Auburn National Bancorporation, Inc. (AUBN) Business, 2016

Auburn National Bancorporation, Inc. (the “Company”) is a bank holding company registered with the Board of Governors of the Federal Reserve System (the “Federal Reserve”) under the Bank Holding Company Act of 1956, as amended (the “BHC Act”). The Company was incorporated in Delaware in 1990, and in 1994 it succeeded its Alabama predecessor as the bank holding company controlling AuburnBank, an Alabama state member bank with its principal office in Auburn, Alabama (the “Bank”). The Company and its predecessor have controlled the Bank since 1984. As a bank holding company, the Company may diversify into a broader range of financial services and other business activities than currently are permitted to the Bank under applicable laws and regulations. The holding company structure also provides greater financial and operating flexibility than is presently permitted to the Bank.

The Bank has operated continuously since 1907 and currently conducts its business primarily in East Alabama, including Lee County and surrounding areas. The Bank has been a member of the Federal Reserve System since April 1995. The Bank’s primary regulators are the Federal Reserve and the Alabama Superintendent of Banks (the “Alabama Superintendent”). The Bank has been a member of the Federal Home Loan Bank of Atlanta (the “FHLB”) since 1991.

The Company’s business is conducted primarily through the Bank and its subsidiaries. Although it has no immediate plans to conduct any other business, the Company may engage directly or indirectly in a number of activities that the Federal Reserve has determined to be so closely related to banking or managing or controlling banks as to be a proper incident thereto.

The Company’s principal executive offices are located at 100 N. Gay Street, Auburn, Alabama 36830, and its telephone number at such address is (334) 821-9200. The Company maintains an Internet website at www.auburnbank.com. The Company’s website and the information appearing on the website are not included or incorporated in, and are not part of, this report. The Company files annual, quarterly and current reports, proxy statements, and other information with the SEC. You may read and copy any document we file with the SEC at the SEC’s public reference room at 100 F Street, N.E., Washington, DC 20549. Please call the SEC at 1-800-SEC-0330 for more information on the operation of the public reference rooms. The SEC maintains an Internet site at www.sec.gov that contains reports, proxy, and other information, where SEC filings are available to the public free of charge.

Table of Contents

The Company directly owns all the common equity in Auburn National Bancorporation Capital Trust I (the “Trust”), a Delaware statutory trust, which was formed in 2003 for the purpose of issuing $7.0 million of floating rate capital securities. In October 2016, the Company purchased $4.0 million par amount of outstanding trust preferred securities issued by the Trust. These securities were sold by the FDIC, as receiver of a failed bank that had held the trust preferred securities. The Company used dividends from the Bank to purchase these trust preferred securities and has deemed an equivalent amount of the related junior subordinated debentures issued by the Company as no longer outstanding. The Company realized a pre-tax gain of $0.8 million on the early extinguishment of debt in this transaction. Following the transaction, the Company had $3.2 million in junior subordinated debentures related to $3.0 million of trust preferred securities outstanding held by the Trust. The amount related to the trust preferred securities remains included in the Company’s Tier 1 capital for regulatory purposes.

The Bank offers checking, savings, transaction deposit accounts and certificates of deposit, and is an active residential mortgage lender in its primary service area. The Bank’s primary service area includes the cities of Auburn and Opelika, Alabama and nearby surrounding areas in East Alabama, primarily in Lee County. The Bank also offers commercial, financial, agricultural, real estate construction and consumer loan products and other financial services. The Bank is one of the largest providers of automated teller services in East Alabama and operates ATM machines in 14 locations in its primary service area. The Bank offers Visa® Checkcards, which are debit cards with the Visa logo that work like checks but can be used anywhere Visa is accepted, including ATMs. The Bank’s Visa Checkcards can be used internationally through the Plus® network. The Bank offers online banking, bill payment and other electronic services through its Internet website, www.auburnbank.com

The banking business in East Alabama, including Lee County, is highly competitive with respect to loans, deposits, and other financial services. The area is dominated by a number of regional and national banks and bank holding companies that have substantially greater resources, and numerous offices and affiliates operating over wide geographic areas. The Bank competes for deposits, loans and other business with these banks, as well as with credit unions, mortgage companies, insurance companies, and other local and nonlocal financial institutions, including institutions offering services through the mail, by telephone and over the Internet. As more and different kinds of businesses enter the market for financial services, competition from nonbank financial institutions may be expected to intensify further.

Among the advantages that larger financial institutions have over the Bank are their ability to finance extensive advertising campaigns, to diversify their funding sources, and to allocate and diversify their assets among loans and securities of the highest yield in locations with the greatest demand. Many of the major commercial banks or their affiliates operating in the Bank’s service area offer services which are not presently offered directly by the Bank and they typically have substantially higher lending limits than the Bank.

Banks also have experienced significant competition for deposits from mutual funds, insurance companies and other investment companies and from money center banks’ offerings of high-yield investments and deposits. Certain of these competitors are not subject to the same regulatory restrictions as the Bank.

Lee County’s population was estimated to be 156,933 in 2015, and has increased approximately 11.9% from 2010 to 2015. The largest employers in the area are Auburn University, East Alabama Medical Center, a Wal-Mart Distribution Center, Mando America Corporation, and Briggs & Stratton. Auto manufacturing is of increasing importance along Interstate Highway 85 to the east and west of Auburn. Kia Motors has a large automobile factory in nearby West Point, Georgia, and Hyundai Motors has a large automobile factory in Montgomery, Alabama.

Table of Contents

The Bank makes loans for commercial, financial and agricultural purposes, as well as for real estate mortgages, real estate acquisition, construction and development and consumer purposes. While there are certain risks unique to each type of lending, management believes that there is more risk associated with commercial, real estate acquisition, construction and development, agricultural and consumer lending than with residential real estate mortgage loans. To help manage these risks, the Bank has established underwriting standards used in evaluating each extension of credit on an individual basis, which are substantially similar for each type of loan. These standards include a review of the economic conditions affecting the borrower, the borrower’s financial strength and capacity to repay the debt, the underlying collateral and the borrower’s past credit performance. We apply these standards at the time a loan is made and monitor them periodically throughout the life of the loan. See “Lending Practices” for a discussion of regulatory guidance on commercial real estate lending.

The Bank has loans outstanding to borrowers in all industries within its primary service area. Any adverse economic or other conditions affecting these industries would also likely have an adverse effect on the local workforce, other local businesses, and individuals in the community that have entered into loans with the Bank. For example, the auto manufacturing business and its suppliers have positively affected our local economy, but automobile manufacturing is cyclical and adversely affected by increases in interest rates. Decreases in automobile sales, including adverse changes due to interest rate increases, could adversely affect nearby Kia and Hyundai automotive plants and their suppliers’ local spending and employment, and could adversely affect economic conditions in the markets we serve. However, management believes that due to the diversified mix of industries located within the Bank’s primary service area, adverse changes in one industry may not necessarily affect other area industries to the same degree or within the same time frame. The Bank’s primary service area also is subject to both local and national economic conditions and fluctuations. While most loans are made within our primary service area, some residential mortgage loans are originated outside the primary service area, and the Bank from time to time has purchased loan participations from outside its primary service area.

At December 31, 2016, the Company and its subsidiaries had 158 full-time equivalent employees, including 37 officers.

