Table of Contents

Our indirect and consumer lending involves risk elements in addition to normal credit risk.

A portion of our current lending involves the purchase of consumer automobile installment sales contracts from automobile dealers located in Western, Central and the Capital District of New York, and Northern and Central Pennsylvania. These loans are for the purchase of new or used automobiles. We serve customers that cover a range of creditworthiness, and counterparties.

In deciding whether to extend credit or enter into other transactions, we may rely on information furnished by or on behalf of customersthe required terms and counterparties, including financial statements, credit reports, and other financial information. We may also rely on representationsrates are reflective of those customers, counterparties, orrisk profiles. While these loans have higher yields than many of our other third parties,loans, such loans involve risk elements in addition to normal credit risk. Additional risk elements associated with indirect lending include the limited personal contact with the borrower as independent auditors, as toa result of indirect lending through non-bank channels, namely automobile dealers. While indirect automobile loans are secured, such loans are secured by depreciating assets and characterized by loan-to-value ratios that could result in us not recovering the accuracy and completenessfull value of that information. Reliance on inaccurate or misleading financial statements, credit reports, or other financial information could cause us to enter into unfavorable transactions, whichan outstanding loan upon default by the borrower. If the losses from our indirect loan portfolio are higher than anticipated, it could have a material adverse effect on our financial condition and results of operations.

Our insurance brokerage subsidiary, SDN, is subject to risk related to the insurance industry.

SDN derives the bulk of its revenue from commissions and fees earned from brokerage services. SDN does not determine the insurance premiums on which its commissions are based.    Insurance premiums are cyclical in nature and may vary widely based on market conditions. As a result, insurance brokerage revenues and profitability can be volatile. As insurance companies outsource the production of premium revenue tonon-affiliated brokers or agents such as SDN, those insurance companies may seek to further minimize their expenses by reducing the commission rates payable to insurance agents or brokers, which could adversely affect SDN’s revenues. In addition, there have been and may continue to be various trends in the insurance industry toward alternative insurance markets including, among other things, increased use of self-insurance, captives, and risk retention groups. While SDN has been able to participate in certain of theseour consumer lending activities and earn fees for such services, there can be no assurance that we will realize revenues and profitability as favorable as those realized from SDN’s traditional brokerage activities.

Our investment advisory and wealth management operations are subject to risk related to the financial services industry.

The financial services industry is subject to extensive regulation at the federal and state levels. It is very difficult to predict the future impact of the legislative and regulatory requirements affecting our business. The securitiesnumerous consumer protection laws and other laws that govern the activities of our registered investment advisor are complexregulations, and subject to change. The activities of our investment advisory and wealth management operations are subject primarily to provisions of the Advisers Act and the Employee Retirement Income Act of 1940, as amended (“ERISA”). We are a fiduciary under ERISA. Our investment advisory services are also subject to state laws including anti-fraud laws and regulations. Any claim of noncompliance, regardless of merit or ultimate outcome, could subject us to investigation by the SEC or other regulatory authorities. Our compliance processes may not be sufficient to prevent assertions thatif we failedwere unable to comply with anythe regulations applicable law, rule or regulation. Ifto our investment advisoryconsumer lending activities, our financial condition and wealth management operations are subject to investigation by the SEC or other regulatory authorities or if litigation is brought by clients based on our failure to comply with applicable regulations, our results of operations could be materially adversely effected.

In addition, the majority of our investment advisory revenue is from fees based on the percentage of assets under management. The value of the assets under management is determined, in part by market conditions that can be volatile. As a result, investment advisory revenues and profitability can fluctuate with market conditions.

We may be unable to successfully implement our growth strategies, including the integration and successful managementadversely affected.

Lack of newly-acquired businesses.

Our current growth strategy is multi-faceted. We seek to expand our branch network into nearby areas, make strategic acquisitions of loans, portfolios, other regional banks andnon-banking firms whose businesses we feel may be complementary with ours, and to continue to organically grow our core deposits. Any failure by us to effectively implement any one or more of these growth strategies could have several negative effects, including a possible declineseasoning in the size or the quality, or both,portions of our loan portfolio orcould increase risk of credit defaults in the future.

As a decrease in profitability caused by an increase in operating expenses.

In particular, we hope to continue an active merger and acquisition strategy. However, even if we useresult of our common stockgrowth over the past several years, certain portions of our loan portfolio, such as the predominant formincreased size of consideration,our commercial loan portfolio and in particular the PPP loans we originated, are of relatively recent origin. Loans may not begin to show signs of credit deterioration or default until they have been outstanding for some period of time, a process referred to as “seasoning.” As a result, a portfolio of older loans will usually behave more predictably than a newer portfolio. Because these portions of our portfolio are relatively new, the current level of delinquencies and defaults may not represent the level that may prevail as the portfolio becomes more seasoned. If delinquencies and defaults increase, we may need to raise capital in order to negotiate a transaction on terms acceptable to us and there can be no assurance that we will be able to raise a sufficient amount of capital to enable us to complete an acquisition. It is also possible that even with adequate capital we may still be unable to complete an acquisition on favorable terms, causing us to miss opportunitiesrequired to increase our earningsprovision for loan losses, which could have an adverse effect on our business, financial condition and expandresults of operations.

We accept deposits that do not have a fixed term and which may be withdrawn by the customer at any time for any reason.

At December 31, 2020, we had $3.39 billion of deposit liabilities that have no maturity and, therefore, may be withdrawn by the depositor at any time. These deposit liabilities include our checking, savings, and money market deposit accounts.

Market conditions may impact the competitive landscape for deposits in the banking industry. The low rate environment and future actions the Federal Reserve may take may impact pricing and demand for deposits in the banking industry. The withdrawal of more deposits than we anticipate could have an adverse impact on our profitability as this source of funding, if not replaced by similar deposit funding, would need to be replaced with wholesale funding, the sale of interest-earning assets, or diversifya combination of these two actions. The replacement of deposit funding with wholesale funding could cause our operations.

- 21 -

Our growth strategy isoverall cost of funding to increase, which would reduce our net interest income. A loss of interest-earning assets could also dependent upon the successful integration of new businesses, including SDN and Courier Capital, as well as any future acquisitions, intoreduce our existing operations. While our senior management team has had extensive experience in acquisitions and post-acquisition integration, there is no guarantee that our current or future integration efforts will be successful, and if our senior management is forced to spend a disproportionate amount of time on integrating recently-acquired businesses, it may distract their attention from other growth opportunities.net interest income.

We are subject to environmental liability risk associated with our lending activities.

A significant portion of our loan portfolio is secured by real property. During the ordinary course of business, we may foreclose on and take title to properties securing certain loans. There is a risk that hazardous or toxic substances could be found on properties we have foreclosed upon. If hazardous or toxic substances are found, we may be liable for remediation costs, as well as for personal injury and property damage regardless of whether we knew, had reason to know of, or caused the release of such substance. Environmental laws may require us to incur substantial expenses and may materially reduce the affected property’s value or limit our ability to use or sell the affected property. In addition, future laws or more stringent interpretations or enforcement policies with respect to existing laws may increase our exposure to environmental liability. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on our financial condition and results of operations.

Our commercial businessWe operate in a highly competitive industry and mortgage loans increasemarket area.

We face substantial competition in all areas of our exposure to credit risks.

