COMMUNITY FINANCIAL SYSTEM, INC. (CBU) Business

Community Financial System, Inc. (the “Company”) was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 333 Butternut Drive, Syracuse, New York 13214. The Company’s business philosophy is to operate as a diversified financial services enterprise providing a broad array of banking and other financial services to retail, commercial, institutional and governmental customers. The Company is a registered financial holding company which wholly-owns two significant subsidiaries: Community Bank, N.A. (the “Bank” or “CBNA”), and Benefit Plans Administrative Services, Inc. (“BPAS”). As of December 31, 2025, BPAS owns five subsidiaries: Benefit Plans Administrative Services, LLC (“BPA”), a provider of defined contribution plan administration services; Northeast Retirement Services, LLC (“NRS”), a provider of institutional transfer agency, master recordkeeping services, fund administration, trust, and retirement plan services; BPAS Actuarial & Pension Services, LLC (“BPAS-APS”), a provider of actuarial and benefit consulting services; BPAS Trust Company of Puerto Rico, a provider of trust and benefit plan administration services; and Hand Benefits & Trust Company (“HB&T”), a provider of collective investment fund administration and institutional trust services. NRS owns one subsidiary, Global Trust Company, Inc. (“GTC”), a non-depository trust company which provides fiduciary services for collective investment trusts and other products. HB&T owns one subsidiary, Hand Securities, Inc. (“HSI”), an introducing broker-dealer.

As of December 31, 2025, the Bank operates 192 full-service branches and 8 drive-thru only locations throughout 42 counties of Upstate New York, 9 counties of Northeastern Pennsylvania, 12 counties of Vermont, 1 county of Western Massachusetts and 1 county of Southern New Hampshire, offering a range of commercial and retail banking services. The Bank owns the following operating subsidiaries: CBNA Preferred Funding Corporation (“PFC”), CBNA Treasury Management Corporation (“TMC”), Nottingham Investment Services, Inc. (“NISI”), Nottingham Advisors, Inc. (“Nottingham Advisors”), OneGroup NY, Inc. (“OneGroup”), Nottingham Wealth Partners, Inc. (“Wealth Partners”) and Oneida Preferred Funding II LLC (“OPFC II”). OneGroup is a full-service insurance agency offering personal and commercial lines of insurance and other risk management products and services. PFC and OPFC II primarily act as investors in residential and commercial real estate activities. TMC provides cash management, investment, and treasury services to the Bank. NISI and Wealth Partners provide broker-dealer and investment advisory services. Nottingham Advisors provides asset management services to individuals, corporations, corporate pension and profit sharing plans, and foundations.

The Company maintains a website at https://communityfinancialsystem.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information posted on the website is not incorporated into or a part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at https://www.sec.gov.

Current Year Acquisitions

7 Branches from Santander Bank, N.A. in the Lehigh Valley Market

On November 7, 2025, the Company, through its subsidiary CBNA, completed the acquisition of seven branch locations in the Allentown, Pennsylvania area from Santander Bank, N.A. (“Santander”), including certain branch-related loans and deposits, acquiring $31.9 million of loans and $543.7 million of deposits. Total cash consideration was $80.9 million, including a deposit premium of 8%, or $43.5 million, and the Company recorded core deposit intangibles of $11.9 million and goodwill of $32.0 million.

Table of Contents

Financial Services Companies

During 2025, the Company, through its subsidiaries OneGroup, BPA, BPAS-APS and NISI, completed the acquisitions of certain assets of financial services companies. The assets were acquired from companies that provide insurance, employee benefit and wealth management services. Total aggregate consideration for these acquisitions was $11.2 million, including $4.5 million in cash and $6.7 million in contingent consideration arrangements. The Company recognized $8.4 million of customer list intangible assets and $2.9 million of goodwill in conjunction with these acquisitions.

Segment Information

The Company has identified four reportable operating business segments: Banking and Corporate, Employee Benefit Services, Insurance Services and Wealth Management Services. Information about the Company’s reportable business segments is included in Note U of the “Notes to Consolidated Financial Statements” filed herewith in Part II.

Business Segments

Banking

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank’s branches are located in towns and cities within its geographic market areas of Upstate New York, Northeastern Pennsylvania, Vermont, Western Massachusetts and Southern New Hampshire. The Bank is nearing completion of its process of expanding its branch presence in more densely populated markets within its geographic footprint including the Albany, Buffalo, Rochester and Syracuse regions of New York, the Lehigh Valley region of Pennsylvania, Southern New Hampshire and Springfield, Massachusetts. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch and regional levels and its digital banking service offerings, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System, the Federal Home Loan Bank of New York and the Federal Home Loan Bank of Boston (as a non-member bank) (collectively, referred to as “FHLB”), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Employee Benefit Services

Through BPAS and its subsidiaries, the Company operates a national practice that provides employee benefit trust, collective investment fund, retirement plan and health savings account administration, fund administration, transfer agency, actuarial, and health and welfare consulting services to a diverse array of clients spanning the United States and the Commonwealth of Puerto Rico.

Insurance Services

Through OneGroup, the Company offers personal and commercial lines of insurance and other risk management products and services. In addition, OneGroup offers employee benefit related services. OneGroup represents many leading and specialty insurance companies.

Wealth Management Services

Through the Bank’s Nottingham Trust division, NISI, Nottingham Advisors, and Wealth Partners, the Company provides wealth management, retirement planning, higher educational planning, fiduciary, risk management, trust services and personal financial planning services. The Company offers a range of investment products including stocks, bonds, exchange-traded funds, mutual funds, insurance and advisory products.

Table of Contents

Competition

The banking and financial services industry is highly competitive in the New York, Pennsylvania, Vermont, Massachusetts and New Hampshire markets. The Company competes actively for loans, deposits, and financial services relationships with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, including financial technology companies, insurance agencies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The Company’s employee benefits, trust and plan administration business competes on a national scale and provides geographic diversification for the Company. Certain lines of business are marketed primarily through unaffiliated financial advisors, while others are marketed directly to plan sponsors and fund companies. In order to compete with large national firms, the Company stresses its consultative approach to complex engagements.

The Company utilizes the Community Connect program, which is a joint initiative between the four operating business segments to facilitate cross-selling opportunities and connections with commercial clients between the functional areas of the business. The program intends to provide customers with interconnected solutions and enhance customer retention.

Human Capital Resources

The Company’s employees are asked to embody the core values of integrity, excellence, teamwork and humility. These values are foundational to sustaining the strength of the Company’s culture. As of December 31, 2025, the Company had 3,001 total employees, which included 2,853 full-time employees and 148 part-time and temporary employees. Of the Company’s 3,001 employees, 2,157 are in the Banking and Corporate segment (2,028 full-time employees and 129 part-time and temporary employees), 479 employees are in the Employee Benefit Services segment (471 full-time employees and 8 part-time and temporary employees), 256 are in the Insurance Services segment (246 full-time employees and 10 part-time and temporary employees), and 109 employees are in the Wealth Management Services segment (108 full-time employees and 1 part-time temporary employee). The Company’s employee base is concentrated in New York, Pennsylvania and New England where the Bank maintains its retail bank branch presence, with approximately 2,136 employees in New York, 312 in Pennsylvania and 323 in Vermont, Massachusetts and New Hampshire. Approximately 230 of the Company’s employee base is located outside of its retail banking footprint.

The Company considers its relationship with its employees to be strong. None of the Company’s employees are represented by a labor union or are represented by a collective bargaining agreement.

Oversight

The Board of Directors (the “Board”) has ultimate responsibility for the strategy of the Company. The Board’s Compensation Committee is responsible for the oversight of executive compensation, company culture, diversity, and employee engagement. The Company proactively identifies potential human capital related risks, such as succession planning, labor market shortage, increased labor costs, and employee retention strategies to mitigate those risks. Strong human capital management is viewed as integral to the Company’s business strategy.

Compensation and Benefits

The success and growth of the Company’s business is largely dependent on its ability to attract, develop, and retain a population of skilled and high-performing employees with varied backgrounds and skill sets at all levels of the organization. Accordingly, the Company’s compensation philosophy includes elements that reinforce the Company’s core values, reward employees for their achievements and maximize continued performance with long-term retention. The Company employs benchmarking measures to ensure employees are paid fairly based on their job and performance. The Company conducts workforce planning sessions periodically across all business areas to ensure competitive market pay for employees and actions to support commitment to the professional development of employees.

Table of Contents

Growth and Development

The Company continues to broaden the scope of its talent development initiatives across its widening and geographically diverse footprint in order to sustain a value-driven and growth-oriented environment where employees can perform at their peak and the next generation of leaders are prepared. The Company offers a wide range of learning and development programs, both internally and externally, that support a broad scope of the Company’s talent development initiatives making continuous learning a part of each employee’s relationship with the Company in a growth-oriented environment. The Company maintains a strong performance culture through its performance management program. The program supports setting clear expectations for all employees via annual goal setting and encourages ongoing and frequent feedback. These dialogues are intended to achieve higher performance, engagement and commitment, improving outcomes and productivity. The Company has invested in an on-line skills development platform that will expand and enhance the ability to build critical skills for today and in the future.

Culture and Attracting a Talented Workforce

The Company is committed to fostering an inclusive environment where there is a sense of purpose, belonging, and ownership, guided by the Company’s core values and dedication to serving customers. The Company empowers its workforce to achieve their full potential by supporting the development of job-related skills and personal growth within a culture that prioritizes employees’ wellbeing and fosters inclusivity. In this environment, employees feel safe to share ideas, receive support, and take thoughtful risks without the fear of judgment or retaliation.

The goal of the Company’s recruitment efforts is to provide fair opportunities to all candidates and to build a strong and positive reputation both internally and externally. To support this objective, leaders across the business and the Company’s human resource professionals share increased responsibility in recruitment and selection processes, supported by a committed Talent Acquisition team that focuses exclusively on recruitment and talent attraction to deliver a consistent, strategic and candidate-centered experience. The Company’s long-standing presence and proven track record offer candidates the stability of a well-established organization, while its forward-looking strategy continues to drive expansion into diverse geographic locations and new markets. This balanced approach provides opportunities for career growth, innovation, and meaningful impact, complemented by a comprehensive benefits package that supports employee well-being, financial security, and work-life balance. To further support effective hiring decisions, the Company initiated the use of assessments within the recruitment process. These assessments are intended to promote objectivity, alignment with role requirements, and a positive candidate experience. The Company remains committed to continuing to grow, refine, and develop these assessment practices as part of its ongoing investment in talent acquisition excellence.

Engagement

The Company is committed to creating a top-tier workplace filled with highly satisfied and engaged employees. The Company believes that open and honest communication among employees, managers and executive leadership fosters an open and collaborative work environment where everyone can participate, develop, and thrive. The Company continues to conduct a survey annually to maintain a feedback loop with employees. In 2023, the Company selected Engagement Champions whose role is to support leaders and managers in the ongoing engagement efforts and initiatives. In 2024, the CEO instituted a Company-wide employee townhall to enhance communication and transparency relative to the Company’s strategy and priorities. The townhalls include a Q&A segment where the CEO answers questions on a variety of topics. The town halls are conducted twice a year and continue to serve as a key component of transparent communication with all employees.

Health and Safety

The health and safety of the Company’s employees is of utmost importance. The Company is committed to providing tools and resources to support employees’ overall health and wellbeing. This includes offering a variety of health and welfare benefits as well as a holistic wellbeing program.

Table of Contents

Supervision and Regulation

General

The banking industry is highly regulated with numerous statutory and regulatory requirements that are designed primarily for the protection of depositors and the financial system. Set forth below is a description of the material laws and regulations applicable to the Company and the Bank. This summary is not complete and the reader should refer to these laws and regulations for more detailed information. The Company’s and its subsidiaries’ failure to comply with applicable laws and regulations could result in a range of sanctions and administrative actions imposed upon the Company and/or its subsidiaries, including restrictions on merger and acquisition activity, the imposition of civil money penalties, formal agreements and cease and desist orders. New laws and regulations, more complex regulations, and changes in regulators’ interpretations and application of existing laws and regulations cannot be predicted and may have a material adverse effect on the Company’s businesses and results.

The Company and its subsidiaries are subject to the laws and regulations of the federal government and, where applicable, the states and jurisdictions in which they conduct business. The Company, as a financial holding company, is subject to extensive regulation and supervision by the Board of Governors of the Federal Reserve System (“FRB” or “Federal Reserve”) as its primary federal regulator. The Bank is a federally chartered national bank and is subject to extensive regulation and supervision by the Office of the Comptroller of the Currency (“OCC”) as its primary federal regulator, and as to certain matters, the FRB, the Consumer Financial Protection Bureau (“CFPB”), and the FDIC. The Company expects the current federal government administration will continue to implement a regulatory reform agenda that impacts the rulemaking, supervision, examination and enforcement priorities of the federal banking agencies.

The Company is also subject to the jurisdiction of the SEC and is subject to disclosure and regulatory requirements under the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended. The Company’s common stock is listed on the New York Stock Exchange (“NYSE”) and it is subject to NYSE’s rules for listed companies. Affiliated entities, including BPAS, BPA, NRS, GTC, HB&T, HSI, BPAS Trust Company of Puerto Rico, Nottingham Advisors, NISI, OneGroup, and Wealth Partners are subject to the jurisdiction of certain state and federal regulators and self-regulatory organizations including, but not limited to, the SEC, the Texas Department of Banking, the State of Maine Bureau of Financial Institutions, the Financial Industry Regulatory Authority (“FINRA”), Puerto Rico Office of the Commissioner of Financial Institutions, the U.S. Department of Labor, and state securities and insurance regulators.

Federal Bank Holding Company Regulation

As the Company is classified as a financial holding company, the Company can affiliate with securities firms and insurance companies and engage in other activities that are “financial in nature” or “incidental” or “complementary” to activities that are financial in nature, as long as it continues to meet the eligibility requirements for financial holding companies (including requirements that the financial holding company and its depository institution subsidiary maintain their status as “well capitalized” and “well managed”).

Generally, FRB approval is not required for the Company to acquire a company (other than a bank holding company, bank or savings association) engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the FRB. Prior notice to the FRB may be required, however, if the company to be acquired has total consolidated assets of $10 billion or more. Prior FRB approval is required before the Company may acquire the beneficial ownership or control of more than 5% of the voting shares or substantially all of the assets of a bank holding company, bank or savings association.

As the Company is a financial holding company, if the Bank were to not maintain a Satisfactory or better rating under the Community Reinvestment Act of 1977, as amended (“CRA”), the Company would be prohibited, until the rating is raised to Satisfactory or better, from engaging in new activities or acquiring companies other than bank holding companies, banks or savings associations, except that the Company could engage in new activities, or acquire companies engaged in activities, that are considered “closely related to banking” under the Bank Holding Company Act of 1956, (the “BHC Act”). The Bank’s most recent CRA rating was “Satisfactory”. In addition, if the FRB determines that the Company or the Bank is not well capitalized or well managed, the Company would be required to enter into an agreement with the FRB to comply with all applicable capital and management requirements and may contain additional limitations or conditions. Until corrected, the Company could be prohibited from engaging in any new activity or acquiring companies engaged in activities that are not closely related to banking, absent prior FRB approval.

Table of Contents

Federal Reserve System Regulation

As the Company is a financial holding company, it is subject to regulatory capital requirements. The Bank is under similar capital requirements administered by the OCC as discussed below. FRB policy has historically required a financial holding company to act as a source of financial and managerial strength to its subsidiary banks. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) codifies this historical policy as a statutory requirement. To the extent the Bank is in need of regulatory capital, the Company would be expected to provide additional capital, including borrowings from the FRB for such purpose. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors’ funds.

The FRB also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the FRB, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust its strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond its control.

The Office of the Comptroller of the Currency Regulation (“OCC”)

The Bank is supervised by the OCC. OCC supervision consists of multiple examinations of the Bank’s activities over the course of its annual supervisory cycle. The various laws and regulations administered by the OCC affect the Company’s practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects the Bank’s business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and the location of its offices. The OCC generally prohibits a depository institution from making any capital distributions, including the payment of a dividend, or paying any management fee to its parent holding company if the depository institution would become undercapitalized due to the payment. Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the OCC. The OCC may take enforcement actions for a variety of supervisory concerns, including violations of laws, rules or regulations and unsafe and unsound practices. As a result, the OCC could also establish individual minimum capital ratios (“IMCR”) for the Bank that are higher than the regulatory minimums. This would impair the Bank’s ability to pay dividends to the Company. The Bank is well capitalized under regulatory standards administered by the OCC. For additional information on the Company’s capital requirements see “Management’s Discussion and Analysis of Financial Condition and Results of Operations – Shareholders’ Equity and Regulatory Capital” and Note P to the Financial Statements.

During 2025, the OCC announced a number of initiatives intended to tailor regulatory and supervisory expectations for community banks, including the release of a notice of proposed rulemaking to expand the definition of community banks to include institutions with less than $30 billion in total assets. These initiatives are focused on reducing the regulatory burden on smaller, lower risk national banks and include refinements to examination processes, supervisory practices, and certain data collection requirements. The OCC has indicated that these changes are designed to improve examination efficiency, enhance supervisory clarity, and focus regulatory attention on areas of heightened or material risk. While these initiatives may reduce certain compliance and operational burdens, the Company remains subject to comprehensive prudential regulation and supervisory oversight, and changes in regulatory priorities or expectations could continue to affect the Company’s operations, compliance costs, and strategic planning. Additionally, some of the administration’s policy initiatives could have unforeseen negative consequences directly on the bank’s operations or the credit markets that it lends. If deposit alternatives, such as stablecoin, were to gain significant market share among retail and commercial depositors, it could have a significant negative impact on the Bank’s liquidity and funding costs.

Table of Contents

Federal Home Loan Bank (“FHLB”)

The Bank is a member of the FHLB, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to certain rules and requirements as a member institution of the FHLB, including the purchase of shares of FHLB activity-based stock in the amount of 4.5% of the dollar amount of outstanding advances and FHLB capital stock in an amount equal to the greater of $1,000 or the sum of 0.15% of the mortgage-related assets held by the Bank based upon the previous year-end financial information. The Bank was in compliance with the rules and requirements of the FHLB at December 31, 2025.

Deposit Insurance

Deposits of the Bank are insured up to the applicable limits by the Deposit Insurance Fund (“DIF”) and are subject to deposit insurance assessments to maintain the DIF. The Dodd-Frank Act permanently increased the maximum amount of deposit insurance to $250,000 per deposit category, per depositor, per institution. A depository institution’s DIF assessment is calculated by multiplying its assessment rate by the assessment base, which is defined as the average consolidated total assets less the average tangible equity of the depository institution. The Bank’s deposit insurance assessment is based on a large institution classification. For large insured depository institutions, generally defined as those with at least $10 billion in total assets, the FDIC uses capital and supervisory ratings (“CAMELS”) and financial measures from two scorecards to calculate assessment rates. Each scorecard has two components - a performance score and loss severity score, which are combined and converted to an initial assessment rate. The FDIC has the ability to adjust a large or highly complex insured depository institution’s total score by a maximum of 15 points, up or down, based upon significant risk factors that are not captured by the scorecard. Under the assessment rate schedule effective for 2025, the initial base assessment rate for large and highly complex insured depository institutions ranges from five to 32 basis points, and the total base assessment rate, after applying the unsecured debt and brokered deposit adjustments, ranges from two and one-half to 42 basis points. The Bank’s FDIC insurance for 2025 was based on assessment rates ranging between six and seven basis points compared to assessment rates ranging between five and seven basis points for 2024 and five and six basis points for 2023.

Under the Federal Deposit Insurance Act (“FDIA”), if the FDIC finds that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, the FDIC may determine that such violation or unsafe or unsound practice or condition require the termination of deposit insurance.

The FDIA requires federal bank regulatory agencies to prescribe, by regulation or guideline, operational and managerial standards for all insured depository institutions that relate to, among other things: (i) internal controls, information systems and audit systems; (ii) loan documentation; (iii) credit underwriting; (iv) interest rate exposure; (v) asset growth and quality; and (vi) compensation and benefits. Federal banking agencies have adopted regulations and Interagency Guidelines Prescribing Standards for Safety and Soundness to implement these requirements, which regulators use to identify and address problems at insured depository institutions before capital becomes impaired. If a regulator determines that a bank fails to meet any standards prescribed by the guidelines, the bank may be required to submit an acceptable plan to achieve compliance and agree to specific deadlines for the submission to and review by the regulator of reports confirming progress in implementing the safety and soundness compliance plan. Failure to implement such a plan may result in an enforcement action against the bank.

Enforcement actions against the Company, the Bank and their respective officers and directors may include the issuance of a written directive, the issuance of a cease-and-desist order that can be judicially enforced, the imposition of civil money penalties, the issuance of directives to increase capital, the issuance of formal and informal agreements, the issuance of removal and prohibition orders against officers or other institution-affiliated parties, the imposition of restrictions and sanctions under prompt corrective action regulations, the termination of deposit insurance (in the case of the Bank) and the appointment of a conservator or receiver for the Bank. Civil money penalties can be over $2 million for each day a violation continues.

Various proposals are under active consideration by policymakers that could affect the scope of deposit insurance coverage. For example, bipartisan legislation has been introduced in the U.S. Senate that would significantly raise the deposit insurance limit for certain noninterest-bearing transaction accounts, subject to legislative approval and funding determinations. In addition, Congress and the FDIC have conducted oversight hearings and agency analyses exploring broader deposit insurance reform alternatives, including adjusting coverage limits and targeted insurance frameworks for specific account types. The ultimate outcome, timing, and scope of any changes remain uncertain and could materially affect deposit flows, competitive dynamics, and regulatory costs.

Table of Contents

Transactions with Affiliates and Insiders

The Bank is subject to Section 23A of the Federal Reserve Act, as amended (the "FRA") which places limits on, among other covered transactions, the amount of loans or extensions of credit to affiliates that may be made by the Bank. Extensions of credit to affiliates must be adequately collateralized by specified amounts and types of collateral. Section 23A also limits the amount of loans or advances made by the Bank to third-party borrowers that are collateralized by securities or obligations of the Bank's affiliates. The Bank is also subject to Section 23B of the FRA, which, among other things, prohibits an institution from engaging in transactions with affiliates unless the transactions are on terms substantially the same, or at least as favorable to such institution or its subsidiaries, as those prevailing at the time for comparable transactions with non-affiliates.

The Company is subject to restrictions on extensions of credit to insiders (namely executive officers, directors, and 10% stockholders) and their related interests. These restrictions are contained in the FRA and Federal Reserve Regulation O and apply to all insured depository institutions as well as their subsidiaries and holding companies. These restrictions include limits on loans to any individual insider and such insider's related interests and certain conditions that must be met before such loans can be made. There is also an aggregate limitation on all loans to insiders and their related interests, which cannot exceed the institution's total unimpaired capital and surplus, unless the FDIC determines that a lesser amount is appropriate. Insiders are subject to enforcement actions for knowingly accepting loans in violation of applicable restrictions.

Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

On July 21, 2010, the Dodd-Frank Act was signed into law, which resulted in significant changes to the banking industry. The Dodd-Frank Act contains numerous provisions that affect all banks and bank holding companies and impacts how the Company and the Bank handle their operations. The Dodd-Frank Act requires various federal agencies, including those that regulate the Company and the Bank, to promulgate rules and regulations and to conduct various studies and reports for Congress. The federal agencies have either completed or are in the process of completing these rules and regulations and have been given significant discretion in drafting such rules and regulations. Several of the provisions of the Dodd-Frank Act have the consequence of increasing the Bank’s expenses, decreasing its revenues, and changing the activities in which it chooses to engage. The specific impact of the Dodd-Frank Act on the Company’s current activities or new financial activities the Company may consider in the future, the Company’s financial performance, and the markets in which the Company operates depends on the manner in which the relevant agencies continue to develop and implement the required rules and regulations and the reaction of market participants to these regulatory developments.

Pursuant to FRB regulations mandated by the Dodd-Frank Act, interchange fees on debit card transactions are limited to a maximum of $0.21 per transaction plus 5 basis points of the transaction amount. A debit card issuer may recover an additional one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements prescribed by the FRB. The FRB also adopted requirements in the final rule that issuers include two unaffiliated networks for routing debit transactions that are applicable to the Company and the Bank. On October 25, 2023, the FRB proposed to lower the maximum interchange fee that a large debit card issuer can receive for a debit card transaction. The proposal would also establish a regular process for updating the maximum amount every other year going forward. The Company continues to monitor the development of these proposed rule revisions.

The Dodd-Frank Act established the CFPB and empowered it to exercise broad rulemaking, supervision, and enforcement authority for a wide range of consumer protection laws. Because the Bank’s total consolidated assets exceed $10 billion, the Bank is subject to the direct supervision of the CFPB. If the CFPB were to implement rules that negatively impacted the Bank’s products or services, it could have a material negative impact on its operations.

Table of Contents

The CFPB has broad powers to supervise and enforce consumer protection laws, including laws that apply to banks in order to prohibit unfair, deceptive or abusive acts or practices (“UDAAP”). The Dodd-Frank Act also clarified the federal preemption rules that are applicable to national banks and gives state attorney generals for the states certain powers to enforce federal consumer protection laws. A violation of the consumer protection and privacy laws, and in particular UDAAP, could have serious legal, financial, and reputational consequences.

The CFPB, FRB, and OCC are also authorized to collect fines and provide consumer restitution in the event of violations, engage in consumer financial education, track consumer complaints, request data and promote the availability of financial services to underserved consumers and communities. The CFPB is authorized to pursue administrative proceedings or litigation for violations of federal consumer financial laws. In these proceedings, the CFPB can obtain cease and desist orders (which can include orders for restitution or rescission of contracts, as well as other kinds of affirmative relief) and monetary penalties.

The final rules issued by the FRB, SEC, OCC, FDIC, and Commodity Futures Trading Commission implementing Section 619 of the Dodd-Frank Act (commonly known as the Volcker Rule) prohibit insured depository institutions and companies affiliated with insured depository institutions from (1) engaging in short-term proprietary trading of certain securities, derivatives, commodity futures and options on these instruments, for their own account and (2) sponsoring certain covered funds, subject to certain limited exceptions. The final rules of the Volcker Rule are not material to the Company’s investing and trading activities.

The Dodd-Frank Act requires U.S. financial regulators, including the FRB and the SEC, to adopt rules on incentive-based payment arrangements at specified regulated entities having at least $1 billion in total assets. In 2016, the federal banking regulators, the SEC, the Federal Housing Finance Agency and the National Credit Union Administration proposed revised rules on incentive-based compensation practices, which have not yet been finalized. If these or other regulations are adopted in a form similar to what has been proposed, they will impose limitations on the manner in which the Company may structure compensation for its employees, which could adversely affect the Company’s ability to hire, retain and motivate key employees.

The ongoing effects of the Dodd-Frank Act, as well as the recent and possible future changes to the regulatory framework as a result of the Economic Growth Act and future proposals make it difficult to assess the overall financial impact of the Dodd-Frank Act and related regulatory developments on the Company and the banking industry. As a result, the Company cannot predict the ultimate impact of the Dodd-Frank Act on the Company or the Bank, including the extent to which it could increase costs or limit the Company’s ability to pursue business opportunities in an efficient manner, or otherwise adversely affect its business, financial condition and results of operations. Nor can the Company predict the impact or substance of other future legislation or regulation. However, it is expected that future legislation or regulation at a minimum will increase the Company’s and the Bank’s operating and compliance costs. As rules and regulations continue to be implemented or issued, the Company may need to dedicate additional resources to ensure compliance, which may increase its costs of operations and adversely impact the Company’s earnings.

Capital Requirements

The Company and the Bank are required to comply with applicable capital adequacy standards established by the federal banking agencies (the “Capital Rules”) which are based on the Basel Committee on Banking Supervision’s (the “Basel Committee”) 2010 final capital framework for strengthening international capital standards, referred to as “Basel III”.

The Capital Rules, among other things, impose a capital measure called “Common Equity Tier 1,” (“CET1”) to which most deductions/adjustments to regulatory capital measures are to be made. In addition, the Capital Rules specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting certain specified requirements.

Under the Capital Rules, the minimum capital ratios are as follows:

● 4.5% CET1 to total risk-weighted assets;

● 6.0% Tier 1 capital (CET1 plus Additional Tier 1 capital) to total risk-weighted assets;

● 8.0% Total capital (Tier 1 Capital plus Tier 2 capital) to total risk-weighted assets;

● 4.0% Tier 1 capital to total adjusted quarterly average assets (known as “leverage ratio”)

Table of Contents

The Capital Rules require the Company and the Bank to maintain a “capital conservation buffer” composed entirely of CET1. Banking organizations are required to maintain a minimum capital conservation buffer of 2.5% (CET1 to total risk-weighted assets), in addition to the minimum risk-based capital ratios. Therefore, to satisfy both the minimum risk-based capital ratios and the capital conservation buffer, a banking organization is required to maintain the following: (i) CET1 to total risk-weighted assets of at least 7%, (ii) Tier 1 capital to total risk-weighted assets of at least 8.5%, and (iii) Total capital (Tier 1 capital plus Tier 2 capital) to total risk-weighted assets of at least 10.5%. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions that do not maintain a capital conservation buffer of 2.5% or more will face constraints on dividends, common share repurchases and incentive compensation based on the amount of the shortfall.

The Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, deferred tax assets dependent upon future taxable income and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. Under the Capital Rules, the effects of certain accumulated other comprehensive income or loss items are not excluded for the purposes of determining regulatory capital; however, banks not using the advanced approach, including the Company and the Bank, were permitted to, and in the case of the Company and the Bank did, make a one-time permanent election to continue to exclude these items.

With respect to the Bank, the Capital Rules also revised the prompt corrective action (“PCA”) regulations established pursuant to Section 38 of the Federal Deposit Insurance Act, establishing the CET1 ratio at 6.5% for well-capitalized status and the Tier 1 capital ratio at 8.0% for well-capitalized status. The Capital Rules do not change the total risk-based PCA capital requirement for any capital category.

The Capital Rules prescribe a standardized approach for risk weighted-assets that expands the risk-weight categories from the four Basel I-derived categories (0%, 20%, 50% and 100%) to a larger and more risk-sensitive number of categories, depending on the nature of the asset. The risk-weight categories generally range from 0% for U.S. government and agency securities, to 1,250% for certain securitized exposures, and result in higher risk weights for a variety of asset categories. The standardized approach requires financial institutions to transition assets that are 90 days or more past due or on nonaccrual from their original risk weight to 150 percent. Additionally, loans designated as high volatility commercial real estate (“HVCRE”) are assigned a risk-weighting of 150 percent.

Requirements to maintain higher levels of capital or to maintain higher levels of liquid assets could adversely impact the Company’s net income and return on equity. The current requirements and the Company’s actual capital levels are detailed in Note P of “Notes to Consolidated Financial Statements” filed in Part II, Item 8, “Financial Statements and Supplementary Data.”

Consumer Protection Laws

In connection with its banking activities, the Bank is subject to a number of federal and state laws designed to protect consumers and promote lending to various sectors of the economy. These laws include but are not limited to the Equal Credit Opportunity Act, the Gramm-Leach-Bliley Act (“GLB Act”), the Fair Credit Reporting Act (“FCRA”), the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”), the Electronic Funds Transfer Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Dodd-Frank Act, the Real Estate Settlement Procedures Act, the Secure and Fair Enforcement for Mortgage Licensing Act (“SAFE”), the Servicemembers Civil Relief Act (“SCRA”), the Military Lending Act (“MLA”), and various state law counterparts. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must interact with clients when taking deposits, making loans, collecting and servicing loans and providing other services. The Company is subject to regulation by the CFPB, which is responsible for promoting fairness and transparency for mortgages, credit cards, deposit accounts and other consumer financial products and services and for interpreting and enforcing the federal consumer financial laws that govern the provision of such products and services. The CFPB is also authorized to prevent any institution under its authority from engaging in an unfair, deceptive, or abusive act or practice in connection with consumer financial products and services.

Table of Contents

The GLB Act requires all financial institutions to adopt privacy policies, restrict the sharing of nonpublic customer data with nonaffiliated parties and establish procedures and practices to protect customer data from unauthorized access. The GLB Act also requires certain disclosures to consumers about information collection, sharing, and security practices and their right to “opt out” of the institution’s disclosure of their personal financial information to non-affiliated third-parties (with certain exceptions). In addition, the FCRA, as amended by the FACT Act, includes provisions affecting the Company, the Bank, and their affiliates, including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. The FACT Act requires persons subject to FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the Federal Trade Commission have extensive rulemaking authority under the FACT Act, and the Company and the Bank are subject to the rules that have been created under the FACT Act, including rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate certain identity theft red flags. The SCRA protects persons called to active military service and their dependents from undue hardship resulting from their military service, and the MLA extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The SCRA applies to all debts incurred prior to the commencement of active duty and limits the amount of interest, including service and renewal charges and any other fees or charges (other than bona fide insurance) that are related to the obligation or liability. The MLA applies to certain consumer loans and extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The Company and the Bank are also subject to data security standards and data breach notice requirements issued by various states, the OCC and other regulatory agencies. The Bank has created policies and procedures to comply with these consumer protection requirements.

The CFPB has implemented the ability-to-repay and qualified mortgage (QM) provisions of the Truth in Lending Act (the “QM Rule”) and has taken steps to modify the QM Rule. The ability-to-repay provision requires creditors to make reasonable, good faith determinations that borrowers are able to repay their mortgages before extending credit based on a number of factors and consideration of financial information about the borrower derived from reasonably reliable third-party documents. Under the Dodd-Frank Act and the QM Rule, loans meeting the definition of “qualified mortgage” are entitled to a presumption that the lender satisfied the ability-to-repay requirements. The presumption is a conclusive presumption/safe harbor for loans meeting the QM requirements, and a rebuttable presumption for higher-priced loans meeting the QM requirements. The Bank has created policies and procedures to comply with these consumer protection requirements and continues to monitor developments relative to future changes to the QM Rule.

Among other provisions, the federal banking rule under the Electronic Fund Transfer Act prohibits financial institutions from charging consumers fees for paying overdrafts on automated teller machines and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions. The rule does not govern overdraft fees on the payment of checks and certain other forms of bill payments.

In recent periods, the CFPB has finalized and proposed rules related to consumer financial data access, fee practices and other aspects of consumer banking. Certain of these rules are subject to legal challenge or further regulatory action and their ultimate scope, timing and applicability remain uncertain.

In May 2024, the SEC finalized amendments to require broker-dealers, investment companies and investment advisers registered with the SEC to adopt written policies and procedures for incident response programs to address unauthorized access to or use of customer information. The amendments also require covered entities to notify, within 30 days, individuals affected by an incident involving sensitive customer information and provide them with details about the incident and other information intended to help affected individuals respond appropriately. Compliance with these amendments began on December 3, 2025.

The Bank Secrecy Act

The Bank Secrecy Act (“BSA”) requires all financial institutions, including banks and securities broker-dealers, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. The BSA includes a variety of recordkeeping and reporting requirements (such as currency transaction and suspicious activity reporting), as well as due diligence/know-your-customer documentation requirements. The Company has established a BSA/anti-money laundering program and taken other appropriate measures in order to comply with BSA requirements.

Table of Contents

Anti-Money Laundering Act of 2020

The Anti-Money Laundering Act of 2020 (“AMLA”) amends the BSA and was enacted in January 2021. The AMLA was intended to reform and modernize U.S. bank secrecy and anti-money laundering laws. The Company has and will continue to review and monitor its anti-money laundering program to ensure it complies with the provisions of the AMLA.

In July 2024, the federal banking agencies, including the Federal Reserve and OCC, proposed amendments to update the requirements for supervised institutions to establish, implement and maintain effective, risk-based and reasonably designed AML and countering the financing of terrorism ("CFT") programs. The proposed amendments would require supervised institutions to identify, evaluate and document the regulated institution's money laundering, terrorist financing and other illicit finance activity risks, as well as consider, as appropriate, the U.S. Department of the Treasury's Financial Crimes Enforcement Network's ("FinCEN") published national AML/CFT priorities.

In August 2024, the Financial Crimes Enforcement Network (“FinCEN”), which drafts regulations implementing anti-money laundering legislation, adopted a rule extending anti-money laundering obligations, including maintenance of an anti-money laundering program and filing certain reports with FinCEN, to registered investment advisers, like certain of the Company’s subsidiaries. On December 31, 2025, FinCEN issued a final rule to extend the effective date of this rule from January 1, 2026 until January 1, 2028 to provide additional time for FinCEN to review and tailor the rule.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The USA Patriot Act also encourages information-sharing among financial institutions, regulators, and law enforcement authorities by providing an exemption from the privacy provisions of the GLB Act for financial institutions that comply with the provision of the Act. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the institution. The Company has approved policies and procedures that are designed to comply with the USA Patriot Act and its regulations.

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others administrated by the Treasury’s Office of Foreign Assets Control (“OFAC”). The OFAC administered sanctions can take many different forms; however, they generally contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, entity or individual, including prohibitions against direct or indirect imports and exports and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments, or providing investment related advice or assistance; and (ii) a blocking of assets in which the government or specially designated nationals have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences. The Company has approved policies and procedures that are designed to comply with OFAC and its regulations.

Table of Contents

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934, as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) an independent accounting oversight board for the accounting industry; (iv) standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on non-preferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violations of the securities laws. The Company has approved policies and procedures that are designed to comply with the Sarbanes-Oxley Act and its regulations.

Community Reinvestment Act of 1977

Under the CRA, the Bank is required to help meet the credit needs of its communities, including low- and moderate-income neighborhoods. Although the Bank must follow the requirements of CRA, it does not limit the Bank’s discretion to develop products and services that are suitable for a particular community or establish lending requirements or programs. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibits discrimination in lending practices. The Bank’s failure to comply with the provisions of the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s failure to comply with the Equal Credit Opportunity Act and the Fair Housing Act could result in enforcement actions against it by its regulators as well as other federal regulatory agencies and the Department of Justice. The Bank’s most recent CRA rating was “Satisfactory”.

On October 24, 2023, the FRB, FDIC and OCC jointly issued a final rule intended to strengthen and modernize regulations implementing the CRA to encourage banks to expand access to credit, investment, and banking services in low- and moderate-income communities, adapt to changes in the banking industry, including internet and mobile banking, provide greater clarity and consistency in the application of the CRA regulations and tailor CRA evaluations and data collection to bank size and type. The implementation of this rule was subsequently stayed and on July 16, 2025 the FRB, FDIC and OCC jointly issued a proposal to rescind the aforementioned rule and replace it with the prior CRA regulations, with certain technical amendments. Accordingly, the CRA continues to be administered under the regulatory framework in effect prior to the issuance of the October 2023 final rule.

Cyber Security

The federal bank regulators have adopted rules providing for new notification requirements for banking organizations and their service providers for significant cybersecurity incidents. Specifically, the new rules require a banking organization to notify its primary federal regulator as soon as possible, and no later than 36 hours after, the banking organization determines that a "computer-security incident" rising to the level of a "notification incident" has occurred. Notification is required for incidents that have materially affected or are reasonably likely to materially affect the viability of a banking organization's operations, its ability to deliver banking products and services, or the stability of the financial sector. Service providers are required under the rule to notify affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has materially affected or is reasonably likely to materially affect the banking organization's customers for four or more hours.

Table of Contents

Guidance for Third-Party Relationships

On June 9, 2023, the Federal Reserve, OCC, and FDIC issued final interagency guidance on risk management of third-party relationships. The interagency guidance is based, in part, on the regulators’ previously existing third-party risk management guidance from 2013 and seeks to, among other things, promote consistency in third-party risk management and provide sound risk management guidance for third-party relationships commensurate with a bank's risk profile and complexity as well as the criticality of the activity. The final interagency guidance replaces each agency's existing guidance on this topic and is directed to all banking organizations supervised by the Federal Reserve, OCC, and FDIC. Additionally, third-party relationship risk management and banking-as-a-service arrangements (including with respect to deposit products and services) have continued to be topics of focus for federal bank regulators in 2025 and further rulemaking activity or guidance may be forthcoming.

Guiding and Establishing National Innovation for U.S. Stablecoins Act

On July 18, 2025, the Guiding and Establishing National Innovation for U.S. Stablecoins Act (the “GENIUS Act”) became U.S. law. The statute provides a federal regulatory framework for the issuance of stablecoins. If stablecoins become widely adopted by retail and/or commercial bank depositors as a substitute for bank accounts, financial institutions, such as CBNA, would experience a substantial negative impact on their liquidity, ability to originate loans and related interest income. It is highly uncertain what the impact of this law will be on CBNA’s future financial condition.

Future Legislation and Regulation

Laws, regulations and policies are continually under review by Congress and state legislatures and federal and state regulatory agencies. In addition to the specific legislation and regulations described above, future legislation and regulations or changes to existing statutes, regulations or regulatory policies applicable to the Company and its subsidiaries may affect the business, financial condition and results of operations in adverse and unpredictable ways and increase reporting requirements and compliance costs. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted.

Table of Contents

Information about Our Executive Officers

The executive officers of the Company and the Bank who are elected by the Board of Directors are as follows:

Dimitar A. Karaivanov 44 Director, President and Chief Executive Officer. Mr. Karaivanov assumed his current position on January 1, 2024. He previously served as Executive Vice President and Chief Operating Officer from October 2022 to December 2023 and Executive Vice President of Financial Services and Corporate Development from June 2021 to September 2022. Prior to joining the Company, he was the Managing Director of Lazard Middle Market’s Financial Institutions Group from June 2018 through June 2021. Prior to Lazard, he was the Managing Director of RBC Capital Markets’ Financial Institutions Group from April 2011 through June 2018. Marya Burgio Wlos 48 Executive Vice President and Chief Financial Officer. Ms. Burgio Wlos joined the Company on March 31, 2025. Prior to joining the Company, Ms. Wlos served as Managing Director and COO of the Investment Bank at M&T Bank from January 2021 through March 2025. Ms. Wlos served as Head of Management Accounting, Finance at M&T Bank from September 2018 through January 2021 and as Head of Trading Relationship Management, UBS Asset Management at UBS AG from November 2013 through August 2018. Prior to that time, Ms. Wlos served in various finance roles at Citadel LLC from April 2008 through September 2012 and at Bank of America from January 2007 to April 2008. Maureen Gillan-Myer 58 Executive Vice President and Chief Administration and Human Resources Officer. Ms. Gillan-Myer assumed her current position on October 1, 2024. She joined the Company as Executive Vice President and Chief Human Resources Officer on October 1, 2021. Prior to joining the Company, she served as the Chief Human Resources Officer of HSBC US from February 2016 through September 2021 and as its Senior Vice President - Talent Acquisition from May 2009 through February 2016. Michael N. Abdo 48 Executive Vice President and General Counsel. Mr. Abdo assumed his current position in July 2022. He served as Associate General Counsel from 2013 to 2020 and as Senior Vice President and Senior Associate General Counsel from January 2020 to July 2022. Prior to joining the Company in 2013, he was an associate with Cadwalader Wickersham & Taft. Matthew K. Durkee 63 Senior Vice President, Chief Banking Officer and President of Commercial Banking. Mr. Durkee assumed his current position on January 1, 2026. He served as President, Commercial Banking from January 2024 through December 2025 and the President of the New England Region from January 2022 through December 2023. Prior to joining the Bank, he served as Executive Vice President and New England President for NBT Bank, N.A. from 2009 to 2020.

Table of Contents

Community Financial System, Inc. (the “Company”) was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company was formerly named Community Bank System, Inc. until May 15, 2024. The Company’s business philosophy is to operate as a diversified financial services enterprise providing a broad array of banking and other financial services to retail, commercial, institutional and governmental customers. The Company is a registered financial holding company which wholly-owns two significant subsidiaries: Community Bank, N.A. (the “Bank” or “CBNA”), and Benefit Plans Administrative Services, Inc. (“BPAS”). As of December 31, 2024, BPAS owns five subsidiaries: Benefit Plans Administrative Services, LLC (“BPA”), a provider of defined contribution plan administration services; Northeast Retirement Services, LLC (“NRS”), a provider of institutional transfer agency, master recordkeeping services, fund administration, trust, and retirement plan services; BPAS Actuarial & Pension Services, LLC (“BPAS-APS”), a provider of actuarial and benefit consulting services; BPAS Trust Company of Puerto Rico, a provider of trust and benefit plan administration services; and Hand Benefits & Trust Company (“HB&T”), a provider of collective investment fund administration and institutional trust services. BPA owns one subsidiary, Fringe Benefits Design of Minnesota, Inc. (“FBD”), a provider of retirement plan administration and benefit consulting services. NRS owns one subsidiary, Global Trust Company, Inc. (“GTC”), a non-depository trust company which provides fiduciary services for collective investment trusts and other products. HB&T owns one subsidiary, Hand Securities, Inc. (“HSI”), an introducing broker-dealer.

As of December 31, 2024, the Bank operates 185 full-service branches and 11 drive-thru only locations throughout 42 counties of Upstate New York, six counties of Northeastern Pennsylvania, 12 counties of Vermont, and one county of Western Massachusetts, offering a range of commercial and retail banking services. The Bank owns the following operating subsidiaries: The Carta Group, Inc. (“Carta Group”), CBNA Preferred Funding Corporation (“PFC”), CBNA Treasury Management Corporation (“TMC”), Community Investment Services, Inc. (“CISI”), Nottingham Advisors, Inc. (“Nottingham”), OneGroup NY, Inc. (“OneGroup”), OneGroup Wealth Partners, Inc. (“Wealth Partners”) and Oneida Preferred Funding II LLC (“OPFC II”). OneGroup is a full-service insurance agency offering personal and commercial lines of insurance and other risk management products and services. PFC and OPFC II primarily act as investors in residential and commercial real estate activities. TMC provides cash management, investment, and treasury services to the Bank. CISI, Carta Group and Wealth Partners provide broker-dealer and investment advisory services. Nottingham provides asset management services to individuals, corporations, corporate pension and profit sharing plans, and foundations.

The Company maintains a website at cbna.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information posted on the website is not incorporated into or a part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at https://www.sec.gov.

Acquisition History (2022-2024)

2024 – Insurance Agencies

During 2024, the Company, through its subsidiary OneGroup, completed acquisitions of three insurance agencies headquartered in New York and two insurance agencies headquartered in Florida. Total aggregate consideration for these acquisitions was $10.3 million, including $9.6 million in cash and contingent consideration with an estimated fair value of $0.7 million at acquisition date. Net assets acquired were $6.4 million, including $6.8 million of customer list intangible assets and the Company recorded goodwill of $3.9 million.

Table of Contents

2024 – Creative Plan Designs Limited

On February 1, 2024, the Company, through its subsidiary BPA, completed the acquisition of certain assets of Creative Plan Designs Limited (“CPD”), a financial services company that provides employee benefit plan design, administration and consulting services. Total consideration was $5.9 million in cash plus contingent consideration with an estimated fair value of $3.0 million at acquisition date. Net assets acquired were $4.5 million, including $5.5 million of customer list intangible assets, and the Company recorded $4.4 million of goodwill in conjunction with the acquisition.

2023 – Axiom Realty Group

On March 1, 2023, the Company, through its subsidiary CBNA, completed the acquisition of certain assets of Axiom Realty Group, which includes Axiom Capital Corp., Axiom Realty Management, LLC and Axiom Realty Advisors, LLC (collectively referred to as “Axiom”), a commercial real estate finance and advisory firm, for $1.8 million in cash. The Company recorded a $1.2 million customer list intangible and recognized $0.6 million of goodwill in conjunction with the acquisition.

2023 – Financial Services Companies

During 2023, the Company, through its subsidiaries OneGroup, Wealth Partners and BPAS, completed the acquisition of certain assets of financial services companies. The acquired companies provide insurance, wealth management and benefit plan recordkeeping services and are headquartered in New York, Pennsylvania and Florida. Total aggregate consideration for these acquisitions was $8.2 million, including $6.8 million in cash and $1.4 million in contingent consideration arrangements. Aggregate assets acquired were $5.2 million, including $5.0 million of customer list intangible assets, and the Company recorded goodwill of $3.0 million.

2022 – Elmira Savings Bank

On May 13, 2022, the Company completed its merger with Elmira Savings Bank (“Elmira”), a New York State chartered savings bank headquartered in Elmira, New York, for $82.2 million in cash. The merger enhanced the Company’s presence in five counties in New York’s Southern Tier and Finger Lakes regions. In connection with the merger, the Company added eight full-service offices to its branch service network and acquired approximately $583.6 million of identifiable assets, including $436.8 million of loans, $11.3 million of investment securities and $8.0 million of core deposit intangibles, as well as $522.3 million of deposits. Goodwill of $42.1 million was recognized as a result of the merger.

2022 – Financial Services Companies

During 2022, the Company, through its subsidiary OneGroup, completed acquisitions of certain assets of insurance agencies for an aggregate amount of $3.5 million in cash. The Company recorded a $2.9 million customer list intangible asset and a $0.1 million intangible asset for a noncompete agreement and recognized $0.5 million of goodwill in conjunction with the acquisitions.

Services

Banking

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank’s branches are generally located in smaller towns and cities within its geographic market areas of Upstate New York, Northeastern Pennsylvania, Vermont and Western Massachusetts. The Bank is in the process of expanding its branch presence in new, more densely populated markets within its geographic footprint including the Albany, Buffalo, Rochester and Syracuse regions of New York, the Lehigh Valley region of Pennsylvania and Springfield, Massachusetts. The expansion will also include the Bank’s first physical branch in Southern New Hampshire. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch and regional levels and its digital banking service offerings, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System, the Federal Home Loan Bank of New York and the Federal Home Loan Bank of Boston (as a non-member bank) (collectively, referred to as “FHLB”), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Table of Contents

Employee Benefit Services

Through BPAS and its subsidiaries, the Company operates a national practice that provides employee benefit trust, collective investment fund, retirement plan and health savings account administration, fund administration, transfer agency, actuarial, and health and welfare consulting services to a diverse array of clients spanning the United States and the Commonwealth of Puerto Rico.

Insurance Services

Through OneGroup, the Company offers personal and commercial lines of insurance and other risk management products and services. In addition, OneGroup offers employee benefit related services. OneGroup represents many leading and specialty insurance companies.

Wealth Management Services

Through the Bank’s Nottingham Trust division, CISI, Carta Group, Nottingham, and Wealth Partners, the Company provides wealth management, retirement planning, higher educational planning, fiduciary, risk management, trust services and personal financial planning services. The Company offers a range of investment products including stocks, bonds, exchange-traded funds, mutual funds, insurance and advisory products.

Segment Information

The Company has identified four reportable operating business segments: Banking and Corporate, Employee Benefit Services, Insurance Services and Wealth Management Services. Information about the Company’s reportable business segments is included in Note T of the “Notes to Consolidated Financial Statements” filed herewith in Part II.

Competition

The banking and financial services industry is highly competitive in the New York, Pennsylvania, Vermont, Massachusetts and New Hampshire markets. The Company competes actively for loans, deposits, and financial services relationships with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, including, financial technology companies, insurance agencies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The Company’s employee benefits, trust and plan administration business competes on a national scale and provides geographic diversification for the Company. Certain lines of business are marketed primarily through unaffiliated financial advisors, while others are marketed directly to plan sponsors and fund companies. In order to compete with large national firms, the Company stresses its consultative approach to complex engagements.

The Company has established the Community Connect program, which is a joint initiative between the four operating business segments to facilitate cross-selling opportunities and connections with commercial clients between the functional areas of the business. The program intends to provide customers with interconnected solutions and enhance customer retention.

Table of Contents

Human Capital Resources

The Company’s employees are asked to embody the core values of integrity, excellence, teamwork and humility. These values are what makes the Company’s culture strong. As of December 31, 2024, the Company had 2,918 total employees, which included 2,730 full-time employees and 188 part-time and temporary employees. Of the Company’s 2,918 employees, 2,079 are in the Banking and Corporate segment (1,913 full-time employees and 166 part-time and temporary employees), 459 employees are in the Employee Benefit Services segment (448 full-time employees and 11 part-time and temporary employees), 267 are in the Insurance Services segment (256 full-time employees and 11 part-time and temporary employees), and 113 employees are in the Wealth Management Services segment (all are full-time employees). The Company’s employee base is concentrated in New York, Pennsylvania and New England where the Bank maintains its retail bank branch presence, with approximately 2,115 employees in New York, 279 in Pennsylvania, and 309 in Vermont, Massachusetts and New Hampshire. Approximately 215 of the Company’s employee base is located outside of its retail banking footprint.

The Company considers its relationship with its employees to be strong. None of the Company’s employees are represented by a labor union or are represented by a collective bargaining agreement.

Oversight

The Board of Directors (the “Board”) has ultimate responsibility for the strategy of the Company. The Board’s Compensation Committee is responsible for the oversight of executive compensation, company culture, diversity, and employee engagement. The Company proactively identifies potential human capital related risks, such as succession planning, labor market shortage, increased labor costs, and employee retention strategies to mitigate those risks. Strong human capital management is viewed as integral to the Company’s business strategy.