Certain statistical information is included in response to Item 7 of this Annual Report on Form 10-K. Certain statistical information is also included in response to Item 6, Item 7A and Item 8 of this Annual Report on Form 10-K.

The Company and the Bank are extensively regulated under federal and state laws applicable to financial institutions. The supervision, regulation and examination of the Company and the Bank and their respective subsidiaries by the bank regulatory agencies are primarily intended to maintain the safety and soundness of financial institutions and the federal deposit insurance system, as well as the protection of depositors, rather than holders of Company capital stock and other securities. Any change in applicable law or regulation may have a material effect on the Company’s business. The following discussion is qualified in its entirety by reference to the particular statutory and regulatory provisions referred to below.

The Company, as a bank holding company, is subject to supervision, regulation and examination by the Federal Reserve under the BHC Act. Bank holding companies generally are limited to the business of banking, managing or controlling banks, and certain related activities. The Company is required to file periodic reports and other information with the Federal Reserve. The Federal Reserve examines the Company and its subsidiaries. The State of Alabama currently does not regulate bank holding companies.

Table of Contents

The BHC Act requires prior Federal Reserve approval for, among other things, the acquisition by a bank holding company of direct or indirect ownership or control of more than 5% of the voting shares or substantially all the assets of any bank, or for a merger or consolidation of a bank holding company with another bank holding company. With certain exceptions, the BHC Act prohibits a bank holding company from acquiring direct or indirect ownership or control of voting shares of any company that is not a bank or bank holding company and from engaging directly or indirectly in any activity other than banking or managing or controlling banks or performing services for its authorized subsidiary. A bank holding company may, however, engage in or acquire an interest in a company that engages in activities that the Federal Reserve has determined by regulation or order to be so closely related to banking or managing or controlling banks as to be a proper incident thereto.

Bank holding companies that are and remain “well-capitalized” and “well-managed,” as defined in Federal Reserve Regulation Y, and have and whose insured depository institution subsidiaries maintain “satisfactory” or better ratings under the Community Reinvestment Act of 1977, (the “CRA”), may elect to become “financial holding companies.” Financial holding companies and their subsidiaries are permitted to acquire or engage in activities such as insurance underwriting, securities underwriting, travel agency activities, broad insurance agency activities, merchant banking and other activities that the Federal Reserve determines to be financial in nature or complementary thereto. In addition, under the BHC’s merchant banking authority and Federal Reserve regulations, financial holding companies are authorized to invest in companies that engage in activities that are not financial in nature, as long as the financial holding company makes its investment with the intention of limiting the terms of its investment, does not manage the company on a day-to-day basis, and the investee company does not cross-market with any depositary institutions controlled by the financial holding company. Financial holding companies continue to be subject to Federal Reserve supervision, regulation and examination, but the Gramm-Leach-Bliley Act of 1999 (the” GLB Act”) applies the concept of functional regulation to the activities conducted by subsidiaries. For example, insurance activities would be subject to supervision and regulation by state insurance authorities. The Federal Reserve recommended repeal of the merchant banking powers in their September 16, 2016 study pursuant to Section 620 of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”). The Company has not elected to become a financial holding company, but it may elect to do so in the future.

The BHC Act permits acquisitions of banks by bank holding companies, subject to various restrictions, including deposit share limits, and that the acquirer be “well capitalized” and “well managed”. Under the Alabama Banking Code, with the prior approval of the Alabama Superintendent, an Alabama bank may acquire and operate one or more banks in other states pursuant to a transaction in which the Alabama bank is the surviving bank. In addition, one or more Alabama banks may enter into a merger transaction with one or more out-of-state banks, and an out-of-state bank resulting from such transaction may continue to operate the acquired branches in Alabama. As a result of the Dodd-Frank Act, banks, including Alabama banks, may branch anywhere in the United States.

The Company is a legal entity separate and distinct from the Bank. Various legal limitations restrict the Bank from lending or otherwise supplying funds to the Company. The Company and the Bank are subject to Sections 23A and 23B of the Federal Reserve Act and Federal Reserve Regulation W thereunder. Section 23A defines “covered transactions,” which include extensions of credit, and limits a bank’s covered transactions with any affiliate to 10% of such bank’s capital and surplus. All covered and exempt transactions between a bank and its affiliates must be on terms and conditions consistent with safe and sound banking practices, and banks and their subsidiaries are prohibited from purchasing low-quality assets from the bank’s affiliates. Finally, Section 23A requires that all of a bank’s extensions of credit to its affiliates be appropriately secured by permissible collateral, generally United States government or agency securities. Section 23B of the Federal Reserve Act generally requires covered and other transactions among affiliates to be on terms and under circumstances, including credit standards, that are substantially the same as or at least as favorable to the bank or its subsidiary as those prevailing at the time for similar transactions with unaffiliated companies.

Federal Reserve policy, as well as the Federal Deposit Insurance Act, as amended by the Dodd-Frank Act, requires a bank holding company to act as a source of financial and managerial strength to its bank subsidiaries and to take measures to preserve and protect its bank subsidiaries in situations where additional investments in a bank subsidiary may not otherwise be warranted. In the event an FDIC-insured subsidiary becomes subject to a capital restoration plan with its regulators, the parent bank holding company is required to guarantee performance of such plan up to 5% of the bank’s assets, and such guarantee is given priority in bankruptcy of the bank holding company. In addition, where a bank holding company has more than one bank or thrift subsidiary, each of the bank holding company’s subsidiary depository institutions are responsible for any losses to the FDIC’s Deposit Insurance Fund (“DIF”), if an affiliated depository institution fails. As a result, a bank holding company may be required to loan money to a bank subsidiary in the form of subordinate capital notes or other instruments which qualify as capital under bank regulatory rules. However, any loans from the holding company to such subsidiary banks likely will be unsecured and subordinated to such bank’s depositors and to other creditors of the bank. See “Capital.”

Table of Contents

Public Law 113-250 was enacted on December 18, 2014. This law directed the Federal Reserve to publish, within six months, changes to the Federal Reserve’s Small Bank Holding Company Policy Statement on Assessment of Financial and Managerial Factors (the “Small BHC Policy”) to expand the coverage of the Small BHC Policy to include thrift holding companies and increase the size of “small” for qualifying bank and thrift holding companies from $500 million to up to $1 billion of pro forma consolidated assets. The Federal Reserve implemented changes to its Small BHC Policy effective May 15, 2015. Since the Company’s common stock is registered with the Securities Exchange Commission, it does not qualify for the Small BHC Policy. As a result, unless and until the Company qualifies under the Small BHC Policy, the Company’s capital adequacy will continue to be evaluated on a consolidated basis with its subsidiaries. See “Capital.”

The Bank is a state bank that is a member of the Federal Reserve. It is subject to supervision, regulation and examination by the Federal Reserve and the Alabama Superintendent, which monitor all areas of the Bank’s operations, including loans, reserves, mortgages, issuances and redemption of capital securities, payment of dividends, establishment of branches, capital adequacy and compliance with laws. The Bank is a member of the FDIC and, as such, its deposits are insured by the FDIC to the maximum extent provided by law. See “FDIC Insurance Assessments.”

