UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

For the fiscal year endedDecember 31 2017      , 2023

OR

For the transition period from to

Commission file number000-26481

FINANCIAL INSTITUTIONS, INC.

Financial Institutions, Inc.

(Exact name of registrant as specified in its charter)

Registrant’s telephone number, including area code: (585)(585) 786-1100

Securities registered under Section 12(b) of the Exchange Act:

Securities registered under Section 12(g) of the Exchange Act: NONE

Indicate by check mark if the regsitrantregistrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☐ No ☑

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☑

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the pastpreceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☑ No ☐

Indicate by check mark whether the registrant has submitted electronically and posted on its corporate Web site, if any, every Interactive Data File required to be submitted and posted pursuant to Rule 405 ofRegulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files). Yes ☑ No ☐

Indicate by check mark if disclosure of delinquent filers pursuant to Item 405 of RegulationS-K (§ 229.405 of this chapter) is not contained herein, and will not be contained, to the best of the registrant’s knowledge, in definitive proxy or information statements

incorporated by reference in Part III of this form10-K or any amendment to this Form10-K.    ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, anon-accelerated filer, or a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company” and “emerging growth compant”company” in Rule12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☑

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule12b-2 of the Exchange Act). Yes ☐ No ☑

The aggregate market value of the registrant’s common stock, par value $0.01 per share, held bynon-affiliates of the registrant, as computed by reference to the June 30, 20172023 closing price reported by NASDAQ,Nasdaq, was approximately $427,573,000.$235,968,000.

As of February 23, 2018,28, 2024, there were outstanding, exclusive of treasury shares, 15,904,40315,408,580 shares of the registrant’s common stock.

DOCUMENTS INCORPORATED BY REFERENCE

TABLE OF CONTENTS

PART I

FORWARD LOOKING INFORMATION

Statements and financial analysis contained in this Annual Report on Form10-K that are based on other than historical data are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. Forward-looking statements provide current expectations or forecasts of future events and include, among others:

These forward-looking statements are not guarantees of future performance, nor should they be relied upon as representing management’s views as of any subsequent date. Forward-looking statements involve significant risks and uncertainties, and actual results may differ materially from those presented, either expressed or implied, in this Annual Report on Form10-K, including, but not limited to, those presented in the Management’s Discussion and Analysis of Financial Condition and Results of Operations. Factors that might cause such material differences include, but are not limited to:

We caution readers not to place undue reliance on any forward-looking statements, which speak only as of the date made, and advise readers that various factors, including those described above, could affect our financial performance and could cause our actual results or circumstances for future periods to differ materially from those anticipated or projected. See also Item 1A, Risk Factors, of this Annual Report on Form10-K for further information. Except as required by law, we do not undertake, and specifically disclaim any obligation to publicly release any revisions to any forward-looking statements to reflect the occurrence of anticipated or unanticipated events or circumstances after the date of such statements.

ITEM 1. BUSINESS

GENERAL

GENERAL

The Parent is a financial holding company organized in 1931 under the laws of New York State (“New York” or “NYS”). The principal office of the Parent is located at 220 Liberty Street, Warsaw, New York 14569 and its telephone number is (585)786-1100. The Parent was incorporated on September 15, 1931, but the continuity of the Company’s banking business is traced to the organization of the National Bank of Geneva on March 28, 1817. Except as the context otherwise requires, the Parent and its direct and indirect subsidiaries are collectively referred to in this report as the “Company.” The Parent’s common stock is traded on the Nasdaq Global Select Market under the ticker symbol “FISI.” Five Star Bank is referred to as “Five Star Bank,” “FSB” or “the Bank,” Scott Danahy Naylon,SDN Insurance Agency, LLC is referred to as “SDN”“SDN,” and Courier Capital, LLC is referred to as “Courier Capital.” The consolidated financial statements include the accounts of the Parent, the Bank, SDN and Courier Capital. The Parent’s common stock is traded on the NASDAQ Global Select Market under the ticker symbol “FISI.”

At December 31, 2017,2023, the Company had consolidated total assets of $4.11$6.16 billion, deposits of $3.21$5.21 billion and shareholders’ equity of $381.2$454.8 million.

The Parent’s primary business is the operation of its subsidiaries. It does not engage in any other substantial business activities. The Parent’s three direct wholly-owned subsidiaries are: (1) the Bank, which provides a full range of banking services to consumer, commercial and municipal customers in Western and Central New York;York, commercial loans in the Mid-Atlantic and Central New York regions, and Banking-as-a-Service (“BaaS”) capabilities to non-bank service providers and other financial technology firms (“FinTechs”); (2) SDN, which sells various premium-based insurance policies on a commission basis to commercial and consumer customers; and (3) Courier Capital, which provides customized investment management, investment consulting and retirement plan services to individuals, businesses, institutions, foundations and retirement plans. At December 31, 2017,2023, the Bank represented 99.1%99.3%, SDN represented 0.5%0.3%, and Courier Capital represented 0.3%, respectively, of the consolidated assets of the Company. Further discussion of our segments is included in Note 21 to the Company’s Consolidated Financial Statements included under Item 8 of this Annual Report on Form10-K.

Five Star Bank

The Bank is a New York charteredYork-chartered bank that has its headquarters at 55 North Main Street, Warsaw, NY, and a total of 5348 full-service banking offices in the New York State counties of Allegany, Cattaraugus, Cayuga, Chautauqua, Chemung, Erie, Genesee, Livingston, Monroe, Ontario, Orleans, Seneca, Steuben, Wyoming and Yates, counties.and commercial loan production offices in Baltimore, Maryland and Syracuse, New York serving the Mid-Atlantic and Central New York regions, respectively.

At December 31, 2017,2023, the Bank had total assets of $4.07$6.12 billion, investment securities of $1.04 billion, net loans of $2.70$4.41 billion, deposits of $3.22$5.23 billion and shareholders’ equity of $382.5 million, compared to total assets of $3.68 billion, investment securities of $1.08 billion, net loans of $2.31 billion, deposits of $3.01 billion and shareholders’ equity of $318.5 million at December��31, 2016.$485.0 million. The Bank offers deposit products, which include checking and NOW accounts, savings accounts, and certificates of deposit, as its principal source of funding. The Bank’s deposits are insured up to the maximum permitted by the BankDeposit Insurance Fund (the “Insurance Fund”“DIF”) of the Federal Deposit Insurance Corporation (“FDIC”). The Bank offers a variety of loan products to its customers, including commercial and consumer loans and commercial and residential mortgage loans.

Scott Danahy Naylon,SDN Insurance Agency, LLC

Acquired in August 2014, SDN is a full-service insurance agency founded in 1923 and headquartered in Amherst, NY. SDN offers personal, commercial and financial services products and serves clients in 45 states.products. For the year ended December 31, 2017,2023, SDN had total revenue of $5.1 million, compared to total revenue of $5.2 million for the year ended December 31, 2016.

- 4 -

SDN’s primary market area is Erie and Niagara counties in New York State. Most lines of personal insurance are provided, including automobile, homeowners, boat, recreational vehicle, landlord and umbrella coverage. Commercial insurance products are also provided, consisting of property, liability, automobile, inland marine, workers compensation, bonds, crop and umbrella insurance. SDN also provides the following financial services products: life and disability insurance, Medicare supplements, long-term care, annuities, mutual funds, retirement programs and New York State disability.

Courier Capital, LLC

Acquired in January 2016, Courier Capital is anSEC-registered investment advisory and wealth management firm founded in 1967 and basedheadquartered in Western New York, with offices in Buffalo, AmherstRochester and Jamestown.Jamestown, New York, and Pittsburgh, Pennsylvania. With $1.69$2.88 billion in assets under management as of December 31, 2023, Courier Capital offers customized investment advice, wealth management, investment consulting and retirement plan services to individuals, businesses and institutions across nine states.institutions. For the year ended December 31, 2017,2023, Courier Capital had total revenue of $4.1 million, compared to total revenue$10.1 million.

On May 1, 2023, the Company completed the merger of $3.4 million for the period from date of acquisition through December 31, 2016.its wholly-owned SEC-registered investments advisory firms, in which HNP Capital, LLC merged with and into Courier Capital.

In August 2017, Courier Capital acquired the assets of Robshaw & Julian Associates, Inc., a Buffalo-area registered investment adviser with approximately $175 million assets under management, which increased Courier Capital’s total assets under management to approximately $1.6 billion.

Other Subsidiaries

Five Star REIT, Inc.

Five Star REIT, Inc. (“Five Star REIT”), a wholly-owned subsidiary of the Bank, operates as a real estate investment trust that holds residential mortgages and commercial real estate loans. Five Star REIT provides additional flexibility and planning opportunities for the business of the Bank.

Business Strategy

Our business strategy has been to maintain a community bank philosophy, which consists of focusing on and understanding the individualized banking and other financial services needs of individuals, municipalities and businesses of the local communities surrounding our primary service area. We believe this focus allows us to be more responsive to our customers’ needs and provide a high level of personal service that differentiates us from larger competitors, resulting in long-standing and broad-based banking relationships. Our core customers are primarily small- tomedium-sized businesses, individuals and community organizations who prefer to build banking, insurance and wealth management relationships with a community bank that offers and combines high quality,high-quality, competitively-priced products and services with personalized service. Because of our identity and origin as a locally operated bank, we believe that our level of personal service provides a competitive advantage over larger banks, which tend to consolidate decision-making authority outside local communities.

A key aspect of our current business strategy is to foster a community-orientedcommunity–oriented culture where our customers and employees establish long-standing and mutually beneficial relationships. We believe that we are well-positioned to be a strong competitor within our market area because of our focus on community banking needs and customer service, our comprehensive suite of deposit, loan, insurance and wealth management products and services typically found at larger banks, our highly experienced management team and our strategically located banking centers.

We prioritize customer acquisition through cost-effective, high-demand digital, virtual and physical channels, while maintaining a community bank distinctiveness relative to larger banks and digital-only neobanks. We leverage the retail branch network and customer contact center to build trust and credibility, provide personal financial education and advice, offer convenience, and bridge digital and physical channels. Our enhanced digital capabilities complement a continued focus on a consistent customer experience and engagement across physical and virtual channels, including using branches to create deeper engagement and relationships with customers, balancing customer engagement with efficiency opportunities (e.g., framing outreach to the customer contact center to teach customers how to use digital channels, in addition to addressing the reason for the call), and maintaining and expanding our customer reach digitally, physically or virtually. By employing digital channels across our current products and services, we deepen existing relationships and enter new geographies or market segments that would otherwise be prohibitively expensive targets using traditional approaches. Deepening our existing digital capabilities allows us to capitalize on a shift in customer preferences away from physical branches, while launching opportunities with non-bank entities through BaaS.

We have evolved to meet changing customer needs by opening what we refer to as financial solution center branches. These financial solution centers have a smaller footprint than our traditional branches,offering complementary physical, digital and virtual channels. We focus on technology to provide solutions that fit our customer preferences for transacting business with us, and these branchesus. Branches are staffed by certified personal bankers who are trained to meet a broad array of customer needs. In recent years,Our digital banking capabilities, interactive teller machine (“ITM”) functionality and Customer Contact Center provide additional self-serve and phone options through which customer needs are met effectively.

Our BaaS business offers banking capabilities to non-bank financial service providers and other FinTechs, allowing them to provide banking services to their end users. With the help of the Bank’s partners, we have opened fourcan offer banking services and products beyond our traditional footprint, creating new fee-based revenue opportunities through service, interchange and other fees, coupled with cost effective deposit gathering opportunities. We are primarily focused on five key BaaS client types where we see strong opportunity: business-to-business, where we help FinTechs innovate solutions while creating new market opportunities and efficiencies; affinity groups, where we help empower traditionally under-banked communities with expanded financial solution centersservices access; sustainable finance, where we meet customer-led environmental demands by partnering with early movers in the Rochestergreen banking space; cannabis-related businesses, where we can tap into the multi-billion dollar cannabis market by leveraging regulatory and Buffalo markets. We believe that the foregoing factors all helprisk experience for sustained operations; and wealth management, which enables wealth managers to grow our core deposits, which supports a central element of our business strategy - the growth of a diversified and high-quality loan portfolio.meet accelerating client demand for banking services.

Acquisition Strategy

We will continue to explore market expansion opportunities in or near ourthat complement current market areas as opportunities arise. Our primary focus will be on increasing the Bank’s market share within existing markets, while taking advantage of potential growth opportunities within our insurance and wealth managementnon-interest income lines of business by acquiring new businesses that can be added toincorporated into existing operations. We believe our capital position remains strong enough to support an active merger and acquisition strategy and the expansion of our core financial service businesses of banking, insurance and wealth management.businesses. Consequently, we continue to explore acquisition opportunities in these activities. InWhen evaluating acquisition opportunities, we will balance the potential for earnings accretion with maintaining adequate capital levels, which could result in our common stock being the predominatepredominant form of consideration and/or the need for us to raise capital.

- 5 -

Conversations with potential strategic partners occur on a regular basis. The evaluation of any potential opportunity will favor a transaction that complements our core competencies and strategic intent, with a lesser emphasis being placed on geographic location or size. Additionally, we remain committed to maintaining a diversified revenue stream. Our senior management team has had extensive experience in acquisitions and post-acquisition integration of operations and is prepared to act quicklypromptly should a potential opportunity arise but will remain disciplined with its approach. We believe this experience positions us to successfully acquire and integrate additional financial services and banking businesses.

HUMAN CAPITAL RESOURCES STRATEGY

In order to continue to deliver on our mission of financial inclusion for all, it is crucial that we attract and retain talent who desire to enable financial equality through delivery of capable solutions, thoughtful innovation and equitable consumer options in the markets that we serve. To facilitate talent attraction and retention, we strive to make the Company an inclusive, safe and healthy workplace, with opportunities for our employees to grow and develop in their careers, supported by strong compensation, benefits, health and welfare programs.

Employee Profile

As of December 31, 2023, we had 624 employees situated across the United States (the “U.S.”). This represents a decrease of 48 employees, or 7%, from December 31, 2022.

As of December 31, 2023, approximately 64% of our current workforce is female, 36% male, and our average tenure is 6.83 years, an increase of 19% from an average tenure of 5.74 years as of December 31, 2022.

Total Rewards

As part of our compensation philosophy, we believe that we must offer and maintain market competitive total rewards programs for our employees in order to attract and retain superior talent. In addition to market competitive base wages, our rewards programs include performance-based bonus opportunities, equity compensation, Company-sponsored retirement plans, healthcare and insurance benefits, health savings and flexible spending accounts, paid time off, family leave, family care resources, remote work arrangements, flexible work schedules, adoption assistance, and employee assistance programs.

Health and Safety

The success of our business is fundamentally connected to the well-being of our people. Accordingly, we are committed to the health, safety and wellness of our employees. We provide our employees and their families with access to a variety of flexible and convenient health and welfare programs, including benefits that support their physical and mental health by providing tools and resources to help them improve or maintain their health status and that offer choice where possible so they can customize their benefits to meet their needs and the needs of their families.

Talent

A core tenet of our talent system is to both develop talent from within and supplement with external hires. This approach has yielded loyalty and commitment among our employees which in turn grows our business, our products, and our customers, while also adding new talent, skill sets and ideas to support a continuous improvement mindset and our goals of a diverse and inclusive workforce.

We conduct intentional, strategic hiring to supplement the organization with new skill sets and perspectives. Our talent acquisition team uses internal and external resources to recruit highly skilled and talented workers, and, additionally, we incent employee referrals for open positions.

Our performance management framework positions our leaders as coaches who continuously develop and grow talent through ongoing performance and development discussions, formal talent and development assessments, goal setting and feedback and performance-based compensation programs.

Diversity and Inclusion

We strive toward having a powerful and diverse team of employees, knowing we are better together with our combined wisdom and intellect. With a commitment to equality, inclusion and workplace diversity, we focus on understanding, accepting, and valuing the differences between people. To accomplish this, we established a Diversity, Equity and Inclusion Council (formerly the Diversity & Inclusion Advisory Council) in 2020 that is currently made up of 15 employee representatives throughout our operating footprint. The Council meets regularly to provide feedback and ideas that guide our Diversity, Equity and Inclusion (“DEI”) strategy. We established a series of DEI-focused training to raise awareness of unconscious bias and equip leaders to build inclusive team experiences. We continue our commitment to equal employment opportunity through a comprehensive action plan which includes annual compensation analyses and ongoing reviews of our selection and hiring practices alongside a continued focus on building and maintaining a diverse workforce.

MARKET AREAS AND COMPETITION

We provide a wide range of banking and financial services to individuals, municipalities and businesses through a network of over 50more than 48 offices and an extensive ATM network throughout Western and Central New York. The region includes the counties of Allegany, Cattaraugus, Cayuga, Chautauqua, Chemung, Erie, Genesee, Livingston, Monroe, Ontario, Orleans, Schuyler, Seneca, Steuben, Wayne, Wyoming and Yates counties.Yates. Our banking activities, though concentrated in the communities where we maintain branches, also extend into neighboring counties. In addition, we have expandedDuring 2023, our consumer indirect lending presence toincluded the Capital District of New York and Northern and Central Pennsylvania.Pennsylvania, and we have commercial loan production offices in Baltimore, Maryland and Syracuse, New York, serving the Mid-Atlantic and Central New York regions, respectively. Effective January 1, 2024, we exited the Pennsylvania automobile market in order to align our focus more fully around our core Upstate New York market.

Our market area is economically diversified in that we serve both rural markets and the larger markets in and around Rochester and Buffalo.Buffalo, New York. Rochester and Buffalo are the two largest metropolitan areas in New York outside of New York City, with a combined population of over two million people. We anticipate continuing to increase our presence in and around these metropolitan statistical areas and complementary market areas in the coming years.

We face significant competition in both making loans and attracting deposits, as Western and Central New York have a high density of financial institutions. Our competition for loans comes principally from commercial banks, savings banks, savings and loan associations, mortgage banking companies, credit unions, insurance companies and other financial services companies. Our most direct competition for deposits has historically come from commercial banks, savings banks and credit unions. We face additional competition for deposits from non-traditional FinTech firms and non-depository competitors such as the mutual fund industry, securities and brokerage firms and insurance companies. We generally compete with other financial service providers on factors such as level of customer service, responsiveness to customer needs, availability and pricing of products, and geographic location. Our industry frequently experiences merger activity, which affects competition by eliminating some institutions while potentially strengthening the franchises of others.

The following table presents the Bank’s market share percentage for total deposits as of June 30, 2017,2023, in each county where we have operations.operations in New York. The table also indicates the ranking by deposit size in each market. All information in the table was obtained from S&P Global Market Intelligence, which compiles deposit data published by the FDIC as of June 30, 20172023 and updates the information for any bank mergers and acquisitions completed subsequent to the reporting date.

In addition, we are pursuing revenue diversification through BaaS and digital banking as new standalone lines of business. We compete with other banks and FinTech companies in these lines of business on a national level.

INVESTMENT ACTIVITIES

Our investment policy is contained within our overall Asset-Liability Management and Investment Policy. This policy dictates that investment decisions will be made based on the safety of the investment, liquidity requirements, potential returns, cash flow targets, need for collateral and desired risk parameters. In pursuing these objectives, we consider the ability of an investment to provide earnings consistent with factors related to quality, maturity, marketability, pledgeable naturepledgeability and risk diversification. Our Chief Financial Officer and Treasurer, guided by our Asset-LiabilityAsset–Liability Committee (“ALCO”), is responsible for investment portfolio decisions within the established policies.

- 6 -

Our investment securities strategy is focused on providing liquidity to meet loan demand and redeeming liabilities, meeting pledging requirements, managing credit risks, managing overall interest rate risks and maximizing portfolio yield. Our current policy generally limits security purchases to the following:

LENDING ACTIVITIES

General

We offer a broad range of loans including commercial business and revolving lines of credit, commercial mortgages, equipment loans, residential mortgage loans and home equity loans and lines of credit, home improvement loans, automobile loans and personal loans. Newly originated and refinanced fixed rate residential mortgage loans are either retained in our portfolio or sold to the secondary market with servicing rights retained.

