The Capital Rules also require a “capital conservation buffer,” composed entirely of CET1, on top of these minimum risk-weighted asset ratios. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer will face constraints on dividends, equity and other capital instrument repurchases and compensation based on the amount of the shortfall. The capital conservation buffer was phased in incrementally until when, on January 1, 2019, the capital conservation buffer was fully phased in, resulting in the capital standards applicable to the Company and the Bank including an additional capital conservation buffer of 2.5% of CET1, and effectively resulting in minimum ratios inclusive of the capital conservation buffer of (i)(1) CET1 to risk-weighted assets of at least 7%, (ii)(2) Tier 1 capital to risk-weighted assets of at least 8.5% and (iii)(3) Total capital to risk-weighted assets of at least 10.5%. The risk-weighting categories in the Capital Rules are standardized and include a risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. government and agency securities, to 600% for certain equity exposures and resulting in higher risk weights for a variety of asset classes.

In addition, under the prior general risk-based capital rules, the effects of accumulated other comprehensive income or loss (“AOCI”) items included in stockholders’ equity (for example, marks-to-market of securities held in the available for sale ("AFS"(“AFS”) portfolio) under GAAP were excluded for the purposes of determining regulatory capital ratios. Under the Capital Rules, the effects of certain AOCI items are not excluded; however, banking organizations not using the advanced approaches, including the Company and the Bank, were permitted to make a one-time permanent election to continue to exclude these items in January 2015. The Capital Rules also preclude certain hybrid securities, such as trust preferred securities issued after May 19, 2010, from inclusion in bank holding companies’ Tier 1 capital.

Pursuant to Section 38 of the FDIA, federal banking agencies are required to take “prompt corrective action” (“PCA”) should an insured depository institution fail to meet certain capital adequacy standards. At each successive lower capital category, an insured depository institution is subject to more restrictions and prohibitions, including restrictions on growth, restrictions on interest rates paid on deposits, restrictions or prohibitions on payment of dividends and restrictions on the acceptance of brokered deposits. Furthermore, if an insured depository institution is classified in one of the undercapitalized categories, it is required to submit a capital restoration plan to the appropriate federal banking agency and the holding company must guarantee the performance of that plan. Based upon its capital levels, a bank that is classified as well-capitalized, adequately capitalized or undercapitalized, may be treated as though it were in the next lower capital category if the appropriate federal banking agency, after notice and opportunity for hearing, determines that an unsafe or unsound condition or an unsafe or unsound practice, warrants such treatment.

For purposes of PCA, to be: (i)(1) well-capitalized, an insured depository institution must have a total risk based capital ratio of at least 10%, a Tier 1 risk based capital ratio of at least 8%, a CET1 risk based capital ratio of at least 6.5%, and a Tier 1 leverage ratio of at least 5%; (ii)(2) adequately capitalized, an insured depository institution must have a total risk based capital ratio of at least 8%, a Tier 1 risk based capital ratio of at least 6%, a CET1 risk based capital ratio of at least 4.5%, and a Tier 1 leverage ratio of at least 4%; (iii)(3) undercapitalized, an insured depository institution would have a total risk based capital ratio of less than 8%, a Tier 1 risk based capital ratio of less than 6%, a CET1 risk based capital ratio of less than 4.5%, and a Tier 1 leverage ratio of less than 4%; (iv)(4) significantly undercapitalized, an insured depository institution would have a total risk based capital ratio of less than 6%, a Tier 1 risk based capital ratio of less than 4%, a CET1 risk based capital ratio of less than 3%, and a Tier 1 leverage ratio of less than 3%.; (v)(5) critically undercapitalized, an insured depository institution would have a ratio of tangible equity to total assets that is less than or equal to 2%. At December 31, 2019,2022, the Bank qualified as “well-capitalized” under applicable regulatory capital standards.

