The banking industry is highly regulated with numerous statutory and regulatory requirements that are designed primarily for the protection of depositors and the financial system, and not for the purpose of protecting shareholders.system. Set forth below is a description of the material laws and regulations applicable to the Company and the Bank. This summary is not complete and the reader should refer to these laws and regulations for more detailed information. The Company’s and the Bank’s failure to comply with applicable laws and regulations could result in a range of sanctions and administrative actions imposed upon the Company and/or the Bank, including restriction to merger and acquisition activity, the imposition of civil money penalties, formal agreements and cease and desist orders. Changes in applicable law or regulations, and in their interpretation and application by regulatory agencies, cannot be predicted, and may have a material effect on the Company’s business and results.

The Company and its subsidiaries are subject to the laws and regulations of the federal government and where applicable the states and jurisdictions in which they conduct business. The Company, as a bank holding company, is subject to extensive regulation, supervision and examination by the Board of Governors of the Federal Reserve System (“FRB”) as its primary federal regulator. The Bank is a nationally-chartered bank and is subject to extensive regulation, supervision and examination by the Office of the Comptroller of the Currency (“OCC”) as its primary federal regulator, and as to certain matters, the FRB, the Consumer Financial Protection Bureau (“CFPB”), and the Federal Deposit Insurance Corporation (“FDIC”).

The Company is also subject to the jurisdiction of the SEC and is subject to disclosure and regulatory requirements under the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended. The Company’s common stock is listed on the New York Stock Exchange (“NYSE”) and it is subject to NYSE’s rules for listed companies. Affiliated entities, including BPAS, GTC, HB&T, HSI, BPAS Trust Company of Puerto Rico,FBD, Nottingham, CISI, OneGroup, and Carta Group, and Wealth Partners are subject to the jurisdiction of certain state and federal regulators and self-regulatory organizations including, but not limited to, the SEC, the Texas Department of Banking, the State of Maine Bureau of Financial Institutions, the Financial Industry Regulatory Authority (“FINRA”), Puerto Rico Office of the Commissioner of Financial Institutions, the U.S. Department of Labor, and state securities and insurance regulators.

The Company was a bank holding company under the Bank Holding Company Act of 1956, (the “BHC Act”), and became a financial holding company effective September 30, 2015. As a bank holding company that has elected to become a financial holding company, the Company can affiliate with securities firms and insurance companies and engage in other activities that are “financial in nature” or “incidental” or “complementary” to activities that are financial in nature, as long as it continues to meet the eligibility requirements for financial holding companies (including requirements that the financial holding company and its depository institution subsidiary maintain their status as “well capitalized” and “well managed”).

Generally, FRB approval is not required for the Company to acquire a company (other than a bank holding company, bank or savings association) engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the FRB. Prior notice to the FRB may be required, however, if the company to be acquired has total consolidated assets of $10 billion or more. Prior FRB approval is required before the Company may acquire the beneficial ownership or control of more than 5% of the voting shares or substantially all of the assets of a bank holding company, bank or savings association.

Because the Company is a financial holding company, if the Bank were to receive a rating under the Community Reinvestment Act of 1977, as amended (“CRA”), of less than Satisfactory, the Company will be prohibited, until the rating is raised to Satisfactory or better, from engaging in new activities or acquiring companies other than bank holding companies, banks or savings associations, except that the Company could engage in new activities, or acquire companies engaged in activities, that are considered “closely related to banking” under the BHC Act.Bank Holding Company Act of 1956, (the “BHC Act”). The Bank’s most recent CRA rating was “Satisfactory”. In addition, if the FRB determines that the Company or the Bank is not well capitalized or well managed, the Company would be required to enter into an agreement with the FRB to comply with all applicable capital and management requirements and may contain additional limitations or conditions. Until corrected, the Company could be prohibited from engaging in any new activity or acquiring companies engaged in activities that are not closely related to banking, absent prior FRB approval.