We continually evaluate and update our lending policy. The key elements of our lending philosophy include the following:

Commercial Business and Commercial Mortgage Lending

We primarily originate commercial business loans in our market areas and underwrite them based on the borrower’s ability to service the loan from operating income. We offer a broad range of commercial lending products, including term loans and lines of credit. ShortShort- and medium-term commercial loans, primarily collateralized, are made available to businesses for working capital (including inventory and receivables), business expansion (including acquisition of real estate, expansion and improvements) and the purchase of equipment. We offer commercial business loans to customers in the agricultural industry for short-term crop production, farm equipment and livestock financing. As a general practice, where possible, a first position collateral lien is placed on any available real estate, equipment or other assets owned by the borrower and a personal guarantee of the owner is obtained. As of December 31, 2017, $122.42023, our commercial business loan portfolio totaled $735.7 million, or 27%16% of our total loan portfolio. As of December 31, 2023, $171.7 million, or 23%, of our aggregate commercial business loan portfolio were at fixed interest rates, while $327.9$564.0 million, or 73%77%, were at variable interest rates.

We also offer commercial mortgage loans to finance the purchase of real property, which generally consists of real estate with completed structures and, to a smaller extent, agricultural real estate financing. Commercialstructures. The majority of our commercial mortgage loans are secured by first liens on the real estate and are typically amortized over a 1010- to 20 year20-year period. The underwriting analysis includes credit verification, appraisals and a review of the borrower’s financial condition and repayment capacity. As of December 31, 2017, $348.72023, our commercial mortgage loan portfolio totaled $2.01 billion, or 44.9% of our total loan portfolio. As of December 31, 2023, $914.1 million, or 43%46%, of the loans in our aggregate commercial mortgage portfolio were at fixed interest rates, while $460.2 million,$1.09 billion, or 57%54%, were at variable interest rates.

Commercial loans include both owner-occupied and non-owner occupied commercial real estate loans.

We utilize government loan guarantee programs wherewhen available and appropriate.

- 7 -

Government Guarantee Programs

We participate in government loan guarantee programs offered by the SBA, U.S. Department of Agriculture, Rural Economic and Community Development and Farm Service Agency, among others. As of December 31, 2017,2023, we had loans with an aggregate principal balance of $47.8$25.0 million that were covered by guarantees under these programs. The guarantees typically cover only cover a certain percentage of these loans. By participating in these programs, we are able to broaden our base of borrowers while minimizingreducing credit risk.

Residential Real Estate Lending

We originate fixed and variable rateone-to-four family residential mortgages collateralized by owner-occupied properties located in our market areas. We offer a variety of real estate loan products, including home improvement loans,closed-end home equity loans, and home equity lines of credit, which are generally amortized over periods of up to 30 years. Loans collateralized byone-to-four family residential real estate generally have been originated in amounts of no more than 80% of appraised value or have mortgage insurance. Mortgage title insurance and hazard insurance are normally required. As of December 31, 2023, our residential real estate loan portfolio totaled $649.8 million, or 15% of our total loan portfolio. As of December 31, 2023, our residential real estate lines portfolio totaled $77.4 million, or 2% of our total loan portfolio. As of December 31, 2023, $511.3 million, or 79%, of the loans in our residential real estate loan portfolio were at fixed interest rates, while $138.5 million, or 21%, were at variable interest rates. The residential real estate lines portfolio primarily consists of variable rate lines. Approximately 92% of the loans and lines in our residential real estate portfolios were in first lien positions at December 31, 2023. We do not engage in sub-prime or other high-risk residential mortgage lending as a line of business.

We sell certainone-to-four family residential mortgages to the secondary mortgage market and typically retain the right to service the mortgages. To assure maximum salability of the residential loan products for possible resale, weWe typically follow the underwriting and appraisal guidelines of the secondary market, including the FHLMC and the Federal Housing Administration, and service the loans in a manner that satisfies the secondary market agreements. As of December 31, 2017,2023, our residential mortgage servicing portfolio totaled $163.3$269.4 million, the majority of which has been sold to the FHLMC. As of December 31, 2017, our residential real estate loan portfolio totaled $465.3 million, or 17% of our total loan portfolio. As of December 31, 2017, our residential real estate lines portfolio totaled $116.3 million, or 4% of our total loan portfolio. As of December 31, 2017, $417.4 million, or 90%, of the loans in our residential real estate loan portfolio were at fixed rates, while $47.9 million, or 10%, were at variable rates. The residential real estate lines portfolio primarily consists of variable rate lines. Approximately 88% of the loans and lines in our residential real estate portfolios were in first lien positions at December 31, 2017. We do not engage insub-prime or other high-risk residential mortgage lending as aline-of-business.

Consumer Lending

We offer a variety of loan products to our consumer customers, including automobile loans, secured installment loans and other types of secured and unsecured personal loans. AtAs of December 31, 2017, outstanding2023, our consumer indirect portfolio totaled $948.8 million, or 21% of our total loan portfolio. Outstanding consumer loan balances were concentrated in indirect automobile loans.

We originate indirect consumer loans for a mix of new and used vehicles predominately through franchised new car dealers. The consumer indirect loan portfolio is primarily comprised of loans with terms that typically range from 36 to 36–84 months. We have developed relationships with franchised new car dealers in Western, Central and the Capital District of New York, and Northern and Central Pennsylvania. As of December 31, 2017, our consumer indirect portfolio totaled $876.6 million, or 32% of our total loan portfolio. The consumer indirect loan portfolio primarily consists of fixed rate loans with relatively short durations. Effective January 1, 2024, we exited the Pennsylvania automobile market in order to align our focus more fully around our core Upstate New York market.

Through our BaaS line of business, we originate secured consumer residential solar loans. The terms of these loans typically range from 7–25 years. As of December 31, 2023, the residential solar loan portfolio approximated $30.0 million, all of which were fixed interest rate loans.

We also originate, independently of the indirect and BaaS loans described above, consumer automobile loans, recreational vehicle loans, boat loans, personal loans (collateralized and uncollateralized) and deposit account collateralized loans. The terms of these loans typically range from 12 to 12–60 months and vary based upon the nature of the collateral and the size of loan. The majorityA portion of the consumer lending program is underwritten on a secured basis using the customer’s financed automobile, mobile home, boat or recreational vehicle as collateral. The other loans in our consumer portfolio totaled $17.6$14.6 million as of December 31, 2017,2023, all but $753 thousand of which were fixed interest rate loans.

Credit Administration

Our loan policy establishes standardized underwriting guidelines, as well as the loan approval process and the committee structures necessary to facilitate and ensure the highest possible loan quality decision-making in a timely and businesslike manner. The policy establishes requirements for extending credit based on the size, risk rating and type of credit involved. The policy also sets limits on individual lending authority and various forms of joint lending authority, while designating which loans are required to be approved at the committee level.

Our credit objectives are to:

- 8 -

Our policy includes loan reviews, under the supervision of ourthe Audit and Risk Oversight committees of theour Board of Directors and directed by our Chief Risk Officer, in order to render an independent and objective evaluation of our asset quality and credit administration process.

We assign risk ratings to loans in the commercial business and commercial mortgage portfolios. We use those risk ratings to:

Through the loan approval process, loan administration and loan review program, management seeks to continuously monitor our credit risk profile and assess the overall quality of the loan portfolio and adequacy of the allowance for loancredit losses.

We have several procedures in place to assist in maintaining the overall quality of our loan portfolio. Delinquent loan reports are monitored by credit administration to identify adverse levels and trends. Loans, including impaired loans individually evaluated for impairment, are generally classified asnon-accruing if they are past due as to maturity or payment of principal or interest for a period of more than 90 days, unless such loans are well-collateralized and in the process of collection. Loans that are on a current payment status or past due less than 90 days may also be classified asnon-accruing if repayment in full of principal and/or interest is uncertain.

Allowance for LoanCredit Losses

The allowance for loancredit losses is established through charges to earnings in the form of a provision for loancredit losses. The allowance reflects management’s estimate of the amount of probable loancredit losses in the portfolio, based on factors including, but not limited to:

Our methodology for estimating the allowance for loancredit losses includes the following:

- 9 -

Management presents a quarterly review of the adequacy of the allowance for loancredit losses to the Audit Committee of our Board of Directors based on the methodology described above. See also the section titled “Allowance for LoanCredit Losses” in Part II, Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations” of this Annual Report on Form10-K.

SOURCES OF FUNDS

Our primary sources of funds are deposits and borrowed funds.

Deposits

We maintain a full range of deposit products and accounts to meet the needs of the residents and businesses in our primary service area. Products include an array of checking and savings account programs for individuals, municipalities, and businesses, including money market accounts, certificates of deposit, sweep investment capabilities as well as Individual Retirement Accounts and other qualified plan accounts. We rely primarily on competitive pricing of our deposit products, customer service and long-standing relationships with customers to attract and retain these deposits and seek to make our services convenient to the community by offering a choice of several delivery systems and channels, including telephone, mail, online, automated teller machines (ATMs)(“ATMs”), debit cards,point-of-sale transactions, automated clearing house transactions (ACH)(“ACH”), ITM’s, remote deposit, and mobile banking via telephone or wireless devices. We also take advantage of the use of technology by offering business customers banking access via the Internet and various advanced cash management systems. We provide BaaS products to third parties, including non-maturity deposits that have been received through this delivery channel.

We had no traditional brokered deposits at December 31, 2017; however, we doalso participate in the Certificate of Deposit Account Registry Service (“CDARS”) and Insured Cash Sweep (“ICS”)reciprocal deposit programs, which enable depositors to receive FDIC insurance coverage for deposits otherwise exceeding the maximum insurable amount. Through these programs, deposits in excess of the maximum insurable amount are placed with multiple participating financial institutions. Reciprocal CDARS deposits and ICS deposits totaled $159.2$817.6 million and $147.3 million, respectively, at December 31, 2017.2023.

Borrowings

We have access to a variety of borrowing sources and use both short-term and long-term borrowings to support our asset base. Borrowings fromtime-to-time include federal funds purchased, securities sold under agreements to repurchase, brokered deposits, FHLB advances, the Federal Reserve Bank (“FRB”) Bank Term Funding Program, and borrowings from the discount window of the FRB, as defined below.FRB.

Other sources of funds include scheduled amortization and prepayments of principal from loans and mortgage-backed securities, maturities and calls of investment securities and funds provided by operationsoperations.

OPERATING SEGMENTS

We have two reportable segments: Banking andNon-Banking. These reportable segments have been identified and organized based on the nature of the underlying products and services applicable to each segment, the type of customers to whom those products and services are offered and the distribution channel through which those products and services are made available.

The Banking segment includes all of the Company’s retail and commercial banking operations.    TheNon-Banking segment includes the activities of SDN, a full service insurance agency that provides a broad range of insurance services to both personal and business clients, and Courier Capital, an investment advisor and wealth management firm that provides customized investment management, investment consulting and retirement plan services to individuals, businesses, institutions, foundations and retirement plans.

For a discussion of the segments included in our principal activities and certain financial information for each segment, see Note 21, Segment Reporting, of the notes to consolidated financial statements included in this Annual Report on Form10-K.

OTHER INFORMATION

We also make available, free of charge through our website, all reports filed with or furnished to the SEC,Securities and Exchange Commission (“SEC”), including our Annual Reports on Form10-K, Quarterly Reports on Form10-Q and Current Reports on Form8-K, as well as any amendments to those reports, as soon as reasonably practicable after those documents are filed with or furnished to the SEC. These filings may be viewed by accessing theSEC Filingssubsection of theFinancials section of our website (www.fiiwarsaw.comwww.FISI-investors.com). Information available on our website is not a part of, and is not incorporated into, this Annual Report on Form10-K.

- 10 -

All of the reports we file with the SEC, including this Annual Report on Form10-K, Quarterly Reports on Form10-Q and Current Reports on Form8-K, as well as any amendments thereto may be accessed atwww.sec.gov or at the public reference facility maintained by the SEC at its public reference room at 100 F. Street, N.E., Room 1580, Washington, DC 20549 and copies of all or any part thereof may be obtained from that office upon payment of the prescribed fees. You may call the SEC at1-800-SEC-0330 for further information on the operation of the public reference room and you can request copies of the documents upon payment of a duplicating fee, by writing to the SEC..

SUPERVISION AND REGULATION

We are subject to extensive regulation under federal and state laws. The regulatory framework is intended primarily for the protection of depositors, federal deposit insurance funds and the banking system as a whole and not for the protection of shareholders and creditors.

We are also subject to the disclosure and regulatory requirements of the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended, as administered by the Securities and Exchange Commission (“SEC”). Our common stock is listed on the NASDAQ Global Select Market (“NASDAQ”) under the trading symbol “FISI” and is subject to NASDAQ rules for listed companies.

Significant elementsElements of the laws and regulations applicable to the Company and the Bank and material to our operations are described below. The description is qualified in its entirety by reference to the full text of the statutes, regulations and policies that are described. Also, such statutes, regulations and policies are continually under review by Congress, state legislatures, and federal and state regulatory agencies. A change in statutes, regulations or regulatory policies applicable to the Company or the Bank could have a material effect on the business, financial condition and results of operations of the Company.

Holding Company Regulation.

We are subject to comprehensive regulation by the Board of Governors of the Federal Reserve System, frequently referred to as the Federal Reserve Board (“FRB” or “Federal Reserve”), under the Bank Holding Company Act (the “BHC Act”), as amended by, among other laws, the Gramm-Leach-Bliley Act of 1999 (the “Gramm-Leach-Bliley Act”), and by the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), enacted in 2010.. We are registered with the Federal Reserve as a bankfinancial holding company (“BHC”FHC”). We must file reports with the FRB and submit such additional information as the FRB may require, and our holding company andnon-banking affiliates are subject to examination by the FRB. Under FRB policy, a bank holding companyan FHC must serve as a source of strength for its subsidiary banks. Under this policy, the FRB may require, and has required in the past, a holding company to contribute additional capital to an undercapitalized subsidiary bank. The BHC Act provides that a bank holding companyan FHC must obtain FRB approval before:

The BHC Act generally prohibits a bank holding company from acquiring direct or indirect ownership or control of more than 5% of the voting shares of any company which is not a bank or bank holding company, or from engaging directly or indirectly in activities other than those of banking, managing or controlling banks, or providing services for its subsidiaries. The principal exceptions to these prohibitions involve certainnon-bank activities which, by statute or by FRB regulation or order, have been identified as activities closely related toHowever, the business of banking or managing or controlling banks. The list of activities permitted by the FRB includes, among other things: lending; operating a savings institution, mortgage company, finance company, credit card company or factoring company; performing certain data processing operations; providing certain investment and financial advice; underwriting and acting as an insurance agent for certain types of credit related insurance; leasing property on a full-payout,non-operating basis; selling money orders, travelers’ checks and United States Savings Bonds; real estate and personal property appraising; providing tax planning and preparation services; and, subject to certain limitations, providing securities brokerage services for customers. These activities may also be affected by federal legislation.

The Gramm-Leach-Bliley Act amended portions of the BHC Act to authorize bank holding companies,FHCs, such as us, to directly or throughnon-bank subsidiaries to engage in securities, insurance and other activities that are financial in nature or incidental to a financial activity. In order to undertake and maintain these activities, a bank holding companyan FHC must become a “financial holding company” by submitting to the appropriate Federal Reserve Bank a declarationcertify that the company elects to be a financial holding company and a certification that all of the depository institutions controlled by the company are well capitalized and well managed.

- 11 -

The Dodd-Frank Act.Act, Economic Growth Act, and Volcker Rule

The Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) significantly changed the regulation of financial institutions, and the financial services industry. The Dodd-Frank Act includes provisions affecting large and small financial institutions alike, including several provisions that will profoundly affect howsuch as community banks, thrifts, and small bank and thrift holding companies, will be regulatedand the financial services industry.

Although it was enacted in the future. Among other things, these2010, certain provisions abolished the Office of Thrift Supervision and transferred its functions to the other federal banking agencies, relaxed rules regarding interstate branching, allowed financial institutions to pay interest on business checking accounts, and imposed new capital requirements on bank and thrift holding companies. The Dodd-Frank Act also includes several corporate governance provisions that apply to all public companies, not just financial institutions. These include provisions mandating certain disclosures regarding executive compensation and provisions addressing proxy access by shareholders. We have elected to be treated as a financial holding company.

The Dodd-Frank Act contains numerous other provisions affecting financial institutions of all types, including some that may affect our business in substantial and unpredictable ways. We have incurred higher operating costs in complying with the Dodd-Frank Act have yet to be fully implemented and we expect that these higher costs will continue for the foreseeable future.may be impacted by future legislation, rulemaking or executive orders. Our management continues to monitor the ongoing implementation of the Dodd-Frank Act and, as new regulations are issued, will assess their effect on our business, financial condition and results of operations.

On February 3, 2017, President Donald J. Trump issued an executive order directing the Secretary of the Treasury to report, within 120 days, on whether current governmental rules and policies either promote or inhibit the “Core Principles for Financial Regulation” as defined in the executive order (the “Executive Order”). The Treasury Department has since issued multiple reports in response to the Executive Order, the first of which, issued on June 12, 2017, analyzed and made recommendations with respect to the U.S. banking system (the “Treasury Report”). In particular, the Treasury Report recommended several actions that would ease the requirements of the Dodd-Frank Act on community banks such as us, as described in greater detail below. While some of these actions may be implemented unilaterally by our regulators, others will require legislation in order to be put into effect.

On June 8, 2017, the U.S. House of Representatives passed the Financial CHOICE Act of 2017 (the “Financial CHOICE Act”), a bill that, if enacted into law, would repeal or modify key provisions of the Dodd-Frank Act, including elimination of the Volcker Rule, as defined below, and making the director of the CFPB, also defined below, subject to removal by the President. President Trump has indicated that he would sign the Financial CHOICE Act but the U.S. Senate has yet to take up that bill. In early MarchMay 2018, the Senate instead opened debate on the Economic Growth, Regulatory Relief and Consumer Protection Act a bill that would also impact(“Economic Growth Act”) was enacted and impacted several of the provisions of the Dodd-Frank Act and that appearsAct. The law provided certain regulatory relief to enjoy significant bipartisan support.

We cannot predict how closelycommunity banks, like us, with less than $10 billion in total consolidated assets. This relief includes an exemption from the Volcker Rule (i.e., a final bill, if any, will resemble either the one passed by the House of Representatives last year or the one currently under debate in the Senate. Similarly, it is too early for us to predict whether any other executive or congressional action will attempt to implement the recommendationsprovision of the Treasury Report as they pertain to the Dodd-Frank Act.

See Item 1A, Risk Factors, for a more extensive discussion of this topic.

The Volcker Rule.The Dodd-Frank Act which prohibits banks and their affiliates from engaging in proprietary trading and from investing and sponsoring hedge funds and private equity funds.)

Depository Institution Regulation

The statutory provision implementing these restrictionsBank is commonly calledorganized under the “Volcker Rule.” To implementlaws of the Volcker Rule, federal regulators issued final rules in December 2013 that were to become effective April 2014. Thestate of New York. It is a member of the Federal Reserve subsequently issued an order extendingSystem, and its deposits are insured under the period that institutions have to conform their activities to the requirementsDIF of the Volcker RuleFDIC up to July 21, 2015,applicable legal limits. The lending, investment, deposit-taking, and extended the compliance date for banks to conform their investments in certain “legacy covered funds” until July 21, 2016. These final rules exemptother business authority of the Bank as a bank with less than $10 billion in total consolidated assets that does not engageis governed primarily by state and federal law and regulations and the Bank is prohibited from engaging in any covered activities other than trading in certain government, agency, state or municipal obligations, from any significant compliance obligations under the Volcker Rule; therefore, the Volcker Rule willoperations not have a material effect on our business, financial conditionauthorized by such laws and results of operations. We cannot predict whether the Volcker Rule will be repealed by enactment of the Financial CHOICE Act, or modified by implementation of some or all of the relevant recommendations included in the Treasury Report.

