As a public company, Brookline Bancorp, Inc. is subject to the informational requirements of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), and in accordance therewith, files reports, proxy and information statements and other information with the Securities and Exchange Commission (the “SEC”). The Company makes available on or through its internet website, www.brooklinebancorp.com, without charge, its annual reports on Form 10-K, proxy, quarterly reports on Form 10-Q, current reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act, as soon as reasonably practicable after such reports are electronically filed with, or furnished to, the SEC. The Company’s reports filed with, or furnished to, the SEC are also available at the SEC’s website at www.sec.gov .www.sec.gov. Press releases are also maintained on the Company’s website. Additional information for Brookline Bank, BankRI and First Ipswich can be found at www.brooklinebank.com, www.bankri.com and www.firstipswich.com, respectively. Information on the Company’s and any subsidiary's website is not incorporated by reference into this document and should not be considered part of this Report.

The following discussion addresses elements of the regulatory framework applicable to bank holding companies and their subsidiaries. This regulatory framework is intended primarily for the protection of the safety and soundness of depository institutions, the federal deposit insurance system, and depositors, rather than for the protection of shareholders of a bank holding company such as the Company.

As a bank holding company, the Company is subject to regulation, supervision and examination by the FRB under the Bank Holding Company Act of 1956, as amended (the “BHCA”), and by the Massachusetts Division of Banks (the “MDOB”) under Massachusetts General Laws Chapter 167A. The FRB is also the primary federal regulator of the Banks. In addition, Brookline Bank and First Ipswich are subject to regulation, supervision and examination by the MDOB, and BankRI is subject to regulation, supervision and examination by the Banking Division of the Rhode Island Department of Business Regulation (the “RIBD”).

The following is a summary of certain aspects of various statutes and regulations applicable to the Company and its subsidiaries. This summary is not a comprehensive analysis of all applicable law, and is qualified by reference to the applicablefull text of the statutes and regulations.regulations referenced below.

The Company is subject to regulation, supervision and examination by the FRB, which has the authority, among other things, to order bank holding companies to cease and desist from unsafe or unsound banking practices; to assess civil money penalties; and to order termination of non-banking activities or termination of ownership and control of a non-banking subsidiary by a bank holding company.

Pursuant toUnder the BHCA, as amended by the Dodd-Frank Act, the Company is required to serve as a source of financial strength for the Banks in the event of the financial distress of the Banks. This provision of the Dodd-Frank Act codifies the longstanding policy of the FRB. This support may be required at times when the bank holding company may not have the resources to provide the additional financial support required by its subsidiary banks. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a bank subsidiary will be assumed by the bankruptcy trustee and entitled to priority of payment.

The BHCA prohibits a bank holding company, without prior approval of the FRB, from acquiring all or substantially all the assets of a bank, acquiring control of a bank, merging or consolidating with another bank holding company, or acquiring direct or indirect ownership or control of any voting shares of another bank or bank holding company if, after such acquisition, the acquiring bank holding company would control more than 5% of any class of the voting shares of such other bank or bank holding company. Further, as a Massachusetts bank holding company, the Company generally must obtain the prior approval of the Massachusetts Board of Bank Incorporation to acquire ownership or control of more than 5% of any voting stock in any other banking institution, acquire substantially all the assets of a bank, or merge with another bank holding company. However, there is an exemption from this approval requirement in certain cases in which the banking institution to be acquired, simultaneously with the acquisition, merges with a banking institution subsidiary of the Company in a transaction approved by the Massachusetts Commissioner of Banks.

The BHCA also prohibits a bank holding company from engaging directly or indirectly in activities other than those of banking, managing or controlling banks or furnishing services to its subsidiary banks. However, a bank holding company may engage in and may own shares of companies engaged in certain activities that the FRB determineshas determined to be so closely related to banking or managing and controlling banks as to be a proper incident thereto.