Because the Company is a financial holding company, it is subject to regulatory capital requirements and required by the FRB to, among other things, maintain cash reserves against its deposits. Effective on March 26, 2020, the FRB reduced this cash reserve requirement to zero percent to help support lending to households and businesses as a result of the impacts of the COVID-19 pandemic. The Bank is under similar capital requirements administered by the OCC as discussed below. FRB policy has historically required a financial holding company to act as a source of financial and managerial strength to its subsidiary banks. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) codifies this historical policy as a statutory requirement. To the extent the Bank is in need of capital, the Company could be expected to provide additional capital, including borrowings from the FRB for such purpose. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors’ funds.

The FRB also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the FRB, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust ourits strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond ourits control.

The Bank is supervised and regularly examined by the OCC. The various laws and regulations administered by the OCC affect the Company’s practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects the Bank’s business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and the location of its offices. The OCC generally prohibits a depository institution from making any capital distributions, including the payment of a dividend, or paying any management fee to its parent holding company if the depository institution would become undercapitalized due to the payment. Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the OCC. The Bank is well capitalized under regulatory standards administered by the OCC. For additional information on our capital requirements see “Management’s Discussion and Analysis of Financial Condition and Results of Operations – Shareholders’ Equity” and Note P to the Financial Statements.

The Bank is a member of the FHLB, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to the rules and requirements of the FHLB, including the purchase of shares of FHLB activity-based stock in the amount of 4.5% of the dollar amount of outstanding advances and FHLB capital stock in an amount equal to the greater of $1,000 or the sum of 0.15% of the mortgage-related assets held by the Bank based upon the previous year-end financial information. The Bank was in compliance with the rules and requirements of the FHLB at December 31, 2019.

Deposits of the Bank are insured up to the applicable limits by the Deposit Insurance Fund (“DIF”) and are subject to deposit insurance assessments to maintain the DIF. The Dodd-Frank Act permanently increased the maximum amount of deposit insurance to $250,000 per deposit category, per depositor, per institution. A depository institution’s DIF assessment is calculated by multiplying its assessment rate by the assessment base, which is defined as the average consolidated total assets less the average tangible equity of the depository institution. The initial base assessment rate is based on its capital level and supervisory ratings (its “CAMELS ratings”), certain financial measures to assess an institution’s ability to withstand asset related stress and funding related stress and, in some cases, additional discretionary adjustments by the FDIC to reflect additional risk factors. The Bank’s adjusted average consolidated total assets for 4 consecutive quarters exceeded $10.0 billion in 2018, which resulted in a deposit insurance assessment is based on a large institution classification, rather than the small institution classification for years prior to 2018.

For large insured depository institutions, generally defined as those with at least $10 billion in total assets, the FDIC has eliminated risk categories when calculating the initial base assessment rates and now combine CAMELS ratings and financial measures into two scorecards to calculate assessment rates, one for most large insured depository institutions and another for highly complex insured depository institutions (which are generally those with more than $50 billion in total assets that are controlled by a parent company with more than $500 billion in total assets). Each scorecard has two components - a performance score and loss severity score, which are combined and converted to an initial assessment rate. The FDIC has the ability to adjust a large or highly complex insured depository institution’s total score by a maximum of 15 points, up or down, based upon significant risk factors that are not captured by the scorecard. Under the current assessment rate schedule, the initial base assessment rate for large and highly complex insured depository institutions ranges from three to 30 basis points, and the total base assessment rate, after applying the unsecured debt and brokered deposit adjustments, ranges from one and one-half to 40 basis points. The Bank’s FDIC insurance for 20192021 was based on an assessment rate of three basis points.