Depository Institution Regulation.regulations. The Bank is subject to extensive regulation, supervision and examination by, and the enforcement authority of, the New York State Department of Financial Services (the “NY DFS”) and FRB, and to a lesser extent by the FDIC. FDIC, as its deposit insurer.This regulatory structure includes:

Capital Requirements

- 12 -

Capital Requirements.The Company and the Bank are each required to comply with applicable capital adequacy standards established by the Federal Reserve. The current risk-based capital standards applicable to the Company and the Bank parts of which are currently in the process of being phased in, are based on the final capital framework for strengthening international capital standards, known as Basel III, of the Basel Committee.Committee on Banking Supervision.

The Basel III Rules, among other things, (i) introduce a new capital measure called CET1, which consists primarily of retained earnings and common stock, (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments, such as preferred stock and certain convertible securities, meeting certain revised requirements, (iii) define CET1 narrowly by requiring that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital, and (iv) expand the scope of the deductions/adjustments to capital as compared to existinghistorical regulations.

Under the Basel III Rules, the current minimum capital ratios, effective as of January 1, 2015 are:

The Basel III Rules also introduce a newincluding an additional capital conservation buffer designed to absorb losses during periods of economic stress. The capital conservation buffer is an amount in addition to these minimum risk-based capital ratio requirements. The Basel III Rules also provide for a countercyclical capital buffer applicable only to certain covered institutions. We do not expect the countercyclical capital buffer to be(2.5%) applicable to the Company orand the Bank. Bank, are:

Banking institutions that do not hold capital above the required minimum levels, including the capital conservation buffer, will face constraints on paying dividends and compensation based on the amount of the shortfall.

When fully phased in on January 1, 2019, the Basel III Rules will require the Company and the Bank to maintain an additional capital conservation buffer of 2.5% of risk-weighted assets, effectively resulting in minimum ratios of (i) CET1 to risk-weighted assets of at least 7%, (ii) Tier 1 capital to risk-weighted assets of at least 8.5%, and (iii) Total capital to risk-weighted assets of at least 10.5%.

The Basel III Rules also provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that MSRs,mortgage-servicing rights (“MSRs”), certain deferred tax assets and significant investments innon-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such items, in the aggregate, exceed 15% of CET1.

Implementation of the deductions and other adjustments to CET1 began on January 1, 2015 and will be phased in over a4-year period (beginning at 40% on January 1, 2015 and an additional 20% per year thereafter). The implementation of the capital conservation buffer began on January 1, 2016 at the 0.625% level and will be phased in over a4-year period (increasing by that amount on each subsequent January 1, until it reaches 2.5% on January 1, 2019).

The Basel III Rules prescribe a new standardized approach for risk weightings that expands the risk-weighting categories from the four BaselI-derived categories (0%, 20%, 50% and 100%) tofor a much larger and more risk-sensitive numbervariety of categories,asset classes that, depending on the nature of the assets, generally rangingranges from 0% for U.S. government and agency securities, to 600% for certain equity exposures, and resulting in higher risk weightsexposures.

The Economic Growth Act provided for a variety of asset classes.

The recommendations ofpotential exception from the Treasury Report include makingBasel III Rules for community banks suchthat maintain a Community Bank Leverage Ratio (“CBLR”) of at least 8.0% to 10.0%. The CBLR is calculated by dividing Tier 1 capital by the bank’s average total consolidated assets. In the final rules approved by the FRB in November 2019, qualifying community banking organizations that opt in to using the CBLR are considered to be in compliance with the Basel III Rules as us exempt fromlong as the risk-based capital standards included underbank maintains a CBLR of greater than 9.0%. If a bank is not a qualifying community banking organization, does not opt in to using the CBLR, or cannot maintain a CBLR of greater than 9.0%, the bank would have to comply with the Basel III Rules. As no meaningful action has yet been takenWe determined to implement these recommendations, we cannot predict whether or to what extent we will continue to be subject to these standards incomply with the future, including onBasel III Rules instead of using the finalphase-in date of January 1, 2019.CBLR framework.

Leverage Requirements.BHCsRequirements

Bank holding companies and banks are also required to comply with minimum leverage ratio requirements. These requirements provide for a minimum ratio of Tier 1 capital to total consolidated quarterly average assets (as defined for regulatory purposes), net of the loan loss reserve, goodwill and certain other intangible assets (the “leverage ratio”), of 4.0%.

- 13 -

Liquidity Regulation. During 2014, the U.S. banking agencies adopted final rules implementing one of the two new standards provided for in the Basel III liquidity framework - its liquidity coverage ratio (“LCR”), which is designed to ensure that a bank maintains an adequate level of unencumbered high quality liquid assets equal to the bank’s expected net cash outflows for athirty-day time horizon under an acute liquidity stress scenario. The rules as adopted apply in their most comprehensive form only to advanced approaches bank holding companies and depository institution subsidiaries of such bank holding companies and, in a modified form, to banking organizations having $50 billion or more in total consolidated assets. Accordingly, they do not apply to either the Company or the Bank. As a result, we do not manage our balance sheet to be compliant with these rules.

The Basel III framework also included a second standard, referred to as the net stable funding ratio (“NSFR”), which is designed to promote moremedium-and long-term funding of the assets and activities of banks over aone-year time horizon. Although the Basel Committee finalized its formulation of the NSFR in 2014, the U.S. banking agencies have not yet proposed an NSFR for application to U.S. banking organizations or addressed the scope of banking organizations to which it will apply. The Basel Committee’s final NSFR document states that the NSFR applies to internationally active banks, as did its final LCR document as to that ratio.

Prompt Corrective Action.Action

The Federal Deposit Insurance Act, as amended (“FDIA”), requires, among other things, the federal banking agencies to take “prompt corrective action” in respect of depository institutions that do not meet minimum capital requirements. The FDIA establishes five capital categories for FDIC-insured banks: well capitalized, adequately capitalized, under-capitalized,undercapitalized, significantly under-capitalizedundercapitalized and critically under-capitalized. Under rules in effect through December 31, 2014, aundercapitalized. A depository institution is deemed to be “well-capitalized” if the institution has a total risk-based capital ratio of 10.0% or greater, a CET 1 ratio of 6.5% or greater, a Tier 1 risk-based capital ratio of 6.0%8.0% or greater, and a leverage ratio of 5.0% or greater, and the institution is not subject to an order, written agreement, capital directive or prompt corrective action directive to meet and maintain a specific level for any capital measure. As of January 1, 2015, the standards for “well-capitalized” status under prompt corrective action regulations changed by, among other things, introducing a CET 1 ratio requirement of 6.5% and increasing the Tier 1 risk-based capital ratio requirement from 6.0% to 8.0%. The total risk-based capital ratio and Tier 1 leverage ratio requirements remain at 10.0% and 5.0%, respectively.

The FDIA imposes progressively more restrictive constraints on operations, management and capital distributions, depending on the capital category in which an institution is classified. The current capital rule established by the federal bank regulators, discussed above under “Capital Requirements,” amend the prompt corrective action requirements in certain respects, including adding a CET1 risk-based capital ratio as one of the metrics (with a minimum 6.5% ratio for well-capitalized status) and increasing the Tier 1 risk-based capital ratio required for each of the five capital categories, including an increase from 6.0% to 8.0% to be well-capitalized.

For further information regarding the capital ratios and leverage ratio of the Company and the Bank, see the section titled “Capital“Sources and Uses of Capital Resources” in Part II, Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” included in this Annual Report on Form10-K. The current requirements and the actual levels for the Company and the Bank are detailed in Note 11,14, Regulatory Matters, of the notes to consolidated financial statements, included in this Annual Report on Form10-K.

Brokered Deposits

The FDIA and FDIC regulations thereunder limit the ability of banks to accept, renew or rollover brokered deposits unless the institution is well capitalized under the prompt corrective action framework discussed above, or unless it is adequately capitalized and obtains a waiver from the FDIC. Less-than-well-capitalized banks also are subject to restrictions on the interest rates that they may pay on deposits. The characterization of deposits as “brokered” may result in the imposition of higher deposit assessments on such deposits. In December 2020, the FDIC issued a final rule amending its regulations governing brokered deposits. The rule sought to clarify and modernize the FDIC’s regulatory framework for brokered deposits. Notable aspects of the rule include: (i) the establishment of bright-line standards for determining whether an entity meets the statutory definition of “deposit broker”; (ii) the identification of a number of business relationships in which the agent or nominee is automatically not deemed to be a “deposit broker” because their primary purpose is not the placement of funds with depository institutions (the “primary purpose exception”); (iii) the establishment of a more transparent application process for entities that seek the “primary purpose exception,” but do not qualify as one of the identified business relationships to which the exception is automatically applicable; and (iv) the clarification that third parties that have an exclusive deposit-placement arrangement with only one insured depository institution is not considered a “deposit broker.” The final rule took effect in April 2021 and full compliance with the rule has been required since January 1, 2022. Further, as mandated by the Economic Growth Act, the FDIC’s brokered deposit regulations provide a limited exception for reciprocal deposits for banks that are well managed and well capitalized (or adequately capitalized and have obtained a waiver from the FDIC as mentioned above). Under the limited exception, qualified banks are able to exempt from treatment as “brokered” deposits up to $5 billion or 20% of the institution’s total liabilities in reciprocal deposits (which are defined as deposits received by a financial institution through a deposit placement network with the same maturity (if any) and in the same aggregate amount as deposits placed by the institution in other network member banks).

Dividends

The FRB policy is that a bank holding companyan FHC should pay cash dividends only to the extent that its net income for the past year is sufficient to cover both the cash dividends and a rate of earnings retention that is consistent with the holding company’s capital needs, asset quality and overall financial condition and that it is inappropriate for a bank holding companyan FHC experiencing serious financial problems to borrow funds to pay dividends. Furthermore, a bank that is classified under the prompt corrective action regulations as “undercapitalized” will be prohibited from paying any dividends.

The primary source of cash for dividends we pay is the dividends we receive from the Bank. The Bank is subject to various regulatory policies and requirements relating to the payment of dividends, including requirements to maintain capital above regulatory minimums. ApprovalUnder New York banking law, the Bank may declare and pay dividends from its net profits, unless there is an impairment of capital. Additionally, approval of the New York State Department of Financial Services (the “NY DFS”)NY DFS is required prior to paying a dividend if the dividend declared by the Bank exceeds the sum of the Bank’s net profits for that year and its retained net profits for the preceding two calendar years. At January 1, 2018,2024, the Bank could declare dividends of $42.1$70.3 million from retained net profits of the preceding two years. The Bank declared dividends of $12.0$14.0 million and $28.0 million in 20172023 and $16.0 million in 2016.2022, respectively.

Federal Deposit Insurance Assessments.Assessments

The Bank is a member of the FDIC and pays an insurance premium to the FDIC to fund the Deposit Insurance Fund (“DIF”) based upon itsthe Bank’s assessable assets on a quarterly basis. Deposits are insured up to applicable limits by the FDIC and such insurance is backed by the full faith and credit of the United StatesU.S. Government.

Under the Dodd-Frank Act, a permanent increase inThe current level of deposit insurance was authorized to $250,000.is $250 thousand. The coverage limit is per depositor, per insured depository institution for each account ownership category.

TheUnder the Dodd-Frank Act, also set a new minimum Deposit Insurance Fund (“DIF”) reserve ratio at 1.35% of estimated insured deposits. The FDIC is required to attain this ratio by September 30, 2020. The Dodd-Frank Act also required the FDIC to definedefined the deposit insurance assessment base for an insured depository institution as an amount equal to the institution’s average consolidated total assets during the assessment period minus average tangible equity. Premiums for the Bank are now calculated based upon the average balance of total assets minus average tangible equity asFor institutions of the closeBank’s asset size, the FDIC operates a risk-based premium system that determines assessment rates from financial modeling designed to estimate the probability of businessthe bank’s failure over a three-year period. Assessment rates for each day duringinstitutions of the calendar quarter.

- 14 -

The FDIC hasmay also issue special assessments. In 2023, the flexibility to adopt actual rates that are higher or lower than the total baseFDIC issued a special assessment rates adopted without notice and comment, if certain conditions are met.

DIF-insured institutions pay a Financing Corporation (“FICO”) assessmentapplicable for banks with uninsured deposits in excess of $5 billion in order to fund the interest on bonds issued in the 1980s in connection with the failures in the thrift industry. For the fourth quarter of 2017, the FICO assessment was equal to 0.46 basis points (annualized) computed on assets as requiredrecover losses sustained by the Dodd-Frank Act. These assessments will continue untilDIF as a result of the bonds mature in 2019.March 2023 failures of Silicon Valley Bank and Signature Bank.

The FDIC is authorized to conduct examinations of and require reporting by FDIC-insured institutions. It is also authorized to terminate a depository bank’s deposit insurance upon a finding by the FDIC that the bank’s financial condition is unsafe or unsound or that the institution has engaged in unsafe or unsound practices or has violated any applicable rule,law, regulation, order or condition enacted or imposed by the bank’s regulatory agency. The termination of deposit insurance for the Bank would have a material adverse effect on our earnings, operations and financial condition. Management does not know of any practice, condition or violation that might lead to termination of deposit insurance.

Consumer Laws and Regulations.Regulations

In addition to the laws and regulations discussed herein, the Bank is also subject to certain consumer federal and state laws and regulations that are designed to protect consumers in transactions with banks. Many of these laws are implemented through regulations issued by the Consumer Financial Protection Bureau (the “CFPB”) though, for institutions of the Bank’s asset size, compliance is subject to examination by the federal banking regulator, i.e., the FRB in the Bank’s case. While the list set forth herein is not exhaustive, these laws and regulations include, among others, the Fair Credit Reporting Act, the Truth in Lending Act, the Truth in Savings Act, the Electronic Funds Transfer Act, the Expedited Funds Availability Act, the Equal Credit Opportunity Act, the Fair Housing Act, the Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, the Fair Debt Collection Practices Act, the Service Members Civil Relief Act, and these laws’ respectivestate-law counterparts, as well as state usury laws and laws regarding unfair and deceptive acts and practices. These and other federal and state laws, among other things, require disclosures of the cost of credit and terms of deposit accounts, provide substantive consumer rights, prohibit discrimination in credit transactions, regulate the use of credit report information, provide financial privacy protections, prohibit unfair, deceptive and abusive practices, restrict the Company’s ability to raise interest rates and subject the Company to substantial regulatory oversight. Violations of applicable consumer protection laws can result in significant potential liability from litigation brought by customers, including actual damages, restitution and attorneys’ fees. Federal and state bank regulators, federal law enforcement agencies, state attorneys general and state and local consumer protection agencies may also seek to enforce consumer protection requirements and obtain these and other remedies, including regulatory sanctions, customer rescission rights, fines and civil money penalties. Failure to comply with consumer protection requirements may also result in our failure to obtain any required bank regulatory approval for merger or acquisition transactions the Company may wish to pursue or our prohibition from engaging in such transactions even if approval is not required.

The Dodd-Frank Act centralized responsibility for consumer financial protection by creating the Consumer Financial Protection Bureau (“CFPB”), and giving it responsibility for implementing, examining and enforcing compliance with federal consumer protection laws. The CFPB focuses on:

The CFPB has broad rulemaking authority for a wide range of consumer financial laws that apply to all banks, including, among other things, the authority to prohibit “unfair, deceptive or abusive” acts and practices. Abusive acts or practices are defined as those that materially interfere with a consumer’s ability to understand a term or condition of a consumer financial product or service or take unreasonable advantage of a consumer’s (i) lack of financial savvy, (ii) inability to protect himself in the selection or use of consumer financial products or services, or (iii) reasonable reliance on a covered entity to act in the consumer’s interests. The CFPB can issuecease-and-desist orders against banks and other entities that violate consumer financial laws. The CFPB may also institute a civil action against an entity in violation of federal consumer financial law in order to impose a civil penalty or injunction. The CFPB has examination and enforcement authority over all banks with more than $10 billion in assets, as well as their affiliates.

Neither the recommendations of the Treasury Report nor the Financial CHOICE Act provide for the abolishment of the CFPB; both, however, call for the director of the CFPB to be subject to removal by the President and for repeal of the CFPB’s authority to perform examinations. We cannot predict whether or how the CFPB will be impacted by either pending or future legislation or by possible future executive action.

Banking regulators take into account compliance with consumer protection laws when considering approval of a proposed transaction.

- 15 -

Community Reinvestment Act.Act

Pursuant to the federal Community Reinvestment Act (the “CRA”), under federal and its New York State law,state analogue, the Bank is obligated, consistent with safe and sound banking practices, to help meet the credit needs of its entire community, including lowlow- and moderate incomemoderate-income neighborhoods. The FRBFederal Reserve Bank of New York and NY DFS periodically assess the Bank’s record of performance under the CRA and the New York state analogue, respectively, and issue one of the following ratings: “Outstanding,” “Satisfactory,” “Needs to Improve,” or “Substantial Noncompliance.”

The most recently completed evaluation of the Bank’s performance under the CRA was conducted by the FRBFederal Reserve Bank of New York for the time period January 2011 through September 2013in April 2022 and resulted in an overall rating of “Satisfactory.”

The last CRA evaluation completed by NY DFS of New York’s analogue was disclosed to us in March 2018. This2022 and this performance evaluation resulted in an overall rating by the FRBNY DFS of New York of “Needs to Improve.“Satisfactory.” In reaching this rating

On October 24, 2023, the FDIC, the FRB, and the Office of New York considered several factors, including the geographic distributionComptroller of loans we made from January 2011 through September 2013the Currency (“OCC”) issued a final rule to strengthen and modernize the federal CRA regulations. Under the final rule, banks with assets of at least $2 billion as of December 31 in both of the prior two calendar years will be a “large bank.” The agencies will evaluate large banks under four performance tests: the Retail Lending Test, the Retail Services and Products Test, the Community Development Financing Test, and the Community Development Services Test. The applicability date for the majority of the provisions in the BuffaloCRA regulations is January 1, 2026, and Rochester metropolitan areas, the accessibility of our retail delivery systemsadditional requirements will be applicable on January 1, 2027.

Privacy and our level of compliance during the time period with the Equal Credit Opportunity Act and the Fair Housing Act. We believe the Bank has made significant improvements in these areas since September 2013 and we are firmly committed to fair and responsible banking and helping to meet the credit needs of all segments of the communities that we serve.Cybersecurity

The FRB of New York’s evaluation of the Bank’s January 2011 through September 2013 CRA performance may subject the Bank to enhanced scrutiny in any application it files with the FRB of New York or the NY DFS with respect to, among other things, the establishment of new branches, the expansion or relocation of existing branches, or the acquisition by the Bank of another depository institution. While the approval or denial of such an application is typically a facts and circumstances based determination, a less than satisfactory CRA rating would be one of the factors our regulators will consider in their review.

We are in the process of preparing our response to the performance evaluation issued by the FRB of New York and we plan to file a Current Report on Form 8-K when our response and the performance evaluation are publicly available.

In January 2015, we signed an Assurance of Discontinuance (“AOD”) with the NYS Attorney General’s office related to an investigation into lending practices for minority residents within the City of Rochester from 2009 to June 2013. As part of the agreement, we paid NYS $150 thousand to cover its costs. An additional $750 thousand in dedicated funds spread over three-years was earmarked for ongoing business efforts consistent with the Bank’s growth initiatives in the Rochester market, and throughout Monroe County, including efforts focused on marketing to minority communities, as well as lending discounts and/or subsidies. The Bank successfully met all requirements of the AOD and in January 2018, the AOD expired by its terms.

The NY DFS is assessing our CRA performance since 2012 and has not yet completed its evaluation. The last CRA evaluation completed by the NY DFS was in 2011 and resulted in the Bank being rated as “Outstanding.”