The Change in Bank Control Act prohibits a person or group of persons from acquiring “control” of a bank holding company unless the FRB has been notified and has not objected to the transaction. Under a rebuttable presumption established by the FRB, the acquisition of 10% or more of a class of voting securities of a bank holding company, such as the Company, with a class of securities registered under Section 12 of the Exchange Act, would, under the circumstances set forth in the presumption, constitute the acquisition of control of a bank holding company. In addition, the BHCA prohibits any company from acquiring control of a bank or bank holding company without first having obtained the approval of the FRB. Pursuant to the BHCA, a company is deemed to have control of a bank or bank holding company in a number of ways including: if the company owns, controls or holds with power to vote 25% or more of a class of voting securities of the bank or bank holding company; controls in any manner the election of a majority of directors or trustees of the bank or bank holding company; or the

Brookline Bank and First Ipswich are subject to regulation, supervision and examination by the FRBMDOB and the MDOB.FRB. BankRI is subject to regulation, supervision and examination by the FRBRIBD and the RIBD.FRB. The enforcement powers available to federal and state banking regulators include, among other things, the ability to issue cease and desist or removal orders to terminate insurance of deposits; to assess civil money penalties; to issue directives to increase capital; to place the bank into receivership; and to initiate injunctive actions against banking organizations and institution-affiliated parties.

Deposit obligations of the Banks are insured up to applicable limits by the FDIC’s Deposit Insurance Fund and are subject to deposit insurance assessments to maintain the Deposit Insurance Fund. The Dodd-Frank Act permanently increased the FDIC deposit insurance limitup to $250,000 per separately insured depositor for deposits maintainedheld in the same right and capacity atcapacity. Additionally, Brookline Bank is a particularmember bank of the Depositors Insurance Fund ("DIF") The DIF is a private, industry-sponsored insurance fund that insures all deposits above FDIC limits for Massachusetts-chartered savings banks. Brookline Bank is also insured depository institution. by the DIF, and as such, Brookline Bank offers 100% insurance on all deposits as a result of a combination of insurance from the FDIC and the DIF. Additionally, Brookline Bank is required to file reports with the DIF.

The Federal Deposit Insurance Act (the “FDIA”), as amended by the Federal Deposit Insurance Reform Act and the Dodd-Frank Act, requires the FDIC to take steps as may be necessary to cause the ratio of deposit insurance reserves to estimated insured deposits - the designated reserve ratio - to reach 1.35% by September 30, 2020, and it mandates that the reserve ratio designated by the FDIC for any year may not be less than 1.35%. The FDIC utilizes a risk-based assessment system that imposes insurance premiums based upon a risk matrix that takes into account a bank’s capital level and supervisory rating (“CAMELS rating”). CAMELS ratings reflect the applicable bank regulatory agencies’ evaluation of the financial institution’s capital, asset quality, management, earnings, liquidity and sensitivity to risk. Assessment rates may also vary for certain institutions based on long-term debt issuer ratings, issuance of unsecured debt and levels of brokered deposits. Pursuant toFurther, the Dodd-Frank Act required that, in setting assessments, the FDIC offset the effect of the increase in the minimum reserve ratio from 1.15% to 1.35% on banks with less than $10 billion in assets.

To satisfy these requirements, on March 15, 2016, the FDIC’s Board of Directors approved a final rule to increase the reserve ratio to the statutorily required minimum ratio of 1.35% of estimated insured deposits. The final rule imposes on large banks a surcharge of 4.5 basis points of their assessment base, after making certain adjustments. Large banks, which are generally banks with $10 billion or more in assets, will pay quarterly surcharges in addition to their regular risk-based assessments. Overall regular risk-based assessment rates will decline once the reserve ratio reaches 1.15%. Small banks, such as the Banks, will receive credits to offset the portion of their assessments that help to raise the reserve ratio from 1.15% to 1.35%. After the reserve ratio reaches 1.38%, the FDIC will automatically apply a small bank’s credits to reduce its regular assessment up to the entire amount of the assessment. The revised deposit insurance assessment pricing became effective on July 1, 2016.