Alabama law permits statewide branching by banks. The powers granted to Alabama-chartered banks by state law include certain provisions designed to provide such banks competitive equality with national banks.

The Federal Reserve has adopted the Federal Financial Institutions Examination Council’s (“FFIEC”) rating system, which assigns each financial institution a confidential composite “CAMELS” rating based on an evaluation and rating of six essential components of an institution’s financial condition and operations: Capital Adequacy, Asset Quality, Management, Earnings, Liquidity and Sensitivity to market risk, as well as the quality of risk management practices. For most institutions, the FFIEC has indicated that market risk primarily reflects exposures to changes in interest rates. When regulators evaluate this component, consideration is expected to be given to: management’s ability to identify, measure, monitor and control market risk; the institution’s size; the nature and complexity of its activities and its risk profile; and the adequacy of its capital and earnings in relation to its level of market risk exposure. Market risk is rated based upon, but not limited to, an assessment of the sensitivity of the financial institution’s earnings or the economic value of its capital to adverse changes in interest rates, foreign exchange rates, commodity prices or equity prices; management’s ability to identify, measure, monitor and control exposure to market risk; and the nature and complexity of interest rate risk exposure arising from non-trading positions.

The GLB Act and related regulations require banks and their affiliated companies to adopt and disclose privacy policies, including policies regarding the sharing of personal information with third parties. The GLB Act also permits bank subsidiaries to engage in “financial activities” similar to those permitted to financial holding companies.

The Bank is subject to the provisions of the CRA and the Federal Reserve’s regulations thereunder. Under the CRA, all banks and thrifts have a continuing and affirmative obligation, consistent with their safe and sound operation, to help meet the credit needs for their entire communities, including low- and moderate-income neighborhoods. The CRA requires a depository institution’s primary federal regulator, in connection with its examination of the institution, to assess the institution’s record of assessing and meeting the credit needs of the communities served by that institution, including low- and moderate-income neighborhoods. The bank regulatory agency’s assessment of the institution’s record is made available to the public. Further, such assessment is required of any institution which has applied to: (i) charter a national bank; (ii) obtain deposit insurance coverage for a newly-chartered institution; (iii) establish a new branch office that accepts deposits; (iv) relocate an office; or (v) merge or consolidate with, or acquire the assets or assume the liabilities of, a federally regulated financial institution. In the case of bank holding company applications to acquire a bank or other bank holding company, the Federal Reserve will assess the records of each subsidiary depository institution of the applicant bank holding company, and such records may be the basis for denying the application. A less than satisfactory CRA rating will slow, if not preclude, acquisitions, and new branches and other expansion activities and may prevent a company from becoming a financial holding company.

As a result of the GLB Act, CRA agreements with private parties must be disclosed and annual CRA reports must be made to a bank’s primary federal regulator. No new activities authorized under the GLB Act may be commenced by a bank holding company or by a bank financial subsidiary if any of its bank subsidiaries received less than a “satisfactory” CRA rating in its latest CRA examination. The federal CRA regulations require that evidence of discriminatory, illegal or abusive lending practices be considered in the CRA evaluation.

Table of Contents

The Bank is also subject to, among other things, the provisions of the Equal Credit Opportunity Act (the “ECOA”) and the Fair Housing Act (the “FHA”), both of which prohibit discrimination based on race or color, religion, national origin, sex and familial status in any aspect of a consumer or commercial credit or residential real estate transaction. The Department of Justice (the “DOJ”), and the federal bank regulatory agencies have issued an Interagency Policy Statement on Discrimination in Lending to provide guidance to financial institutions in determining whether discrimination exists, how the agencies will respond to lending discrimination, and what steps lenders might take to prevent discriminatory lending practices. The DOJ has increased its efforts to prosecute what it regards as violations of the ECOA and FHA, and the fair lending laws, generally.

The federal bank regulators have updated their guidance several times on overdrafts, including overdrafts incurred at automated teller machines and point of sale terminals. Overdrafts have become a focus of the federal Consumer Financial Protection Bureau (“CFPB”). Among other things, the federal regulators require banks to monitor accounts and to limit the use of overdrafts by customers as a form of short-term, high-cost credit, including, for example, giving customers who overdraw their accounts on more than six occasions where a fee is charged in a rolling 12 month period a reasonable opportunity to choose a less costly alternative and decide whether to continue with fee-based overdraft coverage. It also encourages placing appropriate daily limits on overdraft fees, and asks banks to consider eliminating overdraft fees for transactions that overdraw an account by a de minimis amount. Overdraft policies, processes, fees and disclosures are frequently the subject of litigation against banks in various jurisdictions.

The Dodd-Frank Act established the CFPB, which began exercising its regulatory authority upon the recess appointment of its director on January 4, 2012. The CFPB has the authority, previously exercised by the federal bank regulators to adopt regulations and enforce various laws, including the ECOA, and other fair lending laws, the Truth in Lending Act, the Electronic Funds Transfer Act, mortgage lending rules, the Truth in Savings Act, Fair Credit Reporting and Privacy of Consumer Financial Privacy. Although the CFPB does not examine or supervise banks with less than $10 billion in assets, it exercises broad authority that affects bank regulation in these areas and bank regulators’ consumer examination and enforcement. Banks of all sizes are affected by the CFPB’s regulations, and the precedents set in CFPB enforcement actions and interpretations. The CFPB has focused on various practices to date, including revising mortgage lending rules, credit card add-on products, indirect automobile lending, student lending, and payday and similar short-term lending, and has a broad mandate to regulate consumer financial products and services, whether or not offered by banks or their affiliates.

Residential Mortgages

CFPB regulations implement the Dodd-Frank Act requirement that lenders determine whether a consumer has the ability to repay a mortgage loan became effective January 10, 2014. These established certain minimum requirements for creditors when making ability to pay determinations, and provide certain safe harbors from liability for mortgages that are “qualified mortgages” and are not “higher-priced.” Generally, these CFPB regulations apply to all consumer, closed-end loans secured by a dwelling including home-purchase loans, refinancing and home equity loans—whether first or subordinate lien. Qualified mortgages must generally satisfy detailed requirements related to product features, underwriting standards, and requirements where the total points and fees on a mortgage loan cannot exceed specified amounts or percentages of the total loan amount. Qualified mortgages must have: (1) a term not exceeding 30 years; (2) regular periodic payments that do not result in negative amortization, deferral of principal repayment, or a balloon payment; (3) and be supported with documentation of the borrower and its credit. We anticipate focusing our residential mortgage origination on qualified mortgages and those that meet our investors’ requirements, but we may make loans that do not meet the safe harbor requirements for “qualified mortgages.”

The bank generally services the loans it originates, including those it sells. The CFPB adopted new mortgage servicing standards, effective in January 2014. These include new requirements regarding force-placed insurance, certain notices prior to rate adjustments on adjustable rate mortgages, and periodic disclosures to borrowers. Servicers will be prohibited from processing foreclosures when a loan modification is pending, and must wait until a loan is more than 120 days delinquent before initiating a foreclosure action. Servicers must provide direct and ongoing access to its personnel, and provide prompt review of any loss mitigation application. Servicers must maintain accurate and accessible mortgage records for the life of a loan and until one year after the loan is paid off or transferred. These new standards are expected to increase the cost and compliance risks of servicing mortgage loans, and the mandatory delays in foreclosures could result in loss of value on collateral or the proceeds we may realize from a sale of foreclosed property.