Privacy Rules.Federal banking regulators, as required under the Gramm-Leach-Bliley Act, have adopted rules limiting the ability of banks and other financial institutions to disclose nonpublic information about consumers tonon-affiliated third parties. The rules require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information tonon-affiliated third parties. The privacy provisions of the Gramm-Leach-Bliley Act affect how consumer information is transmitted through diversified financial services companies and conveyed to outside vendors.

In February 2017,November 2021, the NY DFSfederal bank regulatory agencies issued a final rule requiring banking organizations to notify their primary federal regulator as soon as possible and no later than 36 hours after determining that a “computer-security incident” that rises to the level of a “notification incident,” as those terms are defined in the final rule, has occurred. A notification incident is a “computer-security incident” that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector.

The final rule also requires bank service providers to notify any affected bank to or on behalf of which becamethe service provider provides services “as soon as possible” after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for four or more hours. The rule was effective on MarchApril 1, 2017, requiring2022, with compliance required by May 1, 2022.

The NY DFS requires New York State-chartered or licensed banks regulated by the NY DFS, such as us, to adopt broad cybersecurity protections. Specifically,In particular, we are now required to establishhave established a program designed to ensure the safety of our information systems, adoptadopted a written cybersecurity policy, designateand designated an information security officer,officer. We are subject to ongoing compliance and reporting requirements of the NY DFS. In November 2023, the NY DFS amended its cybersecurity regulations to include heightened governance requirements and an expansion of the breadth and depth of required policies and procedures, among other things.

Digital Banking

Technological developments continue to significantly alter the ways in which financial institutions and their customers conduct their business. The growth of the Internet has caused banks to adopt and refine alternative distribution and marketing systems. The federal bank regulatory agencies have targeted various aspects of Internet banking, including security and systems. There can be no assurance that the bank regulatory agencies will not adopt new regulations that will materially affect the Bank’s Internet operations or restrict any such further operations.

Cannabis Banking

The Marijuana Regulation and Taxation Act was signed into law on March 31, 2021, legalizing the possession and sale of recreational marijuana in New York State for adults aged 21 or older and the state has issued adult-use cannabis cultivation, processing and retail dispensary licenses. We have implemented a program to provide financial products and services to legal cannabis-related businesses and partner with other financial institutions who provide such services.

Offering financial products and services to the cannabis industry presents a unique set of regulatory risks due to the conflict between state and federal laws, as marijuana remains illegal at the federal level. In January 2018, the U.S. Department of Justice (the “DOJ”) rescinded the “Cole Memo” and related memoranda which characterized the enforcement of the Controlled Substances Act against persons and entities complying with state regulatory systems permitting the use, manufacture and sale of medical marijuana as an inefficient use of their prosecutorial resources and discretion. The impact of the DOJ’s rescission of the Cole Memo and related memoranda is unclear, but in the future may result in increased enforcement actions against the regulated cannabis industry generally. The current United States Attorney General has indicated that the DOJ, under his leadership, does not intend to pursue cases against parties who comply with NY DFS certificationthe laws in states which have legalized and reporting requirements. Complianceare effectively regulating marijuana. However, enforcement policies and practices may be highly variable between political administrations. In addition, federal prosecutors have significant discretion and there can be no assurance that the federal prosecutor for any district in which we operate will not choose to strictly enforce the federal laws governing cannabis. In the future, enforcement actions may be taken against cannabis-related businesses or financial services providers that are viewed as aiding and abetting such activities.

The Financial Crimes Enforcement Network (“FinCEN”) published guidelines in 2014 for financial institutions servicing state-legal cannabis businesses. These guidelines clarify how financial institutions can provide services to marijuana-related businesses “in a manner consistent with their obligations to know their customers and to report possible criminal activity.” The Bank has and will continue to follow this rule is subject to fourphase-in dates between September 2017 and March 2019.other FinCEN guidance in the areas of cannabis banking.

Anti-Money Laundering and the USA Patriot Act.Act

A major focus of governmental policy on financial institutions in recent years has been aimed atis combating money laundering and terrorist financing. The USA PATRIOT Act of 2001 or the USA Patriot Act, substantially broadened the scope of United StatesU.S. anti-money laundering laws and regulations by imposing significant new compliance and due diligence obligations, creating new crimes and penalties and expanding the extra-territorial jurisdiction of the United States. Financial institutions are also prohibited from entering into specified financial transactions and account relationships and must use enhanced due diligence procedures in their dealings with certain types of high-risk customers and implement a written customer identification program. Financial institutions must take certain steps to assist government agencies in detecting and preventing money laundering and report certain types of suspicious transactions.

Regulatory authorities routinely examine financial institutions for compliance with these obligations, and for theobligations. The failure of a financial institution to maintain and implement an adequate programsprogram to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal and reputational consequences for the institution, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required. Regulatory authorities have increased their regulatory scrutiny of the Bank Secrecy Act (“BSA”) and anti-money laundering programs maintained by financial institutions and have imposed cease and desist orders and civil money penalties against institutions found to be violating these obligations. The Bank has adopted policies and procedures which are in compliance with these requirements.

The Anti-Money Laundering Act of 2020 (“AMLA”), which amends the BSA, was enacted in January 2021. The AMLA is intended to comprehensively reform and modernize U.S. anti-money laundering and anti-terrorist financing laws. Among other things, it codified a risk-based approach to anti-money laundering compliance for financial institutions; required the Dodd-Frank Act,U.S. Department of the Treasury to promulgate priorities for anti-money laundering and countering the financing of terrorism policy; required the development of standards for testing technology and internal processes for BSA compliance; expanded enforcement and investigation-related authority, including the increase of available sanctions for certain BSA violations; and expanded BSA whistleblower incentives and protections. In June 2021, the FinCEN issued the priorities for anti-money laundering and countering the financing of terrorism policy required under AMLA. The national priorities include: (i) corruption, (ii) cybercrime, (iii) terrorist financing, (iv) fraud, (v) transnational crime, (vi) drug trafficking, (vii) human trafficking and state-chartered banks may open an initial branch in a state other than(viii) proliferation financing. The Bank reviews and monitors its home state (e.g., a host state) by establishing a de novo branch at any location in such host state at which a bank chartered in such host state could establish a branch. Applicationsanti-money laundering compliance program to establish such branches must still be filedensure it complies with the appropriate primary federal regulator. It is too early to predict whether President Trump’s Executive Order or any subsequent presidential or congressional action will resultchanges reflected in any change to a bank’s ability to establish a de novo branch in a host state.

Transactions with Affiliates.FII, FSB, Five Star REIT, SDN and Courier Capital are affiliates within the meaning of the Federal Reserve Act. The Federal Reserve Act imposes limitations on a bank with respect to extensions of credit to, investments in, and certain other transactions with, its parent bank holding companyAMLA and the holding company’s other subsidiaries. Furthermore, bank loans and extensions of credit to affiliates also are subject to various collateral requirements.

- 16 -

Various governmental requirements, including Sections 23A and 23B of the Federal Reserve Act and the FRB’s Regulation W, limit borrowings by FII and its nonbank subsidiaries from FSB, and also limit various other transactions between FII and its nonbank subsidiaries, on the one hand, and FSB, on the other. For example, Section 23A of the Federal Reserve Act limits the aggregate outstanding amount of any insured depository institution’s loans and other “covered transactions” with any particular nonbank affiliate to no more than 10% of the institution’s total capital and limits the aggregate outstanding amount of any insured depository institution’s covered transactions with all of its nonbank affiliates to no more than 20% of its total capital. “Covered transactions” are defined by statute to include a loan or extension of credit, as well as a purchase of securities issued by an affiliate, a purchase of assets (unless otherwise exempted by the FRB) from the affiliate, the acceptance of securities issued by the affiliate as collateral for a loan, and the issuance of a guarantee, acceptance or letter of credit on behalf of an affiliate. Section 23A of the Federal Reserve Act also generally requires that an insured depository institution’s loans to its nonbank affiliates be, at a minimum, 100% secured, and Section 23B of the Federal Reserve Act generally requires that an insured depository institution’s transactions with its nonbank affiliates be on terms and under circumstances that are substantially the same or at least as favorable as those prevailing for comparable transactions withnon-affiliates. The Dodd-Frank Act significantly expanded the coverage and scope of the limitations on affiliate transactions within a banking organization. For example, commencing in July 2012, the Dodd-Frank Act applies the 10% of capital limit on covered transactions to financial subsidiaries and amends the definition of “covered transaction” to include (i) securities borrowing or lending transactions with an affiliate, and (ii) all derivatives transactions with an affiliate, to the extent that either causes a bank or its affiliate to have credit exposure to the securities borrowing/lending or derivative counterparty.

Office of Foreign Assets Control Regulation.Regulation

The U.S. Treasury Department’s Office of Foreign Assets Control, or OFAC,“OFAC”, administers and enforces economic and trade sanctions against targeted foreign countries and regimes, nationals, and others, under authority of various laws, including designated foreign countries, nationalsregulations, and others.executive orders. OFAC publishes lists of specially designated targetsnationals and sanctioned countries. The Company is responsible for, among other things, blocking accounts of, and transactions with, such targets and countries,sanctioned parties or jurisdictions, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence. Failure to comply with these sanctions could have serious legal and reputational consequences, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required.

Interstate Branching

Pursuant to the Dodd-Frank Act, national and state-chartered banks may open an initial branch in states other than their home state (e.g., host states) by establishing a de novo branch at any location in such host state at which a bank chartered in such host state could establish a branch. Applications to establish such branches must still be filed with the appropriate primary federal regulator.

Transactions with Affiliates

FII, FSB, Five Star REIT, SDN, and Courier Capital are affiliates within the meaning of the Federal Reserve Act and its implementing regulation, Regulation W. The Federal Reserve Act and Regulation W imposes limitations on a bank with respect to extensions of credit to, investments in, and certain other transactions with, its affiliates, including its parent financial holding company and the holding company’s other subsidiaries. Furthermore, bank loans and extensions of credit to affiliates also are subject to various collateral requirements.

Section 23A of the Federal Reserve Act and Regulation W limit the aggregate outstanding amount of any insured depository institution’s loans and other “covered transactions” with any particular affiliate to no more than 10% of the institution’s total capital and limits the aggregate outstanding amount of any insured depository institution’s covered transactions with all of its non-bank affiliates to no more than 20% of its total capital. “Covered transactions” are defined by law and regulation to include a loan or extension of credit to an affiliate, as well as a purchase of securities issued by an affiliate, a purchase of assets from the affiliate, the acceptance of securities issued by the affiliate as collateral for a loan, and the issuance of a guarantee, acceptance or letter of credit on behalf of an affiliate. Section 23A of the Federal Reserve Act and Regulation W also generally requires that an insured depository institution’s loans to its affiliates be, at a minimum, 100% secured, and Section 23B of the Federal Reserve Act and Regulation W generally requires that an insured depository institution’s transactions with its affiliates be on terms and under circumstances that are substantially the same or at least as favorable to the bank as those prevailing for comparable transactions with or involving non-affiliates. The Dodd-Frank Act significantly expanded the coverage and scope of the limitations on affiliate transactions within a banking organization. For example, the Dodd-Frank Act applies the 10% of capital limit on covered transactions to financial subsidiaries and amended the definition of “covered transaction” to include (i) securities borrowing or lending transactions with an affiliate, and (ii) all derivatives transactions with an affiliate, to the extent that either causes a bank or its affiliate to have credit exposure to the securities borrowing/lending or derivative counterparty.

Insurance Regulation.Regulation

SDN is required to be licensed or receive regulatory approval in nearly every state in which it does business. In addition, most jurisdictions require individuals who engage in brokerage and certain other insurance service activities to be personally licensed. These licensing laws and regulations vary from jurisdiction to jurisdiction. In most jurisdictions, licensing laws and regulations generally grant broad discretion to supervisory authorities to adopt and amend regulations and to supervise regulated activities.

Investment Advisory Regulation.Regulation

Courier Capital is a provider of investment consulting and financial planning services and, as such, is considered an “investment adviser” under the U.S. Investment Advisers Act of 1940, as amended (the “Advisers Act”). An investment adviser is any person or entity that provides advice to others, or that issues reports or analyses, regarding securities for compensation. While a BHCan FHC is generally excluded from regulation under the Advisers Act, the SEC has stated that this exclusion does not apply to investment adviser subsidiaries of BHCs,FHCs, such as Courier Capital. SinceBecause Courier Capital has over $100 million in assets under management, it is considered a “large adviser,” which requires registration with the SEC by filing Form ADV, and updating itincluding Part 3 to Form ADV, or Form CRS, which discloses the material terms of the advisor’s relationship with retail customers. Courier Capital must update these forms at least once each year and more frequently under certain specified circumstances. This registration covers Courier Capital and its employees as well as other persons under itstheir control and supervision, such as independent contractors, provided that their activities are undertaken on behalf of Courier Capital.

In addition to these registration requirements, the Advisers Act contains numerous other provisions that impose obligations on investment advisors. For example, Section 206 includes anti-fraud provisions that courts have interpreted as establishing fiduciary duties extending to all services undertaken on behalf of the client. These duties include, but are not limited to, the disclosure of all material facts to clients, providing only suitable investment advice, and seeking best price execution of trades. Section 206 also has specific rules relating to, among other things, advertising, safeguarding client assets, the engagement of third-parties,third parties, the duty to supervise persons acting on the investment adviser’s behalf, and the establishment of an effective internal compliance program and a code of ethics.

Courier Capital is subject to each of these obligations and, as applicable, restrictions, and is also subject to examination by the SEC’s Office of Compliance, Investigations, and Examinations to assess its overall compliance with the Advisers Act and the effectiveness of its internal controls.

PriorCommencing in October 2013, prior to ourthe Parent’s acquisition of Courier Capital in January 2016, the Bank had provided investment advisory and broker-dealer services to its customers through its subsidiary Five Star Investment Services, Inc. Commencing in October 2013,former HNP Capital, the Bank entered into a partnership with LPL Financial one of the nation’s largest independent financial services companies (“LPL”), to provide investment advisory and broker-dealer services to its customers through LPL. This partnership continues and the Bank employs wealth advisors, who are licensed by LPL, to provide investment advisory and broker-dealer services to the Bank’s customers.customers through LPL. Currently, the Bank employs a wealth advisor who is licensed by LPL to provide such services to the Bank’s retail banking customers who are not otherwise clients of Courier Capital. LPL is an investment adviser registered under the Advisers Act and is subject to its provisions.

Incentive Compensation

- 17 -

Incentive Compensation.Our compensation practices are subject to oversight by the Federal Reserve. In June 2010, the FederalThe federal banking agencies issued comprehensive finalagencies’ guidance on incentive compensation policies intendedintends to ensure that the incentive compensation policies of banking organizations do not encourage excessive risk-taking and undermine the safety and soundness of such organizations by encouraging excessive risk-taking.those organizations. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

The FRB reviews, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Company, that are not “large, complex banking organizations.” These reviews are tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives are included in reports of examination. Deficiencies are incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

The Dodd-Frank Act requires the federal banking agencies and the SEC to establish joint regulations or guidelines prohibiting incentive-based payment arrangements at specified regulated entities having at least $1 billion in total consolidated assets (which would include the Company and the Bank) that encourage inappropriate risks by providing an executive officer, employee, director or principal shareholder with excessive compensation, fees or benefits or that could lead to material financial loss to the entity. In addition, the agencies must establish regulations or guidelines requiring enhanced disclosure to regulators of incentive-based compensation arrangements. In May 2016, sixthe federal bank regulatory agencies including the FRB, the FDIC and the SEC invited public comments on a proposed rule to accomplish this mandate;mandate, but no final rule has since been issued, however, and it is uncertain at this time whetherissued.

In October 2022, the agencies intend to further pursueSEC adopted a final rule implementing the rule for the foreseeable future.

The FRB will review, as partincentive-based compensation recovery (“clawback”) provisions of the regular, risk-focused examination process,Dodd-Frank Act. The final rule directs national securities exchanges and associations, including NASDAQ, to require listed companies to develop and implement clawback policies to recover erroneously awarded incentive-based compensation from current or former executive officers in the incentive compensation arrangementsevent of banking organizations,a required accounting restatement due to material noncompliance with any financial reporting requirement under the securities laws, and to disclose their clawback policies and any actions taken under these policies. NASDAQ amended its proposed listing standards relating to clawbacks to provide that listed companies had until December 1, 2023 to adopt a compliant clawback policy. The Company met such as the Company, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.requirement.

Other Future Legislation and Changes in Regulations.Regulations

In addition to the specific proposals described above, from time to time, various legislative and regulatory initiatives are introduced in Congress and state legislatures, as well as by regulatory agencies. Such initiatives may include proposals to expand or contract the powers of bank holding companiesFHCs and depository institutions or proposals to substantially change the financial institution regulatory system. Such legislation could change banking statutes and/or our operating environment in substantial and unpredictable ways. If enacted, such legislation could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among banks, savings associations, credit unions, and other financial institutions. We cannot predict whether any such legislation will be enacted, and, if enacted, the effect that it, or any implementing regulations, would have on our financial condition or results of operations. A change in statutes, regulations or regulatory policies applicable to us or our subsidiaries could have a material effect on our business.

Impact of Inflation and Changing Prices

Our financial statements included herein have been prepared in accordance with GAAP, which requires us to measure financial position and operating results principally using historic dollars. Changes in the relative value of money due to inflation or recession are generally not considered. The primary effect of inflation on our operations is reflected in increased operating costs. We believe changes in interest rates affect the financial condition of a financial institution to a far greater degree than changes in the inflation rate. While interest rates are generally influenced by changes in the inflation rate, they do not necessarily change at the same rate or in the same magnitude. Interest rates are sensitive to many factors that are beyond our control, including changes in the expected rate of inflation, general and local economic conditions and the monetary and fiscal policies of the United States government, its agencies and various other governmental regulatory authorities.

- 18 -

Regulatory and Economic Policies

Our business and earnings are affected by general and local economic conditions and by the monetary and fiscal policies of the U.S. government, its agencies and various other governmental regulatory authorities. The FRB regulates the supply of money in order to influence general economic conditions. Among the instruments of monetary policy available to the FRB are (i) conducting open market operations in U.S. government obligations, (ii) changing the discount rate on financial institution borrowings, (iii) imposing or changing reserve requirements against financial institution deposits, and (iv) restricting certain borrowings and imposing or changing reserve requirements against certain borrowings by financial institutions and their affiliates. These methods are used in varying degrees and combinations to directly affect the availability of bank loans and deposits, as well as the interest rates charged on loans and paid on deposits. For that reason, the policies of the FRB could have a material effect on our earnings.

On December 22, 2017, the Tax Cuts and Jobs Act (the “TCJ Act”) was signed into law which, among other items, reduces the federal statutory corporate tax rate from 35 percent to 21 percent, effective January 1, 2018.

EMPLOYEESITEM 1A. RISK FACTORS

At December 31, 2017, we had 656 employees, none of whom are subject to a collective bargaining agreement. Management believes our relations with employees are good.

- 19 -

An investment in our common stock is subject to risks inherent to our business. The material risks and uncertainties that management believes could affect us are described below. Before making an investment decision, you should carefully consider the risks and uncertainties described below, together with all of the other information included or incorporated by reference herein. This Annual Report on Form10-K is qualified in its entirety by these risk factors. Further, to the extent that any of the information contained in this Annual Report on Form10-K constitutes forward-looking statements, the risk factors set forth below also are cautionary statements identifying important factors that could cause our actual results to differ materially from those expressed in any forward-looking statements made by or on behalf of us.

If any of the following risks actually occur, our financial condition and results of operations could be materially and adversely affected. If this were to happen, the value of our common stock could decline significantly, and you could lose all or part of your investment.

Credit Risks and Risks Related to Banking Activities

If we experience greater credit losses than anticipated, earnings may be adversely impacted.