Compensation and Benefits

The success and growth of the Company’s business is largely dependent on its ability to attract, develop, and retain a population of skilled and high-performing employees with varied backgrounds and skill sets at all levels of the organization. Accordingly, the Company’s compensation philosophy includes elements that reinforce the Company’s core values, reward employees for their achievements and maximize continued performance with long-term retention. The Company employs benchmarking measures to ensure employees are paid fairly based on their job and performance. The Company conducts workforce planning sessions periodically across all business areas to ensure market competitive pay for employees and actions to support commitment to the professional development of employees.

Growth and Development

The Company continues to broaden the scope of its talent development initiatives across its widening geographically diverse footprint in order to sustain a value-driven and growth-oriented environment where employees can perform at their peak and the next generation of leaders are prepared to lead. The Company offers a wide range of learning and development programs, both internally and externally, that support a broad scope of the Company’s talent development initiatives making continuous learning a part of each employee’s relationship with the Company in a growth-oriented environment. In addition to learning and development programs, in 2024 the Company continued its performance management review process to provide enhanced tools and encourage ongoing and more frequent feedback. These dialogues are intended to achieve higher performance, engagement and commitment, improving outcomes and productivity.

Culture and Attracting a Talented Workforce

The Company is committed to fostering an inclusive environment where there is a sense of purpose, belonging, and work ownership driven by the Company’s core values and service to customers. The Company aspires to empower its workforce to achieve their full potential and enable the development of job-related skills and personal growth in a culture that prioritizes employees’ wellbeing and fosters inclusivity. Employees feel safe to share ideas, receive support, and take risks without the fear of judgment or retaliation. In 2023, the Company introduced the Culture & Diversity Strategic Pillars and initiatives. These strategic pillars support the Company’s commitment to knowing, respecting, and leveraging each person’s unique talents, which in turn drives impact within the organization.

Table of Contents

The goal of the Company’s recruitment efforts is to provide fair opportunity to all and to build a positive reputation internally and externally. To that end, leaders across the businesses and the Company’s human resource professionals have increased shared responsibility in recruitment and selection processes. In 2024, the Company continued to engage in partnership opportunities and provided resources in support of employment opportunities for Military and Veteran Military families. The Company also continued its partnership with organizations that expanded its sourcing efforts and helped to identify a more diverse slate of candidates for employment.

Engagement

The Company is committed to creating a top-tier workplace filled with highly satisfied and engaged employees. The Company believes that open and honest communication among employees, managers and executive leadership fosters an open and collaborative work environment where everyone can participate, develop, and thrive. In 2021, the Company launched the first company-wide employee engagement survey called “MyVoice”, in partnership with a global analytics and advisory firm. The Company continues to conduct a survey annually to maintain a feedback loop with employees. In 2023, the Company selected Engagement Champions whose role is to support leaders and managers in the ongoing engagement efforts and initiatives. In 2024, the CEO instituted a CFSI company-wide employee townhall to enhance communication and transparency relative to the Company’s strategy and priorities. The townhall included a Q&A segment where the CEO answered questions on a variety of topics. The intent is to conduct these townhalls twice a year.

Health and Safety

The health and safety of the Company’s employees is of utmost importance. The Company is committed to providing tools and resources to support employees’ overall health and wellbeing. This includes offering a variety of health and welfare benefits as well as a holistic wellbeing program.

Supervision and Regulation

General

The banking industry is highly regulated with numerous statutory and regulatory requirements that are designed primarily for the protection of depositors and the financial system. Set forth below is a description of the material laws and regulations applicable to the Company and the Bank. This summary is not complete and the reader should refer to these laws and regulations for more detailed information. The Company’s and its subsidiaries’ failure to comply with applicable laws and regulations could result in a range of sanctions and administrative actions imposed upon the Company and/or its subsidiaries, including restrictions on merger and acquisition activity, the imposition of civil money penalties, formal agreements and cease and desist orders. New laws and regulations, more complex regulations, and changes in regulators’ interpretations and application of existing laws and regulations cannot be predicted and may have a material adverse effect on the Company’s businesses and results.

The Company and its subsidiaries are subject to the laws and regulations of the federal government and, where applicable, the states and jurisdictions in which they conduct business. The Company, as a financial holding company, is subject to extensive regulation and supervision by the Board of Governors of the Federal Reserve System (“FRB”) as its primary federal regulator. The Bank is a nationally-chartered bank and is subject to extensive regulation and supervision by the Office of the Comptroller of the Currency (“OCC”) as its primary federal regulator, and as to certain matters, the FRB, the Consumer Financial Protection Bureau (“CFPB”), and the FDIC. The Company expects the Trump administration will seek to implement a regulatory reform agenda that is significantly different from that of the Biden administration, impacting the rulemaking, supervision, examination and enforcement priorities of the federal banking agencies.

Table of Contents

The Company is also subject to the jurisdiction of the SEC and is subject to disclosure and regulatory requirements under the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended. The Company’s common stock is listed on the New York Stock Exchange (“NYSE”) and it is subject to NYSE’s rules for listed companies. Affiliated entities, including BPAS, BPA, NRS, GTC, HB&T, HSI, BPAS Trust Company of Puerto Rico, FBD, Nottingham, CISI, OneGroup, Carta Group, and Wealth Partners are subject to the jurisdiction of certain state and federal regulators and self-regulatory organizations including, but not limited to, the SEC, the Texas Department of Banking, the State of Maine Bureau of Financial Institutions, the Financial Industry Regulatory Authority (“FINRA”), Puerto Rico Office of the Commissioner of Financial Institutions, the U.S. Department of Labor, and state securities and insurance regulators.

Federal Bank Holding Company Regulation

As the Company is classified as a financial holding company, the Company can affiliate with securities firms and insurance companies and engage in other activities that are “financial in nature” or “incidental” or “complementary” to activities that are financial in nature, as long as it continues to meet the eligibility requirements for financial holding companies (including requirements that the financial holding company and its depository institution subsidiary maintain their status as “well capitalized” and “well managed”).

Generally, FRB approval is not required for the Company to acquire a company (other than a bank holding company, bank or savings association) engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the FRB. Prior notice to the FRB may be required, however, if the company to be acquired has total consolidated assets of $10 billion or more. Prior FRB approval is required before the Company may acquire the beneficial ownership or control of more than 5% of the voting shares or substantially all of the assets of a bank holding company, bank or savings association.

As the Company is a financial holding company, if the Bank were to not maintain a Satisfactory or better rating under the Community Reinvestment Act of 1977, as amended (“CRA”), the Company would be prohibited, until the rating is raised to Satisfactory or better, from engaging in new activities or acquiring companies other than bank holding companies, banks or savings associations, except that the Company could engage in new activities, or acquire companies engaged in activities, that are considered “closely related to banking” under the Bank Holding Company Act of 1956, (the “BHC Act”). The Bank’s most recent CRA rating was “Satisfactory”. In addition, if the FRB determines that the Company or the Bank is not well capitalized or well managed, the Company would be required to enter into an agreement with the FRB to comply with all applicable capital and management requirements and may contain additional limitations or conditions. Until corrected, the Company could be prohibited from engaging in any new activity or acquiring companies engaged in activities that are not closely related to banking, absent prior FRB approval.

Federal Reserve System Regulation

As the Company is a financial holding company, it is subject to regulatory capital requirements. The Bank is under similar capital requirements administered by the OCC as discussed below. FRB policy has historically required a financial holding company to act as a source of financial and managerial strength to its subsidiary banks. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) codifies this historical policy as a statutory requirement. To the extent the Bank is in need of regulatory capital, the Company would be expected to provide additional capital, including borrowings from the FRB for such purpose. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors’ funds.

The FRB also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the FRB, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust its strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond its control.

Table of Contents

The Office of the Comptroller of the Currency Regulation (“OCC”)

The Bank is supervised by the OCC. OCC supervision consists of multiple examinations of the Bank’s activities over the course of its annual supervisory cycle. The various laws and regulations administered by the OCC affect the Company’s practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects the Bank’s business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and the location of its offices. The OCC generally prohibits a depository institution from making any capital distributions, including the payment of a dividend, or paying any management fee to its parent holding company if the depository institution would become undercapitalized due to the payment. Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the OCC. The OCC may take enforcement actions for a variety of supervisory concerns, including violations of laws, rules or regulations and unsafe and unsound practices. As a result, the OCC could also establish individual minimum capital ratios (“IMCR”) for the Bank that are higher than the regulatory minimums. This would impair the Bank’s ability to pay dividends to the Company. The Bank is well capitalized under regulatory standards administered by the OCC. For additional information on the Company’s capital requirements see “Management’s Discussion and Analysis of Financial Condition and Results of Operations – Shareholders’ Equity and Regulatory Capital” and Note O to the Financial Statements.

Federal Home Loan Bank (“FHLB”)

The Bank is a member of the FHLB, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to certain rules and requirements as a member institution of the FHLB, including the purchase of shares of FHLB activity-based stock in the amount of 4.5% of the dollar amount of outstanding advances and FHLB capital stock in an amount equal to the greater of $1,000 or the sum of 0.15% of the mortgage-related assets held by the Bank based upon the previous year-end financial information. The Bank was in compliance with the rules and requirements of the FHLB at December 31, 2024.

Deposit Insurance

Deposits of the Bank are insured up to the applicable limits by the Deposit Insurance Fund (“DIF”) and are subject to deposit insurance assessments to maintain the DIF. The Dodd-Frank Act permanently increased the maximum amount of deposit insurance to $250,000 per deposit category, per depositor, per institution. A depository institution’s DIF assessment is calculated by multiplying its assessment rate by the assessment base, which is defined as the average consolidated total assets less the average tangible equity of the depository institution. The Bank’s deposit insurance assessment is based on a large institution classification. For large insured depository institutions, generally defined as those with at least $10 billion in total assets, the FDIC uses capital and supervisory ratings (“CAMELS”) and financial measures from two scorecards to calculate assessment rates. Each scorecard has two components - a performance score and loss severity score, which are combined and converted to an initial assessment rate. The FDIC has the ability to adjust a large or highly complex insured depository institution’s total score by a maximum of 15 points, up or down, based upon significant risk factors that are not captured by the scorecard. Under the assessment rate schedule effective for 2024, the initial base assessment rate for large and highly complex insured depository institutions ranges from five to 32 basis points, and the total base assessment rate, after applying the unsecured debt and brokered deposit adjustments, ranges from two and one-half to 42 basis points. The Bank’s FDIC insurance for 2024 was based on assessment rates ranging between five and seven basis points compared to assessment rates ranging between five and six basis points for 2023.

On November 16, 2023, the FDIC issued a final rule to implement a special assessment to recover the loss to the DIF associated with protecting uninsured depositors following the closures of certain banks in the first quarter of 2023. As of December 31, 2024, the special assessment is anticipated to be collected over ten quarterly assessment periods that began in 2024 at an annual rate of approximately 13.4 basis points of uninsured deposits that exceeded $5 billion as of December 31, 2022 for the first eight quarterly assessment periods, and an annual rate of approximately 6.8 basis points of uninsured deposits that exceeded $5 billion as of December 31, 2022 for the last two quarterly assessment periods. As the estimated loss to the DIF will be periodically adjusted the FDIC could cease collection early, if the FDIC has collected enough to recover actual or estimated losses, extend the special assessment collection period one or more quarters beyond the initial collection period, if actual or estimated losses exceed the amounts collected, and impose a final shortfall special assessment on a one-time basis after certain receiverships terminate, if actual losses exceed the amounts collected. The Company recorded a $0.2 million and a $1.5 million expense accrual associated with this special assessment in 2024 and 2023, respectively. Excluding the expense accruals associated with the special assessment, FDIC insurance expense in 2024 totaled $8.9 million, compared to $8.0 million in 2023 and $5.5 million in 2022.

Table of Contents

Under the Federal Deposit Insurance Act (“FDIA”), if the FDIC finds that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, the FDIC may determine that such violation or unsafe or unsound practice or condition require the termination of deposit insurance.

The FDIA requires federal bank regulatory agencies to prescribe, by regulation or guideline, operational and managerial standards for all insured depository institutions that relate to, among other things: (i) internal controls, information systems and audit systems; (ii) loan documentation; (iii) credit underwriting; (iv) interest rate exposure; (v) asset growth and quality; and (vi) compensation and benefits. Federal banking agencies have adopted regulations and Interagency Guidelines Prescribing Standards for Safety and Soundness to implement these requirements, which regulators use to identify and address problems at insured depository institutions before capital becomes impaired. If a regulator determines that a bank fails to meet any standards prescribed by the guidelines, the bank may be required to submit an acceptable plan to achieve compliance and agree to specific deadlines for the submission to and review by the regulator of reports confirming progress in implementing the safety and soundness compliance plan. Failure to implement such a plan may result in an enforcement action against the bank.

Enforcement actions against the Company, the Bank and their respective officers and directors may include the issuance of a written directive, the issuance of a cease-and-desist order that can be judicially enforced, the imposition of civil money penalties, the issuance of directives to increase capital, the issuance of formal and informal agreements, the issuance of removal and prohibition orders against officers or other institution-affiliated parties, the imposition of restrictions and sanctions under prompt corrective action regulations, the termination of deposit insurance (in the case of the Bank) and the appointment of a conservator or receiver for the Bank. Civil money penalties can be over $2 million for each day a violation continues.

Transactions with Affiliates and Insiders

The Bank is subject to Section 23A of the Federal Reserve Act, as amended (the "FRA") which places limits on, among other covered transactions, the amount of loans or extensions of credit to affiliates that may be made by the Bank. Extensions of credit to affiliates must be adequately collateralized by specified amounts and types of collateral. Section 23A also limits the amount of loans or advances made by the Bank to third party borrowers that are collateralized by securities or obligations of the Bank's affiliates. The Bank is also subject to Section 23B of the FRA, which, among other things, prohibits an institution from engaging in transactions with affiliates unless the transactions are on terms substantially the same, or at least as favorable to such institution or its subsidiaries, as those prevailing at the time for comparable transactions with non-affiliates.

The Company is subject to restrictions on extensions of credit to insiders (namely executive officers, directors, and 10% stockholders) and their related interests. These restrictions are contained in the FRA and Federal Reserve Regulation O and apply to all insured depository institutions as well as their subsidiaries and holding companies. These restrictions include limits on loans to any individual insider and such insider's related interests and certain conditions that must be met before such loans can be made. There is also an aggregate limitation on all loans to insiders and their related interests, which cannot exceed the institution's total unimpaired capital and surplus, unless the FDIC determines that a lesser amount is appropriate. Insiders are subject to enforcement actions for knowingly accepting loans in violation of applicable restrictions.

Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

On July 21, 2010, the Dodd-Frank Act was signed into law, which resulted in significant changes to the banking industry. The Dodd-Frank Act contains numerous provisions that affect all banks and bank holding companies and impacts how the Company and the Bank handle their operations. The Dodd-Frank Act requires various federal agencies, including those that regulate the Company and the Bank, to promulgate rules and regulations and to conduct various studies and reports for Congress. The federal agencies have either completed or are in the process of completing these rules and regulations and have been given significant discretion in drafting such rules and regulations. Several of the provisions of the Dodd-Frank Act have the consequence of increasing the Bank’s expenses, decreasing its revenues, and changing the activities in which it chooses to engage. The specific impact of the Dodd-Frank Act on the Company’s current activities or new financial activities the Company may consider in the future, the Company’s financial performance, and the markets in which the Company operates depends on the manner in which the relevant agencies continue to develop and implement the required rules and regulations and the reaction of market participants to these regulatory developments.

Table of Contents

Pursuant to FRB regulations mandated by the Dodd-Frank Act, interchange fees on debit card transactions are limited to a maximum of $0.21 per transaction plus 5 basis points of the transaction amount. A debit card issuer may recover an additional one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements prescribed by the FRB. The FRB also adopted requirements in the final rule that issuers include two unaffiliated networks for routing debit transactions that are applicable to the Company and the Bank. On October 25, 2023, the FRB proposed to lower the maximum interchange fee that a large debit card issuer can receive for a debit card transaction. The proposal would also establish a regular process for updating the maximum amount every other year going forward. The Company continues to monitor the development of these proposed rule revisions.

The Dodd-Frank Act established the CFPB and empowered it to exercise broad rulemaking, supervision, and enforcement authority for a wide range of consumer protection laws. Because the Bank’s total consolidated assets exceed $10 billion, the Bank is subject to the direct supervision of the CFPB. The CFPB has issued numerous regulations and amendments under which the Company and the Bank may continue to incur additional expense in connection with its ongoing compliance obligations. Significant recent CFPB developments that may affect operations and compliance costs include:

●continued focus on fair lending, including promoting racial and economic equity for underserved, vulnerable and marginalized communities;

●focused efforts on enforcing certain compliance obligations the CFPB deems a priority, such as automobile loan servicing, debt collection, deposit, overdraft and other services fees, mortgage origination and servicing, and remittances, among others; and

●rulemaking plans concerning, among others, overdrafts, consumers’ access to their financial information and requirements for financial institutions to collect, and publicly report, certain demographic information concerning some business credit applicants, loan approvals, and denials.

The CFPB has broad powers to supervise and enforce consumer protection laws, including laws that apply to banks in order to prohibit unfair, deceptive or abusive acts or practices (“UDAAP”). The Dodd-Frank Act also clarified the federal preemption rules that are applicable to national banks and gives state attorney generals for the states certain powers to enforce federal consumer protection laws. A violation of the consumer protection and privacy laws, and in particular UDAAP, could have serious legal, financial, and reputational consequences.

The CFPB, FRB, and OCC are also authorized to collect fines and provide consumer restitution in the event of violations, engage in consumer financial education, track consumer complaints, request data and promote the availability of financial services to underserved consumers and communities. The CFPB is authorized to pursue administrative proceedings or litigation for violations of federal consumer financial laws. In these proceedings, the CFPB can obtain cease and desist orders (which can include orders for restitution or rescission of contracts, as well as other kinds of affirmative relief) and monetary penalties.

The final rules issued by the FRB, SEC, OCC, FDIC, and Commodity Futures Trading Commission implementing Section 619 of the Dodd-Frank Act (commonly known as the Volcker Rule) prohibit insured depository institutions and companies affiliated with insured depository institutions from (1) engaging in short-term proprietary trading of certain securities, derivatives, commodity futures and options on these instruments, for their own account and (2) sponsoring certain covered funds, subject to certain limited exceptions. The final rules of the Volcker Rule are not material to the Company’s investing and trading activities.

The Dodd-Frank Act requires U.S. financial regulators, including the FRB and the SEC, to adopt rules on incentive-based payment arrangements at specified regulated entities having at least $1 billion in total assets. In 2016, the federal banking regulators, the SEC, the Federal Housing Finance Agency and the National Credit Union Administration proposed revised rules on incentive-based compensation practices, which have not yet been finalized. If these or other regulations are adopted in a form similar to what has been proposed, they will impose limitations on the manner in which the Company may structure compensation for its employees, which could adversely affect the Company’s ability to hire, retain and motivate key employees.

Table of Contents

The ongoing effects of the Dodd-Frank Act, as well as the recent and possible future changes to the regulatory framework as a result of the Economic Growth Act and future proposals make it difficult to assess the overall financial impact of the Dodd-Frank Act and related regulatory developments on the Company and the banking industry. As a result, the Company cannot predict the ultimate impact of the Dodd-Frank Act on the Company or the Bank, including the extent to which it could increase costs or limit the Company’s ability to pursue business opportunities in an efficient manner, or otherwise adversely affect its business, financial condition and results of operations. Nor can the Company predict the impact or substance of other future legislation or regulation. However, it is expected that future legislation or regulation at a minimum will increase the Company’s and the Bank’s operating and compliance costs. As rules and regulations continue to be implemented or issued, the Company may need to dedicate additional resources to ensure compliance, which may increase its costs of operations and adversely impact the Company’s earnings.

Capital Requirements

The Company and the Bank are required to comply with applicable capital adequacy standards established by the federal banking agencies (the “Capital Rules”) which are based on the Basel Committee on Banking Supervision’s (the “Basel Committee”) 2010 final capital framework for strengthening international capital standards, referred to as “Basel III”.

The Capital Rules, among other things, impose a capital measure called “Common Equity Tier 1,” (“CET1”) to which most deductions/adjustments to regulatory capital measures are to be made. In addition, the Capital Rules specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting certain specified requirements.

Under the Capital Rules, the minimum capital ratios are as follows:

● 4.5% CET1 to total risk-weighted assets;

● 6.0% Tier 1 capital (CET1 plus Additional Tier 1 capital) to total risk-weighted assets;

● 8.0% Total capital (Tier 1 Capital plus Tier 2 capital) to total risk-weighted assets;

● 4.0% Tier 1 capital to total adjusted quarterly average assets (known as “leverage ratio”)

The Capital Rules require the Company and the Bank to maintain a “capital conservation buffer” composed entirely of CET1. Banking organizations are required to maintain a minimum capital conservation buffer of 2.5% (CET1 to total risk-weighted assets), in addition to the minimum risk-based capital ratios. Therefore, to satisfy both the minimum risk-based capital ratios and the capital conservation buffer, a banking organization is required to maintain the following: (i) CET1 to total risk-weighted assets of at least 7%, (ii) Tier 1 capital to total risk-weighted assets of at least 8.5%, and (iii) Total capital (Tier 1 capital plus Tier 2 capital) to total risk-weighted assets of at least 10.5%. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions that do not maintain a capital conservation buffer of 2.5% or more will face constraints on dividends, common share repurchases and incentive compensation based on the amount of the shortfall.

The Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, deferred tax assets dependent upon future taxable income and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. Under the Capital Rules, the effects of certain accumulated other comprehensive income or loss items are not excluded for the purposes of determining regulatory capital; however, banks not using the advanced approach, including the Company and the Bank, were permitted to, and in the case of the Company and the Bank did, make a one-time permanent election to continue to exclude these items.

With respect to the Bank, the Capital Rules also revised the prompt corrective action (“PCA”) regulations established pursuant to Section 38 of the Federal Deposit Insurance Act, establishing the CET1 ratio at 6.5% for well-capitalized status and the Tier 1 capital ratio at 8.0% for well-capitalized status. The Capital Rules do not change the total risk-based PCA capital requirement for any capital category.

Table of Contents

The Capital Rules prescribe a standardized approach for risk weighted-assets that expands the risk-weight categories from the four Basel I-derived categories (0%, 20%, 50% and 100%) to a larger and more risk-sensitive number of categories, depending on the nature of the asset. The risk-weight categories generally range from 0% for U.S. government and agency securities, to 1,250% for certain securitized exposures, and result in higher risk weights for a variety of asset categories. The standardized approach requires financial institutions to transition assets that are 90 days or more past due or on nonaccrual from their original risk weight to 150 percent. Additionally, loans designated as high volatility commercial real estate (“HVCRE”) are assigned a risk-weighting of 150 percent.

Requirements to maintain higher levels of capital or to maintain higher levels of liquid assets could adversely impact the Company’s net income and return on equity. The current requirements and the Company’s actual capital levels are detailed in Note O of “Notes to Consolidated Financial Statements” filed in Part II, Item 8, “Financial Statements and Supplementary Data.”

Consumer Protection Laws

In connection with its banking activities, the Bank is subject to a number of federal and state laws designed to protect consumers and promote lending to various sectors of the economy. These laws include but are not limited to the Equal Credit Opportunity Act, the Gramm-Leach-Bliley Act (“GLB Act”), the Fair Credit Reporting Act (“FCRA”), the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”), the Electronic Funds Transfer Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Dodd-Frank Act, the Real Estate Settlement Procedures Act, the Secure and Fair Enforcement for Mortgage Licensing Act (“SAFE”), the Servicemembers Civil Relief Act (“SCRA”), the Military Lending Act (“MLA”), and various state law counterparts. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must interact with clients when taking deposits, making loans, collecting and servicing loans and providing other services. The Company is subject to regulation by the CFPB, which is responsible for promoting fairness and transparency for mortgages, credit cards, deposit accounts and other consumer financial products and services and for interpreting and enforcing the federal consumer financial laws that govern the provision of such products and services. The CFPB is also authorized to prevent any institution under its authority from engaging in an unfair, deceptive, or abusive act or practice in connection with consumer financial products and services.

The GLB Act requires all financial institutions to adopt privacy policies, restrict the sharing of nonpublic customer data with nonaffiliated parties and establish procedures and practices to protect customer data from unauthorized access. The GLB Act also requires certain disclosures to consumers about information collection, sharing, and security practices and their right to “opt out” of the institution’s disclosure of their personal financial information to non-affiliated third-parties (with certain exceptions). In addition, the FCRA, as amended by the FACT Act, includes provisions affecting the Company, the Bank, and their affiliates, including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. The FACT Act requires persons subject to FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the Federal Trade Commission have extensive rulemaking authority under the FACT Act, and the Company and the Bank are subject to the rules that have been created under the FACT Act, including rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate certain identity theft red flags. The SCRA protects persons called to active military service and their dependents from undue hardship resulting from their military service, and the MLA extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The SCRA applies to all debts incurred prior to the commencement of active duty and limits the amount of interest, including service and renewal charges and any other fees or charges (other than bona fide insurance) that are related to the obligation or liability. The MLA applies to certain consumer loans and extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The Company and the Bank are also subject to data security standards and data breach notice requirements issued by various states, the OCC and other regulatory agencies. The Bank has created policies and procedures to comply with these consumer protection requirements.

Table of Contents

The CFPB has implemented the ability-to-repay and qualified mortgage (QM) provisions of the Truth in Lending Act (the “QM Rule”) and has taken steps to modify the QM Rule. The ability-to-repay provision requires creditors to make reasonable, good faith determinations that borrowers are able to repay their mortgages before extending credit based on a number of factors and consideration of financial information about the borrower derived from reasonably reliable third-party documents. Under the Dodd-Frank Act and the QM Rule, loans meeting the definition of “qualified mortgage” are entitled to a presumption that the lender satisfied the ability-to-repay requirements. The presumption is a conclusive presumption/safe harbor for loans meeting the QM requirements, and a rebuttable presumption for higher-priced loans meeting the QM requirements. The Bank has created policies and procedures to comply with these consumer protection requirements and continues to monitor developments relative to future changes to the QM Rule.

Among other provisions, the federal banking rule under the Electronic Fund Transfer Act prohibits financial institutions from charging consumers fees for paying overdrafts on automated teller machines and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions. The rule does not govern overdraft fees on the payment of checks and certain other forms of bill payments.

In May 2024, the SEC finalized amendments to require broker-dealers, investment companies and investment advisers registered with the SEC to adopt written policies and procedures for incident response programs to address unauthorized access to or use of customer information. The amendments also require covered entities to notify, within 30 days, individuals affected by an incident involving sensitive customer information and provide them with details about the incident and other information intended to help affected individuals respond appropriately. Compliance with these amendments may begin on December 3, 2025.

In October 2024, the CFPB issued a rule aimed to enhance consumer control and competition in financial services requiring banks and payment providers to give consumers free access to certain financial data upon request. With consumer authorization, they must also share this data with third parties via secure interfaces to facilitate financial services. Required data includes transaction information, account balance, account and routing numbers, terms and conditions, upcoming bill information, and certain account verification data. The rule may take effect on April 1, 2027, however the compliance timeline is subject to change due to the outcome of pending litigation challenging the rule. While the impact of the rule will depend upon a number of factors, including consumer behavior and the actions of data providers and recipients, open banking initiatives like this final rule have the potential to change the competitive landscape, presenting challenges to the Company’s business model.

In December 2024, the CFPB amended the rules implementing the Truth in Lending Act. The new regulation expanded the application of the regulation to consumer transaction account overdrafts at financial institutions with over $10 billion in assets. Overdraft fees must align with actual costs or a $5 benchmark; otherwise, they qualify as covered credit, requiring clear disclosures of borrowing costs and interest rates. Covered overdraft credits must be in a separate credit account rather than as a negative checking balance. The rule may take effect on October 1, 2025.

The Bank Secrecy Act

The Bank Secrecy Act (“BSA”) requires all financial institutions, including banks and securities broker-dealers, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. The BSA includes a variety of recordkeeping and reporting requirements (such as currency transaction and suspicious activity reporting), as well as due diligence/know-your-customer documentation requirements. The Company has established a BSA/anti-money laundering program and taken other appropriate measures in order to comply with BSA requirements.

Anti-Money Laundering Act of 2020

The Anti-Money Laundering Act of 2020 (“AMLA”) amends the BSA and was enacted in January 2021. The AMLA was intended to reform and modernize U.S. bank secrecy and anti-money laundering laws. The Company has and will continue to review and monitor its anti-money laundering program to ensure it complies with the provisions of the AMLA.

Table of Contents

In July 2024, the federal banking agencies, including the Federal Reserve and OCC, proposed amendments to update the requirements for supervised institutions to establish, implement and maintain effective, risk-based and reasonably designed AML and countering the financing of terrorism ("CFT") programs. The proposed amendments would require supervised institutions to identify, evaluate and document the regulated institution's money laundering, terrorist financing and other illicit finance activity risks, as well as consider, as appropriate, the U.S. Department of the Treasury's Financial Crimes Enforcement Network's ("FinCEN") published national AML/CFT priorities.

In August 2024, the Financial Crimes Enforcement Network (“FinCEN”), which drafts regulations implementing anti-money laundering legislation, adopted a rule extending anti-money laundering obligations, including maintenance of an anti-money laundering program and filing certain reports with FinCEN, to registered investment advisers, like certain of the Company’s subsidiaries. Compliance with these requirements may begin on January 1, 2026.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The USA Patriot Act also encourages information-sharing among financial institutions, regulators, and law enforcement authorities by providing an exemption from the privacy provisions of the GLB Act for financial institutions that comply with the provision of the Act. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the institution. The Company has approved policies and procedures that are designed to comply with the USA Patriot Act and its regulations.

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others administrated by the Treasury’s Office of Foreign Assets Control (“OFAC”). The OFAC administered sanctions can take many different forms; however, they generally contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, entity or individual, including prohibitions against direct or indirect imports and exports and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments, or providing investment related advice or assistance; and (ii) a blocking of assets in which the government or specially designated nationals have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences. The Company has approved policies and procedures that are designed to comply with OFAC and its regulations.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934, as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) an independent accounting oversight board for the accounting industry; (iv) standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on non-preferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violations of the securities laws. The Company has approved policies and procedures that are designed to comply with the Sarbanes-Oxley Act and its regulations.

Table of Contents

Community Reinvestment Act of 1977

Under the CRA, the Bank is required to help meet the credit needs of its communities, including low- and moderate-income neighborhoods. Although the Bank must follow the requirements of CRA, it does not limit the Bank’s discretion to develop products and services that are suitable for a particular community or establish lending requirements or programs. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibits discrimination in lending practices. The Bank’s failure to comply with the provisions of the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s failure to comply with the Equal Credit Opportunity Act and the Fair Housing Act could result in enforcement actions against it by its regulators as well as other federal regulatory agencies and the Department of Justice. The Bank’s most recent CRA rating was “Satisfactory”.

On October 24, 2023, the FRB, FDIC and OCC jointly issued a final rule to strengthen and modernize regulations implementing the CRA to encourage banks to expand access to credit, investment, and banking services in low- and moderate-income communities, adapt to changes in the banking industry, including internet and mobile banking, provide greater clarity and consistency in the application of the CRA regulations and tailor CRA evaluations and data collection to bank size and type. Most of the rule’s requirements may begin January 1, 2026 while the remaining requirements, including the data reporting requirements, may be applicable on January 1, 2027. Whether the final rule will ultimately be implemented and any related compliance requirements remains uncertain.

Cyber Security

The federal bank regulators have adopted rules providing for new notification requirements for banking organizations and their service providers for significant cybersecurity incidents. Specifically, the new rules require a banking organization to notify its primary federal regulator as soon as possible, and no later than 36 hours after, the banking organization determines that a "computer-security incident" rising to the level of a "notification incident" has occurred. Notification is required for incidents that have materially affected or are reasonably likely to materially affect the viability of a banking organization's operations, its ability to deliver banking products and services, or the stability of the financial sector. Service providers are required under the rule to notify affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has materially affected or is reasonably likely to materially affect the banking organization's customers for four or more hours.

Guidance for Third-Party Relationships

On June 9, 2023, the Federal Reserve, OCC, and FDIC issued final interagency guidance on risk management of third-party relationships. The interagency guidance is based, in part, on the regulators’ previously existing third-party risk management guidance from 2013 and seeks to, among other things, promote consistency in third-party risk management and provide sound risk management guidance for third-party relationships commensurate with a bank's risk profile and complexity as well as the criticality of the activity. The final interagency guidance replaces each agency's existing guidance on this topic and is directed to all banking organizations supervised by the Federal Reserve, OCC, and FDIC. Additionally, third party relationship risk management and banking-as-a-service arrangements (including with respect to deposit products and services) have been topics of focus for federal bank regulators in 2024 and further rulemaking activity or guidance may be forthcoming.

Future Legislation and Regulation

Laws, regulations and policies are continually under review by Congress and state legislatures and federal and state regulatory agencies. In addition to the specific legislation and regulations described above, future legislation and regulations or changes to existing statutes, regulations or regulatory policies applicable to the Company and its subsidiaries may affect the business, financial condition and results of operations in adverse and unpredictable ways and increase reporting requirements and compliance costs. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted.

Table of Contents

Information about Our Executive Officers

The executive officers of the Company and the Bank who are elected by the Board of Directors are as follows:

Dimitar A. Karaivanov 43 Director, President and Chief Executive Officer. Mr. Karaivanov assumed his current position on January 1, 2024. He previously served as Executive Vice President and Chief Operating Officer from October 2022 to December 2023 and Executive Vice President of Financial Services and Corporate Development from June 2021 to September 2022. Prior to joining the Company, he was the Managing Director of Lazard Middle Market’s Financial Institutions Group from June 2018 through June 2021. Prior to Lazard, he was the Managing Director of RBC Capital Markets’ Financial Institutions Group from April 2011 through June 2018. Joseph E. Sutaris 57 Executive Vice President and Chief Financial Officer. Mr. Sutaris assumed his current position in June 2018. He served as Senior Vice President, Finance and Accounting from November 2017 to June 2018, as the Bank’s Director of Municipal Banking from September 2016 to November 2017 and as the Senior Vice President of the Central Region of the Bank from April 2011 to September 2016. Mr. Sutaris joined the Company in April 2011 as part of the acquisition of Wilber National Bank where he served as the Executive Vice President, Chief Financial Officer, Treasurer and Secretary. On November 7, 2024, Mr. Sutaris notified the Company of his intention to retire, effective in or around the third quarter of 2025, as Executive Vice President and Chief Financial Officer of the Company and the Bank. Maureen Gillan-Myer 57 Executive Vice President and Chief Administration and Human Resources Officer. Ms. Gillan-Myer assumed her current position in October 1, 2024. She joined the Company as Executive Vice President and Chief Human Resources Officer on October 1, 2021. Prior to joining the Company, she served as the Chief Human Resources Officer of HSBC US from February 2016 through September 2021 and as its Senior Vice President - Talent Acquisition from May 2009 through February 2016. Michael N. Abdo 47 Executive Vice President and General Counsel. Mr. Abdo assumed his current position in July 2022. He served as Associate General Counsel from 2013 to 2020 and as Senior Vice President and Senior Associate General Counsel from January 2020 to July 2022. Prior to joining the Company in 2013, he was an associate with Cadwalader Wickersham & Taft. Jeffrey M. Levy 63 Senior Vice President and Chief Banking Officer. Mr. Levy assumed his current position on January 1, 2024. He served as the Bank’s President of Commercial Banking from January 2022 to December 2023, Senior Vice President, Commercial Banking Sales Executive from June 2021 to December 2021, Senior Vice President, Regional President of Capital Region from June 2019 to June 2021, and Senior Vice President, Commercial Banking Team Leader from January 2018 to June 2019. Prior to joining the Bank, he served as the Executive Vice President and President of Commercial Banking at NBT Bank, N.A. from December 2006 to August 2016.

Community Bank System, Inc. (the “Company”) was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company’s business philosophy is to operate as a diversified financial services enterprise providing a broad array of banking and other financial services to retail, commercial, institutional and municipal customers. The Company is a registered financial holding company which wholly-owns two significant subsidiaries: Community Bank, N.A. (the “Bank” or “CBNA”), and Benefit Plans Administrative Services, Inc. (“BPAS”). As of December 31, 2023, BPAS owns five subsidiaries: Benefit Plans Administrative Services, LLC (“BPA”), a provider of defined contribution plan administration services; Northeast Retirement Services, LLC (“NRS”), a provider of institutional transfer agency, master recordkeeping services, fund administration, trust, and retirement plan services; BPAS Actuarial & Pension Services, LLC (“BPAS-APS”), a provider of actuarial and benefit consulting services; BPAS Trust Company of Puerto Rico, a Puerto Rican trust company; and Hand Benefits & Trust Company (“HB&T”), a provider of collective investment fund administration and institutional trust services. BPA owns one subsidiary, Fringe Benefits Design of Minnesota, Inc. (“FBD”), a provider of retirement plan administration and benefit consulting services. NRS owns one subsidiary, Global Trust Company, Inc. (“GTC”), a non-depository trust company which provides fiduciary services for collective investment trusts and other products. HB&T owns one subsidiary, Hand Securities, Inc. (“HSI”), an introducing broker-dealer.

As of December 31, 2023, the Bank operates 193 full-service branches and 12 drive-thru only locations throughout 42 counties of Upstate New York, six counties of Northeastern Pennsylvania, 12 counties of Vermont, and one county of Western Massachusetts, offering a range of commercial and retail banking services. The Bank owns the following operating subsidiaries: The Carta Group, Inc. (“Carta Group”), CBNA Preferred Funding Corporation (“PFC”), CBNA Treasury Management Corporation (“TMC”), Community Investment Services, Inc. (“CISI”), Nottingham Advisors, Inc. (“Nottingham”), OneGroup NY, Inc. (“OneGroup”), OneGroup Wealth Partners, Inc. (“Wealth Partners”) and Oneida Preferred Funding II LLC (“OPFC II”). OneGroup is a full-service insurance agency offering personal and commercial lines of insurance and other risk management products and services. PFC and OPFC II primarily act as investors in residential and commercial real estate activities. TMC provides cash management, investment, and treasury services to the Bank. CISI, Carta Group and Wealth Partners provide broker-dealer and investment advisory services. Nottingham provides asset management services to individuals, corporations, corporate pension and profit sharing plans, and foundations.

The Company maintains a website at cbna.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information posted on the website is not incorporated into or a part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at https://www.sec.gov.

Acquisition History (2021-2023)

Financial Services Companies – 2023

During 2023, the Company, through its subsidiaries OneGroup, Wealth Partners and BPAS, completed the acquisition of certain assets of financial services companies. The acquired companies provide insurance, wealth management and benefit plan recordkeeping services and are headquartered in New York, Pennsylvania and Florida. Total aggregate consideration for these acquisitions was $8.1 million, including $6.7 million in cash and $1.4 million in contingent consideration arrangements. There were no adjustments to the fair value of the contingent consideration arrangements associated with these acquisitions during 2023. Aggregate assets acquired were $5.1 million, including $4.9 million of customer list intangible assets and the Company recorded goodwill of $3.0 million.

Table of Contents

Axiom Realty Group

On March 1, 2023, the Company, through its subsidiary CBNA, completed the acquisition of certain assets of Axiom Realty Group, which includes Axiom Capital Corp., Axiom Realty Management, LLC and Axiom Realty Advisors, LLC (collectively referred to as “Axiom”), a commercial real estate finance and advisory firm, for $1.8 million in cash. The Company recorded a $1.2 million customer list intangible and recognized $0.6 million of goodwill in conjunction with the acquisition.

Elmira Savings Bank

On May 13, 2022, the Company completed its merger with Elmira Savings Bank (“Elmira”), a New York State chartered savings bank headquartered in Elmira, New York, for $82.2 million in cash. The merger enhanced the Company’s presence in five counties in New York’s Southern Tier and Finger Lakes regions. In connection with the merger, the Company added eight full-service offices to its branch service network and acquired approximately $583.6 million of identifiable assets, including $436.8 million of loans, $11.3 million of investment securities and $8.0 million of core deposit intangibles, as well as $522.3 million of deposits. Goodwill of $42.1 million was recognized as a result of the merger.

Insurance Agencies – 2022

During 2022, the Company, through its subsidiary OneGroup, completed acquisitions of certain assets of insurance agencies for an aggregate amount of $3.5 million in cash. The Company recorded a $2.9 million customer list intangible asset and a $0.1 million intangible asset for a noncompete agreement and recognized $0.5 million of goodwill in conjunction with the acquisitions.

Thomas Gregory Associates Insurance Brokers, Inc.

On August 2, 2021, the Company, through its subsidiary OneGroup, completed its acquisition of certain assets of Thomas Gregory Associates Insurance Brokers, Inc. (“TGA”), a specialty-lines insurance broker based in the Boston, Massachusetts area for $13.1 million, including $11.6 million in cash and contingent consideration valued at $1.5 million. The total allowable maximum performance-based contingent consideration pursuant to the acquisition agreement was $3.4 million. As of December 31, 2023, the remaining contingent consideration is valued at $1.0 million, based on an estimated probability of achievement, and $2.4 million of contingent consideration has been paid. The Company recorded a $10.9 million customer list intangible asset and $2.2 million of goodwill in conjunction with the acquisition.

Fringe Benefits Design of Minnesota, Inc.

On July 1, 2021, the Company, through its subsidiary BPA, completed its acquisition of FBD, a provider of retirement plan administration and benefit consulting services with offices in Minnesota and South Dakota, for $16.7 million, including $15.3 million in cash and contingent consideration valued at $1.4 million. The total allowable maximum performance-based contingent consideration pursuant to the acquisition agreement was $2.7 million. As of December 31, 2023, the contingent consideration is valued at $2.7 million, based on potential probability of achievement. The Company recorded a $14.0 million customer list intangible asset and $2.1 million of goodwill in conjunction with the acquisition.

NuVantage Insurance Corp.

On June 1, 2021, the Company, through its subsidiary OneGroup, completed its acquisition of certain assets of NuVantage Insurance Corp. (“NuVantage”), an insurance agency headquartered in Melbourne, Florida. The Company paid $2.9 million in cash and recorded a $1.4 million customer list intangible asset and $1.5 million of goodwill in conjunction with the acquisition.

Table of Contents

Services

Banking

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank’s branches are generally located in smaller towns and cities within its geographic market areas of Upstate New York, Northeastern Pennsylvania, Vermont and Western Massachusetts. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch, regional levels and its digital banking service offerings, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System, the Federal Home Loan Bank of New York and the Federal Home Loan Bank of Boston (as a non-member bank) (collectively, referred to as “FHLB”), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Employee Benefit Services

Through BPAS and its subsidiaries, the Company operates a national practice that provides employee benefit trust, collective investment fund, retirement plan and health savings account administration, fund administration, transfer agency, actuarial, and health and welfare consulting services to a diverse array of clients spanning the United States and Puerto Rico.

Wealth Management Services

Through the Bank’s Nottingham Trust division, CISI, Carta Group, Nottingham, and Wealth Partners, the Company provides wealth management, retirement planning, higher educational planning, fiduciary, risk management, trust services and personal financial planning services. The Company offers investment alternatives including stocks, bonds, exchange-traded funds, mutual funds, insurance and advisory products.

Insurance Services

Through OneGroup, the Company offers personal and commercial lines of insurance and other risk management products and services. In addition, OneGroup offers employee benefit related services. OneGroup represents many leading and specialty insurance companies.

Segment Information

The Company has identified three reportable operating business segments: Banking, Employee Benefit Services and All Other. Included in the All Other segment are the Wealth Management and Insurance operations. Information about the Company’s reportable business segments is included in Note S of the “Notes to Consolidated Financial Statements” filed herewith in Part II.

Competition

The banking and financial services industry is highly competitive in the New York, Pennsylvania, Vermont, and Massachusetts markets. The Company competes actively for loans, deposits, and financial services relationships with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, including, financial technology companies, insurance agencies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The Company’s employee benefit trust and plan administration business competes on a national scale and provides geographic diversification for the Company. Certain lines of business are marketed primarily through unaffiliated financial advisors, while others are marketed directly to plan sponsors and fund companies. In order to compete with large national firms, the Company stresses its consultative approach to complex engagements.

Table of Contents

Human Capital Resources

The Company’s employees are asked to embody the core values of integrity, excellence, teamwork and humility. These values are what makes the Company’s culture strong. As of December 31, 2023, the Company had 2,849 total employees, which included 2,687 full-time employees and 162 part-time and temporary employees. Of the Company’s 2,849 employees, 2,061 are in the Banking segment (1,914 full-time employees and 147 part-time and temporary employees), 418 employees are in the Employee Benefit Services segment (412 full-time employees and six part-time and temporary employees), and 370 employees are in the All Other segment (361 full-time employees and nine part-time and temporary employees). The Company’s employee base is concentrated in New York, Pennsylvania and New England where the Bank maintains its retail bank branch presence, with approximately 2,087 employees in New York, 269 in Pennsylvania, and 287 in Vermont and Massachusetts. Approximately 206 of the Company’s employee base is located outside of its retail banking footprint.

The Company considers its relationship with its employees to be strong. None of the Company’s employees are represented by a labor union or are represented by a collective bargaining agreement.

Oversight

The Board of Directors (the “Board”) has ultimate responsibility for the strategy of the Company. The Board’s Compensation Committee is responsible for the oversight of executive compensation, company culture, diversity, and employee engagement. The Company proactively identifies potential human capital related risks, such as succession planning, labor market shortage, increased labor costs, and employee retention strategies to mitigate those risks. Strong human capital management is viewed as integral to the Company’s business strategy.

Compensation and Benefits

The success and growth of the Company’s business is largely dependent on its ability to attract, develop, and retain a population of talented and high-performing employees with a diversity of background and skill sets at all levels of our organization. Accordingly, the Company’s compensation philosophy includes elements that reinforce our values, reward our colleagues and maximize long-term performance. We employ various benchmarking measures to ensure our colleagues are paid fairly based on the job that they hold and their performance in that role. Workforce planning sessions are conducted periodically across all our business areas to ensure market competitive pay and staff development actions that support our commitment to the development of our employees.

Growth and Development

The Company continues to broaden the scope of its talent development initiatives across its widening geographically diverse footprint in order to sustain a value-driven and growth-oriented environment where employees can perform at their peak and the next generation of leaders are prepared to lead. The Company offers a wide range of learning and development programs that support a broad scope of the Company’s talent development initiatives, making continuous learning a part of each employee’s relationship with the Company in a growth-oriented environment. In addition to learning and development programs, the Company transformed its performance management process in 2023 from traditional annual reviews to ongoing, more frequent dialogue and coaching conversations.

Culture and Diversity and Attracting a Talented Workforce

The Company is committed to fostering a diverse and inclusive environment where there is a sense of purpose, belonging, and work ownership, driven by our core values and service to our customers. We aspire to empower our workforce to achieve their full potential. In 2023, we introduced our Culture and Diversity Strategic Pillars and initiatives. These strategic pillars support our commitment to knowing, respecting, and leveraging each person’s unique talents, which helps both respect diversity of thought but also drive impact within the organization. The Company is committed to establishing a culture that prioritizes employees’ well-being and fosters inclusivity, development of job related skills and personal growth. In addition, employees are encouraged to communicate their ideas and perspectives and express concerns without fear of judgement or retaliation.

Table of Contents

The goal of the Company’s recruitment efforts is to embed inclusion and diversity to build a positive reputation internally and externally. To that end, leaders across the businesses and the Company’s human resource professionals have increased shared responsibility and accountability into recruitment and selection processes. In 2023, the Company explored opportunities for partnerships and resources for military and veteran military families, continued our partnership with a third party service provider on diverse candidate sourcing efforts, and continued to participate in various career fairs, including those specific to traditionally under-represented groups, within our organization’s footprint. The Company supports a hybrid work environment allowing certain employees to work in the office or remotely to provide flexibility for employees balancing busy professional and personal lives.

Engagement

The Company is committed to creating a top tier workplace filled with highly satisfied and engaged employees. The Company believes that open and honest communication among employees, managers and executive leadership fosters an open and collaborative work environment where everyone can participate, develop, and thrive. In 2021, the Company launched the first company-wide employee engagement survey called “MyVoice”, in partnership with a global analytics and advisory firm. Survey results were shared with business leaders to identify strengths and improvements in areas of culture, career development, manager performance, and inclusivity, with 83% of the Company’s employees participating in the initial survey. The results highlighted that engagement, performance, and employee development are interlinked and interdependent. In 2022, the Company launched a short pulse survey that focused on a few specific subset questions from the previous 2021 full survey in order to solicit further feedback. As next steps, the Company supported managers with tools, resources, and streamlined processes to build action plans for enhanced engagement and development. In 2023, we continued this momentum and launched another company-wide MyVoice survey in December 2023 and 77% of the Company’s employees participated in the survey, indicating once again that our employees feel heard and want to provide feedback to the Company.

Health and Safety

The health and safety of the Company’s employees is of utmost important to us. The Company is committed to providing tools and resources to support employees’ overall health and wellbeing. This includes offering a variety of health and welfare benefits as well as a holistic wellbeing program.

Supervision and Regulation

General

The banking industry is highly regulated with numerous statutory and regulatory requirements that are designed primarily for the protection of depositors and the financial system. Set forth below is a description of the material laws and regulations applicable to the Company and the Bank. This summary is not complete and the reader should refer to these laws and regulations for more detailed information. The Company’s and its subsidiaries’ failure to comply with applicable laws and regulations could result in a range of sanctions and administrative actions imposed upon the Company and/or its subsidiaries, including restrictions on merger and acquisition activity, the imposition of civil money penalties, formal agreements and cease and desist orders. Changes in applicable law or regulations, and in their interpretation and application by regulatory agencies, cannot be predicted, and may have a material effect on the Company’s business and results.

The Company and its subsidiaries are subject to the laws and regulations of the federal government and, where applicable, the states and jurisdictions in which they conduct business. The Company, as a financial holding company, is subject to extensive regulation and supervision by the Board of Governors of the Federal Reserve System (“FRB”) as its primary federal regulator. The Bank is a nationally-chartered bank and is subject to extensive regulation and supervision by the Office of the Comptroller of the Currency (“OCC”) as its primary federal regulator, and as to certain matters, the FRB, the Consumer Financial Protection Bureau (“CFPB”), and the FDIC.

Table of Contents

The Company is also subject to the jurisdiction of the SEC and is subject to disclosure and regulatory requirements under the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended. The Company’s common stock is listed on the New York Stock Exchange (“NYSE”) and it is subject to NYSE’s rules for listed companies. Affiliated entities, including BPAS, BPA, NRS, GTC, HB&T, HSI, BPAS Trust Company of Puerto Rico, FBD, Nottingham, CISI, OneGroup, Carta Group, and Wealth Partners are subject to the jurisdiction of certain state and federal regulators and self-regulatory organizations including, but not limited to, the SEC, the Texas Department of Banking, the State of Maine Bureau of Financial Institutions, the Financial Industry Regulatory Authority (“FINRA”), Puerto Rico Office of the Commissioner of Financial Institutions, the U.S. Department of Labor, and state securities and insurance regulators.

Federal Bank Holding Company Regulation

As the Company is classified as a financial holding company, the Company can affiliate with securities firms and insurance companies and engage in other activities that are “financial in nature” or “incidental” or “complementary” to activities that are financial in nature, as long as it continues to meet the eligibility requirements for financial holding companies (including requirements that the financial holding company and its depository institution subsidiary maintain their status as “well capitalized” and “well managed”).

Generally, FRB approval is not required for the Company to acquire a company (other than a bank holding company, bank or savings association) engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the FRB. Prior notice to the FRB may be required, however, if the company to be acquired has total consolidated assets of $10 billion or more. Prior FRB approval is required before the Company may acquire the beneficial ownership or control of more than 5% of the voting shares or substantially all of the assets of a bank holding company, bank or savings association.

As the Company is a financial holding company, if the Bank were to not maintain a Satisfactory or better rating under the Community Reinvestment Act of 1977, as amended (“CRA”), the Company would be prohibited, until the rating is raised to Satisfactory or better, from engaging in new activities or acquiring companies other than bank holding companies, banks or savings associations, except that the Company could engage in new activities, or acquire companies engaged in activities, that are considered “closely related to banking” under the Bank Holding Company Act of 1956, (the “BHC Act”). The Bank’s most recent CRA rating was “Satisfactory”. In addition, if the FRB determines that the Company or the Bank is not well capitalized or well managed, the Company would be required to enter into an agreement with the FRB to comply with all applicable capital and management requirements and may contain additional limitations or conditions. Until corrected, the Company could be prohibited from engaging in any new activity or acquiring companies engaged in activities that are not closely related to banking, absent prior FRB approval.