At December 31, 2017, our portfoliooperations from a variety of commercial businessdifferent competitors, many of which are larger and mortgage loans totaled $1,259.2 million, or 46.1% of total loans.may have more financial resources than us. Such competitors primarily include national, regional and internet banks within the markets in which we operate. We plan to continue to emphasize the origination of thesealso face competition from many other types of loans, which generally expose us to a greater risk of nonpaymentfinancial institutions, including, without limitation, savings and loss than residential real estate or consumer loans because repayment of such loans often depends on the successful operationsloan associations, credit unions, finance companies, brokerage firms, insurance companies and income stream of the borrowers. Additionally, such loans typically involve larger loan balances to single borrowers or groups of related borrowers compared to consumer loans or residential real estate loans. A sudden downturn in the economyother financial intermediaries. The financial services industry could result in borrowers being unable to repay their loans, thus exposing us to increased credit risk.

Our indirect lending involves risk elements in addition to normal credit risk.

A portion of our current lending involves the purchase of consumer automobile installment sales contracts from automobile dealers located in Western, Central and the Capital District of New York, and Northern and Central Pennsylvania. These loans are for the purchase of new or used automobiles. We serve customers that cover a range of creditworthiness, and the required terms and rates are reflective of those risk profiles. While these loans have higher yields than many of our other loans, such loans involve risk elements in addition to normal credit risk. Additional risk elements associated with indirect lending include the limited personal contact with the borrowerbecome even more competitive as a result of indirectlegislative, regulatory and technological changes and continued consolidation. Banks, securities firms and insurance companies can merge under the umbrella of a financial holding company, which can offer virtually any type of financial service, including banking, securities underwriting, insurance (both agency and underwriting), and merchant banking. Also, technology has lowered barriers to entry and made it possible for nonbanks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. More recently, peer to peer lending throughnon-bank channels, namely automobile dealers. While indirect automobile loans are secured, such loans are secured by depreciating assetshas emerged as an alternative borrowing source for our customers and characterized byloan-to-value ratios thatmany other non-banks offer lending and payment services in competition with banks. Many of these competitors have fewer regulatory constraints and may have lower cost structures. Additionally, due to their size, many of our larger competitors may be able to achieve economies

-22 -

Table of Contents

of scale and, as a result, may offer a broader range of products and services as well as better pricing for those products and services than we can.

Our ability to compete successfully depends on a number of factors, including, among other things:

Failure to perform in any of these areas could resultsignificantly weaken our competitive position, which could adversely affect our growth and profitability, which, in us not recovering the full value of an outstanding loan upon default by the borrower. If the losses from our indirect loan portfolio are higher than anticipated, itturn, could have a material adverse effect on our financial condition and results of operations.

We accept depositsChanges to and replacement of the LIBOR Benchmark Interest Rate may adversely affect our business, financial condition, and results of operations.

In 2017, the United Kingdom’s Financial Conduct Authority, a regulator of financial services firms and financial markets in the United Kingdom, stated that do notit will only support the regulatory oversight of the London Interbank Offered Rate ("LIBOR") interest rate indices through 2021. This announcement, and, more generally, financial benchmark reforms and changes in the interbank lending markets, have resulted in uncertainty about the interest rate benchmarks that will be used in the future. In the United States, efforts to identify a set of alternative U.S. dollar reference interest rates are ongoing, and the Alternative Reference Rate Committee has recommended the use of a Secured Overnight Funding Rate (“SOFR”). SOFR is different from LIBOR in that it is a retrospective-looking secured rate rather than a forward-looking unsecured rate. These differences could lead to a greater disconnect between our and the Bank’s costs to raise funds for SOFR as compared to LIBOR. In addition to the discontinuance of LIBOR, there may be future changes in the rules or methodologies used to calculate SOFR or other benchmarks, which may have a fixed termmaterial adverse effect on the value of or return on our financial assets and liabilities that are based on or are linked to LIBOR and other benchmarks. The uncertainty related to these changes may have an unpredictable impact on the financial markets and could adversely impact our financial condition or results of operations.

Legal and Regulatory Risks

Legal and regulatory proceedings and related matters could adversely affect us and the banking industry in general.

We have been, and may in the future be, subject to various legal and regulatory proceedings, including class action litigation. It is inherently difficult to assess the outcome of these matters, and there can be no assurance that we will prevail in any proceeding or litigation. Legal and regulatory matters of any degree of significance could result in substantial cost and diversion of our efforts, which by itself could have a material adverse effect on our financial condition and operating results.

As disclosed in Part I, Item 3, “Legal Proceedings,” an action has been brought against us by four individuals seeking to represent a putative class of consumers who are alleged to have obtained direct or indirect financing from us for the purchase of vehicles that we later repossessed. If we settle these claims or the litigation is not resolved in our favor, we may suffer reputational damage and incur legal costs, settlements or judgments that exceed the amounts covered by our existing insurance policies. We can provide no assurances that our insurer will insure the legal costs, settlements or judgements we incur in excess of our deductible. If we are not successful in defending ourselves from these claims, or if our insurer does not insure us against legal costs we incur in excess of our deductible, the result may materially adversely affect our business, results of operations and financial condition. Further, adverse determinations in such matters could result in actions by our regulators that could materially adversely affect our business, financial condition or results of operations. There can be no guarantee that proceedings that may have a material adverse effect on our business, results of operations or financial condition will not arise in the near or long-term future.

We establish reserves for legal claims when payments associated with the claims become probable and the costs can be reasonably estimated. We may still incur legal costs for a matter even if we have not established a reserve. In addition, due to the inherent subjectivity of the assessments and unpredictability of the outcome of legal proceedings, the actual cost of resolving a legal claim may be withdrawn bysubstantially higher than any amounts reserved for that matter. The ultimate resolution of a pending legal proceeding, depending on the customer at any time for any reason.

At December 31, 2017, we had $2.36 billionremedy sought and granted, could adversely affect our results of deposit liabilities that have no maturityoperations and therefore, may be withdrawn by the depositor at any time. These deposit liabilities include our checking, savings, and money market deposit accounts.

Market conditions may impact the competitive landscape for deposits in the banking industry. The unprecedented low rate environment and future actions the Federal Reserve may take may impact pricing and demand for deposits in the banking industry. The withdrawal of more deposits than we anticipate could have an adverse impact on our profitability as this source of funding, if not replaced by similar deposit funding, would need to be replaced with wholesale funding, the sale of interest-earning assets, or a combination of these two actions. The replacement of deposit funding with wholesale funding could cause our overall cost of funding to increase, which would reduce our net interest income. A loss of interest-earning assets could also reduce our net interest income.financial condition.

Any future FDIC insurance premium increases may adversely affect our earnings.

The amount that is assessed by the FDIC for deposit insurance is set by the FDIC based on a variety of factors. These include the depositor insurance fund’s reserve ratio, the Bank’s assessment base, which is equal to average consolidated total assets minus average tangible equity, and various inputs into the FDIC’s assessment rate calculation.

-23 -

Table of Contents

If there are financial institution failures, we may be required to pay higher FDIC premiums. Such increases of FDIC insurance premiums may adversely impact our earnings. See the section captioned “Supervision and Regulation” included in Part I, Item 1 “Business, Supervision and Regulation-Federal Deposit Insurance Assessments”“Business” for more information about FDIC insurance premiums.

