capital depending upon the impact of interest rate fluctuations on the fair value of the Company’s securities portfolio. Contained within the rule was a one-time option to permanently opt-out of the inclusion of accumulated other comprehensive income in the capital calculation based upon asset size. Tompkins decided to opt out of this requirement in January 2015.

The Basel III Capital Rules also required the phase-out of certain hybrid securities, such as trust preferred securities, as Tier 1 capital of bank holding companies. However, because the trust preferred securities held by Tompkins were issued prior to May 19, 2010, and because Tompkins’ total consolidated assets were less than $15.0 billion as of December 31, 2009, these trust preferred securities are permanently grandfathered under the final rule and may continue to be included as Tier 1 capital.

 

In addition,February 2019, the Basel III Capital Rules provide more advantageous risk weightsfederal bank regulatory agencies issued a final rule (the “2019 CECL Rule”) that revised certain capital regulations to account for derivatives and repurchase-style transactions cleared throughchanges to credit loss accounting under U.S. GAAP. The 2019 CECL Rule included a qualifying central counterparty and increasetransition option that allows banking organizations to phase in, over a three-year period, the scopeday-one adverse effects of eligible guarantors and eligible collateral for purposesadopting a new accounting standard related to the measurement of current expected credit risk mitigation.

Section 38 of the Federal Deposit Insurance Act (“FDIA”) requires federal banking agencies to take “prompt corrective action” (“PCA”) should an insured depository institutionsinstitution fail to meet certain capital adequacy standards. If an insured depository institution is classified in one of the undercapitalized categories, it is required to submit a capital restoration plan to the appropriate federal banking agency and the holding company must guarantee the performance of that plan. Based upon its capital levels, a bank that is classified as well- capitalized, adequately capitalized or undercapitalized, may be treated as though it were in the next lower capital category if the appropriate federal banking agency, after notice and opportunity for hearing, determines that an unsafe or unsound condition or an unsafe or unsound practice, warrants such treatment.

With respect to the Company’s banking subsidiaries,Tompkins Community Bank, the Basel III Capital Rules revised the PCA regulations, by: (i) introducing a CET1 ratio requirement at each PCA category (other than critically undercapitalized), with the required CET1 ratio being 6.5% for well-capitalized status; (ii) increasing the minimum Tier 1 capital ratio requirement for each category, with the minimum Tier 1 capital ratio for well-capitalized status being 8% (as compared to 6%); and (iii) eliminating the provision that permitted a bank with a composite supervisory rating of 1 and a 3% leverage ratio to be considered adequately capitalized. The Basel III Capital Rules did not change the total risk- basedrisk-based capital requirement for any PCA category. Additionally, Bankbank holding companies and insured depository institutions may also be subject to potential enforcement actions of varying levels of severity for unsafe or

For further information concerning the regulatory capital requirements, actual capital amounts and the ratios of Tompkins and its bank subsidiaries,Tompkins Community Bank, see the discussion in “Note 20 - Regulations and Supervision” in Notes to Consolidated Financial Statements in Part II, Item 8. of this Report.

 

Substantially all of the deposits of the Company’s banking subsidiariesTompkins Community Bank's deposits are insured up to applicable limits by the Deposit Insurance Fund (“DIF”) of the FDIC and are subject to deposit insurance assessments to maintain the DIF. The Dodd-Frank Act permanently increased the maximum amount of deposit insurance to $250,000 per deposit category, per depositor, per institution retroactive to January 1, 2008.

 

The Company’s banking subsidiaries payTompkins Community Bank pays deposit insurance premiums to the FDIC based on assessment rates established by the FDIC. The assessment rates are based upon asset size and other risks the institution poses to the Deposit Insurance Fund, or DIF.

Under this assessment system, risk is defined and measured using an institution’s supervisory ratings with other risk measures, including financial ratios. The current total base assessment rates on an annualized basis range from 1.5 basis points

In October 2010, the FDIC adopted a new Restoration Plan for certain “well-capitalized,” “well-managed” banks, with the highest ratings,DIF to 40 basis points for institutions posingensure that the most risk to the DIF. The FDIC may raise or lower these assessment rates on a quarterly basis based on various factors to achieve afund reserve ratio which the Dodd-Frank Act has mandated to be no less than 1.35 percent of insured deposits. In 2011, the FDIC redefined the deposit insurance assessment base to equal average consolidated total assets minus average tangible equityreached 1.35% by September 30, 2020, as required by the Dodd-Frank Act. On April 26, 2016, the FDIC adopted a rule amending pricing for deposit insurance for institutions with less than $10 billion in assets effective the quarter after the fund reserve ratio reached 1.15%. The fund reserve ratio reached 1.15% effective as of June 30, 2016. The Dodd-Frank Act required the FDIC to offset the effect of increasing the reserve ratio on insured depository institutions with total consolidated assets of less than $10 billion. In September 2018, the reserve ratio reached 1.36%, at which time banks with assets of less than $10 billion were awarded assessment credits for their portion of their assessments that contributed to the growth in the reserve ratio from 1.15% to 1.35%. When the reserve ratio reached 1.40% in June 2019, the FDIC applied these credits to assessment invoices for banks with assets of less than $10 billion. In 2019 and 2020, the Company's subsidiary banks applied credits of $1.5 million and $121,000, respectively, in the aggregate, to offset deposit insurance expense.