Federal Reserve System Regulation

As the Company is a financial holding company, it is subject to regulatory capital requirements. The Bank is under similar capital requirements administered by the OCC as discussed below. FRB policy has historically required a financial holding company to act as a source of financial and managerial strength to its subsidiary banks. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) codifies this historical policy as a statutory requirement. To the extent the Bank is in need of capital, the Company could be expected to provide additional capital, including borrowings from the FRB for such purpose. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors’ funds.

The FRB also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the FRB, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust its strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond its control.

Table of Contents

The Office of the Comptroller of the Currency Regulation (“OCC”)

The Bank is supervised by the OCC. OCC supervision consists of multiple examinations of the Bank’s activities over the course of its annual supervisory cycle. The various laws and regulations administered by the OCC affect the Company’s practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects the Bank’s business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and the location of its offices. The OCC generally prohibits a depository institution from making any capital distributions, including the payment of a dividend, or paying any management fee to its parent holding company if the depository institution would become undercapitalized due to the payment. Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the OCC. The OCC may take enforcement actions for a variety of supervisory concerns, including violations of laws, rules or regulations and unsafe and unsound practices. As a result, the OCC could also establish individual minimum capital ratios (“IMCR”) for the Bank that are higher than the regulatory minimums. This would impair the Bank’s ability to pay dividends to the Company. The Bank is well capitalized under regulatory standards administered by the OCC. For additional information on our capital requirements see “Management’s Discussion and Analysis of Financial Condition and Results of Operations – Shareholders’ Equity and Regulatory Capital” and Note O to the Financial Statements.

Federal Home Loan Bank (“FHLB”)

The Bank is a member of the FHLB, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to certain rules and requirements as a member institution of the FHLB, including the purchase of shares of FHLB activity-based stock in the amount of 4.5% of the dollar amount of outstanding advances and FHLB capital stock in an amount equal to the greater of $1,000 or the sum of 0.15% of the mortgage-related assets held by the Bank based upon the previous year-end financial information. The Bank was in compliance with the rules and requirements of the FHLB at December 31, 2023.

Deposit Insurance

Deposits of the Bank are insured up to the applicable limits by the Deposit Insurance Fund (“DIF”) and are subject to deposit insurance assessments to maintain the DIF. The Dodd-Frank Act permanently increased the maximum amount of deposit insurance to $250,000 per deposit category, per depositor, per institution. A depository institution’s DIF assessment is calculated by multiplying its assessment rate by the assessment base, which is defined as the average consolidated total assets less the average tangible equity of the depository institution. The Bank’s deposit insurance assessment is based on a large institution classification. For large insured depository institutions, generally defined as those with at least $10 billion in total assets, the FDIC uses capital and supervisory ratings (“CAMELS”) and financial measures from two scorecards to calculate assessment rates. Each scorecard has two components - a performance score and loss severity score, which are combined and converted to an initial assessment rate. The FDIC has the ability to adjust a large or highly complex insured depository institution’s total score by a maximum of 15 points, up or down, based upon significant risk factors that are not captured by the scorecard. Under the assessment rate schedule effective for 2023, which increased two basis points from the prior year, the initial base assessment rate for large and highly complex insured depository institutions ranges from five to 32 basis points, and the total base assessment rate, after applying the unsecured debt and brokered deposit adjustments, ranges from two and one-half to 42 basis points. The Bank’s FDIC insurance for 2023 was based on assessment rates ranging between five and six basis points compared to assessment rates ranging between three and four basis points for 2022.

On November 16, 2023, the FDIC issued a final rule to implement a special assessment to recover the loss to the DIF associated with protecting uninsured depositors following the closures of certain banks in the first quarter of 2023. The special assessment is anticipated to be collected over eight quarterly assessment periods beginning in 2024 at an annual rate of approximately 13.4 basis points of uninsured deposits that exceeded $5 billion as of December 31, 2022. As the estimated loss to the DIF will be periodically adjusted the FDIC could cease collection early, if the FDIC has collected enough to recover actual or estimated losses, extend the special assessment collection period one or more quarters beyond the initial eight-quarter collection period, if actual or estimated losses exceed the amounts collected, and impose a final shortfall special assessment on a one-time basis after certain receiverships terminate, if actual losses exceed the amounts collected. The Company recorded a $1.5 million expense accrual in 2023 associated with this special assessment. Excluding the $1.5 million expense accrual associated with the special assessment, FDIC insurance expense in 2023 totaled $8.0 million, compared to $5.5 million in 2022 and $4.1 million in 2021.

Table of Contents

Under the Federal Deposit Insurance Act, if the FDIC finds that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, the FDIC may determine that such violation or unsafe or unsound practice or condition require the termination of deposit insurance.

Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

On July 21, 2010, the Dodd-Frank Act was signed into law, which resulted in significant changes to the banking industry.

The Dodd-Frank Act contains numerous provisions that affect all banks and bank holding companies and impacts how the Company and the Bank handle their operations. The Dodd-Frank Act requires various federal agencies, including those that regulate the Company and the Bank, to promulgate rules and regulations and to conduct various studies and reports for Congress. The federal agencies have either completed or are in the process of completing these rules and regulations and have been given significant discretion in drafting such rules and regulations. Several of the provisions of the Dodd-Frank Act have the consequence of increasing the Bank’s expenses, decreasing its revenues, and changing the activities in which it chooses to engage. The specific impact of the Dodd-Frank Act on the Company’s current activities or new financial activities the Company may consider in the future, the Company’s financial performance, and the markets in which the Company operates depends on the manner in which the relevant agencies continue to develop and implement the required rules and regulations and the reaction of market participants to these regulatory developments.

Pursuant to FRB regulations mandated by the Dodd-Frank Act, interchange fees on debit card transactions are limited to a maximum of $0.21 per transaction plus 5 basis points of the transaction amount. A debit card issuer may recover an additional one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements prescribed by the FRB. The FRB also adopted requirements in the final rule that issuers include two unaffiliated networks for routing debit transactions that are applicable to the Company and the Bank.

The Dodd-Frank Act established the CFPB and empowered it to exercise broad rulemaking, supervision, and enforcement authority for a wide range of consumer protection laws. Because the Bank’s total consolidated assets exceed $10 billion, the Bank is subject to the direct supervision of the CFPB. The CFPB has issued numerous regulations and amendments under which the Company and the Bank may continue to incur additional expense in connection with its ongoing compliance obligations. Significant recent CFPB developments that may affect operations and compliance costs include:

●continued focus on fair lending, including promoting racial and economic equity for underserved, vulnerable and marginalized communities;

●focused efforts on enforcing certain compliance obligations the CFPB deems a priority, such as automobile loan servicing, debt collection, deposit, overdraft and other services fees, mortgage origination and servicing, and remittances, among others; and

●rulemaking plans concerning, among others, overdrafts, interchange fees, consumers’ access to their financial information and requirements for financial institutions to collect, report and make public certain information concerning credit applications made by women-owned, minority-owned and small businesses.

The CFPB has broad powers to supervise and enforce consumer protection laws, including laws that apply to banks in order to prohibit unfair, deceptive or abusive acts or practices (“UDAAP”). The Dodd-Frank Act also weakens the federal preemption rules that are applicable to national banks and gives attorney generals for the states certain powers to enforce federal consumer protection laws. A violation of the consumer protection and privacy laws, and in particular UDAAP, could have serious legal, financial, and reputational consequences.

Table of Contents

The final rules issued by the FRB, SEC, OCC, FDIC, and Commodity Futures Trading Commission implementing Section 619 of the Dodd-Frank Act (commonly known as the Volcker Rule) prohibit insured depository institutions and companies affiliated with insured depository institutions from (1) engaging in short-term proprietary trading of certain securities, derivatives, commodity futures and options on these instruments, for their own account and (2) sponsoring certain covered funds, subject to certain limited exceptions. The final rules of the Volcker Rule are not material to the Company’s investing and trading activities.

The Dodd-Frank Act requires U.S. financial regulators, including the FRB and the SEC, to adopt rules on incentive-based payment arrangements at specified regulated entities having at least $1 billion in total assets. In 2016, the federal banking regulators, the SEC, the Federal Housing Finance Agency and the National Credit Union Administration proposed revised rules on incentive-based compensation practices, which have not yet been finalized. If these or other regulations are adopted in a form similar to what has been proposed, they will impose limitations on the manner in which the Company may structure compensation for its employees, which could adversely affect the Company’s ability to hire, retain and motivate key employees.

The ongoing effects of the Dodd-Frank Act, as well as the recent and possible future changes to the regulatory framework as a result of the Economic Growth Act and future proposals make it difficult to assess the overall financial impact of the Dodd-Frank Act and related regulatory developments on the Company and the banking industry. As a result, the Company cannot predict the ultimate impact of the Dodd-Frank Act on the Company or the Bank, including the extent to which it could increase costs or limit the Company’s ability to pursue business opportunities in an efficient manner, or otherwise adversely affect its business, financial condition and results of operations. Nor can the Company predict the impact or substance of other future legislation or regulation. However, it is expected that future legislation or regulation at a minimum will increase the Company’s and the Bank’s operating and compliance costs. As rules and regulations continue to be implemented or issued, the Company may need to dedicate additional resources to ensure compliance, which may increase its costs of operations and adversely impact the Company’s earnings.

Capital Requirements

The Company and the Bank are required to comply with applicable capital adequacy standards established by the federal banking agencies (the “Capital Rules”) which are based on the Basel Committee on Banking Supervision’s (the “Basel Committee”) 2010 final capital framework for strengthening international capital standards, referred to as “Basel III”.

The Capital Rules, among other things, impose a capital measure called “Common Equity Tier 1,” (“CET1”) to which most deductions/adjustments to regulatory capital measures are to be made. In addition, the Capital Rules specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting certain specified requirements.

Under the Capital Rules, the minimum capital ratios are as follows:

● 4.5% CET1 to total risk-weighted assets;

● 6.0% Tier 1 capital (CET1 plus Additional Tier 1 capital) to total risk-weighted assets;

● 8.0% Total capital (Tier 1 Capital plus Tier 2 capital) to total risk-weighted assets;

● 4.0% Tier 1 capital to total adjusted quarterly average assets (known as “leverage ratio”)

The Capital Rules require the Company and the Bank to maintain a “capital conservation buffer” composed entirely of CET1. Banking organizations are required to maintain a minimum capital conservation buffer of 2.5% (CET1 to total risk-weighted assets), in addition to the minimum risk-based capital ratios. Therefore, to satisfy both the minimum risk-based capital ratios and the capital conservation buffer, a banking organization is required to maintain the following: (i) CET1 to total risk-weighted assets of at least 7%, (ii) Tier 1 capital to total risk-weighted assets of at least 8.5%, and (iii) Total capital (Tier 1 capital plus Tier 2 capital) to total risk-weighted assets of at least 10.5%. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions that do not maintain a capital conservation buffer of 2.5% or more will face constraints on dividends, common share repurchases and incentive compensation based on the amount of the shortfall.

Table of Contents

The Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, deferred tax assets dependent upon future taxable income and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. Under the Capital Rules, the effects of certain accumulated other comprehensive income or loss items are not excluded for the purposes of determining regulatory capital; however, banks not using the advanced approach, including the Company and the Bank, were permitted to, and in the case of the Company and the Bank did, make a one-time permanent election to continue to exclude these items.

With respect to the Bank, the Capital Rules also revised the prompt corrective action (“PCA”) regulations established pursuant to Section 38 of the Federal Deposit Insurance Act, establishing the CET1 ratio at 6.5% for well-capitalized status and the Tier 1 capital ratio at 8.0% for well-capitalized status. The Capital Rules do not change the total risk-based PCA capital requirement for any capital category.

The Capital Rules prescribe a standardized approach for risk weighted-assets that expands the risk-weight categories from the four Basel I-derived categories (0%, 20%, 50% and 100%) to a larger and more risk-sensitive number of categories, depending on the nature of the asset. The risk-weight categories generally range from 0% for U.S. government and agency securities, to 1,250% for certain securitized exposures, and result in higher risk weights for a variety of asset categories. The standardized approach requires financial institutions to transition assets that are 90 days or more past due or on nonaccrual from their original risk weight to 150 percent. Additionally, loans designated as high volatility commercial real estate (“HVCRE”) are assigned a risk-weighting of 150 percent.

Requirements to maintain higher levels of capital or to maintain higher levels of liquid assets could adversely impact the Company’s net income and return on equity. The current requirements and the Company’s actual capital levels are detailed in Note O of “Notes to Consolidated Financial Statements” filed in Part II, Item 8, “Financial Statements and Supplementary Data.”

Consumer Protection Laws

In connection with its banking activities, the Bank is subject to a number of federal and state laws designed to protect consumers and promote lending to various sectors of the economy. These laws include but are not limited to the Equal Credit Opportunity Act, the Gramm-Leach-Bliley Act (“GLB Act”), the Fair Credit Reporting Act (“FCRA”), the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”), the Electronic Funds Transfer Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Dodd-Frank Act, the Real Estate Settlement Procedures Act, the Secure and Fair Enforcement for Mortgage Licensing Act (“SAFE”), the Servicemembers Civil Relief Act (“SCRA”), the Military Lending Act (“MLA”), and various state law counterparts.

The GLB Act requires all financial institutions to adopt privacy policies, restrict the sharing of nonpublic customer data with nonaffiliated parties and establishes procedures and practices to protect customer data from unauthorized access. In addition, the FCRA, as amended by the FACT Act, includes provisions affecting the Company, the Bank, and their affiliates, including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. The FACT Act requires persons subject to FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the Federal Trade Commission have extensive rulemaking authority under the FACT Act, and the Company and the Bank are subject to the rules that have been created under the FACT Act, including rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate certain identity theft red flags. The SCRA protects persons called to active military service and their dependents from undue hardship resulting from their military service, and the MLA extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The SCRA applies to all debts incurred prior to the commencement of active duty and limits the amount of interest, including service and renewal charges and any other fees or charges (other than bona fide insurance) that are related to the obligation or liability. The MLA applies to certain consumer loans and extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The Company and the Bank are also subject to data security standards and data breach notice requirements issued by various states, the OCC and other regulatory agencies. The Bank has created policies and procedures to comply with these consumer protection requirements.

Table of Contents

The CFPB has implemented the ability-to-repay and qualified mortgage (QM) provisions of the Truth in Lending Act (the “QM Rule”) and has recently taken steps to modify the QM Rule. The ability-to-repay provision requires creditors to make reasonable, good faith determinations that borrowers are able to repay their mortgages before extending credit based on a number of factors and consideration of financial information about the borrower derived from reasonably reliable third-party documents. Under the Dodd-Frank Act and the QM Rule, loans meeting the definition of “qualified mortgage” are entitled to a presumption that the lender satisfied the ability-to-repay requirements. The presumption is a conclusive presumption/safe harbor for loans meeting the QM requirements, and a rebuttable presumption for higher-priced loans meeting the QM requirements. The Bank has created policies and procedures to comply with these consumer protection requirements and continues to monitor developments relative to future changes to the QM Rule.

Among other provisions, the federal banking rule under the Electronic Fund Transfer Act prohibits financial institutions from charging consumers fees for paying overdrafts on automated teller machines and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions. The rule does not govern overdraft fees on the payment of checks and certain other forms of bill payments.

The Bank Secrecy Act

The Bank Secrecy Act (“BSA”) requires all financial institutions, including banks and securities broker-dealers, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. The BSA includes a variety of recordkeeping and reporting requirements (such as currency transaction and suspicious activity reporting), as well as due diligence/know-your-customer documentation requirements. The Company has established a BSA/anti-money laundering program and taken other appropriate measures in order to comply with BSA requirements.

Anti-Money Laundering Act of 2020

The Anti-Money Laundering Act of 2020 (“AMLA”) amends the BSA and was enacted in January 2021. The AMLA was intended to reform and modernize U.S. bank secrecy and anti-money laundering laws. The Company has and will continue to review and monitor its anti-money laundering program to ensure it complies with the provisions of the AMLA.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The USA Patriot Act also encourages information-sharing among financial institutions, regulators, and law enforcement authorities by providing an exemption from the privacy provisions of the GLB Act for financial institutions that comply with the provision of the Act. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the institution. The Company has approved policies and procedures that are designed to comply with the USA Patriot Act and its regulations.

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others administrated by the Treasury’s Office of Foreign Assets Control (“OFAC”). The OFAC administered sanctions can take many different forms; however, they generally contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, entity or individual, including prohibitions against direct or indirect imports and exports and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments, or providing investment related advice or assistance; and (ii) a blocking of assets in which the government or specially designated nationals have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences.

Table of Contents

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934, as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) an independent accounting oversight board for the accounting industry; (iv) standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on non-preferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violations of the securities laws.

Community Reinvestment Act of 1977

Under the CRA, the Bank is required to help meet the credit needs of its communities, including low- and moderate-income neighborhoods. Although the Bank must follow the requirements of CRA, it does not limit the Bank’s discretion to develop products and services that are suitable for a particular community or establish lending requirements or programs. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibits discrimination in lending practices. The Bank’s failure to comply with the provisions of the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s failure to comply with the Equal Credit Opportunity Act and the Fair Housing Act could result in enforcement actions against it by its regulators as well as other federal regulatory agencies and the Department of Justice. The Bank’s most recent CRA rating was “Satisfactory”.

On October 24, 2023, the FRB, FDIC and OCC jointly issued a final rule to strengthen and modernize regulations implementing the CRA to encourage banks to expand access to credit, investment, and banking services in low- and moderate-income communities, adapt to changes in the banking industry, including internet and mobile banking, provide greater clarity and consistency in the application of the CRA regulations and tailor CRA evaluations and data collection to bank size and type. Most of the rule’s requirements will be applicable beginning January 1, 2026 while the remaining requirements, including the data reporting requirements, will be applicable on January 1, 2027.

Table of Contents

Information about Our Executive Officers

The executive officers of the Company and the Bank who are elected by the Board of Directors are as follows:

Dimitar A. Karaivanov 42 Director, President and Chief Executive Officer. Mr. Karaivanov assumed his current position on January 1, 2024. He previously served as Executive Vice President and Chief Operating Officer from October 2022 to December 2023 and Executive Vice President of Financial Services and Corporate Development from June 2021 to September 2022. Prior to joining the Company, he was the Managing Director of Lazard Middle Market’s Financial Institutions Group from June 2018 through June 2021. Prior to Lazard, he was the Managing Director of RBC Capital Markets’ Financial Institutions Group from April 2011 through June 2018. Joseph E. Sutaris 56 Executive Vice President and Chief Financial Officer. Mr. Sutaris assumed his current position in June 2018. He served as Senior Vice President, Finance and Accounting from November 2017 to June 2018, as the Bank’s Director of Municipal Banking from September 2016 to November 2017 and as the Senior Vice President of the Central Region of the Bank from April 2011 to September 2016. Mr. Sutaris joined the Company in April 2011 as part of the acquisition of Wilber National Bank where he served as the Executive Vice President, Chief Financial Officer, Treasurer and Secretary. Maureen Gillan-Myer 56 Executive Vice President and Chief Human Resources Officer. Ms. Gillan-Myer assumed her current position in October 2021. Prior to joining the Company, she served as the Chief Human Resources Officer of HSBC US from February 2016 through September 2021 and as its Senior Vice President - Talent Acquisition from May 2009 through February 2016. Michael N. Abdo 46 Executive Vice President and General Counsel. Mr. Abdo assumed his current position in July 2022. He served as Associate General Counsel from 2013 to 2020 and as Senior Vice President and Senior Associate General Counsel from January 2020 to July 2022. Prior to joining the Company in 2013, he was an associate with Cadwalader Wickersham & Taft. Jeffrey M. Levy 62 Senior Vice President and Chief Banking Officer. Mr. Levy assumed his current position on January 1, 2024. He served as the Bank’s President of Commercial Banking from January 2022 to December 2023, Senior Vice President, Commercial Banking Sales Executive from June 2021 to December 2021, Senior Vice President, Regional President of Capital Region from June 2019 to June 2021, and Senior Vice President, Commercial Banking Team Leader from January 2018 to June 2019. Prior to joining the Bank, he served as the Executive Vice President and President of Commercial Banking at NBT Bank, N.A. from December 2006 to August 2016.

Community Bank System, Inc. (the “Company”) was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company is a registered financial holding company which wholly-owns two significant subsidiaries: Community Bank, N.A. (the “Bank” or “CBNA”), and Benefit Plans Administrative Services, Inc. (“BPAS”). As of December 31, 2022, BPAS owns five subsidiaries: Benefit Plans Administrative Services, LLC (“BPA”), a provider of defined contribution plan administration services; Northeast Retirement Services, LLC (“NRS”), a provider of institutional transfer agency, master recordkeeping services, fund administration, trust, and retirement plan services; BPAS Actuarial & Pension Services, LLC (“BPAS-APS”), a provider of actuarial and benefit consulting services; BPAS Trust Company of Puerto Rico, a Puerto Rican trust company; and Hand Benefits & Trust Company (“HB&T”), a provider of collective investment fund administration and institutional trust services. BPA owns one subsidiary, Fringe Benefits Design of Minnesota, Inc. (“FBD”), a provider of retirement plan administration and benefit consulting services. NRS owns one subsidiary, Global Trust Company, Inc. (“GTC”), a non-depository trust company which provides fiduciary services for collective investment trusts and other products. HB&T owns one subsidiary, Hand Securities, Inc. (“HSI”), an introducing broker-dealer.

The Bank’s business philosophy is to operate as a diversified financial services enterprise providing a broad array of banking and other financial services to retail, commercial and municipal customers. As of December 31, 2022, the Bank operates 203 full-service branches and 13 drive-thru only locations throughout 42 counties of Upstate New York, six counties of Northeastern Pennsylvania, 12 counties of Vermont, and one county of Western Massachusetts, offering a range of commercial and retail banking services. The Bank owns the following operating subsidiaries: The Carta Group, Inc. (“Carta Group”), CBNA Preferred Funding Corporation (“PFC”), CBNA Treasury Management Corporation (“TMC”), Community Investment Services, Inc. (“CISI”), Nottingham Advisors, Inc. (“Nottingham”), OneGroup NY, Inc. (“OneGroup”), OneGroup Wealth Partners, Inc. (“Wealth Partners”), Oneida Preferred Funding II LLC (“OPFC II”) and E.S.B. Realty Corp. (“ESB Realty”). OneGroup is a full-service insurance agency offering personal and commercial lines of insurance and other risk management products and services. PFC, ESB Realty and OPFC II primarily act as investors in residential and commercial real estate activities. TMC provides cash management, investment, and treasury services to the Bank. CISI, Carta Group and Wealth Partners provide broker-dealer and investment advisory services. Nottingham provides asset management services to individuals, corporations, corporate pension and profit sharing plans, and foundations.

The Company maintains a website at cbna.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information posted on the website is not incorporated into or a part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at https://www.sec.gov.

Acquisition History (2020-2022)

JMD Associates

On November 1, 2022, the Company, through its subsidiary OneGroup, completed its acquisition of certain assets of JMD Associates, LLC (“JMD”), an insurance agency headquartered in Boca Raton, Florida. The Company paid $1.0 million in cash and recorded a $0.1 million intangible asset for a noncompete agreement, a $0.4 million customer list intangible and $0.5 million of goodwill in conjunction with the acquisition.

Table of Contents

Elmira Savings Bank

On May 13, 2022, the Company completed its merger with Elmira Savings Bank (“Elmira”), a New York State chartered savings bank headquartered in Elmira, New York, for $82.2 million in cash. The merger enhanced the Company’s presence in five counties in New York’s Southern Tier and Finger Lakes regions. In connection with the merger, the Company added eight full-service offices to its branch service network and acquired approximately $583.4 million of identifiable assets, including $437.0 million of loans, $11.3 million of investment securities and $8.0 million of core deposit intangibles, as well as $522.3 million of deposits. Goodwill of $42.2 million was recognized as a result of the merger.

Insurance Agencies

On January 1, 2022, the Company, through its subsidiary OneGroup, completed acquisitions of certain assets of three insurance agencies for an aggregate amount of $2.5 million in cash. The Company recorded a $2.5 million customer list intangible asset in conjunction with the acquisitions.

Thomas Gregory Associates Insurance Brokers, Inc.

On August 2, 2021, the Company, through its subsidiary OneGroup, completed its acquisition of certain assets of Thomas Gregory Associates Insurance Brokers, Inc. (“TGA”), a specialty-lines insurance broker based in the Boston, Massachusetts area for $13.1 million, including $11.6 million in cash and contingent consideration valued at $1.5 million. As of December 31, 2022, the contingent consideration is valued at $1.7 million. The Company recorded a $10.9 million customer list intangible asset and $2.2 million of goodwill in conjunction with the acquisition.

Fringe Benefits Design of Minnesota, Inc.

On July 1, 2021, the Company, through its subsidiary BPA, completed its acquisition of FBD, a provider of retirement plan administration and benefit consulting services with offices in Minnesota and South Dakota, for $16.7 million, including $15.3 million in cash and contingent consideration valued at $1.4 million. As of December 31, 2022, the contingent consideration is valued at $1.1 million. The Company recorded a $14.0 million customer list intangible asset and $2.1 million of goodwill in conjunction with the acquisition.

NuVantage Insurance Corp.

On June 1, 2021, the Company, through its subsidiary OneGroup, completed its acquisition of certain assets of NuVantage Insurance Corp. (“NuVantage”), an insurance agency headquartered in Melbourne, Florida. The Company paid $2.9 million in cash and recorded a $1.4 million customer list intangible asset and $1.5 million of goodwill in conjunction with the acquisition.

Steuben Trust Corporation

On June 12, 2020, the Company completed its merger with Steuben Trust Corporation (“Steuben”), parent company of Steuben Trust Company, a New York State chartered bank headquartered in Hornell, New York, for $98.6 million in Company stock and cash, comprised of $21.6 million in cash and the issuance of 1.36 million shares of common stock. The merger extended the Company’s footprint into two new counties in Western New York State, and enhanced the Company’s presence in four Western New York State counties in which it had already operated. In connection with the merger, the Company added 11 full-service offices to its branch service network and acquired $607.8 million of assets, including $339.7 million of loans and $180.5 million of investment securities, as well as $516.3 million of deposits. Goodwill of $20.0 million, a $2.9 million core deposit intangible asset and a $1.2 million customer list intangible asset were recognized as a result of the merger.

Services

Banking

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank's branches are generally located in smaller towns and cities within its geographic market areas of Upstate New York, Northeastern Pennsylvania, Vermont and Western Massachusetts. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch, regional levels and its digital banking service offerings, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System, the Federal Home Loan Bank of New York and the Federal Home Loan Bank of Boston (as a non-member bank) (collectively, referred to as “FHLB”), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Table of Contents

Employee Benefit Services

Through BPAS and its subsidiaries, the Company operates a national practice that provides employee benefit trust, collective investment fund, retirement plan administration, fund administration, transfer agency, actuarial, VEBA/HRA and health and welfare consulting services to a diverse array of clients spanning the United States and Puerto Rico.

Wealth Management Services

Through the Bank’s trust department, CISI, Carta Group, Nottingham, and Wealth Partners, the Company provides wealth management, retirement planning, higher educational planning, fiduciary, risk management, trust services and personal financial planning services. The Company offers investment alternatives including stocks, bonds, exchange-traded funds, mutual funds, insurance and advisory products.

Insurance Services

Through OneGroup, the Company offers personal and commercial lines of insurance and other risk management products and services. In addition, OneGroup offers employee benefit related services. OneGroup represents many leading insurance companies.

Segment Information

The Company has identified three reportable operating business segments: Banking, Employee Benefit Services, and All Other. Included in the All Other segment are the smaller Wealth Management and Insurance operations. Information about the Company’s reportable business segments is included in Note T of the “Notes to Consolidated Financial Statements” filed herewith in Part II.

Competition

The banking and financial services industry is highly competitive in the New York, Pennsylvania, Vermont, and Massachusetts markets. The Company competes actively for loans, deposits, and financial services relationships with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, including, financial technology companies, insurance agencies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The Company’s employee benefit trust and plan administration business competes on a national scale and provides geographic diversification for the Company. Certain lines of business are marketed primarily through unaffiliated financial advisors, while others are marketed directly to plan sponsors and fund companies. In order to compete with large national firms, the Company stresses its consultative approach to complex engagements.

Table of Contents

The table below summarizes the Bank’s deposits and market share by the 61 counties of New York, Pennsylvania, Vermont, and Massachusetts in which it had customer facilities as of June 30, 2022. Market share is based on deposits of all commercial banks, credit unions, savings and loan associations, and savings banks.

Number of Deposits as of 6/30/2022(1) Towns/ Towns Where Company Has 1st or County State (000's omitted) Market Share(1) Branches ATM's Cities 2nd Market Position Grand Isle VT $ 60,109 100.00 % 1 1 1 1 Lewis NY 271,111 76.42 % 4 4 3 3 Allegany NY 527,874 75.89 % 10 13 9 9 Franklin NY 528,153 58.91 % 6 5 4 4 Hamilton NY 72,712 56.06 % 2 2 2 2 Madison NY 527,387 42.90 % 6 8 5 5 Cattaraugus NY 783,447 39.77 % 9 11 7 6 Otsego NY 473,341 33.14 % 7 8 5 4 Schuyler NY 87,065 31.39 % 1 1 1 1 Chemung NY 421,881 27.95 % 7 8 2 1 Seneca NY 180,273 25.78 % 3 3 3 2 Saint Lawrence NY 640,996 25.37 % 10 12 9 8 Yates NY 152,404 24.89 % 3 2 2 2 Clinton NY 566,000 24.45 % 3 6 2 2 Jefferson NY 596,900 23.12 % 7 7 6 5 Wyoming PA 206,180 22.73 % 3 3 3 2 Livingston NY 281,424 22.43 % 5 8 5 4 Chautauqua NY 543,374 20.76 % 11 11 10 6 Columbia NY 298,543 19.32 % 4 3 4 3 Essex NY 145,650 12.68 % 4 4 4 3 Oswego NY 261,946 12.58 % 4 5 4 2 Steuben NY 529,565 11.96 % 9 11 8 6 Wayne NY 175,364 10.84 % 3 4 2 2 Addison VT 92,772 10.75 % 2 2 2 1 Caledonia VT 86,219 9.71 % 2 2 2 1 Bennington VT 113,096 9.46 % 2 4 2 0 Orange VT 41,241 9.07 % 1 1 1 1 Herkimer NY 76,232 8.84 % 1 1 1 1 Ontario NY 324,590 8.62 % 6 12 5 3 Tioga NY 46,557 8.33 % 2 2 2 1 Delaware NY 145,403 7.76 % 4 4 4 3 Rutland VT 152,796 7.71 % 3 4 2 1 Chittenden VT 737,782 7.68 % 9 10 7 3 Montgomery NY 75,790 7.36 % 2 2 2 1 Franklin VT 60,318 6.90 % 2 2 2 0 Luzerne PA 603,275 6.65 % 9 13 8 3 Susquehanna PA 87,101 6.29 % 1 1 1 1 Lackawanna PA 530,108 6.16 % 9 8 6 3 Fulton NY 64,889 5.82 % 1 1 1 0 Carbon PA 60,969 5.40 % 2 2 2 0 Cayuga NY 89,106 5.26 % 2 2 2 2 Windham VT 67,262 4.94 % 2 3 2 1 Windsor VT 90,778 4.82 % 2 2 2 0 Schoharie NY 27,663 4.35 % 1 1 1 0 Washington NY 38,895 4.01 % 1 1 1 1 Oneida NY 346,352 3.97 % 6 8 5 4 Chenango NY 33,010 3.70 % 1 1 1 1 Lamoille VT 36,318 3.46 % 1 1 1 1 Bradford PA 56,801 3.28 % 2 2 2 1 Tompkins NY 123,694 2.91 % 4 3 1 0 Washington VT 120,997 2.69 % 3 4 3 1 Rensselaer NY 66,719 2.32 % 1 2 1 0 Onondaga NY 342,119 2.06 % 4 5 4 1 Warren NY 50,686 1.74 % 1 1 1 1 Wyoming NY 26,186 1.18 % 1 1 1 0 Ulster NY 60,135 1.05 % 1 1 1 1 Broome NY 37,615 0.44 % 1 1 1 0 Erie NY 229,893 0.36 % 5 5 4 2 Albany NY 83,221 0.27 % 3 7 3 0 Hampden MA 46,421 0.27 % 1 1 1 0 Monroe NY 9,980 0.04 % 1 0 1 0 $ 13,614,688 4.80 % 224 263 190 123

(1)Deposits and Market Share data as of June 30, 2022, the most recent information available from S&P Global Market Intelligence. Deposit amounts include $239.8 million of intercompany balances that are eliminated upon consolidation. The weighted average total market share percentage, calculated by adding the market shares for each county, weighted by the proportion of the Company’s deposits in each county to its total deposits, is 22.74%.

Table of Contents

Human Capital Resources

The Company’s employees are asked to embody the core values of integrity, excellence, teamwork and humility. These values are what makes the Company’s culture strong. As of December 31, 2022, the Company had 3,026 total employees, which included 2,839 full-time employees and 187 part-time and temporary employees. Of the Company’s 3,026 employees, 2,331 are in the Banking segment (2,157 full-time employees and 174 part-time and temporary employees), 407 employees are in the Employee Benefit Services segment (399 full-time employees and eight part-time and temporary employees), and 288 employees are in the All Other segment (283 full-time employees and five part-time and temporary employees). The Company’s employee base is concentrated in New York, Pennsylvania and New England where the Bank maintains its retail bank branch presence, with approximately 2,253 employees in New York, 293 in Pennsylvania, and 299 in Vermont and Massachusetts. Approximately 181 of the Company’s employee base is outside of its retail banking footprint.

The Company considers its relationship with its employees to be strong. The Company has not experienced any material employment-related issues or interruptions of services due to labor disagreements. None of the Company’s employees are represented by a labor union or are represented by a collective bargaining agreement.

Oversight

The Board of Directors (the “Board”) has ultimate responsibility for the strategy of the Company. The Board’s Compensation Committee is responsible for the oversight of executive compensation, company culture, diversity, and employee engagement. The Company proactively identifies potential human capital related risks, such as succession planning, labor market shortage, increased labor costs, and employee retention strategies to mitigate those risks. Strong human capital management is viewed as integral to the Company's business strategy.

Compensation and Benefits

The success and growth of the Company’s business is largely dependent on its ability to attract, develop, and retain a population of talented and high-performing employees with a diversity of background and skill sets at all levels of our organization. Accordingly, the Company strives to offer competitive salaries and benefits that are consistent with employee positions, skill levels, experience, and geographic location. The Company is proud to offer an array of incentive compensation in which a majority of employees have an opportunity to earn various forms of supplemental pay as a reward for their overall contributions towards the Company’s strategic goals and financial objectives. Additionally, the Company offers a wellness program aimed at providing tools, resources, and encouragement to support its employees’ physical and mental well-being.

Growth and Development

The Company continues to broaden the scope of its talent development initiatives across its widening geographically diverse footprint in order to sustain a value-driven and growth-oriented environment where employees can perform at their peak and the next generation of leaders are prepared to lead. In 2021, the Company implemented a new HR operating system which includes several features to support talent development, enhanced performance management tools and other features that provide a more streamlined employee experience for various interactions with the HR team. In 2022, the Company fully resumed in person leadership and management development training programs to further build the skills of our leaders and managers. In 2023, the Company will launch an enhanced performance management program with the intent of providing clear goals and expectations and thus driving improved individual performance.

The Company offers an array of programs and continuing education dedicated to strengthen employee engagement, personal accountability, productivity, and emotional well-being including customized programs supporting an overall strategy of strong workforce planning, growth-focused coaching sessions, career-path roadmaps and curated learning resources. The Company is committed to enabling a culture that celebrates talent sharing, career development and agility across the Company and generally posts all roles internally first before sharing them externally.

Table of Contents

Culture and Diversity and Attracting a Talented Workforce

The Company is committed to fostering a workforce in an inclusive environment that enhances the culture of shared identity, civility, dignity, and respect. The Company has a company-wide Culture and Diversity Council that supports this effort and provides strategic direction and advocacy for these initiatives. The Council’s members play a vital role in creating the Company’s culture and diversity initiatives and are comprised of employees from various areas of the Company’s businesses and geographic locations. The Council members, along with other employees who volunteer to act as “Council Ambassadors,” are responsible for advancing the Council’s message within their own network of employees. Their efforts demonstrate the Company’s commitment to creating a work environment where everyone feels welcomed, valued, and fully engaged to contribute their unique talents thereby weaving an enhanced appreciation of cultural differences into corporate culture. The Council has developed a set of initiatives to increase focus on diversity, equity, and inclusion across the key areas of talent acquisition and retention; employee community service spotlights; senior leadership composition; a collaborative learning and development campaign centered on greater awareness of unconscious bias; and vendor selection monitoring. In 2022, the Company appointed a Culture, Diversity & Inclusion Officer who leads its efforts by continuing to build upon the current efforts and bringing increased focus for the future, including working with the Company’s Culture and Diversity Council and its ambassadors to identify initiatives to promote an inclusive workplace. The Company continues to focus on educating our employees on the benefits of our diverse workforce and celebrating our differences. The Company is currently working to expand our existing partnerships with organizations that promote diversity and inclusion and expand our reach into diverse talent pools.

The goal of the Company’s recruitment efforts is to attract and hire talented individuals in all roles and at all career levels. The Company strives to provide both external candidates and internal employees who are seeking a different role with challenging and stimulating career opportunities. The Company’s recruitment team also strives to create and maintain diverse representation at all levels and in all areas of the organization to promote a sense of belonging among employees and maintain a workforce that reflects the communities in which the Company serves.

Engagement

The Company is committed to creating a top tier workplace filled with highly satisfied and engaged employees. The Company believes that open and honest communication among employees, managers and executive leadership fosters a collaborative work environment where everyone can participate, develop and thrive. In 2021, the Company launched a Company-wide engagement process called “MyVoice” which was initiated with an engagement survey to gauge employee sentiment in areas like culture, career development, manager performance and inclusivity with 83% employee participation. The collective results from the survey highlighted that engagement, performance, and employee development are interlinked and interdependent. In 2022, the Company supported managers with tools and resources to build action plans for enhanced engagement within their teams. A check-in survey was launched in October of 2022 and results will help to measure the Company’s engagement year-over-year and will inform its next steps on the continued journey to enhance engagement and make the Company a great place to work.

Health and Safety

The health and safety of the Company’s employees is of utmost important to us. We offer a comprehensive benefits program to protect the health of our employees and their families. We provide our employees and their families with access to a variety of innovative, flexible and convenient health and wellness programs that support their physical and mental health by providing tools and resources to help them improve or maintain their health status.

Table of Contents

Supervision and Regulation

General

The banking industry is highly regulated with numerous statutory and regulatory requirements that are designed primarily for the protection of depositors and the financial system. Set forth below is a description of the material laws and regulations applicable to the Company and the Bank. This summary is not complete and the reader should refer to these laws and regulations for more detailed information. The Company’s and its subsidaries’ failure to comply with applicable laws and regulations could result in a range of sanctions and administrative actions imposed upon the Company and/or its subsidiaries, including restrictions on merger and acquisition activity, the imposition of civil money penalties, formal agreements and cease and desist orders. Changes in applicable law or regulations, and in their interpretation and application by regulatory agencies, cannot be predicted, and may have a material effect on the Company’s business and results.

The Company and its subsidiaries are subject to the laws and regulations of the federal government and where applicable the states and jurisdictions in which they conduct business. The Company, as a bank holding company, is subject to extensive regulation, supervision and examination by the Board of Governors of the Federal Reserve System (“FRB”) as its primary federal regulator. The Bank is a nationally-chartered bank and is subject to extensive regulation, supervision and examination by the Office of the Comptroller of the Currency (“OCC”) as its primary federal regulator, and as to certain matters, the FRB, the Consumer Financial Protection Bureau (“CFPB”), and the FDIC.

The Company is also subject to the jurisdiction of the SEC and is subject to disclosure and regulatory requirements under the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended. The Company’s common stock is listed on the New York Stock Exchange (“NYSE”) and it is subject to NYSE’s rules for listed companies. Affiliated entities, including BPAS, BPA, NRS, GTC, HB&T, HSI, BPAS Trust Company of Puerto Rico, FBD, Nottingham, CISI, OneGroup, Carta Group, and Wealth Partners are subject to the jurisdiction of certain state and federal regulators and self-regulatory organizations including, but not limited to, the SEC, the Texas Department of Banking, the State of Maine Bureau of Financial Institutions, the Financial Industry Regulatory Authority (“FINRA”), Puerto Rico Office of the Commissioner of Financial Institutions, the U.S. Department of Labor, and state securities and insurance regulators.

Federal Bank Holding Company Regulation

As the Company is classified as a financial holding company, the Company can affiliate with securities firms and insurance companies and engage in other activities that are “financial in nature” or “incidental” or “complementary” to activities that are financial in nature, as long as it continues to meet the eligibility requirements for financial holding companies (including requirements that the financial holding company and its depository institution subsidiary maintain their status as “well capitalized” and “well managed”).

Generally, FRB approval is not required for the Company to acquire a company (other than a bank holding company, bank or savings association) engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the FRB. Prior notice to the FRB may be required, however, if the company to be acquired has total consolidated assets of $10 billion or more. Prior FRB approval is required before the Company may acquire the beneficial ownership or control of more than 5% of the voting shares or substantially all of the assets of a bank holding company, bank or savings association.

Because the Company is a financial holding company, if the Bank were to receive a rating under the Community Reinvestment Act of 1977, as amended (“CRA”), of less than Satisfactory, the Company will be prohibited, until the rating is raised to Satisfactory or better, from engaging in new activities or acquiring companies other than bank holding companies, banks or savings associations, except that the Company could engage in new activities, or acquire companies engaged in activities, that are considered “closely related to banking” under the Bank Holding Company Act of 1956, (the “BHC Act”). The Bank’s most recent CRA rating was “Satisfactory”. In addition, if the FRB determines that the Company or the Bank is not well capitalized or well managed, the Company would be required to enter into an agreement with the FRB to comply with all applicable capital and management requirements and may contain additional limitations or conditions. Until corrected, the Company could be prohibited from engaging in any new activity or acquiring companies engaged in activities that are not closely related to banking, absent prior FRB approval.

Table of Contents

Federal Reserve System Regulation

Because the Company is a financial holding company, it is subject to regulatory capital requirements and required by the FRB to, among other things, maintain cash reserves against its deposits. Effective on March 26, 2020, the FRB reduced this cash reserve requirement to zero percent. The Bank is under similar capital requirements administered by the OCC as discussed below. FRB policy has historically required a financial holding company to act as a source of financial and managerial strength to its subsidiary banks. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) codifies this historical policy as a statutory requirement. To the extent the Bank is in need of capital, the Company could be expected to provide additional capital, including borrowings from the FRB for such purpose. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors’ funds.

The FRB also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the FRB, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust its strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond its control.

The Office of the Comptroller of the Currency Regulation (“OCC”)

The Bank is supervised and regularly examined by the OCC. The various laws and regulations administered by the OCC affect the Company’s practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects the Bank’s business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and the location of its offices. The OCC generally prohibits a depository institution from making any capital distributions, including the payment of a dividend, or paying any management fee to its parent holding company if the depository institution would become undercapitalized due to the payment. Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the OCC. The Bank is well capitalized under regulatory standards administered by the OCC. For additional information on our capital requirements see “Management’s Discussion and Analysis of Financial Condition and Results of Operations – Shareholders’ Equity and Regulatory Capital” and Note P to the Financial Statements.

Federal Home Loan Bank (“FHLB”)

The Bank is a member of the FHLB, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to certain rules and requirements as a member institution of the FHLB, including the purchase of shares of FHLB activity-based stock in the amount of 4.5% of the dollar amount of outstanding advances and FHLB capital stock in an amount equal to the greater of $1,000 or the sum of 0.15% of the mortgage-related assets held by the Bank based upon the previous year-end financial information. The Bank was in compliance with the rules and requirements of the FHLB at December 31, 2022.

Deposit Insurance

Deposits of the Bank are insured up to the applicable limits by the Deposit Insurance Fund (“DIF”) and are subject to deposit insurance assessments to maintain the DIF. The Dodd-Frank Act permanently increased the maximum amount of deposit insurance to $250,000 per deposit category, per depositor, per institution. A depository institution’s DIF assessment is calculated by multiplying its assessment rate by the assessment base, which is defined as the average consolidated total assets less the average tangible equity of the depository institution. The Bank’s deposit insurance assessment is based on a large institution classification. For large insured depository institutions, generally defined as those with at least $10 billion in total assets, the FDIC uses capital and supervisory ratings (“CAMELS”) and financial measures from two scorecards to calculate assessment rates. Each scorecard has two components - a performance score and loss severity score, which are combined and converted to an initial assessment rate. The FDIC has the ability to adjust a large or highly complex insured depository institution’s total score by a maximum of 15 points, up or down, based upon significant risk factors that are not captured by the scorecard. Under the assessment rate schedule effective during 2022, the initial base assessment rate for large and highly complex insured depository institutions ranges from three to 30 basis points, and the total base assessment rate, after applying the unsecured debt and brokered deposit adjustments, ranges from one and one-half to 40 basis points. The Bank’s FDIC insurance for 2022 was based on assessment rates ranging between three and four basis points. FDIC insurance expense in 2022 totaled $5.5 million, compared to $4.1 million in 2021 and $2.7 million in 2020. On October 18, 2022, the FDIC adopted a final rule to increase initial base assessment rate schedules uniformly by two basis points, effective January 1, 2023.

Table of Contents

Under the Federal Deposit Insurance Act, if the FDIC finds that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, the FDIC may determine that such violation or unsafe or unsound practice or condition require the termination of deposit insurance.

Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

On July 21, 2010, the Dodd-Frank Act was signed into law, which resulted in significant changes to the banking industry. As discussed further throughout this section, certain aspects of the Dodd-Frank Act are subject to implementing final rules. While many of these final rules have taken effect, the finalization process is ongoing.

The Dodd-Frank Act contains numerous provisions that affect all banks and bank holding companies and impacts how the Company and the Bank handle their operations. The Dodd-Frank Act requires various federal agencies, including those that regulate the Company and the Bank, to promulgate rules and regulations and to conduct various studies and reports for Congress. The federal agencies have either completed or are in the process of completing these rules and regulations and have been given significant discretion in drafting such rules and regulations. Several of the provisions of the Dodd-Frank Act have the consequence of increasing the Bank’s expenses, decreasing its revenues, and changing the activities in which it chooses to engage. The specific impact of the Dodd-Frank Act on the Company’s current activities or new financial activities the Company may consider in the future, the Company’s financial performance, and the markets in which the Company operates depends on the manner in which the relevant agencies continue to develop and implement the required rules and regulations and the reaction of market participants to these regulatory developments.

Pursuant to FRB regulations mandated by the Dodd-Frank Act, interchange fees on debit card transactions are limited to a maximum of $0.21 per transaction plus 5 basis points of the transaction amount. A debit card issuer may recover an additional one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements prescribed by the FRB. The FRB also adopted requirements in the final rule that issuers include two unaffiliated networks for routing debit transactions that are applicable to the Company and the Bank.

The Dodd-Frank Act established the CFPB and empowered it to exercise broad rulemaking, supervision, and enforcement authority for a wide range of consumer protection laws. Because the Bank’s total consolidated assets exceed $10 billion, the Bank is subject to the direct supervision of the CFPB. The CFPB has issued numerous regulations and amendments under which the Company and the Bank may continue to incur additional expense in connection with its ongoing compliance obligations. Significant recent CFPB developments that may affect operations and compliance costs include:

●continued focus on fair lending, including promoting racial and economic equity for underserved, vulnerable and marginalized communities;

●focused efforts on enforcing certain compliance obligations the CFPB deems a priority, such as automobile loan servicing, debt collection, deposit, overdraft and other services fees, mortgage origination and servicing, and remittances, among others; and

●rulemaking plans concerning, among others, consumers’ access to their financial information and requirements for financial institutions to collect, report and make public certain information concerning credit applications made by women-owned, minority-owned and small businesses.

The CFPB has broad powers to supervise and enforce consumer protection laws, including laws that apply to banks in order to prohibit unfair, deceptive or abusive acts or practices (“UDAAP”). The Dodd-Frank Act also weakens the federal preemption rules that are applicable to national banks and gives attorney generals for the states certain powers to enforce federal consumer protection laws. A violation of the consumer protection and privacy laws, and in particular UDAAP, could have serious legal, financial, and reputational consequences.

Table of Contents

The final rules issued by the FRB, SEC, OCC, FDIC, and Commodity Futures Trading Commission implementing Section 619 of the Dodd-Frank Act (commonly known as the Volcker Rule) prohibit insured depository institutions and companies affiliated with insured depository institutions from (1) engaging in short-term proprietary trading of certain securities, derivatives, commodity futures and options on these instruments, for their own account and (2) sponsoring certain covered funds, subject to certain limited exceptions. The final rules of the Volcker Rule are not material to the Company’s investing and trading activities.

The ongoing effects of the Dodd-Frank Act, as well as the recent and possible future changes to the regulatory framework as a result of the Economic Growth Act and future proposals make it difficult to assess the overall financial impact of the Dodd-Frank Act and related regulatory developments on the Company and the banking industry. As a result, the Company cannot predict the ultimate impact of the Dodd-Frank Act on the Company or the Bank, including the extent to which it could increase costs or limit the Company’s ability to pursue business opportunities in an efficient manner, or otherwise adversely affect its business, financial condition and results of operations. Nor can the Company predict the impact or substance of other future legislation or regulation. However, it is expected that future legislation or regulation at a minimum will increase the Company’s and the Bank’s operating and compliance costs. As rules and regulations continue to be implemented or issued, the Company may need to dedicate additional resources to ensure compliance, which may increase its costs of operations and adversely impact the Company’s earnings.

Capital Requirements

The Company and the Bank are required to comply with applicable capital adequacy standards established by the federal banking agencies (the “Capital Rules”) which are based on the Basel Committee on Banking Supervision’s (the “Basel Committee”) 2010 final capital framework for strengthening international capital standards, referred to as “Basel III”.

The Capital Rules, among other things, impose a capital measure called “Common Equity Tier 1,” (“CET1”) to which most deductions/adjustments to regulatory capital measures are to be made. In addition, the Capital Rules specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting certain specified requirements.

Under the Capital Rules, the minimum capital ratios are as follows:

● 4.5% CET1 to total risk-weighted assets;

● 6.0% Tier 1 capital (CET1 plus Additional Tier 1 capital) to total risk-weighted assets;

● 8.0% Total capital (Tier 1 Capital plus Tier 2 capital) to total risk-weighted assets;

● 4.0% Tier 1 capital to total adjusted quarterly average assets (known as “leverage ratio”)

The Capital Rules require the Company and the Bank to maintain a “capital conservation buffer” composed entirely of CET1. Banking organizations are required to maintain a minimum capital conservation buffer of 2.5% (CET1 to total risk-weighted assets), in addition to the minimum risk-based capital ratios. Therefore, to satisfy both the minimum risk-based capital ratios and the capital conservation buffer, a banking organization is required to maintain the following: (i) CET1 to total risk-weighted assets of at least 7%, (ii) Tier 1 capital to total risk-weighted assets of at least 8.5%, and (iii) Total capital (Tier 1 capital plus Tier 2 capital) to total risk-weighted assets of at least 10.5%. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions that do not maintain a capital conservation buffer of 2.5% or more will face constraints on dividends, common share repurchases and incentive compensation based on the amount of the shortfall.

The Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, deferred tax assets dependent upon future taxable income and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. Under the Capital Rules, the effects of certain accumulated other comprehensive income or loss items are not excluded for the purposes of determining regulatory capital; however, banks not using the advanced approach, including the Company and the Bank, were permitted to, and in the case of the Company and the Bank they did, make a one-time permanent election to continue to exclude these items.

Consistent with Section 171 of the Dodd-Frank Act, the Capital Rules allow certain bank holding companies to include certain hybrid securities, such as trust preferred securities, in Tier 1 capital if they had less than $15 billion in assets as of December 31, 2009 and the securities were issued before May 19, 2010. Accordingly, the trust preferred securities on the Company’s balance sheet were included as Tier 1 capital while they were outstanding.

Table of Contents

With respect to the Bank, the Capital Rules also revised the prompt corrective action (“PCA”) regulations established pursuant to Section 38 of the Federal Deposit Insurance Act, establishing the CET1 ratio at 6.5% for well-capitalized status and the Tier 1 capital ratio at 8.0% for well-capitalized status. The Capital Rules do not change the total risk-based PCA capital requirement for any capital category.