As a lender, we are exposed to the risk that customers will be unable to repay their loans according to their terms and that any collateral securing the payment of their loans may not be sufficient to assure repayment. Credit losses are inherent in the business of making loans and could have a material adverse impact on our results of operations.

We make various assumptions and judgments about the collectability of our loan portfolio, including the creditworthiness of our borrowers and the value of the real estate and other assets serving as collateral, and we provide an allowance for estimated loancredit losses based on a number of factors. We believe that the allowance for loancredit losses is adequate. However, if our assumptions or judgments are wrong, the allowance for loan losses may not be sufficient to cover the actual credit losses. We may have to increase the allowance in the future in response to the request of one of our primary banking regulators, to adjust for changing conditions and assumptions, or as a result of any deterioration in the quality of our loan portfolio. The actual amount of future provisions for credit losses may vary from the amount of past provisions.

Our tax strategies are dependent upon our ability to generate taxable income in future periods. Our tax strategies will be less effective in the event we fail to generate taxable income. Our deferred tax assetsWe are subject to risks and losses resulting from fraudulent activities that could adversely impact our financial performance and results of operations.

As a bank, we are susceptible to fraudulent activity that may be committed against us or our clients, which may result in financial losses or increased costs to us or our clients, disclosure or misuse of our information or our client information, misappropriation of assets, privacy breaches against our clients, litigation or damage to our reputation. We are most subject to fraud and compliance risk in connection with the origination of loans, ACH transactions, wire transactions, ATM transactions, checking transactions, and debit cards that we have issued to our customers and through our online banking portals.

Subsequent to year end, the Bank discovered fraudulent activity associated with deposit transactions conducted over the course of several business days ending in early March 2024 by an evaluationin-market business customer of whether itthe Bank. The Bank continues to investigate this matter to determine the potential exposure to the Company, which the Company currently estimates could be up to $18.9 million, or $14.1 million net of taxes. The ultimate financial impact could be lower and will depend, in part, on the Bank’s success in recovering the funds. The Bank plans to pursue all available sources of recovery to mitigate the potential loss. See Note 24, Subsequent Events, of the notes to consolidated financial statements, included in this Annual Report on Form 10-K, for additional details.

While the Company believes this recent incident is more likely thanan isolated occurrence, there can be no assurance that such fraudulent actions will not occur again or that theysuch acts will be realized fordetected in a timely manner. We maintain a system of internal controls and insurance coverage to mitigate against such risks, including data processing system failures and errors, and customer fraud. If our internal controls fail to prevent or detect any such occurrence, or if any resulting loss is not insured or exceeds applicable insurance limits, it could have a material adverse effect on our business, financial statement purposes. In making this determination, we consider all positivecondition and negative evidence available including the impact of recent operating results as well as potential carryback of tax to prior years’ taxable income, reversals of existing taxable temporary differences, tax planning strategies and projected earnings within the statutory tax loss carryover period. If we were to conclude that a significant portion of our deferred tax assets were not more likely than not to be realized, the required valuation allowance could adversely affect our financial position, results of operations and regulatory capital ratios. In addition, the value of our deferred tax assets could be adversely affected by a change in statutory tax rates.operations.

Geographic concentration may unfavorably impact our operations.

Substantially allThe majority of our business and operations are concentrated in the Western and Central New York region.regions. As a result of this geographic concentration, our results depend largely on economic conditions in these and surrounding areas. Deterioration in economic conditions in our market, whether caused by inflation, recessionary conditions, public health emergencies, unemployment, or other factors beyond our control, could:

- 20 -

Generally, we make loans to small tomid-sized businesses whose success depends on the regional economy. These businesses generally have fewer financial resources in terms of capital or borrowing capacity than larger entities. Adverse economic and business conditions in our market areas could reduce our growth rate, affect our borrowers’ ability to repay their loans and, consequently, adversely affect our business, financial condition and performance. For example, we place substantial reliance on real estate as collateral for our loan portfolio. A sharp downturn in real estate values in our market area could leave many of these loans inadequately collateralized. If we are required to liquidate the collateral securing a loan to satisfy the debt during a period of reduced real estate values, the impact on our results of operations could be materially adverse.

Our commercial business and commercial mortgage loans increase our exposure to credit risks.

At December 31, 2023, our portfolio of commercial business and commercial mortgage loans totaled $2.74 billion, or 61% of total loans. We dependplan to continue to emphasize the origination of these types of loans, which generally expose us to a greater risk of nonpayment and loss than residential real estate or consumer loans because repayment of such loans often depends on the accuracysuccessful operations and completenessincome stream of information aboutthe borrowers. Additionally, such loans typically involve larger loan balances to single borrowers or groups of related borrowers compared to consumer loans or residential real estate loans. A sudden downturn in the economy, or a prolonged downturn for specific industries, could result in borrowers being unable to repay their loans, thus exposing us to increased credit risk.

If our regulators impose limitations on our commercial real estate lending activities, earnings could be adversely affected.

In 2006, the federal bank regulatory agencies issued joint guidance entitled “Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices” (the “CRE Guidance”). Although the CRE Guidance did not establish specific lending limits, it provides that a bank’s commercial real estate lending exposure may receive increased supervisory scrutiny where total non-owner occupied commercial real estate loans, including loans secured by apartment buildings, investor commercial real estate and construction and land loans, represent 300% or more of an institution’s total risk-based capital and the outstanding balance of the commercial real estate loan portfolio has increased by 50% or more during the preceding 36 months. Our non-owner occupied commercial real estate level equaled 285% of total risk-based capital at December 31, 2023. If our regulators were to impose restrictions on the amount of commercial real estate loans we can hold in our portfolio, or require higher capital ratios as a result of the level of commercial real estate loans held, our earnings would be adversely affected.

Our indirect and consumer lending involves risk elements in addition to normal credit risk.

A portion of our lending involves the purchase of consumer automobile installment sales contracts from automobile dealers located in Western, Central and the Capital District of New York, and Northern and Central Pennsylvania. Effective January 1, 2024, we exited the Pennsylvania automobile market in order to align our focus more fully around our core Upstate New York market. These loans are for the purchase of new or used automobiles. We serve customers that cover a range of creditworthiness, and counterparties.

In deciding whether to extend credit or enter into other transactions, we may rely on information furnished by or on behalf of customersthe required terms and counterparties, including financial statements, credit reports, and other financial information. We may also rely on representationsrates are reflective of those customers, counterparties, orrisk profiles. While these loans have higher yields than many of our other third parties,loans, such loans involve risk elements in addition to normal credit risk. Additional risk elements associated with indirect lending include the limited personal contact with the borrower as independent auditors, asa result of indirect lending through non-bank channels, namely automobile dealers. While indirect automobile loans are secured, such loans are secured by depreciating assets and characterized by loan-to-value ratios that could result in us not recovering the full value of an outstanding loan upon default by the borrower. State and federal laws may further limit our ability to recover outstanding principal balances on such loans. If the accuracy and completeness of that information. Reliance on inaccurate or misleading financial statements, credit reports, or other financial information could cause us to enter into unfavorable transactions, whichlosses from our indirect loan portfolio are higher than anticipated, it could have a material adverse effect on our financial condition and results of operations.

Our insurance brokerage subsidiary, SDN, is subject to risk related to the insurance industry.

SDN derives the bulk of its revenue from commissions and fees earned from brokerage services. SDN does not determine the insurance premiums on which its commissions are based.    Insurance premiums are cyclical in nature and may vary widely based on market conditions. As a result, insurance brokerage revenues and profitability can be volatile. As insurance companies outsource the production of premium revenue tonon-affiliated brokers or agents such as SDN, those insurance companies may seek to further minimize their expenses by reducing the commission rates payable to insurance agents or brokers, which could adversely affect SDN’s revenues.    In addition, there have been and may continue to be various trends in the insurance industry toward alternative insurance markets including, among other things, increased use of self-insurance, captives, and risk retention groups. While SDN has been able to participate in certain of theseour consumer lending activities and earn fees for such services, there can be no assurance that we will realize revenues and profitability as favorable as those realized from SDN’s traditional brokerage activities.

Our investment advisory and wealth management operations are subject to risk related to the financial services industry.

The financial services industry is subject to extensive regulation at the federal and state levels. It is very difficult to predict the future impact of the legislative and regulatory requirements affecting our business. The securitiesnumerous consumer protection laws and other laws that governregulations, including fair lending laws. Because indirect automobile loan applications are originated by automobile dealerships, we assume the activitiesrisk of our registered investment advisorunsatisfactory origination programs, including any noncompliance with federal, state, and local laws. If we are complex and subject to change. The activities of our investment advisory and wealth management operations are subject primarily to provisions of the Advisers Act and the Employee Retirement Income Act of 1940, as amended (“ERISA”). We are a fiduciary under ERISA. Our investment advisory services are also subject to state laws including anti-fraud laws and regulations. Any claim of noncompliance, regardless of merit or ultimate outcome, could subject us to investigation by the SEC or other regulatory authorities. Our compliance processes may not be sufficient to prevent assertions that we failedunable to comply with anythe regulations applicable law, rule or regulation. Ifto our investment advisoryconsumer lending activities, our financial condition and wealth management operations are subject to investigation by the SEC or other regulatory authorities or if litigation is brought by clients based on our failure to comply with applicable regulations, our results of operations could be materially adversely effected.

In addition, the majority of our investment advisory revenue is from fees based on the percentage of assets under management. The value of the assets under management is determined, in part by market conditions that can be volatile. As a result, investment advisory revenues and profitability can fluctuate with market conditions.

We may be unable to successfully implement our growth strategies, including the integration and successful managementadversely affected.

Lack of newly-acquired businesses.

Our current growth strategy is multi-faceted. We seek to expand our branch network into nearby areas, make strategic acquisitions of loans, portfolios, other regional banks andnon-banking firms whose businesses we feel may be complementary with ours, and to continue to organically grow our core deposits. Any failure by us to effectively implement any one or more of these growth strategies could have several negative effects, including a possible declineseasoning in the size or the quality, or both,portions of our loan portfolio orcould increase risk of credit defaults in the future.

As a decrease in profitability caused by an increase in operating expenses.

In particular, we hope to continue an active merger and acquisition strategy. However, even if we useresult of our common stockgrowth over the past several years, certain portions of our loan portfolio, such as the predominant formincreased size of consideration,our commercial loan portfolio, are of relatively recent origin. Loans may not begin to show signs of credit deterioration or default until they have been outstanding for some period of time, a process referred to as “seasoning.” As a result, a portfolio of older loans will usually behave more predictably than a newer portfolio. Because these portions of our portfolio are relatively new, the current level of delinquencies and defaults may not represent the level that may prevail as the portfolio becomes more seasoned. If delinquencies and defaults increase, we may need to raise capital in order to negotiate a transaction on terms acceptable to us and there can be no assurance that we will be able to raise a sufficient amount of capital to enable us to complete an acquisition. It is also possible that even with adequate capital we may still be unable to complete an acquisition on favorable terms, causing us to miss opportunitiesrequired to increase our earningsprovision for loan losses, which could have an adverse effect on our business, financial condition and expandresults of operations.

We accept deposits that do not have a fixed term, and which may be withdrawn by the customer at any time for any reason.

At December 31, 2023, we had $3.81 billion of deposit liabilities, or diversify73% of our operations.

Market conditions may impact the competitive landscape for deposits in the banking industry. The interest rate environment and future actions of the Federal Reserve may impact pricing and demand for deposits in the banking industry. The withdrawal of more deposits than we anticipate could have an adverse impact on our profitability as this source of funding, if not replaced by similar deposit funding, would need to be replaced with wholesale funding, the sale of interest-earning assets, or a combination of these two actions. The replacement of deposit funding with wholesale funding could cause our overall cost of funding to increase, which would reduce our net interest income. A loss of interest-earning assets could also reduce our net interest income.

- 21 -

Our growth strategy is also dependent upon the successful integration of new businesses, including SDN and Courier Capital, as well as any future acquisitions, into our existing operations. While our senior management team has had extensive experience in acquisitions and post-acquisition integration, there is no guarantee that our current or future integration efforts will be successful, and if our senior management is forced to spend a disproportionate amount of time on integrating recently-acquired businesses, it may distract their attention from other growth opportunities.

We are subject to environmental liability risk associated with our lending activities.

A significant portion of our loan portfolio is secured by real property. During the ordinary course of business, we may foreclose on and take title to properties securing certain loans. There is a risk that hazardous or toxic substances could be found on properties we have foreclosed upon. If hazardous or toxic substances are found, we may be liable for remediation costs, as well as for personal injury and property damage regardless of whether we knew, had reason to know of, or caused the release of such substance. Environmental laws may require us to incur substantial expenses and may materially reduce the affected property’s value or limit our ability to use or sell the affected property. In addition, future laws or more stringent interpretations or enforcement policies with respect to existing laws may increase our exposure to environmental liability. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on our financial condition and results of operations.

We operate in a highly competitive industry and mortgage loans increasemarket area.

We face substantial competition in all areas of our exposure to credit risks.

At December 31, 2017, our portfoliooperations from a variety of commercial businessdifferent competitors, many of which are larger and mortgage loans totaled $1,259.2 million, or 46.1% of total loans.may have more financial resources than us. Such competitors primarily include national, regional and internet banks within the markets in which we operate. We plan to continue to emphasize the origination of thesealso face competition from many other types of loans, which generally expose us to a greater risk of nonpaymentfinancial institutions, including, without limitation, savings and loss than residential real estate or consumer loans because repayment of such loans often depends on the successful operationsloan associations, credit unions, finance companies, brokerage firms, insurance companies and income stream of the borrowers. Additionally, such loans typically involve larger loan balances to single borrowers or groups of related borrowers compared to consumer loans or residential real estate loans. A sudden downturn in the economyother financial intermediaries. The financial services industry could result in borrowers being unable to repay their loans, thus exposing us to increased credit risk.

Our indirect lending involves risk elements in addition to normal credit risk.

A portion of our current lending involves the purchase of consumer automobile installment sales contracts from automobile dealers located in Western, Central and the Capital District of New York, and Northern and Central Pennsylvania. These loans are for the purchase of new or used automobiles. We serve customers that cover a range of creditworthiness, and the required terms and rates are reflective of those risk profiles. While these loans have higher yields than many of our other loans, such loans involve risk elements in addition to normal credit risk. Additional risk elements associated with indirect lending include the limited personal contact with the borrowerbecome even more competitive as a result of indirect lending throughnon-bank channels, namely automobile dealers. While indirect automobile loans are secured, such loans are secured by depreciating assetslegislative, regulatory and characterized byloan-to-value ratios that could result in us not recoveringtechnological changes and continued consolidation. Banks, securities firms and insurance companies can merge under the full valueumbrella of an outstanding loanFHC, which can offer virtually any type of financial service, including banking, securities underwriting, insurance (both agency and underwriting), and merchant banking. Technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. More recently, peer to peer lending has emerged as an alternative borrowing source for our customers and many other non-banks offer lending and payment services, such as consumer credit through buy now - pay later offerings, in competition with banks. Many of these competitors have fewer regulatory constraints and may have lower cost structures. Additionally, due to their size, many of our larger competitors may be able to achieve economies of scale and, as a result, may offer a broader range of products and services than we can at competitive prices or with low or no fees.

Our ability to compete successfully depends on a number of factors, including, among other things:

Failure to perform in any of these areas could significantly weaken our competitive position, which could adversely affect our growth and profitability, which, in turn, could have a material adverse effect on our financial condition and results of operations.

Legal and Regulatory Risks

Legal and regulatory proceedings and related matters could adversely affect us and the banking industry in general.

We accept depositshave been, and may in the future be, subject to various legal and regulatory proceedings, including class action litigation. It is inherently difficult to assess the outcome of these matters, and there can be no assurance that do notwe will prevail in any proceeding or litigation. Legal and regulatory matters of any degree of significance could result in substantial cost and diversion of our efforts, which by itself could have a fixed termmaterial adverse effect on our financial condition and whichoperating results.

As disclosed in Part I, Item 3, “Legal Proceedings,” an action has been brought against us by four individuals who sought and were granted class certification to represent classes of consumers who allege to have obtained direct or indirect financing from us for the purchase of vehicles that we later repossessed. On September 30, 2021, the court granted plaintiffs’ motion for class certification and matters and certified four different classes (two classes of New York consumers and two classes of Pennsylvania consumers). There are approximately 5,200 members in the New York classes and approximately 300 members in the Pennsylvania classes. If we settle these claims or the litigation is not resolved in our favor, we may suffer reputational damage and incur legal costs, settlements or judgments that exceed the amounts covered by our existing insurance policies. We can provide no assurances that our insurer will cover the full legal costs, settlements or judgments we incur. If we are not successful in defending ourselves from these claims, or if our insurer does not cover the full amount of legal costs we incur, the result may materially adversely affect our business, results of operations and financial condition. Further, adverse determinations in such matters could result in actions by our regulators that could materially adversely affect our business, financial condition or results of operations. There can be no guarantee that other proceedings that may have a material adverse effect on our business, results of operations or financial condition will not arise in the near or long-term future.

We establish reserves for legal claims when payments associated with the claims become probable and the costs can be reasonably estimated. We may still incur legal costs for a matter even if we have not established a reserve. In addition, due to the inherent subjectivity of the assessments and unpredictability of the outcome of legal proceedings, the actual cost of resolving a legal claim may be withdrawn bysubstantially higher than any amounts reserved for that matter. The ultimate resolution of a pending legal proceeding, depending on the customer at any time for any reason.remedy sought and granted, could adversely affect our results of operations and financial condition.

At December 31, 2017, we had $2.36 billion of deposit liabilities that have no maturity and, therefore, may be withdrawn by the depositor at any time. These deposit liabilities include our checking, savings, and money market deposit accounts.

Market conditions may impact the competitive landscape for deposits in the banking industry. The unprecedented low rate environment and future actions the Federal Reserve may take may impact pricing and demand for deposits in the banking industry. The withdrawal of more deposits than we anticipate could have an adverse impact on our profitability as this source of funding, if not replaced by similar deposit funding, would need to be replaced with wholesale funding, the sale of interest-earning assets, or a combination of these two actions. The replacement of deposit funding with wholesale funding could cause our overall cost of funding to increase, which would reduce our net interest income. A loss of interest-earning assets could also reduce our net interest income.

Any future FDIC insurance premium increases may adversely affect our earnings.

The amount that is assessed by the FDIC for deposit insurance is set by the FDIC based on a variety of factors. These include the depositor insurance fund’s reserve ratio, the Bank’s assessment base, which is equal to average consolidated total assets minus average tangible equity, and various inputs into the FDIC’s assessment rate calculation.

If there are financial institution failures, we may be required to pay higher FDIC premiums.premiums or special assessments. For example, in 2023, the FDIC issued a special assessment applicable for banks with total uninsured deposits in excess of $5 billion in order to recover losses sustained by the DIF as a result of the March 2023 failures of Silicon Valley Bank and Signature Bank. Such increases of FDIC insurance premiums may adversely impact our earnings. See the section captioned “Supervision and Regulation” included in Part I, Item 1 “Business, Supervision and Regulation-Federal Deposit Insurance Assessments”“Business” for more information about FDIC insurance premiums.

- 22 -

We are highly regulated, and any adverse regulatory action may result in additional costs, loss of business opportunities, and reputational damage.

As described in the section captioned “Supervision and Regulation” included in Part I, Item 1, “Business,” both our Banking and Non-Banking segmentswe are subject to extensive supervision, regulation and examination. The various regulatory authorities with jurisdiction over us have significant latitude in addressing our compliance with applicable laws and regulations including, but not limited to, those governing consumer credit, fair lending, anti-money laundering, anti-terrorism,anti-terrorist financing, capital adequacy, asset quality and risk, management ability and performance, earnings, liquidity, and various other factors affecting us. As part of this regulatory structure, we are subject to policies and other guidance developed by the regulatory agencies with respect to, among other things, capital levels, the timing and amount of dividend payments, the classification of assets and the establishment of adequate loan loss reserves for regulatory purposes. Our regulators have broad discretion to impose monetary fines or restrictions and limitations on our operations if they determine, for any reason, that our operations are unsafe or unsound, fail to comply with applicable law or are otherwise inconsistent with laws and regulations or with the supervisory policies of these agencies.