In October 2010, the FDIC adopted a DIF restoration plan to ensure that the fund reserve ratio reached 1.35% by September 30, 2020, as required by the Dodd-Frank Act. In September 2018, the DIF reserve ratio reached 1.36%, exceeding the required reserve ratio of 1.35% ahead of the September 30, 2020 deadline. Since the DIF reserve ratio remained above 1.35% in 2019, the Bank was permitted to offset its FDIC insurance assessments in 2019 with Small Bank Assessment Credits issued by the FDIC in January 2019. The Bank offset $1.5 million of FDIC insurance assessments in 2019 with Small Bank Assessment Credits. FDIC insurance expense net of Small Bank Assessment Credits in 20192021 totaled $1.4$4.1 million, compared to $3.2$2.7 million in 20182020 and $3.5$1.4 million in 2017.

Under the Federal Deposit Insurance Act, if the FDIC finds that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, the FDIC may determine that such violation or unsafe or unsound practice or condition require the termination of deposit insurance.

On July 21, 2010, the Dodd-Frank Act was signed into law, which resulted in significant changes to the banking industry. As discussed further throughout this section, certain aspects of the Dodd-Frank Act are subject to implementing rules that have been taking effect over several years.

Pursuant to FRB regulations mandated by the Dodd-Frank Act, interchange fees on debit card transactions are limited to a maximum of $0.21 per transaction plus 5 basis points of the transaction amount. A debit card issuer may recover an additional one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements prescribed by the FRB. The FRB also adopted requirements in the final rule that issuers include two unaffiliated networks for routing debit transactions that are applicable to the Company and the Bank.  The Company became subject to the interchange fee cap mandated by the Dodd-Frank Act beginning on July 1, 2018.  As such, the fees the Company received on and after July 1, 2018 for an electronic debit transaction were capped at the statutory limit.  Prior to July 1, 2018, the Company was exempt from the interchange fee cap under the "small issuer" exemption, which applies to any debit card issuer with total worldwide assets (including those of its affiliates) of less than $10 billion as of the end of the previous calendar year.

The Dodd-Frank Act established the CFPB and empowered it to exercise broad rulemaking, supervision, and enforcement authority for a wide range of consumer protection laws. Since the Company’sBank’s total consolidated assets exceed $10 billion, the CompanyBank is subject to the direct supervision of the CFPB. The CFPB has issued numerous regulations and amendments under which the Company and the Bank may continue to incur additional expense in connection with its ongoing compliance obligations. Significant recent CFPB developments that may affect operations and compliance costs include:

​

The final rules issued by the FRB, SEC, OCC, FDIC, and Commodity Futures Trading Commission implementing Section 619 of the Dodd-Frank Act (commonly known as the Volcker Rule) prohibit insured depository institutions and companies affiliated with insured depository institutions from engaging in short-term proprietary trading of certain securities, derivatives, commodity futures and options on these instruments, for their own account. The final rules also imposeimposes limits on banking entities’ investments in, and other relationships with, hedge funds or private equity funds.

On January 30, 2020, the five federal agencies proposed additional amendments to the Volcker Rule related to the restrictions on ownership interests and relationships with covered funds. The ultimate benefits or consequencesOn June 25, 2020, a final rule was finalized which modified the Volcker Rule by streamlining the covered funds portion of these amendments will depend on their final form, which the Company cannot predict.

The ongoing effects of the Dodd-Frank Act, as well as the recent and possible future changes to the regulatory framework as a result of the Economic Growth Act and future proposals make it difficult to assess the overall financial impact of the Dodd-Frank Act and related regulatory developments on the Company and the banking industry. As a result, the Company cannot predict the ultimate impact of the Dodd-Frank Act on the Company or the Bank, including the extent to which it could increase costs or limit the Company’s ability to pursue business opportunities in an efficient manner, or otherwise adversely affect its business, financial condition and results of operations. Nor can the Company predict the impact or substance of other future legislation or regulation. However, it is expected that future legislation or regulation at a minimum will increase the Company’s and the Bank’s operating and compliance costs. As rules and regulations continue to be implemented or issued, the Company may need to dedicate additional resources to ensure compliance, which may increase its costs of operations and adversely impact itsthe Company’s earnings.