The Capital Rules prescribe a standardized approach for risk weighted-assets that expands the risk-weight categories from the four Basel I-derived categories (0%, 20%, 50% and 100%) to a larger and more risk-sensitive number of categories, depending on the nature of the asset. The risk-weight categories generally range from 0% for U.S. government and agency securities, to 1,250% for certain securitized exposures, and result in higher risk weights for a variety of asset categories. The standardized approach requires financial institutions to transition assets that are 90 days or more past due or on nonaccrual from their original risk weight to 150 percent. Additionally, loans designated as high volatility commercial real estate (“HVCRE”) are assigned a risk-weighting of 150 percent.

Requirements to maintain higher levels of capital or to maintain higher levels of liquid assets could adversely impact the Company’s net income and return on equity. The current requirements and the Company’s actual capital levels are detailed in Note P of “Notes to Consolidated Financial Statements” filed in Part II, Item 8, “Financial Statements and Supplementary Data.”

Consumer Protection Laws

In connection with its banking activities, the Bank is subject to a number of federal and state laws designed to protect consumers and promote lending to various sectors of the economy. These laws include but are not limited to the Equal Credit Opportunity Act, the Gramm-Leach-Bliley Act (“GLB Act”), the Fair Credit Reporting Act (“FCRA”), the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”), the Electronic Funds Transfer Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Dodd-Frank Act, the Real Estate Settlement Procedures Act, the Secure and Fair Enforcement for Mortgage Licensing Act (“SAFE”), the Servicemembers Civil Relief Act (“SCRA”), the Military Lending Act (“MLA”), and various state law counterparts.

The GLB Act requires all financial institutions to adopt privacy policies, restrict the sharing of nonpublic customer data with nonaffiliated parties and establishes procedures and practices to protect customer data from unauthorized access. In addition, the FCRA, as amended by the FACT Act, includes provisions affecting the Company, the Bank, and their affiliates, including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. The FACT Act requires persons subject to FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the Federal Trade Commission have extensive rulemaking authority under the FACT Act, and the Company and the Bank are subject to the rules that have been created under the FACT Act, including rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate certain identity theft red flags. The SCRA protects persons called to active military service and their dependents from undue hardship resulting from their military service, and the MLA extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The SCRA applies to all debts incurred prior to the commencement of active duty and limits the amount of interest, including service and renewal charges and any other fees or charges (other than bona fide insurance) that are related to the obligation or liability. The MLA applies to certain consumer loans and extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The Company and the Bank are also subject to data security standards and data breach notice requirements issued by various states, the OCC and other regulatory agencies. The Bank has created policies and procedures to comply with these consumer protection requirements.

Table of Contents

The CFPB has implemented the ability-to-repay and qualified mortgage (QM) provisions of the Truth in Lending Act (the “QM Rule”) and has recently taken steps to modify the QM Rule. The ability-to-repay provision requires creditors to make reasonable, good faith determinations that borrowers are able to repay their mortgages before extending credit based on a number of factors and consideration of financial information about the borrower derived from reasonably reliable third-party documents. Under the Dodd-Frank Act and the QM Rule, loans meeting the definition of “qualified mortgage” are entitled to a presumption that the lender satisfied the ability-to-repay requirements. The presumption is a conclusive presumption/safe harbor for loans meeting the QM requirements, and a rebuttable presumption for higher-priced loans meeting the QM requirements. The Bank has created policies and procedures to comply with these consumer protection requirements and continues to monitor developments relative to future changes to the QM Rule.

Among other provisions, the federal banking rule under the Electronic Fund Transfer Act prohibits financial institutions from charging consumers fees for paying overdrafts on automated teller machines and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions. The rule does not govern overdraft fees on the payment of checks and certain other forms of bill payments.

The Bank Secrecy Act

The Bank Secrecy Act (“BSA”) requires all financial institutions, including banks and securities broker-dealers, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. The BSA includes a variety of recordkeeping and reporting requirements (such as currency transaction and suspicious activity reporting), as well as due diligence/know-your-customer documentation requirements. The Company has established a bank secrecy act /anti-money laundering program and taken other appropriate measures in order to comply with BSA requirements.

Anti-Money Laundering Act of 2020

The Anti-Money Laundering Act of 2020 (“AMLA”) amends the BSA and was enacted in January 2021. The AMLA was intended to reform and modernize U.S. bank secrecy and anti-money laundering laws. The Company has and will continue to review and monitor its anti-money laundering program to ensure it complies with the provisions of the AMLA.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The USA Patriot Act also encourages information-sharing among financial institutions, regulators, and law enforcement authorities by providing an exemption from the privacy provisions of the GLB Act for financial institutions that comply with the provision of the Act. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the institution. The Company has approved policies and procedures that are designed to comply with the USA Patriot Act and its regulations.

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others administrated by the Treasury’s Office of Foreign Assets Control (“OFAC”). The OFAC administered sanctions can take many different forms; however, they generally contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, entity or individual, including prohibitions against direct or indirect imports and exports and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments, or providing investment related advice or assistance; and (ii) a blocking of assets in which the government or specially designated nationals have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences.

Table of Contents

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934, as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) an independent accounting oversight board for the accounting industry; (iv) standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on non-preferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violations of the securities laws.

Community Reinvestment Act of 1977

Under the CRA, the Bank is required to help meet the credit needs of its communities, including low- and moderate-income neighborhoods. Although the Bank must follow the requirements of CRA, it does not limit the Bank’s discretion to develop products and services that are suitable for a particular community or establish lending requirements or programs. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibits discrimination in lending practices. The Bank’s failure to comply with the provisions of the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s failure to comply with the Equal Credit Opportunity Act and the Fair Housing Act could result in enforcement actions against it by its regulators as well as other federal regulatory agencies and the Department of Justice. The Bank’s most recent CRA rating was “Satisfactory”.

Table of Contents

Information about Our Executive Officers

The executive officers of the Company and the Bank who are elected by the Board of Directors are as follows:

Name Age Position Mark E. Tryniski 62 Director, President and Chief Executive Officer. Mr. Tryniski assumed his current position in August 2006. He served as Executive Vice President and Chief Operating Officer from March 2004 to July 2006 and as the Treasurer and Chief Financial Officer from June 2003 to March 2004. He was previously a partner in the Syracuse office of PricewaterhouseCoopers LLP. Joseph E. Sutaris 55 Executive Vice President and Chief Financial Officer. Mr. Sutaris assumed his current position in June 2018. He served as Senior Vice President, Finance and Accounting from November 2017 to June 2018, as the Bank’s Director of Municipal Banking from September 2016 to November 2017 and as the Senior Vice President of the Central Region of the Bank from April 2011 to September 2016. Mr. Sutaris joined the Company in April 2011 as part of the acquisition of Wilber National Bank where he served as the Executive Vice President, Chief Financial Officer, Treasurer and Secretary. Dimitar A. Karaivanov 41 Executive Vice President and Chief Operating Officer. Mr. Karaivanov assumed his current position in October 2022. He served as Executive Vice President of Financial Services and Corporate Development from June 2021 to September 2022. Prior to joining the Company, he was the Managing Director of Lazard Middle Market’s Financial Institutions Group from June 2018 through June 2021. Prior to Lazard, he was the Managing Director of RBC Capital Markets’ Financial Institutions Group from April 2011 through June 2018. Maureen Gillan-Myer 55 Executive Vice President and Chief Human Resources Officer. Ms. Gillan-Myer assumed her current position in October 2021. Prior to joining the Company, she served as the Chief Human Resources Officer of HSBC US from February 2016 through September 2021 and as its Senior Vice President- Talent Acquisition from May 2009 through February 2016. Michael N. Abdo 45 Executive Vice President and General Counsel. Mr. Abdo assumed his current position in July 2022. He served as Associate General Counsel from 2013 to 2020 and as Senior Vice President & Senior Associate General Counsel from January 2020 to July 2022. Prior to joining the Company in 2013, he was an associate with Cadwalader Wickersham & Taft. Jeffrey M. Levy 61 President, Commercial Banking. Mr. Levy assumed his current position in January 2022. He served as the Bank’s Senior Vice President, Commercial Banking Sales Executive from June 2021 to December 2021, as Senior Vice President, Regional President of Capital Region from June 2019 to June 2021, and as Senior Vice President, Commercial Banking Team Leader from January 2018 to June 2019. Prior to joining the Bank, he served as the Executive Vice President and President of Commercial Banking at NBT Bank, N.A. from December 2006 to August 2016.

Table of Contents

Community Bank System, Inc. (the “Company”) was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company is a registered financial holding company which wholly-owns two significant subsidiaries: Community Bank, N.A. (the “Bank” or “CBNA”), and Benefit Plans Administrative Services, Inc. (“BPAS”). As of December 31, 2021, BPAS owns five subsidiaries: Benefit Plans Administrative Services, LLC (“BPA”), a provider of defined contribution plan administration services; Northeast Retirement Services, LLC (“NRS”), a provider of institutional transfer agency, master recordkeeping services, fund administration, trust, and retirement plan services; BPAS Actuarial & Pension Services, LLC (“BPAS-APS”), a provider of actuarial and benefit consulting services; BPAS Trust Company of Puerto Rico, a Puerto Rican trust company; and Hand Benefits & Trust Company (“HB&T”), a provider of collective investment fund administration and institutional trust services. BPA owns one subsidiary, Fringe Benefits Design of Minnesota, Inc. (“FBD”), a provider of retirement plan administration and benefit consulting services. NRS owns one subsidiary, Global Trust Company, Inc. (“GTC”), a non-depository trust company which provides fiduciary services for collective investment trusts and other products. HB&T owns one subsidiary, Hand Securities, Inc. (“HSI”), an introducing broker-dealer.

The Bank’s business philosophy is to operate as a diversified financial services enterprise providing a broad array of banking and other financial services to retail, commercial and municipal customers. As of December 31, 2021, the Bank operates 206 full-service branches and 12 drive-thru only locations operating as Community Bank, N.A. throughout 42 counties of Upstate New York, six counties of Northeastern Pennsylvania, 12 counties of Vermont, and one county of Western Massachusetts, offering a range of commercial and retail banking services. The Bank owns the following operating subsidiaries: The Carta Group, Inc. (“Carta Group”), CBNA Preferred Funding Corporation (“PFC”), CBNA Treasury Management Corporation (“TMC”), Community Investment Services, Inc. (“CISI”), Nottingham Advisors, Inc. (“Nottingham”), OneGroup NY, Inc. (“OneGroup”), OneGroup Wealth Partners, Inc. (“Wealth Partners”) and Oneida Preferred Funding II LLC (“OPFC II”). OneGroup is a full-service insurance agency offering personal and commercial lines of insurance and other risk management products and services. PFC and OPFC II primarily act as investors in residential and commercial real estate activities. TMC provides cash management, investment, and treasury services to the Bank. CISI, Carta Group and Wealth Partners provide broker-dealer and investment advisory services. Nottingham provides asset management services to individuals, corporations, corporate pension and profit sharing plans, and foundations.

The Company maintains a website at cbna.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information posted on the website is not incorporated into or a part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at https://www.sec.gov.

Acquisition History (2019-2021)

Elmira Savings Bank – Pending Acquisition

On October 4, 2021, the Company announced that the Bank had entered into an agreement to acquire Elmira Savings Bank (“Elmira”), a twelve branch banking franchise headquartered in Elmira, New York, for $82.8 million in cash. The acquisition will enhance the Company’s presence in five counties in New York’s Southern Tier and Finger Lakes regions. Elmira had total assets of $632.2 million, total deposits of $541.0 million, and net loans of $458.6 million at December 31, 2021. The merger was approved by the shareholders of Elmira on December 14, 2021. The Company expects to complete the acquisition in the second quarter of 2022, subject to customary closing conditions, including required regulatory approval.

Table of Contents

Thomas Gregory Associates Insurance Brokers, Inc.

On August 2, 2021, the Company, through its subsidiary OneGroup, completed its acquisition of certain assets of Thomas Gregory Associates Insurance Brokers, Inc. (“TGA”), a specialty-lines insurance broker based in the Boston, Massachusetts area for $13.1 million, including $11.6 million in cash and contingent consideration valued at $1.5 million. The Company recorded a $10.9 million customer list intangible asset and $2.2 million of goodwill in conjunction with the acquisition.

Fringe Benefits Design of Minnesota, Inc.

On July 1, 2021, the Company, through its subsidiary BPA, completed its acquisition of Fringe Benefits Design of Minnesota, Inc. (“FBD”), a provider of retirement plan administration and benefit consulting services with offices in Minnesota and South Dakota, for $16.7 million, including $15.3 million in cash and contingent consideration valued at $1.4 million. As of December 31, 2021, the contingent consideration is valued at $1.6 million, resulting in a $0.2 million acquisition-related contingent consideration adjustment recorded in the consolidated statements of income in 2021. The Company recorded a $14.0 million customer list intangible asset and $2.1 million of goodwill in conjunction with the acquisition.

NuVantage Insurance Corp.

On June 1, 2021, the Company, through its subsidiary OneGroup, completed its acquisition of certain assets of NuVantage Insurance Corp. (“NuVantage”), an insurance agency headquartered in Melbourne, Florida. The Company paid $2.9 million in cash and recorded a $1.4 million customer list intangible asset and $1.5 million of goodwill in conjunction with the acquisition.

Steuben Trust Corporation

On June 12, 2020, the Company completed its merger with Steuben Trust Corporation (“Steuben”), parent company of Steuben Trust Company, a New York State chartered bank headquartered in Hornell, New York, for $98.6 million in Company stock and cash, comprised of $21.6 million in cash and the issuance of 1.36 million shares of common stock. The merger extended the Company’s footprint into two new counties in Western New York State, and enhanced the Company’s presence in four Western New York State counties in which it had already operated. In connection with the merger, the Company added 11 full-service offices to its branch service network and acquired $607.8 million of assets, including $339.7 million of loans and $180.5 million of investment securities, as well as $516.3 million of deposits. Goodwill of $20.0 million, a $2.9 million core deposit intangible asset and a $1.2 million customer list intangible asset were recognized as a result of the merger.

Financial Services Practice – Syracuse, NY

On September 18, 2019, the Company, through its subsidiary, CISI, completed its acquisition of certain assets of a practice engaged in the financial services business headquartered in Syracuse, New York. The Company paid $0.5 million in cash to acquire a customer list, and recorded a $0.5 million customer list intangible asset in conjunction with the acquisition.

Kinderhook Bank Corp.

On July 12, 2019, the Company completed its merger with Kinderhook Bank Corp. (“Kinderhook”), parent company of The National Union Bank of Kinderhook, headquartered in Kinderhook, New York, for $93.4 million in cash. The merger added 11 branch locations across a five county area in the Capital District of Upstate New York. The merger resulted in the acquisition of $642.8 million of assets, including $479.9 million of loans and $39.8 million of investment securities, as well as $568.2 million of deposits and $40.0 million in goodwill.

Wealth Resources Network, Inc.

On January 2, 2019, the Company, through its subsidiary, CISI, completed its acquisition of certain assets of Wealth Resources Network, Inc. (“Wealth Resources”), a financial services business headquartered in Liverpool, New York. The Company paid $1.2 million in cash to acquire a customer list from Wealth Resources, and recorded a $1.2 million customer list intangible asset in conjunction with the acquisition.

Table of Contents

Services

Banking

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank's branches are generally located in smaller towns and cities within its geographic market areas of Upstate New York, Northeastern Pennsylvania, Vermont and Western Massachusetts. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch, regional levels and its digital banking service offerings, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System, the Federal Home Loan Bank of New York and the Federal Home Loan Bank of Boston (as a non-member bank) (collectively, referred to as “FHLB”), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Employee Benefit Services

Through BPAS and its subsidiaries, the Company operates a national practice that provides employee benefit trust, collective investment fund, retirement plan administration, fund administration, transfer agency, actuarial, VEBA/HRA and health and welfare consulting services to a diverse array of clients spanning the United States and Puerto Rico.

Wealth Management Services

Through the Bank’s trust department, CISI, Carta Group, Nottingham, and Wealth Partners, the Company provides wealth management, retirement planning, higher educational planning, fiduciary, risk management, trust services and personal financial planning services. The Company offers investment alternatives including stocks, bonds, mutual funds, insurance and advisory products.

Insurance Services

Through OneGroup, the Company offers personal and commercial lines of insurance and other risk management products and services. In addition, OneGroup offers employee benefit related services. OneGroup represents many leading insurance companies.

Segment Information

The Company has identified three reportable operating business segments: Banking, Employee Benefit Services, and All Other. Included in the All Other segment are the smaller Wealth Management and Insurance operations. Information about the Company’s reportable business segments is included in Note U of the “Notes to Consolidated Financial Statements” filed herewith in Part II.

Competition

The banking and financial services industry is highly competitive in the New York, Pennsylvania, Vermont, and Massachusetts markets. The Company competes actively for loans, deposits, and financial services relationships with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, including, financial technology companies, insurance agencies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The Company’s employee benefit trust and plan administration business competes on a national scale and provides geographic diversification for the Company. Certain lines of business are marketed primarily through unaffiliated financial advisors, while others are marketed directly to plan sponsors and fund companies. In order to compete with large national firms, the Company stresses its consultative approach to complex engagements.

The table below summarizes the Bank’s deposits and market share by the 61 counties of New York, Pennsylvania, Vermont, and Massachusetts in which it had customer facilities as of June 30, 2021. Market share is based on deposits of all commercial banks, credit unions, savings and loan associations, and savings banks.

Table of Contents

Number of Deposits as of 6/30/2021(1) Market Share Towns/ Towns Where Company Has 1st or County State (000's omitted) (1) Branches ATM's Cities Towns Where Position Grand Isle VT $ 52,321 100.00 % 1 1 1 1 Allegany NY 601,552 79.36 % 10 14 9 9 Lewis NY 265,837 71.48 % 4 4 3 3 Hamilton NY 71,146 60.02 % 2 2 2 2 Franklin NY 470,650 54.81 % 6 5 4 4 Madison NY 487,528 41.28 % 6 8 5 5 Cattaraugus NY 775,070 40.17 % 9 11 7 6 Otsego NY 404,353 27.76 % 9 9 6 5 Saint Lawrence NY 640,699 25.56 % 10 12 9 8 Seneca NY 167,514 24.69 % 3 3 3 2 Schuyler NY 63,626 23.44 % 1 1 1 1 Jefferson NY 608,321 22.83 % 7 7 6 5 Yates NY 125,549 22.27 % 3 2 2 1 Clinton NY 507,678 22.24 % 3 6 2 2 Livingston NY 271,370 21.07 % 5 8 5 4 Wyoming PA 167,967 20.31 % 3 3 3 2 Chautauqua NY 509,708 19.24 % 11 11 10 6 Columbia NY 282,507 17.38 % 4 3 4 3 Essex NY 175,779 15.93 % 4 4 4 3 Oswego NY 269,670 13.63 % 4 5 4 2 Steuben NY 496,905 11.93 % 10 11 9 7 Wayne NY 181,780 11.32 % 3 4 2 2 Addison VT 93,039 10.66 % 2 2 2 1 Ontario NY 327,002 10.45 % 7 13 5 3 Caledonia VT 79,518 9.06 % 2 2 2 1 Bennington VT 100,540 9.01 % 2 4 2 0 Orange VT 37,758 8.97 % 1 1 1 1 Herkimer NY 71,341 8.48 % 1 1 1 1 Tioga NY 44,947 8.29 % 2 2 2 1 Delaware NY 138,633 7.86 % 4 4 4 3 Chittenden VT 697,821 7.44 % 9 10 7 3 Rutland VT 139,639 7.20 % 3 4 2 1 Luzerne PA 575,994 6.61 % 9 13 8 4 Montgomery NY 68,033 6.48 % 2 2 2 1 Franklin VT 56,963 6.44 % 2 2 2 0 Chemung NY 87,440 6.11 % 2 2 1 0 Lackawanna PA 508,313 5.98 % 10 9 7 4 Susquehanna PA 74,756 5.65 % 2 1 2 1 Carbon PA 58,543 5.34 % 2 2 2 1 Fulton NY 59,392 5.26 % 1 1 1 0 Windham VT 67,258 4.89 % 2 3 2 1 Windsor VT 86,002 4.75 % 2 2 2 0 Schoharie NY 27,203 4.53 % 1 1 1 0 Washington NY 40,695 4.31 % 1 1 1 1 Oneida NY 319,969 3.81 % 6 8 5 4 Lamoille VT 34,904 3.79 % 1 1 1 1 Cayuga NY 57,200 3.23 % 2 2 2 1 Washington VT 112,528 2.92 % 3 4 3 1 Bradford PA 42,574 2.69 % 2 2 2 1 Chenango NY 30,599 2.38 % 2 2 1 0 Rensselaer NY 63,535 2.08 % 1 2 1 0 Onondaga NY 337,305 2.00 % 4 5 4 1 Warren NY 45,378 1.59 % 1 1 1 1 Wyoming NY 23,775 1.11 % 1 1 1 0 Ulster NY 59,597 1.03 % 1 1 1 1 Broome NY 36,875 0.45 % 1 1 1 0 Albany NY 90,990 0.33 % 3 7 3 0 Erie NY 216,878 0.32 % 5 5 4 2 Hampden MA 46,080 0.28 % 1 1 1 0 Tompkins NY 5,683 0.14 % 1 0 1 0 Monroe NY 7,157 0.03 % 1 0 1 0 $ 12,569,387 4.47 % 223 259 193 124

(1) Deposits and Market Share data as of June 30, 2021, the most recent information available from S&P Global Market Intelligence. Deposit amounts include $230.4 million of intercompany balances that are eliminated upon consolidation.

Table of Contents

Human Capital Resources

As of December 31, 2021, the Company had 2,927 total employees, which included 2,728 full-time employees and 199 part-time and temporary employees. Of the Company’s 2,927 employees, 2,268 are in the Banking segment (2,083 full-time employees and 185 part-time and temporary employees), 396 employees are in the Employee Benefit Services segment (388 full-time employees and 8 part-time and temporary employees), and 263 employees are in the All Other segment (257 full-time employees and 6 part-time and temporary employees). The Company considers its relationship with its employees to be good. The Company has not experienced any material employment-related issues or interruptions of services due to labor disagreements. None of the Company’s employees are represented by a labor union or are represented by a collective bargaining agreement.

Compensation and Benefits

The success and growth of the Company’s business is largely dependent on its ability to attract, develop, and retain a population of talented and high-performing employees with a diversity of background and skill sets at all levels of our organization. Accordingly, the Company strives to offer competitive salaries and benefits that are consistent with employee positions, skill levels, experience, and geographic location. The Company is proud to offer an array of incentive compensation in which all employees have an opportunity to earn various forms of supplemental pay as a reward for their overall contributions towards the Company’s financial objectives. Additionally, the Company offers a wellness program aimed at providing tools, resources, and encouragement to support its employees’ physical and mental well-being.

Growth and Development

The Company continues to broaden the scope of its talent development initiatives across its widening geographically diverse footprint in order to sustain a value-driven and growth-oriented environment where employees can perform at their peak and the next generation of leaders are prepared to lead. In 2021, the Company implemented a new HR operating system which includes several features to support talent development, enhanced performance management tools and other features that provide a more streamlined employee experience for various transactions. The Company offers an array of programs and continuing education dedicated to strengthen employee engagement, personal accountability, productivity, and emotional well-being including customized programs supporting an overall strategy of strong workforce planning, growth-focused coaching sessions, career-path roadmaps and curated learning resources. The Company is committed to enabling a culture that celebrates talent sharing, career development and agility across the Company and generally posts all roles internally first before sharing them externally.

Culture and Diversity

The Company is committed to fostering a workforce in an inclusive environment that enhances the culture of shared identity, civility, dignity, and respect. The Company has a company-wide Culture and Diversity Council that supports this effort and provides strategic direction and advocacy for these initiatives. The Council’s members play a vital role in creating the Company’s culture and diversity initiatives and are comprised of employees from various areas of the Company’s business and geographic locations. The Council members, along with other employees who volunteer to act as “Council Ambassadors,” are responsible for advancing the Council’s message within their own network of employees. Their efforts demonstrate the Company’s commitment to creating a work environment where everyone feels welcomed, valued, and fully engaged to contribute their unique talents and transform that deeper understanding into the organization’s culture. The Culture and Diversity Council has developed a set of initiatives to increase focus on diversity, equity, and inclusion across the key areas of talent acquisition and retention; employee community service spotlights; senior leadership composition; a collaborative learning and development campaign centered on greater awareness of unconscious bias; and vendor selection monitoring.

Table of Contents

Engagement

The Company is committed to creating a world class workplace filled with highly satisfied and engaged employees. The Company believes that open and honest communication among employees, managers and executive leadership fosters an open and collaborative work environment where everyone can participate, develop and thrive. In 2021, the Company launched a Company-wide engagement process called “MyVoice” which was initiated with an engagement survey to gauge employee sentiment in areas like culture, career development, manager performance and inclusivity with 83% employee participation. The collective results from the survey highlighted that engagement, performance, and employee development are interlinked and interdependent. The Company’s primary objective in 2022 will be to equip managers with the tools to take daily responsibility for engagement and development by identifying and building individual team action plans from the engagement and performance data garnered from the survey results. These action plans will be created at the local level by having frequent, meaningful conversations with individuals on their teams to identify and then take ownership of improving the workplace experience for their team.

Health and Safety

As the COVID-19 events continued throughout 2021, the Company continued to implement various plans, strategies and protocols to protect its employees, customers and stakeholders, among other objectives. In order to protect its employees and assure workforce continuity and operational redundancy, the Company continued and adjusted as appropriate many of its protocols in order to conduct the Company’s operations in a safe and efficient manner. The safety of its customers, employees, stakeholders and communities will always remain the Company’s top priority.

Supervision and Regulation

General

The banking industry is highly regulated with numerous statutory and regulatory requirements that are designed primarily for the protection of depositors and the financial system. Set forth below is a description of the material laws and regulations applicable to the Company and the Bank. This summary is not complete and the reader should refer to these laws and regulations for more detailed information. The Company’s and the Bank’s failure to comply with applicable laws and regulations could result in a range of sanctions and administrative actions imposed upon the Company and/or the Bank, including restriction to merger and acquisition activity, the imposition of civil money penalties, formal agreements and cease and desist orders. Changes in applicable law or regulations, and in their interpretation and application by regulatory agencies, cannot be predicted, and may have a material effect on the Company’s business and results.

The Company and its subsidiaries are subject to the laws and regulations of the federal government and where applicable the states and jurisdictions in which they conduct business. The Company, as a bank holding company, is subject to extensive regulation, supervision and examination by the Board of Governors of the Federal Reserve System (“FRB”) as its primary federal regulator. The Bank is a nationally-chartered bank and is subject to extensive regulation, supervision and examination by the Office of the Comptroller of the Currency (“OCC”) as its primary federal regulator, and as to certain matters, the FRB, the Consumer Financial Protection Bureau (“CFPB”), and the Federal Deposit Insurance Corporation (“FDIC”).

The Company is also subject to the jurisdiction of the SEC and is subject to disclosure and regulatory requirements under the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended. The Company’s common stock is listed on the New York Stock Exchange (“NYSE”) and it is subject to NYSE’s rules for listed companies. Affiliated entities, including BPAS, GTC, HB&T, HSI, BPAS Trust Company of Puerto Rico,FBD, Nottingham, CISI, OneGroup, Carta Group, and Wealth Partners are subject to the jurisdiction of certain state and federal regulators and self-regulatory organizations including, but not limited to, the SEC, the Texas Department of Banking, the State of Maine Bureau of Financial Institutions, the Financial Industry Regulatory Authority (“FINRA”), Puerto Rico Office of the Commissioner of Financial Institutions, the U.S. Department of Labor, and state securities and insurance regulators.

Table of Contents

Federal Bank Holding Company Regulation

The Company became a financial holding company effective September 30, 2015. As a financial holding company, the Company can affiliate with securities firms and insurance companies and engage in other activities that are “financial in nature” or “incidental” or “complementary” to activities that are financial in nature, as long as it continues to meet the eligibility requirements for financial holding companies (including requirements that the financial holding company and its depository institution subsidiary maintain their status as “well capitalized” and “well managed”).

Generally, FRB approval is not required for the Company to acquire a company (other than a bank holding company, bank or savings association) engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the FRB. Prior notice to the FRB may be required, however, if the company to be acquired has total consolidated assets of $10 billion or more. Prior FRB approval is required before the Company may acquire the beneficial ownership or control of more than 5% of the voting shares or substantially all of the assets of a bank holding company, bank or savings association.

Because the Company is a financial holding company, if the Bank were to receive a rating under the Community Reinvestment Act of 1977, as amended (“CRA”), of less than Satisfactory, the Company will be prohibited, until the rating is raised to Satisfactory or better, from engaging in new activities or acquiring companies other than bank holding companies, banks or savings associations, except that the Company could engage in new activities, or acquire companies engaged in activities, that are considered “closely related to banking” under the Bank Holding Company Act of 1956, (the “BHC Act”). The Bank’s most recent CRA rating was “Satisfactory”. In addition, if the FRB determines that the Company or the Bank is not well capitalized or well managed, the Company would be required to enter into an agreement with the FRB to comply with all applicable capital and management requirements and may contain additional limitations or conditions. Until corrected, the Company could be prohibited from engaging in any new activity or acquiring companies engaged in activities that are not closely related to banking, absent prior FRB approval.

Federal Reserve System Regulation

Because the Company is a financial holding company, it is subject to regulatory capital requirements and required by the FRB to, among other things, maintain cash reserves against its deposits. Effective on March 26, 2020, the FRB reduced this cash reserve requirement to zero percent to help support lending to households and businesses as a result of the impacts of the COVID-19 pandemic. The Bank is under similar capital requirements administered by the OCC as discussed below. FRB policy has historically required a financial holding company to act as a source of financial and managerial strength to its subsidiary banks. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) codifies this historical policy as a statutory requirement. To the extent the Bank is in need of capital, the Company could be expected to provide additional capital, including borrowings from the FRB for such purpose. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors’ funds.

The FRB also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the FRB, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust its strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond its control.

The Office of the Comptroller of the Currency Regulation (“OCC”)

The Bank is supervised and regularly examined by the OCC. The various laws and regulations administered by the OCC affect the Company’s practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects the Bank’s business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and the location of its offices. The OCC generally prohibits a depository institution from making any capital distributions, including the payment of a dividend, or paying any management fee to its parent holding company if the depository institution would become undercapitalized due to the payment. Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the OCC. The Bank is well capitalized under regulatory standards administered by the OCC. For additional information on our capital requirements see “Management’s Discussion and Analysis of Financial Condition and Results of Operations – Shareholders’ Equity” and Note P to the Financial Statements.

Table of Contents

Federal Home Loan Bank (“FHLB”)

The Bank is a member of the FHLB, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to the rules and requirements of the FHLB, including the purchase of shares of FHLB activity-based stock in the amount of 4.5% of the dollar amount of outstanding advances and FHLB capital stock in an amount equal to the greater of $1,000 or the sum of 0.15% of the mortgage-related assets held by the Bank based upon the previous year-end financial information. The Bank was in compliance with the rules and requirements of the FHLB at December 31, 2021.

Deposit Insurance

Deposits of the Bank are insured up to the applicable limits by the Deposit Insurance Fund (“DIF”) and are subject to deposit insurance assessments to maintain the DIF. The Dodd-Frank Act permanently increased the maximum amount of deposit insurance to $250,000 per deposit category, per depositor, per institution. A depository institution’s DIF assessment is calculated by multiplying its assessment rate by the assessment base, which is defined as the average consolidated total assets less the average tangible equity of the depository institution. The initial base assessment rate is based on its capital level and supervisory ratings (its “CAMELS ratings”), certain financial measures to assess an institution’s ability to withstand asset related stress and funding related stress and, in some cases, additional discretionary adjustments by the FDIC to reflect additional risk factors. The Bank’s deposit insurance assessment is based on a large institution classification.

For large insured depository institutions, generally defined as those with at least $10 billion in total assets, the FDIC has eliminated risk categories when calculating the initial base assessment rates and now combine CAMELS ratings and financial measures into two scorecards to calculate assessment rates, one for most large insured depository institutions and another for highly complex insured depository institutions (which are generally those with more than $50 billion in total assets that are controlled by a parent company with more than $500 billion in total assets). Each scorecard has two components - a performance score and loss severity score, which are combined and converted to an initial assessment rate. The FDIC has the ability to adjust a large or highly complex insured depository institution’s total score by a maximum of 15 points, up or down, based upon significant risk factors that are not captured by the scorecard. Under the current assessment rate schedule, the initial base assessment rate for large and highly complex insured depository institutions ranges from three to 30 basis points, and the total base assessment rate, after applying the unsecured debt and brokered deposit adjustments, ranges from one and one-half to 40 basis points. The Bank’s FDIC insurance for 2021 was based on an assessment rate of three basis points.

In October 2010, the FDIC adopted a DIF restoration plan to ensure that the fund reserve ratio reached 1.35% by September 30, 2020, as required by the Dodd-Frank Act. In September 2018, the DIF reserve ratio reached 1.36%, exceeding the required reserve ratio of 1.35% ahead of the September 30, 2020 deadline. Since the DIF reserve ratio remained above 1.35% in 2019, the Bank was permitted to offset its FDIC insurance assessments in 2019 with Small Bank Assessment Credits issued by the FDIC in January 2019. The Bank offset $1.5 million of FDIC insurance assessments in 2019 with Small Bank Assessment Credits. FDIC insurance expense net of Small Bank Assessment Credits in 2021 totaled $4.1 million, compared to $2.7 million in 2020 and $1.4 million in 2019.

Under the Federal Deposit Insurance Act, if the FDIC finds that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, the FDIC may determine that such violation or unsafe or unsound practice or condition require the termination of deposit insurance.

Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

On July 21, 2010, the Dodd-Frank Act was signed into law, which resulted in significant changes to the banking industry. As discussed further throughout this section, certain aspects of the Dodd-Frank Act are subject to implementing rules that have been taking effect over several years.

Table of Contents

The Dodd-Frank Act contains numerous provisions that affect all banks and bank holding companies and impacts how the Company and the Bank handle their operations. The Dodd-Frank Act requires various federal agencies, including those that regulate the Company and the Bank, to promulgate new rules and regulations and to conduct various studies and reports for Congress. The federal agencies have either completed or are in the process of completing these rules and regulations and have been given significant discretion in drafting such rules and regulations. Several of the provisions of the Dodd-Frank Act may have the consequence of increasing the Bank’s expenses, decreasing its revenues, and changing the activities in which it chooses to engage. The specific impact of the Dodd-Frank Act on the Company’s current activities or new financial activities the Company may consider in the future, the Company’s financial performance, and the markets in which the Company operates depends on the manner in which the relevant agencies continue to develop and implement the required rules and regulations and the reaction of market participants to these regulatory developments.

Pursuant to FRB regulations mandated by the Dodd-Frank Act, interchange fees on debit card transactions are limited to a maximum of $0.21 per transaction plus 5 basis points of the transaction amount. A debit card issuer may recover an additional one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements prescribed by the FRB. The FRB also adopted requirements in the final rule that issuers include two unaffiliated networks for routing debit transactions that are applicable to the Company and the Bank.

The Dodd-Frank Act established the CFPB and empowered it to exercise broad rulemaking, supervision, and enforcement authority for a wide range of consumer protection laws. Since the Bank’s total consolidated assets exceed $10 billion, the Bank is subject to the direct supervision of the CFPB. The CFPB has issued numerous regulations and amendments under which the Company and the Bank may continue to incur additional expense in connection with its ongoing compliance obligations. Significant recent CFPB developments that may affect operations and compliance costs include:

●continued focus on fair lending, including promoting racial and economic equity for underserved, vulnerable and marginalized communities;

●focused efforts on enforcing certain compliance obligations the CFPB deems a priority, such as automobile loan servicing, debt collection, deposit, overdraft and other services fees, mortgage origination and servicing, and remittances, among others; and

●rulemaking plans concerning, among others, consumers’ access to their financial information and requirements for financial institutions to collect, report and make public certain information concerning credit applications made by women-owned, minority-owned and small businesses.

The final rules issued by the FRB, SEC, OCC, FDIC, and Commodity Futures Trading Commission implementing Section 619 of the Dodd-Frank Act (commonly known as the Volcker Rule) prohibit insured depository institutions and companies affiliated with insured depository institutions from engaging in short-term proprietary trading of certain securities, derivatives, commodity futures and options on these instruments, for their own account. The final rules also imposes limits on banking entities’ investments in, and other relationships with, hedge funds or private equity funds. The final rules of the Volcker Rule are not material to the Company's investing and trading activities.

On January 30, 2020, the five federal agencies proposed additional amendments to the Volcker Rule related to the restrictions on ownership interests and relationships with covered funds. On June 25, 2020, a final rule was finalized which modified the Volcker Rule by streamlining the covered funds portion of the rule, addressing the extraterritorial treatment of certain foreign funds and permitting banking entities to offer financial services and engage in other activities that do not raise concerns that the Volcker rule was intended to address. These modifications became effective on October 1, 2020 and were not material to the Company’s investing and trading activities.

Table of Contents

The ongoing effects of the Dodd-Frank Act, as well as the recent and possible future changes to the regulatory framework as a result of the Economic Growth Act and future proposals make it difficult to assess the overall financial impact of the Dodd-Frank Act and related regulatory developments on the Company and the banking industry. As a result, the Company cannot predict the ultimate impact of the Dodd-Frank Act on the Company or the Bank, including the extent to which it could increase costs or limit the Company’s ability to pursue business opportunities in an efficient manner, or otherwise adversely affect its business, financial condition and results of operations. Nor can the Company predict the impact or substance of other future legislation or regulation. However, it is expected that future legislation or regulation at a minimum will increase the Company’s and the Bank’s operating and compliance costs. As rules and regulations continue to be implemented or issued, the Company may need to dedicate additional resources to ensure compliance, which may increase its costs of operations and adversely impact the Company’s earnings.

Capital Requirements

The Company and the Bank are required to comply with applicable capital adequacy standards established by the federal banking agencies (the “Capital Rules”) which are based on the Basel Committee on Banking Supervision’s (the “Basel Committee”) December 2010 final capital framework for strengthening international capital standards, referred to as “Basel III”.

The Capital Rules, among other things, impose a capital measure called “Common Equity Tier 1,” (“CET1”) to which most deductions/adjustments to regulatory capital measures be made. In addition, the Capital Rules specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting certain specified requirements.

Under the Capital Rules, the minimum capital ratios are as follows:

● 4.5% CET1 to total risk-weighted assets;

● 6.0% Tier 1 capital (CET1 plus Additional Tier 1 capital) to total risk-weighted assets;

● 8.0% Total capital (Tier 1 Capital plus Tier 2 capital) to total risk-weighted assets;

● 4.0% Tier 1 capital to total adjusted quarterly average assets (known as “leverage ratio”)

The Capital Rules require the Company and the Bank to maintain a “capital conservation buffer” composed entirely of CET1. Banking organizations are required to maintain a minimum capital conservation buffer of 2.5% (CET1 to Total risk-weighted assets), in addition to the minimum risk-based capital ratios. Therefore, to satisfy both the minimum risk-based capital ratios and the capital conservation buffer, a banking organization is required to maintain the following: (i) CET1 to total risk-weighted assets of at least 7%, (ii) Tier 1 capital to total risk-weighted assets of at least 8.5%, and (iii) Total capital (Tier 1 capital plus Tier 2 capital) to total risk-weighted assets of at least 10.5%. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions that do not maintain a capital conservation buffer of 2.5% or more will face constraints on dividends, common share repurchases and incentive compensation based on the amount of the shortfall.

The Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, deferred tax assets dependent upon future taxable income and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. Under the Capital Rules, the effects of certain accumulated other comprehensive income or loss items are not excluded for the purposes of determining regulatory capital; however, banks not using the advanced approach, including the Company and the Bank, were permitted to, and in the case of the Company and the Bank they did, make a one-time permanent election to continue to exclude these items.

Consistent with Section 171 of the Dodd-Frank Act, the Capital Rules allow certain bank holding companies to include certain hybrid securities, such as trust preferred securities, in Tier 1 capital if they had less than $15 billion in assets as of December 31, 2009 and the securities were issued before May 19, 2010. Accordingly, the trust preferred securities on the Company’s balance sheet were included as Tier 1 capital while they were outstanding.

With respect to the Bank, the Capital Rules also revised the prompt corrective action (“PCA”) regulations established pursuant to Section 38 of the Federal Deposit Insurance Act, establishing the CET1 ratio at 6.5% for well-capitalized status and the Tier 1 capital ratio at 8.0% for well-capitalized status. The Capital Rules do not change the Total risk-based PCA capital requirement for any capital category.

Table of Contents

The Capital Rules prescribe a standardized approach for risk weighted-assets that expands the risk-weight categories from the four Basel I-derived categories (0%, 20%, 50% and 100%) to a larger and more risk-sensitive number of categories, depending on the nature of the asset. The risk-weight categories generally range from 0% for U.S. government and agency securities, to 1,250% for certain securitized exposures, and result in higher risk weights for a variety of asset categories. The standardized approach requires financial institutions to transition assets that are 90 days or more past due or on nonaccrual from their original risk weight to 150 percent. Additionally, loans designated as high volatility commercial real estate (“HVCRE”) are assigned a risk-weighting of 150 percent.

Requirements to maintain higher levels of capital or to maintain higher levels of liquid assets could adversely impact the Company’s net income and return on equity. The current requirements and the Company’s actual capital levels are detailed in Note P of “Notes to Consolidated Financial Statements” filed in Part II, Item 8, “Financial Statements and Supplementary Data.”

Consumer Protection Laws

In connection with its banking activities, the Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending to various sectors of the economy. These laws include but are not limited to the Equal Credit Opportunity Act, the Gramm-Leach-Bliley Act (“GLB Act”), the Fair Credit Reporting Act (“FCRA”), the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”), Electronic Funds Transfer Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Dodd-Frank Act, the Real Estate Settlement Procedures Act, the Secure and Fair Enforcement for Mortgage Licensing Act (“SAFE”), the Servicemembers Civil Relief Act (“SCRA”), the Military Lending Act (“MLA”), and various state law counterparts.

The Dodd-Frank Act created the CFPB with broad powers to supervise and enforce consumer protection laws, including laws that apply to banks in order to prohibit unfair, deceptive or abusive acts or practices. The CFPB has examination authority over all banks and savings institutions with more than $10 billion in assets. The Dodd-Frank Act also weakens the federal preemption rules that are applicable to national banks and gives attorney generals for the states certain powers to enforce federal consumer protection laws. Further, under the Dodd-Frank Act, it is unlawful for any provider of consumer financial products or services to engage in any unfair, deceptive, or abusive acts or practices (“UDAAP”). A violation of the consumer protection and privacy laws, and in particular UDAAP, could have serious legal, financial, and reputational consequences.

The GLB Act requires all financial institutions to adopt privacy policies, restrict the sharing of nonpublic customer data with nonaffiliated parties and establishes procedures and practices to protect customer data from unauthorized access. In addition, the FCRA, as amended by the FACT Act, includes provisions affecting the Company, the Bank, and their affiliates, including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. The FACT Act requires persons subject to FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the Federal Trade Commission have extensive rulemaking authority under the FACT Act, and the Company and the Bank are subject to the rules that have been created under the FACT Act, including rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate certain identity theft red flags. The SCRA protects persons called to active military service and their dependents from undue hardship resulting from their military service, and the MLA extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The SCRA applies to all debts incurred prior to the commencement of active duty and limits the amount of interest, including service and renewal charges and any other fees or charges (other than bona fide insurance) that are related to the obligation or liability. The MLA applies to certain consumer loans and extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The Bank is also subject to data security standards and data breach notice requirements issued by the OCC and other regulatory agencies. The Bank has created policies and procedures to comply with these consumer protection requirements.

Table of Contents

The CFPB has implemented the ability-to-repay and qualified mortgage (QM) provisions of the Truth in Lending Act (the “QM Rule”) and has recently taken steps to modify the QM Rule. The ability-to-repay provision requires creditors to make reasonable, good faith determinations that borrowers are able to repay their mortgages before extending credit based on a number of factors and consideration of financial information about the borrower derived from reasonably reliable third-party documents. Under the Dodd-Frank Act and the QM Rule, loans meeting the definition of “qualified mortgage” are entitled to a presumption that the lender satisfied the ability-to-repay requirements. The presumption is a conclusive presumption/safe harbor for loans meeting the QM requirements, and a rebuttable presumption for higher-priced loans meeting the QM requirements. The Bank has created policies and procedures to comply with these consumer protection requirements and continues to monitor developments relative to future changes to the QM Rule.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The USA Patriot Act also encourages information-sharing among financial institutions, regulators, and law enforcement authorities by providing an exemption from the privacy provisions of the GLB Act for financial institutions that comply with the provision of the Act. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the institution. The Company has approved policies and procedures that are designed to comply with the USA Patriot Act and its regulations.

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others administrated by the Treasury’s Office of Foreign Assets Control (“OFAC”). The OFAC administered sanctions can take many different forms; however, they generally contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, entity or individual, including prohibitions against direct or indirect imports and exports and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments, or providing investment related advice or assistance; and (ii) a blocking of assets in which the government or specially designated nationals have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934, as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) new requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) additional responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) the creation of an independent accounting oversight board for the accounting industry; (iv) new standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on non-preferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violations of the securities laws.

Electronic Fund Transfer Act

Among other provisions, the federal banking rule under the Electronic Fund Transfer Act prohibits financial institutions from charging consumers fees for paying overdrafts on automated teller machines and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions. The rule does not govern overdraft fees on the payment of checks and certain other forms of bill payments.

Table of Contents

Community Reinvestment Act of 1977

Under the CRA, the Bank is required to help meet the credit needs of its communities, including low- and moderate-income neighborhoods. Although the Bank must follow the requirements of CRA, it does not limit the Bank’s discretion to develop products and services that are suitable for a particular community or establish lending requirements or programs. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibits discrimination in lending practices. The Bank’s failure to comply with the provisions of the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s failure to comply with the Equal Credit Opportunity Act and the Fair Housing Act could result in enforcement actions against it by its regulators as well as other federal regulatory agencies and the Department of Justice. The Bank’s most recent CRA rating was “Satisfactory”.

The Bank Secrecy Act

The Bank Secrecy Act (“BSA”) requires all financial institutions, including banks and securities broker-dealers, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. The BSA includes a variety of recordkeeping and reporting requirements (such as currency transaction and suspicious activity reporting), as well as due diligence/know-your-customer documentation requirements. The Company has established a bank secrecy act /anti-money laundering program and taken other appropriate measures in order to comply with BSA requirements.

Table of Contents

Information about Our Executive Officers

The executive officers of the Company and the Bank who are elected by the Board of Directors are as follows:

Name Age Position Mark E. Tryniski 61 Director, President and Chief Executive Officer. Mr. Tryniski assumed his current position in August 2006. He served as Executive Vice President and Chief Operating Officer from March 2004 to July 2006 and as the Treasurer and Chief Financial Officer from June 2003 to March 2004. He previously served as a partner in the Syracuse office of PricewaterhouseCoopers LLP. Joseph E. Sutaris 54 Executive Vice President and Chief Financial Officer. Mr. Sutaris assumed his current position in June 2018. He served as Senior Vice President, Finance and Accounting from November 2017 to June 2018, as the Bank’s Director of Municipal Banking from September 2016 to November 2017 and as the Senior Vice President of the Central Region of the Bank from April 2011 to September 2016. Mr. Sutaris joined the Company in April 2011 as part of the acquisition of Wilber National Bank where he served as the Executive Vice President, Chief Financial Officer, Treasurer and Secretary. George J. Getman 65 Executive Vice President and General Counsel. Mr. Getman assumed his current position in January 2008. Prior to joining the Company, he was a partner with Bond, Schoeneck & King, PLLC and served as corporate counsel to the Company. Maureen Gillan-Myer 54 Executive Vice President and Chief Human Resources Officer. Ms. Gillan-Myer assumed her current position in October 2021. Prior to joining the Company, she served as the Chief Human Resources Officer of HSBC US from February 2016 through September 2021 and as its Senior Vice President- Talent Acquisition from May 2009 through February 2016. Dimitar A. Karaivanov 40 Executive Vice President of Financial Services and Corporate Development. Mr. Karaivanov assumed his current position in June 2021. Prior to joining the Company, he served as Managing Director of Lazard Middle Market’s Financial Institutions Group from June 2018 through June 2021. Prior to Lazard, he was the Managing Director of RBC Capital Markets’ Financial Institutions Group from April 2011 through June 2018. Jeffrey M. Levy 60 President, Commercial Banking. Mr. Levy assumed his current position in January 2022. He served as the Bank’s Senior Vice President, Commercial Banking Sales Executive from June 2021 to December 2021, as Senior Vice President, Regional President of Capital Region from June 2019 to June 2021, and as Senior Vice President, Commercial Banking Team Leader from January 2018 to June 2019. Prior to joining the Bank, he served as the Executive Vice President and President of Commercial Banking at NBT Bank, N.A. from December 2006 to August 2016. Joseph F. Serbun 61 President, Retail Banking. Mr. Serbun assumed his current position in January 2022. He served as the Company’s and the Bank’s Executive Vice President and Chief Banking Officer from March 2020 to December 2021, as the Bank’s Executive Vice President and Chief Credit Officer from June 2018 to March 2020, as Senior Vice President and Chief Credit Officer from June 2010 to June 2018 and as Vice President and Commercial Team Leader of the Bank from January 2008 until June 2010. Prior to joining the Company, he served as Vice President at JPMorgan Chase Bank, N.A.

Table of Contents

Community Bank System, Inc. (the “Company”) was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company is a registered financial holding company which wholly-owns two significant subsidiaries: Community Bank, N.A. (the “Bank” or “CBNA”), and Benefit Plans Administrative Services, Inc. (“BPAS”). As of December 31, 2020, BPAS owns five subsidiaries: Benefit Plans Administrative Services, LLC (“BPA”), a provider of defined contribution plan administration services; Northeast Retirement Services, LLC (“NRS”), a provider of institutional transfer agency, master recordkeeping services, fund administration, trust and retirement plan services; BPAS Actuarial & Pension Services, LLC (“BPAS-APS”), a provider of actuarial and benefit consulting services; BPAS Trust Company of Puerto Rico, a Puerto Rican trust company; and Hand Benefits & Trust Company (“HB&T”), a provider of collective investment fund administration and institutional trust services. NRS owns one subsidiary, Global Trust Company, Inc. (“GTC”), a non-depository trust company which provides fiduciary services for collective investment trusts and other products. HB&T owns one subsidiary, Hand Securities, Inc. (“HSI”), an introducing broker-dealer. The Company also sponsors one unconsolidated subsidiary business trust formed for the purpose of issuing mandatorily-redeemable preferred securities which are considered Tier I capital under regulatory capital adequacy guidelines.

The Bank’s business philosophy is to operate as a diversified financial services enterprise providing a broad array of banking and other financial services to retail, commercial and municipal customers. As of December 31, 2020, the Bank operates 232 full-service branches operating as Community Bank, N.A. throughout 42 counties of Upstate New York, six counties of Northeastern Pennsylvania, 12 counties of Vermont and one county of Western Massachusetts, offering a range of commercial and retail banking services. The Bank owns the following operating subsidiaries: The Carta Group, Inc. (“Carta Group”), CBNA Preferred Funding Corporation (“PFC”), CBNA Treasury Management Corporation (“TMC”), Community Investment Services, Inc. (“CISI”), Nottingham Advisors, Inc. (“Nottingham”), OneGroup NY, Inc. (“OneGroup”), OneGroup Wealth Partners, Inc. (“Wealth Partners”) and Oneida Preferred Funding II LLC (“OPFC II”). OneGroup is a full-service insurance agency offering personal and commercial lines of insurance and other risk management products and services. PFC and OPFC II primarily act as investors in residential and commercial real estate activities. TMC provides cash management, investment, and treasury services to the Bank. CISI, Carta Group and Wealth Partners provide broker-dealer and investment advisory services. Nottingham provides asset management services to individuals, corporations, corporate pension and profit sharing plans, and foundations.

The Company maintains a website at cbna.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information posted on the website is not incorporated into or a part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at https://www.sec.gov.

Acquisition History (2016-2020)

Steuben Trust Corporation

On June 12, 2020, the Company completed its merger with Steuben Trust Corporation (“Steuben”), parent company of Steuben Trust Company, a New York State chartered bank headquartered in Hornell, New York, for $98.6 million in Company stock and cash, comprised of $21.6 million in cash and the issuance of 1.36 million shares of common stock. The merger extended the Company’s footprint into two new counties in Western New York State, and enhanced the Company’s presence in four Western New York State counties in which it currently operates. In connection with the merger, the Company added 11 full-service offices to its branch service network and acquired $607.8 million of assets, including $339.7 million of loans and $180.5 million of investment securities, as well as $516.3 million of deposits. Goodwill of $20.2 million was recognized as a result of the merger.