The CFPB’s new Truth in Lending Act – Real Estate Settlement Procedures Act (“RESPA”) rule and the related integrated disclosures (sometimes called “TRID”), became effective October 3, 2015 for closed-end and credit transactions secured by real property.

Table of Contents

The Federal Housing Finance Authority (“FHFA”) updated Fannie Mae’s and Freddie Mac’s (individually and collectively, “GSE”) repurchase rules, including the kinds of loan defects that could lead to a repurchase request to, or alternative remedies with, the mortgage loan originator or seller. These rules became effective January 1, 2016. FHFA also has updated these GSEs representations and warranties framework and announced on February 2, 2016 an independent dispute resolution (“IDR”) process to allow a neutral third party to resolve demands after the GSE’s quality control and appeal processes have been exhausted. The GSEs are expected to update their repurchase demand escalation and appeal processes later this year to resolve disputes before any IDR process begins.

The TRID rules adversely affected our mortgage originations in 2016, while we revised our systems and processes to comply with these rules. Our residential mortgage strategy, product offerings, and profitability may change as these regulations are interpreted and applied in practice, and may also change due to any restructuring of Fannie Mae and Freddie Mac as part of the resolution of their conservatorships.

The International Money Laundering Abatement and Anti-Terrorism Funding Act of 2001 specifies new “know your customer” requirements that obligate financial institutions to take actions to verify the identity of the account holders in connection with opening an account at any U.S. financial institution. Bank regulators are required to consider compliance with this Act’s money laundering provisions in acting upon acquisition and merger proposals, and sanctions for violations of this Act can be imposed in an amount equal to twice the sum involved in the violating transaction, up to $1 million.

Under the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (the “USA PATRIOT Act”), financial institutions are subject to prohibitions against specified financial transactions and account relationships as well as to enhanced due diligence and “know your customer” standards in their dealings with foreign financial institutions and foreign customers.

The USA PATRIOT Act requires financial institutions to establish anti-money laundering programs, and sets forth minimum standards for these programs, including:

• the development of internal policies, procedures, and controls;

• the designation of a compliance officer;

• an ongoing employee training program; and

• an independent audit function to test the programs.

The Company is also required to comply with various corporate governance and financial reporting requirements under the Sarbanes-Oxley Act of 2002, as well as new rules and regulations adopted by the SEC, the Public Company Accounting Oversight Board and Nasdaq. In particular, the Company is required to report on internal controls as part of its annual report for the year ended December 31, 2016 pursuant to Section 404 of the Sarbanes-Oxley Act. The Company has evaluated its controls, including compliance with the SEC rules on internal controls, and has and expects to continue to spend significant amounts of time and money on compliance with these rules. If the Company fails to comply with these internal control rules in the future, it may materially adversely affect its reputation, its ability to obtain the necessary certifications to its financial statements, its relations with its regulators and other financial institutions with which it deals, and its ability to access the capital markets and offer and sell Company securities on terms and conditions acceptable to the Company. The Company’s assessment of its financial reporting controls as of December 31, 2016 are included elsewhere in this report with no material weaknesses reported.

The Company is a legal entity separate and distinct from the Bank. The Company’s primary source of cash is dividends from the Bank. Prior regulatory approval is required if the total of all dividends declared by a state member bank (such as the Bank) in any calendar year will exceed the sum of such bank’s net profits for the year and its retained net profits for the preceding two calendar years, less any required transfers to surplus. During 2016, the Bank paid cash dividends of approximately $6.7 million to the Company, of which $3.2 million was used to purchase $4.0 million par amount of outstanding trust preferred securities of Auburn National Bancorporation Capital Trust I. At December 31, 2016, the Bank could have declared additional dividends of approximately $10.1 million without prior approval of regulatory authorities.

Table of Contents

In addition, the Company and the Bank are subject to various general regulatory policies and requirements relating to the payment of dividends, including requirements to maintain capital above regulatory minimums. The appropriate federal and state regulatory authorities are authorized to determine when the payment of dividends would be an unsafe or unsound practice, and may prohibit such dividends. The Federal Reserve has indicated that paying dividends that deplete a state member bank’s capital base to an inadequate level would be an unsafe and unsound banking practice. The Federal Reserve has indicated that depository institutions and their holding companies should generally pay dividends only out of current year’s operating earnings.

Under Federal Reserve Supervisory Letter SR-09-4 (February 24, 2009), as revised December 21, 2015, the board of directors of a bank holding company must consider different factors to ensure that its dividend level is prudent relative to maintaining a strong financial position, and is not based on overly optimistic earnings scenarios, such as potential events that could affect its ability to pay, while still maintaining a strong financial position. As a general matter, the Federal Reserve has indicated that the board of directors of a bank holding company should consult with the Federal Reserve and eliminate, defer or significantly reduce the bank holding company’s dividends if:

• its net income available to shareholders for the past four quarters, net of dividends previously paid during that period, is not sufficient to fully fund the dividends;

• its prospective rate of earnings retention is not consistent with its capital needs and overall current and prospective financial condition; or

• It will not meet, or is in danger of not meeting, its minimum regulatory capital adequacy ratios.

When fully-phased in by 2019, the Basel III capital rules will further limit permissible dividends, stock repurchases and discretionary bonuses by the Company and the Bank, respectively, unless the Company and the Bank meet the full capital conservation buffer requirement. See “Basel III Capital Rules.”

The Federal Reserve has risk-based capital guidelines for bank holding companies and state member banks, respectively. These guidelines required at year end 2016 a minimum ratio of capital to risk-weighted assets (including certain off-balance sheet activities, such as standby letters of credit) of 8%. At least half of the total capital must consist of common equity and related retained earnings. A limited amount of qualifying preferred stock, less goodwill and certain core deposit intangibles are also added as part of Tier 1 Capital (“Tier 1 capital”). Voting common equity must be the predominant form of capital. The remainder may consist of non–qualifying preferred stock, qualifying subordinated, perpetual, and/or mandatory convertible debt, term subordinated debt and intermediate term preferred stock, up to 45% of pretax unrealized holding gains on available for sale equity securities with readily determinable market values that are prudently valued, and a limited amount of general loan loss allowance (“Tier 2 capital” and, together with Tier 1 capital, “Total risk-based capital”).

In addition, the Federal Reserve has established minimum leverage ratio guidelines for bank holding companies not subject to the Small BHC Policy, and state member banks, which provide for a minimum leverage ratio of Tier 1 capital to adjusted average quarterly assets (“leverage ratio”) equal to 3%, plus an additional cushion of 1.0% to 2.0%, if the institution has less than the highest regulatory rating. The minimum capital ratios sought by the regulators are increasing, and a 5% leverage ratio is the minimum for the largest institutions. The guidelines also provide that institutions experiencing internal growth or making acquisitions will be expected to maintain strong capital positions substantially above the minimum supervisory levels without significant reliance on intangible assets. Higher capital may be required in individual cases and depending upon a bank holding company’s risk profile. All bank holding companies and banks are expected to hold capital commensurate with the level and nature of their risks including the volume and severity of their problem loans. Lastly, the Federal Reserve’s guidelines indicate that the Federal Reserve will continue to consider a “tangible Tier 1 leverage ratio” (deducting all intangibles) in evaluating proposals for expansion or new activity. The level of Tier 1 capital to risk-adjusted assets is becoming more widely used by the bank regulators to measure capital adequacy. The Federal Reserve has not advised the Company or the Bank of any specific minimum leverage ratio or tangible Tier 1 leverage ratio applicable to them. Under Federal Reserve policies, bank holding companies are generally expected to operate with capital positions well above the minimum ratios. The Federal Reserve believes the risk-based ratios do not take into account the quality of capital and interest rate, liquidity, market and operational risks. Accordingly, supervisory assessments of capital adequacy may differ significantly from conclusions based solely on the level of an organization’s risk-based capital ratio.