The Company and the Bank are required to comply with applicable capital adequacy standards established by the federal banking agencies.  The risk-based capital standards that were applicable to the Company and the Bank through December 31, 2014 wereagencies (the “Capital Rules”) which are based on the 1988 Capital Accord, known as Basel I (“Basel I”), of the Basel Committee on Banking SupervisionSupervision’s (the “Basel Committee”).  However, in July 2013, the FRB, the OCC and the FDIC approved final rules (the “Capital Rules”) establishing a new comprehensive capital framework for U.S. banking organizations.  These rules went into effect for the Company and the Bank on January 1, 2015, subject to phase-in periods for certain components.

The Capital Rules, among other things: (i) introduces asthings, impose a capital measure called “Common Equity Tier 1,” (“CET1”), (ii) to which most deductions/adjustments to regulatory capital measures be made. In addition, the Capital Rules specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting certain specified revised requirements, (iii) defines CET1 narrowly by requiring that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital, and (iv) expands the scope of the deductions from and adjustments to capital as compared to existing regulations.  Under the Capital Rules, the most common form of Additional Tier 1 capital is non-cumulative perpetual preferred stock, and the most common form of Tier 2 capital is subordinated notes and a portion of the allowance for loan and lease losses, in each case, subject to the Capital Rules specific requirements.

Under the Capital Rules, the minimum capital ratios as of January 1, 2016 are as follows:

​

The Capital Rules requiredrequire the Company and the Bank to maintain a “capital conservation buffer” composed entirely of CET1. When it was fully phased-in at the beginning of 2019, bankingBanking organizations wereare required to maintain a minimum capital conservation buffer of 2.5% (CET1 to Total risk-weighted assets), in addition to the minimum risk-based capital ratios. Therefore, to satisfy both the minimum risk-based capital ratios and the capital conservation buffer, a banking organization is required to maintain the following: (i) CET1 to total risk-weighted assets of at least 7%, (ii) Tier 1 capital to total risk-weighted assets of at least 8.5%, and (iii) Total capital (Tier 1 capital plus Tier 2 capital) to total risk-weighted assets of at least 10.5%. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions that do not maintain a capital conservation buffer of 2.5% or more will face constraints on dividends, common share repurchases and incentive compensation based on the amount of the shortfall.

The Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, deferred tax assets dependent upon future taxable income and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. Under the general Basel I risk-based capital rules, the effects of accumulated other comprehensive income or loss items included in shareholders' equity (for example, marks-to-market of securities held in the available for sale portfolio) were reversed for the purposes of determining regulatory capital. Under the Capital Rules, the effects of certain accumulated other comprehensive income or loss items are not excluded;excluded for the purposes of determining regulatory capital; however, banks not using the advanced approach, including the Company and the Bank, were permitted to, and in the case of the Company and the Bank they did, make a one-time permanent election to continue to exclude these items.

Consistent with Section 171 of the Dodd-Frank Act, the Capital Rules allow certain bank holding companies to include certain hybrid securities, such as trust preferred securities, in Tier 1 capital if they had less than $15 billion in assets as of December 31, 2009 and the securities were issued before May 19, 2010. Accordingly, the trust preferred securities on the Company’s balance sheet will bewere included as Tier 1 capital while they are outstanding, unless the Company completes an acquisition of a depository institution holding company that did not meet this criteria, or are acquired by such an organization, after January 1, 2014, at which time they would be subject to the stated phase-out requirements of the Capital Rules and would be included as Tier 2 capital.