 

Under the FDIA, the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.

FDIC insurance expense totaled $2.6$2.8 million, $2.5$2.4 million, $733,000 in 2021, 2020 and $3.0 million2019, respectively. The increase in 2018, 2017expense between 2020 and 2016, respectively. FDIC insurance expense includes2019 was due to the deposit insurance assessments, and Financing Corporation (“FICO”) assessments related to outstanding FICO bonds. FICO is a mixed-ownership government corporation established by the Competitive Equality Banking Act of 1987 whose sole purpose was to function as a financing vehicle for the now defunct Federal Savings & Loan Insurance Corporation.credits mentioned above, which were recognized mainly in 2019.

The FDIA provides that, in the event of the “liquidation or other resolution” of an insured depository institution, such as the Company’s subsidiary banks,Tompkins Community Bank, the claims of depositors of the institution, including the claims of the FDIC, as subrogee of the insured depositors, and certain claims for administrative expenses of the FDIC as receiver, will have priority over other general unsecured claims against the institution. If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors, including the parent bank holding company, with respect to any extensions of credit they have made to such insured depository institutions.institutions, as well as the shareholders of the parent bank holding company, who are unlikely to recover in the event a bank holding company's sole bank subsidiary fails.

The CRA and the regulations issued thereunder are intended to encourage banks to help meet the credit needs of their entire service area, including low and moderate income neighborhoods, consistent with the safe and sound operations of such banks. These regulations also provide for regulatory assessment of a bank’s record in meeting the needs of its service area when considering applications to establish branches, merger applications and applications to acquire the assets and assume the liabilities of another bank. As of December 31, 2018,2021, the Company’s subsidiary banks all had ratings of satisfactory or better.

The common stock of the Company is registered with the SEC under the Securities Exchange Act of 1934, as amended (the “Exchange Act”). Therefore, the Company is subject to the reporting, information disclosure, proxy solicitation and other requirements imposed on public companies by the SEC under the Exchange Act. Additionally, Company insiders are subject to security trading limitations and are required to file insider ownership reports with the SEC. The SEC and NYSE American have adopted regulations under the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley”) and the Dodd-Frank Act that apply to the Company as an exchange-traded, public company, which seek to improve corporate governance, accounting, and reporting requirements, provide enhanced penalties for financial reporting improprieties and improve the reliability of disclosures in SEC filings. For example, the Sarbanes-Oxley requirements include: (1) requirements for audit committees, including independence and financial expertise; (2) certification of financial statements by the chief executive officer and chief financial officer of the reporting company;

 

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA PatriotPATRIOT Act”), the Bank Secrecy Act, the Money Laundering Control Act, and other federal laws, collectively impose obligations on all financial institutions, including the Company, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal and reputational consequences for the institution, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required.

 

The Gramm-Leach-Bliley Act of 1999 (“GLBA”) requires that financial institutions implement comprehensive written information security programs that include administrative, technical and physical safeguards designed to protect consumer information. Under the GLBA, federal banking regulators adopted rules that limit the ability of banks and other financial institutions to disclose non-public information about consumers to non-affiliated third parties. These limitations require disclosure of privacy policies and certain security breaches to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a non-affiliated third party. These provisions affect, among other things, how consumer information is transmitted through diversified financial companies and conveyed to outside vendors.

The United States has imposed economic sanctions that affect transactions with designated foreign countries, designated nationals and others. These are known as the “OFAC” rules based on their administration by the U.S. Treasury Department Office of Foreign Assets Control (“OFAC”). The OFAC-administered sanctions targeting designated countries take many different forms. Generally, however, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments in, or providing investment-related advice or assistance to, a sanctioned country; and (ii) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to a U.S. jurisdiction (including property in the possession or control of U.S. persons). These sanctions that are applicable to countries and individuals also are imposed against some non-governmental organizations, associations, or other criminal networks. Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a

license from OFAC. Failure to comply with these sanctions could have serious legal, strategic and reputational consequences.consequences, and result in civil money penalties against the Company and Tompkins Community Bank..

In connection with theirits lending and leasing activities, the Company’s banking subsidiaries areTompkins Community Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending. These consumer financial laws include the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Fair and Accurate Credit Transaction Act of 2003, Electronic Funds Transfer Act, the Expedited Funds Availability Act, the Truth in Lending Act, the Truth in Savings Act, the Home Mortgage Disclosure Act, and the Real Estate Settlement Procedures Act, and similar laws at the state level. The Company’sTompkins Community Bank's failure to comply with any of the consumer financial laws can result in civil actions, regulatory enforcement action by the federal banking agencies and the U.S. Department of Justice.