- 22 -

We are highly regulated, and any adverse regulatory action may result in additional costs, loss of business opportunities, and reputational damage.

As described in the section captioned “Supervision and Regulation” included in Part I, Item 1, “Business,” both our Banking and Non-Banking segments are subject to extensive supervision, regulation and examination. The various regulatory authorities with jurisdiction over us have significant latitude in addressing our compliance with applicable laws and regulations including, but not limited to, those governing consumer credit, fair lending, anti-money laundering, anti-terrorism, capital adequacy, asset quality and risk, management ability and performance, earnings, liquidity, and various other factors affecting us. As part of this regulatory structure, we are subject to policies and other guidance developed by the regulatory agencies with respect to, among other things, capital levels, the timing and amount of dividend payments, the classification of assets and the establishment of adequate loan loss reserves for regulatory purposes. Our regulators have broad discretion to impose monetary fines or restrictions and limitations on our operations if they determine, for any reason, that our operations are unsafe or unsound, fail to comply with applicable law or are otherwise inconsistent with laws and regulations or with the supervisory policies of these agencies.

This supervisory framework could materially impact the conduct, growth and profitability of our operations. Any failure on our part to comply with current laws, regulations, other regulatory requirements or safe and sound banking, insurance, or investment advisory practices or concerns about our financial condition, or any related regulatory sanctions or adverse actions against us, could increase our costs or restrict our ability to expand our business and result in damage to our reputation.

In March 2018, we were notified by the FRB of New York that its most recent evaluation of the Bank’s CRA performance for the time period January 2011 through September 2013, resulted in an overall rating of “Needs to Improve.” This rating may subject the Bank to enhanced scrutiny in any application for business expansion it files with the Federal Reserve or the NY DFS, which may result in a delay in approving or the denial of such application. In addition, the publication of the “Needs to Improve” rating may damage our reputation, making it more difficult for us to achieve our business goals and objectives, particularly in the Buffalo and Rochester metropolitan areas.

The policies of the Federal Reserve have a significant impact on our earnings.

The policies of the Federal Reserve impact us significantly. The Federal Reserve regulates the supply of money and credit in the United States. Its policies directly and indirectly influence the rate of interest earned on loans and paid on borrowings and interest-bearing deposits and can also affect the value of financial instruments we hold. Those policies determine, to a significant extent, our cost of funds for lending and investing and impact our net interest income, our primary source of revenue. Changes in those policies are beyond our control and are difficult to predict. Federal Reserve policies can also affect our borrowers, potentially increasing the risk that they may fail to repay their loans. For example, a tightening of the money supply by the Federal Reserve could reduce the demand for a borrower’s products and services. This could adversely affect the borrower’s earnings and ability to repay its loan, which could have a material adverse effect on our financial condition and results of operations.

Risks Related to Non-Banking Activities

Our insurance brokerage subsidiary is subject to risk related to the insurance industry.

SDN derives the bulk of its revenue from commissions and fees earned from brokerage services. SDN does not determine the insurance premiums on which its commissions are based. Insurance premiums are cyclical in nature and may vary widely based on market conditions. As a result, insurance brokerage revenues and profitability can be volatile. As insurance companies outsource the production of premium revenue to non-affiliated brokers or agents such as SDN, those insurance companies may seek to further minimize their expenses by reducing the commission rates payable to insurance agents or brokers, which could adversely affect SDN’s revenues.    In addition, there have been and may continue to be various trends in the insurance industry toward alternative insurance markets including, among other things, increased use of self-insurance, captives, and risk retention groups. While SDN has been able to participate in certain of these activities and earn fees for such services, there can be no assurance that we will realize revenues and profitability as favorable as those realized from SDN’s traditional brokerage activities.

Our investment advisory and wealth management operations are subject to risk related to the regulation of the financial services industry and market volatility.

The financial services industry is subject to extensive regulation at the federal and state levels. It is very difficult to predict the future impact of the legislative and regulatory requirements affecting our business. The securities laws and other laws that govern the activities of our registered investment advisor are complex and subject to change. The activities of our investment advisory and wealth management operations are subject primarily to provisions of the Advisers Act and the Employee Retirement Income Act of

-24 -

Table of Contents

1940, as amended (“ERISA”). We are a fiduciary under ERISA. Our investment advisory services are also subject to state laws including anti-fraud laws and regulations.

In addition, the broker-dealer services provided by Courier Capital and HNP Capital are subject to Regulation Best Interest, which requires a broker-dealer to act in the best interest of a retail customer when making a recommendation to that customer of any securities transaction or investment strategy involving securities. The regulation imposes heightened standards on broker-dealers and will require us to review and modify the policies and procedures of our wealth management operations, as well as associated supervisory and compliance controls.

Any claim of noncompliance, regardless of merit or ultimate outcome, could subject us to investigation by the SEC or other regulatory authorities. Our compliance processes may not be sufficient to prevent assertions that we failed to comply with any applicable law, rule or regulation. If our investment advisory and wealth management operations are subject to investigation by the SEC or other regulatory authorities or if litigation is brought by clients based on our failure to comply with applicable regulations, our results of operations could be materially adversely affected.

In addition, the majority of our investment advisory revenue is from fees based on the percentage of assets under management. The value of the assets under management is determined, in part, by market conditions that can be volatile. As a result, investment advisory revenues and profitability can fluctuate with market conditions.

Strategic and Operational Risks

We make certain assumptions and estimates in preparing our financial statements that may prove to be incorrect, which could significantly impact our results of operations, cash flows and financial condition, and we are subject to new or changing accounting rules and interpretations, and the failure by us to correctly interpret or apply these evolving rules and interpretations could have a material adverse effect.

Accounting principles generally accepted in the United States require us to use certain assumptions and estimates in preparing our financial statements, including in determining credit loss reserves and reserves related to litigation, among other items. Certain of our financial instruments, includingavailable-for-sale securities and certain loans, require a determination of their fair value in order to prepare our financial statements. Where quoted market prices are not available, we may make fair value determinations based on internally developed models or other means, which ultimately rely to some degree on management judgment. Some of these and other assets and liabilities may have no direct observable price levels, making their valuation particularly subjective, as they are based on significant estimation and judgment. In addition, sudden illiquidity in markets or declines in prices of certain loans and securities may make it more difficult to value certain balance sheet items, which may lead to the possibility that such valuations will be subject to further change or adjustment. If assumptions or estimates underlying our financial statements are incorrect, we may experience material losses that would impact our results of operations, cash flows and financial condition.

As indicated in Note 1, Summary of Significant Accounting Policies - Recent Accounting Pronouncements, to the Consolidated Financial Statements included in Item 8 of this Annual Report on Form10-K, the regulations, rules, standards, policies, and interpretations underlying GAAP are constantly evolving and may change significantly over time. In particular, effective January 1, 2020, we have implemented FASB’s Accounting Standards Update 2016-13, Financial Instruments – Credit Losses (Topic 326) – Measurement of Credit Losses on Financial Instruments, which requires us to recognize an allowance for credit losses based on historical experience, current conditions and reasonable and supportable forecasts, as opposed to recognizing an allowance when it is probable that a loss has been incurred. This change in GAAP increased our allowance for credit losses and created more volatility in the level of our allowance for credit losses, and has been, and will continue to be, impacted by the Company’s loan and securities portfolios’ composition, attributes and quality. If we fail to interpret any one or more of these GAAP provisions correctly, or if our methodology in applying them to our financial reporting or disclosures is at all flawed, our financial statements may contain inaccuracies that, if severe enough, could warrant a later restatement by us, which in turn could result in a material adverse event.