Table of Contents

The Federal Deposit Insurance Corporation Improvement Act of 1991 (“FDICIA”), among other things, requires the federal banking agencies to take “prompt corrective action” regarding depository institutions that do not meet minimum capital requirements. FDICIA establishes five capital tiers: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” and “critically undercapitalized.” A depository institution’s capital tier will depend upon how its capital levels compare to various relevant capital measures and certain other factors, as established by regulation.

All of the federal bank regulatory agencies also have regulations establishing risk-adjusted measures and relevant capital levels implementing the “prompt corrective action” standards. The relevant capital measures are the total risk-based capital ratio, Tier 1 risk-based capital ratio, Common Equity Tier 1 capital ratio, as well as, the leverage capital ratio. Under the regulations, a state member bank will be: (i) well capitalized if it has a total risk-based capital ratio of 10% or greater, a Tier 1 risk-based capital ratio of 8% or greater, a Common Equity Tier 1 capital ratio of 6.5% or greater, a leverage capital ratio of 5% or greater and is not subject to any written agreement, order, capital directive or prompt corrective action directive by a federal bank regulatory agency to maintain a specific capital level for any capital measure; (ii) “adequately capitalized” if it has a total risk-based capital ratio of 8% or greater, a Tier 1 risk-based capital ratio of 6% or greater, a Common Equity Tier 1 capital ratio of 4.5% or greater, and generally has a leverage capital ratio of 4% or greater; (iii) “undercapitalized” if it has a total risk-based capital ratio of less than 8%, a Tier 1 risk-based capital ratio of less than 6%, a Common Equity Tier 1 capital ratio of less than 4.5% or generally has a leverage capital ratio of less than 2%; (iv) “significantly undercapitalized” if it has a total risk-based capital ratio of less than 6%, a Tier 1 risk-based capital ratio of less than 4%, a Common Equity Tier 1 capital ratio of less than 3%, or a leverage capital ratio of less than 3%; or (v) “critically undercapitalized” if its tangible equity is equal to or less than 2% to total assets. The federal bank regulatory agencies have authority to require additional capital, and have been indicating that higher capital levels may be required in light of current market conditions and risk.

The Dodd–Frank Act significantly modified the capital rules applicable to the Company and calls for increased capital, generally.

• The generally applicable prompt corrective action leverage and risk-based capital standards (the “generally applicable standards”), including the types of instruments that may be counted as Tier 1 capital, will be applicable on a consolidated basis to depository institution holding companies (except for such companies subject to the Small BHC Policy), as well as their bank and thrift subsidiaries.

• The generally applicable standards in effect prior to the Dodd-Frank Act will be “floors” for the standards to be set by the regulators.

• Bank and thrift holding companies with assets of less than $15 billion as of December 31, 2009, will be permitted to include trust preferred securities that were issued before May 19, 2010, as Tier 1 capital, but trust preferred securities issued by a bank holding company (other than those with assets of less than $1 billion that meet the Federal Reserve’s “qualitative standards” under the Small BHC Policy) after May 19, 2010, will no longer count as Tier 1 capital.

• The Dodd-Frank Act also requires studies of the use of hybrid instruments as capital, and of “smaller” (consolidated assets of $5 billion or less) financial companies’ access to the capital markets.

Information concerning the Company’s and the Bank’s regulatory capital ratios at December 31, 2016 is included in Note 19 of the consolidated financial statements that accompany this report.

Table of Contents

Depository institutions that are no longer “well capitalized” for bank regulatory purposes must receive a waiver from the FDIC prior to accepting or renewing brokered deposits. FDICIA generally prohibits a depository institution from making any capital distribution (including paying dividends) or paying any management fee to its holding company, if the depository institution thereafter would be “undercapitalized”. Institutions that are “undercapitalized” are subject to growth limitations and are required to submit a capital restoration plan for approval. A depository institution’s parent holding company must guarantee that the institution will comply with such capital restoration plan. The aggregate liability of the parent holding company is limited to the lesser of 5% of the depository institution’s total assets at the time it became undercapitalized and the amount necessary to bring the institution into compliance with applicable capital standards. If a depository institution fails to submit an acceptable plan, it is treated as if it is “significantly undercapitalized”. If the controlling holding company fails to fulfill its obligations under FDICIA and files (or has filed against it) a petition under the federal Bankruptcy Code, the claim against the holding company’s capital restoration obligation would be entitled to a priority in such bankruptcy proceeding over third party creditors of the bank holding company. Significantly undercapitalized depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become “adequately capitalized”, requirements to reduce total assets, and cessation of receipt of deposits from correspondent banks. “Critically undercapitalized” institutions are subject to the appointment of a receiver or conservator. Because the Company and the Bank exceed applicable capital requirements, the respective managements of the Company and the Bank do not believe that the provisions of FDICIA have had or will have any material effect on the Company and the Bank or their respective operations.

The Federal Reserve and the other bank regulators adopted in June 2013 final capital rules for bank holding companies and banks implementing the Basel Committee on Banking Supervision’s “Basel III: A Global Regulatory Framework for more Resilient Banks and Banking Systems.” These new U.S. capital rules are called the “Basel III Rules.”

The Basel III Rules limits Tier 1 capital to common stock and noncumulative perpetual preferred stock, as well as trust preferred securities and cumulative perpetual preferred stock issued before May 19, 2010, each of which are permanently grandfathered in Tier 1 capital for bank holding companies with less than $15 billion in assets. A new capital measure, “Common Equity Tier I Capital” or “CET1,” is introduced. CET1 includes common stock and related surplus, retained earnings and, subject to certain adjustments, minority common equity interests in subsidiaries. CET1 is reduced by deductions for:

• Goodwill and other intangibles, other than mortgage servicing assets (“MSAs”), which are treated separately, net of associated deferred tax liabilities (“DTLs”);

• Deferred tax assets (“DTAs”) arising from operating losses and tax credit carryforwards net of allowances and DTLs;

• Gains on sale from any securitization exposure; and

• Defined benefit pension fund net assets (i.e., excess plan assets), net of associated DTLs.

The Company made a one-time election in its first regulatory report in 2015 and, as a result, CET1 will not be adjusted for certain accumulated other comprehensive income (“AOCI”).

Additional “threshold deductions” of the following that are individually greater than 10% of CET1 or collectively greater than 15% of CET1 (after the above deductions are also made):

• MSAs, net of associated DTLs;

• DTAs arising from temporary differences that could not be realized through net operating loss carrybacks, net of any valuation allowances and DTLs; and

• Significant common stock investments in unconsolidated financial institutions, net of associated DTLs.