Table of Contents

Financial Services Practice – Syracuse, NY

On September 18, 2019, the Company, through its subsidiary, CISI, completed its acquisition of certain assets of a practice engaged in the financial services business headquartered in Syracuse, New York. The Company paid $0.5 million in cash to acquire a customer list, and recorded a $0.5 million customer list intangible asset in conjunction with the acquisition.

Kinderhook Bank Corp.

On July 12, 2019, the Company completed its merger with Kinderhook Bank Corp. (“Kinderhook”), parent company of The National Union Bank of Kinderhook, headquartered in Kinderhook, New York, for $93.4 million in cash. The merger added 11 branch locations across a five county area in the Capital District of Upstate New York. The merger resulted in the acquisition of $642.8 million of assets, including $479.9 million of loans and $39.8 million of investment securities, as well as $568.2 million of deposits and $40.0 million in goodwill.

Wealth Resources Network, Inc.

On January 2, 2019, the Company, through its subsidiary, CISI, completed its acquisition of certain assets of Wealth Resources Network, Inc. (“Wealth Resources”), a financial services business headquartered in Liverpool, New York. The Company paid $1.2 million in cash to acquire a customer list from Wealth Resources, and recorded a $1.2 million customer list intangible asset in conjunction with the acquisition.

HR Consultants, LLC

On April 2, 2018, the Company, through its subsidiary, BPAS, acquired certain assets of HR Consultants (SA), LLC (“HR Consultants”), a provider of actuarial and benefit consulting services headquartered in Puerto Rico. The Company paid $0.3 million in cash to acquire the assets of HR Consultants and recorded intangible assets of $0.3 million in conjunction with the acquisition.

Penna & Associates Agency, Inc.

On January 2, 2018, the Company, through its subsidiary, OneGroup, completed its acquisition of certain assets of Penna & Associates Agency, Inc. (“Penna”), an insurance agency headquartered in Johnson City, New York. The Company paid $0.8 million in cash to acquire the assets of Penna, and recorded goodwill in the amount of $0.3 million and a customer list intangible asset of $0.3 million in conjunction with the acquisition.

Styles Bridges Associates

On January 2, 2018, the Company, through its subsidiary, CISI, completed its acquisition of certain assets of Styles Bridges Associates (“Styles Bridges”), a financial services business headquartered in Canton, New York. The Company paid $0.7 million in cash to acquire a customer list from Styles Bridges, and recorded a $0.7 million customer list intangible asset in conjunction with the acquisition.

Gordon B. Roberts Agency, Inc.

On December 4, 2017, the Company, through its subsidiary, OneGroup, completed its acquisition of Gordon B. Roberts Agency, Inc. (“GBR”), an insurance agency headquartered in Oneonta, New York for $3.7 million in Company stock and cash, comprised of $1.35 million in cash and the issuance of 0.04 million shares of common stock. The transaction resulted in the acquisition of $0.6 million of assets, $0.6 million of other liabilities, goodwill in the amount of $2.1 million and other intangible assets of $1.6 million.

Northeast Capital Management, Inc.

On November 17, 2017, the Company, through its subsidiary, CISI, completed its acquisition of certain assets of Northeast Capital Management, Inc. (“NECM”), a financial services business headquartered in Wilkes-Barre, Pennsylvania. The Company paid $1.2 million in cash to acquire a customer list from NECM, and recorded a $1.2 million customer list intangible asset in conjunction with the acquisition.

Merchants Bancshares, Inc.

On May 12, 2017, the Company completed its acquisition of Merchants Bancshares, Inc. (“Merchants”), parent company of Merchants Bank headquartered in South Burlington, Vermont, for $345.2 million in Company stock and cash, comprised of $82.9 million in cash and the issuance of 4.68 million shares of common stock. The acquisition extended the Company’s footprint into the Vermont and Western Massachusetts markets with the addition of 31 branch locations in Vermont and one location in Massachusetts. This transaction resulted in the acquisition of $2.0 billion of assets, including $1.49 billion of loans and $370.6 million of investment securities, as well as $1.45 billion of deposits and $189.0 million in goodwill.

Table of Contents

Dryfoos Insurance Agency, Inc.

On March 1, 2017, the Company, through its subsidiary, OneGroup, completed its acquisition of certain assets of Dryfoos Insurance Agency, Inc. (“Dryfoos”), an insurance agency headquartered in Hazleton, Pennsylvania. The Company paid $3.0 million in cash to acquire the assets of Dryfoos, and recorded goodwill in the amount of $1.7 million and other intangible assets of $1.7 million in conjunction with the acquisition.

Northeast Retirement Services, Inc.

On February 3, 2017, the Company completed its acquisition of NRS and its subsidiary GTC, headquartered in Woburn, Massachusetts, for $148.6 million in Company stock and cash, comprised of $70.1 million in cash and the issuance of 1.32 million shares of common stock. NRS was a privately held corporation focused on providing institutional transfer agency, master recordkeeping services, custom target date fund administration, trust product administration and customized reporting services to institutional clients. Its wholly-owned subsidiary, GTC, is chartered in the State of Maine as a non-depository trust company and provides fiduciary services for collective investment trusts and other products. The acquisition of NRS and GTC, hereafter referred to collectively as NRS, strengthens and complements the Company’s existing employee benefit services businesses. Upon the completion of the merger, NRS became a wholly-owned subsidiary of BPAS and operates as Northeast Retirement Services, LLC, a Delaware limited liability company. This transaction resulted in the acquisition of $36.1 million in net tangible assets, principally cash and certificates of deposit, $60.2 million in customer list intangibles that will be amortized over 10 years, the creation of a $23.0 million deferred tax liability associated with the customer list intangible and $75.3 million in goodwill.

Benefits Advisory Service, Inc.

On January 1, 2017, the Company, through its subsidiary, OneGroup, acquired certain assets of Benefits Advisory Service, Inc. (“BAS”), a benefits consulting group headquartered in Forest Hills, New York. The Company paid $1.2 million in cash to acquire the assets of BAS and recorded intangible assets of $1.2 million in conjunction with the acquisition.

WJL Agencies, Inc.

On January 4, 2016, the Company, through its subsidiary, CBNA Insurance Agency, Inc., completed its acquisition of WJL Agencies, Inc. doing business as The Clark Insurance Agencies (“WJL”), an insurance agency operating in Canton, New York. The Company paid $0.6 million in cash for the intangible assets of the company. Goodwill in the amount of $0.3 million and intangible assets in the amount of $0.3 million were recorded in conjunction with the acquisition. On August 19, 2016, the Company merged together its insurance subsidiaries and as of that date, CBNA Insurance Agency, Inc. was merged into OneGroup.

Services

Banking

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank's branches are generally located in smaller towns and cities within its geographic market areas of Upstate New York, Northeastern Pennsylvania, Vermont and Western Massachusetts. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch, regional levels and its digital banking service offerings, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System, the Federal Home Loan Bank of New York and the Federal Home Loan Bank of Boston (as a non-member bank) (collectively, referred to as “FHLB”), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Employee Benefit Services

Through BPAS and its subsidiaries, the Company operates a national practice that provides employee benefit trust, collective investment fund, retirement plan administration, fund administration, transfer agency, actuarial, VEBA/HRA and health and welfare consulting services to a diverse array of clients spanning the United States and Puerto Rico.

Wealth Management

Through the Bank, its trust department, CISI, Carta Group, Nottingham, and Wealth Partners, the Company provides wealth management, retirement planning, higher educational planning, fiduciary, risk management, trust services and personal financial planning services. The Company offers investment alternatives including stocks, bonds, mutual funds, insurance and advisory products.

Table of Contents

Insurance Agency

Through OneGroup, the Company offers personal and commercial lines of insurance and other risk management products and services. In addition, OneGroup offers employee benefit related services. OneGroup represents many leading insurance companies.

Segment Information

The Company has identified three reportable operating business segments: Banking, Employee Benefit Services, and All Other. Included in the All Other segment are the smaller Wealth Management and Insurance operations. Information about the Company’s reportable business segments is included in Note U of the “Notes to Consolidated Financial Statements” filed herewith in Part II.

Competition

The banking and financial services industry is highly competitive in the New York, Pennsylvania, Vermont and Massachusetts markets. The Company competes actively for loans, deposits, and financial services relationships with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, including, financial technology companies, insurance agencies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The Company’s employee benefit trust and plan administration business competes on a national scale and provides geographic diversification for the Company. Certain lines of business are marketed primarily through unaffiliated financial advisors, while others are marketed directly to plan sponsors and fund companies. In order to compete with large national firms, the Company stresses its consultative approach to complex engagements.

Table of Contents

The table below summarizes the Bank’s deposits and market share by the 61 counties of New York, Pennsylvania, Vermont, and Massachusetts in which it had customer facilities as of June 30, 2020. Market share is based on deposits of all commercial banks, credit unions, savings and loan associations, and savings banks.

Number of Towns Where Company Has 1st Deposits as of 6/30/2020(1) Market Towns/ or 2nd Market County State (000's omitted) Share(1) Branches ATM's Cities Position Grand Isle VT $ 46,151 100.00 % 1 1 1 1 Allegany NY 573,269 77.87 % 12 16 11 11 Lewis NY 228,542 73.69 % 4 4 3 3 Hamilton NY 60,664 56.08 % 2 2 2 2 Franklin NY 400,704 55.42 % 6 6 5 5 Madison NY 442,410 45.98 % 6 8 5 5 Cattaraugus NY 737,672 41.91 % 9 11 7 6 Otsego NY 378,178 29.67 % 9 9 6 5 Saint Lawrence NY 540,472 25.08 % 13 12 11 10 Jefferson NY 510,003 22.74 % 7 10 6 5 Schuyler NY 55,195 22.74 % 1 1 1 1 Yates NY 108,328 22.64 % 3 2 2 1 Seneca NY 142,632 22.10 % 4 3 4 2 Wyoming PA 168,917 21.97 % 4 4 4 3 Clinton NY 389,984 20.83 % 4 7 2 2 Livingston NY 242,127 20.75 % 5 6 5 4 Columbia NY 266,021 19.69 % 4 4 4 3 Chautauqua NY 449,662 19.30 % 12 12 10 7 Essex NY 148,981 15.31 % 5 5 4 3 Orange VT 53,712 13.86 % 2 2 2 2 Steuben NY 429,928 12.49 % 12 13 8 7 Oswego NY 204,247 11.48 % 4 5 4 1 Wayne NY 155,907 10.86 % 3 4 2 2 Addison VT 72,930 10.05 % 2 2 2 1 Ontario NY 274,517 9.57 % 7 13 5 3 Caledonia VT 71,316 9.32 % 2 2 2 1 Delaware NY 138,190 8.90 % 5 5 5 4 Bennington VT 86,008 8.83 % 2 4 2 0 Tioga NY 43,849 8.55 % 2 2 2 1 Herkimer NY 62,676 7.77 % 1 1 1 1 Montgomery NY 66,005 7.67 % 2 2 2 1 Rutland VT 126,651 7.47 % 3 4 2 1 Chittenden VT 603,286 7.46 % 9 10 6 4 Franklin VT 49,485 6.50 % 2 2 2 0 Luzerne PA 502,977 6.49 % 9 13 8 3 Lackawanna PA 444,531 6.17 % 11 11 8 4 Chemung NY 77,888 5.71 % 2 2 1 0 Fulton NY 57,261 5.66 % 1 1 1 0 Susquehanna PA 63,506 5.50 % 2 1 2 1 Carbon PA 52,696 5.15 % 2 2 2 1 Schoharie NY 22,916 4.31 % 1 1 1 0 Lamoille VT 30,841 4.05 % 1 1 1 1 Oneida NY 283,239 3.84 % 6 8 5 4 Windsor VT 58,230 3.79 % 2 2 2 0 Cayuga NY 50,362 3.50 % 2 2 2 1 Bradford PA 47,554 3.32 % 2 2 2 1 Windham VT 51,112 3.29 % 2 3 2 1 Washington NY 23,019 2.75 % 1 1 1 1 Washington VT 94,028 2.46 % 3 4 3 1 Rensselaer NY 60,304 2.33 % 1 2 1 0 Onondaga NY 362,626 2.32 % 4 6 4 1 Chenango NY 25,901 2.21 % 2 2 1 0 Warren NY 40,364 1.59 % 1 1 1 1 Wyoming NY 24,017 1.39 % 1 1 1 0 Ulster NY 30,564 0.61 % 1 1 1 1 Broome NY 40,912 0.55 % 1 1 1 0 Erie NY 195,968 0.32 % 5 5 4 2 Albany NY 83,278 0.31 % 3 5 3 0 Hampden MA 46,150 0.29 % 1 1 1 0 Tompkins NY 5,240 0.14 % 1 0 1 0 Monroe NY 7,847 0.03 % 1 0 1 0 $ 11,111,950 4.41 % 238 273 201 132

(1) Deposits and Market Share data as of June 30, 2020, the most recent information available from S&P Global Market Intelligence. Deposit amounts include $265.3 million of intercompany balances that are eliminated upon consolidation.

Table of Contents

Employees and Human Capital

As of December 31, 2020, the Company had 3,047 total employees, which included 2,807 full-time employees and 240 part-time and temporary employees. Of the Company’s 3,047 employees, 2,431 are in the Banking segment (2,213 full-time employees and 218 part-time and temporary employees), 367 employees are in the Employee Benefit Services segment (354 full-time employees and 13 part-time and temporary employees), and 249 employees are in the All Other segment (240 full-time employees and 9 part-time and temporary employees).

The success and growth of our business is largely dependent on our ability to attract, develop, and retain a population of talented and high-performing employees with a diversity of background and skill sets at all levels of our organization. Accordingly, the Company strives to offer competitive salaries and benefits that are consistent with employee positions, skill levels, experience, and geographic location. The Company is proud to offer an array of incentive compensation in which all employees have an opportunity to earn various forms of supplemental pay as a reward for their overall contributions towards the Company’s financial objectives. Additionally, the Company offers a wellness program aimed at providing tools, resources, and encouragement to support its employees’ physical and mental well-being.

The Company continues to broaden the scope of its talent development initiatives across our widening geographically diverse footprint in order to sustain a value-driven and growth-oriented environment where employees can perform at their peak and the next generation of leaders are prepared to lead. The Company offers an array of programs and continuing education dedicated to strengthen employee engagement, personal accountability, productivity, and emotional well-being including customized programs supporting an overall strategy of strong workforce planning, growth-focused coaching sessions, career-path roadmaps and curated learning resources.

The Company is committed to fostering a workforce in an inclusive environment that enhances the culture of shared identity, civility, dignity, and respect. In 2020, the Company launched a company-wide Diversity Council to lead this effort and provide strategic direction and advocacy for these initiatives. The Council’s members play a vital role in creating the Company’s diversity initiatives and are comprised of employees from various areas of the Company’s business and geographic locations. The Council members, along with other employees who volunteer to act as “Council Ambassadors,” are responsible for advancing the Council’s message within their own network of employees. Their efforts demonstrate the Company’s commitment to creating a work environment where everyone feels welcomed, valued, and fully engaged to contribute their unique talents and transform that deeper understanding into the organization’s culture.

As the COVID-19 events unfolded throughout 2020, the Company implemented various plans, strategies and protocols to protect its employees, customers and stakeholders, among other objectives. In order to protect its employees and assure workforce continuity and operational redundancy, the Company imposed business travel restrictions, implemented quarantine and work from home protocols and physically separated, to the extent possible, the critical operations workforce that are unable to work remotely. To limit the risk of virus spread, the Company implemented enhanced cleaning and sanitation processes for both branches and office administration spaces and implemented drive-thru only and by appointment operating protocols as needed for its extensive bank branch network. As of December 31, 2020, the Company is pleased to report there have been no employee layoffs or furloughs. The safety of its customers, employees, stakeholders and communities will always remain the Company’s top priority.

The Company considers its relationship with its employees to be good. The Company has not experienced any material employment-related issues or interruptions of services due to labor disagreements. None of the Company’s employees are represented by a labor union or are represented by a collective bargaining agreement.

Table of Contents

Supervision and Regulation

General

The banking industry is highly regulated with numerous statutory and regulatory requirements that are designed primarily for the protection of depositors and the financial system, and not for the purpose of protecting shareholders. Set forth below is a description of the material laws and regulations applicable to the Company and the Bank. This summary is not complete and the reader should refer to these laws and regulations for more detailed information. The Company’s and the Bank’s failure to comply with applicable laws and regulations could result in a range of sanctions and administrative actions imposed upon the Company and/or the Bank, including restriction to merger and acquisition activity, the imposition of civil money penalties, formal agreements and cease and desist orders. Changes in applicable law or regulations, and in their interpretation and application by regulatory agencies, cannot be predicted, and may have a material effect on the Company’s business and results.

The Company and its subsidiaries are subject to the laws and regulations of the federal government and where applicable the states and jurisdictions in which they conduct business. The Company, as a bank holding company, is subject to extensive regulation, supervision and examination by the Board of Governors of the Federal Reserve System (“FRB”) as its primary federal regulator. The Bank is a nationally-chartered bank and is subject to extensive regulation, supervision and examination by the Office of the Comptroller of the Currency (“OCC”) as its primary federal regulator, and as to certain matters, the FRB, the Consumer Financial Protection Bureau (“CFPB”), and the Federal Deposit Insurance Corporation (“FDIC”).

The Company is also subject to the jurisdiction of the SEC and is subject to disclosure and regulatory requirements under the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended. The Company’s common stock is listed on the New York Stock Exchange (“NYSE”) and it is subject to NYSE’s rules for listed companies. Affiliated entities, including BPAS, GTC, HB&T, HSI, BPAS Trust Company of Puerto Rico, Nottingham, CISI, OneGroup, Carta Group, and Wealth Partners are subject to the jurisdiction of certain state and federal regulators and self-regulatory organizations including, but not limited to, the SEC, the Texas Department of Banking, the State of Maine Bureau of Financial Institutions, the Financial Industry Regulatory Authority (“FINRA”), Puerto Rico Office of the Commissioner of Financial Institutions, and state securities and insurance regulators.

Federal Bank Holding Company Regulation

The Company was a bank holding company under the Bank Holding Company Act of 1956, (the “BHC Act”), and became a financial holding company effective September 30, 2015. As a bank holding company that has elected to become a financial holding company, the Company can affiliate with securities firms and insurance companies and engage in other activities that are “financial in nature” or “incidental” or “complementary” to activities that are financial in nature, as long as it continues to meet the eligibility requirements for financial holding companies (including requirements that the financial holding company and its depository institution subsidiary maintain their status as “well capitalized” and “well managed”).

Generally, FRB approval is not required for the Company to acquire a company (other than a bank holding company, bank or savings association) engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the FRB. Prior notice to the FRB may be required, however, if the company to be acquired has total consolidated assets of $10 billion or more. Prior FRB approval is required before the Company may acquire the beneficial ownership or control of more than 5% of the voting shares or substantially all of the assets of a bank holding company, bank or savings association.

Because the Company is a financial holding company, if the Bank were to receive a rating under the Community Reinvestment Act of 1977, as amended (“CRA”), of less than Satisfactory, the Company will be prohibited, until the rating is raised to Satisfactory or better, from engaging in new activities or acquiring companies other than bank holding companies, banks or savings associations, except that the Company could engage in new activities, or acquire companies engaged in activities, that are considered “closely related to banking” under the BHC Act. In addition, if the FRB determines that the Company or the Bank is not well capitalized or well managed, the Company would be required to enter into an agreement with the FRB to comply with all applicable capital and management requirements and may contain additional limitations or conditions. Until corrected, the Company could be prohibited from engaging in any new activity or acquiring companies engaged in activities that are not closely related to banking, absent prior FRB approval.

Table of Contents

Federal Reserve System Regulation

Because the Company is a financial holding company, it is subject to regulatory capital requirements and required by the FRB to, among other things, maintain cash reserves against its deposits. Effective on March 26, 2020, the FRB reduced this cash reserve requirement to zero percent to help support lending to households and businesses as a result of the impacts of the COVID-19 pandemic. The Bank is under similar capital requirements administered by the OCC as discussed below. FRB policy has historically required a financial holding company to act as a source of financial and managerial strength to its subsidiary banks. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) codifies this historical policy as a statutory requirement. To the extent the Bank is in need of capital, the Company could be expected to provide additional capital, including borrowings from the FRB for such purpose. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors’ funds.

The FRB also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the FRB, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust its strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond its control.

The Office of the Comptroller of the Currency Regulation

The Bank is supervised and regularly examined by the OCC. The various laws and regulations administered by the OCC affect the Company’s practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects the Bank’s business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and the location of its offices. The OCC generally prohibits a depository institution from making any capital distributions, including the payment of a dividend, or paying any management fee to its parent holding company if the depository institution would become undercapitalized due to the payment. Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the OCC. The Bank is well capitalized under regulatory standards administered by the OCC. For additional information on our capital requirements see “Management’s Discussion and Analysis of Financial Condition and Results of Operations – Shareholders’ Equity” and Note P to the Financial Statements.

Federal Home Loan Bank

The Bank is a member of the FHLB, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to the rules and requirements of the FHLB, including the purchase of shares of FHLB activity-based stock in the amount of 4.5% of the dollar amount of outstanding advances and FHLB capital stock in an amount equal to the greater of $1,000 or the sum of 0.15% of the mortgage-related assets held by the Bank based upon the previous year-end financial information. The Bank was in compliance with the rules and requirements of the FHLB at December 31, 2020.

Deposit Insurance

Deposits of the Bank are insured up to the applicable limits by the Deposit Insurance Fund (“DIF”) and are subject to deposit insurance assessments to maintain the DIF. The Dodd-Frank Act permanently increased the maximum amount of deposit insurance to $250,000 per deposit category, per depositor, per institution. A depository institution’s DIF assessment is calculated by multiplying its assessment rate by the assessment base, which is defined as the average consolidated total assets less the average tangible equity of the depository institution. The initial base assessment rate is based on its capital level and supervisory ratings (its “CAMELS ratings”), certain financial measures to assess an institution’s ability to withstand asset related stress and funding related stress and, in some cases, additional discretionary adjustments by the FDIC to reflect additional risk factors. The Bank’s adjusted average consolidated total assets for 4 consecutive quarters exceeded $10.0 billion in 2018, which resulted in a deposit insurance assessment based on a large institution classification, rather than the small institution classification for years prior to 2018.

Table of Contents

For large insured depository institutions, generally defined as those with at least $10 billion in total assets, the FDIC has eliminated risk categories when calculating the initial base assessment rates and now combine CAMELS ratings and financial measures into two scorecards to calculate assessment rates, one for most large insured depository institutions and another for highly complex insured depository institutions (which are generally those with more than $50 billion in total assets that are controlled by a parent company with more than $500 billion in total assets). Each scorecard has two components - a performance score and loss severity score, which are combined and converted to an initial assessment rate. The FDIC has the ability to adjust a large or highly complex insured depository institution’s total score by a maximum of 15 points, up or down, based upon significant risk factors that are not captured by the scorecard. Under the current assessment rate schedule, the initial base assessment rate for large and highly complex insured depository institutions ranges from three to 30 basis points, and the total base assessment rate, after applying the unsecured debt and brokered deposit adjustments, ranges from one and one-half to 40 basis points. The Bank’s FDIC insurance for 2020 was based on an assessment rate of three basis points.

In October 2010, the FDIC adopted a DIF restoration plan to ensure that the fund reserve ratio reached 1.35% by September 30, 2020, as required by the Dodd-Frank Act. In September 2018, the DIF reserve ratio reached 1.36%, exceeding the required reserve ratio of 1.35% ahead of the September 30, 2020 deadline. Since the DIF reserve ratio remained above 1.35% in 2019, the Bank was permitted to offset its FDIC insurance assessments in 2019 with Small Bank Assessment Credits issued by the FDIC in January 2019. The Bank offset $1.5 million of FDIC insurance assessments in 2019 with Small Bank Assessment Credits. FDIC insurance expense net of Small Bank Assessment Credits in 2020 totaled $2.7 million, compared to $1.4 million in 2019 and $3.2 million in 2018.

Under the Federal Deposit Insurance Act, if the FDIC finds that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, the FDIC may determine that such violation or unsafe or unsound practice or condition require the termination of deposit insurance.

Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

On July 21, 2010, the Dodd-Frank Act was signed into law, which resulted in significant changes to the banking industry. As discussed further throughout this section, certain aspects of the Dodd-Frank Act are subject to implementing rules that have been taking effect over several years.

The Dodd-Frank Act contains numerous provisions that affect all banks and bank holding companies and impacts how the Company and the Bank handle their operations. The Dodd-Frank Act requires various federal agencies, including those that regulate the Company and the Bank, to promulgate new rules and regulations and to conduct various studies and reports for Congress. The federal agencies have either completed or are in the process of completing these rules and regulations and have been given significant discretion in drafting such rules and regulations. Several of the provisions of the Dodd-Frank Act may have the consequence of increasing the Bank’s expenses, decreasing its revenues, and changing the activities in which it chooses to engage. The specific impact of the Dodd-Frank Act on the Company’s current activities or new financial activities the Company may consider in the future, the Company’s financial performance, and the markets in which the Company operates depends on the manner in which the relevant agencies continue to develop and implement the required rules and regulations and the reaction of market participants to these regulatory developments.

Pursuant to FRB regulations mandated by the Dodd-Frank Act, interchange fees on debit card transactions are limited to a maximum of $0.21 per transaction plus 5 basis points of the transaction amount. A debit card issuer may recover an additional one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements prescribed by the FRB. The FRB also adopted requirements in the final rule that issuers include two unaffiliated networks for routing debit transactions that are applicable to the Company and the Bank. The Company became subject to the interchange fee cap mandated by the Dodd-Frank Act beginning on July 1, 2018. As such, the fees the Company received on and after July 1, 2018 for an electronic debit transaction were capped at the statutory limit. Prior to July 1, 2018, the Company was exempt from the interchange fee cap under the "small issuer" exemption, which applies to any debit card issuer with total worldwide assets (including those of its affiliates) of less than $10 billion as of the end of the previous calendar year.

Table of Contents

The Dodd-Frank Act established the CFPB and empowered it to exercise broad rulemaking, supervision, and enforcement authority for a wide range of consumer protection laws. Since the Bank’s total consolidated assets exceed $10 billion the Bank is subject to the direct supervision of the CFPB. The CFPB has issued numerous regulations and amendments under which the Company and the Bank may continue to incur additional expense in connection with its ongoing compliance obligations. Significant recent CFPB developments that may affect operations and compliance costs include:

●positions taken by the CFPB on fair lending, including applying the disparate impact theory which could make it more difficult for lenders to charge different rates or to apply different terms to loans to different customers;

●the CFPB’s final rule amending Regulation C, which implements the Home Mortgage Disclosure Act, requiring most lenders to report expanded information in order for the CFPB to more effectively monitor fair lending concerns and other information shortcomings identified by the CFPB;

●positions taken by the CFPB regarding the Electronic Fund Transfer Act and Regulation E, which require companies to obtain customer authorizations before automatically debiting a consumer’s account for pre-authorized electronic funds transfers; and

●focused efforts on enforcing certain compliance obligations the CFPB deems a priority, such as automobile loan servicing, debt collection, mortgage origination and servicing, remittances, and fair lending, among others.

The final rules issued by the FRB, SEC, OCC, FDIC, and Commodity Futures Trading Commission implementing Section 619 of the Dodd-Frank Act (commonly known as the Volcker Rule) prohibit insured depository institutions and companies affiliated with insured depository institutions from engaging in short-term proprietary trading of certain securities, derivatives, commodity futures and options on these instruments, for their own account. The final rules also imposes limits on banking entities’ investments in, and other relationships with, hedge funds or private equity funds.

As of October 2019, the five federal agencies identified above with rulemaking authority with respect to the Volcker Rule finalized amendments to the proprietary trading provisions of the Volcker Rule. These amendments tailor the Volcker Rule’s compliance requirements to the amount of a firm’s trading activity, revise the definition of trading account, clarify certain key provisions in the Volcker Rule, and modify the information companies are required to provide the federal agencies. These amendments to the Volcker Rule are not material to the Company’s investing and trading activities.

On January 30, 2020, the five federal agencies proposed additional amendments to the Volcker Rule related to the restrictions on ownership interests and relationships with covered funds. The ultimate benefits or consequences of these amendments will depend on their final form, which the Company cannot predict.

In May of 2018, the Economic Growth, Regulatory Relief, and Consumer Protection Act (“Economic Growth Act”) was enacted to amend the Dodd-Frank Act and modify certain post-crisis regulatory requirements, including a variety of provisions intended to promote economic growth, provide tailored regulatory relief for smaller and less complex financial institutions, and enhance consumer protections. Among other things, the law raised the asset size threshold for the filing of required company-run stress tests that the Dodd-Frank Act had applied to the Company and the Bank, from $10 billion to $250 billion in total assets. As implemented by the federal banking agencies, these changes became effective in 2018 for banking organizations with total assets of less than $100 billion, such as the Bank.

The ongoing effects of the Dodd-Frank Act, as well as the recent and possible future changes to the regulatory framework as a result of the Economic Growth Act and future proposals make it difficult to assess the overall financial impact of the Dodd-Frank Act and related regulatory developments on the Company and the banking industry. As a result, the Company cannot predict the ultimate impact of the Dodd-Frank Act on the Company or the Bank, including the extent to which it could increase costs or limit the Company’s ability to pursue business opportunities in an efficient manner, or otherwise adversely affect its business, financial condition and results of operations. Nor can the Company predict the impact or substance of other future legislation or regulation. However, it is expected that future legislation or regulation at a minimum will increase the Company’s and the Bank’s operating and compliance costs. As rules and regulations continue to be implemented or issued, the Company may need to dedicate additional resources to ensure compliance, which may increase its costs of operations and adversely impact its earnings.

Table of Contents

Capital Requirements

The Company and the Bank are required to comply with applicable capital adequacy standards established by the federal banking agencies. In July 2013, the FRB, the OCC and the FDIC approved final rules (the “Capital Rules”) establishing a new comprehensive capital framework for U.S. banking organizations. These rules went into effect for the Company and the Bank on January 1, 2015, subject to phase-in periods for certain components.

The Capital Rules implement the Basel Committee on Banking Supervision’s (the “Basel Committee”) December 2010 capital framework (known as “Basel III”) for strengthening international capital standards as well as certain provisions of the Dodd-Frank Act. The Capital Rules substantially revised the risk-based capital requirements applicable to bank holding companies and depository institutions, including the Company and the Bank, compared to the previous U.S. Basel I risk-based capital rules. The Capital Rules define the components of capital and address other issues in banking institutions regulatory capital ratios and replace the Basel I risk-weighting approach, with a more risk-sensitive one, based in part, on the standardized approach set forth in “Basel II”. The Capital Rules also implement the requirements of Section 939A of the Dodd-Frank Act to remove references to credit ratings from the Federal banking agencies’ rules.

The Capital Rules, among other things: (i) introduces as a capital measure “Common Equity Tier 1,” (“CET1”), (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting specified revised requirements, (iii) defines CET1 narrowly by requiring that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital, and (iv) expands the scope of the deductions from and adjustments to capital as compared to existing regulations. Under the Capital Rules, the most common form of Additional Tier 1 capital is non-cumulative perpetual preferred stock, and the most common form of Tier 2 capital is subordinated notes and a portion of the allowance for credit losses, in each case, subject to the Capital Rules specific requirements.

Under the Capital Rules, the minimum capital ratios as of January 1, 2016 are as follows:

● 4.5% CET1 to total risk-weighted assets;

● 6.0% Tier 1 capital (CET1 plus Additional Tier 1 capital) to total risk-weighted assets;

● 8.0% Total capital (Tier 1 Capital plus Tier 2 capital) to total risk-weighted assets;

● 4.0% Tier 1 capital to total adjusted quarterly average assets (known as “leverage ratio”)

Beginning in 2016, the Capital Rules required the Company and the Bank to maintain a “capital conservation buffer” composed entirely of CET1. When it was fully phased-in at the beginning of 2019, banking organizations were required to maintain a minimum capital conservation buffer of 2.5% (CET1 to Total risk-weighted assets), in addition to the minimum risk-based capital ratios. Therefore, to satisfy both the minimum risk-based capital ratios and the capital conservation buffer, a banking organization is required to maintain the following: (i) CET1 to total risk-weighted assets of at least 7%, (ii) Tier 1 capital to total risk-weighted assets of at least 8.5%, and (iii) Total capital (Tier 1 capital plus Tier 2 capital) to total risk-weighted assets of at least 10.5%. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions that do not maintain a capital conservation buffer of 2.5% or more will face constraints on dividends, common share repurchases and incentive compensation based on the amount of the shortfall.

The Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, deferred tax assets dependent upon future taxable income and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. Under the Capital Rules, the effects of certain accumulated other comprehensive income or loss items are not excluded for the purposes of determining regulatory capital; however, banks not using the advanced approach, including the Company and the Bank, were permitted to, and in the case of the Company and the Bank they did, make a one-time permanent election to continue to exclude these items.

Table of Contents

Consistent with Section 171 of the Dodd-Frank Act, the Capital Rules allow certain bank holding companies to include certain hybrid securities, such as trust preferred securities, in Tier 1 capital if they had less than $15 billion in assets as of December 31, 2009 and the securities were issued before May 19, 2010. Accordingly, the trust preferred securities on the Company’s balance sheet will be included as Tier 1 capital while they are outstanding, unless the Company completes an acquisition of a depository institution holding company that did not meet this criteria, or are acquired by such an organization, after January 1, 2014, at which time they would be subject to the stated phase-out requirements of the Capital Rules and would be included as Tier 2 capital.

Implementation of the deductions and other adjustments to CET1 began on January 1, 2015 and were phased-in over a 4-year period (beginning at 40% on January 1, 2015 and an additional 20% per year thereafter). The implementation of the capital conservation buffer began on January 1, 2016 at the 0.625% level and was phased in over a four-year period (increasing by that amount on each subsequent January 1, until it reached 2.5% on January 1, 2019).

With respect to the Bank, the Capital Rules also revised the prompt corrective action (“PCA”) regulations established pursuant to Section 38 of the Federal Deposit Insurance Act, by (i) introducing a CET1 ratio requirement for each capital category other than critically undercapitalized, with the required CET1 ratio being 6.5% for well-capitalized status; (ii) increasing the minimum Tier 1 capital ratio requirement for each capital category, with the minimum Tier 1 capital ratio for well-capitalized status being 8.0%; and (iii) eliminating the current provision that allows certain highly-rated banking organizations to maintain a 3.0% leverage ratio and still be adequately capitalized. The Capital Rules do not change the Total risk-based PCA capital requirement for any capital category.

The Capital Rules prescribe a standardized approach for risk weighted-assets that expands the risk-weight categories from the four Basel I-derived categories (0%, 20%, 50% and 100%) to a larger and more risk-sensitive number of categories, depending on the nature of the asset. The risk-weight categories generally range from 0% for U.S. government and agency securities, to 1,250% for certain securitized exposures, and result in higher risk weights for a variety of asset categories. The standardized approach requires financial institutions to transition assets that are 90 days or more past due or on nonaccrual from their original risk weight to 150 percent. Additionally, loans designated as high volatility commercial real estate (“HVCRE”) are assigned a risk-weighting of 150 percent.

Requirements to maintain higher levels of capital or to maintain higher levels of liquid assets could adversely impact the Company’s net income and return on equity. The current requirements and the Company’s actual capital levels are detailed in Note P of “Notes to Consolidated Financial Statements” filed in Part II, Item 8, “Financial Statements and Supplementary Data.”

Consumer Protection Laws

In connection with its banking activities, the Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending to various sectors of the economy. These laws include but are not limited to the Equal Credit Opportunity Act, the Gramm-Leach-Bliley Act (“GLB Act”), the Fair Credit Reporting Act (“FCRA”), the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”), Electronic Funds Transfer Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Dodd-Frank Act, the Real Estate Settlement Procedures Act, the Secure and Fair Enforcement for Mortgage Licensing Act (“SAFE”), the Servicemembers Civil Relief Act (“SCRA”), the Military Lending Act (“MLA”), and various state law counterparts.

The Dodd-Frank Act created the CFPB with broad powers to supervise and enforce consumer protection laws, including laws that apply to banks in order to prohibit unfair, deceptive or abusive acts or practices. The CFPB has examination authority over all banks and savings institutions with more than $10 billion in assets. The Dodd-Frank Act also weakens the federal preemption rules that are applicable to national banks and gives attorney generals for the states certain powers to enforce federal consumer protection laws. Further, under the Dodd-Frank Act, it is unlawful for any provider of consumer financial products or services to engage in any unfair, deceptive, or abusive acts or practices (“UDAAP”). A violation of the consumer protection and privacy laws, and in particular UDAAP, could have serious legal, financial, and reputational consequences.

Table of Contents

The GLB Act requires all financial institutions to adopt privacy policies, restrict the sharing of nonpublic customer data with nonaffiliated parties and establishes procedures and practices to protect customer data from unauthorized access. In addition, the FCRA, as amended by the FACT Act, includes provisions affecting the Company, the Bank, and their affiliates, including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. The FACT Act requires persons subject to FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the Federal Trade Commission have extensive rulemaking authority under the FACT Act, and the Company and the Bank are subject to the rules that have been created under the FACT Act, including rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate certain identity theft red flags. The SCRA protects persons called to active military service and their dependents from undue hardship resulting from their military service, and the MLA extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The SCRA applies to all debts incurred prior to the commencement of active duty and limits the amount of interest, including service and renewal charges and any other fees or charges (other than bona fide insurance) that are related to the obligation or liability. The MLA applies to certain consumer loans and extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The Bank is also subject to data security standards and data breach notice requirements issued by the OCC and other regulatory agencies. The Bank has created policies and procedures to comply with these consumer protection requirements.

The CFPB issued the final rules implementing the ability-to-repay and qualified mortgage (QM) provisions of the Truth in Lending Act (the “QM Rule”). The ability-to-repay provision requires creditors to make reasonable, good faith determinations that borrowers are able to repay their mortgages before extending credit based on a number of factors and consideration of financial information about the borrower derived from reasonably reliable third-party documents. Under the Dodd-Frank Act and the QM Rule, loans meeting the definition of “qualified mortgage” are entitled to a presumption that the lender satisfied the ability-to-repay requirements. The presumption is a conclusive presumption/safe harbor for loans meeting the QM requirements, and a rebuttable presumption for higher-priced loans meeting the QM requirements. The definition of a “qualified mortgage” incorporates the statutory requirements, such as not allowing negative amortization or terms longer than 30 years. The QM Rule also adds an explicit maximum 43% debt-to-income ratio for borrowers if the loan is to meet the QM definition, though some mortgages that meet government-sponsored enterprises, Federal Housing Administration, and Veterans Administration underwriting guidelines may, for a period not to exceed seven years, meet the QM definition without being subject to the 43% debt-to-income limits. The Bank has created policies and procedures to comply with these consumer protection requirements.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The USA Patriot Act also encourages information-sharing among financial institutions, regulators, and law enforcement authorities by providing an exemption from the privacy provisions of the GLB Act for financial institutions that comply with the provision of the Act. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the institution. The Company has approved policies and procedures that are designed to comply with the USA Patriot Act and its regulations.

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others administrated by the Treasury’s Office of Foreign Assets Control (“OFAC”). The OFAC administered sanctions can take many different forms; however, they generally contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, entity or individual, including prohibitions against direct or indirect imports and exports and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments, or providing investment related advice or assistance; and (ii) a blocking of assets in which the government or specially designated nationals have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences.

Table of Contents

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934, as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) new requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) additional responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) the creation of an independent accounting oversight board for the accounting industry; (iv) new standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on non-preferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violations of the securities laws.

Electronic Fund Transfer Act

Among other provisions, the federal banking rule under the Electronic Fund Transfer Act prohibits financial institutions from charging consumers fees for paying overdrafts on automated teller machines and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions. The rule does not govern overdraft fees on the payment of checks and certain other forms of bill payments.

Community Reinvestment Act of 1977

Under the CRA, the Bank is required to help meet the credit needs of its communities, including low- and moderate-income neighborhoods. Although the Bank must follow the requirements of CRA, it does not limit the Bank’s discretion to develop products and services that are suitable for a particular community or establish lending requirements or programs. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibits discrimination in lending practices. The Bank’s failure to comply with the provisions of the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s failure to comply with the Equal Credit Opportunity Act and the Fair Housing Act could result in enforcement actions against it by its regulators as well as other federal regulatory agencies and the Department of Justice. The Bank’s latest CRA rating was “Satisfactory”.

The Bank Secrecy Act

The Bank Secrecy Act (“BSA”) requires all financial institutions, including banks and securities broker-dealers, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. The BSA includes a variety of recordkeeping and reporting requirements (such as currency transaction and suspicious activity reporting), as well as due diligence/know-your-customer documentation requirements. The Company has established a bank secrecy act /anti-money laundering program and taken other appropriate measures in order to comply with BSA requirements.

Community Bank System, Inc. (the “Company”) was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company is a registered financial holding company which wholly-owns two significant subsidiaries: Community Bank, N.A. (the “Bank” or “CBNA”), and Benefit Plans Administrative Services, Inc. (“BPAS”). As of December 31, 2019, BPAS owns five subsidiaries: Benefit Plans Administrative Services, LLC (“BPA”), a provider of defined contribution plan administration services; Northeast Retirement Services, LLC (“NRS”), a provider of institutional transfer agency, master recordkeeping services, fund administration, trust and retirement plan services; BPAS Actuarial & Pension Services, LLC (“BPAS-APS”), a provider of actuarial and benefit consulting services; BPAS Trust Company of Puerto Rico, a Puerto Rican trust company; and Hand Benefits & Trust Company (“HB&T”), a provider of collective investment fund administration and institutional trust services. NRS owns one subsidiary, Global Trust Company, Inc. (“GTC”), a non-depository trust company which provides fiduciary services for collective investment trusts and other products. HB&T owns one subsidiary, Hand Securities, Inc. (“HSI”), an introducing broker-dealer. The Company also sponsors one unconsolidated subsidiary business trust formed for the purpose of issuing mandatorily-redeemable preferred securities which are considered Tier I capital under regulatory capital adequacy guidelines.

The Bank’s business philosophy is to operate as a diversified financial services enterprise providing a broad array of banking and other financial services to retail, commercial and municipal customers. As of December 31, 2019, the Bank operates 231 full-service branches operating as Community Bank, N.A. throughout 40 counties of Upstate New York, six counties of Northeastern Pennsylvania, 12 counties of Vermont and one county of Western Massachusetts, offering a range of commercial and retail banking services. The Bank owns the following operating subsidiaries: The Carta Group, Inc. (“Carta Group”), CBNA Preferred Funding Corporation (“PFC”), CBNA Treasury Management Corporation (“TMC”), Community Investment Services, Inc. (“CISI”), NOTCH Investment Fund, LLC (“NOTCH”), Nottingham Advisors, Inc. (“Nottingham”), OneGroup NY, Inc. (“OneGroup”), and Oneida Preferred Funding II LLC (“OPFC II”). OneGroup is a full-service insurance agency offering personal and commercial property insurance and other risk management products and services. NOTCH, PFC and OPFC II primarily act as investors in residential and commercial real estate activities. TMC provides cash management, investment, and treasury services to the Bank. CISI and Carta Group provide broker-dealer and investment advisory services. Nottingham provides asset management services to individuals, corporations, corporate pension and profit sharing plans, and foundations.

The Company maintains a website at cbna.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information posted on the website is not incorporated into or a part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at https://www.sec.gov.

Acquisition History (2015-2019)

Steuben Trust Corporation - Pending Acquisition

On October 21, 2019, the Company announced that it had entered into a definitive agreement to acquire Steuben Trust Corporation (“Steuben”), parent company of Steuben Trust Company, a New York State chartered bank headquartered in Hornell, New York, for approximately $104.4 million in Company stock and cash. Steuben currently operates 14 branch locations in Western New York. The acquisition will extend the Company’s footprint into two new counties in Western New York State and enhance the Company’s presence in four Western New York State counties in which it currently operates. The acquisition is expected to close during the second quarter of 2020, pending both customary regulatory and Steuben shareholder approval. The Company expects to incur certain one-time, transaction-related costs in 2020 in connection with the Steuben acquisition.

Financial Services Practice – Syracuse, NY

On September 18, 2019, the Company, through its subsidiary, CISI, completed its acquisition of certain assets of a practice engaged in the financial services business headquartered in Syracuse, New York. The Company paid $0.5 million in cash to acquire a customer list, and recorded a $0.5 million customer list intangible asset in conjunction with the acquisition.

Table of Contents

Kinderhook Bank Corp.

On July 12, 2019, the Company completed its merger with Kinderhook Bank Corp. (“Kinderhook”), parent company of The National Union Bank of Kinderhook, headquartered in Kinderhook, New York, for $93.4 million in cash. The merger added 11 branch locations across a five county area in the Capital District of Upstate New York. The merger resulted in the acquisition of $642.8 million of assets, including $479.9 million of loans and $39.8 million of investment securities, as well as $568.2 million of deposits and $40.3 million in goodwill.

Wealth Resources Network, Inc.

On January 2, 2019, the Company, through its subsidiary, CISI, completed its acquisition of certain assets of Wealth Resources Network, Inc. (“Wealth Resources”), a financial services business headquartered in Liverpool, New York. The Company paid $1.2 million in cash to acquire a customer list from Wealth Resources, and recorded a $1.2 million customer list intangible asset in conjunction with the acquisition.

HR Consultants, LLC

On April 2, 2018, the Company, through its subsidiary, BPAS, acquired certain assets of HR Consultants (SA), LLC (“HR Consultants”), a provider of actuarial and benefit consulting services headquartered in Puerto Rico. The Company paid $0.3 million in cash to acquire the assets of HR Consultants and recorded intangible assets of $0.3 million in conjunction with the acquisition.

Penna & Associates Agency, Inc.

On January 2, 2018, the Company, through its subsidiary, OneGroup, completed its acquisition of certain assets of Penna & Associates Agency, Inc. (“Penna”), an insurance agency headquartered in Johnson City, New York. The Company paid $0.8 million in cash to acquire the assets of Penna, and recorded goodwill in the amount of $0.3 million and a customer list intangible asset of $0.3 million in conjunction with the acquisition.

Styles Bridges Associates

On January 2, 2018, the Company, through its subsidiary, CISI, completed its acquisition of certain assets of Styles Bridges Associates (“Styles Bridges”), a financial services business headquartered in Canton, New York. The Company paid $0.7 million in cash to acquire a customer list from Styles Bridges, and recorded a $0.7 million customer list intangible asset in conjunction with the acquisition.

Gordon B. Roberts Agency, Inc.

On December 4, 2017, the Company, through its subsidiary, OneGroup, completed its acquisition of Gordon B. Roberts Agency, Inc. (“GBR”), an insurance agency headquartered in Oneonta, New York for $3.7 million in Company stock and cash, comprised of $1.35 million in cash and the issuance of 0.04 million shares of common stock. The transaction resulted in the acquisition of $0.6 million of assets, $0.6 million of other liabilities, goodwill in the amount of $2.1 million and other intangible assets of $1.6 million.

Northeast Capital Management, Inc.

On November 17, 2017, the Company, through its subsidiary, CISI, completed its acquisition of certain assets of Northeast Capital Management, Inc. (“NECM”), a financial services business headquartered in Wilkes-Barre, Pennsylvania. The Company paid $1.2 million in cash to acquire a customer list from NECM, and recorded a $1.2 million customer list intangible asset in conjunction with the acquisition.

Merchants Bancshares, Inc.

On May 12, 2017, the Company completed its acquisition of Merchants Bancshares, Inc. (“Merchants”), parent company of Merchants Bank headquartered in South Burlington, Vermont, for $345.2 million in Company stock and cash, comprised of $82.9 million in cash and the issuance of 4.68 million shares of common stock. The acquisition extended the Company’s footprint into the Vermont and Western Massachusetts markets with the addition of 31 branch locations in Vermont and one location in Massachusetts. This transaction resulted in the acquisition of $2.0 billion of assets, including $1.49 billion of loans and $370.6 million of investment securities, as well as $1.45 billion of deposits and $189.0 million in goodwill.

Dryfoos Insurance Agency, Inc.

On March 1, 2017, the Company, through its subsidiary, OneGroup, completed its acquisition of certain assets of Dryfoos Insurance Agency, Inc. (“Dryfoos”), an insurance agency headquartered in Hazleton, Pennsylvania. The Company paid $3.0 million in cash to acquire the assets of Dryfoos, and recorded goodwill in the amount of $1.7 million and other intangible assets of $1.7 million in conjunction with the acquisition.

Table of Contents

Northeast Retirement Services, Inc.

On February 3, 2017, the Company completed its acquisition of NRS and its subsidiary GTC, headquartered in Woburn, Massachusetts, for $148.6 million in Company stock and cash. NRS was a privately held corporation focused on providing institutional transfer agency, master recordkeeping services, custom target date fund administration, trust product administration and customized reporting services to institutional clients. Its wholly-owned subsidiary, GTC, is chartered in the State of Maine as a non-depository trust company and provides fiduciary services for collective investment trusts and other products. The acquisition of NRS and GTC, hereafter referred to collectively as NRS, strengthens and complements the Company’s existing employee benefit services businesses. Upon the completion of the merger, NRS became a wholly-owned subsidiary of BPAS and operates as Northeast Retirement Services, LLC, a Delaware limited liability company. This transaction resulted in the acquisition of $36.1 million in net tangible assets, principally cash and certificates of deposit, $60.2 million in customer list intangibles that will be amortized over 10 years, the creation of a $23.0 million deferred tax liability associated with the customer list intangible and $75.3 million in goodwill.

Benefits Advisory Service, Inc.

On January 1, 2017, the Company, through its subsidiary, OneGroup, acquired certain assets of Benefits Advisory Service, Inc. (“BAS”), a benefits consulting group headquartered in Forest Hills, New York. The Company paid $1.2 million in cash to acquire the assets of BAS and recorded intangible assets of $1.2 million in conjunction with the acquisition.

WJL Agencies, Inc.

On January 4, 2016, the Company, through its subsidiary, CBNA Insurance Agency, Inc., completed its acquisition of WJL Agencies, Inc. doing business as The Clark Insurance Agencies (“WJL”), an insurance agency operating in Canton, New York. The Company paid $0.6 million in cash for the intangible assets of the company. Goodwill in the amount of $0.3 million and intangible assets in the amount of $0.3 million were recorded in conjunction with the acquisition. On August 19, 2016, the Company merged together its insurance subsidiaries and as of that date, CBNA Insurance Agency, Inc. was merged into OneGroup.

Oneida Financial Corp.

On December 4, 2015, the Company completed its acquisition of Oneida Financial Corp. (“Oneida”), parent company of Oneida Savings Bank, headquartered in Oneida, New York for $158.5 million in Company stock and cash, comprised of $56.3 million of cash and the issuance of 2.38 million common shares. Upon the completion of the merger, the Bank added 12 branch locations in Oneida and Madison counties and approximately $769.4 million of assets, including approximately $399.4 million of loans and $225.7 million of investment securities, along with $699.2 million of deposits. Through the acquisition of Oneida, the Company acquired OneGroup and Oneida Wealth Management, Inc. (“OWM”) as wholly-owned subsidiaries primarily engaged in offering insurance and investment advisory services. These subsidiaries complement the Company’s other non-banking financial services businesses. On April 22, 2016, the activities of OWM were merged into CISI.

Services

Banking

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank's branches are generally located in smaller towns and cities within its geographic market areas of Upstate New York, Northeastern Pennsylvania, Vermont and Western Massachusetts. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch and regional levels, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System, the Federal Home Loan Bank of New York and the Federal Home Loan Bank of Boston (as a non-member bank) (collectively, referred to as “FHLB”), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Employee Benefit Services

Through BPAS and its subsidiaries, the Company operates a national practice that provides employee benefit trust, collective investment fund, retirement plan administration, fund administration, transfer agency, actuarial, VEBA/HRA and health and welfare consulting services to a diverse array of clients spanning the United States and Puerto Rico.

Wealth Management

Through the Bank, its trust department, CISI, Carta Group, and Nottingham, the Company provides wealth management, retirement planning, higher educational planning, fiduciary, risk management, trust services and personal financial planning services. The Company offers investment alternatives including stocks, bonds, mutual funds and advisory products.

Table of Contents

Insurance Agency

Through OneGroup, the Company offers personal and commercial lines of insurance and other risk management products and services. In addition, OneGroup offers employee benefit related services. OneGroup represents many leading insurance companies.

Segment Information

The Company has identified three reportable operating business segments: Banking, Employee Benefit Services, and All Other. Included in the All Other segment are the smaller Wealth Management and Insurance operations. Information about the Company’s reportable business segments is included in Note U of the “Notes to Consolidated Financial Statements” filed herewith in Part II.