This supervisory framework could materially impact the conduct, growth and profitability of our operations. Any failure on our part to comply with current laws, regulations, other regulatory requirements or safe and sound banking, insurance, or investment advisory practices or concerns about our financial condition, or any related regulatory sanctions or adverseenforcement actions against us, could increase our costs or restrict our ability to expand our business and result in damage to our reputation.

In March 2018,We are subject to the CRA and fair lending laws, and failure to comply with these laws could lead to material penalties.

The Community Reinvestment Act (the “CRA”), the Equal Credit Opportunity Act, the Fair Housing Act and other fair lending laws and regulations impose nondiscriminatory lending requirements on financial institutions. With respect to the Bank, the NY DFS, FRB, the United States Department of Justice and other federal and state agencies are responsible for enforcing these laws and regulations. A successful regulatory challenge to an institution’s performance under the CRA or fair lending laws and regulations could result in a wide variety of sanctions, including the required payment of damages and civil money penalties, injunctive relief, imposition of restrictions on mergers and acquisitions activity and restrictions on expansion. Private parties may also have the ability to challenge an institution’s performance under fair lending laws in private class action litigation. Such actions could have a material adverse effect on our business, financial condition and results of operations.

The policies of the Federal Reserve have a significant impact on our earnings.

The policies of the Federal Reserve impact us significantly. The Federal Reserve regulates the supply of money and credit in the United States. Its policies directly and indirectly influence the rate of interest earned on loans and paid on borrowings and interest-bearing deposits and can also affect the value of financial instruments we were notifiedhold. Those policies determine, to a significant extent, our cost of funds for lending and investing and impact our net interest income, our primary source of revenue. Changes in those policies are beyond our control and are difficult to predict. Federal Reserve policies can also affect our borrowers, potentially increasing the risk that they may fail to repay their loans. For example, a tightening of the money supply by the FRBFederal Reserve could reduce the demand for a borrower’s products and services. This could adversely affect the borrower’s earnings and ability to repay its loan, which could have a material adverse effect on our financial condition and results of operations.

Regulatory scrutiny of bank provision of BaaS solutions and related technology considerations has recently increased.

We provide BaaS products and services to third parties. The third parties that use these BaaS solutions, and with which we may partner in marketing efforts, are typically considered FinTech companies but may also include other financial intermediaries. Recently, federal bank regulators have increasingly focused on the risks related to bank and FinTech company partnerships, raising potential concerns regarding risk management, oversight, internal controls, information security, change management, and information technology operational resilience. There have been regulatory enforcement actions against other banks that have not adequately addressed these potential concerns while growing their BaaS offerings. Accordingly, we could be subject to additional regulatory scrutiny with respect to that portion of our business.

We have implemented a program to provide financial products and services to customers that do business in the cannabis industry and the strict enforcement of federal laws and regulations regarding cannabis could result in our inability to continue to provide financial products and services to these customers and we could have legal action taken against us by the federal government and exposure to additional liabilities and regulatory compliance costs.

Offering financial products and services to the cannabis industry presents a unique set of regulatory risks due to the conflict between state and federal laws. While the possession and sale of recreational marijuana is legal for adults aged 21 and older in New York State, cannabis remains classified as a Schedule I controlled substance under the federal Controlled Substances Act. In January 2018, the DOJ rescinded the “Cole Memo” and related memoranda which characterized the enforcement of the Controlled Substances Act against persons and entities complying with state regulatory systems permitting the use, manufacture and sale of medical marijuana as an inefficient use of their prosecutorial resources and discretion. The impact of the DOJ’s rescission of the Cole Memo and related memoranda is unclear, but in the future may result in increased enforcement actions against the regulated cannabis industry generally. More recently, the United States Attorney General has indicated that the DOJ under his leadership does not intend to pursue cases against parties who comply with the laws in states which have legalized and are effectively regulating marijuana. However, enforcement policies and practices may be highly variable between political administrations. In addition, federal prosecutors have significant discretion and there can be no assurance that the federal prosecutor for any district in which we or our customers operate will not choose to strictly enforce the federal laws governing cannabis.

Any enforcement action against a cannabis-related business customer of ours could affect our results of operation and financial condition. Additionally, as the possession and use of cannabis remains illegal under the Controlled Substances Act, we may be deemed to be aiding and abetting illegal activities through the services that we provide to such customers and could have legal action taken against us by the federal government, including imprisonment and fines. The FinCEN published guidelines in 2014 for financial institutions servicing state-legal cannabis businesses. These guidelines clarify how financial institutions can provide services to marijuana-related businesses in a “manner consistent with their obligations to know their customers and to report possible criminal activity.” The Bank has and will continue to follow this and other FinCEN guidance in the areas of cannabis banking. However, there can be no assurance that compliance with FinCEN’s guidelines will protect us from federal prosecution or other regulatory sanctions. Any change in position or potential action taken against us could result in significant financial damage to us and our stockholders.

Additionally, while we believe our Bank Secrecy Act/Anti-Money Laundering (“BSA/AML”) policies and practices for our cannabis banking program are sufficient, the recreational cannabis business is considered high-risk, and our BSA/AML program will be subject to increased regulatory scrutiny. Any real or perceived shortcomings in our BSA/AML program may result in regulatory action against us and may prevent us from undertaking mergers and acquisitions or other expansion activities.

Risks Related to Non-Banking Activities

Our insurance brokerage subsidiary is subject to risk related to the insurance industry.

SDN derives the bulk of its most recentrevenue from commissions and fees earned from brokerage services. SDN does not determine the insurance premiums on which its commissions are based. Insurance premiums are cyclical in nature and may vary widely based on market conditions. As a result, insurance brokerage revenues and profitability can be volatile. As insurance companies outsource the production of premium revenue to non-affiliated brokers or agents such as SDN, those insurance companies may seek to further minimize their expenses by reducing the commission rates payable to insurance agents or brokers, which could adversely affect SDN’s revenues. In addition, there have been and may continue to be various trends in the insurance industry toward alternative insurance markets including, among other things, increased use of self-insurance, captives, and risk retention groups. While SDN has been able to participate in certain of these activities and earn fees for such services, there can be no assurance that we will realize revenues and profitability as favorable as those realized from SDN’s traditional brokerage activities.

Our investment advisory and wealth management operations are subject to risk related to the regulation of the financial services industry and market volatility.

The financial services industry is subject to extensive regulation at the federal and state levels. It is very difficult to predict the future impact of the legislative and regulatory requirements affecting our business. The securities laws and other laws that govern the activities of our registered investment advisor are complex and subject to change. The activities of our investment advisory and wealth management operations are subject primarily to provisions of the Advisers Act and the Employee Retirement Income Act of 1940, as amended (“ERISA”). We are a fiduciary under ERISA. Our investment advisory services are also subject to state laws including anti-fraud laws and regulations.

In addition, the broker-dealer services provided by Courier Capital are subject to Regulation Best Interest, which requires a broker-dealer to act in the best interest of a retail customer when making a recommendation to that customer of any securities transaction or investment strategy involving securities. The regulation imposes heightened standards on broker-dealers and will require us to review and modify the policies and procedures of our wealth management operations, as well as associated supervisory and compliance controls.

Any claim of noncompliance, regardless of merit or ultimate outcome, could subject us to investigation by the SEC or other regulatory authorities or harm our reputation and customer relationships. Our compliance processes may not be sufficient to prevent assertions that we failed to comply with any applicable law, rule or regulation. If our investment advisory and wealth management operations are subject to investigation by the SEC or other regulatory authorities or if litigation is brought by clients based on our failure to comply with applicable regulations, our results of operations could be materially adversely affected.

Our investment advisory revenue may decrease as a result of poor investment performance, in either relative or absolute terms, which could decrease our revenues and net income.

Our investment advisory business derives a significant amount of its revenues from investment management fees based on assets under management. Our ability to maintain or increase assets under management is subject to a number of factors, including our clients’ evaluation of the Bank’s CRApast performance forof our investment advisory business, in either relative or absolute terms, general market and economic conditions, and competition from other investment management firms. A decline in the time period January 2011 through September 2013, resulted in an overall rating of “Needs to Improve.” This rating may subject the Bank to enhanced scrutiny in any application for business expansion it files with the Federal Reserve or the NY DFS, which may result in a delay in approving or the denial of such application. In addition, the publicationfair value of the “Needs to Improve” rating may damageassets under management would decrease our reputation, making it more difficultinvestment advisory revenue.

Investment performance is one of the most important factors in retaining existing investment advisory clients and competing for us to achievenew investment advisory clients. Poor investment performance could reduce our business goalsinvestment advisory revenues and objectives, particularlyimpede the growth of our investment advisory business in the Buffalofollowing ways: existing clients may withdraw funds from our investment advisory business in favor of better performing products or firms; asset-based management fees could decline from a decrease in assets under management; our ability to attract funds from existing and Rochester metropolitan areas.new clients might diminish; and the investment advisory personnel may depart to join a competitor or otherwise.

Strategic and Operational Risks

We make certain assumptions and estimates in preparing our financial statements that may prove to be incorrect, which could significantly impact our results of operations, cash flows and financial condition, and we are subject to new or changing accounting rules and interpretations, and the failure by us to correctly interpret or apply these evolving rules and interpretations could have a material adverse effect.

Accounting principles generally accepted in the United States require us to use certain assumptions and estimates in preparing our financial statements, including in determining credit loss reserves and reserves related to litigation, among other items. Certain of our financial instruments, includingavailable-for-sale securities and certain loans, require a determination of their fair value in order to prepare our financial statements. Where quoted market prices are not available, we may make fair value determinations based on internally developed models or other means, which ultimately rely to some degree on management judgment. Some of these and other assets and liabilities may have no direct observable price levels, making their valuation particularly subjective, as they are based on significant estimation and judgment. In addition, sudden illiquidity in markets or declines in prices of certain loans and securities may make it more difficult to value certain balance sheet items, which may lead to the possibility that such valuations will be subject to further change or adjustment. If assumptions or estimates underlying our financial statements are incorrect, we may experience material losses that would impact our results of operations, cash flows and financial condition.

As indicated in Note 1, Summary of Significant Accounting Policies -– Recent Accounting Pronouncements, to the Consolidated Financial Statements included in Item 8 of this Annual Report on Form10-K, the regulations, rules, standards, policies, and interpretations underlying GAAP are constantly evolving and may change significantly over time. If we fail to interpret any one or more of these GAAP provisions correctly, or if our methodology in applying them to our financial reporting or disclosures is at all flawed, our financial statements may contain inaccuracies that, if severe enough, could warrant a later restatement by us, which in turn could result in a material adverse event.

LegalThe value of our goodwill and regulatory proceedingsother intangible assets may decline in the future.

As of December 31, 2023, we had $67.1 million of goodwill and related matters could adversely affect us$5.4 million of other intangible assets. Significant and sustained declines in our stock price and market capitalization, significant declines in our expected future cash flows, significant adverse changes in the banking industry in general.

We have been, andbusiness climate or slower growth rates may necessitate our taking charges in the future be, subjectrelated to various legalthe impairment of our goodwill. Future regulatory actions could also have a material impact on assessments of goodwill for impairment. If the fair value of our net assets improves at a faster rate than the market value of our reporting units, or if we were to experience increases in book values of a reporting unit in excess of the increase in fair value of equity, we may also have to take charges related to the impairment of our goodwill. If we were to conclude that a future write-down of our goodwill is necessary, we would record the appropriate charge, which could have a material adverse effect on our results of operations.

Identifiable intangible assets other than goodwill consist of core deposit intangibles and regulatory proceedings. It is inherently difficult to assessother intangible assets (primarily customer relationships). Adverse events or circumstances could impact the outcomerecoverability of these matters,intangible assets including loss of core deposits, significant losses of customer accounts and/or balances, increased competition or adverse changes in the economy. To the extent these intangible assets are deemed unrecoverable, a non-cash impairment charge would be recorded which could have a material adverse effect on our results of operations.

We may be unable to successfully implement our growth strategies, including the integration and successful management of newly-acquired businesses.

Our current growth strategy is multi-faceted. We seek to expand our branch network into nearby areas, continue to invest in our digital banking strategy, develop new sustainable revenue streams through BaaS, make strategic acquisitions of loans, portfolios, other regional banks and non-banking firms whose businesses we feel may be complementary with ours, and to continue to organically grow our core deposits. Any failure by us to effectively implement any one or more of these growth strategies could have several negative effects, including a possible decline in the size or the quality, or both, of our loan portfolio or a decrease in profitability caused by an increase in operating expenses.

We hope to continue an active merger and acquisition strategy. However, even if we use our common stock as the predominant form of consideration, we may need to raise capital to negotiate a transaction on terms acceptable to us and there can be no assurance that we will prevailbe able to raise a sufficient amount of capital to enable us to complete an acquisition. It is also possible that even with adequate capital we may still be unable to complete an acquisition on favorable terms, causing us to miss opportunities to increase our earnings and expand or diversify our operations.

Our growth strategy is also dependent upon the successful integration of new businesses and any future acquisitions into our existing operations. While our senior management team has had extensive experience in any proceedingacquisitions and post-acquisition integration, there is no guarantee that our current or litigation. Legalfuture integration efforts will be successful, and if our senior management is forced to spend a disproportionate amount of time on integrating recently-acquired businesses, it may distract their attention from operating our business or pursuing other growth opportunities.

Acquisitions may disrupt our business and dilute shareholder value.

We intend to continue to pursue a growth strategy for our business by expanding our branch network into communities within or complementary to markets where we currently conduct business. We may consider acquisitions of loans or securities portfolios, lending or leasing firms, commercial and small business lenders, residential lenders, direct banks, banks or bank branches, wealth and investment management firms, securities brokerage firms, specialty finance or other financial services-related companies. We may be unsuccessful in expanding our non-banking subsidiaries through acquisition because of the growing interest in our industry in acquiring insurance brokers and wealth management firms, which could make it more difficult for us to identify appropriate targets and could make such acquisitions more expensive. Even if we are able to identify appropriate acquisition targets, we may not have sufficient capital to fund acquisitions or be able to execute transactions on favorable terms. If we are unable to pursue our growth strategy, we may not be able to achieve all of the expected benefits of our historical acquisitions, which could adversely affect our results of operations and financial condition.

Acquiring other banks, businesses, or branches involves potential adverse impact to our financial results and various other risks commonly associated with acquisitions, including, among other things:

Our tax strategies and the value of our deferred tax assets and liabilities could adversely affect our operating results and regulatory matterscapital ratios.

Our tax strategies are dependent upon our ability to generate taxable income in future periods. Our tax strategies will be less effective in the event we fail to generate taxable income. Our deferred tax assets are subject to an evaluation of any degreewhether it is more likely than not that they will be realized for financial statement purposes. In making this determination, we consider all positive and negative evidence available including the impact of significancerecent operating results, reversals of existing taxable temporary differences, tax planning strategies and projected earnings within the statutory tax loss carryover period. If we were to conclude that a significant portion of our deferred tax assets were not more likely than not to be realized, the required valuation allowance could adversely affect our financial position, results of operations and regulatory capital ratios. In addition, the value of our deferred tax assets could be adversely affected by a change in statutory rates.

Liquidity is essential to our businesses.

Liquidity is essential to our business as we must be able to meet the cash needs of borrowers and depositors. Our liquidity could be impaired by an inability to access the capital markets or unforeseen outflows of cash. Reduced liquidity may arise due to circumstances that we may be unable to control, such as a general market disruption or an operational problem that affects third parties or us. Our efforts to monitor and manage liquidity risk may not be successful or sufficient to deal with dramatic or unanticipated reductions in our liquidity. In such events, our cost of funds may increase, thereby reducing our net interest income, or we may need to sell a portion of our investment and/or loan portfolio, which, depending upon market conditions, could result in substantial cost and diversionus realizing a loss.

We rely on dividends from our subsidiaries for most of our efforts,revenue.

We are a separate and distinct legal entity from our subsidiaries. A substantial portion of our revenue comes from dividends from our Bank subsidiary. These dividends are the principal source of funds we use to pay dividends on our common and preferred stock, and to pay interest and principal on our debt. Federal and/or state laws and regulations limit the amount of dividends that our Bank subsidiary may pay to us. Also, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors. In the event our Bank subsidiary is unable to pay dividends to us, we may not be able to service debt, pay obligations, or pay dividends on our common and preferred stock. The inability to receive dividends from our Bank subsidiary could have a material adverse effect on our business, financial condition, and results of operations.

If our risk management framework does not effectively identify or mitigate our risks, we could suffer losses.

Our risk management framework seeks to mitigate risk and appropriately balance risk and return. We have established processes and procedures intended to identify, measure, monitor and report the types of risk to which by itselfwe are subject, including credit risk, operations risk, compliance risk, reputation risk, strategic risk, market risk, and liquidity risk. We seek to monitor and control our risk exposure through a framework of policies, procedures and reporting requirements. Management of our risks in some cases depends upon the use of analytical and/or forecasting models. If the models used to mitigate these risks are inadequate, we may incur losses. In addition, there may be risks that exist, or that develop in the future, that we have not appropriately anticipated, identified or mitigated. If our risk management framework does not effectively identify or mitigate our risks, we could suffer unexpected losses and could be materially adversely affected.

Market Risks

We are subject to interest rate risk, and fluctuations in market interest rates may affect our interest margins and income, demand for our products, defaults on loans, loan prepayments and the fair value of our financial instruments.

Our earnings and cash flows depend largely upon our net interest income. Interest rates are highly sensitive to many factors that are beyond our control, including general economic conditions and policies of governmental and regulatory agencies, particularly the Federal Reserve. Changes in monetary policy, including changes in interest rates, could influence the interest we receive on loans and investments and the amount of interest we pay on deposits and borrowings, which may affect our net interest margins. Such changes could also affect (i) demand for our products and services and price competition, in turn affecting our ability to originate loans and obtain deposits; (ii) the fair value of our financial assets and liabilities; (iii) the average duration of our mortgage-backed securities portfolio and other interest-earning assets; (iv) levels of defaults on loans; and (v) loan prepayments.

During 2022 and 2023, in response to accelerated inflation, the Federal Reserve implemented monetary tightening policies, resulting in significantly increased interest rates. If the interest rates paid on deposits and other borrowings increase at a faster rate than the interest rates received on loans and other investments, our net interest income, and therefore earnings, could be adversely affected. In addition, our net interest margin may contract in a rising rate environment because our funding costs may increase faster than the yield we earn on our interest-earning assets. In a rising rate environment, demand for loans may decrease and loans with adjustable interest rates are more likely to experience a higher rate of default. Additionally, changes in interest rates also affect the fair value of the securities portfolio. Generally, the value of securities moves inversely with changes in interest rates. The combination of these events may adversely affect our financial condition and results of operations.

Earnings could also be adversely affected if the interest rates received on loans and other investments fall more quickly than the interest rates paid on deposits and other borrowings. In addition, in a falling rate environment, or the recent pandemic-related environment where the Federal Reserve held the federal reference rate near 0.00%, loans may be prepaid sooner than we expect, which could result in a delay between when we receive the prepayment and when we are able to redeploy the funds into new interest-earning assets and in a decrease in the amount of interest income we are able to earn on those assets. If we are unable to manage these risks effectively, our financial condition and results of operations could be materially adversely affected.

Any substantial, unexpected or prolonged change in market interest rates could have a material adverse effect on our financial condition and operating results. While,results of operations. Also, our interest rate risk modeling techniques and assumptions likely may not fully predict or capture the impact of actual interest rate changes on our balance sheet.