• Noncumulative perpetual preferred stock, Tier 1 minority interest not included in CET1, subject to limits, and current Tier 1 capital instruments issued to the U.S. Treasury, including shares issued pursuant to the TARP or SBLF programs, will qualify as additional Tier I capital. All other qualifying preferred stock, subordinated debt and qualifying minority interests will be included in Tier 2 capital.

Table of Contents

In addition to the minimum risk-based capital requirements, a new “capital conservation buffer” of CET1 capital of at least 2.5% of total risk weighted assets, will be required. The capital conservation buffer will be calculated as the lowest of:

• the banking organization’s CET1 capital ratio minus 4.5%;

• the banking organization’s tier 1 risk-based capital ratio minus 6.0%; and

• the banking organization’s total risk-based capital ratio minus 8.0%.

The capital conservation buffers and the related restrictions on permissible dividends, stock repurchases and discretionary bonuses were applicable for the first time in 2016. The capital conservation buffer of 0.625% or less triggered restrictions in 2016. In 2017, the capital conservation trigger is 1.25% or less.

When fully-phased in by 2019, permissible dividends, stock repurchases and discretionary bonuses will be limited to the following percentages based on the capital conservation buffer as calculated above, subject to any further regulatory limitations, including those based on risk assessments and enforcement actions:

Buffer% Buffer % Limit More than 2.50% None > 1.875% - 2.50% 60.0% > 1.250% - 1.875% 40.0 > 0.625% - 1.250% 20.0 £ 0.625 - 0 -

The various capital elements and total capital under the Basel III Rules, when fully phased by January 1, 2019 will be:

December 31, 2016 Fully Phased InJanuary 1, 2019 Minimum CET1 4.50% 4.50% CET1 Conservation Buffer 0.625% 2.50% Total CET1 5.125% 7.0% Deductions from CET1 60% 100% Minimum Tier 1 Capital 6.0% 6.0% Minimum Tier 1 Capital plus conservation buffer 6.625% 8.5% Deductions from Tier 1 Capital 40% 0% Minimum Total Capital 8.0% 8.0% Minimum Total Capital plus conservation buffer 8.625% 10.5%

Changes in Risk-Weightings

Basel III significantly changes the risk weightings used to determine risk weighted capital adequacy. Among various other changes, Basel III applies a 250% risk-weighting to mortgage servicing rights, deferred tax assets that cannot be realized through net operating loss carry-backs and significant (greater than 10%) investments in other financial institutions. The proposal also would change the risk-weighting for residential mortgages, including mortgages sold. A new 150% risk-weighted category would apply to “high volatility commercial real estate loans,” which are credit facilities for the acquisition, construction or development of real property other than one-to-four family residential properties or commercial real projects where: (i) the loan-to-value ratio is not in excess of interagency real estate lending standards; and (ii) the borrower has contributed capital equal to not less than 15% of the real estate’s “as completed” value before the loan was made.

Table of Contents

The Basel III Rules also change some of the risk weightings used to determine risk-weighted capital adequacy. Among other things, the Basel III Rules:

• Assign a 250% risk weight to MSAs;

• Assign up to a 1,250% risk weight to structured securities, including private label mortgage securities, trust preferred CDOs and asset backed securities;

• Retain existing risk weights for residential mortgages, but assign a 100% risk weight to most commercial real estate loans and a 150% risk-weight for “high volatility” commercial real estate loans;

• Assign a 150% risk weight to past due exposures (other than sovereign exposures and residential mortgages);

• Assign a 250% risk weight to DTAs, to the extent not deducted from capital (subject to certain maximums);

• Retain the existing 100% risk weight for corporate and retail loans; and

• Increase the risk weight for exposures to qualifying securities firms from 20% to 100%.

Changes to Prompt Corrective Action Rules

Under the Basel III Rules, the prompt corrective action rules and categories changed as of January 1, 2015. The following illustrates the range of the changes from well capitalized, to undercapitalized, to critically undercapitalized categories. The adequately capitalized and significantly undercapitalized categories also would be retained with appropriate changes, but are not included in the following illustration.

Minimums Pre-2015 Basel III Well capitalized CET1 — 6.5% Tier 1 risk-based capital 6.0% 8.0% Total risk-based capital 10.0% 10.0% Tier 1 leverage ratio 5.0% 5.0% Undercapitalized CET1 — < 4.5% Tier 1 risk-based capital < 4.0% £ 6.0% Total risk-based capital < 8.0% < 8.0% Tier 1 leverage ratio < 5.0% < 4.0% Critically undercapitalized Tangible equity to totalassets £ 2.0% Tier 1 capital plus non-Tier 1perpetual preferred stock tototal assets £ 2.0%

FDICIA directs that each federal bank regulatory agency prescribe standards for depository institutions and depository institution holding companies relating to internal controls, information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth composition, a maximum ratio of classified assets to capital, minimum earnings sufficient to absorb losses, a minimum ratio of market value to book value for publicly traded shares, safety and soundness, and such other standards as the federal bank regulatory agencies deem appropriate.

Table of Contents

The Federal Reserve and the Alabama Superintendent monitor compliance with laws and regulations. The CFPB monitors compliance with laws and regulations applicable to consumer financial products and services. Violations of laws and regulations, or other unsafe and unsound practices, may result in these agencies imposing fines, penalties and/or restitution, cease and desist orders, or taking other formal or informal enforcement actions. Under certain circumstances, these agencies may enforce these remedies directly against officers, directors, employees and others participating in the affairs of a bank or bank holding company.

Banking is a business that depends on interest rate differentials. In general, the difference between the interest paid by a bank on its deposits and its other borrowings, and the interest received by a bank on its loans and securities holdings, constitutes the major portion of a bank’s earnings. Thus, the earnings and growth of the Company and the Bank, as well as the values of, and earnings on, its assets and the costs of its deposits and other liabilities are subject to the influence of economic conditions generally, both domestic and foreign, and also to the monetary and fiscal policies of the United States and its agencies, particularly the Federal Reserve. The Federal Reserve regulates the supply of money through various means, including open market dealings in United States government securities, the discount rate at which banks may borrow from the Federal Reserve, and the reserve requirements on deposits.

The Federal Reserve’s target federal funds rate was 0-0.25% on December 16, 2008, where it remained until December 16, 2015 when it was raised to 0.50%. The target range was increased to 0.50-0.75% on December 14, 2016. The Federal Reserve’s discount rate on bank borrowings from the Federal Reserve was 0.50% on December 16, 2008, until it was raised on February 19, 2010 to 0.75%. The discount rate was further raised on December 17, 2015 to 1.00% and to 1.25% on December 15, 2016.

On April 30, 2010, the Federal Reserve Board amended Regulation D (Reserve Requirements of Depository Institutions) authorizing the Reserve Banks to offer term deposits to certain institutions. Term deposits, which are deposits with specified maturity dates, will be offered through a Term Deposit Facility. Term deposits will be one of several tools that the Federal Reserve could employ to drain reserves when policymakers judge that it is appropriate to begin moving to a less accommodative stance of monetary policy.