Competition

The banking and financial services industry is highly competitive in the New York, Pennsylvania, Vermont and Massachusetts markets. The Company competes actively for loans, deposits, and financial services relationships with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, insurance agencies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The Company’s employee benefit trust and plan administration business competes on a national scale and provides geographic diversification for the Company. Certain lines of business are marketed primarily through unaffiliated financial advisors, while others are marketed directly to plan sponsors and fund companies. In order to compete with large national firms, the Company stresses its consultative approach to complex engagements.

The table below summarizes the Bank’s deposits and market share by the fifty-four counties of New York, Pennsylvania, Vermont, and Massachusetts in which it had customer facilities as of June 30, 2019. Market share is based on deposits of all commercial banks, credit unions, savings and loan associations, and savings banks.

Table of Contents

Number of County State Deposits as of 6/30/2019(1)(000's omitted) Market Share(1) Branches ATM's Towns/Cities Towns Where Company Has 1stor 2nd Market Position Grand Isle VT $ 38,229 100.00 % 1 1 1 1 Lewis NY 193,316 70.95 % 4 4 3 3 Hamilton NY 59,183 55.92 % 2 2 2 2 Franklin NY 351,577 55.63 % 6 6 5 5 Madison NY 399,052 47.14 % 8 8 5 5 Allegany NY 301,879 44.05 % 9 10 8 8 Cattaraugus NY 560,348 37.78 % 10 11 7 6 Otsego NY 343,793 29.45 % 10 10 6 5 Seneca NY 128,869 25.54 % 4 3 4 3 Saint Lawrence NY 458,019 24.42 % 13 12 11 10 Schuyler NY 53,512 22.95 % 1 1 1 1 Yates NY 96,230 22.53 % 3 2 2 1 Wyoming PA 146,007 21.37 % 4 4 4 3 Clinton NY 363,824 21.35 % 4 7 2 2 Jefferson NY 404,712 21.27 % 7 9 6 5 Chautauqua NY 397,076 19.54 % 12 12 10 6 Livingston NY 199,581 19.18 % 5 6 5 4 Essex NY 126,558 14.83 % 5 5 4 3 Orange VT 48,712 14.08 % 2 2 2 2 Oswego NY 195,433 12.56 % 4 5 4 2 Wayne NY 134,571 10.81 % 3 4 2 2 Ontario NY 241,373 9.92 % 7 13 5 3 Caledonia VT 64,197 9.70 % 2 2 2 1 Bennington VT 77,325 9.12 % 2 4 2 0 Addison VT 56,928 9.11 % 2 2 2 1 Delaware NY 128,095 8.65 % 5 5 5 4 Tioga NY 38,709 8.31 % 2 2 2 1 Chittenden VT 515,512 7.50 % 9 10 6 4 Rutland VT 106,041 7.32 % 3 4 2 1 Franklin VT 47,188 7.30 % 2 2 2 1 Herkimer NY 53,224 6.76 % 1 1 1 1 Lackawanna PA 394,431 6.54 % 11 11 8 4 Luzerne PA 449,879 6.54 % 10 14 8 4 Susquehanna PA 59,522 6.44 % 2 1 2 1 Steuben NY 190,635 6.04 % 8 8 7 3 Chemung NY 66,162 5.85 % 2 2 1 0 Lamoille VT 29,036 4.55 % 1 1 1 1 Windham VT 47,329 4.47 % 2 3 2 1 Schoharie NY 21,490 4.38 % 1 1 1 0 Carbon PA 42,891 4.30 % 2 2 2 0 Oneida NY 251,953 3.99 % 6 8 5 3 Windsor VT 53,160 3.83 % 2 2 2 0 Cayuga NY 44,746 3.79 % 2 2 2 1 Washington VT 87,015 3.37 % 3 4 3 1 Bradford PA 38,945 3.00 % 2 2 2 1 Washington NY 20,951 2.80 % 1 0 1 1 Chenango NY 23,990 2.29 % 2 2 1 0 Onondaga NY 278,350 2.13 % 4 5 4 1 Warren NY 36,971 1.78 % 1 1 1 1 Ulster NY 27,662 0.63 % 1 1 1 1 Broome NY 26,928 0.42 % 1 1 1 0 Erie NY 145,933 0.32 % 4 4 3 2 Hampden MA 31,703 0.25 % 1 1 1 0 Tompkins NY 5,387 0.17 % 1 0 1 0 $ 8,704,142 5.49 % 222 245 183 122

(1) Deposits and Market Share data as of June 30, 2019, the most recent information available from SNL Financial LLC. Deposit amounts include $215.9 million of intercompany balances that are eliminated upon consolidation.

Table of Contents

Employees

As of December 31, 2019, the Company employed 2,752 full-time employees and 286 part-time and temporary employees. None of the Company’s employees are represented by a collective bargaining agreement. The Company offers a variety of employment benefits and considers its relationship with its employees to be good.

Supervision and Regulation

General

The banking industry is highly regulated with numerous statutory and regulatory requirements that are designed primarily for the protection of depositors and the financial system, and not for the purpose of protecting shareholders. Set forth below is a description of the material laws and regulations applicable to the Company and the Bank. This summary is not complete and the reader should refer to these laws and regulations for more detailed information. The Company’s and the Bank’s failure to comply with applicable laws and regulations could result in a range of sanctions and administrative actions imposed upon the Company and/or the Bank, including the imposition of civil money penalties, formal agreements and cease and desist orders. Changes in applicable law or regulations, and in their interpretation and application by regulatory agencies, cannot be predicted, and may have a material effect on the Company’s business and results.

The Company and its subsidiaries are subject to the laws and regulations of the federal government and the states and jurisdictions in which they conduct business. The Company, as a bank holding company, is subject to extensive regulation, supervision and examination by the Board of Governors of the Federal Reserve System (“FRB”) as its primary federal regulator. The Bank is a nationally-chartered bank and is subject to extensive regulation, supervision and examination by the Office of the Comptroller of the Currency (“OCC”) as its primary federal regulator, and as to certain matters, the FRB, the Consumer Financial Protection Bureau (“CFPB”), and the Federal Deposit Insurance Corporation (“FDIC”).

The Company is also subject to the jurisdiction of the SEC and is subject to disclosure and regulatory requirements under the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended. The Company’s common stock is listed on the New York Stock Exchange (“NYSE”) and it is subject to NYSE’s rules for listed companies. Affiliated entities, including BPAS, GTC, HB&T, HSI, BPAS Trust Company of Puerto Rico, Nottingham, CISI, OneGroup, and Carta Group are subject to the jurisdiction of certain state and federal regulators and self-regulatory organizations including, but not limited to, the SEC, the Texas Department of Banking, the State of Maine Bureau of Financial Institutions, the Financial Industry Regulatory Authority (“FINRA”), Puerto Rico Office of the Commissioner of Financial Institutions, and state securities and insurance regulators.

Federal Bank Holding Company Regulation

The Company was a bank holding company under the Bank Holding Company Act of 1956, (the “BHC Act”), and became a financial holding company effective September 30, 2015. As a bank holding company that has elected to become a financial holding company, the Company can affiliate with securities firms and insurance companies and engage in other activities that are “financial in nature” or “incidental” or “complementary” to activities that are financial in nature, as long as it continues to meet the eligibility requirements for financial holding companies (including requirements that the financial holding company and its depository institution subsidiary maintain their status as “well capitalized” and “well managed”).

Generally, FRB approval is not required for the Company to acquire a company (other than a bank holding company, bank or savings association) engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the FRB. Prior notice to the FRB may be required, however, if the company to be acquired has total consolidated assets of $10 billion or more. Prior FRB approval is required before the Company may acquire the beneficial ownership or control of more than 5% of the voting shares or substantially all of the assets of a bank holding company, bank or savings association.

Because the Company is a financial holding company, if the Bank were to receive a rating under the Community Reinvestment Act of 1977, as amended (“CRA”), of less than Satisfactory, the Company will be prohibited, until the rating is raised to Satisfactory or better, from engaging in new activities or acquiring companies other than bank holding companies, banks or savings associations, except that the Company could engage in new activities, or acquire companies engaged in activities, that are considered “closely related to banking” under the BHC Act. In addition, if the FRB determines that the Company or the Bank is not well capitalized or well managed, the Company would be required to enter into an agreement with the FRB to comply with all applicable capital and management requirements and may contain additional limitations or conditions. Until corrected, the Company could be prohibited from engaging in any new activity or acquiring companies engaged in activities that are not closely related to banking, absent prior FRB approval.

Table of Contents

Federal Reserve System Regulation

Because the Company is a financial holding company, it is subject to regulatory capital requirements and required by the FRB to, among other things, maintain cash reserves against its deposits. The Bank is under similar capital requirements administered by the OCC as discussed below. FRB policy has historically required a financial holding company to act as a source of financial and managerial strength to its subsidiary banks. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) codifies this historical policy as a statutory requirement. To the extent the Bank is in need of capital, the Company could be expected to provide additional capital, including borrowings from the FRB for such purpose. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors’ funds.

The FRB also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the FRB, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust our strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond our control.

The Office of the Comptroller of the Currency Regulation

The Bank is supervised and regularly examined by the OCC. The various laws and regulations administered by the OCC affect the Company’s practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects the Bank’s business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and the location of its offices. The OCC generally prohibits a depository institution from making any capital distributions, including the payment of a dividend, or paying any management fee to its parent holding company if the depository institution would become undercapitalized due to the payment. Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the OCC. The Bank is well capitalized under regulatory standards administered by the OCC. For additional information on our capital requirements see “Management’s Discussion and Analysis of Financial Condition and Results of Operations – Shareholders’ Equity” and Note P to the Financial Statements.

Federal Home Loan Bank

The Bank is a member of the FHLB, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to the rules and requirements of the FHLB, including the purchase of shares of FHLB activity-based stock in the amount of 4.5% of the dollar amount of outstanding advances and FHLB capital stock in an amount equal to the greater of $1,000 or the sum of 0.15% of the mortgage-related assets held by the Bank based upon the previous year-end financial information. The Bank was in compliance with the rules and requirements of the FHLB at December 31, 2019.

Deposit Insurance

Deposits of the Bank are insured up to the applicable limits by the Deposit Insurance Fund (“DIF”) and are subject to deposit insurance assessments to maintain the DIF. The Dodd-Frank Act permanently increased the maximum amount of deposit insurance to $250,000 per deposit category, per depositor, per institution. A depository institution’s DIF assessment is calculated by multiplying its assessment rate by the assessment base, which is defined as the average consolidated total assets less the average tangible equity of the depository institution. The initial base assessment rate is based on its capital level and supervisory ratings (its “CAMELS ratings”), certain financial measures to assess an institution’s ability to withstand asset related stress and funding related stress and, in some cases, additional discretionary adjustments by the FDIC to reflect additional risk factors. The Bank’s adjusted average consolidated total assets for 4 consecutive quarters exceeded $10.0 billion in 2018, which resulted in a deposit insurance assessment based on a large institution classification, rather than the small institution classification for years prior to 2018.

For large insured depository institutions, generally defined as those with at least $10 billion in total assets, the FDIC has eliminated risk categories when calculating the initial base assessment rates and now combine CAMELS ratings and financial measures into two scorecards to calculate assessment rates, one for most large insured depository institutions and another for highly complex insured depository institutions (which are generally those with more than $50 billion in total assets that are controlled by a parent company with more than $500 billion in total assets). Each scorecard has two components - a performance score and loss severity score, which are combined and converted to an initial assessment rate. The FDIC has the ability to adjust a large or highly complex insured depository institution’s total score by a maximum of 15 points, up or down, based upon significant risk factors that are not captured by the scorecard. Under the current assessment rate schedule, the initial base assessment rate for large and highly complex insured depository institutions ranges from three to 30 basis points, and the total base assessment rate, after applying the unsecured debt and brokered deposit adjustments, ranges from one and one-half to 40 basis points. The Bank’s FDIC insurance for 2019 was based on an assessment rate of three basis points.

Table of Contents

In October 2010, the FDIC adopted a DIF restoration plan to ensure that the fund reserve ratio reached 1.35% by September 30, 2020, as required by the Dodd-Frank Act. In September 2018, the DIF reserve ratio reached 1.36%, exceeding the required reserve ratio of 1.35% ahead of the September 30, 2020 deadline. Since the DIF reserve ratio remained above 1.35% in 2019, the Bank was permitted to offset its FDIC insurance assessments in 2019 with Small Bank Assessment Credits issued by the FDIC in January 2019. The Bank offset $1.5 million of FDIC insurance assessments in 2019 with Small Bank Assessment Credits. FDIC insurance expense net of Small Bank Assessment Credits in 2019 totaled $1.4 million, compared to $3.2 million in 2018 and $3.5 million in 2017.

Under the Federal Deposit Insurance Act, if the FDIC finds that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, the FDIC may determine that such violation or unsafe or unsound practice or condition require the termination of deposit insurance.

Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

On July 21, 2010, the Dodd-Frank Act was signed into law, which resulted in significant changes to the banking industry. As discussed further throughout this section, certain aspects of the Dodd-Frank Act are subject to implementing rules that have been taking effect over several years.

The Dodd-Frank Act contains numerous provisions that affect all banks and bank holding companies and impacts how the Company and the Bank handle their operations. The Dodd-Frank Act requires various federal agencies, including those that regulate the Company and the Bank, to promulgate new rules and regulations and to conduct various studies and reports for Congress. The federal agencies have either completed or are in the process of completing these rules and regulations and have been given significant discretion in drafting such rules and regulations. Several of the provisions of the Dodd-Frank Act may have the consequence of increasing the Bank’s expenses, decreasing its revenues, and changing the activities in which it chooses to engage. The specific impact of the Dodd-Frank Act on the Company’s current activities or new financial activities the Company may consider in the future, the Company’s financial performance, and the markets in which the Company operates depends on the manner in which the relevant agencies continue to develop and implement the required rules and regulations and the reaction of market participants to these regulatory developments.

Pursuant to FRB regulations mandated by the Dodd-Frank Act, interchange fees on debit card transactions are limited to a maximum of $0.21 per transaction plus 5 basis points of the transaction amount. A debit card issuer may recover an additional one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements prescribed by the FRB. The FRB also adopted requirements in the final rule that issuers include two unaffiliated networks for routing debit transactions that are applicable to the Company and the Bank. The Company became subject to the interchange fee cap mandated by the Dodd-Frank Act beginning on July 1, 2018. As such, the fees the Company received on and after July 1, 2018 for an electronic debit transaction were capped at the statutory limit. Prior to July 1, 2018, the Company was exempt from the interchange fee cap under the "small issuer" exemption, which applies to any debit card issuer with total worldwide assets (including those of its affiliates) of less than $10 billion as of the end of the previous calendar year.

The Dodd-Frank Act established the CFPB and empowered it to exercise broad rulemaking, supervision, and enforcement authority for a wide range of consumer protection laws. Since the Company’s total consolidated assets exceed $10 billion the Company is subject to the direct supervision of the CFPB. The CFPB has issued numerous regulations and amendments under which the Company and the Bank may continue to incur additional expense in connection with its ongoing compliance obligations. Significant recent CFPB developments that may affect operations and compliance costs include:

• positions taken by the CFPB on fair lending, including applying the disparate impact theory which could make it more difficult for lenders to charge different rates or to apply different terms to loans to different customers;

• the CFPB’s final rule amending Regulation C, which implements the Home Mortgage Disclosure Act, requiring most lenders to report expanded information in order for the CFPB to more effectively monitor fair lending concerns and other information shortcomings identified by the CFPB;

• positions taken by the CFPB regarding the Electronic Fund Transfer Act and Regulation E, which require companies to obtain customer authorizations before automatically debiting a consumer’s account for pre-authorized electronic funds transfers; and

• focused efforts on enforcing certain compliance obligations the CFPB deems a priority, such as automobile loan servicing, debt collection, mortgage origination and servicing, remittances, and fair lending, among others.

The final rules issued by the FRB, SEC, OCC, FDIC, and Commodity Futures Trading Commission implementing Section 619 of the Dodd-Frank Act (commonly known as the Volcker Rule) prohibit insured depository institutions and companies affiliated with insured depository institutions from engaging in short-term proprietary trading of certain securities, derivatives, commodity futures and options on these instruments, for their own account. The final rules also impose limits on banking entities’ investments in, and other relationships with, hedge funds or private equity funds.

Table of Contents

As of October 2019, the five federal agencies identified above with rulemaking authority with respect to the Volcker Rule finalized amendments to the proprietary trading provisions of the Volcker Rule. These amendments tailor the Volcker Rule’s compliance requirements to the amount of a firm’s trading activity, revise the definition of trading account, clarify certain key provisions in the Volcker Rule, and modify the information companies are required to provide the federal agencies. These amendments to the Volcker Rule are not material to the Company’s investing and trading activities.

On January 30, 2020, the five federal agencies proposed additional amendments to the Volcker Rule related to the restrictions on ownership interests and relationships with covered funds. The ultimate benefits or consequences of these amendments will depend on their final form, which the Company cannot predict.

In May of 2018, the Economic Growth, Regulatory Relief, and Consumer Protection Act (“Economic Growth Act”) was enacted to amend the Dodd-Frank Act and modify certain post-crisis regulatory requirements, including a variety of provisions intended to promote economic growth, provide tailored regulatory relief for smaller and less complex financial institutions, and enhance consumer protections. Among other things, the law raised the asset size threshold for the filing of required company-run stress tests that the Dodd-Frank Act had applied to the Company and the Bank, from $10 billion to $250 billion in total assets. As implemented by the federal banking agencies, these changes became effective in 2018 for banking organizations with total assets of less than $100 billion, such as the Bank.

The ongoing effects of the Dodd-Frank Act, as well as the recent and possible future changes to the regulatory framework as a result of the Economic Growth Act and future proposals make it difficult to assess the overall financial impact of the Dodd-Frank Act and related regulatory developments on the Company and the banking industry. As a result, the Company cannot predict the ultimate impact of the Dodd-Frank Act on the Company or the Bank, including the extent to which it could increase costs or limit the Company’s ability to pursue business opportunities in an efficient manner, or otherwise adversely affect its business, financial condition and results of operations. Nor can the Company predict the impact or substance of other future legislation or regulation. However, it is expected that future legislation or regulation at a minimum will increase the Company’s and the Bank’s operating and compliance costs. As rules and regulations continue to be implemented or issued, the Company may need to dedicate additional resources to ensure compliance, which may increase its costs of operations and adversely impact its earnings.

Capital Requirements

The Company and the Bank are required to comply with applicable capital adequacy standards established by the federal banking agencies. The risk-based capital standards that were applicable to the Company and the Bank through December 31, 2014 were based on the 1988 Capital Accord, known as Basel I (“Basel I”), of the Basel Committee on Banking Supervision (the “Basel Committee”). However, in July 2013, the FRB, the OCC and the FDIC approved final rules (the “Capital Rules”) establishing a new comprehensive capital framework for U.S. banking organizations. These rules went into effect for the Company and the Bank on January 1, 2015, subject to phase-in periods for certain components.

The Capital Rules implement the Basel Committee’s December 2010 capital framework (known as “Basel III”) for strengthening international capital standards as well as certain provisions of the Dodd-Frank Act. The Capital Rules substantially revise the risk-based capital requirements applicable to bank holding companies and depository institutions, including the Company and the Bank, compared to the previous U.S. Basel I risk-based capital rules. The Capital Rules define the components of capital and address other issues in banking institutions regulatory capital ratios and replace the Basel I risk-weighting approach, with a more risk-sensitive one, based in part, on the standardized approach set forth in “Basel II”. The Capital Rules also implement the requirements of Section 939A of the Dodd-Frank Act to remove references to credit ratings from the Federal banking agencies’ rules.

The Capital Rules, among other things: (i) introduces as a capital measure “Common Equity Tier 1,” (“CET1”), (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting specified revised requirements, (iii) defines CET1 narrowly by requiring that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital, and (iv) expands the scope of the deductions from and adjustments to capital as compared to existing regulations. Under the Capital Rules, the most common form of Additional Tier 1 capital is non-cumulative perpetual preferred stock, and the most common form of Tier 2 capital is subordinated notes and a portion of the allowance for loan and lease losses, in each case, subject to the Capital Rules specific requirements.

Under the Capital Rules, the minimum capital ratios as of January 1, 2016 are as follows:

• 4.5% CET1 to total risk-weighted assets;

• 6.0% Tier 1 capital (CET1 plus Additional Tier 1 capital) to total risk-weighted assets;

• 8.0% Total capital (Tier 1 Capital plus Tier 2 capital) to total risk-weighted assets;

• 4.0% Tier 1 capital to total adjusted quarterly average assets (known as “leverage ratio”)

Table of Contents

Beginning in 2016, the Capital Rules required the Company and the Bank to maintain a “capital conservation buffer” composed entirely of CET1. When it was fully phased-in at the beginning of 2019, banking organizations were required to maintain a minimum capital conservation buffer of 2.5% (CET1 to Total risk-weighted assets), in addition to the minimum risk-based capital ratios. Therefore, to satisfy both the minimum risk-based capital ratios and the capital conservation buffer, a banking organization is required to maintain the following: (i) CET1 to total risk-weighted assets of at least 7%, (ii) Tier 1 capital to total risk-weighted assets of at least 8.5%, and (iii) Total capital (Tier 1 capital plus Tier 2 capital) to total risk-weighted assets of at least 10.5%. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions that do not maintain a capital conservation buffer of 2.5% or more will face constraints on dividends, common share repurchases and incentive compensation based on the amount of the shortfall.

The Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, deferred tax assets dependent upon future taxable income and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. Under the general Basel I risk-based capital rules, the effects of accumulated other comprehensive income or loss items included in shareholders' equity (for example, marks-to-market of securities held in the available for sale portfolio) were reversed for the purposes of determining regulatory capital. Under the Capital Rules, the effects of certain accumulated other comprehensive income or loss items are not excluded; however, banks not using the advanced approach, including the Company and the Bank, were permitted to, and in the case of the Company and the Bank they did, make a one-time permanent election to continue to exclude these items.

Consistent with Section 171 of the Dodd-Frank Act, the Capital Rules allow certain bank holding companies to include certain hybrid securities, such as trust preferred securities, in Tier 1 capital if they had less than $15 billion in assets as of December 31, 2009 and the securities were issued before May 19, 2010. Accordingly, the trust preferred securities on the Company’s balance sheet will be included as Tier 1 capital while they are outstanding, unless the Company completes an acquisition of a depository institution holding company that did not meet this criteria, or are acquired by such an organization, after January 1, 2014, at which time they would be subject to the stated phase-out requirements of the Capital Rules and would be included as Tier 2 capital.

Implementation of the deductions and other adjustments to CET1 began on January 1, 2015 and were phased-in over a 4-year period (beginning at 40% on January 1, 2015 and an additional 20% per year thereafter). The implementation of the capital conservation buffer began on January 1, 2016 at the 0.625% level and was phased in over a four-year period (increasing by that amount on each subsequent January 1, until it reached 2.5% on January 1, 2019).

With respect to the Bank, the Capital Rules also revise the prompt corrective action (“PCA”) regulations established pursuant to Section 38 of the Federal Deposit Insurance Act, by (i) introducing a CET1 ratio requirement for each capital category other than critically undercapitalized, with the required CET1 ratio being 6.5% for well-capitalized status; (ii) increasing the minimum Tier 1 capital ratio requirement for each capital category, with the minimum Tier 1 capital ratio for well-capitalized status being 8.0%; and (iii) eliminating the current provision that allows certain highly-rated banking organizations to maintain a 3.0% leverage ratio and still be adequately capitalized. The Capital Rules do not change the Total risk-based PCA capital requirement for any capital category.

The Capital Rules prescribe a standardized approach for risk weighted-assets that expands the risk-weight categories from the four Basel I-derived categories (0%, 20%, 50% and 100%) to a larger and more risk-sensitive number of categories, depending on the nature of the asset. The risk-weight categories generally range from 0% for U.S. government and agency securities, to 1,250% for certain securitized exposures, and result in higher risk weights for a variety of asset categories. The standardized approach requires financial institutions to transition assets that are 90 days or more past due or on nonaccrual from their original risk weight to 150 percent. Additionally, loans designated as high volatility commercial real estate (“HVCRE”) are assigned a risk-weighting of 150 percent.

Requirements to maintain higher levels of capital or to maintain higher levels of liquid assets could adversely impact the Company's net income and return on equity. The current requirements and the Company's actual capital levels are detailed in Note P of “Notes to Consolidated Financial Statements” filed in Part II, Item 8, “Financial Statements and Supplementary Data.”

Consumer Protection Laws

In connection with its banking activities, the Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending to various sectors of the economy. These laws include but are not limited to the Equal Credit Opportunity Act, the Gramm-Leach-Bliley Act (“GLB Act”), the Fair Credit Reporting Act (“FCRA”), the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”), Electronic Funds Transfer Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Dodd-Frank Act, the Real Estate Settlement Procedures Act, the Secure and Fair Enforcement for Mortgage Licensing Act (“SAFE”), the Servicemembers Civil Relief Act (“SCRA”), the Military Lending Act (“MLA”), and various state law counterparts.

Table of Contents

The Dodd-Frank Act created the CFPB with broad powers to supervise and enforce consumer protection laws, including laws that apply to banks in order to prohibit unfair, deceptive or abusive acts or practices. The CFPB has examination authority over all banks and savings institutions with more than $10 billion in assets. The Dodd-Frank Act also weakens the federal preemption rules that are applicable to national banks and gives attorney generals for the states certain powers to enforce federal consumer protection laws. Further, under the Dodd-Frank Act, it is unlawful for any provider of consumer financial products or services to engage in any unfair, deceptive, or abusive acts or practices (“UDAAP”). A violation of the consumer protection and privacy laws, and in particular UDAAP, could have serious legal, financial, and reputational consequences.

In addition, the GLB Act requires all financial institutions to adopt privacy policies, restrict the sharing of nonpublic customer data with nonaffiliated parties and establishes procedures and practices to protect customer data from unauthorized access. In addition, the FCRA, as amended by the FACT Act, includes provisions affecting the Company, the Bank, and their affiliates, including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. The FACT Act requires persons subject to FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the Federal Trade Commission have extensive rulemaking authority under the FACT Act, and the Company and the Bank are subject to the rules that have been created under the FACT Act, including rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate certain identity theft red flags. The SCRA protects persons called to active military service and their dependents from undue hardship resulting from their military service, and the MLA extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The SCRA applies to all debts incurred prior to the commencement of active duty and limits the amount of interest, including service and renewal charges and any other fees or charges (other than bona fide insurance) that are related to the obligation or liability. The MLA applies to certain consumer loans and extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The Bank is also subject to data security standards and data breach notice requirements issued by the OCC and other regulatory agencies. The Bank has created policies and procedures to comply with these consumer protection requirements.

The CFPB issued the final rules implementing the ability-to-repay and qualified mortgage (QM) provisions of the Truth in Lending Act (the “QM Rule”). The ability-to-repay provision requires creditors to make reasonable, good faith determinations that borrowers are able to repay their mortgages before extending credit based on a number of factors and consideration of financial information about the borrower derived from reasonably reliable third-party documents. Under the Dodd-Frank Act and the QM Rule, loans meeting the definition of “qualified mortgage” are entitled to a presumption that the lender satisfied the ability-to-repay requirements. The presumption is a conclusive presumption/safe harbor for loans meeting the QM requirements, and a rebuttable presumption for higher-priced loans meeting the QM requirements. The definition of a “qualified mortgage” incorporates the statutory requirements, such as not allowing negative amortization or terms longer than 30 years. The QM Rule also adds an explicit maximum 43% debt-to-income ratio for borrowers if the loan is to meet the QM definition, though some mortgages that meet government-sponsored enterprises, Federal Housing Administration, and Veterans Administration underwriting guidelines may, for a period not to exceed seven years, meet the QM definition without being subject to the 43% debt-to-income limits. The Bank has created policies and procedures to comply with these consumer protection requirements.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The USA Patriot Act also encourages information-sharing among financial institutions, regulators, and law enforcement authorities by providing an exemption from the privacy provisions of the GLB Act for financial institutions that comply with the provision of the Act. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the institution. The Company has approved policies and procedures that are designed to comply with the USA Patriot Act and its regulations.

Table of Contents

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others administrated by the Treasury’s Office of Foreign Assets Control (“OFAC”). The OFAC administered sanctions can take many different forms; however, they generally contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, entity or individual, including prohibitions against direct or indirect imports and exports and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments, or providing investment related advice or assistance; and (ii) a blocking of assets in which the government or specially designated nationals have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934, as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) new requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) additional responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) the creation of an independent accounting oversight board for the accounting industry; (iv) new standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on non-preferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violations of the securities laws.

Electronic Fund Transfer Act

Among other provisions, the federal banking rule under the Electronic Fund Transfer Act prohibits financial institutions from charging consumers fees for paying overdrafts on automated teller machines and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions. The rule does not govern overdraft fees on the payment of checks and certain other forms of bill payments.

Community Reinvestment Act of 1977

Under the CRA, the Bank is required to help meet the credit needs of its communities, including low- and moderate-income neighborhoods. Although the Bank must follow the requirements of CRA, it does not limit the Bank’s discretion to develop products and services that are suitable for a particular community or establish lending requirements or programs. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibits discrimination in lending practices. The Bank’s failure to comply with the provisions of the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s failure to comply with the Equal Credit Opportunity Act and the Fair Housing Act could result in enforcement actions against it by its regulators as well as other federal regulatory agencies and the Department of Justice. The Bank’s latest CRA rating was “Satisfactory”.

The Bank Secrecy Act

The Bank Secrecy Act (“BSA”) requires all financial institutions, including banks and securities broker-dealers, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. The BSA includes a variety of recordkeeping and reporting requirements (such as currency transaction and suspicious activity reporting), as well as due diligence/know-your-customer documentation requirements. The Company has established a bank secrecy act /anti-money laundering program and taken other appropriate measures in order to comply with BSA requirements.

Community Bank System, Inc. (the “Company”) was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company is a registered financial holding company which wholly-owns two significant subsidiaries: Community Bank, N.A. (the “Bank” or “CBNA”), and Benefit Plans Administrative Services, Inc. (“BPAS”). As of December 31, 2018, BPAS owns five subsidiaries: Benefit Plans Administrative Services, LLC (“BPA”), a provider of defined contribution plan administration services; Northeast Retirement Services, LLC (“NRS”), a provider of institutional transfer agency, master recordkeeping services, fund administration, trust and retirement plan services; BPAS Actuarial & Pension Services, LLC (“BPAS-APS”), a provider of actuarial and benefit consulting services; BPAS Trust Company of Puerto Rico, a Puerto Rican trust company; and Hand Benefits & Trust Company (“HB&T”), a provider of collective investment fund administration and institutional trust services. NRS owns one subsidiary, Global Trust Company, Inc. (“GTC”), a non-depository trust company which provides fiduciary services for collective investment trusts and other products. HB&T owns one subsidiary, Hand Securities, Inc. (“HSI”), an introducing broker-dealer. The Company also sponsors two unconsolidated subsidiary business trusts formed for the purpose of issuing mandatorily-redeemable preferred securities which are considered Tier I capital under regulatory capital adequacy guidelines.

The Bank’s business philosophy is to operate as a diversified financial services enterprise providing a broad array of banking and other financial services to retail, commercial and municipal customers. As of December 31, 2018, the Bank operates 224 full-service branches operating as Community Bank, N.A. throughout 35 counties of Upstate New York, six counties of Northeastern Pennsylvania, 12 counties of Vermont and one county of Western Massachusetts, offering a range of commercial and retail banking services. The Bank owns the following operating subsidiaries: The Carta Group, Inc. (“Carta Group”), CBNA Preferred Funding Corporation (“PFC”), CBNA Treasury Management Corporation (“TMC”), Community Investment Services, Inc. (“CISI”), NOTCH Investment Fund, LLC (“NOTCH”), Nottingham Advisors, Inc. (“Nottingham”), OneGroup NY, Inc. (“OneGroup”), and Oneida Preferred Funding II LLC (“OPFC II”). OneGroup is a full-service insurance agency offering personal and commercial property insurance and other risk management products and services. NOTCH, PFC and OPFC II primarily act as investors in residential and commercial real estate activities. TMC provides cash management, investment, and treasury services to the Bank. CISI and Carta Group provide broker-dealer and investment advisory services. Nottingham provides asset management services to individuals, corporations, corporate pension and profit sharing plans, and foundations.

The Company maintains a website at cbna.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information posted on the website is not incorporated into or a part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at https://www.sec.gov.

Acquisition History (2014-2018)

Kinderhook Bank Corp. - Subsequent Event/ Pending Acquisition

On January 22, 2019, the Company announced that it had entered into a definitive agreement to acquire Kinderhook Bank Corp. (“Kinderhook”), parent company of The National Union Bank of Kinderhook headquartered in Kinderhook, New York, for approximately $93.4 million in cash. The acquisition will extend the Company’s footprint into the Capital District of Upstate New York. Upon the completion of the merger, the Bank will add 11 branch locations across a five county area in the Capital District of Upstate New York with approximately $640 million in assets, and deposits of $560 million. The acquisition is expected to close during the third quarter of 2019, pending both customary regulatory and Kinderhook shareholder approval. The Company expects to incur certain one-time, transaction-related costs in 2019.

Wealth Resources Network, Inc. - Subsequent Event

On January 2, 2019, the Company, through its subsidiary, CISI, completed its acquisition of certain assets of Wealth Resources Network, Inc. (“Wealth Resources”), a financial services business headquartered in Liverpool, New York. The Company paid $1.2 million in cash to acquire the assets of Wealth Resources and recorded a $1.2 million customer list intangible asset in conjunction with the acquisition.

Table of Contents

HR Consultants, LLC

On April 2, 2018, the Company, through its subsidiary, BPAS, acquired certain assets of HR Consultants (SA), LLC (“HR Consultants”), a provider of actuarial and benefit consulting services headquartered in Puerto Rico. The Company paid $0.3 million in cash to acquire the assets of HR Consultants and recorded intangible assets of $0.3 million in conjunction with the acquisition.

Penna & Associates Agency, Inc.

On January 2, 2018, the Company, through its subsidiary, OneGroup, completed its acquisition of certain assets of Penna & Associates Agency, Inc. (“Penna”), an insurance agency headquartered in Johnson City, New York. The Company paid $0.8 million in cash to acquire the assets of Penna, and recorded goodwill in the amount of $0.3 million and a customer list intangible asset of $0.3 million in conjunction with the acquisition.

Styles Bridges Associates

On January 2, 2018, the Company, through its subsidiary, CISI, completed its acquisition of certain assets of Styles Bridges Associates (“Styles Bridges”), a financial services business headquartered in Canton, New York. The Company paid $0.7 million in cash to acquire a customer list from Styles Bridges, and recorded a $0.7 million customer list intangible asset in conjunction with the acquisition.

Gordon B. Roberts Agency, Inc.

On December 4, 2017, the Company, through its subsidiary, OneGroup, completed its acquisition of Gordon B. Roberts Agency, Inc. (“GBR”), an insurance agency headquartered in Oneonta, New York for $3.7 million in Company stock and cash, comprised of $1.35 million in cash and the issuance of 0.04 million shares of common stock. The transaction resulted in the acquisition of $0.6 million of assets, $0.6 million of other liabilities, goodwill in the amount of $2.1 million and other intangible assets of $1.6 million.

Northeast Capital Management, Inc.

On November 17, 2017, the Company, through its subsidiary, CISI, completed its acquisition of certain assets of Northeast Capital Management, Inc. (“NECM”), a financial services business headquartered in Wilkes-Barre, Pennsylvania. The Company paid $1.2 million in cash to acquire a customer list from NECM, and recorded a $1.2 million customer list intangible asset in conjunction with the acquisition.

Merchants Bancshares, Inc.

On May 12, 2017, the Company completed its acquisition of Merchants Bancshares, Inc. (“Merchants”), parent company of Merchants Bank headquartered in South Burlington, Vermont, for $345.2 million in Company stock and cash, comprised of $82.9 million in cash and the issuance of 4.68 million shares of common stock. The acquisition extended the Company’s footprint into the Vermont and Western Massachusetts markets with the addition of 31 branch locations in Vermont and one location in Massachusetts. This transaction resulted in the acquisition of $2.0 billion of assets, including $1.49 billion of loans and $370.6 million of investment securities, as well as $1.45 billion of deposits and $189.0 million in goodwill.

Dryfoos Insurance Agency, Inc.

On March 1, 2017, the Company, through its subsidiary, OneGroup, completed its acquisition of certain assets of Dryfoos Insurance Agency, Inc. (“Dryfoos”), an insurance agency headquartered in Hazleton, Pennsylvania. The Company paid $3.0 million in cash to acquire the assets of Dryfoos, and recorded goodwill in the amount of $1.7 million and other intangible assets of $1.7 million in conjunction with the acquisition.

Northeast Retirement Services, Inc.

On February 3, 2017, the Company completed its acquisition of NRS and its subsidiary GTC, headquartered in Woburn, Massachusetts, for $148.6 million in Company stock and cash. NRS was a privately held corporation focused on providing institutional transfer agency, master recordkeeping services, custom target date fund administration, trust product administration and customized reporting services to institutional clients. Its wholly-owned subsidiary, GTC, is chartered in the State of Maine as a non-depository trust company and provides fiduciary services for collective investment trusts and other products. The acquisition of NRS and GTC, hereafter referred to collectively as NRS, strengthens and complements the Company’s existing employee benefit services businesses. Upon the completion of the merger, NRS became a wholly-owned subsidiary of BPAS and operates as Northeast Retirement Services, LLC, a Delaware limited liability company. This transaction resulted in the acquisition of $36.1 million in net tangible assets, principally cash and certificates of deposit, $60.2 million in customer list intangibles that will be amortized over 10 years, the creation of a $23.0 million deferred tax liability associated with the customer list intangible and $75.3 million in goodwill.

Table of Contents

Benefits Advisory Service, Inc.

On January 1, 2017, the Company, through its subsidiary, OneGroup, acquired certain assets of Benefits Advisory Service, Inc. (“BAS”), a benefits consulting group headquartered in Forest Hills, New York. The Company paid $1.2 million in cash to acquire the assets of BAS and recorded intangible assets of $1.2 million in conjunction with the acquisition.

WJL Agencies, Inc.

On January 4, 2016, the Company, through its subsidiary, CBNA Insurance Agency, Inc., completed its acquisition of WJL Agencies, Inc. doing business as The Clark Insurance Agencies (“WJL”), an insurance agency operating in Canton, New York. The Company paid $0.6 million in cash for the intangible assets of the company. Goodwill in the amount of $0.3 million and intangible assets in the amount of $0.3 million were recorded in conjunction with the acquisition. On August 19, 2016, the Company merged together its insurance subsidiaries and as of that date, CBNA Insurance Agency, Inc. was merged into OneGroup.

Oneida Financial Corp.

On December 4, 2015, the Company completed its acquisition of Oneida Financial Corp. (“Oneida”), parent company of Oneida Savings Bank, headquartered in Oneida, New York for $158.5 million in Company stock and cash, comprised of $56.3 million of cash and the issuance of 2.38 million common shares. Upon the completion of the merger, the Bank added 12 branch locations in Oneida and Madison counties and approximately $769.4 million of assets, including approximately $399.4 million of loans and $225.7 million of investment securities, along with $699.2 million of deposits. Through the acquisition of Oneida, the Company acquired OneGroup and Oneida Wealth Management, Inc. (“OWM”) as wholly-owned subsidiaries primarily engaged in offering insurance and investment advisory services. These subsidiaries complement the Company’s other non-banking financial services businesses. On April 22, 2016, the activities of OWM were merged into CISI.

EBS-RMSCO, Inc.

On January 1, 2014, BPAS-APS, formerly known as Harbridge Consulting Group LLC, completed its acquisition of a professional services practice from EBS-RMSCO, Inc., a subsidiary of The Lifetime Healthcare Companies (“EBS-RMSCO”). This professional services practice, which provides actuarial valuation and consulting services to clients who sponsor pension and post-retirement medical and welfare plans, enhanced the Company’s participation in the Western New York marketplace.

Services

Banking

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank’s branches are generally located in smaller towns and cities within its geographic market areas of Upstate New York, Northeastern Pennsylvania, Vermont and Western Massachusetts. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch and regional levels, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System, the Federal Home Loan Bank of New York and the Federal Home Loan Bank of Boston (collectively referred to as “FHLB”), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Employee Benefit Services

Through BPAS and its subsidiaries, the Company operates a national practice that provides employee benefit trust, collective investment fund, retirement plan administration, fund administration, transfer agency, actuarial, VEBA/HRA and health and welfare consulting services to a diverse array of clients spanning the United States and Puerto Rico.

Wealth Management

Through the Bank, CISI, Carta Group, and Nottingham, the Company provides wealth management, retirement planning, higher educational planning, fiduciary, risk management, trust services and personal financial planning services. The Company offers investment alternatives including stocks, bonds, mutual funds and advisory products.

Insurance Agency

Through OneGroup, the Company offers personal and commercial property insurance and other risk management products and services. In addition, OneGroup offers employee benefit related services. OneGroup represents many leading insurance companies.

Table of Contents

Segment Information

The Company has identified three reportable operating business segments: Banking, Employee Benefit Services, and All Other. Included in the All Other segment are the smaller Wealth Management and Insurance operations. Information about the Company’s reportable business segments is included in Note U of the “Notes to Consolidated Financial Statements” filed herewith in Part II.

Competition

The banking and financial services industry is highly competitive in the New York, Pennsylvania, Vermont and Massachusetts markets. The Company competes actively for loans, deposits, and financial services relationships with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, insurance agencies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The Company’s employee benefit trust and plan administration business competes on a national scale and provides geographic diversification for the Company. Certain lines of business are marketed primarily through unaffiliated financial advisors, while others are marketed directly to plan sponsors and fund companies. In order to compete with large national firms, the Company stresses its consultative approach to complex engagements.

The table below summarizes the Bank’s deposits and market share by the fifty-four counties of New York, Pennsylvania, Vermont, and Massachusetts in which it has customer facilities. Market share is based on deposits of all commercial banks, credit unions, savings and loan associations, and savings banks.

Table of Contents

Number of County State Deposits as of 6/30/2018(1) (000’s omitted) Market Share (1) Branches ATM’s Towns/ Cities Towns Where Company Has 1st or 2nd Market Position Grand Isle VT $37,681 100.00% 1 1 1 1 Lewis NY 201,318 73.46% 4 4 3 3 Hamilton NY 59,541 56.52% 2 2 2 2 Franklin NY 344,894 52.83% 6 6 5 5 Madison NY 418,397 45.71% 8 8 5 5 Allegany NY 280,196 44.50% 9 10 8 8 Cattaraugus NY 432,515 33.45% 10 11 7 6 Otsego NY 344,457 29.82% 10 9 6 5 Schuyler NY 53,185 24.97% 1 1 1 1 Seneca NY 127,217 24.94% 4 3 4 4 Saint Lawrence NY 456,884 24.58% 13 13 11 10 Yates NY 97,185 23.36% 3 2 2 1 Clinton NY 385,880 23.34% 4 7 2 2 Jefferson NY 440,124 23.29% 7 9 6 6 Wyoming PA 136,249 20.98% 4 4 4 3 Livingston NY 190,211 19.59% 5 6 5 4 Chautauqua NY 368,106 18.81% 12 12 10 7 Essex NY 130,903 15.74% 5 5 4 3 Orange VT 50,659 15.08% 2 2 2 2 Oswego NY 202,165 13.59% 4 5 4 3 Caledonia VT 69,740 10.92% 2 2 2 1 Wayne NY 133,223 10.52% 3 4 2 2 Ontario NY 236,577 10.33% 8 13 5 3 Addison VT 57,973 9.48% 2 2 2 2 Delaware NY 138,152 9.39% 5 5 5 4 Bennington VT 77,389 9.18% 2 4 2 0 Chittenden VT 589,812 8.90% 9 10 6 4 Tioga NY 38,382 8.53% 2 2 2 1 Franklin VT 50,716 7.88% 2 2 2 1 Rutland VT 107,221 7.46% 3 3 2 1 Chemung NY 75,227 6.88% 2 2 1 0 Susquehanna PA 59,611 6.72% 3 1 3 2 Herkimer NY 47,578 6.71% 1 1 1 1 Luzerne PA 463,068 6.68% 10 13 8 4 Lackawanna PA 405,557 6.40% 11 11 8 4 Steuben NY 193,545 6.29% 8 9 7 4 Schoharie NY 21,777 4.72% 1 1 1 0 Lamoille VT 27,326 4.68% 1 1 1 1 Windham VT 47,652 4.57% 2 3 2 1 Carbon PA 45,025 4.55% 2 2 2 0 Oneida NY 256,782 4.28% 6 8 5 3 Windsor VT 58,462 4.20% 2 1 2 0 Washington VT 87,601 3.63% 3 5 3 1 Cayuga NY 43,880 3.60% 2 2 2 1 Bradford PA 43,259 3.36% 2 2 2 1 Chenango NY 22,822 2.56% 2 2 1 0 Washington NY 19,569 2.53% 1 0 1 1 Warren NY 37,977 1.96% 1 1 1 1 Onondaga NY 206,535 1.65% 4 5 4 1 Ulster NY 31,046 0.73% 1 1 1 1 Broome NY 32,672 0.52% 1 1 1 0 Erie NY 138,335 0.33% 4 4 3 2 Hampden MA 37,223 0.29% 1 1 1 0 Tompkins NY 4,867 0.16% 1 0 1 0 8,664,348 5.67% 224 244 184 129 (1) Deposits and Market Share data as of June 30, 2018, the most recent information available from SNL Financial LLC. Deposit amounts include $150.4 million of intercompany balances that are eliminated upon consolidation.

Table of Contents

Employees

As of December 31, 2018, the Company employed 2,661 full-time employees and 272 part-time and temporary employees. None of the Company’s employees are represented by a collective bargaining agreement. The Company offers a variety of employment benefits and considers its relationship with its employees to be good.

Supervision and Regulation

General

The banking industry is highly regulated with numerous statutory and regulatory requirements that are designed primarily for the protection of depositors and the financial system, and not for the purpose of protecting shareholders. Set forth below is a description of the material laws and regulations applicable to the Company and the Bank. This summary is not complete and the reader should refer to these laws and regulations for more detailed information. The Company’s and the Bank’s failure to comply with applicable laws and regulations could result in a range of sanctions and administrative actions imposed upon the Company and/or the Bank, including the imposition of civil money penalties, formal agreements and cease and desist orders. Changes in applicable law or regulations, and in their interpretation and application by regulatory agencies, cannot be predicted, and may have a material effect on the Company’s business and results.

The Company and its subsidiaries are subject to the laws and regulations of the federal government and the states and jurisdictions in which they conduct business. The Company, as a bank holding company, is subject to extensive regulation, supervision and examination by the Board of Governors of the Federal Reserve System (“FRB”) as its primary federal regulator. The Bank is a nationally-chartered bank and is subject to extensive regulation, supervision and examination by the Office of the Comptroller of the Currency (“OCC”) as its primary federal regulator, and as to certain matters, the FRB, the Consumer Financial Protection Bureau (“CFPB”), and the Federal Deposit Insurance Corporation (“FDIC”).

The Company is also subject to the jurisdiction of the SEC and is subject to disclosure and regulatory requirements under the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended. The Company’s common stock is listed on the New York Stock Exchange (“NYSE”) and it is subject to NYSE’s rules for listed companies. Affiliated entities, including BPAS, NRS, HB&T, HSI, BPAS Trust Company of Puerto Rico, Nottingham, CISI, OneGroup, and Carta Group are subject to the jurisdiction of certain state and federal regulators and self-regulatory organizations including, but not limited to, the SEC, the Texas Department of Banking, the State of Maine Bureau of Financial Institutions, the Financial Industry Regulatory Authority (“FINRA”), Puerto Rico Office of the Commissioner of Financial Institutions, and state securities and insurance regulators.

Federal Bank Holding Company Regulation

The Company was a bank holding company under the Bank Holding Company Act of 1956, (the “BHC Act”), and became a financial holding company effective September 30, 2015. As a bank holding company that has elected to become a financial holding company, the Company can affiliate with securities firms and insurance companies and engage in other activities that are “financial in nature” or “incidental” or “complementary” to activities that are financial in nature, as long as it continues to meet the eligibility requirements for financial holding companies (including requirements that the financial holding company and its depository institution subsidiary maintain their status as “well capitalized” and “well managed”).

Generally, FRB approval is not required for the Company to acquire a company (other than a bank holding company, bank or savings association) engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the FRB. Prior notice to the FRB may be required, however, if the company to be acquired has total consolidated assets of $10 billion or more. Prior FRB approval is required before the Company may acquire the beneficial ownership or control of more than 5% of the voting shares or substantially all of the assets of a bank holding company, bank or savings association.

Because the Company is a financial holding company, if the Bank were to receive a rating under the Community Reinvestment Act of 1977, as amended (“CRA”), of less than Satisfactory, the Company will be prohibited, until the rating is raised to Satisfactory or better, from engaging in new activities or acquiring companies other than bank holding companies, banks or savings associations, except that the Company could engage in new activities, or acquire companies engaged in activities, that are considered “closely related to banking” under the BHC Act. In addition, if the FRB determines that the Company or the Bank is not well capitalized or well managed, the Company would be required to enter into an agreement with the FRB to comply with all applicable capital and management requirements and may contain additional limitations or conditions. Until corrected, the Company could be prohibited from engaging in any new activity or acquiring companies engaged in activities that are not closely related to banking, absent prior FRB approval.

Table of Contents

Federal Reserve System Regulation

Because the Company is a financial holding company, it is subject to regulatory capital requirements and required by the FRB to, among other things, maintain cash reserves against its deposits. The Bank is under similar capital requirements administered by the OCC as discussed below. FRB policy has historically required a financial holding company to act as a source of financial and managerial strength to its subsidiary banks. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) codifies this historical policy as a statutory requirement. To the extent the Bank is in need of capital, the Company could be expected to provide additional capital, including borrowings from the FRB for such purpose. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors’ funds.

The FRB also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the FRB, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust our strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond our control.

The Office of Comptroller of the Currency Regulation

The Bank is supervised and regularly examined by the OCC. The various laws and regulations administered by the OCC affect the Company’s practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects the Bank’s business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and the location of its offices. The OCC generally prohibits a depository institution from making any capital distributions, including the payment of a dividend, or paying any management fee to its parent holding company if the depository institution would become undercapitalized due to the payment. Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the OCC. The Bank is well capitalized under regulatory standards administered by the OCC. For additional information on our capital requirements see “Management’s Discussion and Analysis of Financial Condition and Results of Operations – Shareholders’ Equity” and Note P to the Financial Statements.

Federal Home Loan Bank

The Bank is a member of the FHLB, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to the rules and requirements of the FHLB, including the purchase of shares of FHLB activity-based stock in the amount of 4.5% of the dollar amount of outstanding advances and FHLB capital stock in an amount equal to the greater of $1,000 or the sum of 0.15% of the mortgage-related assets held by the Bank based upon the previous year-end financial information. The Bank was in compliance with the rules and requirements of the FHLB at December 31, 2018.

Deposit Insurance

Deposits of the Bank are insured up to the applicable limits by the Deposit Insurance Fund (“DIF”) and are subject to deposit insurance assessments to maintain the DIF. The Dodd-Frank Act permanently increased the maximum amount of deposit insurance to $250,000 per deposit category, per depositor, per institution. A depository institution’s DIF assessment is calculated by multiplying its assessment rate by the assessment base, which is defined as the average consolidated total assets less the average tangible equity of the depository institution. The initial base assessment rate is based on its capital level and supervisory ratings (its “CAMELS ratings”), certain financial measures to assess an institution’s ability to withstand asset related stress and funding related stress and, in some cases, additional discretionary adjustments by the FDIC to reflect additional risk factors. The Bank’s adjusted average consolidated total assets for 4 consecutive quarters exceeded $10.0 billion in 2018, which resulted in a deposit insurance assessment based on a large institution classification, rather than the small institution classification for years prior to 2018.

For large insured depository institutions, generally defined as those with at least $10 billion in total assets, the FDIC has eliminated risk categories when calculating the initial base assessment rates and now combine CAMELS ratings and financial measures into two scorecards to calculate assessment rates, one for most large insured depository institutions and another for highly complex insured depository institutions (which are generally those with more than $50 billion in total assets that are controlled by a parent company with more than $500 billion in total assets). Each scorecard has two components - a performance score and loss severity score, which are combined and converted to an initial assessment rate. The FDIC has the ability to adjust a large or highly complex insured depository institution’s total score by a maximum of 15 points, up or down, based upon significant risk factors that are not captured by the scorecard. Under the current assessment rate schedule, the initial base assessment rate for large and highly complex insured depository institutions ranges from three to 30 basis points, and the total base assessment rate, after applying the unsecured debt and brokered deposit adjustments, ranges from one and one-half to 40 basis points. The Bank’s FDIC insurance for 2018 was based on an assessment rate of three basis points.