Additionally, the Dodd-Frank Act established a new Bureau of Consumer Financial Protection Bureau (“CFPB”) with broad powers to supervise and enforce consumer protection laws. The CFPB has broad rule-making authority for a wide range of consumer protection laws that apply to all banks and savings institutions, including the authority to prohibit “unfair, deceptive or abusive” acts and practices. The CFPB has examination and enforcement authority over all banks and savings institutions with more than $10 billion in assets. The Company and its subsidiaries areTompkins Community Bank is required to comply with the rules of the CFPB; however, these rules are generally enforced by our primary regulators, the FRB andregulator, the FDIC.

The BankCompany is also subject to data security standards and privacy and data breach notice requirements as established by federal and state regulators. Federal banking agencies, through the Federal Financial Institutions Examination Council, have adopted guidelines to encourage financial institutions to address cybersecurity risks and identify, assess and mitigate these risks, both internally and at critical third party service providers. For example, federal banking regulators have highlighted that financial institutions should establish several lines of defense and design their risk management processes to address the risk posed by compromised customer credentials. Further, financial institutions are expected to maintain sufficient business continuity planning processes designed to facilitate a recovery, resumption and maintenance of the institution’s operations after a cyber-attack.

Additionally, the Company must comply with a NYSDFS rule entitled “Cybersecurity Requirements for Financial Services Companies,” which became effective March 1, 2017, subject to a full phase-in over the following two years,period, concluding in 2019. This NYSDFS rule requires financial services companies, including Tompkins, to maintain a maintain a cybersecurity program designed to protect the confidentiality, integrity and availability of the company’s information systems, establish cybersecurity policies and procedures, identify persons responsible for implementing and enforcing the cybersecurity program and cybersecurity policies and procedures, and conduct periodic risk assessments of its information systems. See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity.

 

Additionally, the FRB, OCC and FDIC have issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-takingrisk-

taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors. Management believes the current and past compensation practices of the Company do not encourage excessive risk taking or undermine the safety and soundness of the organization.

The FRB reviews, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Company, that are not “large, complex banking organizations.” The findings of the supervisory initiatives are included in reports of examination and deficiencies can lead to limitations on the Company’s abilities and even enforcement actions.

The Company is also subject to the NYSDFS rule “Guidance on Incentive Compensation Arrangements,” which directs all New York state regulated banks (including the Trust Company, Tompkins Bank of Castile, and Tompkins MahopacCommunity Bank) to ensure that any employee incentive arrangements do not encourage inappropriate risk-taking or improper sales practices. Under this guidance, incentive compensation based on employee performance indicators may only be paid if the bank has effective risk management, oversight and control systems in place. We believe the Company is compliant with all applicable state and federal regulation regarding incentive compensation

At Tompkins, our culture is underpinned by our core values, including “a commitment to our employees.” As of December 31, 2018,2021, the Company had 1,0351,074 total employees, approximately 116which included 969 full-time employees and 105 part-time and temporary employees. Of the Company’s total employees, 850 are employed by one of whom were part-time.our four subsidiary banks, 58 employees are in our wealth management subsidiary (Tompkins Financial Advisors), and 166 employees are in our insurance subsidiary (Tompkins Insurance). Our entire organization relies on our Shared Services division, which provides administrative and operational support to all of our subsidiaries.

On January 1, 2022, the Company consolidated the four banks under one charter and the banking affiliate is now known as Tompkins Community Bank. Employees of Tompkins Financial Advisors and our Shared Services group are part of Tompkins Community Bank. Because our Shared Services group is part of Tompkins Community Bank, these employees are included in the bank employee count listed above. No employees are covered by a collective bargaining agreement, and the Company believes its employee relations are excellent.

The Company maintains a website at www.tompkinsfinancial.com. The Company makes available free of charge through its website its annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, its proxy statements related to its shareholders’ meetings, and amendments to these reports or statements, filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act, as soon as reasonably practicable after the Company electronically files such material with, or furnishes such material to, the SEC. Copies of these reports are also available at no charge to any person who requests them, with such requests directed to Tompkins Financial Corporation, Investor Relations Department, 118 E. Seneca St., P.O. Box 460, Ithaca, New York 14850,14851, telephone no. (888) 503-5753. The SEC maintains an Internet website that contains reports, proxy and information statements and other information regarding issuers that file electronically with the SEC, including material filed by the Company, at www.sec.gov. The information contained on the Company's website is provided for the information of the reader and it is not intended to be active links. The Company is not including the information contained on the Company’s website as a part of, or incorporating it by reference into, this Annual Report on Form 10-K, or into any other report filed with or furnished to the SEC by the Company.

Our Company's success is dependentdepends on management's ability to identify and manage the risks inherent in our financial services business. These risks include credit risk, market risk, liquidity risk, operational risk, model risk, compliance and legal risk, and strategic and reputation risk. We list below the material risk factors we face. Any of these risks could result in a material adverse impact on our business, operating results, financial condition, liquidity, and cash flow, or may cause our results to vary materially from recent results, or from the results implied by any forward-looking statements made by us.