Deposit premiums are based on assets rather than insurable deposits.assets. To determine their actualits deposit insurance premiums, each ofpremium, the BanksBank computes itsthe base amount onof its average consolidated assets less its average tangible equity (defined as the amount of Tier 1 capital) and itsthe applicable assessment rate. The Company’s FDICOn April 26, 2016, the FDIC’s Board of Directors adopted a final rule that changed the manner in which deposit insurance costs totaled $3.5 million in 2015. assessment rates are calculated for established small banks, generally those banks with less than $10 billion of assets that have been insured for at least five years. The rule utilizes the CAMELS rating system, which is a supervisory rating system designed to take into account and reflect all financial and operational risks or bank may face, including capital adequacy, asset quality, management capability, earnings, liquidity and sensitivity to market risk. Under the final rule, each of seven financial ratios and a weighted average of CAMELS component ratings will be multiplied by a corresponding pricing multiplier. The sum of these products will be added to a uniform amount, with the resulting sum being an institution’s initial base assessment rate (subject to minimum or maximum assessment rates based on a bank’s CAMELS composite rating). This method takes into account various measures, including an institution’s leverage ratio, brokered deposit ratio, one year asset growth, the ratio of net income before taxes to total assets and considerations related to asset quality. Assessments for established small banks with a CAMELS rating of 1 or 2 range from 1.5 to 16 basis points, after adjustments, while assessments for established small banks with a CAMELS rating of 3 range from 3 to 30 basis points. Assessment rates for established small banks with a CAMELS composite rating of 4 or 5 range from 11 to 30 basis points, after adjustments.

The FDIC has the power to adjust the assessment rates at any time.

Similar to the source of strength doctrine discussed above in “Regulation of the Company-Source of Strength,” under the cross-guarantee provisions of the FDIA, the FDIC can hold any FDIC-insured depository institution liable for any loss suffered or anticipated by the FDIC in connection with (i) the “default” of a commonly controlled FDIC-insured depository institution; or (ii) any assistance provided by the FDIC to a commonly controlled FDIC-insured depository institution “in danger of default.”

The Banks must seek prior regulatory approval from the FRB to acquire another bank or establish a new branch office. Brookline Bank and First Ipswich must also seek prior regulatory approval from the MDOB to acquire another bank or establish a new branch office and BankRI must also seek prior regulatory approval from the RIBD to acquire another bank or establish a new branch office. Well capitalized and well managed banks may acquire other banks in any state, subject to certain deposit concentration limits and other conditions, pursuant to the Riegle-Neal Interstate Banking and Branching Efficiency Act of 1994, as amended by the Dodd-Frank Act. In addition, the Dodd-Frank Act authorizes a state-chartered bank to establish new branches on an interstate basis to the same extent a bank chartered by the host state may establish branches.

Section 24 of the FDIA generally limits the types of equity investments that FDIC-insured state-chartered member banks, such as the Banks, may make and the kinds of activities in which such banks may engage, as a principal, to those that are permissible for national banks. Further, the Gramm-Leach-Bliley Act of 1999 (the “GLBA”) permits state banks, to the extent permitted under state law, to engage through “financial subsidiaries” in certain activities which are permissible for subsidiaries of a financial holding company. In order to form a financial subsidiary, a state-chartered bank must be well capitalized, and must comply with certain capital deduction, risk management and affiliate transaction rules, among other requirements.

Section 29 of the FDIA and federal regulations generally limit the ability of an insured depository institution to accept, renew or roll over any brokered deposit unless the institution’s capital category is “well capitalized” or, with regulatory approval, “adequately capitalized.” Depository institutions other than those in the lowest risk category, that have brokered deposits in excess of 10% of total depositsassets will be subject to increased FDIC deposit insurance premium assessments. Additionally, depository institutions considered “adequately capitalized” that need regulatory approval to accept, renew or roll over any brokered deposits are subject to additional restrictions on the interest rate they may pay on deposits. As of December 31, 2015,2017, none of the Banks had brokered deposits in excess of 10% of total deposits.