Table of Contents

In October 2010, the FDIC adopted a DIF restoration plan to ensure that the fund reserve ratio reached 1.35% by September 30, 2020, as required by the Dodd-Frank Act. In September 2018, the DIF reserve ratio reached 1.36%, exceeding the required reserve ratio of 1.35% ahead of the September 30, 2020 deadline. FDIC insurance expense totaled $3.2 million, $3.5 million and $3.7 million in 2018, 2017 and 2016, respectively.

Under the Federal Deposit Insurance Act, if the FDIC finds that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, the FDIC may determine that such violation or unsafe or unsound practice or condition require the termination of deposit insurance.

Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

On July 21, 2010, the Dodd-Frank Act was signed into law, which resulted in significant changes to the banking industry. As discussed further throughout this section, certain aspects of the Dodd-Frank Act are subject to implementing rules that have been taking effect over several years.

The Dodd-Frank Act contains numerous provisions that affect all banks and bank holding companies and impacts how the Company and the Bank handle their operations. The Dodd-Frank Act requires various federal agencies, including those that regulate the Company and the Bank, to promulgate new rules and regulations and to conduct various studies and reports for Congress. The federal agencies have either completed or are in the process of completing these rules and regulations and have been given significant discretion in drafting such rules and regulations. Several of the provisions of the Dodd-Frank Act may have the consequence of increasing the Bank’s expenses, decreasing its revenues, and changing the activities in which it chooses to engage. The specific impact of the Dodd-Frank Act on the Company’s current activities or new financial activities the Company may consider in the future, the Company’s financial performance, and the markets in which the Company operates depends on the manner in which the relevant agencies continue to develop and implement the required rules and regulations and the reaction of market participants to these regulatory developments.

Pursuant to FRB regulations mandated by the Dodd-Frank Act, interchange fees on debit card transactions are limited to a maximum of $0.21 per transaction plus 5 basis points of the transaction amount. A debit card issuer may recover an additional one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements prescribed by the FRB. The FRB also adopted requirements in the final rule that issuers include two unaffiliated networks for routing debit transactions that are applicable to the Company and the Bank. The Company became subject to the interchange fee cap mandated by the Dodd-Frank Act beginning on July 1, 2018. As such, the fees the Company may receive for an electronic debit transaction will be capped at the statutory limit. Prior to July 1, 2018, the Company was exempt from the interchange fee cap under the “small issuer” exemption, which applies to any debit card issuer with total worldwide assets (including those of its affiliates) of less than $10 billion as of the end of the previous calendar year.

The Dodd-Frank Act established the CFPB and empowered it to exercise broad rulemaking, supervision, and enforcement authority for a wide range of consumer protection laws. Since the Company’s total consolidated assets exceed $10 billion the Company is subject to the direct supervision of the CFPB. The CFPB has issued and continues to issue numerous regulations under which the Company and the Bank will continue to incur additional expense in connection with its ongoing compliance obligations. Significant recent CFPB developments that may affect operations and compliance costs include:

· positions taken by the CFPB on fair lending, including applying the disparate impact theory which could make it more difficult for lenders to charge different rates or to apply different terms to loans to different customers;

· the CFPB’s final rule amending Regulation C, which implements the Home Mortgage Disclosure Act, requiring most lenders to report expanded information in order for the CFPB to more effectively monitor fair lending concerns and other information shortcomings identified by the CFPB;

· positions taken by the CFPB regarding the Electronic Fund Transfer Act and Regulation E, which require companies to obtain customer authorizations before automatically debiting a consumer’s account for pre-authorized electronic funds transfers; and

· focused efforts on enforcing certain compliance obligations the CFPB deems a priority, such as automobile loan servicing, debt collection, mortgage origination and servicing, remittances, and fair lending, among others.

The final rules issued by the FRB, SEC, OCC, FDIC, and Commodity Futures Trading Commission implementing Section 619 of the Dodd-Frank Act (commonly known as the Volcker Rule) prohibit insured depository institutions and companies affiliated with insured depository institutions from engaging in short-term proprietary trading of certain securities, derivatives, commodity futures and options on these instruments, for their own account. The final rules also impose limits on banking entities’ investments in, and other relationships with, hedge funds or private equity funds.

Table of Contents

In May of 2018, the Economic Growth, Regulatory Relief, and Consumer Protection Act (“Economic Growth Act”) was enacted to amend the Dodd-Frank Act and modify certain post-crisis regulatory requirements, including a variety of provisions intended to promote economic growth, provide tailored regulatory relief for smaller and less complex financial institutions, and enhance consumer protections. Among other things, the law raised the asset size threshold for the filing of required company-run stress tests that the Dodd-Frank Act had applied to the Company and the Bank, from $10 billion to $250 billion in total assets. As implemented by the federal banking agencies, these changes became effective in 2018 for banking organizations with total assets of less than $100 billion, such as the Bank.

The ongoing effects of the Dodd-Frank Act, as well as the recent and possible future changes to the regulatory framework as a result of the Economic Growth Act and future proposals make it difficult to assess the overall financial impact of the Dodd-Frank Act and related regulatory developments on the Company and the banking industry. As a result, the Company cannot predict the ultimate impact of the Dodd-Frank Act on the Company or the Bank, including the extent to which it could increase costs or limit the Company’s ability to pursue business opportunities in an efficient manner, or otherwise adversely affect its business, financial condition and results of operations. Nor can the Company predict the impact or substance of other future legislation or regulation. However, it is expected that future legislation or regulation at a minimum will increase the Company’s and the Bank’s operating and compliance costs. As rules and regulations continue to be implemented or issued, the Company may need to dedicate additional resources to ensure compliance, which may increase its costs of operations and adversely impact its earnings.

Capital Requirements

The Company and the Bank are required to comply with applicable capital adequacy standards established by the federal banking agencies. The risk-based capital standards that were applicable to the Company and the Bank through December 31, 2014 were based on the 1988 Capital Accord, known as Basel I (“Basel I”), of the Basel Committee on Banking Supervision (the “Basel Committee”). However, in July 2013, the FRB, the OCC and the FDIC approved final rules (the “Capital Rules”) establishing a new comprehensive capital framework for U.S. banking organizations. These rules went into effect for the Company and the Bank on January 1, 2015, subject to phase-in periods for certain components.

The Capital Rules implement the Basel Committee’s December 2010 capital framework (known as “Basel III”) for strengthening international capital standards as well as certain provisions of the Dodd-Frank Act. The Capital Rules substantially revise the risk-based capital requirements applicable to bank holding companies and depository institutions, including the Company and the Bank, compared to the previous U.S. Basel I risk-based capital rules. The Capital Rules define the components of capital and address other issues affecting the numerator in banking institutions regulatory capital ratios and replace the Basel I risk-weighting approach, with a more risk-sensitive one, based in part, on the standardized approach set forth in “Basel II”. The Capital Rules also implement the requirements of Section 939A of the Dodd-Frank Act to remove references to credit ratings from the Federal banking agencies’ rules.

The Capital Rules, among other things: (i) introduces as a capital measure “Common Equity Tier 1,” (“CET1”), (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting specified revised requirements, (iii) defines CET1 narrowly by requiring that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital, and (iv) expands the scope of the deductions from and adjustments to capital as compared to existing regulations. Under the Capital Rules, the most common form of Additional Tier 1 capital is non-cumulative perpetual preferred stock, and the most common form of Tier 2 capital is subordinated notes and a portion of the allowance for loan and lease losses, in each case, subject to the Capital Rules specific requirements.

Under the Capital Rules, the minimum capital ratios as of January 1, 2016 are as follows:

· 4.5% CET1 to total risk-weighted assets;

· 6.0% Tier 1 capital (CET1 plus Additional Tier 1 capital) to total risk-weighted assets;

· 8.0% Total capital (Tier 1 Capital plus Tier 2 capital) to total risk-weighted assets;

· 4.0% Tier 1 capital to total adjusted quarterly average assets (known as “leverage ratio”)

Beginning in 2016, the Capital Rules required the Company and the Bank to maintain a “capital conservation buffer” composed entirely of CET1. When it is fully phased-in by the beginning of 2019, banking organizations will be required to maintain a minimum capital conservation buffer of 2.5% (CET1 to Total risk-weighted assets), in addition to the minimum risk-based capital ratios. Therefore, to satisfy both the minimum risk-based capital ratios and the capital conservation buffer, a banking organization will be required to maintain the following: (i) CET1 to total risk-weighted assets of at least 7%, (ii) Tier 1 capital to total risk-weighted assets of at least 8.5%, and (iii) Total capital (Tier 1 capital plus Tier 2 capital) to total risk-weighted assets of at least 10.5% by January 1, 2019, upon full phase-in of the capital conservation buffer. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions that do not maintain a capital conservation buffer of 2.5% or more will face constraints on dividends, common share repurchases and incentive compensation based on the amount of the shortfall.

Table of Contents

The Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, deferred tax assets dependent upon future taxable income and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. Under the general Basel I risk-based capital rules, the effects of accumulated other comprehensive income or loss items included in shareholders’ equity (for example, marks-to-market of securities held in the available for sale portfolio) were reversed for the purposes of determining regulatory capital. Under the Capital Rules, the effects of certain accumulated other comprehensive income or loss items are not excluded; however, banks not using the advanced approach, including the Company and the Bank, were permitted to, and in the case of the Company and the Bank they did, make a one-time permanent election to continue to exclude these items.

Consistent with the section 171 of the Dodd-Frank Act, the Capital Rules allow certain bank holding companies to include certain hybrid securities, such as trust preferred securities, in Tier 1 capital if they had less than $15 billion in assets as of December 31, 2009 and the securities were issued before May 19, 2010. Accordingly, the trust preferred securities on the Company’s balance sheet will be included as Tier 1 capital while they are outstanding, unless the Company completes an acquisition of a depository institution holding company that did not meet this criteria, or are acquired by such an organization, after January 1, 2014, at which time they would be subject to the stated phase-out requirements of the Capital Rules and would be included as Tier 2 capital.

Implementation of the deductions and other adjustments to CET1 began on January 1, 2015 and will be phased-in over a 4-year period (beginning at 40% on January 1, 2015 and an additional 20% per year thereafter). The implementation of the capital conservation buffer began on January 1, 2016 at the 0.625% level and will be phased in over a four-year period (increasing by that amount on each subsequent January 1, until it reaches 2.5% on January 1, 2019).

With respect to the Bank, the Capital Rules also revise the prompt corrective action (“PCA”) regulations established pursuant to Section 38 of the Federal Deposit Insurance Act, by (i) introducing a CET1 ratio requirement for each capital category other than critically undercapitalized, with the required CET1 ratio being 6.5% for well-capitalized status; (ii) increasing the minimum Tier 1 capital ratio requirement for each capital category, with the minimum Tier 1 capital ratio for well-capitalized status being 8.0%; and (iii) eliminating the current provision that allows certain highly-rated banking organizations to maintain a 3.0% leverage ratio and still be adequately capitalized. The Capital Rules do not change the Total risk-based PCA capital requirement for any capital category.

The Capital Rules prescribe a standardized approach for risk weighted-assets that expands the risk-weight categories from the four Basel I-derived categories (0%, 20%, 50% and 100%) to a larger and more risk-sensitive number of categories, depending on the nature of the asset. The risk-weight categories generally range from 0% for U.S. government and agency securities, to 1,250% for certain securitized exposures, and result in higher risk weights for a variety of asset categories. The standardized approach requires financial institutions to transition assets that are 90 days or more past due or on nonaccrual from their original risk weight to 150 percent. Additionally, loans designated as high volatility commercial real estate (“HVCRE”) are assigned a risk-weighting of 150 percent.

Requirements to maintain higher levels of capital or to maintain higher levels of liquid assets could adversely impact the Company’s net income and return on equity. The current requirements and the Company’s actual capital levels are detailed in Note P of “Notes to Consolidated Financial Statements” filed in Part II, Item 8, “Financial Statements and Supplementary Data.”

Consumer Protection Laws

In connection with its banking activities, the Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending to various sectors of the economy. These laws include the Equal Credit Opportunity Act, the Gramm-Leach-Bliley Act (“GLB Act”), the Fair Credit Reporting Act (“FCRA”), the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”), Electronic Funds Transfer Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Dodd-Frank Act, the Real Estate Settlement Procedures Act, the Secure and Fair Enforcement for Mortgage Licensing Act (“SAFE”), the Servicemembers Civil Relief Act (“SCRA”), the Military Lending Act (“MLA”), and various state law counterparts.

The Dodd-Frank Act created the CFPB with broad powers to supervise and enforce consumer protection laws, including laws that apply to banks in order to prohibit unfair, deceptive or abusive acts or practices. The CFPB has examination authority over all banks and savings institutions with more than $10 billion in assets. The Dodd-Frank Act also weakens the federal preemption rules that are applicable to national banks and gives attorney generals for the states certain powers to enforce federal consumer protection laws. Further, under the Dodd-Frank Act, it is unlawful for any provider of consumer financial products or services to engage in any unfair, deceptive, or abusive acts or practices (“UDAAP”). A violation of the consumer protection and privacy laws, and in particular UDAAP, could have serious legal, financial, and reputational consequences.

Table of Contents

In addition, the GLB Act requires all financial institutions to adopt privacy policies, restrict the sharing of nonpublic customer data with nonaffiliated parties and establishes procedures and practices to protect customer data from unauthorized access. In addition, the FCRA, as amended by the FACT Act, includes provisions affecting the Company, the Bank, and their affiliates, including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. The FACT Act requires persons subject to FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the Federal Trade Commission have extensive rulemaking authority under the FACT Act, and the Company and the Bank are subject to the rules that have been created under the FACT Act, including rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate certain identity theft red flags. The SCRA protects persons called to active military service and their dependents from undue hardship resulting from their military service, and the MLA extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The SCRA applies to all debts incurred prior to the commencement of active duty and limits the amount of interest, including service and renewal charges and any other fees or charges (other than bona fide insurance) that are related to the obligation or liability. The MLA applies to certain consumer loans and extends specific protections if an accountholder, at the time of account opening, is a covered active duty member of the military or certain family members thereof. The Bank is also subject to data security standards and data breach notice requirements issued by the OCC and other regulatory agencies. The Bank has created policies and procedures to comply with these consumer protection requirements.

The CFPB issued the final rules implementing the ability-to-repay and qualified mortgage (QM) provisions of the Truth in Lending Act (the “QM Rule”). The ability-to-repay provision requires creditors to make reasonable, good faith determinations that borrowers are able to repay their mortgages before extending the credit based on a number of factors and consideration of financial information about the borrower derived from reasonably reliable third-party documents. Under the Dodd-Frank Act and the QM Rule, loans meeting the definition of “qualified mortgage” are entitled to a presumption that the lender satisfied the ability-to-repay requirements. The presumption is a conclusive presumption/safe harbor for loans meeting the QM requirements, and a rebuttable presumption for higher-priced loans meeting the QM requirements. The definition of a “qualified mortgage” incorporates the statutory requirements, such as not allowing negative amortization or terms longer than 30 years. The QM Rule also adds an explicit maximum 43% debt-to-income ratio for borrowers if the loan is to meet the QM definition, though some mortgages that meet government-sponsored enterprises, Federal Housing Administration, and Veterans Administration underwriting guidelines may, for a period not to exceed seven years, meet the QM definition without being subject to the 43% debt-to-income limits. The Bank has created policies and procedures to comply with these consumer protection requirements.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The USA Patriot Act also encourages information-sharing among financial institutions, regulators, and law enforcement authorities by providing an exemption from the privacy provisions of the GLB Act for financial institutions that comply with the provision of the Act. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the institution. The Company has approved policies and procedures that are designed to comply with the USA Patriot Act and its regulations.

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others administrated by the Treasury’s Office of Foreign Assets Control (“OFAC”). The OFAC administered sanctions can take many different forms; however, they generally contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, entity or individual, including prohibitions against direct or indirect imports and exports and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments, or providing investment related advice or assistance; and (ii) a blocking of assets in which the government or specially designated nationals have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences.

Table of Contents

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934, as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) new requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) additional responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) the creation of an independent accounting oversight board for the accounting industry; (iv) new standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on non-preferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violations of the securities laws.

Electronic Fund Transfer Act

Among other provisions, the federal banking rule under the Electronic Fund Transfer Act prohibits financial institutions from charging consumers fees for paying overdrafts on automated teller machines and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions. The rule does not govern overdraft fees on the payment of checks and certain other forms of bill payments.

Community Reinvestment Act of 1977

Under the CRA, the Bank is required to help meet the credit needs of its communities, including low- and moderate-income neighborhoods. Although the Bank must follow the requirements of CRA, it does not limit the Bank’s discretion to develop products and services that are suitable for a particular community or establish lending requirements or programs. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibits discrimination in lending practices. The Bank’s failure to comply with the provisions of the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s failure to comply with the Equal Credit Opportunity Act and the Fair Housing Act could result in enforcement actions against it by its regulators as well as other federal regulatory agencies and the Department of Justice. The Bank’s latest CRA rating was “Satisfactory”.

The Bank Secrecy Act

The Bank Secrecy Act (“BSA”) requires all financial institutions, including banks and securities broker-dealers, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. The BSA includes a variety of recordkeeping and reporting requirements (such as currency transaction and suspicious activity reporting), as well as due diligence/know-your-customer documentation requirements. The Company has established a bank secrecy act /anti-money laundering program and taken other appropriate measures in order to comply with BSA requirements.

Community Bank System, Inc. (the “Company”) was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company is a registered financial holding company which wholly-owns two significant subsidiaries: Community Bank, N.A. (the “Bank” or “CBNA”), and Benefit Plans Administrative Services, Inc. (“BPAS”). As of December 31, 2017, BPAS owns five subsidiaries: Benefit Plans Administrative Services, LLC (“BPA”), a provider of defined contribution plan administration services; Northeast Retirement Services, LLC (“NRS”), a provider of institutional transfer agency, master recordkeeping services, fund administration, trust and retirement plan services; BPAS Actuarial & Pension Services, LLC (“BPAS-APS”), a provider of actuarial and benefit consulting services; BPAS Trust Company of Puerto Rico, a Puerto Rican trust company; and Hand Benefits & Trust Company (“HB&T”), a provider of collective investment fund administration and institutional trust services. NRS owns one subsidiary, Global Trust Company, Inc. (“GTC”), a non-depository trust company which provides fiduciary services for collective investment trusts and other products. HB&T owns one subsidiary, Hand Securities, Inc. (“HSI”), an introducing broker-dealer. The Company also wholly-owns three unconsolidated subsidiary business trusts formed for the purpose of issuing mandatorily-redeemable preferred securities which are considered Tier I capital under regulatory capital adequacy guidelines.

The Bank’s business philosophy is to operate as a diversified financial services enterprise providing a broad array of banking and other financial services to retail, commercial and municipal customers. As of December 31, 2017, the Bank operates 225 full-service branches operating as Community Bank, N.A. throughout 35 counties of Upstate New York, six counties of Northeastern Pennsylvania, 12 counties of Vermont and one county of Western Massachusetts, offering a range of commercial and retail banking services. The Bank owns the following operating subsidiaries: The Carta Group, Inc. (“Carta Group”), CBNA Preferred Funding Corporation (“PFC”), CBNA Treasury Management Corporation (“TMC”), Community Investment Services, Inc. (“CISI”), NOTCH Investment Fund, LLC (“NOTCH”), Nottingham Advisors, Inc. (“Nottingham”), OneGroup NY, Inc. (“OneGroup”), and Oneida Preferred Funding II LLC (“OPFC II”). OneGroup is a full-service insurance agency offering personal and commercial property insurance and other risk management products and services. NOTCH, PFC and OPFC II primarily act as investors in residential and commercial real estate activities. TMC provides cash management, investment, and treasury services to the Bank. CISI and Carta Group provide broker-dealer and investment advisory services. Nottingham provides asset management services to individuals, corporations, corporate pension and profit sharing plans, and foundations.

The Company maintains a website at communitybankna.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information posted on the website is not incorporated into or a part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at https://www.sec.gov.

Acquisition History (2013-2017)

Gordon B. Roberts Agency, Inc.

On December 4, 2017, the Company, through its subsidiary, OneGroup, completed its acquisition of Gordon B. Roberts Agency, Inc. (“GBR”), an insurance agency headquartered in Oneonta, New York for $3.7 million in Company stock and cash, comprised of $1.35 million in cash and the issuance of 0.04 million shares of common stock. The transaction resulted in the acquisition of $0.6 million of assets, $0.7 million of other liabilities, goodwill in the amount of $2.2 million and other intangible assets of $1.6 million.

Northeast Capital Management, Inc.

On November 17, 2017, the Company, through its subsidiary, CISI, completed its acquisition of certain assets of Northeast Capital Management, Inc. (“NECM”), a financial services business headquartered in Wilkes Barre, Pennsylvania. The Company agreed to pay $1.2 million in cash, including a $0.2 million contingent payment based on certain customer retention objectives, to acquire a customer list from NECM, and recorded a $1.2 million customer list intangible asset in conjunction with the acquisition.

Table of Contents

Merchants Bancshares, Inc.

On May 12, 2017, the Company completed its acquisition of Merchants Bancshares, Inc. (“Merchants”), parent company of Merchants Bank headquartered in South Burlington, Vermont, for $345.2 million in Company stock and cash, comprised of $82.9 million in cash and the issuance of 4.68 million shares of common stock. The acquisition extends the Company’s footprint into the Vermont and Western Massachusetts markets with the addition of 31 branch locations in Vermont and one location in Massachusetts. This transaction resulted in the acquisition of $2.0 billion of assets, including $1.49 billion of loans and $370.6 million of investment securities, as well as $1.45 billion of deposits and $189.0 million in goodwill.

Dryfoos Insurance Agency, Inc.

On March 1, 2017, the Company, through its subsidiary, OneGroup, completed its acquisition of certain assets of Dryfoos Insurance Agency, Inc. (“Dryfoos”), an insurance agency headquartered in Hazleton, Pennsylvania. The Company paid $3.0 million in cash to acquire the assets of Dryfoos, and recorded goodwill in the amount of $1.7 million and other intangible assets of $1.7 million in conjunction with the acquisition.

Northeast Retirement Services, Inc.

On February 3, 2017, the Company completed its acquisition of Northeast Retirement Services, Inc. (“NRS”) and its subsidiary Global Trust Company, Inc. (“GTC”), headquartered in Woburn, Massachusetts, for $148.6 million in Company stock and cash. NRS was a privately held corporation focused on providing institutional transfer agency, master recordkeeping services, custom target date fund administration, trust product administration and customized reporting services to institutional clients. Its wholly-owned subsidiary, GTC, is chartered in the State of Maine as a non-depository trust company and provides fiduciary services for collective investment trusts and other products. The acquisition of NRS and GTC, hereafter referred to collectively as NRS, will strengthen and complement the Company’s existing employee benefit services businesses. Upon the completion of the merger, NRS became a wholly-owned subsidiary of BPAS and operates as Northeast Retirement Services, LLC, a Delaware limited liability company. This transaction resulted in the acquisition of $36.1 million in net tangible assets, principally cash and certificates of deposit, $60.2 million in customer list intangibles that will be amortized over 10 years, the creation of a $24.2 million deferred tax liability associated with the customer list intangible and $76.4 million in goodwill.

Benefits Advisory Service, Inc.

On January 1, 2017, the Company, through its subsidiary, OneGroup, acquired certain assets of Benefits Advisory Service, Inc. (“BAS”), a benefits consulting group headquartered in Forest Hills, New York. The Company paid $1.2 million in cash to acquire the assets of BAS and recorded intangible assets of $1.2 million in conjunction with the acquisition.

WJL Agencies, Inc.

On January 4, 2016, the Company, through its subsidiary, CBNA Insurance Agency, Inc., completed its acquisition of WJL Agencies, Inc. doing business as The Clark Insurance Agencies (“WJL”), an insurance agency operating in Canton, New York. The Company paid $0.6 million in cash for the intangible assets of the company. Goodwill in the amount of $0.3 million and intangible assets in the amount of $0.3 million were recorded in conjunction with the acquisition. The effects of the acquired assets and liabilities have been included in the consolidated financial statements since that date. On August 19, 2016, the Company merged together its insurance subsidiaries and as of that date, CBNA Insurance Agency, Inc. was merged into OneGroup.

Oneida Financial Corp.

On December 4, 2015, the Company completed its acquisition of Oneida Financial Corp. (“Oneida”), parent company of Oneida Savings Bank, headquartered in Oneida, New York for $158.5 million in Company stock and cash, comprised of $56.3 million of cash and the issuance of 2.38 million common shares. Upon the completion of the merger, the Bank added 12 branch locations in Oneida and Madison counties and approximately $769.4 million of assets, including approximately $399.4 million of loans and $225.7 million of investment securities, along with $699.2 million of deposits. Through the acquisition of Oneida, the Company acquired OneGroup and Oneida Wealth Management, Inc. (“OWM”) as wholly-owned subsidiaries primarily engaged in offering insurance and investment advisory services. These subsidiaries complement the Company’s other non-banking financial services businesses. The effects of the acquired assets and liabilities have been included in the consolidated financial statements since that date. On April 22, 2016, the activities of OWM were merged into CISI.

EBS-RMSCO, Inc.

On January 1, 2014, BPAS-APS, formerly known as Harbridge Consulting Group LLC, completed its acquisition of a professional services practice from EBS-RMSCO, Inc., a subsidiary of The Lifetime Healthcare Companies (“EBS-RMSCO”). This professional services practice, which provides actuarial valuation and consulting services to clients who sponsor pension and post-retirement medical and welfare plans, enhanced the Company’s participation in the Western New York marketplace.

Table of Contents

Bank of America Branches

On December 13, 2013, the Bank completed its acquisition of eight retail branch-banking locations across its Northeast Pennsylvania markets from Bank of America, N.A. (“B of A”), acquiring approximately $1.1 million in loans and $303 million of deposits. The assumed deposits consisted of $220 million of checking, savings and money market accounts (“core deposits”) and $83 million of time deposits. Under the terms of the purchase agreement, the Bank paid B of A a blended deposit premium of 2.4%, or approximately $7.3 million.

Services

Banking

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank's branches are generally located in smaller towns and cities within its geographic market areas of Upstate New York, Northeastern Pennsylvania, Vermont and Western Massachusetts. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch and regional levels, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System (“FRB”), the Federal Home Loan Bank of New York and the Federal Home Loan Bank of Boston (collectively referred to as “FHLB”), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Employee Benefit Services

Through BPAS and its subsidiaries, the Company operates a national practice that provides employee benefit trust, collective investment fund, retirement plan administration, fund administration, transfer agency, actuarial, VEBA/HRA and health and welfare consulting services to a diverse array of clients spanning the United States and Puerto Rico.

Wealth Management

Through the Bank, CISI, Carta Group, and Nottingham, the Company provides wealth management, retirement planning, higher educational planning, fiduciary, risk management, and personal financial planning services. The Company offers investment alternatives including stocks, bonds, mutual funds and advisory products.

Insurance Agency

Through OneGroup, the Company offers personal and commercial property insurance and other risk management products and services. In addition, OneGroup offers employee benefit related services. OneGroup represents many leading insurance companies.

Segment Information

The Company has identified three reportable operating business segments: Banking, Employee Benefit Services, and All Other. Included in the All Other segment are the smaller Wealth Management and Insurance operations. Information about the Company’s reportable business segments is included in Note U of the “Notes to Consolidated Financial Statements” filed herewith in Part II.

Competition

The banking and financial services industry is highly competitive in the New York, Pennsylvania, Vermont and Massachusetts markets. The Company competes actively for loans, deposits and customers with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, insurance agencies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The table below summarizes the Bank’s deposits and market share by the fifty-four counties of New York, Pennsylvania, Vermont, and Massachusetts in which it has customer facilities. Market share is based on deposits of all commercial banks, credit unions, savings and loan associations, and savings banks.

Table of Contents

Number of County State Deposits as of 6/30/2017(1) (000's omitted) Market Share(1) Branches ATM's Towns/ Cities Towns Where Company Has 1st or 2nd Market Position Grand Isle VT $ 36,796 100.00 % 1 1 1 1 Lewis NY 192,249 74.29 % 4 4 3 3 Hamilton NY 55,239 55.34 % 2 2 2 2 Franklin NY 336,499 53.36 % 6 6 5 5 Madison NY 456,572 51.84 % 8 8 5 5 Allegany NY 271,725 45.18 % 9 10 8 8 Cattaraugus NY 415,657 32.81 % 10 11 7 6 Otsego NY 362,180 32.04 % 10 9 6 5 Saint Lawrence NY 476,376 25.80 % 13 12 11 10 Yates NY 99,850 25.41 % 3 2 2 1 Schuyler NY 51,187 25.19 % 1 1 1 1 Seneca NY 120,754 24.95 % 4 3 4 3 Jefferson NY 468,133 24.93 % 7 9 6 6 Clinton NY 377,479 23.23 % 4 7 2 2 Wyoming PA 137,114 22.03 % 4 4 4 3 Livingston NY 179,165 19.78 % 5 6 5 4 Chautauqua NY 363,774 19.12 % 12 12 10 7 Orange VT 55,309 16.25 % 2 2 2 2 Essex NY 128,899 15.83 % 5 5 4 3 Oswego NY 197,101 14.09 % 4 5 4 3 Addison VT 62,944 10.63 % 2 2 2 2 Ontario NY 236,981 10.59 % 8 14 5 3 Caledonia VT 66,903 10.59 % 2 2 2 1 Wayne NY 133,558 10.56 % 3 4 2 2 Bennington VT 86,313 9.94 % 2 4 2 0 Delaware NY 139,908 9.91 % 5 5 5 4 Chittenden VT 605,611 9.35 % 9 10 6 4 Franklin VT 54,992 8.96 % 2 2 2 1 Tioga NY 37,851 8.41 % 2 2 2 1 Rutland VT 112,866 7.88 % 3 3 2 1 Herkimer NY 50,229 7.25 % 1 1 1 1 Luzerne PA 469,025 6.95 % 10 13 8 4 Chemung NY 74,840 6.90 % 2 2 1 0 Lackawanna PA 408,991 6.78 % 11 11 8 4 Susquehanna PA 57,053 6.66 % 3 1 3 2 Steuben NY 187,442 6.24 % 8 9 7 3 Lamoille VT 33,262 6.06 % 1 1 1 1 Windham VT 51,762 5.00 % 2 3 2 1 Schoharie NY 22,118 4.84 % 1 1 1 0 Oneida NY 274,408 4.65 % 7 7 6 3 Windsor VT 56,183 4.24 % 2 1 2 0 Carbon PA 42,135 4.23 % 2 2 2 1 Washington VT 94,345 4.07 % 3 5 3 1 Bradford PA 45,572 3.67 % 2 2 2 1 Cayuga NY 43,074 3.63 % 2 2 2 1 Washington NY 18,695 2.43 % 1 0 1 1 Chenango NY 22,484 2.33 % 2 2 1 0 Warren NY 35,089 1.94 % 1 1 1 1 Onondaga NY 131,119 1.02 % 4 4 4 0 Ulster NY 30,749 0.74 % 1 1 1 1 Broome NY 34,418 0.56 % 1 1 1 0 Hampden MA 66,362 0.53 % 1 1 1 0 Erie NY 129,259 0.32 % 4 4 3 2 Tompkins NY 5,019 0.17 % 1 0 1 0 $ 8,703,618 5.85 % 225 242 185 127

(1) Deposits and Market Share data as of June 30, 2017, the most recent information available from SNL Financial LLC. Deposit amounts include $78.0 million of intercompany balances that are eliminated upon consolidation.

Table of Contents

Employees

As of December 31, 2017, the Company employed 2,600 full-time employees, 135 part-time employees and 139 temporary employees. None of the Company’s employees are represented by a collective bargaining agreement. The Company offers a variety of employment benefits and considers its relationship with its employees to be good.

Supervision and Regulation

General

The banking industry is highly regulated with numerous statutory and regulatory requirements that are designed primarily for the protection of depositors and the financial system, and not for the purpose of protecting shareholders. Set forth below is a description of the material laws and regulations applicable to the Company and the Bank. This summary is not complete and the reader should refer to these laws and regulations for more detailed information. The Company’s and the Bank’s failure to comply with applicable laws and regulations could result in a range of sanctions and administrative actions imposed upon the Company and/or the Bank, including the imposition of civil money penalties, formal agreements and cease and desist orders. Changes in applicable law or regulations, and in their interpretation and application by regulatory agencies, cannot be predicted, and may have a material effect on the Company’s business and results.

The Company and its subsidiaries are subject to the laws and regulations of the federal government and the states and jurisdictions in which they conduct business. The Company, as a bank holding company, is subject to extensive regulation, supervision and examination by the Board of Governors of the Federal Reserve System (“FRB”) as its primary federal regulator. The Bank is a nationally-chartered bank and is subject to extensive regulation, supervision and examination by the Office of the Comptroller of the Currency (“OCC”) as its primary federal regulator, and as to certain matters, the FRB, the Consumer Financial Protection Bureau (“CFPB”), and the Federal Deposit Insurance Corporation (“FDIC”).

The Company is also subject to the jurisdiction of the SEC and is subject to disclosure and regulatory requirements under the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended. The Company’s common stock is listed on the New York Stock Exchange (“NYSE”) and it is subject to NYSE’s rules for listed companies. Affiliated entities, including BPAS, NRS, HB&T, HSI, BPAS Trust Company of Puerto Rico, Nottingham, CISI, OneGroup, and Carta Group are subject to the jurisdiction of certain state and federal regulators and self-regulatory organizations including, but not limited to, the SEC, the Texas Department of Banking, the State of Maine Bureau of Financial Institutions, the Financial Industry Regulatory Authority (“FINRA”), Puerto Rico Office of the Commissioner of Financial Institutions, and state securities and insurance regulators.

The Company, the Bank, and their respective subsidiaries may be subject to the laws and regulations of the federal government and/or the various states in which they conduct business.

Federal Bank Holding Company Regulation

The Company was a bank holding company under the Bank Holding Company Act of 1956, (the “BHC Act”), and became a financial holding company effective September 30, 2015. As a bank holding company that has elected to become a financial holding company, the Company can affiliate with securities firms and insurance companies and engage in other activities that are “financial in nature” or “incidental” or “complementary” to activities that are financial in nature, as long as it continues to meet the eligibility requirements for financial holding companies (including requirements that the financial holding company and its depository institution subsidiary maintain their status as “well capitalized” and “well managed”).

Generally, FRB approval is not required for the Company to acquire a company (other than a bank holding company, bank or savings association) engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the FRB. Prior notice to the FRB may be required, however, if the company to be acquired has total consolidated assets of $10 billion or more. Prior FRB approval is required before the Company may acquire the beneficial ownership or control of more than 5% of the voting shares or substantially all of the assets of a bank holding company, bank or savings association.

Because the Company is a financial holding company, if the Bank were to receive a rating under the Community Reinvestment Act of 1977, as amended (“CRA”), of less than Satisfactory, the Company will be prohibited, until the rating is raised to Satisfactory or better, from engaging in new activities or acquiring companies other than bank holding companies, banks or savings associations, except that the Company could engage in new activities, or acquire companies engaged in activities, that are considered “closely related to banking” under the BHC Act. In addition, if the FRB determines that the Company or the Bank is not well capitalized or well managed, the Company would be required to enter into an agreement with the FRB to comply with all applicable capital and management requirements and may contain additional limitations or conditions. Until corrected, the Company could be prohibited from engaging in any new activity or acquiring companies engaged in activities that are not closely related to banking, absent prior FRB approval.

Table of Contents

Federal Reserve System Regulation

Because the Company is a financial holding company, it is subject to regulatory capital requirements and required by the FRB to, among other things, maintain cash reserves against its deposits. The Bank is under similar capital requirements administered by the OCC as discussed below. FRB policy has historically required a financial holding company to act as a source of financial and managerial strength to its subsidiary banks. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) codifies this historical policy as a statutory requirement. To the extent the Bank is in need of capital, the Company could be expected to provide additional capital, including borrowings from the FRB for such purpose. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors’ funds.

The FRB also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the FRB, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust our strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond our control.

The Office of Comptroller of the Currency Regulation

The Bank is supervised and regularly examined by the OCC. The various laws and regulations administered by the OCC affect the Company’s practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects the Bank’s business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and the location of its offices. The OCC generally prohibits a depository institution from making any capital distributions, including the payment of a dividend, or paying any management fee to its parent holding company if the depository institution would become undercapitalized due to the payment. Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the OCC. The Bank is well capitalized under regulatory standards administered by the OCC. For additional information on our capital requirements see “Management’s Discussion and Analysis of Financial Condition and Results of Operations – Shareholders’ Equity” and Note P to the Financial Statements.

Federal Home Loan Bank

The Bank is a member of the FHLB, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to the rules and requirements of the FHLB, including the purchase of shares of FHLB activity-based stock in the amount of 4.5% of the dollar amount of outstanding advances and FHLB capital stock in an amount equal to the greater of $1,000 or the sum of 0.15% of the mortgage-related assets held by the Bank based upon the previous year-end financial information. The Bank was in compliance with the rules and requirements of the FHLB at December 31, 2017.

Deposit Insurance

Deposits of the Bank are insured up to the applicable limits by the Deposit Insurance Fund (“DIF”) and are subject to deposit insurance assessments to maintain the DIF. The Dodd-Frank Act permanently increased the maximum amount of deposit insurance to $250,000 per deposit category, per depositor, per institution. A depository institution’s DIF assessment is calculated by multiplying its assessment rate by the assessment base, which is defined as the average consolidated total assets less the average tangible equity of the depository institution. The initial base assessment rate is based on its capital level and supervisory ratings (its “CAMELS ratings”), certain financial measures to assess an institution’s ability to withstand asset related stress and funding related stress and, in some cases, additional discretionary adjustments by the FDIC to reflect additional risk factors. The Bank’s adjusted average consolidated total assets for 4 consecutive quarters will exceed $10.0 billion in 2018, which will result in a deposit insurance assessment based on a large institution classification, rather than the small institution classification for years prior to 2018.

For large insured depository institutions, generally defined as those with at least $10 billion in total assets, the FDIC has eliminated risk categories when calculating the initial base assessment rates and now combine CAMELS ratings and financial measures into two scorecards to calculate assessment rates, one for most large insured depository institutions and another for highly complex insured depository institutions (which are generally those with more than $50 billion in total assets that are controlled by a parent company with more than $500 billion in total assets). Each scorecard has two components - a performance score and loss severity score, which are combined and converted to an initial assessment rate. The FDIC has the ability to adjust a large or highly complex insured depository institution’s total score by a maximum of 15 points, up or down, based upon significant risk factors that are not captured by the scorecard. Under the current assessment rate schedule, the initial base assessment rate for large and highly complex insured depository institutions ranges from three to 30 basis points, and the total base assessment rate, after applying the unsecured debt and brokered deposit adjustments, ranges from one and one-half to 40 basis points.

Table of Contents

In October 2010, the FDIC adopted a DIF restoration plan to ensure that the fund reserve ratio reaches 1.35% by September 30, 2020, as required by the Dodd-Frank Act. At least semi-annually, the FDIC will update its loss and income projections for the fund and, if needed, will increase or decrease assessment rates, following notice-and-comment rulemaking if required. On June 30, 2016, the fund reserve ratio reached 1.15% and the assessment rate schedule was lowered. FDIC insurance expense totaled $3.5 million, $3.7 million and $4.0 million in 2017, 2016 and 2015, respectively.

Under the Federal Deposit Insurance Act, if the FDIC finds that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, the FDIC may determine that such violation or unsafe or unsound practice or condition require the termination of deposit insurance.

Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

On July 21, 2010, the Dodd-Frank Act was signed into law, which resulted in significant changes to the banking industry. The Dodd-Frank Act contains numerous provisions that affect all banks and bank holding companies and impacts how the Company and the Bank handle their operations. The Dodd-Frank Act requires various federal agencies, including those that regulate the Company and the Bank, to promulgate new rules and regulations and to conduct various studies and reports for Congress. The federal agencies have either completed or are in the process of completing these rules and regulations and have been given significant discretion in drafting such rules and regulations. Several of the provisions of the Dodd-Frank Act may have the consequence of increasing the Bank’s expenses, decreasing its revenues, and changing the activities in which it chooses to engage. The specific impact of the Dodd-Frank Act on the Company’s current activities or new financial activities the Company may consider in the future, the Company’s financial performance, and the markets in which the Company operates depends on the manner in which the relevant agencies continue to develop and implement the required rules and regulations and the reaction of market participants to these regulatory developments.

Pursuant to FRB regulations mandated by the Dodd-Frank Act, interchange fees on debit card transactions are limited to a maximum of $0.21 per transaction plus 5 basis points of the transaction amount. A debit card issuer may recover an additional one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements prescribed by the FRB. The Company has been exempt from the interchange fee cap under the "small issuer" exemption, which applies to any debit card issuer with total worldwide assets (including those of its affiliates) of less than $10 billion as of the end of the previous calendar year. However, the Company had $10.7 billion in assets as of December 31, 2017, and will become subject to the interchange fee limitations beginning July 1, 2018. As such, the fees the Company may receive for an electronic debit transaction will be capped at the statutory limit. The FRB also adopted requirements in the final rule that issuers include two unaffiliated networks for routing debit transactions that are applicable to the Company and the Bank.

The Dodd-Frank Act established the CFPB and empowered it to exercise broad rulemaking, supervision, and enforcement authority for a wide range of consumer protection laws. Since the Company’s total consolidated assets exceeded $10 billion during the second quarter of 2018, the Company will now be subject to the direct supervision of the CFPB. The CFPB has issued and continues to issue numerous regulations under which the Company and the Bank will continue to incur additional expense in connection with its ongoing compliance obligations. Significant recent CFPB developments that may affect operations and compliance costs include:

· positions taken by the CFPB on fair lending, including applying the disparate impact theory which could make it more difficult for lenders to charge different rates or to apply different terms to loans to different customers;

· the CFPB’s final rule amending Regulation C, which implements the Home Mortgage Disclosure Act, requiring most lenders to report expanded information in order for the CFPB to more effectively monitor fair lending concerns and other information shortcomings identified by the CFPB;

· positions taken by the CFPB regarding the Electronic Fund Transfer Act and Regulation E, which require companies to obtain customer authorizations before automatically debiting a consumer’s account for pre-authorized electronic funds transfers; and

· focused efforts on enforcing certain compliance obligations the CFPB deems a priority, such as automobile loan servicing, debt collection, mortgage origination and servicing, remittances, and fair lending, among others.

The final rules issued by the FRB, SEC, OCC, FDIC, and Commodity Futures Trading Commission implementing Section 619 of the Dodd-Frank Act (commonly known as the Volcker Rule) prohibit insured depository institutions and companies affiliated with insured depository institutions from engaging in short-term proprietary trading of certain securities, derivatives, commodity futures and options on these instruments, for their own account. The final rules also impose limits on banking entities’ investments in, and other relationships with, hedge funds or private equity funds.

Table of Contents

The scope and impact of many of the Dodd-Frank Act’s provisions will continue to be determined over time, including as final regulations are issued and become effective. As a result, the Company cannot predict the ultimate impact of the Dodd-Frank Act on the Company or the Bank at this time, including the extent to which it could increase costs or limit the Company’s ability to pursue business opportunities in an efficient manner, or otherwise adversely affect its business, financial condition and results of operations. Nor can the Company predict the impact or substance of other future legislation or regulation. However, it is expected that future legislation or regulation at a minimum will increase the Company’s and the Bank’s operating and compliance costs. As rules and regulations continue to be implemented or issued, the Company may need to dedicate additional resources to ensure compliance, which may increase its costs of operations and adversely impact its earnings.

Capital Requirements

The Company and the Bank are required to comply with applicable capital adequacy standards established by the federal banking agencies. The risk-based capital standards that were applicable to the Company and the Bank through December 31, 2014 were based on the 1988 Capital Accord, known as Basel I (“Basel I”), of the Basel Committee on Banking Supervision (the “Basel Committee”). However, in July 2013, the FRB, the OCC and the FDIC approved final rules (the “New Capital Rules”) establishing a new comprehensive capital framework for U.S. banking organizations. These rules went into effect for the Company and the Bank on January 1, 2015, subject to phase-in periods for certain components.

The New Capital Rules implement the Basel Committee’s December 2010 capital framework (known as “Basel III”) for strengthening international capital standards as well as certain provisions of the Dodd-Frank Act. The New Capital Rules substantially revise the risk-based capital requirements applicable to bank holding companies and depository institutions, including the Company and the Bank, compared to the previous U. S. Basel I risk-based capital rules. The New Capital Rules define the components of capital and address other issues affecting the numerator in banking institutions regulatory capital ratios and replace the Basel I risk-weighting approach, with a more risk-sensitive one, based in part, on the standardized approach set forth in “Basel II”. The New Capital Rules also implement the requirements of Section 939A of the Dodd-Frank Act to remove references to credit ratings from the Federal banking agencies’ rules.

The New Capital Rules, among other things: (i) introduces as a new capital measure “Common Equity Tier 1,” (“CET1”), (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting specified revised requirements, (iii) defines CET1 narrowly by requiring that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital, and (iv) expands the scope of the deductions from and adjustments to capital as compared to existing regulations. Under the New Capital Rules, the most common form of Additional Tier 1 capital is non-cumulative perpetual preferred stock, and the most common form of Tier 2 capital is subordinated notes and a portion of the allowance for loan and lease losses, in each case, subject to the New Capital Rules specific requirements.

Under the New Capital Rules, the minimum capital ratios as of January 1, 2015 are as follows:

· 4.5% CET1 to total risk-weighted assets;

· 6.0% Tier 1 capital (CET1 plus Additional Tier 1 capital) to total risk-weighted assets;

· 8.0% Total capital (Tier 1 Capital plus Tier 2 capital) to total risk-weighted assets;

· 4.0% Tier 1 capital to total adjusted quarterly average assets (known as “leverage ratio”)

Beginning in 2016, the New Capital Rules required the Company and the Bank to maintain a “capital conservation buffer” composed entirely of CET1. When it is fully phased-in by the beginning of 2019, banking organizations will be required to maintain a minimum capital conservation buffer of 2.5% (CET1 to Total risk-weighted assets), in addition to the minimum risk-based capital ratios. Therefore, to satisfy both the minimum risk-based capital ratios and the capital conservation buffer, a banking organization will be required to maintain the following: (i) CET1 to total risk-weighted assets of at least 7%, (ii) Tier 1 capital to total risk-weighted assets of at least 8.5%, and (iii) Total capital (Tier 1 capital plus Tier 2 capital) to total risk-weighted assets of at least 10.5% by January 1, 2019, upon full phase-in of the capital conservation buffer. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions that do not maintain a capital conservation buffer of 2.5% or more will face constraints on dividends, common share repurchases and incentive compensation based on the amount of the shortfall.

The New Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, deferred tax assets dependent upon future taxable income and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. Under the general Basel I risk-based capital rules, the effects of accumulated other comprehensive income or loss items included in shareholders' equity (for example, marks-to-market of securities held in the available for sale portfolio) were reversed for the purposes of determining regulatory capital. Under the New Capital Rules, the effects of certain accumulated other comprehensive income or loss items are not excluded; however, banks not using the advanced approach, including the Company and the Bank, were permitted to, and in the case of the Company and the Bank they did, make a one-time permanent election to continue to exclude these items.

Table of Contents

Consistent with the section 171 of the Dodd-Frank Act, the New Capital Rules allow certain bank holding companies to include certain hybrid securities, such as trust preferred securities, in Tier 1 capital if they had less than $15 billion in assets as of December 31, 2009 and the securities were issued before May 19, 2010. Accordingly, the trust preferred securities classified as long-term debt on the Company’s balance sheet will be included as Tier 1 capital while they are outstanding, unless the Company completes an acquisition of a depository institution holding company that did not meet this criteria, or are acquired by such an organization, after January 1, 2014, at which time they would be subject to the stated phase-out requirements of the New Capital Rules and would be included as Tier 2 capital.

Implementation of the deductions and other adjustments to CET1 began on January 1, 2015 and will be phased-in over a 4-year period (beginning at 40% on January 1, 2015 and an additional 20% per year thereafter). The implementation of the capital conservation buffer began on January 1, 2016 at the 0.625% level and will be phased in over a four-year period (increasing by that amount on each subsequent January 1, until it reaches 2.5% on January 1, 2019).

With respect to the Bank, the New Capital Rules also revise the prompt corrective action (“PCA”) regulations established pursuant to Section 38 of the Federal Deposit Insurance Act, by (i) introducing a CET1 ratio requirement for each capital category other than critically undercapitalized, with the required CET1 ratio being 6.5% for well-capitalized status; (ii) increasing the minimum Tier 1 capital ratio requirement for each capital category, with the minimum Tier 1 capital ratio for well-capitalized status being 8.0%; and (iii) eliminating the current provision that allows certain highly-rated banking organizations to maintain a 3.0% leverage ratio and still be adequately capitalized. The New Capital Rules do not change the Total risk-based PCA capital requirement for any capital category.

The New Capital Rules prescribe a new standardized approach for risk weighted-assets that expands the risk-weight categories from the current four Basel I-derived categories (0%, 20%, 50% and 100%) to a larger and more risk-sensitive number of categories, depending on the nature of the asset. The new risk-weight categories generally range from 0% for U.S. government and agency securities, to 1,250% for certain securitized exposures, and result in higher risk weights for a variety of asset categories. The standardized approach requires financial institutions to transition assets that are 90 days or more past due or on nonaccrual from their original risk weight to 150 percent. Additionally, loans designated as high volatility commercial real estate (“HVCRE”) are assigned a risk-weighting of 150 percent.

Requirements to maintain higher levels of capital or to maintain higher levels of liquid assets could adversely impact the Company's net income and return on equity. The current requirements and the Company's actual capital levels are detailed in Note P of “Notes to Consolidated Financial Statements” filed in Part II, Item 8, “Financial Statements and Supplementary Data.”

Consumer Protection Laws

In connection with its banking activities, the Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending to various sectors of the economy. These laws include the Equal Credit Opportunity Act, the Gramm-Leach-Bliley Act (“GLB Act”), the Fair Credit Reporting Act (“FCRA”), the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”), Electronic Funds Transfer Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Dodd-Frank Act, the Real Estate Settlement Procedures Act, the Secure and Fair Enforcement for Mortgage Licensing Act (“SAFE”), and various state law counterparts.

The Dodd-Frank Act created the CFPB with broad powers to supervise and enforce consumer protection laws, including laws that apply to banks in order to prohibit unfair, deceptive or abusive practices. The CFPB has examination authority over all banks and savings institutions with more than $10 billion in assets. The Dodd-Frank Act weakens the federal preemption rules that have been applicable to national banks and gives attorney generals for the states certain powers to enforce federal consumer protection laws. Further, under the Dodd-Frank Act, it is unlawful for any provider of consumer financial products or services to engage in any unfair, deceptive, or abusive acts or practice (“UDAAP”). A violation of the consumer protection and privacy laws, and in particular UDAAP, could have serious legal, financial, and reputational consequences.

In addition, the GLB Act requires all financial institutions to adopt privacy policies, restrict the sharing of nonpublic customer data with nonaffiliated parties and establishes procedures and practices to protect customer data from unauthorized access. In addition, the FCRA, as amended by the FACT Act, includes provisions affecting the Company, the Bank, and their affiliates, including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. The FACT Act requires persons subject to FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the Federal Trade Commission have extensive rulemaking authority under the FACT Act, and the Company and the Bank are subject to the rules that have been created under the FACT Act, including rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate certain identity theft red flags. The Bank is also subject to data security standards and data breach notice requirements issued by the OCC and other regulatory agencies. The Bank has created policies and procedures to comply with these consumer protection requirements.

Table of Contents

The CFPB issued the final rules implementing the ability-to-repay and qualified mortgage (QM) provisions of the Truth in Lending Act, as amended by the Dodd-Frank Act (the “QM Rule”). The ability-to-repay provision requires creditors to make reasonable, good faith determinations that borrowers are able to repay their mortgages before extending the credit based on a number of factors and consideration of financial information about the borrower derived from reasonably reliable third-party documents. Under the Dodd-Frank Act and the QM Rule, loans meeting the definition of “qualified mortgage” are entitled to a presumption that the lender satisfied the ability-to-repay requirements. The presumption is a conclusive presumption/safe harbor for loans meeting the QM requirements, and a rebuttable presumption for higher-priced loans meeting the QM requirements. The definition of a “qualified mortgage” incorporates the statutory requirements, such as not allowing negative amortization or terms longer than 30 years. The QM Rule also adds an explicit maximum 43% debt-to-income ratio for borrowers if the loan is to meet the QM definition, though some mortgages that meet government-sponsored enterprises, Federal Housing Administration, and Veterans Administration underwriting guidelines may, for a period not to exceed seven years, meet the QM definition without being subject to the 43% debt-to-income limits. The Bank has created policies and procedures to comply with these consumer protection requirements.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The USA Patriot Act also encourages information-sharing among financial institutions, regulators, and law enforcement authorities by providing an exemption from the privacy provisions of the GLB Act for financial institutions that comply with the provision of the Act. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the institution. The Company has approved policies and procedures that are designed to comply with the USA Patriot Act and its regulations.