The Company offers different types of commercial loans to a variety of businesses, and we believe commercial loans will continue to comprise a significant concentration of our loan portfolio in 20192022 and beyond. Real estate lending is generally considered to be collateral-based lending with loan amounts based on predetermined loan-to-collateral values. As such, declines in real estate valuations in the Company’s market area would lower the value of the collateral securing these loans. Additionally, the Company has experienced, and expects to continue experiencing, increased competition in commercial real estate lending. This increased competition may inhibit the Company's ability to generate additional commercial real estate loans or maintain its current inventory of commercial real estate loans. The Company’s commercial business loans are made based primarily on the cash flow and creditworthiness of the borrower and secondarily on the underlying collateral provided by the borrower, with liquidation of the underlying real estate collateral being viewed as the primary source of repayment in the event of borrower default. The borrowers’ cash flow may be difficult to predict, and collateral securing these loans may fluctuate in value. Although commercial business loans are often collateralized by equipment, inventory, accounts receivable, or other business assets, the liquidation of collateral in the event of default is often an insufficient source of repayment. As of December 31, 2018,2021, commercial and commercial real estate loans totaled $3.4$3.5 billion or 70.7%69.4% of total loans.

As part of the Company’s commercial business lending activities, the Company originates agricultural loans, consisting of agricultural real estate loans and agricultural operating loans. As of December 31, 2018, $277.72021, $295.1 million or 5.7%5.8% of the Company’s total loan portfolio consisted of agriculturally-related loans, including $170.2$196.0 million in agricultural real estate loans and $107.5$99.2 million in agricultural operating loans. Payments on agricultural loans are dependent on the profitable operation or management of the related farm property. The success of the farm may be affected by many factors outside the control of the borrower, including adverse weather conditions that prevent the planting of a crop or limit crop yields (such as hail, drought and floods), loss of livestock due to disease or other factors, declines in market prices for agricultural products and the impact of governmental regulations and subsidies (including changes in price supports and environmental regulations). Many farms are dependent upon a limited number of key individuals whose injury or death may significantly affect the successful operation of the farm. If the cash flow from a farming operation is diminished, the borrower’s ability to repay the loan may be impaired. While agricultural operating loans are generally secured by a blanket lien on the farm’s operating assets, any repossessed collateral in respect of a defaulted loan may not provide an adequate source of repayment of the outstanding balance.

Additionally, the profitable operation or management of the related farm properties, and the value thereof, is impacted by changes in U.S. government trade policies. In 2018,2019, 2020, and 2021, the U.S. government implemented tariffs on certain products, and certain countries or

As of December 31, 2018,2021, the Company had $99.9$96.1 million of goodwill and other intangible assets. The Company is required to test its goodwill and intangible assets for impairment on a periodic basis. A significant decline in the Company’s expected future cash flows, a significant adverse change in business climate, slower growth rates or a significant and sustained decline in the price of the Company’s common stock, may necessitate our taking charges in the future related to the impairment of the Company’s goodwill and intangible assets. If we make an impairment determination in a future reporting period, the Company’s earnings and the book value of these intangible assets would be reduced by the amount of the impairment. Further, a goodwill impairment charge could significantly restrict the ability of our banking subsidiariessubsidiary to make dividend payments to us without prior regulatory approval, which could have a material adverse effect on our financial condition and results of operations.

Financial services institutions are interrelated as a result of trading, clearing, counterparty or other relationships. The Company has exposure to many different industries and counterparties, and routinely executes transactions with counterparties in the financial services industry. The most important counterparty for the Company, in terms of liquidity, is the Federal Home Loan Bank of New York (“FHLBNY”). The Company also has a relationship with the Federal Home Loan Bank of Pittsburgh (“FHLBPITT”). The Company uses FHLBNY as its primary source of overnight funds and also has long-term advances and

repurchase agreements with FHLBNY. The Company has placed sufficient collateral in the form of commercial and residential real estate loans at FHLBNY. In addition, the Company is required to hold stock in FHLBNY and FHLBPITT. The amount of borrowed funds and repurchase agreements with the FHLBNY and FHLBPITT, and the amount of FHLBNY and FHLBPITT stock held by the Company, at its most recent fiscal year-end are discussed in Part II, Item 8 of this Report on Form 10-K.

 

There are 11 branches of the FHLB, including New York and Pittsburgh. The FHLBNY and the FHLBPITT are jointly and severally liable along with the other Federal Home Loan Banks for the consolidated obligations issued on behalf of the Federal Home Loan Banks through the Office of Finance. Dividends on, redemption of, or repurchase of shares of the FHLBNY’s or FHLBPITT’s capital stock cannot occur unless the principal and interest due on all consolidated obligations have been paid in full. If another Federal Home Loan Bank were to default on its obligation to pay principal or interest on any consolidated obligations, the Federal Home Loan Finance Agency (the “Finance Agency”) may allocate the outstanding liability among one or more of the remaining Federal Home Loan Banks on a pro rata basis or on any other basis the Finance Agency may determine. As a result, the FHLBNY’s or FHLBPITT’s ability to pay dividends on, to redeem, or to repurchase shares of capital stock could be affected by the financial condition of one or more of the other Federal Home Loan Banks. Any such adverse effects on the FHLBNY or FHLBPITT could adversely affect our liquidity, the value of our investment in FHLBNY or FHLBPITT common stock, and could negatively impact our results of operations.