LegalThe value of our goodwill and regulatory proceedingsother intangible assets may decline in the future.

As of December 31, 2020, we had $66.1 million of goodwill and related matters$7.7 million of other intangible assets. Although we did not record any impairment to our goodwill during 2020, significant and sustained declines in our stock price and market capitalization, significant declines in our expected future cash flows, significant adverse changes in the business climate or slower growth rates, any or all of which could adversely affect us andbe materially impacted by the banking industry in general.

We have been, andongoing COVID-19 pandemic, may necessitate our taking charges in the future be, subjectrelated to various legalthe impairment of our goodwill. If the recent capital markets downturn resulting from the COVID-19 pandemic continues for an extended period of time, or the capital markets continue to experience increased volatility, we may record an impairment to our goodwill in subsequent fiscal periods. Future regulatory actions could also have a material impact on assessments of goodwill for impairment. If the fair value of our net assets improves at a faster rate than the market value of our reporting units, or if we were to experience increases in book values of a reporting unit in excess of the increase in fair value of equity, we may also have to take charges related to the impairment of our goodwill. If we were to conclude that a future write-down of our goodwill is necessary, we would record the appropriate charge, which could have a material adverse effect on our results of operations.

-25 -

Table of Contents

Identifiable intangible assets other than goodwill consist of core deposit intangibles and regulatory proceedings. It is inherently difficult to assessother intangible assets (primarily customer relationships). Adverse events or circumstances could impact the outcomerecoverability of these matters,intangible assets including loss of core deposits, significant losses of customer accounts and/or balances, increased competition or adverse changes in the economy, such as those related to the ongoing COVID-19 pandemic. To the extent these intangible assets are deemed unrecoverable, a non-cash impairment charge would be recorded which could have a material adverse effect on our results of operations.

During the fourth quarter of 2018, we determined that the carrying value of our SDN reporting unit exceeded its fair value and recorded a $2.4 million impairment charge. For further discussion, see Note 1, Summary of Significant Accounting Policies, and Note 8, Goodwill and Other Intangible Assets, to the Consolidated Financial Statements included in Item 8 of this Annual Report on Form 10-K.

We may be unable to successfully implement our growth strategies, including the integration and successful management of newly-acquired businesses.

Our current growth strategy is multi-faceted. We seek to expand our branch network into nearby areas, make strategic acquisitions of loans, portfolios, other regional banks and non-banking firms whose businesses we feel may be complementary with ours, and to continue to organically grow our core deposits. Any failure by us to effectively implement any one or more of these growth strategies could have several negative effects, including a possible decline in the size or the quality, or both, of our loan portfolio or a decrease in profitability caused by an increase in operating expenses.

We hope to continue an active merger and acquisition strategy. However, even if we use our common stock as the predominant form of consideration, we may need to raise capital to negotiate a transaction on terms acceptable to us and there can be no assurance that we will prevailbe able to raise a sufficient amount of capital to enable us to complete an acquisition. It is also possible that even with adequate capital we may still be unable to complete an acquisition on favorable terms, causing us to miss opportunities to increase our earnings and expand or diversify our operations.

Our growth strategy is also dependent upon the successful integration of new businesses and any future acquisitions into our existing operations. While our senior management team has had extensive experience in any proceeding or litigation. Legalacquisitions and regulatory matters of any degree of significance could result in substantial cost and diversion of our efforts, which by itself could have a material adverse effect on our financial condition and operating results. While, as disclosed in Part I, Item 3, “Legal Proceedings,” our management does not believe thatpost-acquisition integration, there are any pending or threatened proceedings against us, that, if determined adversely, would have a material adverse effect on our business, results of operations or financial condition, there can beis no guarantee that suchour current or future integration efforts will be successful, and if our senior management is forced to spend a proceeding will not arise in the near or long-term future. Further, adverse determinations in such matters could result in actions by our regulators that could materially adversely affect our business, financial condition or resultsdisproportionate amount of operations.

We establish reserves for legal claims when payments associated with the claims become probable and the costs can be reasonably estimated. Wetime on integrating recently-acquired businesses, it may still incur legal costs for a matter even if we have not established a reserve. In addition, due to the inherent subjectivity of the assessments and unpredictability of the outcome of legal proceedings, the actual cost of resolving a legal claim may be substantially higher than any amounts reserved for that matter. The ultimate resolution of a pending legal proceeding, depending on the remedy sought and granted, could adversely affect our results of operations and financial condition.

- 23 -

A breach in security of our or third party information systems, including the occurrence of a cyber incident or a deficiency in cybersecurity, or a failure by us to comply with enhanced New York State cybersecurity regulations, may subject us to liability, result in a loss of customer business or damage our brand image.

We rely heavily on communications, information systems (both internal and provided by third parties) and the internet to conduct our business. Our business depends on our ability to process and monitor a large volume of daily transactions in compliance with legal, regulatory and internal standards and specifications. In addition, a significant portion of our operations relies heavily on the secure processing, storage and transmission of personal and confidential information of our customers and clients. These risks may increase in the future as our customers continue to adapt to mobile payment and other internet-based product offerings and we expand the availability ofweb-based products and applications.

In addition, several U.S. financial institutions have experienced significant distributeddenial-of-service attacks, some of which involved sophisticated and targeted attacks intended to disable or degrade service, or sabotage systems. Other potential attacks have attempted to obtain unauthorized access to confidential information or destroy data, often through the introduction of computer viruses or malware, cyber-attacks and other means. To date, none of these types of attacks have had a material effect ondistract their attention from operating our business or operations. Such security attacks can originate frompursuing other growth opportunities.

Acquisitions may disrupt our business and dilute shareholder value.

We intend to continue to pursue a wide varietygrowth strategy for our business by expanding our branch network into communities within or adjacent to markets where we currently conduct business. We may consider acquisitions of sources, including persons who are involved with organized crimeloans or whosecurities portfolios, lending or leasing firms, commercial and small business lenders, residential lenders, direct banks, banks or bank branches, wealth and investment management firms, securities brokerage firms, specialty finance or other financial services-related companies. We also intend to expand our non-banking subsidiaries, SDN, Courier Capital and HNP Capital, by acquiring smaller insurance agencies and wealth management firms in areas which complement our current footprint. We may be linkedunsuccessful in expanding our non-banking subsidiaries through acquisition because of the growing interest in acquiring insurance brokers and wealth management firms, which could make it more difficult for us to terrorist organizationsidentify appropriate targets and could make such acquisitions more expensive. Even if we are able to identify appropriate acquisition targets, we may not have sufficient capital to fund acquisitions or hostile foreign governments. Those same partiesbe able to execute transactions on favorable terms. If we are unable to expand our non-banking operations through smaller acquisitions, we may also attemptnot be able to fraudulently induce employees, customers or other usersachieve all of our systems to disclose sensitive information in order to gain access to our data or thatthe expected benefits of our customers or clients. We are also subject to the risk that our employees may interceptSDN, Courier Capital and transmit unauthorized confidential or proprietary information. An interception, misuse or mishandling of personal, confidential or proprietary information being sent to or received from a customer or third party could result in legal liability, remediation costs, regulatory action and reputational harm, any ofHNP Capital acquisitions, which could adversely affect our results of operations and financial condition.