The Community Reinvestment Act (“CRA”) requires the FRB to evaluate each of the Banks with regard to their performance in helping to meet the credit needs of the communities each of the Banks serve, including low and moderate-income neighborhoods, consistent with safe and sound banking operations, and to take this record into consideration when evaluating certain applications. The FRB’s CRA regulations are generally based upon objective criteria of the performance of institutions under three key assessment tests: (i) a lending test, to evaluate the institution’s record of making loans in its service areas; (ii) an investment test, to evaluate the institution’s record of investing in community development projects, affordable housing, and programs benefiting low or moderate income individuals and businesses; and (iii) a service test, to evaluate the institution’s delivery of services through its branches, ATMs, and other offices. Failure of an institution to receive at least a “Satisfactory” rating could inhibit the Banks or the Company from undertaking certain activities, including engaging in activities permitted as a financial holding company under GLBA and acquisitions of other financial institutions. Each Bank has achieved a rating of “Satisfactory” on its most recent CRA examination. Both Massachusetts and Rhode Island have adopted specific community reinvestment requirements which are substantially similar to those of the FRB.

Federal law limits a bank’s authority to extend credit to its directors, executive officers and holders of more than 10% of the Company's common stock, as well as to entities controlled by such persons. Among other things, extensions of credit to insiders are required to be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with unaffiliated persons. Also, the terms of such extensions of credit may not involve more than the normal risk of repayment or present other unfavorable features and may not exceed certain limitations on the amount of credit extended to such persons, individually and in the aggregate, which limits are based, in part, on the amount of the bank’s capital. The Dodd-Frank Act explicitly provides that an extension of credit to an insider includes credit exposure arising from a derivatives transaction, repurchase agreement, reverse repurchase agreement, securities lending transaction or securities borrowing transaction. Additionally, the Dodd-Frank Act requires that asset sale transactions with insiders must be on market terms, and if the transaction represents more than 10% of the capital and surplus of the bank, be approved by a majority of the disinterested directors of the bank.

The FRB has issued risk-based and leverage capital rules applicable to U.S. banking organizations such as the Company and the Banks. These guidelinesrules are intended to reflect the relationship between the banking organization’s capital and the degree of risk associated with its operations based on transactions recorded on-balance sheet as well as off-balance sheet items. The FRB may from time to time require that a banking organization maintain capital above the minimum levels discussed below, due to the banking organization’s financial condition or actual or anticipated growth.

The capital adequacy rules define qualifying capital instruments and specify minimum amounts of capital as a percentage of assets that banking organizations are required to maintain. Common equity Tier 1 capital generally includes common stock and related surplus, retained earnings and, in certain cases and subject to certain limitations, minority interest in consolidated subsidiaries, less goodwill, other non-qualifying intangible assets and certain other deductions. Tier 1 capital for banks and bank holding companies generally consists of the sum of common equity Tier 1 elements, non-cumulative perpetual preferred stock, and related surplus in certain cases and subject to limitations, minority interests in consolidated subsidiaries that do not qualify as common equity Tier 1 capital, less certain deductions. Tier 2 capital generally consists of hybrid capital instruments, perpetual debt and mandatory convertible debt securities, cumulative perpetual preferred stock, term subordinated debt and intermediate-term preferred stock, and, subject to limitations, allowances for loan losses. The sum of Tier 1 and Tier 2 capital less certain required deductions represents qualifying total risk-based capital. Prior to the effectiveness of certain provisions of the Dodd-Frank Act, bank holding companies were permitted to include trust preferred securities and cumulative perpetual

Under the capital rules, risk-based capital ratios are calculated by dividing common equity Tier 1, Tier 1, and total risk-based capital, respectively, by risk-weighted assets. Assets and off-balance sheet credit equivalents are assigned to one of several categories of risk-weights, based primarily on relative risk. Under the FRB's rules, the Company and the Banks are each required to maintain a minimum common equity Tier 1 capital ratio requirement of 4.5%, a minimum Tier 1 capital ratio requirement of 6%, a minimum total capital requirement of 8% and a minimum leverage ratio requirement of 4%. Additionally subject to a transition schedule, these rules require an institution to establish a capital conservation buffer of common equity Tier 1 capital in an amount above the minimum risk-based capital requirements for "adequately capitalized" institutions equal to 2.5% of total risk weighted assets, or face restrictions on the ability to pay dividends, pay discretionary bonuses, and to engaged in share repurchases.