Bank holding companies and insured depository institutions may also be subject to potential enforcement actions of varying levels of severity by the federal banking agencies for unsafe or unsound practices in conducting their business or for violation of any law, rule, regulation, condition imposed in writing by the agency or term of a written agreement with the agency. In more serious cases, enforcement actions may include the issuance of directives to increase capital; the issuance of formal and informal agreements; the imposition of civil monetary penalties; the issuance of a cease and desist order that can be judicially enforced; the issuance of removal and prohibition orders against officers, directors and other institution−affiliated parties; the termination of the insured depository institution’s deposit insurance; the appointment of a conservator or receiver for the insured depository institution; and the enforcement of such actions through injunctions or restraining orders based upon a judicial determination that the FDIC, as receiver, would be harmed if such equitable relief was not granted.

Section 619 of the Dodd-Frank Act, commonly known as the Volcker Rule, restricts the ability of banking entities from: (i)(1) engaging in “proprietary trading” and (ii)(2) investing in or sponsoring certain covered funds, subject to certain limited exceptions. Under the EGRRCPA,Economic Growth, Regulatory Reform and Consumer Protection Act (“EGRRCPA”), depository institutions and their holding companies with less than $10 billion in assets, like us, are excluded from the prohibitions of the Volcker Rule. Accordingly,During 2020, the Company crossed the $10 billion threshold, accordingly, we are no longer subject to the Volcker Rule, although if we grow to have more than $10 billion in assets, we will become subject to the Volcker Rule again. Given the Company’s size and the scope of its activities, the implementation of the Volcker Rule did not have a significant effect on its consolidated financial statements, and we expect this will remain true if the Company becomes subject to the Volcker Rule again in the future.

The FDIA provides that, in the event of the “liquidation or other resolution” of an insured depository institution, the claims of depositors of the institution, including the claims of the FDIC as subrogee of insured depositors and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution. If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors, including the parent bank holding company, with respect to any extensions of credit they have made to such insured depository institution.

The Dodd-Frank Act centralized responsibility for consumer financial protection by creating the CFPB, an independent agency charged with responsibility for implementing, enforcing and examining compliance with federal consumer financial laws. The CFPB has examination authority over all banks and savings institutions with more thanCompany grew its asset base in excess of $10 billion in assets. As the2020. The Company is below this threshold,now subject to the OCC continues to exercise primaryCFPB’s examination authority over the Bank with regard to compliance with federal consumer financial laws and regulations.regulations, in addition to the OCC as the primary regulatory of the Bank. Under the Dodd-Frank Act, state attorneys general are empowered to enforce rules issued by the CFPB.

The Company is subject to federal consumer financial statutes and the regulations promulgated thereunder including, but not limited to:

The Bank’s failure to comply with any of the consumer financial laws can result in civil actions, regulatory enforcement action by the federal banking agencies and the U.S. Department of Justice.

The Bank Secrecy Act (“BSA”), as amended by the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA PATRIOT Act”), imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. Financial institutions also are required to respond to requests for information from federal banking agencies and law enforcement agencies. Information sharing among financial institutions for the above purposes is encouraged by an exemption granted to complying financial institutions from the privacy provisions of the GLBA and other privacy laws. Financial institutions that hold correspondent accounts for foreign banks or provide private banking services to foreign individuals are required to take measures to avoid dealing with certain foreign individuals or entities, including foreign banks with profiles that raise money laundering concerns and are prohibited from dealing with foreign “shell banks” and persons from jurisdictions of particular concern. The primary federal banking agencies and the Secretary of the Treasury have adopted regulations to implement several of these provisions. Beginning onSince May 11, 2018, the Bank ishas been required to comply with the Customer Due Diligence Rule, which clarified and strengthened the existing obligations for identifying new and existing customers and explicitly included risk-based procedures for conducting ongoing customer due diligence. All financial institutions also are required to establish internal anti-money laundering programs. The effectiveness of a financial institution in combating money laundering activities is a factor to be considered in any application submitted by the financial institution under the Bank Merger Act. The Company has a Bank Secrecy ActBSA and USA PATRIOT Act board-approved compliance program commensurate with its risk profile.