With respect to the Bank, the Capital Rules also reviserevised the prompt corrective action (“PCA”) regulations established pursuant to Section 38 of the Federal Deposit Insurance Act, by (i) introducing aestablishing the CET1 ratio requirement for each capital category other than critically undercapitalized, with the required CET1 ratio beingat 6.5% for well-capitalized status; (ii) increasingstatus and the minimum Tier 1 capital ratio requirement for each capital category, with the minimum Tier 1 capital ratioat 8.0% for well-capitalized status being 8.0%; and (iii) eliminating the current provision that allows certain highly-rated banking organizations to maintain a 3.0% leverage ratio and still be adequately capitalized.status. The Capital Rules do not change the Total risk-based PCA capital requirement for any capital category.

Requirements to maintain higher levels of capital or to maintain higher levels of liquid assets could adversely impact the Company'sCompany’s net income and return on equity. The current requirements and the Company'sCompany’s actual capital levels are detailed in Note P of “Notes to Consolidated Financial Statements” filed in Part II, Item 8, “Financial Statements and Supplementary Data.”

In connection with its banking activities, the Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending to various sectors of the economy. These laws include but are not limited to the Equal Credit Opportunity Act, the Gramm-Leach-Bliley Act (“GLB Act”), the Fair Credit Reporting Act (“FCRA”), the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”), Electronic Funds Transfer Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Dodd-Frank Act, the Real Estate Settlement Procedures Act, the Secure and Fair Enforcement for Mortgage Licensing Act (“SAFE”), the Servicemembers Civil Relief Act (“SCRA”), the Military Lending Act (“MLA”), and various state law counterparts.

The Dodd-Frank Act created the CFPB with broad powers to supervise and enforce consumer protection laws, including laws that apply to banks in order to prohibit unfair, deceptive or abusive acts or practices. The CFPB has examination authority over all banks and savings institutions with more than $10 billion in assets. The Dodd-Frank Act also weakens the federal preemption rules that are applicable to national banks and gives attorney generals for the states certain powers to enforce federal consumer protection laws. Further, under the Dodd-Frank Act, it is unlawful for any provider of consumer financial products or services to engage in any unfair, deceptive, or abusive acts or practices (“UDAAP”). A violation of the consumer protection and privacy laws, and in particular UDAAP, could have serious legal, financial, and reputational consequences.

The GLB Act requires all financial institutions to adopt privacy policies, restrict the sharing of nonpublic customer data with nonaffiliated parties and establishes procedures and practices to protect customer data from unauthorized access. In addition, the FCRA, as amended by the FACT Act, includes provisions affecting the Company, the Bank, and their affiliates, including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. The FACT Act requires persons subject to FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the Federal Trade Commission have extensive rulemaking authority under the FACT Act, and the Company and the Bank are subject to the rules that have been created under the FACT Act, including rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate certain identity theft red flags. The SCRA protects persons called to active military service and their dependents from undue hardship resulting from their military service, and the MLA extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The SCRA applies to all debts incurred prior to the commencement of active duty and limits the amount of interest, including service and renewal charges and any other fees or charges (other than bona fide insurance) that are related to the obligation or liability. The MLA applies to certain consumer loans and extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The Bank is also subject to data security standards and data breach notice requirements issued by the OCC and other regulatory agencies. The Bank has created policies and procedures to comply with these consumer protection requirements.

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The USA Patriot Act also encourages information-sharing among financial institutions, regulators, and law enforcement authorities by providing an exemption from the privacy provisions of the GLB Act for financial institutions that comply with the provision of the Act. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the institution. The Company has approved policies and procedures that are designed to comply with the USA Patriot Act and its regulations.

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others administrated by the Treasury’s Office of Foreign Assets Control (“OFAC”). The OFAC administered sanctions can take many different forms; however, they generally contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, entity or individual, including prohibitions against direct or indirect imports and exports and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments, or providing investment related advice or assistance; and (ii) a blocking of assets in which the government or specially designated nationals have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences.

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934, as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) new requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) additional responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) the creation of an independent accounting oversight board for the accounting industry; (iv) new standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on non-preferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violations of the securities laws.