AsAcquiring other banks, businesses, or branches involves potential adverse impact to our financial results and various other risks commonly associated with acquisitions, including, among other things:

-26 -

Table of March 1, 2017,Contents

Our tax strategies and the value of our deferred tax assets and liabilities could adversely affect our operating results and regulatory capital ratios.

Our tax strategies are dependent upon our ability to generate taxable income in future periods. Our tax strategies will be less effective in the event we fail to generate taxable income. Our deferred tax assets are subject to an evaluation of whether it is more likely than not that they will be realized for financial statement purposes. In making this determination, we consider all positive and negative evidence available including the impact of recent operating results, reversals of existing taxable temporary differences, tax planning strategies and projected earnings within the statutory tax loss carryover period. If we were to conclude that a significant portion of our deferred tax assets were not more likely than not to be realized, the required valuation allowance could adversely affect our financial position, results of operations and regulatory capital ratios. In addition, the value of our deferred tax assets could be adversely affected by a change in statutory rates.

Liquidity is essential to our businesses.

Our liquidity could be impaired by an inability to access the capital markets or unforeseen outflows of cash. Reduced liquidity may arise due to circumstances that we may be unable to control, such as a general market disruption or an operational problem that affects third parties or us. Our efforts to monitor and manage liquidity risk may not be successful or sufficient to deal with dramatic or unanticipated reductions in our liquidity. In such events, our cost of funds may increase, thereby reducing our net interest income, or we may need to sell a portion of our investment and/or loan portfolio, which, depending upon market conditions, could result in us realizing a loss.

We rely on dividends from our subsidiaries for most of our revenue.

We are a separate and distinct legal entity from our subsidiaries. A substantial portion of our revenue comes from dividends from our Bank subsidiary. These dividends are the principal source of funds we use to pay dividends on our common and preferred stock, and to pay interest and principal on our debt. Federal and/or state laws and regulations limit the amount of dividends that our Bank subsidiary may pay to us. Also, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors. In the event our Bank subsidiary is unable to pay dividends to us, we may not be able to service debt, pay obligations, or pay dividends on our common and preferred stock. The inability to receive dividends from our Bank subsidiary could have a material adverse effect on our business, financial condition, and results of operations.

If our risk management framework does not effectively identify or mitigate our risks, we could suffer losses.

Our risk management framework seeks to mitigate risk and appropriately balance risk and return. We have established processes and procedures intended to identify, measure, monitor and report the types of risk to which we are requiredsubject, including credit risk, operations risk, compliance risk, reputation risk, strategic risk, market risk, and liquidity risk. We seek to comply with new cybersecurity regulations promulgated bymonitor and control our risk exposure through a framework of policies, procedures and reporting requirements. Management of our risks in some cases depends upon the NY DFSuse of analytical and/or forecasting models. If the models used to mitigate these risks are inadequate, we may incur losses. In addition, there may be risks that willexist, or that develop in the future, that we have not appropriately anticipated, identified or mitigated. If our risk management framework does not effectively identify or mitigate our risks, we could suffer unexpected losses and could be phased in between September 2017materially adversely affected.

Technology and March 2019. Any failure by us to timely and successfully implement some or all of these regulations, which mandate, among other things, the creation of a new cybersecurity program, a written policy, the appointment of an information security officer and certification by the NY DFS, could also result in regulatory sanctions, public disclosure and reputational damage even if we do not experience a significant cybersecurity breach.Cybersecurity Risks

We face competition in staying current with technological changes and banking alternatives to compete and meet customer demands.

The financial services market, including banking services, faces rapid changes with frequent introductions of new technology-driven products and services. In addition to better serving customers, the effective use of technology increases efficiency and may enable us to reduce costs. Our future success may depend, in part, on our ability to use technology to provide products and services that provide convenience to customers and to create additional efficiencies in our operations. Some of our competitors have substantially greater resources to invest in technological improvements than we currently have. We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers. In addition, technology and other changes are allowing consumers to utilize alternative methods to complete financial transactions that have historically involved banks. For example, consumers can now maintain funds in brokerage accounts or mutual funds that would have historically been held as bank deposits. Consumers can also complete transactions such as paying bills and transferring funds directly without using a traditional bank as an intermediary. The process of eliminating banks as intermediaries could result in the loss of customer deposits, the related income generated from those deposits and additional fee income. We may not be able to effectively compete with these banking alternatives for consumer deposits. As a result, our ability to effectively compete to retain or acquire new business may be impaired, and our business, financial condition or results of operations, may be adversely affected.

-27 -

Table of Contents

We rely on other companies to provide key components of our business infrastructure.

Third party vendors provide key components of our business infrastructure such as internet connections, network access and core application processing. While we have selected these third party vendors carefully, we do not control their actions. Any problems caused by these third parties, including as a result of them not providing us their services for any reason or them performing their services poorly, could adversely affect our ability to deliver products and services to our customers or otherwise conduct our business efficiently and effectively. Replacing these third party vendors could also entail significant delay and expense.

Third parties perform significant operational services on our behalf. These third-party vendors are subject to similar risks as us relating to cybersecurity, breakdowns or failures of their own systems or employees. One or more of our vendors may experience a cybersecurity event or operational disruption and, if any such event does occur, it may not be adequately addressed, either operationally or financially, by the third-party vendor. Certain of our vendors may have limited indemnification obligations or may not have the financial capacity to satisfy their indemnification obligations. Financial or operational difficulties of a vendor could also impair our operations if those difficulties interfere with the vendor’s ability to serve us. If a critical vendor is unable to meet our needs in a timely manner or if the services or products provided by such a vendor are terminated or otherwise delayed and if we are not able to develop alternative sources for these services and products quickly and cost-effectively, it could have a material adverse effect on our business. Federal banking regulators recently issued regulatory guidance on how banks select, engage and manage their outside vendors. These regulations may affect the circumstances and conditions under which we work with third parties and the cost of managing such relationships.

- 24 -

We use financial models forA breach in security of our or third party information systems, including the occurrence of a cyber incident or a deficiency in cybersecurity, or a failure by us to comply with New York State cybersecurity regulations, may subject us to liability, result in a loss of customer business planning purposes that may not adequately predict future results.or damage our brand image.

We use financial modelsrely heavily on communications, information systems (both internal and provided by third parties) and the internet to aid in planning for various purposes includingconduct our capital and liquidity needs, interest rate risk, potential charge-offs, reserves, and other purposes. The models used may not accurately account for all variables that could affect future results, may fail to predict outcomes accurately and/or may overstate or understate certain effects. As a result of these potential failures, we may not adequately prepare for future events and may suffer losses or other setbacks due to these failures.

We may not be able to attract and retain skilled people.

business. Our successbusiness depends in large part, on our ability to attractprocess and retain skilled people. Competition for highly talented people can be intense,monitor a large volume of daily transactions in compliance with legal, regulatory and internal standards and specifications. In addition, a significant portion of our operations relies heavily on the secure processing, storage and transmission of personal and confidential information of our customers and clients. These risks may increase in the future as our customers continue to adapt to mobile payment and other internet-based product offerings and we expand the availability of web-based products and applications.