The Fair Credit Reporting Act’s (“FCRA”)FCRA’s Red Flags Rule requires financial institutions with covered accounts (e.g., consumer bank accounts and loans) to develop, implement and administer an identity theft prevention program. This program must include reasonable policies and procedures to detect suspicious patterns or practices that indicate the possibility of identity theft, such as inconsistencies in personal information or changes in account activity.

The United States government has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others. These are typically known as the “OFAC” rules based on their administration by the U.S. Treasury Department Office of Foreign Assets Control (“OFAC”). The OFAC-administered sanctions targeting countries take many different forms. Generally, they contain one or more of the following elements: (i)(1) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments in or providing investment-related advice or assistance to a sanctioned country; and (ii)(2) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal and reputational consequences.

The Company and the Bank are subject to federal laws, including the GLBA and certain state laws containing consumer privacy protection provisions. These provisions limit the ability of banks and other financial institutions to disclose nonpublic information about consumers to affiliated and non-affiliated third parties and limit the reuse of certain consumer information received from nonaffiliated financial institutions. These provisions require notice of privacy policies to clients and, in some circumstances, allow consumers to prevent disclosure of certain nonpublic personal information to affiliates or non-affiliated third parties by means of “opt out” or “opt in” authorizations.

The GLBA requires that financial institutions implement comprehensive written information security programs that include administrative, technical and physical safeguards to protect consumer information. Further, pursuant to interpretive guidance issued under the GLBA and certain state laws, financial institutions are required to notify clients of security breaches resulting in unauthorized access to their personal information. The Bank believes it is in compliance withfollows all GLBA obligations.

The Bank is also subject to data security standards, privacy and data breach notice requirements, primarily those issued by the OCC. The federal banking agencies, through the Federal Financial Institutions Examination Council, have adopted guidelines to encourage financial institutions to address cyber security risks and identify, assess and mitigate these risks, both internally and at critical third party services providers.

The Bank has a responsibility under the CRA, as implemented by OCC regulations, to help meet the credit needs of the communities it serves, including low- and moderate-income neighborhoods. The CRA does not establish specific lending requirements or programs for financial institutions nor does it limit an institution’s discretion to develop the types of products and services that it believes are best suited to its particular community, consistent with the CRA. Regulators periodically assess the Bank’s record of compliance with the CRA. The Bank’s failure to comply with the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s latestmost current CRA rating was “Satisfactory.”

Congress, state legislatures and financial regulatory agencies may introduce various legislative and regulatory initiatives that could affect the financial services industry, generally. Such initiatives may include proposals to expand or contract the powers of bank holding companies and/or depository institutions or proposals to substantially change the financial institution regulatory system. Such legislation could change banking statutes and the operating environment of the Company in substantial and unpredictable ways. If enacted, such legislation could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among banks, savings associations, credit unions and other financial institutions. The Company cannot predict whether any such legislation will be enacted, and, if enacted, the effect that it or any implementing regulations would have on the financial condition or results of operations of the Company. A change in statutes, regulations or regulatory policies applicable to the Company or any of its subsidiaries could have a material effect on the business of the Company.

At December 31, 2019,2022, the Company had 1,7881,861 full-time equivalent employees. The Company’s employees are not presently represented by any collective bargaining group.

The Company’s website is http://www.nbtbancorp.com. The Company makes available free of charge through its website its Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and any amendments to those reports as soon as reasonably practicable after such material is electronically filed with or furnished to the SEC pursuant to Section 13(a) or 15(d) of the Exchange Act. We also make available through our website other reports filed with or furnished to the SEC under the Exchange Act, including our proxy statements and reports filed by officers and directors under Section 16(a) of that Act, as well as our Code of Business Conduct and Ethics and other codes/committee charters. The references to our website do not constitute incorporation by reference of the information contained in the website and such information should not be considered part of this document.

This Annual Report on Form 10-K and other reports filed with the SEC are available on the SEC’s website, which contains reports, proxy and information statements and other information regarding issuers that file electronically with the SEC. The SEC’s website address is www.sec.gov.