The Federal Reserve has been paying interest on depository institutions’ required and excess reserve balances since October 6, 2008. The payment of interest on excess reserve balances was expected to give the Federal Reserve greater scope to use its lending programs to address conditions in credit markets while also maintaining the federal funds rate close to the target rate established by the Federal Open Market Committee. The Federal Reserve has indicated that it may use this authority to implement a mandatory policy to reduce excess liquidity, in the event of inflation or the threat of inflation.

In 2011, the Federal Reserve repealed its historical Regulation Q to permit banks to pay interest on demand deposits. The Federal Reserve has also engaged in several rounds of quantitative easing (“QE”) to reduce interest rates by buying bonds, and “Operation Twist” to reduce long term interest rates by buying long term bonds, while selling intermediate term securities. In October 2014, the Federal Reserve ended its bond purchases under QE after it began to taper the level of bonds purchased in December 2013, but continues to reinvest the principal of its securities as these mature.

The nature and timing of any changes in monetary policies and their effect on the Company and the Bank cannot be predicted.

The Bank’s deposits are insured by the FDIC’s DIF, and the Bank is subject to FDIC assessments for its deposit insurance, as well as assessments by the FDIC to pay interest on Financing Corporation (“FICO”) bonds.

Effective April 1, 2011, and as discussed above under “Recent Regulatory Developments”, the FDIC began calculating assessments based on an institution’s average consolidated total assets less its average tangible equity (the “FDIC Assessment Base”) in accordance with changes mandated by the Dodd-Frank Act. The FDIC changed its assessment rates which shifted part of the burden of deposit insurance premiums toward depository institutions relying on funding sources other than U.S. deposits.

Table of Contents

Effective July 1, 2016, the FDIC again changed its deposit insurance pricing and eliminated all risk categories and now uses “financial ratios method” based on CAMELS composite ratings to determine assessment rates for small established institutions with less than $10 billion in assets (“Small Banks”). CAMELS composite ratings set a maximum assessment for CAMELS 1 and 2 rated banks, and set minimum assessments for lower rated institutions. All basis points are annual amounts.

The following table shows the FDIC assessment schedule for 2017 applicable to Small Banks, such as the Bank.

Established Small Institution CAMELS Composite 1 or 2 3 4 or 5 Initial Base Assessment Rule 3 to 16 basis points 6 to 30 basis points 16 to 30 basis points Unsecured Debt Adjustment -5 to 0 basis points -5 to 0 basis points -5 to 0 basis points Total Base Assessment Rate 1.5 to 16 basis points 3 to 30 basis points 11 to 30 basis points

The FDIC’s “reserve ratio” of the DIF to total industry deposits reached its 1.15% target effective June 30, 2016. On March 15, 2016 the FDIC implemented Dodd-Frank Act provisions by raising the DIF’s minimum Reserve Ratio from 1.15% to 1.35%. The FDIC imposed a 4.5 basis point annual surcharge on insured depository institutions with total consolidated assets of $10 billion or more (“Large Banks”). The new rules grant credits to smaller banks for the portion of their regular assessments that contribute to increasing the reserve ratio from 1.15% to 1.35%.

Prior to when the new assessment system became effective, the Bank’s overall rate for assessment calculations was 9 basis points or less, which was within the range of assessment rates for the lowest “risk category” under the former FDIC assessment rules. In 2016 and 2015, the Company recorded expense of $0.3 million and $0.4 million, respectively, for FDIC insurance premiums.

In addition, all FDIC-insured institutions are required to pay a pro rata portion of the interest due on FICO bonds, which mature during 2017 through 2019. FICO assessments are set by the FDIC quarterly on each institution’s FDIC Assessment Base. The FICO assessment was 0.60 basis points in all of 2015, except for the third quarter of 2015, when the FICO assessment was 0.58 basis points. The FICO assessment rate for the first quarter of 2016 was 0.58 basis points, which declined to 0.56 basis points for the remainder of last year. FICO assessments of approximately $42 thousand were paid to the FDIC in both 2015 and 2016. The FICO assessments should continue to shrink during 2017-2019, and end when the last FICO bonds mature.

The federal bank regulatory agencies released guidance in 2006 on “Concentrations in Commercial Real Estate Lending” (the “Guidance”). The Guidance defines commercial real estate (“CRE”) loans as exposures secured by raw land, land development and construction (including 1-4 family residential construction), multi-family property, and non-farm nonresidential property where the primary or a significant source of repayment is derived from rental income associated with the property (that is, loans for which 50% or more of the source of repayment comes from third party, non-affiliated, rental income) or the proceeds of the sale, refinancing, or permanent financing of this property. Loans to REITs and unsecured loans to developers that closely correlate to the inherent risks in CRE markets would also be considered CRE loans under the Guidance. Loans on owner occupied CRE are generally excluded.

The Guidance requires that appropriate processes be in place to identify, monitor and control risks associated with real estate lending concentrations. This could include enhanced strategic planning, CRE underwriting policies, risk management, internal controls, portfolio stress testing and risk exposure limits as well as appropriately designed compensation and incentive programs. Higher allowances for loan losses and capital levels may also be required. The Guidance is triggered when either:

• Total reported loans for construction, land development, and other land of 100% or more of a bank’s total capital; or

• Total reported loans secured by multifamily and nonfarm nonresidential properties and loans for construction, land development, and other land are 300% or more of a bank’s total risk-based capital.

Table of Contents

This Guidance was supplemented by the Interagency Statement on Prudent Risk Management for Commercial Real Estate Lending (December 18, 2015). The Guidance also applies when a bank has a sharp increase in CRE loans or has significant concentrations of CRE secured by a particular property type.

The Guidance has not applied to the Bank’s CRE lending activities during 2015 and 2016. At December 31, 2016, the Bank had outstanding $41.7 million in construction and land development loans and $212.1 million in total CRE loans (excluding owner occupied), which represent approximately 46.8% and 238.2%, respectively, of the Bank’s total risk-based capital at December 31, 2016. The Company has always had significant exposures to loans secured by commercial real estate due to the nature of its markets and the loan needs of both its retail and commercial customers. The Company believes its long term experience in CRE lending, underwriting policies, internal controls, and other policies currently in place, as well as its loan and credit monitoring and administration procedures, are generally appropriate to manage its concentrations as required under the Guidance.

The federal bank regulators continue to look at the risks of various assets and asset categories and risk management. In December 2015, the Federal Reserve and other bank regulators issued an interagency statement to highlight prudent risk management practices from existing guidance that regulated financial institutions should implement along with maintaining capital levels commensurate with the level and nature of their CRE concentration risk.

The Bank did not have any loans at year-end 2016 or 2015 that were leveraged loans subject to the Interagency Guidance on Leveraged Lending (February 19, 2013).

The Dodd-Frank Act was signed into law on July 21, 2011. In addition to the capital, liquidity and FDIC deposit insurance changes discussed above, some of the provisions of the Dodd-Frank Act we believe may affect us are set forth below.

Financial Stability Oversight Council

The Dodd-Frank Act creates the Financial Stability Oversight Council or “FSOC”, which is chaired by the Secretary of the Treasury and composed of representatives from various financial services regulators. The FSOC has responsibility for identifying risks and responding to emerging threats to financial stability.