Among other provisions, the federal banking rule under the Electronic Fund Transfer Act prohibits financial institutions from charging consumers fees for paying overdrafts on automated teller machines and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions. The rule does not govern overdraft fees on the payment of checks and certain other forms of bill payments.

Under the CRA, the Bank is required to help meet the credit needs of its communities, including low- and moderate-income neighborhoods. Although the Bank must follow the requirements of CRA, it does not limit the Bank’s discretion to develop products and services that are suitable for a particular community or establish lending requirements or programs. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibits discrimination in lending practices. The Bank’s failure to comply with the provisions of the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s failure to comply with the Equal Credit Opportunity Act and the Fair Housing Act could result in enforcement actions against it by its regulators as well as other federal regulatory agencies and the Department of Justice. The Bank’s latestmost recent CRA rating was “Satisfactory”.

The Bank Secrecy Act (“BSA”) requires all financial institutions, including banks and securities broker-dealers, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. The BSA includes a variety of recordkeeping and reporting requirements (such as currency transaction and suspicious activity reporting), as well as due diligence/know-your-customer documentation requirements. The Company has established a bank secrecy act /anti-money laundering program and taken other appropriate measures in order to comply with BSA requirements.

​

The Company and its subsidiaries are subject to extensive state and federal regulation, supervision and legislation that govern nearly every aspect of its operations. The Company, as a financial holding company, is subject to regulation by the FRB and its banking subsidiary is subject to regulation by the OCC. These regulations affect deposit and lending practices, capital levels and structure, investment practices, dividend policy, and growth. These regulatory authorities have extensive discretion in connection with their supervisory and enforcement activities, including the imposition of restrictions on the operation of a bank, the classification of assets by a bank, and the adequacy of a bank’s allowance for credit losses. In addition, the non-bank subsidiaries are engaged in providing services including, but not limited to, retirement plan administration, fiduciary services to collective investment funds, investment management and insurance brokerage services, which industries are also heavily regulated at both a state and federal level.level, including by state banking and insurance agencies, the U.S. Department of Labor and the SEC. Such regulators govern the activities in which the Company and its subsidiaries may engage.  These regulatory authorities have extensive discretion in connection with their supervisory and enforcement activities, including the imposition of restrictions on the operation of a bank, the classification of assets by a bank and the adequacy of a bank’s allowance for loan losses. Any change in such regulation and oversight, whether in the form of regulatory policy, regulations, legislation, interpretation or application, could have a material impact on the Company and its operations. Changes to the regulatory laws governing these businesses could affect the Company’s ability to deliver or expand its services and adversely impact its operating and financial condition.

The Dodd-Frank Act, as amended by the Economic Growth Act, instituted major changes to the banking and financial institutions regulatory regimes based upon the performance of, and ultimate government intervention in the financial services sector. The ongoing effects of the Dodd-Frank Act, as well as continued rule-making and possible future changes to the regulatory requirements, make it difficult to assessmay substantially impact the overall impact of the Dodd-Frank Act and related regulatory developments on the CompanyCompany’s and the Bank.Bank’s operations. The implications of the Dodd-Frank Act for the Company’s businesses continue to depend to a large extent on the implementation of the legislation by the FRB, the CFPB, and other agencies as well as how market practices and structures change in response to the requirements of such rule making. New initiatives and proposed rulemaking by the Dodd-Frank Act.  All of these changesCFPB may significantly limit the fees the Company may charge for its services and such proposed rulemaking may have a material impact on the Company’s fee income. Changes in regulations could subject the Company, among other things, to additional costs for compliance and limit the types of financial services and products it can offer and/or increase the ability of non-banks to offer competing financial services and products.