In addition, several U.S. financial institutions have experienced significant distributed denial-of-service attacks, some of which involved sophisticated and targeted attacks intended to disable or degrade service or sabotage systems. Other potential attacks have attempted to obtain unauthorized access to confidential information or destroy data, often through the introduction of computer viruses or malware, cyber-attacks and other means. Such security attacks can originate from a wide variety of sources, including persons who are involved with organized crime or who may not be ablelinked to hire sufficiently skilled peopleterrorist organizations or retain them. Further, the rural locationhostile foreign governments. Those same parties may also attempt to fraudulently induce employees, customers or other users of our principal executive offices and manysystems to disclose sensitive information in order to gain access to our data or that of our bank branches make it challenging for uscustomers or clients. We are also subject to attract skilled peoplethe risk that our employees may intercept and transmit unauthorized confidential or proprietary information. An interception, misuse or mishandling of personal, confidential or proprietary information being sent to such locations. The unexpected lossor received from a customer or third party could result in legal liability, remediation costs, regulatory action and reputational harm, any of services of one or more of our key personnel could have a material adverse impact on our business because of their skills, knowledge of our markets, years of industry experience, and the difficulty of promptly finding qualified replacement personnel.

Acquisitions may disrupt our business and dilute shareholder value.

We intend to continue to pursue a growth strategy for our business by expanding our branch network into communities within or adjacent to markets where we currently conduct business.    We may consider acquisitions of loans or securities portfolios, lending or leasing firms, commercial and small business lenders, residential lenders, direct banks, banks or bank branches, wealth and investment management firms, securities brokerage firms, specialty finance or other financial services-related companies. We also intend to expand our SDN and Courier subsidiaries by acquiring smaller insurance agencies and wealth management firms in areas which complement our current footprint. We may be unsuccessful in expanding our SDN and Courier subsidiaries through acquisition because of the growing interest in acquiring insurance brokers and wealth management firms, which could make it more difficult for us to identify appropriate targets and could make such acquisitions more expensive. Even if we are able to identify appropriate acquisition targets, we may not have sufficient capital to fund acquisitions or be able to execute transactions on favorable terms. If we are unable to expand our SDN and Courier operations through smaller acquisitions, we may not be able to achieve all of the expected benefits of the SDN and Courier acquisitions, which could adversely affect our results of operations and financial condition.

Acquiring other banks, businesses,We are subject to cybersecurity regulations promulgated by the NY DFS. Any failure by us to comply with these regulations could also result in regulatory sanctions, public disclosure and reputational damage even if we do not experience a significant cybersecurity breach.

Furthermore, as the threat of cyber attacks continue to evolve, we may be required to expend significant additional resources to continue to modify or branches involves potential adverse impactenhance our systems, or to investigate and remediate vulnerabilities in our financial resultssystems. Due to the complexity and various other risks commonly associated with acquisitions, including, among other things:interconnectedness of information technology systems, the process of enhancing our systems can itself create a risk of systems disruptions and security issues.

Market Risks

We are subject to interest rate risk.risk, and a rising rate environment may reduce our income and result in higher defaults on our loans, whereas a falling rate environment may result in earlier loan prepayments than we expect, which may reduce our income.

Our earnings and cash flows depend largely upon our net interest income. Interest rates are highly sensitive to many factors that are beyond our control, including general economic conditions and policies of governmental and regulatory agencies, particularly the Federal Reserve. Changes in monetary policy, including changes in interest rates, could influence not only the interest we receive on loans and investments and the amount of interest we pay on deposits and borrowings, but such changes could also affect (i) our ability to originate loans and obtain deposits; (ii) the fair value of our financial assets and liabilities; and (iii) the average duration of our mortgage-backed securities portfolio and other interest-earning assets.

-28 -

Table of Contents

If the interest rates paid on deposits and other borrowings increase at a faster rate than the interest rates received on loans and other investments, our net interest income, and therefore earnings, could be adversely affected. In addition, our net interest margin may contract in a rising rate environment because our funding costs may increase faster than the yield we earn on our interest-earning assets. In a rising rate environment, loans with adjustable interest rates are more likely to experience a higher rate of default. The combination of these events may adversely affect our financial condition and results of operations.

Earnings could also be adversely affected if the interest rates received on loans and other investments fall more quickly than the interest rates paid on deposits and other borrowings. In addition, in a falling rate environment, loans may be prepaid sooner than we expect, which could result in a delay between when we receive the prepayment and when we are able to redeploy the funds into new interest-earning assets and in a decrease in the amount of interest income we are able to earn on those assets. If we are unable to manage these risks effectively, our financial condition and results of operations could be materially adversely affected.

Any substantial, unexpected or prolonged change in market interest rates could have a material adverse effect on our financial condition and results of operations. Also, our interest rate risk modeling techniques and assumptions likely may not fully predict or capture the impact of actual interest rate changes on our balance sheet.

- 25 -

Our business may be adversely affected by conditions in the financial markets and economic conditions generally.

Our financial performance generally, and in particular the ability of borrowers to pay interest on and repay principal of outstanding loans and the value of collateral securing those loans, as well as demand for loans and other products and services we offer, is highly dependent on the business environment in the markets where we operate, in the State of New York and in the United States as a whole. A favorable business environment is generally characterized by, among other factors, economic growth, efficient capital markets, low inflation, low unemployment, high business and investor confidence, and strong business earnings. Unfavorable or uncertain economic and market conditions can be caused by declines in economic growth, business activity or investor or business confidence; limitations on the availability or increases in the cost of credit and capital; increases in inflation or interest rates; high unemployment, natural disasters; or a combination of these or other factors.

The policies of the Federal Reserve have a significant impact on our earnings.

The policies of the Federal Reserve impact us significantly. The Federal Reserve regulates the supply of money and credit in the United States. Its policies directly and indirectly influence the rate of interest earned on loans and paid on borrowings and interest-bearing deposits and can also affect the value of financial instruments we hold. Those policies determine, to a significant extent, our cost of funds for lending and investing and impact our net interest income, our primary source of revenue. Changes in those policies are beyond our control and are difficult to predict. Federal Reserve policies can also affect our borrowers, potentially increasing the risk that they may fail to repay their loans. For example, a tightening of the money supply by the Federal Reserve could reduce the demand for a borrower’s products and services. This could adversely affect the borrower’s earnings and ability to repay its loan, which could have a material adverse effect on our financial condition and results of operations.

The soundness of other financial institutions could adversely affect us.

Financial services institutions are interrelated as a result of trading, clearing, counterparty, or other relationships. We have exposure to many different industries and counterparties, and we routinely execute transactions with counterparties in the financial services industry, including commercial banks, brokers and dealers, investment banks, and other institutional clients. Many of these transactions expose us to credit risk in the event of a default by our counterparty or client. In addition, our credit risk may be exacerbated when the collateral held by us cannot be realized or is liquidated at prices not sufficient to recover the full amount of the credit or derivative exposure due us. Any such losses could have a material adverse effect on our financial condition and results of operations.

The value of our goodwill and other intangible assets may decline in the future.