A bank holding company, such as the Company, is considered "well capitalized" if the bank holding company (i) has a total risk based capital ratio of at least 10%, (ii) has a Tier 1 risk-based capital ratio of at least 6%, and (iii) is not subject to any written agreement order, capital directive or prompt corrective action directive to meet and maintain a specific capital level for any capital measure. In addition, under the FRB's prompt corrective action rules, a state member bank is considered “well capitalized” if it (i) has a total risk-based capital ratio of 10.0% or greater; (ii) a Tier 1 risk-based capital ratio of 8.0% or greater; (iii) a common Tier 1 equity ratio of at least 6.5% or greater, (iv) a leverage capital ratio of 5.0% or greater; and (iv)(v) is not subject to any written agreement, order, capital directive, or prompt corrective action directive to meet and maintain a specific capital level for any capital measure. The FRB also considers: (i) concentrations of credit risk; (ii) interest rate risk;

Generally, a bank, upon receiving notice that it is not adequately capitalized (i.e., that it is “undercapitalized”), becomes subject to the prompt corrective action provisions of Section 38 of FDIA that, for example, (i) restrict payment of capital distributions and management fees, (ii) require that the FRBits federal bank regulator monitor the condition of the institution and its efforts to restore its capital, (iii) require submission of a capital restoration plan, (iv) restrict the growth of the institution’s assets and (v) require prior regulatory approval of certain expansion proposals. A bank that is required to submit a capital restoration plan must concurrently submit a performance guarantee by each company that controls the bank. A bank that is “critically undercapitalized” (i.e., has a ratio of tangible equity to total assets that is equal to or less than 2.0%) will be subject to further restrictions, and generally will be placed in conservatorship or receivership within 90 days.

The Banks are considered “well capitalized” under the FRB's prompt corrective action rules and the Company is considered “well capitalized” under the FRB's rules applicable to bank holding companies.

The FDIA requires the federal bank regulatory agencies to prescribe standards, by regulations or guidelines, relating to internal controls, information systems and internal audit systems, risk management, loan documentation, credit underwriting, interest rate risk exposure, asset growth, asset quality, earnings, stock valuation and compensation, fees and benefits, and such other operational and managerial standards as the agencies deem appropriate. Guidelines adopted by the federal bank regulatory agencies establish general standards relating to internal controls and information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, asset quality, earnings and compensation, fees and benefits. In general, these guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines. The guidelines prohibit excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal stockholder. In addition, the federal banking agencies adopted regulations that authorize, but do not require, an agency to order an institution that has been given notice by an agency that it is not satisfying any of such safety and soundness standards to submit a compliance plan. If, after being so notified, an institution fails to submit an acceptable compliance plan or fails in any material respect to implement an acceptable compliance plan, the agency must issue an order directing action to correct the deficiency and may issue an order restricting asset growth, requiring an institution to increase its ratio of tangible equity to assets or directing other actions of the types to which an undercapitalized institution is subject under the “prompt corrective action” provisions of FDIA. See “Regulatory Capital Requirements” above. If an institution fails to comply with such an order, the agency may seek to enforce such order in judicial proceedings and to impose civil money penalties.

The Company is a legal entity separate and distinct from the Banks. The revenue of the Company (on a parent company only basis) is derived primarily from dividends paid to it by the Banks. The right of the Company, and consequently the right of shareholders of the Company, to participate in any distribution of the assets or earnings of the Banks through the payment of such dividends or otherwise is necessarily subject to the prior claims of creditors of the Banks (including depositors), except to the extent that certain claims of the Company in a creditor capacity may be recognized.

The FRB has authority to prohibit bank holding companies from paying dividends if such payment is deemed to be an unsafe or unsound practice. The FRB has indicated generally that it may be an unsafe or unsound practice for bank holding companies to pay dividends unless the bank holding company’s net income for the prior year is sufficient to fund the dividends and the expected rate of earnings retention is consistent with the organization’s capital needs, asset quality and overall financial condition. Further, the Company's ability to pay dividends will be restricted if it does not maintain the required capital conservation buffer. See “Capital Adequacy and Safety and Soundness-Regulatory Capital Requirements” above.