The soundness of other financial institutions could adversely affect us.

Financial services institutions are interrelated as discloseda result of trading, clearing, counterparty, or other relationships. We have exposure to many different industries and counterparties, and we routinely execute transactions with counterparties in Part I, Item 3, “Legal Proceedings,”the financial services industry, including commercial banks, brokers and dealers, investment banks, and other institutional clients. Many of these transactions expose us to credit risk in the event of a default by our management doescounterparty or client. In addition, our credit risk may be exacerbated when the collateral held by us cannot be realized or is liquidated at prices not believe that there are any pendingsufficient to recover the full amount of the credit or threatened proceedings against us, that, if determined adversely, wouldderivative exposure due us. Any such losses could have a material adverse effect on our financial condition and results of operations.

Additionally, in early 2023, the failures of Silicon Valley Bank, Signature Bank, and First Republic Bank resulted in decreased confidence in banks among depositors, other counterparties and investors. Such events and developments could materially and adversely affect our business or financial condition, including through declines in deposits, increased costs of funds, potential liquidity pressures, increased regulation, and declines and volatility in the price of our common stock.

We may need to raise additional capital in the future and such capital may not be available on acceptable terms or at all.

We may need to raise additional capital in the future to provide sufficient capital resources and liquidity to meet our commitments and business needs.

In addition, we are highly regulated, and our regulators could require us to raise additional common equity in the future. We and our regulators perform a variety of analyses of our assets, including the preparation of stress case scenarios, and as a result of those assessments we could determine, or our regulators could require us, to raise additional capital.

Our ability to raise additional capital, if needed, will depend on our financial performance and, among other things, conditions in the capital markets at that time, which are outside of our control. We may not be able to access required capital on acceptable terms or at all. Any occurrence that may limit our access to the capital markets, such as a decline in the confidence of debt purchasers, depositors of the Bank or counterparties participating in the capital markets, or a downgrade of our debt rating, may adversely affect our capital costs and ability to raise capital and, in turn, our liquidity. An inability to raise additional capital on acceptable terms when needed could have a material adverse impact on our business, financial condition, results of operations or financial condition, there can be no guarantee that such a proceeding will not arise in the near or long-term future. Further, adverse determinations in such matters could result in actions by our regulators that could materially adversely affect our business, financial condition or results of operations.liquidity.

We establish reserves for legal claims when payments associated with the claims become probableTechnology and the costs can be reasonably estimated. We may still incur legal costs for a matter even if we have not established a reserve. In addition, due to the inherent subjectivity of the assessments and unpredictability of the outcome of legal proceedings, the actual cost of resolving a legal claim may be substantially higher than any amounts reserved for that matter. The ultimate resolution of a pending legal proceeding, depending on the remedy sought and granted, could adversely affect our results of operations and financial condition.

- 23 -

A breach in security of our or third party information systems, including the occurrence of a cyber incident or a deficiency in cybersecurity, or a failure by us to comply with enhanced New York State cybersecurity regulations, may subject us to liability, result in a loss of customer business or damage our brand image.

We rely heavily on communications, information systems (both internal and provided by third parties) and the internet to conduct our business. Our business depends on our ability to process and monitor a large volume of daily transactions in compliance with legal, regulatory and internal standards and specifications. In addition, a significant portion of our operations relies heavily on the secure processing, storage and transmission of personal and confidential information of our customers and clients. These risks may increase in the future as our customers continue to adapt to mobile payment and other internet-based product offerings and we expand the availability ofweb-based products and applications.

In addition, several U.S. financial institutions have experienced significant distributeddenial-of-service attacks, some of which involved sophisticated and targeted attacks intended to disable or degrade service, or sabotage systems. Other potential attacks have attempted to obtain unauthorized access to confidential information or destroy data, often through the introduction of computer viruses or malware, cyber-attacks and other means. To date, none of these types of attacks have had a material effect on our business or operations. Such security attacks can originate from a wide variety of sources, including persons who are involved with organized crime or who may be linked to terrorist organizations or hostile foreign governments. Those same parties may also attempt to fraudulently induce employees, customers or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or clients. We are also subject to the risk that our employees may intercept and transmit unauthorized confidential or proprietary information. An interception, misuse or mishandling of personal, confidential or proprietary information being sent to or received from a customer or third party could result in legal liability, remediation costs, regulatory action and reputational harm, any of which could adversely affect our results of operations and financial condition.

As of March 1, 2017, we are required to comply with new cybersecurity regulations promulgated by the NY DFS that will be phased in between September 2017 and March 2019. Any failure by us to timely and successfully implement some or all of these regulations, which mandate, among other things, the creation of a new cybersecurity program, a written policy, the appointment of an information security officer and certification by the NY DFS, could also result in regulatory sanctions, public disclosure and reputational damage even if we do not experience a significant cybersecurity breach.

We face competition in staying current with technological changes and banking alternatives to compete and meet customer demands.

The financial services market, including banking services, faces rapid changes with frequent introductions of new technology-driven products and services. In addition to better serving customers, the effective use of technology increases efficiency and may enable us to reduce costs. Our future success may depend, in part, on our ability to use technology to provide products and services that provide convenience to customers and to create additional efficiencies in our operations. Some of our competitors have substantially greater resources to invest in technological improvements than we currently have. We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers. In addition, technology and other changes are allowing consumers to utilize alternative methods to complete financial transactions that have historically involved banks. For example, consumers can now maintain funds in brokerage accounts or mutual funds that would have historically been held as bank deposits. Consumers can also complete transactions such as paying bills and transferring funds directly without using a traditional bank as an intermediary. The process of eliminating banks as intermediaries could result in the loss of customer deposits, the related income generated from those deposits and additional fee income. We may not be able to effectively compete with these banking alternatives for consumer deposits. As a result, our ability to effectively compete to retain or acquire new business may be impaired, and our business, financial condition or results of operations, may be adversely affected.

We rely on other companies to provide key components of our business infrastructure.

Third partyThird-party vendors provide key components of our business infrastructure such as internet connections, network access and core application processing. While we have selected these third partythird-party vendors carefully, we do not control their actions. Any problems caused by these third parties, including as a result of them not providing us their services for any reason or them performing their services poorly, could adversely affect our ability to deliver products and services to our customers or otherwise conduct our business efficiently and effectively. Replacing these third partythird-party vendors could also entail significant delay and expense.

Third parties perform significant operational services on our behalf. These third-party vendors are subject to similar risks as us relating to cybersecurity, breakdowns or failures of their own systems or employees. One or more of our vendors may experience a cybersecurity event or operational disruption and, if any such event does occur, it may not be adequately addressed, either operationally or financially, by the third-party vendor. Certain of our vendors may have limited indemnification obligations or may not have the financial capacity to satisfy their indemnification obligations. Financial or operational difficulties of a vendor could also impair our operations if those difficulties interfere with the vendor’s ability to serve us. If a critical vendor is unable to meet our needs in a timely manner or if the services or products provided by such a vendor are terminated or otherwise delayed and if we are not able to develop alternative sources for these services and products quickly and cost-effectively, it could have a material adverse effect on our business. Federal banking regulators recently issued regulatory guidancehave proposed rules on managing the risks of how banks select, engage and manage their outside vendors.vendors and issued voluntary guidance for banks on similar issues. These regulations and guidance may affect the circumstances and conditions under which we work with third parties and the cost of managing such relationships.

A breach in security of our or third-party information systems, including the occurrence of a cyber incident or a deficiency in cybersecurity, or a failure by us to comply with New York State cybersecurity regulations, may subject us to liability, result in a loss of customer business or damage our brand image.

- 24 -

We use financial models forrely heavily on communications, information systems (both internal and provided by third parties) and the internet to conduct our business. Our business planning purposes that may not adequately predict future results.

We use financial models to aid in planning for various purposes including our capital and liquidity needs, interest rate risk, potential charge-offs, reserves, and other purposes. The models used may not accurately account for all variables that could affect future results, may fail to predict outcomes accurately and/or may overstate or understate certain effects. As a result of these potential failures, we may not adequately prepare for future events and may suffer losses or other setbacks due to these failures.

We may not be able to attract and retain skilled people.

Our success depends in large part, on our ability to attractprocess and retain skilled people. Competition for highly talented people can be intense,monitor a large volume of daily transactions in compliance with legal, regulatory and internal standards and specifications. In addition, a significant portion of our operations relies heavily on the secure processing, storage and transmission of personal and confidential information of our customers and clients. These risks may increase in the future as our customers continue to adapt to mobile payment and other internet-based product offerings and we expand the availability of web-based products and applications.

In addition, several U.S. financial institutions have experienced significant distributed denial-of-service attacks, some of which involved sophisticated and targeted attacks intended to disable or degrade service or sabotage systems. Other potential attacks have attempted to obtain unauthorized access to confidential information or destroy data, often through the introduction of computer viruses or malware, cyber-attacks and other means. Such security attacks can originate from a wide variety of sources, including persons who are involved with organized crime or who may not be ablelinked to hire sufficiently skilled peopleterrorist organizations or retain them. Further, the rural locationhostile foreign governments. Those same parties may also attempt to fraudulently induce employees, customers or other users of our principal executive offices and manysystems to disclose sensitive information in order to gain access to our data or that of our bank branches make it challenging for uscustomers or clients. We are also subject to attract skilled peoplethe risk that our employees may intercept and transmit unauthorized confidential or proprietary information. An interception, misuse or mishandling of personal, confidential or proprietary information being sent to such locations. The unexpected lossor received from a customer or third party could result in legal liability, remediation costs, regulatory action and reputational harm, any of services of one or more of our key personnel could have a material adverse impact on our business because of their skills, knowledge of our markets, years of industry experience, and the difficulty of promptly finding qualified replacement personnel.

Acquisitions may disrupt our business and dilute shareholder value.

We intend to continue to pursue a growth strategy for our business by expanding our branch network into communities within or adjacent to markets where we currently conduct business.    We may consider acquisitions of loans or securities portfolios, lending or leasing firms, commercial and small business lenders, residential lenders, direct banks, banks or bank branches, wealth and investment management firms, securities brokerage firms, specialty finance or other financial services-related companies. We also intend to expand our SDN and Courier subsidiaries by acquiring smaller insurance agencies and wealth management firms in areas which complement our current footprint. We may be unsuccessful in expanding our SDN and Courier subsidiaries through acquisition because of the growing interest in acquiring insurance brokers and wealth management firms, which could make it more difficult for us to identify appropriate targets and could make such acquisitions more expensive. Even if we are able to identify appropriate acquisition targets, we may not have sufficient capital to fund acquisitions or be able to execute transactions on favorable terms. If we are unable to expand our SDN and Courier operations through smaller acquisitions, we may not be able to achieve all of the expected benefits of the SDN and Courier acquisitions, which could adversely affect our results of operations and financial condition.

Acquiring other banks, businesses, or branches involves potential adverse impact to our financial results and various other risks commonly associated with acquisitions, including, among other things:

We are subject to interest rate risk.

Our earnings and cash flows depend largely upon our net interest income. Interest rates are highly sensitivecybersecurity regulations promulgated by the NY DFS. Any failure by us to many factors that are beyond our control, including general economic conditions and policies of governmental and regulatory agencies, particularly the Federal Reserve. Changes in monetary policy, including changes in interest rates, could influence not only the interest we receive on loans and investments and the amount of interest we pay on deposits and borrowings, but such changescomply with these regulations could also affect (i) our ability to originate loansresult in regulatory sanctions, public disclosure and obtain deposits; (ii) the fair value of our financial assets and liabilities; and (iii) the average duration of our mortgage-backed securities portfolio and other interest-earning assets. If the interest rates paid on deposits and other borrowings increase at a faster rate than the interest rates received on loans and other investments, our net interest income, and therefore earnings, could be adversely affected. Earnings could also be adversely affectedreputational damage even if the interest rates received on loans and other investments fall more quickly than the interest rates paid on deposits and other borrowings.

Any substantial, unexpected or prolonged change in market interest rates could have a material adverse effect on our financial condition and results of operations. Also, our interest rate risk modeling techniques and assumptions likely maywe do not fully predict or capture the impact of actual interest rate changes on our balance sheet.

- 25 -

Our business may be adversely affected by conditions in the financial markets and economic conditions generally.

Our financial performance generally, and in particular the ability of borrowers to pay interest on and repay principal of outstanding loans and the value of collateral securing those loans, as well as demand for loans and other products and services we offer, is highly dependent on the business environment in the markets where we operate, in the State of New York and in the United States as a whole. A favorable business environment is generally characterized by, among other factors, economic growth, efficient capital markets, low inflation, low unemployment, high business and investor confidence, and strong business earnings. Unfavorable or uncertain economic and market conditions can be caused by declines in economic growth, business activity or investor or business confidence; limitations on the availability or increases in the cost of credit and capital; increases in inflation or interest rates; high unemployment, natural disasters; or a combination of these or other factors.

The policies of the Federal Reserve haveexperience a significant impact on our earnings.cybersecurity breach.

The policiesFurthermore, as the threat of the Federal Reserve impact us significantly. The Federal Reserve regulates the supply of money and credit in the United States. Its policies directly and indirectly influence the rate of interest earned on loans and paid on borrowings and interest-bearing deposits and can also affect the value of financial instruments we hold. Those policies determine,cyber-attacks continue to a significant extent, our cost of funds for lending and investing and impact our net interest income, our primary source of revenue. Changes in those policies are beyond our control and are difficult to predict. Federal Reserve policies can also affect our borrowers, potentially increasing the risk that they may fail to repay their loans. For example, a tightening of the money supply by the Federal Reserve could reduce the demand for a borrower’s products and services. This could adversely affect the borrower’s earnings and ability to repay its loan, which could have a material adverse effect on our financial condition and results of operations.

The soundness of other financial institutions could adversely affect us.

Financial services institutions are interrelated as a result of trading, clearing, counterparty, or other relationships. We have exposure to many different industries and counterparties, and we routinely execute transactions with counterparties in the financial services industry, including commercial banks, brokers and dealers, investment banks, and other institutional clients. Many of these transactions expose us to credit risk in the event of a default by our counterparty or client. In addition, our credit risk may be exacerbated when the collateral held by us cannot be realized or is liquidated at prices not sufficient to recover the full amount of the credit or derivative exposure due us. Any such losses could have a material adverse effect on our financial condition and results of operations.

The value of our goodwill and other intangible assets may decline in the future.

As of December 31, 2017, we had $65.8 million of goodwill and $8.9 million of other intangible assets. Significant and sustained declines in our stock price and market capitalization, significant declines in our expected future cash flows, significant adverse changes in the business climate or slower growth rates, any or all of which could be materially impacted by many of the risk factors discussed herein, may necessitate our taking charges in the future related to the impairment of our goodwill. Future regulatory actions could also have a material impact on assessments of goodwill for impairment. If the fair value of our net assets improves at a faster rate than the market value of our reporting units, or if we were to experience increases in book values of a reporting unit in excess of the increase in fair value of equity, we may also have to take charges related to the impairment of our goodwill. If we were to conclude that a future write-down of our goodwill is necessary, we would record the appropriate charge, which could have a material adverse effect on our results of operations.

Identifiable intangible assets other than goodwill consist of core deposit intangibles and other intangible assets (primarily customer relationships). Adverse events or circumstances could impact the recoverability of these intangible assets including loss of core deposits, significant losses of customer accounts and/or balances, increased competition or adverse changes in the economy. To the extent these intangible assets are deemed unrecoverable, anon-cash impairment charge would be recorded which could have a material adverse effect on our results of operations.

During the fourth quarter of 2015, we determined that the carrying value of our SDN reporting unit exceeded its fair value and recorded a $751 thousand impairment charge. During the second quarter of 2017, we again determined that the carrying value of our SDN reporting unit exceeded its fair value and recorded an additional $1.6 million impairment charge. For further discussion, see Note 1, Summary of Significant Accounting Policies, and Note 7, Goodwill and Other Intangible Assets, to the Consolidated Financial Statements included in Item 8 of this Annual Report on Form10-K.

- 26 -

We operate in a highly competitive industry and market area.

We face substantial competition in all areas of our operations from a variety of different competitors, many of which are larger and may have more financial resources. Such competitors primarily include national, regional and internet banks within the markets in which we operate. We also face competition from many other types of financial institutions, including, without limitation, savings and loan associations, credit unions, finance companies, brokerage firms, insurance companies and other financial intermediaries. The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. Banks, securities firms and insurance companies can merge under the umbrella of a financial holding company, which can offer virtually any type of financial service, including banking, securities underwriting, insurance (both agency and underwriting), and merchant banking. Also, technology has lowered barriers to entry and made it possible for nonbanks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. More recently, peer to peer lending has emerged as an alternative borrowing source for our customers and many othernon-banks offer lending and payment services in competition with banks. Many of these competitors have fewer regulatory constraints and may have lower cost structures. Additionally, due to their size, many competitors may be able to achieve economies of scale and, as a result, may offer a broader range of products and services as well as better pricing for those products and services than we can.

Our ability to compete successfully depends on a number of factors, including, among other things:    

Failure to perform in any of these areas could significantly weaken our competitive position, which could adversely affect our growth and profitability, which, in turn, could have a material adverse effect on our financial condition and results of operations.

Severe weather, natural disasters, acts of war or terrorism, and other external events could significantly impact our business.

Severe weather, natural disasters, acts of war or terrorism, and other adverse external events could have a significant impact on our ability to conduct business. Such events could affect the operations of our bank branches, stability of our deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue, and/or cause us to incur additional expenses. The occurrence of any such event could have a material adverse effect on our business, which, in turn, could have a material adverse effect on our financial condition and results of operations.

Liquidity is essential to our businesses.

Our liquidity could be impaired by an inability to access the capital markets or unforeseen outflows of cash. Reduced liquidity may arise due to circumstances thatevolve, we may be unablerequired to control, such as a general market disruptionexpend significant additional resources to continue to modify or an operational problem that affects third partiesenhance our systems, or us. Our efforts to monitorinvestigate and manage liquidity risk may not be successful or sufficient to deal with dramatic or unanticipated reductionsremediate vulnerabilities in our liquidity. In such events, our cost of funds may increase, thereby reducing our net interest income, or we may need to sell a portion of our investment and/or loan portfolio, which, depending upon market conditions, could result in us realizing a loss.

We may need to raise additional capital in the future and such capital may not be available on acceptable terms or at all.

We may need to raise additional capital in the future to provide sufficient capital resources and liquidity to meet our commitments and business needs. Our ability to raise additional capital, if needed, will depend on our financial performance and, among other things, conditions in the capital markets at that time which is outside of our control.

In addition, we are highly regulated, and our regulators could require us to raise additional common equity in the future. We and our regulators perform a variety of analyses of our assets, including the preparation of stress case scenarios, and as a result of those assessments we could determine, or our regulators could require us, to raise additional capital.

We cannot assure that required capital will be available on acceptable terms or at all. Any occurrence that may limit our accesssystems. Due to the capital markets, such ascomplexity and interconnectedness of information technology systems, the process of enhancing our systems can itself create a decline in the confidencerisk of debt purchasers, depositors of the Bank or counterparties participating in the capital markets, or a downgrade ofsystems disruptions and security issues.

Risks Related to our debt rating, may adversely affect our capital costs and ability to raise capital and, in turn, our liquidity. An inability to raise additional capital on acceptable terms when needed could have a material adverse impact on our business, financial condition, results of operations or liquidity.

- 27 -

We rely on dividends from our subsidiaries for most of our revenue.

We are a separate and distinct legal entity from our subsidiaries. A substantial portion of our revenue comes from dividends from our Bank subsidiary. These dividends are the principal source of funds we use to pay dividends on our common and preferred stock, and to pay interest and principal on our debt. Federal and/or state laws and regulations limit the amount of dividends that our Bank subsidiary may pay to us. Also, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors. In the event our Bank subsidiary is unable to pay dividends to us, we may not be able to service debt, pay obligations, or pay dividends on our common and preferred stock. The inability to receive dividends from our Bank subsidiary could have a material adverse effect on our business, financial condition, and results of operations.