Executive Compensation

The Dodd-Frank Act provides for a say on pay for shareholders of all public companies. Under the Dodd-Frank Act, each company must give its shareholders the opportunity to vote on the compensation of its executives, on a non-binding advisory basis, at least once every three years. The Dodd-Frank Act also adds disclosure and voting requirements for golden parachute compensation that is payable to named executive officers in connection with sale transactions.

The SEC is required under the Dodd-Frank Act to issue rules obligating companies to disclose in proxy materials for annual shareholders meetings, information that shows the relationship between executive compensation actually paid to their named executive officers and their financial performance, taking into account any change in the value of the shares of a company’s stock and dividends or distributions. The Dodd-Frank Act also provides that a company’s compensation committee may only select a compensation consultant, legal counsel or other advisor after taking into consideration factors to be identified by the SEC that affect the independence of a compensation consultant, legal counsel or other advisor.

Section 954 of the Dodd-Frank Act added section 10D to the Exchange Act. Section 10D directs the SEC to adopt rules prohibiting a national securities exchange or association from listing a company unless it develops, implements, and discloses a policy regarding the recovery or “claw-back” of executive compensation in certain circumstances. The policy must require that, in the event an accounting restatement due to material noncompliance with a financial reporting requirement under the federal securities laws, the company will recover from any current or former executive officer any incentive-based compensation (including stock options) received during the three year period preceding the date of the restatement, which is in excess of what would have been paid based on the restated financial statements. There is no requirement of wrongdoing by the executive, and the claw-back is mandatory and applies to all executive officers. Section 954 augments section 304 of the Sarbanes-Oxley Act of 2002 (“SOX”), which requires the CEO and CFO to return any bonus or other incentive or equity-based compensation received during the 12 months following the date of similarly inaccurate financial statements, as well as any profit received from the sale of employer securities during the period, if the restatement was due to misconduct. Unlike section 304, under which only the SEC may seek recoupment, the Dodd-Frank Act requires the company to seek the return of compensation.

Table of Contents

The SEC adopted rules in September 2013 to implement pay ratios pursuant to Section 953 of the Dodd-Frank Act, which are scheduled to apply to fiscal year 2017 annual reports and proxy statements. The SEC proposed Rule 10D-1 under Section 954 on July 1, 2015 which would direct Nasdaq and the other national securities exchanges to adopt listing standards requiring companies to adopt policies requiring executive officers to pay back erroneously awarded incentive-based compensation. In February 2017, the acting SEC Chairman indicated interest in reconsidering the pay ratio rule.

The Dodd-Frank Act, Section 955, requires the SEC, by rule, to require that each company disclose in the proxy materials for its annual meetings whether an employee or board member is permitted to purchase financial instruments designed to hedge or offset decreases in the market value of equity securities granted as compensation or otherwise held by the employee or board member. The SEC proposed implementing rules in February 2015.

Section 956 of the Dodd-Frank Act prohibits incentive-based compensation arrangements that encourage inappropriate risk taking by covered financial institutions and are deemed to be excessive, or that may lead to material losses. On June 21, 2010, the federal bank regulators adopted Guidance on Sound Incentive Compensation Policies, which, although targeted to larger, more complex organizations than the Company, includes principles that have been applied to smaller organizations similar to the Company. This Guidance applies to incentive compensation to executives as well as employees, who, “individually or a part of a group, have the ability to expose the relevant banking organization to material amounts of risk.” Incentive compensation should:

• Provide employees incentives that appropriately balance risk and reward;

• Be compatible with effective controls and risk-management;

• Be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

The federal bank regulators, the SEC and other regulators proposed regulations implementing Section 956 in April 2011, which would have been applicable to, among others, depository institutions and their holding companies with $1 billion or more in assets. An advance notice of a revised proposed joint rulemaking under Section 956 was published by the financial services regulators in May 2016, but these rules have not been adopted.

Other

The Dodd-Frank Act requires an estimated 240-300 rulemakings and an estimated 130 studies. Many of these rules and studies have been completed. Generally, the Dodd-Frank Act and the related rules are complex, have increased our compliance costs, as well as costs imposed on the markets and on others with whom we do business. Many of the rules lack authoritative interpretative guidance from the applicable government agencies.

Credit Ratings

The Dodd-Frank Act includes a number of provisions that are targeted at improving the reliability of credit ratings. The federal bank regulators and the SEC have adopted rules to implement the Act’s requirement to delete references to rating agency ratings for various purposes, including “investment securities,” which are permissible bank investments.

Debit Card Interchange Fees

The “Durbin Amendment” to the Dodd-Frank Act provides for a set of new rules requiring that interchange transaction fees for electric debit transactions be “reasonable” and proportional to certain costs associated with processing the transactions. The Federal Reserve has established standards for assessing whether interchange fees are reasonable and proportional, which a Federal District Court ruled were improperly adopted. This decision in NACS v. Board of Governors of the Federal Reserve System, was reversed by the District of Columbia Circuit Court of Appeals in 2014 and the Supreme Court declined to hear an appeal on January 20, 2015. The Durbin Amendment is not applicable to banks with assets less than $10 billion.

Table of Contents

Derivatives

The Dodd-Frank Act requires a new regulatory system for the U.S. market for swaps and other over-the counter derivatives, which includes strict capital and margin requirements, central clearing of standardized over-the-counter derivatives, and heightened supervision of over-the-counter derivatives dealers and major market participants. These rules likely have increased the costs and collateral required to utilize derivatives, that we may determine are useful to reduce our interest rate and other risks.

Various legislative and regulatory proposals, including substantial changes in banking, and the regulation of banks, thrifts and other financial institutions, compensation, and the regulation of financial markets and their participants and financial instruments, and the regulators of all of these, as well as the taxation of these entities, are being considered by the executive branch of the federal government, Congress and various state governments, including Alabama.

The new President of the United States, and the majority party in both houses of Congress appear committed to financial regulatory reform, including changes to the Dodd-Frank Act. The President has frozen new rulemaking generally, and on February 3, 2017 issued an Executive Order (the “Executive Order”) containing “Core Principles for Regulating the United States Financial System” (“Core Principals”). The Executive Order directs the Secretary of the Treasury to consult with heads of Financial Stability Oversight Council’s members and report to the President within 120 days and periodically thereafter on how laws and government policies promote the Core Principles and to identify laws, regulations, guidance and reporting that inhibit financial services regulation in a manner consistent with the Core Principles. Another Executive Order requires the repeal of two existing rules for any new significant regulatory proposal. Although it does not apply to the SEC, the federal bank regulators or the CFPB, these independent agencies are encouraged to seek cost savings that would offset the costs of new significant regulatory actions.

Congress is also considering re-examining regulations adopted by the prior administration since June 13, 2016 under the Congressional Review Act. More sweeping changes to the Dodd-Frank Act are expected to be introduced by the Chairman of the House Financial Services Committee similar to the Financial CHOICE Act legislation introduced in 2016. These may include proposals to reduce regulation on banks and their holding companies that are well capitalized, well managed, and less risky, and eliminate or reduce regulation based on asset size alone.

Certain of these proposals, if adopted, could significantly change the regulation or operations of banks and the financial services industry. New regulations and statutes are regularly proposed that contain wide-ranging proposals for altering the structures, regulations and competitive relationships of the nation’s financial institutions.

Table of Contents