Systemic weakness in the FHLB could result in higher costs of FHLB borrowings, reduced value of FHLB stock, and increased demand for alternative sources of liquidity that are more expensive, such as brokered time deposits, the discount window at the Federal Reserve, or lines of credit with correspondent banks. Any of these scenarios could adversely affect our liquidity, the value of our investment in FHLB common stock and our financial condition.

 

The Company is a financial holding company whose principal assets and sources of income are its wholly-owned subsidiaries. The Company is a separate and distinct legal entity from its subsidiaries, and therefore the Company relies primarily on dividends from theseits banking and other subsidiaries to meet its obligations and to provide funds for the payment of dividends to the Company’s shareholders, to the extent declared by the Company’s board of directors. Various federal and state laws and regulations limit the amount of dividends that a bank may pay to its parent company and impose regulatory capital and liquidity requirements on the Company and its banking subsidiaries.subsidiary. Further, as a holding company, the Company’s right to participate in a distribution of assets upon the liquidation or reorganization of a subsidiary is subject to the prior claims of the subsidiary’s creditors (including, in the case of the Company’s banking subsidiaries,subsidiary, the banks’bank's depositors). If the Company were unable to receive dividends from its subsidiaries it would materially and adversely affectsaffect the Company’s liquidity and its ability to service its debt, pay its other obligations, or pay cash dividends on its common stock.

General economic conditions impact the banking and financial services industry. The U.S. and global economies have experienced volatility in recent years and may continue to do so for the foreseeable future. There can be no assurance that economic conditions will not deteriorate. Unfavorable or uncertain economic conditions can be caused by many macro and micro factors, including declines in economic growth, business activity or investor or business confidence, limitations on the availability or increases in the cost of credit and capital, increases in inflation or interest rates, the timing and impact of changing governmental policies and other factors. The Company is particularly affected by U.SU.S. domestic economic conditions, including U.S. interest rates, the

Our operations are heavily concentrated in the New York State and, to a lesser extent, Pennsylvania and, as a result, our financial condition, results of operations and cash flows are significantly impacted by changes in the economic conditions in those areas. Therefore, the Company’s financial performance generally, and in particular, the ability of borrowers to pay interest on and repay the principal of outstanding loans and the value of collateral securing these loans, is highly dependent upon the business environment in the markets where the Company operates, particularly New York State and Pennsylvania. Our success depends to a significant extent upon the business activity, population, income levels, deposits and real estate activity in these markets. Although our clients’ business and financial interests may extend well beyond these markets, adverse economic conditions that affect these markets could disproportionately reduce our growth rate, affect the ability of our clients to repay their loans to us, affect the value of collateral underlying loans and generally affect our financial condition and results of operations. Because of our geographic concentration, we are less able than other regional or national financial institutions to diversify our credit risks across multiple markets. For additional information on our market area, see Part I, Item 1, “Business” of this Report on Form 10-K.

For information about how the Company manages its interest rate risk, refer to Part II, Item 7A, “Quantitative and Qualitative Disclosures About Market Risk” of this Report.

We must maintain sufficient cash flow and liquid assets to satisfy current and future financial obligations, including demand for loans and deposit withdrawals, funding operating costs, and for other corporate purposes. As a part of our liquidity management, we use a number of funding sources in addition to core deposit growth and repayments and maturities of loans and investments. As we continue to grow, we are likely to become more dependent on these sources, which may include various short-term and long-term wholesale borrowings, including Federal funds purchased and securities sold under agreements to repurchase, brokered certificates of deposit, proceeds from the sale of loans, and borrowings from the FHLBNY and FHLBPITT and others.   We also maintain available lines of credit with the FHLBNY and FHLBPITT that are secured by loans. Adverse operating results or changes in industry conditions could make it difficult or impossible for us to access these additional funding sources and could make our existing funds more volatile. Our financial flexibility could be materially constrained if we are unable to maintain access to funding or if adequate financing is not available to accommodate future growth at acceptable interest rates. If we are required to rely more heavily on more expensive funding sources to support future growth, our revenues may not increase proportionately to cover our costs. In that case, our operating margins and profitability would be adversely affected. Further, the volatility inherent in some of these funding sources, particularly including brokered deposits, may increase our exposure to liquidity risk. Any interruption in these sources of liquidity when needed could adversely affect our results of operations, financial condition, cash flow or regulatory capital levels. In addition, reduced liquidity could result from circumstances beyond our control, such as general market disruptions or operational problems that

affect us or third parties.  Management’s efforts to closely monitor our liquidity position for compliance with internal policies may not be successful or sufficient to deal with dramatic or unanticipated reductions in liquidity. 