We may not pay or may reduce the dividends on our common stock.

Holders of our common stock are only entitled to receive such dividends as our Board of Directors may declare out of funds legally available for such payments. Although we have historically declared cash dividends on our common stock, we are not required to do so and may reduce or eliminate our common stock dividend in the future. This could adversely affect the market price of our common stock.

We may issue debt and equity securities or securities convertible into equity securities, any of which may be senior to our common stock as to distributions and in liquidation, which could dilute our current shareholders or negatively affect the value of our common stock.

In the future, we may attempt to increase our capital resources by entering into debt or debt-like financing that is unsecured or secured by all or up to all of our assets, or by issuing additional debt or equity securities, which could include issuances of secured or unsecured commercial paper, medium-term notes, senior notes, subordinated notes, preferred stock or securities convertible into or exchangeable for equity securities. In the event of our liquidation, our lenders and holders of our debt and preferred securities would receive a distribution of our available assets before distributions to the holders of our common stock. For example, our outstanding shares of Series A 3% and Series B-1 8.48% Preferred Stock have a preferential right to receive dividends before holders of our common stock. We must declare and pay annual dividends of $3 per share to Series A 3% Preferred Stock holders and of $8.48 per share to Series B-1 8.48% Preferred Stock holders before any dividends or dissolution payments can be paid to holders of common stock. Because our decision to incur debt and issue securities in our future offerings will depend on market conditions and other factors beyond our control, we cannot predict or estimate the amount, timing or nature of our future offerings and debt financings. Further, market conditions could require us to accept less favorable terms for the issuance of our securities in the future. We may also issue additional shares of our common stock or securities convertible into or exchangeable for our common stock that could dilute our current shareholders and effectaffect the value of our common stock.

Our certificate of incorporation, our bylaws, and certain banking laws may have an anti-takeover effect.

Provisions of our certificate of incorporation, our bylaws, and federal and state banking laws, including regulatory approval requirements, could make it more difficult for a third party to acquire us, even if doing so would be perceived to be beneficial to our shareholders. The combination of these provisions may discourage others from initiating a potential merger, takeover or other change of control transaction, which, in turn, could adversely affect the market price of our common stock.

The market price of our common stock may fluctuate significantly in response to a number of factors.

Our quarterly and annual operating results have varied in the past and could vary significantly in the future, which makes it difficult for us to predict our future operating results. Our operating results may fluctuate due to a variety of factors, many of which are outside of our control, including the changing U.S. economic environment and changes in the commercial and residential real estate market, any of which may cause our stock price to fluctuate. If our operating results fall below the expectations of investors or securities analysts, the price of our common stock could decline substantially. Our stock price can fluctuate significantly in response to a variety of factors including, among other things:

General Risk Factors

We may not be able to attract and retain skilled people.

- 28 -Our success depends, in large part, on our ability to attract and retain skilled people. Competition for highly talented people can be intense, and we may not be able to hire sufficiently skilled people or retain them. Further, the rural location of our principal executive offices and many of our bank branches make it challenging for us to attract skilled people to such locations. The unexpected loss of services of one or more of our key personnel could have a material adverse impact on our business because of their skills, knowledge of our markets, years of industry experience, and the difficulty of promptly finding qualified replacement personnel.

Loss of key employees may disrupt relationships with certain customers.

None.Our customer relationships are critical to the success of our business, and loss of key employees with significant customer relationships may lead to the loss of business if the customers were to follow that employee to a competitor. While we believe our relationships with key personnel are strong, we cannot guarantee that all of our key personnel will remain with the organization, which could result in the loss of some of our customers and could have a negative impact on our business, financial condition, and results of operations.

We use financial models for business planning purposes that may not adequately predict future results.

We use financial models to aid in planning for various purposes including our capital and liquidity needs, interest rate risk, potential charge-offs, reserves, and other purposes. The models used may not accurately account for all variables that could affect future results, may fail to predict outcomes accurately and/or may overstate or understate certain effects. As a result of these potential failures, we may not adequately prepare for future events and may suffer losses or other setbacks due to these failures.

We depend on the accuracy and completeness of information about or from customers and counterparties.

In deciding whether to extend credit or enter into other transactions, we may rely on information furnished by or on behalf of customers and counterparties, including financial statements, credit reports, and other financial information. We may also rely on representations of those customers, counterparties, or other third parties, such as independent auditors, as to the accuracy and completeness of that information. Reliance on inaccurate or misleading financial statements, credit reports, or other financial information could cause us to enter into unfavorable transactions, which could have a material adverse effect on our financial condition and results of operations.

Our business may be adversely affected by conditions in the financial markets and economic conditions generally, including macroeconomic pressures such as inflation, supply chain issues, and geopolitical risks associated with international conflict.

Our financial performance generally, and in particular the ability of borrowers to pay interest on and repay principal of outstanding loans and the value of collateral securing those loans, as well as demand for loans and other products and services we offer, is highly dependent on the business environment in the markets where we operate, in the State of New York and in the United States as a whole. Additionally, international conflict, such as the war in Ukraine and the impact of sanctions on Russia and Russian companies may impact global markets, which may create unfavorable or uncertain economic conditions. A favorable business environment is generally characterized by, among other factors, economic growth, efficient capital markets, low inflation, low unemployment, high business and investor confidence, and strong business earnings. Unfavorable or uncertain economic and market conditions can be caused by declines in economic growth, business activity or investor or business confidence; limitations on the availability or increases in the cost of credit and capital; increases in inflation or interest rates; high unemployment, natural disasters; or a combination of these or other factors. The occurrence of any of these conditions could have a material adverse effect on our financial condition and results of operations.

Severe weather, natural disasters, public health emergencies and pandemics, acts of war or terrorism, and other external events could significantly impact our business.

Severe weather, natural disasters, public health emergencies and pandemics, acts of war or terrorism, geopolitical conflicts, and other adverse external events could have a significant impact on our ability to conduct business. Such events could affect the operations of our bank branches, stability of our deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue, and/or cause us to incur additional expenses. Additionally, demand for our products and services may decline; loan delinquencies, problem assets, and foreclosures may increase, resulting in increased charges and reduced income; collateral for loans may decline in value, which could increase loan losses; our allowance for credit losses may have to be increased if borrowers experience financial difficulties; a material decrease in net income could affect our ability to pay cash dividends; cybersecurity risks may be increased as the result of employees working remotely; critical services provided by third-party vendors may become unavailable; government actions and mandates may affect our workforce and infrastructure; and the Company may experience staffing shortages and unanticipated unavailability or loss of key employees. The occurrence of any such event or a combination of the foregoing factors could have a material adverse effect on our business, which, in turn, could have a material adverse effect on our financial condition and results of operations.

Negative public opinion could damage our reputation and impact business operations and revenues.

As a financial institution, our earnings and capital are subject to risk associated with negative public opinion. Negative public opinion could result from our actual or alleged conduct in any number of activities, including lending practices, the failure of any of our products or services to meet our clients’ expectations or applicable regulatory requirements, corporate governance and acquisitions, social media and other marketing activities, the implementation of environmental, social and governance practices or actions taken by government regulators and community organizations in response to any of the foregoing. Negative public opinion could affect our ability to attract and/or retain clients, could expose us to litigation and regulatory action, and could have a material adverse effect on our stock price or result in heightened volatility. Negative public opinion could also affect our ability to borrow funds in the unsecured wholesale debt markets.

Environmental, social and governance matters, and any related reporting obligations may impact our business.

U.S. and international regulators, investors and other stakeholders are increasingly focused on environmental, social, and governance (“ESG”) matters. Additionally, shareholder activism and potential regulatory reform may lead to substantial new regulations and disclosure obligations, including with respect to ESG matters, which may lead to additional compliance costs and impact the manner in which we operate our business in ways that may materially adversely impact our results of operations and financial condition. We could also face potential negative publicity in traditional media or social media if investors determine that we have not adequately considered or addressed ESG matters, which may result in adverse effects on the trading price of our common stock.

ITEM 1B.UNRESOLVED STAFF COMMENTS

None.

ITEM 1C. CYBERSECURITY

Risk Management and Strategy

Based on the complex and continuously evolving cybersecurity threat landscape, we established, manage and continually enhance an enterprise-wide Information Security Program (“ISP”). The ISP is based on the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”). The CSF provides guidance for organizations to better manage and reduce cybersecurity risk while helping organizations understand, assess, prioritize, and communicate cybersecurity risks and mitigation. The ISP encompasses critical management components such as risk management, asset management, access controls, cyber awareness training, data security, detection and response, incident response, and business continuity.

The ISP, which is part of our Enterprise Risk Management Program, is organized in an operating framework that is supported by policies, standards, procedures, and guidelines that establish the information security control environment. Information Security collaborates with additional areas of our Enterprise Risk Management Program to ensure comprehensive risk oversight and reporting. The ISP is designed and implemented to comply with or exceed regulatory control requirements. Multiple internal and independent third-party assessments and audits are conducted annually to ensure our compliance with its policies, controls, and regulatory requirements.

The execution of the ISP relies on our committed investment in people, processes, and technology. We have invested in market-leading technology and award-winning security partners to execute key processes that ensure the confidentiality, integrity, and availability of company assets.

We have a Third-Party Risk Management (“TPRM”) Program that includes the comprehensive evaluation of the cybersecurity risks of prospective and existing third-party relationships. The TPRM Program utilizes a risk-based approach to perform ongoing due diligence reviews of existing third-party relationships and new prospective third parties. Third-party risks are identified and evaluated in coordination with period reviews, although threat intelligence monitoring and sound vendor relationships are leveraged to identify third-party risks as announced. TPRM is a function of our Risk Organization overseen by the Chief Risk Officer (“CRO”).

We have not experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to affect our business strategy, results of operations, or financial condition. Risks relating to cybersecurity and their potential impact are discussed more fully in “Risk Factors” in Part I, Item 1A herein.

Governance

We have established a dedicated team to manage and execute the ISP. A Chief Information Security Officer (“CISO”) has been appointed as a Senior Vice President of the Company. The CISO leads the strategy and execution of the program while ensuring clear lines of communication with executive management, committees, the Board of Directors, and external stakeholders such as regulators and insurance carriers. The CISO was appointed in August 2023 after serving the Company as a senior officer and technology leader for over 15 years and leads a team of Information Security professionals with diverse security backgrounds including relevant certifications (e.g., CISSP, GSEC, GCTI). As a member of our risk organization, the CISO reports to the CRO, a member of the Executive Management Committee. The CRO joined the Company in February 2023 with over 30 years of progressive risk management experience.

The Company Risk Committee (“CRC”) serves as the management committee responsible for Information Security oversight and the CISO is a member of the committee. The Risk Oversight Committee (“ROC”) is a sub-committee of the Board of Directors (the “Board”) and provides direct oversight of Information Security on behalf of the Board. Kim E. VanGelder, the current Chair of the ROC, has served as a member of our Board since 2016, and has held progressive information technology leadership roles at the Eastman Kodak Company, with responsibilities including cybersecurity, global applications, and global technology infrastructure and has served as its Chief Information Officer since 2004.

The CISO reports on the status of the ISP including relevant risks, cybersecurity threats, program updates, and program reporting to the CRC and the ROC no less than four times per year. Any material cybersecurity information, including strategic program development, is reported by the CISO to appropriate management and Board representatives to ensure timely awareness and escalation as necessary. Should there be a cybersecurity incident, we have a formal Incident Response plan including escalation processes designed to keep relevant management and committees informed of the mitigation and remediation efforts. The identification of incidents may come through internal monitoring and detection resources, external threat intelligence, third-party risk management efforts or various other event escalation methods. We leverage a Managed Security Services Provider (“MSSP”) for supplemental expertise and resources with the management and enhancement of critical threat monitoring solutions. The MSSP also provides industry-leading Security Operations Center services that serve as a critical source for event and incident detection.

The Board is actively engaged in the oversight and prudent management of risk, including those relating to cybersecurity and regulatory compliance. A comprehensive program update is delivered to the Board annually by the CISO. The Board annually reviews and approves the ISP and related Information Security policies to ensure alignment with the Company’s risk appetite and strategic defense amidst the evolving cybersecurity risk landscape.

ITEM 2.PROPERTIES

We own a 27,400 square foot building in Warsaw, New York that serves as our headquarters, and principal executive and administrative offices. We lease a 52,300 square foot regional administrative facility located in Rochester, New York. This lease expires in August 2027, with options for two additionalten-year extensions. We also lease a 28,500 square foot facility in Amherst, New York, which serves as a regional administrative facility, as well as an operations facility for SDN. This lease expires in December 2032, with two additional five-year extensions.

We are engaged in the banking business through 5348 branch offices, of which 3531 are owned and 1817 are leased, in the following fifteenfourteen contiguous counties of Western and Central New York: Allegany, Cattaraugus, Cayuga, Chautauqua, Chemung, Erie, Genesee, Livingston, Monroe, Ontario, Orleans, Seneca, Steuben, Wyoming and Yates Counties. The operating leases for our branch offices expire at various dates through the year 20472061 and generally include options to renew. The Bank also has administrative operations at a leased facility in Amherst, New York.

SDN operates from a leased 14,400 square foot office located in Williamsville, New York. The lease for such space, which is used by SDN and several of our Bank’s commercial lenders, extends through September 2021. SDN also leases one retail location.

Courier Capital operates from an owned 11,000 square foot office, located in Buffalo, New York. Courier Capital also has operations at a leased facility in Amherst, New York and an owned facility in Jamestown, New York.

We believe that our properties have been adequately maintained, are in good operating condition and are suitable for our business as presently conducted, including meeting the prescribed security requirements. For additional information, see Note 6,7, Premises and Equipment, Net, and Note 11,14, Commitments and Contingencies, in the accompanying financial statements included in Part II, Item 8, of this Annual Report on Form10-K.

ITEM 3.LEGAL PROCEEDINGS

FromWe are party to an action filed against us on May 16, 2017 by Matthew L. Chipego, Charlene Mowry, Constance C. Churchill and Joseph W. Ewing in the Court of Common Pleas in Philadelphia, Pennsylvania. Plaintiffs sought class certification to represent classes of consumers in New York and Pennsylvania along with statutory damages, interest and declaratory relief. The plaintiffs sought to represent a putative class of consumers who are alleged to have obtained direct or indirect financing from us for the purchase of vehicles that we later repossessed. The plaintiffs specifically claim that the notices the Bank sent to defaulting consumers after their vehicles were repossessed did not comply with the relevant portions of the Uniform Commercial Code in New York and Pennsylvania. We dispute and believe we have meritorious defenses against these claims and plan to vigorously defend ourselves.

On September 30, 2021, the Court granted plaintiffs’ motion for class certification and certified four different classes (two classes of New York consumers and two classes of Pennsylvania consumers). There are approximately 5,200 members in the New York classes and 300 members in the Pennsylvania classes.

On September 26, 2022, the lower Court denied the plaintiffs’ motion for partial summary judgment for most of the relief they seek and found that there were questions of fact as to whether the members of the class had purchased the subject vehicles for “consumer use” within the meaning of the relevant statutes. The Court also denied our motion for partial summary judgment seeking an offset in the form of recoupment reducing any liability that may be imposed against us by the amounts that the borrowers owe for failing to repay their motor vehicle loans, determining that the Court could not enter a judgment on recoupment — which is a set off from liability — without first determining whether there was liability.

On October 7, 2022, the Superior Court of Pennsylvania granted our December 20, 2021 Request for an Interlocutory Appeal of the denial of our motion to dismiss the claims brought by New York borrowers for lack of subject matter jurisdiction and lack of standing.

In a Memorandum filed on February 13, 2024, the Superior Court affirmed the decision of the lower court, holding that trial court has subject matter jurisdiction over the New York part of this action and that the New York plaintiffs have standing to pursue relief against us. The Superior Court also remanded the case to the lower court for further proceedings, which will include the completion of any remaining discovery and an adjudication of the open claims and defenses that have been asserted in the case. Once the lower court has issued a final adjudication, the parties will have an opportunity to appeal adverse rulings in the case.

We have not accrued a contingent liability for this matter at this time to timebecause, given our defenses, we are unable to conclude whether a partyliability is probable to occur nor are we able to currently reasonably estimate the amount of potential loss.

If we settle these claims or otherwise involvedthe action is not resolved in our favor, we may suffer reputational damage and incur legal proceedings arising out ofcosts, settlements or judgments that exceed the normal course of business. Managementamounts covered by our insurer. We can provide no assurances that our insurer will cover the full legal costs, settlements or judgments we incur. If we are unsuccessful in defending ourselves from these claims or if our insurer does not believe that there is any pending or threatened proceeding against us, which, if determinedcover the full amount of legal costs we incur, the result may materially adversely would have a material adverse effect onaffect our business, results of operations orand financial condition.

Other than as described above, at December 31, 2023, the Company is not involved in any pending legal proceedings other than routine legal proceedings occurring in the ordinary course of business, which involve amounts in the aggregate believed by management to be immaterial to the financial condition and operating results of the Company.

ITEM 4.MINE SAFETY DISCLOSURES

Not applicable.

- 29 -

PART II

ITEM 5. MARKET FOR REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES

Our common stock is traded on the NASDAQNasdaq Global Select Market under the ticker symbol “FISI.” At February 23, 2018, 15,904,40328, 2024, 15,408,580 shares of our common stock were outstanding and held by approximately 3,400there were 255 registered shareholders of record. During 2017, the high sales price of our common stock was $35.40 and the low sales price was $25.65. The closing price per share of our common stock on December 29, 2017, the last trading day of our fiscal year, was $31.10. We declared dividends of $0.85 per common share during the year ended December 31, 2017. See additional information regarding the market price and dividends paid in Part II, Item 6, “Selected Financial Data.”

We have paid regular quarterly cash dividends on our common stock and our Board of Directors presently intends to continue this practice, subject to our results of operations and the need for those funds for debt service and other purposes. See the discussions in the section captioned “Supervision and Regulation” included in Part I, Item 1, “Business,” in the section captioned “Liquidity and Capital Resources”Management” included in Part II, Item 7, in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and in Note 12,14, Regulatory Matters, in the accompanying financial statements included in Part II, Item 8, “Financial Statements and Supplementary Data,” all of which are included elsewhere in this report and incorporated herein by reference thereto.

In June 2022, the Company’s Board of Directors (the “Board.”) authorized a share repurchase program for up to 766,447 shares of common stock (the “2022 Repurchase Program.”). The program will expire at the earlier of the completion of all share repurchases or a Board vote to retire the program. During the quarter ended December 31, 2023, there were no shares repurchased pursuant to the 2022 Repurchase Program.

The Company’s repurchases of its common shares during the fourth quarter of 2023 were as follows:

(1) This column reflects the deemed surrendered to us of common stock to satisfy tax withholding obligations in connection with the vesting of employee restricted stock units.

Stock Performance Graph

The stock performance graph below compares (a) the cumulative total return on our common stock for the period beginning December 31, 20122018 as reported by the NASDAQNasdaq Global Select Market, through December 31, 2017,2023, (b) the cumulative total return on stocks included in the NASDAQ Composite Index over the same period, and (c) the cumulative total return as compiled by S&P Global Market Intelligence, formerly SNL Financial LC (“SNL”), of Major Exchange (NYSE, NYSE MKTthe Standard and NASDAQ)Poor’s (“S&P”) U.S. SmallCap Banks with $1 billion to $5 billion in assetsIndex over the same period. Cumulative return assumes the reinvestment of dividends. During 2021, all SNL indices were replaced with S&P Dow Jones indices. The SNL Bank $1B-$5B Index that has historically been used in our performance graph has therefore been replaced with the comparable S&P U.S. SmallCap Banks Index. The graph was prepared by S&P Global Market Intelligence and is expressed in dollars based on an assumed investment of $100.

ITEM 6. [RESERVED]