The FRB has the authority to use its enforcement powers to prohibit a bank from paying dividends if, in its opinion, the payment of dividends would constitute an unsafe or unsound practice. Federal law also prohibits the payment of dividends by a bank that will result in the bank failing to meet its applicable capital requirements on a pro forma basis. In addition, a state bank that is a member of the Federal Reserve System may not declare or pay a dividend if the total of all dividends declared during the calendar year, including the proposed dividend, exceeds the sum of the bank's net income (as reportable in its Reports of Condition and Income) during the current calendar year and the retained net income of the prior two calendar years, unless the dividend has been approved by the FRB. Payment of dividends by a bank is also restricted pursuant to various state regulatory limitations.

There are various statutory restrictions on the extent to which bank holding companies and their non-bank subsidiaries may borrow, obtain credit from or otherwise engage in “covered transactions” with their insured depository institution subsidiaries. The Dodd-Frank Act amended the definition of affiliate to include an investment fund for which the depository institution or one of its affiliates is an investment adviser. An insured depository institution (and its subsidiaries) may not lend money to, or engage in covered transactions with, its non-depository institution affiliates if the aggregate amount of covered transactions outstanding involving the bank, plus the proposed transaction, exceeds the following limits: (i) in the case of any one such affiliate, the aggregate amount of covered transactions of the insured depository institution and its subsidiaries cannot exceed 10% of the capital stock and surplus of the insured depository institution; and (ii) in the case of all affiliates, the aggregate amount of covered transactions of the insured depository institution and its subsidiaries cannot exceed 20% of the capital stock and surplus of the insured depository institution. For this purpose, “covered transactions” are defined by statute to include a loan or extension of credit to an affiliate, a purchase of or investment in securities issued by an affiliate, a purchase of assets from an affiliate unless exempted by the FRB, the acceptance of securities issued by an affiliate as collateral for a loan or extension of credit to any person or company, the issuance of a guarantee, acceptance or letter of credit on behalf of an affiliate, securities borrowing or lending transactions with an affiliate that creates a credit exposure to such affiliate, or a derivatives transaction with an affiliate that creates a credit exposure to such affiliate. Covered transactions are also subject to certain collateral security requirements. Covered transactions as well as other types of transactions between a bank and a bank holding company must be on market terms and not otherwise unduly favorable to the holding company or an affiliate of the holding company. As of December 31, 2015,2017, there were no such transactions. Moreover, Section 106 of the BHCABank Holding Company Act Amendment of 1970 provides that, to further competition, a bank holding company and its subsidiaries are prohibited from engaging in certain tying arrangements in connection with any extension of credit, lease or sale of property of any kind, or furnishing of any service. As of December 31, 2015,2017, there were no such transactions.

The Company and the Banks are subject to a number of federal and state laws designed to protect consumers and prohibit unfair or deceptive business practices. These laws include the Equal Credit Opportunity Act, Fair Housing Act, Home Ownership Protection Act, Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactions Act of 2003 (the “FACT Act”), GLBA, Truth in Lending Act, the CRA, the Home Mortgage Disclosure Act, Real Estate Settlement Procedures Act, National Flood Insurance Act and various state law counterparts. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must interact with customers when taking deposits, making loans, collecting loans and providing other services. Further, the Dodd-Frank Act established the Consumer Financial Protection Bureau ("CFPB"), which has the responsibility for making rules and regulations under the federal consumer protection laws relating to financial products and services. The CFPB also has a broad mandate to prohibit unfair, deceptive or deceptiveabusive acts and practices and is specifically empowered to require certain disclosures to consumers and draft model