As of December 31, 2017, we had $65.8 million of goodwill and $8.9 million of other intangible assets. Significant and sustained declines in our stock price and market capitalization, significant declines in our expected future cash flows, significant adverse changes in the business climate or slower growth rates, any or all of which could be materially impacted by many of the risk factors discussed herein, may necessitate our taking charges in the future related to the impairment of our goodwill. Future regulatory actions could also have a material impact on assessments of goodwill for impairment. If the fair value of our net assets improves at a faster rate than the market value of our reporting units, or if we were to experience increases in book values of a reporting unit in excess of the increase in fair value of equity, we may also have to take charges related to the impairment of our goodwill. If we were to conclude that a future write-down of our goodwill is necessary, we would record the appropriate charge, which could have a material adverse effect on our results of operations.

Identifiable intangible assets other than goodwill consist of core deposit intangibles and other intangible assets (primarily customer relationships). Adverse events or circumstances could impact the recoverability of these intangible assets including loss of core deposits, significant losses of customer accounts and/or balances, increased competition or adverse changes in the economy. To the extent these intangible assets are deemed unrecoverable, anon-cash impairment charge would be recorded which could have a material adverse effect on our results of operations.

During the fourth quarter of 2015, we determined that the carrying value of our SDN reporting unit exceeded its fair value and recorded a $751 thousand impairment charge. During the second quarter of 2017, we again determined that the carrying value of our SDN reporting unit exceeded its fair value and recorded an additional $1.6 million impairment charge. For further discussion, see Note 1, Summary of Significant Accounting Policies, and Note 7, Goodwill and Other Intangible Assets, to the Consolidated Financial Statements included in Item 8 of this Annual Report on Form10-K.

- 26 -

We operate in a highly competitive industry and market area.

We face substantial competition in all areas of our operations from a variety of different competitors, many of which are larger and may have more financial resources. Such competitors primarily include national, regional and internet banks within the markets in which we operate. We also face competition from many other types of financial institutions, including, without limitation, savings and loan associations, credit unions, finance companies, brokerage firms, insurance companies and other financial intermediaries. The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. Banks, securities firms and insurance companies can merge under the umbrella of a financial holding company, which can offer virtually any type of financial service, including banking, securities underwriting, insurance (both agency and underwriting), and merchant banking. Also, technology has lowered barriers to entry and made it possible for nonbanks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. More recently, peer to peer lending has emerged as an alternative borrowing source for our customers and many othernon-banks offer lending and payment services in competition with banks. Many of these competitors have fewer regulatory constraints and may have lower cost structures. Additionally, due to their size, many competitors may be able to achieve economies of scale and, as a result, may offer a broader range of products and services as well as better pricing for those products and services than we can.

Our ability to compete successfully depends on a number of factors, including, among other things:    

Failure to perform in any of these areas could significantly weaken our competitive position, which could adversely affect our growth and profitability, which, in turn, could have a material adverse effect on our financial condition and results of operations.

Severe weather, natural disasters, acts of war or terrorism, and other external events could significantly impact our business.

Severe weather, natural disasters, acts of war or terrorism, and other adverse external events could have a significant impact on our ability to conduct business. Such events could affect the operations of our bank branches, stability of our deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue, and/or cause us to incur additional expenses. The occurrence of any such event could have a material adverse effect on our business, which, in turn, could have a material adverse effect on our financial condition and results of operations.

Liquidity is essential to our businesses.

Our liquidity could be impaired by an inability to access the capital markets or unforeseen outflows of cash. Reduced liquidity may arise due to circumstances that we may be unable to control, such as a general market disruption or an operational problem that affects third parties or us. Our efforts to monitor and manage liquidity risk may not be successful or sufficient to deal with dramatic or unanticipated reductions in our liquidity. In such events, our cost of funds may increase, thereby reducing our net interest income, or we may need to sell a portion of our investment and/or loan portfolio, which, depending upon market conditions, could result in us realizing a loss.

We may need to raise additional capital in the future and such capital may not be available on acceptable terms or at all.

We may need to raise additional capital in the future to provide sufficient capital resources and liquidity to meet our commitments and business needs. Our ability to raise additional capital, if needed, will depend on our financial performance and, among other things, conditions in the capital markets at that time, which is outside of our control.

In addition, we are highly regulated, and our regulators could require us to raise additional common equity in the future. We and our regulators perform a variety of analyses of our assets, including the preparation of stress case scenarios, and as a result of those assessments we could determine, or our regulators could require us, to raise additional capital.

We cannot assure thatmay not be able to access required capital will be available on acceptable terms or at all. Any occurrence that may limit our access to the capital markets, such as a decline in the confidence of debt purchasers, depositors of the Bank or counterparties participating in the capital markets, or a downgrade of our debt rating, may adversely affect our capital costs and ability to raise capital and, in turn, our liquidity. An inability to raise additional capital on acceptable terms when needed could have a material adverse impact on our business, financial condition, results of operations or liquidity.

- 27 -

We rely on dividends fromRisks Related to our subsidiaries for most of our revenue.

We are a separate and distinct legal entity from our subsidiaries. A substantial portion of our revenue comes from dividends from our Bank subsidiary. These dividends are the principal source of funds we use to pay dividends on our common and preferred stock, and to pay interest and principal on our debt. Federal and/or state laws and regulations limit the amount of dividends that our Bank subsidiary may pay to us. Also, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors. In the event our Bank subsidiary is unable to pay dividends to us, we may not be able to service debt, pay obligations, or pay dividends on our common and preferred stock. The inability to receive dividends from our Bank subsidiary could have a material adverse effect on our business, financial condition, and results of operations.Common Stock

We may not pay or may reduce the dividends on our common stock.

Holders of our common stock are only entitled to receive such dividends as our Board of Directors may declare out of funds legally available for such payments. Although we have historically declared cash dividends on our common stock, we are not required to do so and may reduce or eliminate our common stock dividend in the future. This could adversely affect the market price of our common stock.

We may issue debt and equity securities or securities convertible into equity securities, any of which may be senior to our common stock as to distributions and in liquidation, which could dilute our current shareholders or negatively affect the value of our common stock.

In the future, we may attempt to increase our capital resources by entering into debt or debt-like financing that is unsecured or secured by all or up to all of our assets, or by issuing additional debt or equity securities, which could include issuances of secured or unsecured commercial paper, medium-term notes, senior notes, subordinated notes, preferred stock or securities convertible into or exchangeable for equity securities. In the event of our liquidation, our lenders and holders of our debt and preferred securities would receive a distribution of our available assets before distributions to the holders of our common stock. Because our decision to incur debt and issue securities in our future offerings will depend on market conditions and other factors beyond our control, we cannot predict or estimate the amount, timing or nature of our future offerings and debt financings. Further, market conditions could require us to accept less favorable terms for the issuance of our securities in the future. We may also issue additional shares of our common

-29 -

Table of Contents

stock or securities convertible into or exchangeable for our common stock that could dilute our current shareholders and effect the value of our common stock.

Our certificate of incorporation, our bylaws, and certain banking laws may have an anti-takeover effect.

Provisions of our certificate of incorporation, our bylaws, and federal and state banking laws, including regulatory approval requirements, could make it more difficult for a third party to acquire us, even if doing so would be perceived to be beneficial to our shareholders. The combination of these provisions may discourage others from initiating a potential merger, takeover or other change of control transaction, which, in turn, could adversely affect the market price of our common stock.

The market price of our common stock may fluctuate significantly in response to a number of factors.