 

The Company is subject to extensive state and federal laws and regulations, supervision and legislation that affect how it

practices, and dividend policy. The Dodd-Frank Act, which established the CFPB, and enacted other reforms, has had, and will continue to have, a significant effect on the entire financial services industry. Compliance with these regulations and other initiatives negatively impacts revenue and increases the cost of doing business on an ongoing basis. Further, under the current climate of regulatory reform, the future of currently effective, proposed and potential future regulations and legislation is unclear. New regulatory requirements or changes to existing requirements could necessitate changes to the Company’s businesses, result in increased compliance costs and affect the profitability of such businesses. Refer to “Supervision and Regulation” in Part I, Item 1 - “Business” of this Report on Form 10‑K for additional information on material laws and regulations impacting the Company’s business.

Additionally, banking regulators are authorized to take supervisory actions that may restrict or limit a financial institution's activities. Regulatory restrictions on our activities could adversely affect our costs and revenues, and may impair our ability to execute our strategic plans. In addition, if our regulators identify a compliance failure, we may be assessed a fine, prohibited from completing a strategic acquisition or divestiture, or subject to other actions imposed by the regulatory authorities. The recent regulatory activity and increased scrutiny have resulted, and may continue to result, in increases in our costs of doing business, and could result in decreased revenues and net income, reduce our ability to effectively compete to attract and retain customers, or make it less attractive for us to continue providing certain products and services. Any future changes in federal or state law and regulations, as well as the interpretations and implementations, or modifications or repeals, of such laws and regulations, could have a material adverse effect on our business, financial condition or results of operations.

The Company owns various properties used in the operation of its business. In addition, from time to time, the Company forecloses on properties or may be deemed to become involved in the management of its borrowers’ properties. The Company could be subject to environmental liabilities imposed by applicable federal and state laws with respect to any of these properties. For example, we may be held liable to a government entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination, or may be required to clean up hazardous or toxic substances, or chemical releases, at a property, or may be subject to common law claims by third parties for damages and costs

 

We are required to comply with anti-money laundering and anti-terrorism laws. These laws and regulations require us, among things, to enact policies and procedures to confirm the identity of our customers, and to report suspicious transactions to regulatory agencies. These laws and regulations are complex and require costly, sophisticated monitoring systems and qualified personnel. The policies and procedures that we have adopted in order to detect and prevent such illegal transactions may not be successful in eliminating all instances of such transactions. To the extent we fail to fully comply with applicable laws and regulations, we face the possibility of fines or other penalties, such as restrictions on our business activities, and we may also suffer reputational harm, all of which could have a material adverse effect on our business, results of operations and financial condition. Refer to “Supervision and Regulation” in Part I, Item 1 - “Business” of this Report on Form 10‑K for additional information on anti-money laundering and anti-terrorism laws impacting the Company’s business.

Based on our historical growth rates and current size, it is possible that our total assets could exceed $10 billion dollars in the future. Our total consolidated assets on December 31, 20182021 were $6.8$7.8 billion. The Dodd-Frank Act and its implementing regulations impose enhanced supervisory requirements on bank holding companies with more than $10 billion in total consolidated assets.

In addition to the additional regulatory requirements that we will become subject to upon crossing this asset threshold, federal financial regulators may require the Company to, or the Company may proactively, take actions to prepare for compliance with such increased regulations before we exceed $10 billion in total consolidated assets. We may, therefore, incur significant

compliance costs in an effort to ensure compliance before we reach $10 billion in total consolidated assets. These additional compliance costs, if they occur, may adversely affect our business, results of operations and financial condition.

As a financial institution, the Company is inherently exposed to operational risk in the form of theft and other fraudulent activity by employees, customers and other third parties targeting the Company and/or the Company’s customers or data. Such activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering and other dishonest acts. Although the Company devotes substantial resources to maintaining effective policies and internal controls to identify and prevent such incidents, given the increasing sophistication of possible perpetrators, the Company may experience financial losses or reputational harm as a result of fraud. Fraudulent activity could have a material adverse effect on the Company’s business, financial condition and results of operations.

In our ordinary course of business, we collect and retain large volumes of customer data, including personally identifiable information in various information systems that we maintain and in those maintained by third parties with whom we contract to provide data services. We also maintain important internal Company data such as personally identifiable information about our employees and information relating to our operations. Our customers and employees have been, and will continue to be, targeted by cybersecurity threats attempting to misappropriate passwords, bank account information or other personal information. Our attempts to mitigate these threats may not be successful as cybercrimes are complex and continue to evolve. Publicized information concerning security and cyber-related problems could cause us to incur reputational harm and discourage our customers from using our electronic or web-based applications or solutions, which could harm their utility as a means of conducting commercial transactions.