The Dodd-Frank Act prescribes certain standards that mortgage lenders must consider before making a residential mortgage loan, including verifying a borrower’s ability to repay such mortgage loan, and allows borrowers to assert violations of certain provisions of the Truth-in-Lending Act as a defense to foreclosure proceedings. Under the Dodd-Frank Act, prepayment penalties are prohibited for certain mortgage transactions and creditors are prohibited from financing insurance policies in connection with a residential mortgage loan or home equity line of credit. In addition, the Dodd-Frank Act prohibits mortgage originators from receiving compensation based on the terms of residential mortgage loans and generally limits the ability of a mortgage originator to be compensated by others if compensation is received from a consumer. The Dodd-Frank Act

The GLBA requires financial institutions to implement policies and procedures regarding the disclosure of nonpublic personal information about consumers to nonaffiliated third parties. In general, the Banks must provide their customers with an annual disclosure that explains their policies and procedures regarding the disclosure of such nonpublic personal information and, except as otherwise required or permitted by law, the Banks are prohibited from disclosing such information except as provided in such policies and procedures. If the financial institution only discloses information under exceptions from the GLBA that do not require an opt out to be provided and if there has been no change in the financial institutions privacy policies and practices since its most recent disclosures provide to customers, an annual disclosure is not required to be provided by the financial institution. The GLBA also requires that the Banks develop, implement and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information (as defined under GLBA), to protect against anticipated threats or hazards to the security or integrity of such information and to protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. The Banks are also required to send a notice to customers whose “sensitive information” has been compromised if unauthorized use of this information is “reasonably possible.” Most of the states, including the states where the Banks operate, have enacted legislation concerning breaches of data security and the duties of the Banks in response to a data breach. Congress continues to consider federal legislation that would require consumer notice of data security breaches. Pursuant to the FACT Act, the Banks must also develop and implement a written identity theft prevention program to detect, prevent, and mitigate identity theft in connection with the opening of certain accounts or certain existing accounts. Additionally, the FACT Act amends the Fair Credit Reporting Act to generally prohibit a person from using information received from an affiliate to make a solicitation for marketing purposes to a consumer, unless the consumer is given notice and a reasonable opportunity and a reasonable and simple method to opt out of the making of such solicitations.

Under the Bank Secrecy Act (“BSA”), a financial institution is required to have systems in place to detect certain transactions, based on the size and nature of the transaction. Financial institutions are generally required to report to the United States Treasury any cash transactions involving more thanat least $10,000. In addition, financial institutions are required to file suspicious activity reports for any transaction or series of transactions that involve more than $5,000 and which the financial institution knows, suspects or has reason to suspect involves illegal funds, is designed to evade the requirements of the BSA or has no lawful purpose. The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (the “USA PATRIOT Act”), which amended the BSA, is designed to deny terrorists and others the ability to obtain anonymous access to the U.S. financial system. The USA PATRIOT Act has significant implications for financial institutions and businesses of other types involved in the transfer of money. The USA PATRIOT Act, together with the implementing regulations of various federal regulatory agencies, has caused financial institutions, such as the Banks, to adopt and implement additional policies or amend existing policies and procedures with respect to, among other things, anti-money laundering compliance, suspicious activity, currency transaction reporting, customer identity verification and customer risk analysis. In evaluating an application under Section 3 of the BHCA to acquire a bank or an application under the Bank Merger Act to merge banks or effect a purchase of assets and assumption of deposits and other liabilities, the applicable federal banking

The U.S. has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others. These sanctions, which are administered by the U.S. Treasury’s Office of Foreign Assets Control (“OFAC”), take many different forms. Generally, however, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on “U.S. persons” engaging in financial or other transactions relating to a sanctioned country or with certain designated persons and entities; (ii) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in

The Dodd-Frank Act prohibits banking organizations, such as the Company and the Banks, from engaging in proprietary trading and from sponsoring and investing in hedge funds and private equity funds, except as permitted under certain limited circumstances, in a provision commonly referred to as the “Volcker Rule.” Under the Dodd-Frank Act, proprietary trading generally means trading by a banking entity or its affiliate for its trading account. Hedge funds and private equity funds are described by the Dodd-Frank Act as funds that would be registered under the Investment Company Act but for certain enumerated exemptions. The Volcker Rule restrictions apply to the Company, the Banks and all of their subsidiaries and affiliates.