Our quarterly and annual operating results have varied in the past and could vary significantly in the future, which makes it difficult for us to predict our future operating results. Our operating results may fluctuate due to a variety of factors, many of which are outside of our control, including the changing U.S. economic environment and changes in the commercial and residential real estate market, any of which may cause our stock price to fluctuate. If our operating results fall below the expectations of investors or securities analysts, the price of our common stock could decline substantially. Our stock price can fluctuate significantly in response to a variety of factors including, among other things:

General Risk Factors

We may not be able to attract and retain skilled people.

Our success depends, in large part, on our ability to attract and retain skilled people. Competition for highly talented people can be intense, and we may not be able to hire sufficiently skilled people or retain them. Further, the rural location of our principal executive offices and many of our bank branches make it challenging for us to attract skilled people to such locations. The unexpected loss of services of one or more of our key personnel could have a material adverse impact on our business because of their skills, knowledge of our markets, years of industry experience, and the difficulty of promptly finding qualified replacement personnel.

We use financial models for business planning purposes that may not adequately predict future results.

We use financial models to aid in planning for various purposes including our capital and liquidity needs, interest rate risk, potential charge-offs, reserves, and other purposes. The models used may not accurately account for all variables that could affect future results, may fail to predict outcomes accurately and/or may overstate or understate certain effects. As a result of these potential failures, we may not adequately prepare for future events and may suffer losses or other setbacks due to these failures.

We depend on the accuracy and completeness of information about or from customers and counterparties.

In deciding whether to extend credit or enter into other transactions, we may rely on information furnished by or on behalf of customers and counterparties, including financial statements, credit reports, and other financial information. We may also rely on representations of those customers, counterparties, or other third parties, such as independent auditors, as to the accuracy and completeness of that information. Reliance on inaccurate or misleading financial statements, credit reports, or other financial information could cause us to enter into unfavorable transactions, which could have a material adverse effect on our financial condition and results of operations.

-30 -

Table of Contents

- 28 -

None.

We own a 27,400 square foot building in Warsaw, New York that serves as our headquarters, and principal executive and administrative offices. We lease a 52,300 square foot regional administrative facility located in Rochester, New York. This lease expires in August 2027, with options for two additionalten-year extensions.

We are engaged in the banking business through 5347 branch offices, of which 3532 are owned and 1815 are leased, in the following fifteen contiguous counties of Western and Central New York: Allegany, Cattaraugus, Cayuga, Chautauqua, Chemung, Erie, Genesee, Livingston, Monroe, Ontario, Orleans, Seneca, Steuben, Wyoming and Yates Counties. The operating leases for our branch offices expire at various dates through the year 2047 and generally include options to renew. The Bank also has administrative operations at a leased facility in Amherst, New York.

SDN operates from a leased 14,400 square foot office located in Williamsville, New York. The lease for such space, which is used by SDN and several of our Bank’s commercial lenders, extends through September 2021. SDN also leaseshas operations at a leased facility in Rochester, New York and in one leased retail location.

Courier Capital operates from an owned 11,000 square foot office, located in Buffalo, New York. Courier Capital also has operations at a leased facility in Amherst, New York and an owned facility in Jamestown, New York.

We believe that our properties have been adequately maintained, are in good operating condition and are suitable for our business as presently conducted, including meeting the prescribed security requirements. For additional information, see Note 6,7, Premises and Equipment, Net, and Note 11,14, Commitments and Contingencies, in the accompanying financial statements included in Part II, Item 8, of this Annual Report on Form10-K.

-31 -

Table of Contents

From time to time we are a party to or otherwise involved in legal proceedings arising out of the normal course of business. ManagementRegardless of the outcome, litigation can have an adverse impact on us because of prosecution, defense and settlement costs, unfavorable awards, diversion of management resources and other factors.

We are party to an action filed against us on May 16, 2017 by Matthew L. Chipego, Charlene Mowry, Constance C. Churchill and Joseph W. Ewing in the Court of Common Pleas in Philadelphia, Pennsylvania.  Plaintiffs seek class certification to represent classes of consumers in New York and Pennsylvania along with statutory damages, interest and declaratory relief. The plaintiffs seek to represent a putative class of consumers who are alleged to have obtained direct or indirect financing from us for the purchase of vehicles that we later repossessed. The plaintiffs specifically claim that the notices the Bank sent to defaulting consumers after their vehicles were repossessed did not comply with the relevant portions of the Uniform Commercial Code in New York and Pennsylvania. We dispute and believe we have meritorious defenses against these claims and plan to vigorously defend ourselves.

In February 2020, we agreed to engage in mediation with the plaintiffs but mediation has not yet commenced.  On October 19, 2020, the Court granted plaintiffs’ motion for judgment on the pleadings dismissing our affirmative defense against one named New York plaintiff that his claim was time-barred under New York law, applying a six-year statute of limitations rather than the three years limitation period we had argued. The issue of class certification has been briefed and the parties are awaiting a pre-certification conference date and hearing date.

If we settle these claims or the action is not resolved in our favor, we may suffer reputational damage and incur legal costs, settlements or judgments that exceed the amounts covered by our existing insurance policies. We can provide no assurances that our insurer will insure the legal costs, settlements or judgements we incur in excess of our deductible. If we are unsuccessful in defending ourselves from these claims or if our insurer does not believe that there is any pending or threatened proceedinginsure us against us, which, if determinedlegal costs we incur in excess of our deductible, the result may materially adversely would have a material adverse effect onaffect our business, results of operations orand financial condition.

Not applicable.

-32 -

Table of Contents

- 29 -

PART II

ITEM 5.    MARKET FOR REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES

Our common stock is traded on the NASDAQNasdaq Global Select Market under the ticker symbol “FISI.” At February 23, 2018, 15,904,40328, 2021, 15,816,318 shares of our common stock were outstanding and held by approximately 3,400there were 186 registered shareholders of record. During 2017, the high sales price of our common stock was $35.40 and the low sales price was $25.65. The closing price per share of our common stock on December 29, 2017, the last trading day of our fiscal year, was $31.10. We declared dividends of $0.85 per common share during the year ended December 31, 2017. See additional information regarding the market price and dividends paid in Part II, Item 6, “Selected Financial Data.”

We have paid regular quarterly cash dividends on our common stock and our Board of Directors presently intends to continue this practice, subject to our results of operations and the need for those funds for debt service and other purposes. See the discussions in the section captioned “Supervision and Regulation” included in Part I, Item 1, “Business,” in the section captioned “Liquidity and Capital Resources” included in Part II, Item 7, in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and in Note 12,15, Regulatory Matters, in the accompanying financial statements included in Part II, Item 8, “Financial Statements and Supplementary Data,” all of which are included elsewhere in this report and incorporated herein by reference thereto.

Stock Performance Graph

The stock performance graph below compares (a) the cumulative total return on our common stock for the period beginning December 31, 20122015 as reported by the NASDAQNasdaq Global Select Market, through December 31, 2017,2020, (b) the cumulative total return on stocks included in the NASDAQ Composite Index over the same period, and (c) the cumulative total return, as compiled by S&P Global Market Intelligence formerly SNL Financial LC (“SNL”), of Major Exchange (NYSE, NYSE MKTAmerican and NASDAQ)Nasdaq) Banks with $1 billion to $5 billion in assets over the same period. Cumulative return assumes the reinvestment of dividends. The graph was prepared by S&P Global Market Intelligence and is expressed in dollars based on an assumed investment of $100.

- 3033 -

Table of Contents