Even the most well protected information, networks, systems and facilities remain potentially vulnerable because the techniques used in breach attempts or other disruptions are constantly evolving and generally are not recognized until launched against a target, and in some cases are designed not to be detected and, in fact, may not be detected. Accordingly, we may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures. A security breach or other significant disruption of our information systems or those related to our customers, merchants and our third party vendors, including as a result of cyber-attacks, could (i) disrupt the proper functioning of our internal, or our third-party vendors’, networks and systems and therefore our operations and/or those of certain of our customers; (ii) result in the unauthorized access to, and destruction, loss, theft, misappropriation or release of confidential, sensitive or otherwise valuable information of ours or our customers; (iii) result in a violation of applicable privacy, data breach and other laws, subjecting us to additional regulatory scrutiny and expose the us to civil litigation, governmental fines and possible financial liability; (iv) require significant management attention

In the ordinary course of business we rely on electronic communications and information systems, both internal and provided by external third parties, to conduct our operations and to store, process, and/or transmit sensitive data on a variety of computing platforms and networks and over the Internet. We cannot be certain that all of our systems, or third-party systems upon which we rely, are free from vulnerability to attack or other technological difficulties or failures. Information security breaches and cybersecurity-related incidents may include attempts to access information, including customer and company information, malicious code, computer viruses, phishing, denial of service attacks and other means of intrusion that could result in unauthorized access, misuse, loss or destruction of data (including confidential customer or employee information), account takeovers, unavailability of service or other events. These types of threats may derive from human error, fraud or malice on the part of external or internal parties, or may result from accidental technological failure. Further, to access our products and services our customers may use computers and mobile devices that are beyond our security control systems. If information security is breached or difficulties or failures occur, despite the controls we and our third party vendors have instituted, information may be lost or misappropriated, resulting in financial loss or costs, reputational harm or damages and litigation, regulatory investigation costs or remediation costs to us or others. While we maintain specific “cyber” insurance coverage, which would apply in the event of many breach scenarios, the amount of coverage may not be adequate in any particular case. Furthermore, because cyber threat scenarios are inherently difficult to predict and can take many forms, some breaches may not

be covered under our cyber insurance coverage. Any of these consequences could have a material adverse effect on our financial condition and results of operations.

The risk of a security breach or disruption, particularly through cyber-attack or cyber intrusion, has significantly increased, in part due to the expansion of new technologies, the increased use of the Internet and mobile services and the increased intensity and sophistication of attempted attacks and intrusions from around the world. The threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. Our systems and those of our customers and third-party service providers are under constant threat and it is possible that we could experience a significant event in the future. Our technologies, systems, networks and software, and those of other financial institutions have been, and are likely to continue to be, the target of cybersecurity threats and attacks, which may range from uncoordinated individual attempts to sophisticated and targeted measures directed at us. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats as well as the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our customers. As cyber threats continue to evolve, we may be required to expend significant additional resources to modify our protective measures or to investigate and remediate any information security vulnerabilities.

The Company’s strategic initiatives include diversification within its markets, growth of its fee-based businesses, and growth internally and through acquisitions of financial institutions, branches, and financial services businesses. As such, the Company has acquired, and from time to time considers acquiring, banks, thrift institutions, branch offices of banks or thrift institutions, or other businesses within markets currently served by the Company or in other locations that would complement the Company’s business or its geographic reach. In 2018, the Company did not initiate or complete any acquisitions considering, in part, the increased competition with other regional banks for strategic acquisitions. Additionally,Any future acquisitions will be accompanied by the risks commonly encountered in acquisitions. These risks include: the difficulty of integrating operations and personnel, the potential disruption of our ongoing business, the inability of management to realize or maximize anticipated financial and strategic positions, increased operating costs, the inability to maintain uniform standards, controls, procedures and policies, the difficulty and cost of obtaining adequate financing, the potential for litigation risk, the potential loss of members of a key executive management group, the potential reputational damage and the impairment of relationships with employees and customers as a result of changes in ownership and management. Further, the asset quality or other financial characteristics of an acquired company may deteriorate after the acquisition agreement is signed or after the acquisition closes. We cannot provide any assurance that we will be successful in overcoming these risks or any other problems encountered in connection with acquisitions and any of these risks, if realized, could have an adverse effect on our results of operations and financial condition.

The Company relies on certain external vendors to provide products and services necessary to maintain the day-to-day operations of the Company. Some of the products and services provided by vendors include key components of our business infrastructure including data processing and storage and internet connections and network access, among other products and services. Accordingly, the Company’s operations are exposed to the risk that these vendors will not perform in accordance with the contracted arrangements or under service level agreements. The failure of an external vendor to perform in accordance with the contracted arrangements or under service level agreements, because of changes in the vendor’s organizational structure, financial condition, support for existing products and services or strategic focus or for any other reason, could disrupt the Company’s operations. If we are unable to find alternative sources for our vendors’ services and products quickly and cost-effectively, the failures of our vendors could have a material adverse impact on the Company’s business and, in turn, the Company’s financial condition and results of operations.