The Company is also directly subject to the requirements of entities that set and interpret the accounting standards such as the Financial Accounting Standards Board, and indirectly subject to the actions and interpretations of the Public Company Accounting Oversight Board, which establishes auditing and related professional practice standards for registered public accounting firms and inspects registered firms to assess their compliance with certain laws, rules, and professional standards in public company audits. These regulations, along with the currently existing tax, accounting, securities, insurance, and monetary laws, regulations, rules, standards, policies and interpretations, control the methods by which financial institutions and their holding companies conduct business, engage in strategic and tax planning, implement strategic initiatives, and govern financial reporting.

The Company’s failure to comply with laws, regulations or policies could result in civil or criminal sanctions, restrictions to its business model, and money penalties by state and federal agencies, and/or reputation damage, which could have a material adverse effect on the Company’s business, financial condition and results of operations. See “Supervision and Regulation” for more information about the regulations to which the Company is subject.

The Company depends on dividends from its banking subsidiary for cash revenues to support common dividend payments and other uses, but those dividends are subject to restrictions.

The ability of the Company to satisfy its obligations and pay cash dividends to its shareholders is primarily dependent on the earnings of and dividends from the subsidiary bank. However, payment of dividends by the bank subsidiary is limited by dividend restrictions and capital requirements imposed by bank regulations.

The Company is exposed to many types of operational risks, including reputational risk, legal and compliance risk, the risk of fraud or theft by employees or outsiders, unauthorized transactions by employees, or operational errors, including clerical or record keeping errors or those resulting from faulty or disabled computer or telecommunications systems or disclosure of confidential proprietary information of its customers. Negative public opinion can result from actual or alleged conduct in any number of activities, including lending practices, sales practices, customer treatment, corporate governance and acquisitions and from actions taken by government regulators and community organizations in response to those activities. Negative public opinion can adversely affect the Company’s ability to attract and keep customers and can expose the Company to litigation and regulatory action. Actual or alleged conduct by the Company can result in negative public opinion about its business.

If personal, nonpublic, confidential, or proprietary information of customers in the Company’s possession were to be mishandled or misused, the Company could suffer significant regulatory consequences, reputational damage, and financial loss. Such mishandling or misuse could include, for example, if such information were erroneously provided to parties who are not permitted to have the information, either by fault of its systems, employees, or counterparties, or where such information is intercepted or otherwise inappropriately taken by third parties.

Because the nature of the financial services business involves a high volume of transactions, certain errors may be repeated or compounded before they are discovered and successfully rectified. The Company’s necessary dependence upon automated systems to record and process transactions and the large transaction volumes may further increase the risk that technical flaws or employee tampering or manipulation of those systems will result in losses that are difficult to detect. Further, the significant value of money managed and administered may result in larger exposures. The Company also may be subject to disruptions of its operating systems arising from events that are wholly or partially beyond its control (for example, computer viruses or electrical or telecommunications outages), which may give rise to disruption of service to customers and to financial loss or liability. The Company is further exposed to the risk that external vendors may be unable to fulfill their contractual obligations (or will be subject to the same risk of fraud or operational errors by their respective employees) and to the risk that business continuity and data security systems prove to be inadequate. The occurrence of any of these risks could result in a diminished ability to operate the Company’s business, potential liability to clients, reputational damage, and regulatory intervention, which could adversely affect our business, financial condition, and results of operations, perhaps materially.

The Company’s business requires the secure processing and storage of sensitive information relating to its customers, employees, business partners, and others. However, like any financial institution operating in today’s digital business environment, the Company is subject to threats to the security of its networks and data, as described above. These threats continue to increase as the frequency, intensity and sophistication of attempted attacks and intrusions increase around the world. In response to these threats there has been heightened legislative and regulatory focus on data privacy and cybersecurity in the U.S. and the European Union and as a result, the Company must comply with an evolving set of legal requirements in this area, including substantive cybersecurity standards as well as requirements for notifying regulators and affected individuals in the event of a data security incident. This regulatory environment is increasingly challenging and may present material obligations and risks to the Company’s business, including significantly expanded compliance burdens, costs and enforcement risks.