Additionally, our information technology and telecommunications systems interface with and depend on third-party systems, we could experience service denials if demand for such services exceeds capacity or such third-party systems fail or experience interruptions. If sustained or repeated, a system failure or service denial could result in a deterioration of our ability to process new and renewal loans, gather deposits and provide customer service, compromise our ability to operate effectively, damage our reputation, result in a loss of customer business and subject us to additional regulatory scrutiny and possible financial liability, any of which could have a material adverse effect on our financial condition and results of operations.

We continually monitor our suite of products and services, industry; and changesprioritize new offerings based on our determination of customer demand, within regulatory parameters for financial products. We may invest significant time and resources in government regulations. Other factors, including general market fluctuations, industry-wide factors and economic and general political conditions and events, including foreign and national governmental policy decisions, terrorist attacks, economic slowdownsnew products which become obsolete, or recessions, interest rate changes, credit loss trends or currency fluctuations, may adversely affect the Company’s stock price even though they do not directly pertain togenerate the Company’s operating results.

The Company’s executive offices are located at 118 East Seneca Street in Ithaca. Our new headquarters was completed at this location in the second quarter of 2018, resulting in the consolidation of some staff and operations into a single location; and enabling the Company to sell two previously-owned buildings in Ithaca, New York.

The Company is subject to various claims and legal actions that arise in the ordinary course of conducting business. ManagementAs of December 31, 2021, management, after consultation with legal counsel, does not expectanticipate that the aggregate ultimate dispositionliability arising out of these matterslitigation pending or threatened against the Company or its subsidiaries will be material to have a material adverse impact on the Company’s consolidated financial statements.position. On at least a quarterly basis, the Company assesses its liabilities and contingencies in connection with such legal proceedings. Although the Company does not believe that the outcome of pending litigation will be material to the Company’s consolidated financial position, it cannot rule out the possibility that such outcomes will be material to the consolidated results of operations for a particular reporting period in the future.

The Company’s common stock is traded under the symbol “TMP” on the NYSE American. As of February 22, 2022, there are approximately 2,823 holders of shares of our common stock.

While the Company has a long history of paying cash dividends on shares of its common stock, the Company's ability to pay dividends is generally limited to earnings from the prior year, although retained earnings and dividends from its subsidiaries may also be used to pay dividends under certain circumstances. The Company's primary source of funds to pay for shareholder dividends is receipt of dividends from its subsidiaries. Future dividend payments to the Company by its subsidiaries will be dependent on a number of factors, including earnings and the financial condition of each subsidiary, and are subject to regulatory limitations discussed in "Supervision and Regulation" in Part I, Item 1 of this Report.

The following table reflects all Company repurchases, including those made pursuant to publicly announced plans or programs, during the quarter ended December 31, 2018.2021. 

Included above are 1,2581,233 shares purchased in October 2018,2021, at an average cost of $78.92,$83.04, and 547592 shares purchased in November 2018,2021, at an average cost of $78.35,$84.91, by the trustee of the rabbi trust established by the Company under the Company’s Stock Retainer Plan For Eligible Directors of Tompkins Financial Corporation and Participating Subsidiaries, which were part of the director deferred compensation under that plan.  In addition, the table includes 11,77925,782 shares delivered to the Company in November 20182021 at an average cost of $77.02$83.67 to satisfy mandatory tax withholding requirements upon vesting of restricted stock under the Company's 2009 and 2019 Equity Plan.Plans.

On July 19, 2018,January 30, 2020, the Company’s Board of Directors authorized a share repurchase plan (the “2020 Repurchase Plan”) for the Company to repurchase of up to 400,000 shares of the Company’s common stock. Purchases may be madestock over the 24 months following adoption of the plan. TheShares may be repurchased from time to time under the 2020 Repurchase Plan in open market transactions at prevailing market prices, in privately negotiated transactions, or by other means in accordance with federal securities laws, and the repurchase program may be suspended, modified or terminated by the Board of Directors at any time for any reason. This plan replaced the Company's 400,000 share plan announced on July 21, 2016 which expired in July 2018. Under the current plan,2020 Repurchase Plan, the Company had repurchased 16,983400,000 shares through December 31, 2018,September 30, 2021, at an average cost of $73.17.$75.99.

The following graph compares the Company’s cumulative total stockholder return over the five-year period from December 31, 20132016 through December 31, 2018,2021, with (1) the total return for the NASDAQ Composite and (2) the total return for SNL Bank Index.S&P U.S. BMI Banks index. The graph assumes $100.00 was invested on December 31, 2013,2016, in the Company’s common stock and the comparison groups and assumes the reinvestment of all cash dividends prior to any tax effect and retention of all stock dividends. 

 

In accordance with and to the extent permitted by applicable law or regulation, the information set forth below under the heading “Performance Graph” shall not be incorporated by reference into any future filing under the Securities Act or Exchange Act and shall not be deemed to be “soliciting material” or to be “filed” with the SEC under the Securities Act or the Exchange Act, except to the extent that the Company specifically requests that such information be treated as soliciting material or specifically incorporates it by reference into such filings. The performance graph represents past performance and should not be considered an indication of future performance.