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others administrated by the Treasury’s Office of Foreign Assets Control (“OFAC”). The OFAC administered sanctions can take many different forms; however, they generally contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, entity or individual, including prohibitions against direct or indirect imports and exports and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments, or providing investment related advice or assistance; and (ii) a blocking of assets in which the government or specially designated nationals have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934, as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) new requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) additional responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) the creation of an independent accounting oversight board for the accounting industry; (iv) new standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on non-preferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violations of the securities laws.

Electronic Fund Transfer Act

A federal banking rule under the Electronic Fund Transfer Act prohibits financial institutions from charging consumers fees for paying overdrafts on automated teller machines and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions. The new rule does not govern overdraft fees on the payment of checks and certain other forms of bill payments.

Table of Contents

Community Reinvestment Act of 1977

Under the Community Reinvestment Act of 1977 (“CRA”), the Bank is required to help meet the credit needs of its communities, including low- and moderate-income neighborhoods. Although the Bank must follow the requirements of CRA, it does not limit the Bank’s discretion to develop products and services that are suitable for a particular community or establish lending requirements or programs. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibits discrimination in lending practices. The Bank’s failure to comply with the provisions of the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s failure to comply with the Equal Credit Opportunity Act and the Fair Housing Act could result in enforcement actions against it by its regulators as well as other federal regulatory agencies and the Department of Justice. The Bank’s latest CRA rating was “Satisfactory”.

The Bank Secrecy Act

The Bank Secrecy Act (“BSA”) requires all financial institutions, including banks and securities broker-dealers, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. The BSA includes a variety of recordkeeping and reporting requirements (such as cash and suspicious activity reporting), as well as due diligence/know-your-customer documentation requirements. The Company has established an anti-money laundering program and taken other appropriate measures in order to comply with BSA requirements.

Community Bank System, Inc. (the "Company") was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company is a registered financial holding company which wholly-owns two significant subsidiaries: Community Bank, N.A. (the "Bank" or "CBNA"), and Benefit Plans Administrative Services, Inc. ("BPAS"). As of December 31, 2016, BPAS owns four subsidiaries: Benefit Plans Administrative Services, LLC ("BPA"), a provider of defined contribution plan administration services; BPAS Actuarial & Pension Services, LLC ("BPAS-APS") (formally known as Harbridge Consulting Group, LLC), a provider of actuarial and benefit consulting services; BPAS Trust Company of Puerto Rico, a Puerto Rican trust company; and Hand Benefits & Trust Company ("HB&T"), a provider of collective investment fund administration and institutional trust services. HB&T owns one subsidiary, Hand Securities, Inc. ("HSI"), an introducing broker-dealer. The Company also wholly-owns two unconsolidated subsidiary business trusts formed for the purpose of issuing mandatorily-redeemable preferred securities which are considered Tier I capital under regulatory capital adequacy guidelines.

The Bank's business philosophy is to operate as a community bank with local decision-making, principally in non-metropolitan markets, providing a broad array of banking and financial services to retail, commercial, and municipal customers. As of December 31, 2016, the Bank operates 193 full-service branches operating as Community Bank, N.A. throughout 35 counties of Upstate New York and six counties of Northeastern Pennsylvania, offering a range of commercial and retail banking services. The Bank owns the following operating subsidiaries: The Carta Group, Inc. ("Carta Group"), CBNA Preferred Funding Corporation ("PFC"), CBNA Treasury Management Corporation ("TMC"), Community Investment Services, Inc. ("CISI"), Nottingham Advisors, Inc. ("Nottingham"), OneGroup NY, Inc. ("OneGroup"), Oneida Wealth Management, Inc. ("OWM") and Oneida Preferred Funding II LLC ("OPFCII"). OneGroup is a full-service insurance agency offering personal and commercial property insurance and other risk management products and services. On August 19, 2016, the Company merged its insurance subsidiary CBNA Insurance Agency, Inc. ("CBNA Insurance") into OneGroup. PFC and OPFCII primarily act as investors in residential real estate loans and properties. TMC provides cash management, investment, and treasury services to the Bank. CISI, The Carta Group and OWM provide broker-dealer and investment advisory services. On April 22, 2016, the Company merged the activities of OWM into CISI. Nottingham provides asset management services to individuals, corporations, corporate pension and profit sharing plans, and foundations.

The Company maintains a website at communitybankna.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports, are available on the Company's website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission ("SEC"). The information posted on the website is not incorporated into or a part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC's Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC's website at https://www.sec.gov.

Acquisition History (2012-2016)

Northeast Retirement Services, Inc.

On December 5, 2016, the Company announced that it had entered into a definitive agreement to acquire Northeast Retirement Services, Inc. ("NRS") and its subsidiary Global Trust Company ("GTC") headquartered in Woburn, Massachusetts for approximately $148 million in Company stock and cash. On February 3, 2017, the Company completed its acquisition of NRS and GTC. NRS was a privately held corporation focused on providing institutional transfer agency, master recordkeeping services, custom target date fund administration, trust product administration and customized reporting services to institutional clients. Its wholly-owned subsidiary, GTC, was chartered in the State of Maine in 2008, as a non-depository trust company which provides fiduciary services for collective investment trusts and other products. The acquisition will strengthen and complement the Company's existing employee benefit services businesses. Upon the completion of the merger, NRS is a wholly-owned subsidiary of BPAS and will operate as Northeast Retirement Services, LLC, a Delaware limited liability company. The initial accounting for the assets and liabilities assumed with this acquisition is incomplete as of the date of issuance of the financial statements due to the proximity of the acquisition date to the date of issuance.

Merchants Bancshares, Inc. – Pending Acquisition

On October 24, 2016, the Company announced that it had entered into a definitive agreement to acquire Merchants Bancshares, Inc. ("Merchants"), parent company of Merchants Bank, a state chartered bank headquartered in South Burlington, Vermont, for approximately $362 million in Company stock and cash. The acquisition will extend the Company's footprint into the Vermont and Western Massachusetts markets. Upon the completion of the merger, the Bank will add 31 branch locations in Vermont and one location in Massachusetts with approximately $2.1 billion of assets, and deposits of $1.5 billion. The acquisition is expected to close during the second or third quarter of 2017, pending both regulatory and Merchants' shareholder approval. The Company expects to incur certain one-time, transaction-related costs in 2017.

WJL Agencies, Inc.

On January 4, 2016, the Company, through its subsidiary, CBNA Insurance, completed its acquisition of WJL Agencies, Inc. doing business as The Clark Insurance Agencies ("WJL"), an insurance agency operating in northern New York. The Company paid $0.6 million in cash for the intangible assets of the company. Goodwill in the amount of $0.3 million and intangible assets in the amount of $0.3 million were recorded in conjunction with the acquisition. The effects of the acquired assets and liabilities have been included in the consolidated financial statements since that date. On August 19, 2016, the Company merged together its insurance subsidiaries and as of that date, the activities of CBNA Insurance were merged into OneGroup.

Oneida Financial Corp.

On December 4, 2015, the Company completed its acquisition of Oneida Financial Corp. ("Oneida"), parent company of Oneida Savings Bank, headquartered in Oneida, New York for approximately $158 million in Company stock and cash, comprised of $56.3 million of cash and the issuance of 2.38 million common shares. Upon the completion of the merger, the Bank added 12 branch locations in Oneida and Madison counties and approximately $769 million of assets, including approximately $399 million of loans and $226 million of investment securities, along with $699 million of deposits. Through the acquisition of Oneida, the Company acquired OneGroup and OWM as wholly-owned subsidiaries primarily engaged in offering insurance and investment advisory services. These subsidiaries complement the Company's other non-banking financial services businesses. The effects of the acquired assets and liabilities have been included in the consolidated financial statements since that date.

EBS-RMSCO, Inc.

On January 1, 2014, BPAS-APS, formerly known as Harbridge Consulting Group LLC, completed its acquisition of a professional services practice from EBS-RMSCO, Inc., a subsidiary of The Lifetime Healthcare Companies ("EBS-RMSCO"). This professional services practice, which provides actuarial valuation and consulting services to clients who sponsor pension and post-retirement medical and welfare plans, enhanced the Company's participation in the Western New York marketplace.

Bank of America Branches

On December 13, 2013, the Bank completed its acquisition of eight retail branch-banking locations across its Northeast Pennsylvania markets from Bank of America, N.A. ("B of A"), acquiring approximately $1.1 million in loans and $303 million of deposits. The assumed deposits consisted of $220 million of checking, savings and money market accounts ("core deposits") and $83 million of time deposits. Under the terms of the purchase agreement, the Bank paid B of A a blended deposit premium of 2.4%, or approximately $7.3 million.

HSBC and First Niagara Branches

On July 20, 2012, the Bank completed its acquisition of 16 retail branches in central, northern and western New York from HSBC Bank USA, N.A. ("HSBC"), acquiring approximately $106 million in loans and approximately $697 million of deposits. The assumed deposits consisted primarily of core deposits and the acquired loans consisted of in-market performing loans, primarily residential real estate loans. Under the terms of the purchase agreement, the Bank paid First Niagara Bank, N.A. ("First Niagara"), who acquired HSBC's Upstate New York banking business and assigned its right to purchase the 16 branches to the Bank, a blended deposit premium of 3.4%, or approximately $24 million.

On September 7, 2012, the Bank completed its acquisition of three branches in central New York from First Niagara, acquiring approximately $54 million of loans and $101 million of deposits. The assumed deposits consisted primarily of core deposits and the acquired loans consisted of in-market performing loans, primarily residential real estate loans. Under the terms of the purchase agreement, the Bank paid a blended deposit premium of 3.1%, or approximately $3 million.

In support of the HSBC and First Niagara branch acquisitions, the Company completed a public common stock offering in late January 2012, raising $57.5 million through the issuance of 2.13 million shares of common stock. The net proceeds of the offering were approximately $54.9 million.

Services

Banking

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank's branches are generally located in smaller towns and cities within its geographic market areas of Upstate New York and Northeastern Pennsylvania. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch and regional levels, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System ("FRB") and the Federal Home Loan Bank of New York ("FHLB"), and its deposits are insured by the Federal Deposit Insurance Corporation ("FDIC") up to applicable limits.

Employee Benefit Services

Through BPAS and its subsidiaries, the Company operates a national practice that provides employee benefit trust, collective investment fund, retirement plan administration, actuarial, VEBA/HRA and health and welfare consulting services to a diverse array of clients spanning the United States and Puerto Rico.

Wealth Management

Through the Bank, CISI, OWM, Carta Group, and Nottingham, the Company provides wealth management, retirement planning, higher educational planning, fiduciary, risk management, and personal financial planning services. The Company offers investment alternatives including stocks, bonds, mutual funds and advisory products.

Insurance Agency

Through OneGroup, the Company offers personal and commercial property insurance and other risk management products and services. In addition, OneGroup offers employee benefit related services. OneGroup represents many leading insurance companies.

Segment Information

The Company has identified three reportable operating business segments: Banking, Employee Benefit Services, and All Other. Included in the All Other segment are the smaller Wealth Management and Insurance operations. Information about the Company's reportable business segments is included in Note U of the "Notes to Consolidated Financial Statements" filed herewith in Part II.

Competition

The banking and financial services industry is highly competitive in the New York and Pennsylvania markets. The Company competes actively for loans, deposits and customers with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, insurance agencies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The table below summarizes the Bank's deposits and market share by the forty-one counties of New York and Pennsylvania in which it has customer facilities. Market share is based on deposits of all commercial banks, credit unions, savings and loan associations, and savings banks.

Number of County State Deposits as of 6/30/2016(1) (000's omitted) Market Share (1) Branches ATM's Towns/ Cities Towns Where Company Has 1st or 2nd Market Position Lewis NY $ 198,077 75.70 % 4 4 3 3 Franklin NY 322,707 63.30 % 6 6 5 5 Hamilton NY 54,393 54.98 % 2 2 2 2 Madison NY 465,922 53.33 % 8 8 5 5 Allegany NY 254,923 48.16 % 9 10 8 8 Cattaraugus NY 405,535 42.84 % 10 11 7 6 Saint Lawrence NY 430,746 37.27 % 13 11 11 10 Otsego NY 355,965 34.69 % 10 9 6 5 Jefferson NY 436,631 28.15 % 7 9 6 6 Seneca NY 131,020 27.80 % 4 3 4 4 Clinton NY 354,656 26.80 % 4 7 2 2 Yates NY 95,300 25.70 % 3 2 2 1 Wyoming PA 121,488 24.65 % 4 4 4 4 Schuyler NY 48,371 24.43 % 1 1 1 1 Chautauqua NY 349,177 22.87 % 12 12 10 7 Livingston NY 176,354 22.51 % 5 6 5 4 Steuben NY 187,672 18.31 % 8 8 7 4 Essex NY 120,533 18.03 % 5 5 4 4 Wayne NY 131,884 15.62 % 3 3 2 2 Delaware NY 144,681 14.88 % 5 5 5 5 Ontario NY 241,814 12.07 % 8 14 5 3 Oswego NY 169,822 9.63 % 4 5 4 2 Tioga NY 37,835 8.62 % 2 2 2 1 Oneida NY 273,502 7.94 % 7 7 6 5 Lackawanna PA 398,822 7.66 % 11 11 8 4 Herkimer NY 46,717 7.55 % 1 1 1 1 Luzerne PA 451,924 7.44 % 10 14 8 3 Chemung NY 74,589 7.29 % 2 2 1 0 Susquehanna PA 52,519 6.41 % 3 1 3 2 Schoharie NY 23,327 5.38 % 1 1 1 0 Bradford PA 46,941 4.19 % 2 2 2 1 Carbon PA 40,002 4.07 % 2 2 2 1 Cayuga NY 43,470 4.03 % 2 2 2 1 Washington NY 19,194 2.67 % 1 0 1 1 Chenango NY 22,852 2.38 % 2 2 1 0 Warren NY 32,543 1.92 % 1 1 1 1 Onondaga NY 151,245 1.55 % 4 4 4 1 Broome NY 32,133 1.22 % 1 1 1 0 Ulster NY 29,496 0.97 % 1 1 1 1 Erie NY 117,828 0.29 % 4 4 3 2 Tompkins NY 4,150 0.22 % 1 0 1 0 $ 7,096,760 6.95 % 193 203 157 118 (1) Deposits and Market Share data as of June 30, 2016, the most recent information available from SNL Financial LLC. Deposit amounts include $138.9 million of intercompany balances that are eliminated upon consolidation.

Employees

As of December 31, 2016, the Company employed 2,222 full-time employees, 138 part-time employees and 139 temporary employees. None of the Company's employees are represented by a collective bargaining agreement. The Company offers a variety of employment benefits and considers its relationship with its employees to be good.

Supervision and Regulation

General

The banking industry is highly regulated with numerous statutory and regulatory requirements that are designed primarily for the protection of depositors and the financial system, and not for the purpose of protecting shareholders. Set forth below is a description of the material laws and regulations applicable to the Company and the Bank. This summary is not complete and the reader should refer to these laws and regulations for more detailed information. The Company's and the Bank's failure to comply with applicable laws and regulations could result in a range of sanctions and administrative actions imposed upon the Company and/or the Bank, including the imposition of civil money penalties, formal agreements and cease and desist orders. Changes in applicable law or regulations, and in their interpretation and application by regulatory agencies, cannot be predicted, and may have a material effect on the Company's business and results.

The Company and its subsidiaries are subject to the laws and regulations of the federal government and the states and jurisdictions in which they conduct business. The Company, as a bank holding company, is subject to extensive regulation, supervision and examination by the Board of Governors of the Federal Reserve System ("FRB") as its primary federal regulator. The Bank is a nationally-chartered bank and is subject to extensive regulation, supervision and examination by the Office of the Comptroller of the Currency ("OCC") as its primary federal regulator, and as to certain matters, the FRB, the Consumer Financial Protection Bureau ("CFPB"), and the Federal Deposit Insurance Corporation ("FDIC").

The Company is also subject to the jurisdiction of the SEC and is subject to disclosure and regulatory requirements under the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended. The Company's common stock is listed on the New York Stock Exchange ("NYSE") and it is subject to NYSE's rules for listed companies. Affiliated entities, including BPAS, HB&T, HSI, BPAS Trust Company of Puerto Rico, Nottingham, CISI, OneGroup, Carta Group, and OWM are subject to the jurisdiction of certain state and federal regulators and self-regulatory organizations including, but not limited to, the SEC, the Texas Department of Banking, the Financial Industry Regulatory Authority ("FINRA"), Puerto Rico Office of the Commissioner of Financial Institutions, and state securities and insurance regulators.

The Company, the Bank, and their respective subsidiaries may be subject to the laws and regulations of the federal government and/or the various states in which they conduct business.

Federal Bank Holding Company Regulation

The Company is a bank holding company under the Bank Holding Company Act of 1956, (the "BHC Act"), and became a financial holding company effective September 30, 2015. As a bank holding company that has elected to become a financial holding company, the Company can affiliate with securities firms and insurance companies and engage in other activities that are "financial in nature" or "incidental" or "complementary" to activities that are financial in nature, as long as it continues to meet the eligibility requirements for financial holding companies (including requirements that the financial holding company and its depository institution subsidiary maintain their status as "well capitalized" and "well managed").

Generally, FRB approval is not required for the Company to acquire a company (other than a bank holding company, bank or savings association) engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the FRB. Prior notice to the FRB may be required, however, if the company to be acquired has total consolidated assets of $10 billion or more. Prior FRB approval is required before the Company may acquire the beneficial ownership or control of more than 5% of the voting shares or substantially all of the assets of a bank holding company, bank or savings association.

Because the Company is a financial holding company, if the Bank were to receive a rating under the Community Reinvestment Act of 1977, as amended ("CRA"), of less than Satisfactory, the Company will be prohibited, until the rating is raised to Satisfactory or better, from engaging in new activities or acquiring companies other than bank holding companies, banks or savings associations, except that the Company could engage in new activities, or acquire companies engaged in activities, that are considered "closely related to banking" under the BHC Act. In addition, if the FRB determines that the Company or the Bank is not well capitalized or well managed, the Company would be required to enter into an agreement with the FRB to comply with all applicable capital and management requirements and may contain additional limitations or conditions. Until corrected, the Company could be prohibited from engaging in any new activity or acquiring companies engaged in activities that are not closely related to banking, absent prior FRB approval.

Federal Reserve System Regulation

Because the Company is a bank holding company, it is subject to regulatory capital requirements and required by the FRB to, among other things, maintain cash reserves against its deposits. The Bank is under similar capital requirements administered by the OCC as discussed below. FRB policy has historically required a bank holding company to act as a source of financial and managerial strength to its subsidiary banks. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the "Dodd-Frank Act") codifies this historical policy as a statutory requirement. To the extent the Bank is in need of capital, the Company could be expected to provide additional capital, including borrowings from the FRB for such purpose. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors' funds.

The FRB also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the FRB, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust our strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond our control.

The Office of Comptroller of the Currency Regulation

The Bank is supervised and regularly examined by the OCC. The various laws and regulations administered by the OCC affect the Company's practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects the Bank's business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and the location of its offices. The OCC generally prohibits a depository institution from making any capital distributions, including the payment of a dividend, or paying any management fee to its parent holding company if the depository institution would become undercapitalized due to the payment. Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the OCC. The Bank is well capitalized under regulatory standards administered by the OCC. For additional information on our capital requirements see "Management's Discussion and Analysis of Financial Condition and Results of Operations – Shareholders' Equity" and Note P to the Financial Statements.

Federal Home Loan Bank

The Bank is a member of the FHLB, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to the rules and requirements of the FHLB, including the purchase of shares of FHLB activity-based stock in the amount of 4.5% of the dollar amount of outstanding advances and FHLB capital stock in an amount equal to the greater of $1,000 or the sum of 0.15% of the mortgage-related assets held by the Bank based upon the previous year-end financial information. The Bank was in compliance with the rules and requirements of the FHLB at December 31, 2016.

Deposit Insurance

Deposits of the Bank are insured up to the applicable limits by the Deposit Insurance Fund ("DIF") and are subject to deposit insurance assessments to maintain the DIF. The Dodd-Frank Act permanently increased the maximum amount of deposit insurance to $250,000 per deposit category, per depositor, per institution. A depository institution's DIF assessment is calculated by multiplying its assessment rate by the assessment base, which is defined as the average consolidated total assets less the average tangible equity of the depository institution. The initial base assessment rate is based on its capital level and supervisory ratings (its "CAMELS ratings"), certain financial measures to assess an institution's ability to withstand asset related stress and funding related stress and, in some cases, additional discretionary adjustments by the FDIC to reflect additional risk factors.

In October 2010, the FDIC adopted a DIF restoration plan to ensure that the fund reserve ratio reaches 1.35% by September 30, 2020, as required by the Dodd-Frank Act. At least semi-annually, the FDIC will update its loss and income projections for the fund and, if needed, will increase or decrease assessment rates, following notice-and-comment rulemaking if required. On June 30, 2016, the fund reserve ratio reached 1.15% and the assessment rate schedule was lowered. FDIC insurance expense totaled $3.7 million, $4.0 million and $3.9 million in 2016, 2015 and 2014, respectively.

Under the Federal Deposit Insurance Act, if the FDIC finds that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, the FDIC may determine that such violation or unsafe or unsound practice or condition require the termination of deposit insurance.

Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

On July 21, 2010, the Dodd-Frank Act was signed into law, which resulted in significant changes to the banking industry. The provisions that have received the most public attention have been those that apply to financial institutions larger than the Company; however, the Dodd-Frank Act does contain numerous other provisions that affect all banks and bank holding companies and impacts how the Company and the Bank handle their operations. The Dodd-Frank Act requires various federal agencies, including those that regulate the Company and the Bank, to promulgate new rules and regulations and to conduct various studies and reports for Congress. The federal agencies have either completed or are in the process of completing these rules and regulations and have been given significant discretion in drafting such rules and regulations. Several of the provisions of the Dodd-Frank Act may have the consequence of increasing the Bank's expenses, decreasing its revenues, and changing the activities in which it chooses to engage. The specific impact of the Dodd-Frank Act on the Company's current activities or new financial activities the Company may consider in the future, the Company's financial performance, and the markets in which the Company operates depends on the manner in which the relevant agencies continue to develop and implement the required rules and regulations and the reaction of market participants to these regulatory developments.

Pursuant to FRB regulations mandated by the Dodd-Frank Act, effective October 1, 2011, interchange fees on debit card transactions are limited to a maximum of $0.21 per transaction plus 5 basis points of the transaction amount. A debit card issuer may recover an additional one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements prescribed by the FRB. Currently, the Company is exempt from the interchange fee cap under the "small issuer" exemption, which applies to any debit card issuer with total worldwide assets (including those of its affiliates) of less than $10 billion as of the end of the previous calendar year. In the event the Company's assets reach $10 billion or more, it will become subject to the interchange fee limitations beginning July 1 of the following year, and the fees the Company may receive for an electronic debit transaction will be capped at the statutory limit. The FRB also adopted requirements in the final rule that issuers include two unaffiliated networks for routing debit transactions that are applicable to the Company and the Bank.

The final rules issued by the FRB, SEC, OCC, FDIC, and Commodity Futures Trading Commission implementing Section 619 of the Dodd-Frank Act (commonly known as the Volcker Rule) prohibit insured depository institutions and companies affiliated with insured depository institutions from engaging in short-term proprietary trading of certain securities, derivatives, commodity futures and options on these instruments, for their own account. The final rules also impose limits on banking entities' investments in, and other relationships with, hedge funds or private equity funds. Banking entities with less than $10 billion in total consolidated assets, which generally have very little or no involvement in prohibited proprietary trading or investment activities in covered funds, do not have any compliance obligations under the final rule if they do not engage in any covered activities other than trading in certain government, agency, State or municipal obligations.

The CFPB rules implementing Section 1073 of the Dodd-Frank Act create a comprehensive new system of consumer protections for remittance transfers sent by consumers in the United States to individuals and businesses in foreign countries. The amendments provide new protections, including disclosure requirements, and error resolution and cancellation rights, to consumers who send remittance transfers to other consumers or businesses in a foreign country. The Bank has adopted policies and procedures to comply with the final foreign remittance transfer rules.

The scope and impact of many of the Dodd-Frank Act's provisions will continue to be determined over time, including as final regulations are issued and become effective. As a result, the Company cannot predict the ultimate impact of the Dodd-Frank Act on the Company or the Bank at this time, including the extent to which it could increase costs or limit the Company's ability to pursue business opportunities in an efficient manner, or otherwise adversely affect its business, financial condition and results of operations. Nor can the Company predict the impact or substance of other future legislation or regulation. However, it is expected that they at a minimum will increase the Company's and the Bank's operating and compliance costs. As rules and regulations continue to be implemented or issued, the Company may need to dedicate additional resources to ensure compliance, which may increase its costs of operations and adversely impact its earnings.

Capital Requirements

The Company and the Bank are required to comply with applicable capital adequacy standards established by the federal banking agencies. The risk-based capital standards that were applicable to the Company and the Bank through December 31, 2014 were based on the 1988 Capital Accord, known as Basel I ("Basel I"), of the Basel Committee on Banking Supervision (the "Basel Committee"). However, in July 2013, the FRB, the OCC and the FDIC approved final rules (the "New Capital Rules") establishing a new comprehensive capital framework for U.S. banking organizations. These rules went into effect for the Company and the Bank on January 1, 2015, subject to phase-in periods for certain components.

The New Capital Rules implement the Basel Committee's December 2010 capital framework (known as "Basel III") for strengthening international capital standards as well as certain provisions of the Dodd-Frank Act. The New Capital Rules substantially revise the risk-based capital requirements applicable to bank holding companies and depository institutions, including the Company and the Bank, compared to the previous U. S. Basel I risk-based capital rules. The New Capital Rules define the components of capital and address other issues affecting the numerator in banking institutions regulatory capital ratios and replace the Basel I risk-weighting approach, with a more risk-sensitive one based, in part, on the standardized approach set forth in "Basel II". The New Capital Rules also implement the requirements of Section 939A of the Dodd-Frank Act to remove references to credit ratings from the Federal banking agencies' rules.

The New Capital Rules, among other things: (i) introduces as a new capital measure "Common Equity Tier 1," ("CET1"), (ii) specify that Tier 1 capital consists of CET1 and "Additional Tier 1 capital" instruments meeting specified revised requirements, (iii) defines CET1 narrowly by requiring that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital, and (iv) expands the scope of the deductions from and adjustments to capital as compared to existing regulations. Under the New Capital Rules, the most common form of Additional Tier 1 capital is non-cumulative perpetual preferred stock, and the most common form of Tier 2 capital is subordinated notes and a portion of the allowance for loan and lease losses, in each case, subject to the New Capital Rules specific requirements.

Under the New Capital Rules, the minimum capital ratios as of January 1, 2015 are as follows:

· 4.5% CET1 to total risk-weighted assets;

· 6.0% Tier 1 capital (CET1 plus Additional Tier 1 capital) to total risk-weighted assets;

· 8.0% Total capital (Tier 1 Capital plus Tier 2 capital) to total risk-weighted assets;

· 4.0% Tier 1 capital to total adjusted quarterly average assets (known as "leverage ratio")

Beginning in 2016, the New Capital Rules required the Company and the Bank to maintain a "capital conservation buffer" composed entirely of CET1. When it is fully phased-in by the beginning of 2019, banking organizations will be required to maintain a minimum capital conservation buffer of 2.5% (CET1 to Total risk-weighted assets), in addition to the minimum risk-based capital ratios. Therefore, to satisfy both the minimum risk-based capital ratios and the capital conservation buffer, a banking organization will be required to maintain the following: (i) CET1 to total risk-weighted assets of at least 7%, (ii) Tier 1 capital to total risk-weighted assets of at least 8.5%, and (iii) Total capital (Tier 1 capital plus Tier 2 capital) to total risk-weighted assets of at least 10.5% by January 1, 2019, upon full phase-in of the capital conservation buffer. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions that do not maintain a capital conservation buffer of 2.5% or more will face constraints on dividends, common share repurchases and incentive compensation based on the amount of the shortfall.

The New Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, deferred tax assets dependent upon future taxable income and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. Under the general Basel I risk based capital rules, the effects of accumulated other comprehensive income or loss items included in shareholders' equity (for example, marks-to-market of securities held in the available for sale portfolio) were reversed for the purposes of determining regulatory capital. Under the New Capital Rules, the effects of certain accumulated other comprehensive income or loss items are not excluded; however, banks not using the advanced approaches, including the Company and the Bank, were permitted to, and in the case of the Company and the Bank they did, make a one-time permanent election to continue to exclude these items.

Consistent with the section 171 of the Dodd-Frank Act, the New Capital Rules allow certain bank holding companies to include certain hybrid securities, such as trust preferred securities, in Tier 1 capital if they had less than $15 billion in assets as of December 31, 2009 and the securities were issued before May 19, 2010. Accordingly, the trust preferred securities classified as long-term debt on the Company's balance sheet will be included as Tier 1 capital while they are outstanding, unless the Company completes an acquisition of a depository institution holding company that did not meet this criteria, or are acquired by such an organization, after January 1, 2014, at which time they would be subject to the stated phase-out requirements of the New Capital Rules and would be included as Tier 2 capital.

Implementation of the deductions and other adjustments to CET1 began on January 1, 2015 and will be phased-in over a 4-year period (beginning at 40% on January 1, 2015 and an additional 20% per year thereafter). The implementation of the capital conservation buffer began on January 1, 2016 at the 0.625% level and will be phased in over a four-year period (increasing by that amount on each subsequent January 1, until it reaches 2.5% on January 1, 2019).

With respect to the Bank, the New Capital Rules also revise the prompt corrective action ("PCA") regulations established pursuant to Section 38 of the Federal Deposit Insurance Act, by (i) introducing a CET1 ratio requirement for each capital category other than critically undercapitalized, with the required CET1 ratio being 6.5% for well-capitalized status; (ii) increasing the minimum Tier 1 capital ratio requirement for each capital category, with the minimum Tier 1 capital ratio for well-capitalized status being 8.0% (as compared to the current 6.0%); and (iii) eliminating the current provision that allows certain highly-rated banking organizations to maintain a 3.0% leverage ratio and still be adequately capitalized. The New Capital Rules do not change the Total risk-based PCA capital requirement for any capital category.

The New Capital Rules prescribe a new standardized approach for risk weighted-assets that expands the risk-weight categories from the current four Basel I-derived categories (0%, 20%, 50% and 100%) to a larger and more risk-sensitive number of categories, depending on the nature of the asset. The new risk-weight categories generally range from 0% for U.S. government and agency securities, to 1,250% for certain securitized exposures, and result in higher risk weights for a variety of asset categories. The standardized approach requires financial institutions to transition assets that are 90 days or more past due or on nonaccrual from their original risk weight to 150 percent. Additionally, loans designated as high volatility commercial real estate ("HVCRE") are assigned a risk-weighting of 150 percent.

Requirements to maintain higher levels of capital or to maintain higher levels of liquid assets could adversely impact the Company's net income and return on equity. The current requirements and the Company's actual capital levels are detailed in Note P of "Notes to Consolidated Financial Statements" filed in Part II, Item 8, "Financial Statements and Supplementary Data."

Consumer Protection Laws

In connection with its banking activities, the Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending to various sectors of the economy. These laws include the Equal Credit Opportunity Act, GLB Act, the Fair Credit Reporting Act ("FCRA"), the Fair and Accurate Credit Transactions Act of 2003 ("FACT Act"), Electronic Funds Transfer Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Dodd-Frank Act, the Real Estate Settlement Procedures Act, the Secure and Fair Enforcement for Mortgage Licensing Act ("SAFE"), and various state law counterparts.

The Dodd-Frank Act created the CFPB with broad powers to supervise and enforce consumer protection laws, including laws that apply to banks in order to prohibit unfair, deceptive or abusive practices. The CFPB has examination authority over all banks and savings institutions with more than $10 billion in assets. Until the Company exceeds this threshold, the OCC continues to exercise primary examination authority over the Bank with regard to compliance with federal consumer protection laws and regulations. The Dodd-Frank Act weakens the federal preemption rules that have been applicable to national banks and gives attorney generals for the states certain powers to enforce federal consumer protection laws. Further, under the Dodd-Frank Act, it is unlawful for any provider of consumer financial products or services to engage in any unfair, deceptive, or abusive acts or practice ("UDAAP"). A violation of the consumer protection and privacy laws, and in particular UDAAP, could have serious legal, financial, and reputational consequences.

In addition, the GLB Act requires all financial institutions to adopt privacy policies, restrict the sharing of nonpublic customer data with nonaffiliated parties and establishes procedures and practices to protect customer data from unauthorized access. In addition, the FCRA, as amended by the FACT Act, includes provisions affecting the Company, the Bank, and their affiliates, including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. The FACT Act requires persons subject to FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the Federal Trade Commission have extensive rulemaking authority under the FACT Act, and the Company and the Bank are subject to the rules that have been created under the FACT Act, including rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate certain identity theft red flags. The Bank is also subject to data security standards and data breach notice requirements issued by the OCC and other regulatory agencies. The Bank has created policies and procedures to comply with these consumer protection requirements.

The CFPB issued the final rules implementing the ability-to-repay and qualified mortgage (QM) provisions of the Truth in Lending Act, as amended by the Dodd-Frank Act (the "QM Rule"). The ability-to-repay provision requires creditors to make reasonable, good faith determinations that borrowers are able to repay their mortgages before extending the credit based on a number of factors and consideration of financial information about the borrower derived from reasonably reliable third-party documents. Under the Dodd-Frank Act and the QM Rule, loans meeting the definition of "qualified mortgage" are entitled to a presumption that the lender satisfied the ability-to-repay requirements. The presumption is a conclusive presumption/safe harbor for loans meeting the QM requirements, and a rebuttable presumption for higher-priced loans meeting the QM requirements. The definition of a "qualified mortgage" incorporates the statutory requirements, such as not allowing negative amortization or terms longer than 30 years. The QM Rule also adds an explicit maximum 43% debt-to-income ratio for borrowers if the loan is to meet the QM definition, though some mortgages that meet government-sponsored enterprises, Federal Housing Administration, and Veterans Administration underwriting guidelines may, for a period not to exceed seven years, meet the QM definition without being subject to the 43% debt-to-income limits. The Bank has created policies and procedures to comply with these consumer protection requirements.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 ("USA Patriot Act") imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution's anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The USA Patriot Act also encourages information-sharing among financial institutions, regulators, and law enforcement authorities by providing an exemption from the privacy provisions of the GLB Act for financial institutions that comply with the provision of the Act. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the institution. The Company has approved policies and procedures that are designed to comply with the USA Patriot Act and its regulations.

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others administrated by the Treasury's Office of Foreign Assets Control ("OFAC"). The OFAC administered sanctions can take many different forms; however, they generally contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, entity or individual, including prohibitions against direct or indirect imports and exports and prohibitions on "U.S. persons" engaging in financial transactions relating to making investments, or providing investment related advice or assistance; and (ii) a blocking of assets in which the government or specially designated nationals have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 ("Sarbanes-Oxley Act") implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934, as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) new requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) additional responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) the creation of an independent accounting oversight board for the accounting industry; (iv) new standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on non-preferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violations of the securities laws.

Electronic Fund Transfer Act

A federal banking rule under the Electronic Fund Transfer Act prohibits financial institutions from charging consumers fees for paying overdrafts on automated teller machines and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions. The new rule does not govern overdraft fees on the payment of checks and certain other forms of bill payments.

Community Reinvestment Act of 1977

Under the Community Reinvestment Act of 1977 ("CRA"), the Bank is required to help meet the credit needs of its communities, including low- and moderate-income neighborhoods. Although the Bank must follow the requirements of CRA, it does not limit the Bank's discretion to develop products and services that are suitable for a particular community or establish lending requirements or programs. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibits discrimination in lending practices. The Bank's failure to comply with the provisions of the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank's failure to comply with the Equal Credit Opportunity Act and the Fair Housing Act could result in enforcement actions against it by its regulators as well as other federal regulatory agencies and the Department of Justice. The Bank's latest CRA rating was "Satisfactory".

The Bank Secrecy Act

The Bank Secrecy Act ("BSA") requires all financial institutions, including banks and securities broker-dealers, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. The BSA includes a variety of recordkeeping and reporting requirements (such as cash and suspicious activity reporting), as well as due diligence/know-your-customer documentation requirements. The Company has established an anti-money laundering program and taken other appropriate measures in order to comply with BSA requirements.

Community Bank System, Inc. (the “Company”) was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company is a registered financial holding company which wholly-owns two significant subsidiaries: Community Bank, N.A. (the “Bank” or “CBNA”), and Benefit Plans Administrative Services, Inc. (“BPAS”). BPAS owns four subsidiaries: Benefit Plans Administrative Services, LLC (“BPA”), a provider of defined contribution plan administration services; BPAS Actuarial & Pension Services, LLC (“BPAS-APS”) (formally known as Harbridge Consulting Group, LLC), a provider of actuarial and benefit consulting services; BPAS Trust Company of Puerto Rico, a Puerto Rican trust company; and Hand Benefits & Trust Company (“HB&T”), a provider of collective investment fund administration and institutional trust services. HB&T owns one subsidiary, Hand Securities, Inc. (“HSI”), an introducing broker dealer. The Company also wholly-owns two unconsolidated subsidiary business trusts formed for the purpose of issuing mandatorily-redeemable preferred securities which are considered Tier I capital under regulatory capital adequacy guidelines.

The Bank’s business philosophy is to operate as a community bank with local decision-making, principally in non-metropolitan markets, providing a broad array of banking and financial services to retail, commercial, and municipal customers. As of December 31, 2015, the Bank operates 194 full-service branches operating as Community Bank, N.A. throughout 36 counties of Upstate New York and six counties of Northeastern Pennsylvania, offering a range of commercial and retail banking services. The Bank owns the following operating subsidiaries: The Carta Group, Inc. (“Carta Group”), CBNA Insurance Agency, Inc. (“CBNA Insurance”), CBNA Preferred Funding Corporation (“PFC”), CBNA Treasury Management Corporation (“TMC”), Community Investment Services, Inc. (“CISI”), Nottingham Advisors, Inc. (“Nottingham”), OneGroup NY, Inc. (“OneGroup”), Oneida Wealth Management, Inc. (“OWM”) and Oneida Preferred Funding II LLC (“OPFCII”). OneGroup and CBNA Insurance are full-service insurance agencies offering personal and commercial property insurance and other risk management products and services. PFC and OPFCII primarily act as investors in residential real estate loans and properties. TMC provides cash management, investment, and treasury services to the Bank. CISI, the Carta Group, and OWM provide broker-dealer and investment advisory services. Nottingham provides asset management services to individuals, corporations, corporate pension and profit sharing plans, and foundations.

The Company maintains a website at communitybankna.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information posted on the website is not incorporated into or a part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at http://www.sec.gov.

Acquisition History (2011-2015)

Oneida Financial Corp.

On December 4, 2015, the Company completed its acquisition of Oneida Financial Corp. (“Oneida”), parent company of Oneida Savings Bank, headquartered in Oneida, New York for approximately $158 million in Company stock and cash, comprised of $56.3 million of cash and the issuance of 2.78 million common shares. Upon the completion of the merger, the Bank added 12 branch locations in Oneida and Madison counties and approximately $769 million of assets, including approximately $399 million of loans and $226 million of investment securities, along with $699 million of deposits. Through the acquisition of Oneida, the Company acquired OneGroup and OWM as wholly-owned subsidiaries primarily engaged in offering insurance and investment advisory services. These subsidiaries complement the Company’s other non-banking financial services businesses.

EBS-RMSCO, Inc.

On January 1, 2014, BPAS-APS, formerly known as Harbridge Consulting Group LLC, completed its acquisition of a professional services practice from EBS-RMSCO, Inc., a subsidiary of The Lifetime Healthcare Companies (“EBS-RMSCO”). This professional services practice, which provides actuarial valuation and consulting services to clients who sponsor pension and post-retirement medical and welfare plans, enhanced the Company’s participation in the Western New York marketplace.

3 of 105

Bank of America Branches

On December 13, 2013, the Bank completed its acquisition of eight retail branch-banking locations across its Northeast Pennsylvania markets from Bank of America, N.A. (“B of A”), acquiring approximately $1.1 million in loans and $303 million of deposits. The assumed deposits consisted of $220 million of checking, savings and money market accounts (“core deposits”) and $83 million of time deposits. Under the terms of the purchase agreement, the Bank paid B of A a blended deposit premium of 2.4%, or approximately $7.3 million.

HSBC and First Niagara Branches

On July 20, 2012, the Bank completed its acquisition of 16 retail branches in central, northern and western New York from HSBC Bank USA, N.A. (“HSBC”), acquiring approximately $106 million in loans and approximately $697 million of deposits. The assumed deposits consisted primarily of core deposits and the acquired loans consisted of in-market performing loans, primarily residential real estate loans. Under the terms of the purchase agreement, the Bank paid First Niagara Bank, N.A. (“First Niagara”), who acquired HSBC’s Upstate New York banking business and assigned its right to purchase the 16 branches to the Bank, a blended deposit premium of 3.4%, or approximately $24 million.

On September 7, 2012, the Bank completed its acquisition of three branches in central New York from First Niagara, acquiring approximately $54 million of loans and $101 million of deposits. The assumed deposits consisted primarily of core deposits and the acquired loans consist of in-market performing loans, primarily residential real estate loans. Under the terms of the purchase agreement, the Bank paid a blended deposit premium of 3.1%, or approximately $3 million.

In support of the HSBC and First Niagara branch acquisitions, the Company completed a public common stock offering in late January 2012, raising $57.5 million through the issuance of 2.13 million common shares. The net proceeds of the offering were approximately $54.9 million.

CAI Benefits, Inc.

On November 30, 2011, the Company, through its BPAS subsidiary, acquired in an all-cash transaction, certain assets and liabilities of CAI Benefits, Inc. (“CAI”), a provider of actuarial, consulting and retirement plan administration services, with offices in New York City and Northern New Jersey. The transaction added valuable service capacity and enhanced distribution prospects in support of the Company’s broader-based employee benefits business, including daily valuation plan and collective investment fund administration.

The Wilber Corporation

On April 8, 2011, the Company acquired The Wilber Corporation (“Wilber”), parent company of Wilber National Bank for $103 million of stock and cash, comprised of $20.4 million in cash and the issuance of 3.35 million additional shares of the Company’s common stock. Based in Oneonta, New York, Wilber operated 22 branch-banking centers in the Central, Greater Capital District, and Catskill regions of Upstate New York. The acquisition added approximately $462 million in loans, $297 million of investment securities, and $772 million in deposits.

Services

Banking

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank's branches are generally located in smaller towns and cities within its geograph­ic market areas of Upstate New York and Northeastern Pennsylvania. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch and regional levels, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System (“FRB”) and the Federal Home Loan Bank of New York ("FHLB"), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Employee Benefit Services

Through BPAS and its subsidiaries, the Company operates a national practice that provides employee benefit trust, collective investment fund, retirement plan administration, actuarial, VEBA/HRA and health and welfare consulting services to a diverse array of clients spanning the United States and Puerto Rico.

Wealth Management

Through the Bank, CISI, OWM, Carta Group, and Nottingham, the Company operates a wealth management, retirement planning, higher educational planning, fiduciary, risk management, and personal financial planning. Through a third party broker-dealer relationship, the Company offers investment alternatives including stocks, bonds, mutual funds and advisory products.

4 of 105

Insurance

Through OneGroup and CBNA Insurance, the Company offers personal and commercial property insurance and other risk management products and services. In addition, OneGroup offers employee benefit related services. OneGroup and CBNA Insurance represent many leading insurance companies, including Travelers, CNA, Hartford, Progressive, Cincinnati and Utica National.

Segment Information

The Company has identified three reportable operating business segments: Banking, Employee Benefit Services, and All Other. Included in the All Other segment are the smaller Wealth Management and Insurance segments. Information about the Company’s reportable business segments is included in Note U of the “Notes to Consolidated Financial Statements” filed herewith in Part II.

Competition

The banking and financial services industry is highly competitive in the New York and Pennsylvania markets. The Company competes actively for loans, deposits and customers with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, insurance companies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

5 of 105

The table below summarizes the Bank’s deposits and market share by the forty-two counties of New York and Pennsylvania in which it has customer facilities. Market share is based on deposits of all commercial banks, credit unions, savings and loan associations, and savings banks.

Number of Towns Where Deposits as of Company 6/30/2015(1) Market Towns/ Has 1st or 2nd County State (000's omitted) Share (1) Branches ATM's Cities Market Position Lewis NY $177,913 74.82% 4 4 3 3 Franklin NY 281,304 60.98% 6 6 5 5 Madison NY 613,898 59.78% 8 8 5 5 Hamilton NY 52,141 55.56% 2 2 2 2 Allegany NY 236,056 47.11% 9 10 8 8 Cattaraugus NY 402,793 43.95% 10 11 7 6 St. Lawrence NY 424,885 37.91% 13 10 11 10 Otsego NY 349,524 36.17% 10 9 6 5 Seneca NY 141,246 28.95% 4 3 4 3 Jefferson NY 407,326 27.83% 7 9 6 6 Schuyler NY 50,541 27.63% 1 1 1 1 Clinton NY 329,032 25.86% 4 7 2 2 Yates NY 91,691 25.48% 3 2 2 1 Wyoming PA 128,305 25.35% 3 4 3 3 Chautauqua NY 327,776 22.36% 12 12 10 7 Livingston NY 171,263 22.30% 5 6 5 4 Essex NY 124,369 19.84% 5 5 4 4 Steuben NY 184,281 19.01% 8 7 7 4 Wayne NY 128,957 16.10% 3 3 2 2 Delaware NY 151,914 15.89% 5 5 5 5 Ontario NY 234,937 12.52% 8 13 5 3 Oswego NY 168,214 9.79% 4 5 4 2 Tioga NY 36,811 8.98% 2 2 2 1 Lackawanna PA 403,255 7.94% 11 11 8 4 Luzerne PA 442,484 7.78% 11 15 9 4 Chemung NY 74,052 7.37% 2 2 1 0 Herkimer NY 42,550 7.09% 1 1 1 1 Susquehanna PA 52,604 7.00% 3 1 3 2 Oneida NY 198,506 6.18% 7 7 6 5 Schoharie NY 23,947 5.87% 1 1 1 0 Carbon PA 40,824 4.30% 2 2 2 1 Bradford PA 43,708 3.90% 2 2 2 1 Cayuga NY 39,827 3.86% 2 2 2 1 Washington NY 19,820 2.82% 1 0 1 1 Chenango NY 25,561 2.68% 2 2 1 0 Warren NY 31,615 2.03% 1 1 1 1 Onondaga NY 140,435 1.53% 4 4 4 1 Broome NY 31,781 1.22% 1 1 1 0 Ulster NY 31,782 1.12% 1 1 1 1 Erie NY 105,030 0.28% 4 4 3 2 Tompkins NY 4,144 0.23% 1 0 1 0 Saratoga NY 6,124 0.15% 1 1 1 0 $6,973,226 6.97% 194 202 158 117 (1) Deposits and Market Share data as of June 30, 2015, the most recent information available from SNL Financial LLC, adjusted for the Oneida acquisition occurring on December 4, 2015. Deposit amounts include $133.2 million of intercompany balances that are eliminated upon consolidation.

6 of 105

Employees

As of December 31, 2015, the Company employed 2,207 full-time employees, 133 part-time employees and 150 temporary employees. None of the Company’s employees are represented by a collective bargaining agreement. The Company offers a variety of employment benefits and considers its relationship with its employees to be good.

Supervision and Regulation

General

The banking industry is highly regulated with numerous statutory and regulatory requirements that are designed primarily for the protection of depositors and the financial system, and not for the purpose of protecting shareholders. Set forth below is a description of the material laws and regulations applicable to the Company and the Bank. This summary is not complete and the reader should refer to these laws and regulations for more detailed information. The Company’s and the Bank’s failure to comply with applicable laws and regulations could result in a range of sanctions and administrative actions imposed upon the Company and/or the Bank, including the imposition of civil money penalties, formal agreements and cease and desist orders. Changes in applicable law or regulations, and in their interpretation and application by regulatory agencies, cannot be predicted, and may have a material effect on the Company’s business and results.

The Company and its subsidiaries are subject to the laws and regulations of the federal government and the states and jurisdictions in which they conduct business. The Company, as a bank holding company, is subject to extensive regulation, supervision and examination by the Board of Governors of the FRB as its primary federal regulator. The Bank is a nationally-chartered bank and is subject to extensive regulation, supervision and examination by the Office of the Comptroller of the Currency (“OCC”) as its primary federal regulator, and as to certain matters, the FRB, the Consumer Financial Protection Bureau (“CFPB”), and the Federal Deposit Insurance Corporation (“FDIC”).

The Company is also subject to the jurisdiction of the SEC and is subject to disclosure and regulatory requirement under the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended. The Company’s common stock is listed on the New York Stock Exchange (“NYSE”) and it is subject to NYSE’s rules for listed companies. Affiliated entities, including BPAS, HB&T, HSI, BPAS Trust Company of Puerto Rico, Nottingham, CISI, OneGroup, Carta Group, OWM and CBNA Insurance are subject to the jurisdiction of certain state and federal regulators and self-regulatory organizations including, but not limited to, the SEC, the Texas Department of Banking, the Financial Industry Regulatory Authority (“FINRA”), Puerto Rico Office of the Commissioner of Financial Institutions, and state securities and insurance regulators.

Federal Bank Holding Company Regulation

The Company is a bank holding company under the Bank Holding Company Act of 1956, (the “BHC Act”) that registered in 2015 with the FRB as a single bank financial holding company, as provided by the Financial Modernization Act of 1999 as amended (also known as the Gramm-Leach-Bliley Act (the “GLB Act”)). The Company continues to maintain its status as a bank holding company for purposes of other FRB regulations. The BHC Act generally restricts bank holding companies from engaging in business activities other than the business of banking and certain closely related activities. As a bank holding company that has elected to become a financial holding company, the Company can affiliate with securities firms and insurance companies and engage in other activities that are financial in nature or incidental or complementary to activities that are financial in nature, as long as it continues to meet the eligibility requirements for financial holding companies (including requirements that the financial holding company and its depository institution subsidiary maintain their status as “well capitalized” and “well managed”). Generally, FRB approval is not required for the Company to acquire a company (other than a bank holding company, bank or savings association) engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the FRB.

The FRB has the authority to limit a financial holding company’s ability to conduct activities that would otherwise be permissible if the financial holding company or any of its depositary institution subsidiaries ceases to meet the applicable eligibility requirements. The FRB may also impose corrective capital and/or managerial requirements on the financial holding company and may require divestiture of the holding company’s depository institutions if the deficiencies persist. Federal regulations also provide that if any depository institution controlled by a financial holding company fails to maintain a satisfactory rating under the Community Reinvestment Act, the FRB must prohibit the financial holding company and its subsidiaries from engaging in any activities other than those permissible for bank holding companies.

7 of 105

Federal Reserve System Regulation

Because the Company is a bank holding company, it is subject to regulatory capital requirements and required by the FRB to, among other things, maintain cash reserves against its deposits. The Bank is under similar capital requirements administered by the OCC as discussed below. FRB policy has historically required a bank holding company to act as a source of financial and managerial strength to its subsidiary banks. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) codifies this historical policy as a statutory requirement. To the extent the Bank is in need of capital, the Company could be expected to provide additional capital, including borrowings from the FRB for such purpose. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors’ funds.

The FRB also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the FRB, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust our strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond their control.

The Office of Comptroller of the Currency Regulation

The Bank is supervised and regularly examined by the OCC. The various laws and regulations administered by the OCC affect the Company’s practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects the Bank’s business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and the location of its offices. The OCC generally prohibits a depository institution from making any capital distributions, including the payment of a dividend, or paying any management fee to its parent holding company if the depository institution would become undercapitalized due to the payment. Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the OCC. The Bank is well capitalized under regulatory standards administered by the OCC. For additional information on our capital requirements see “Management’s Discussion and Analysis of Financial Condition and Results of Operations – Shareholders’ Equity” and Note P to the Financial Statements.

Federal Home Loan Bank

The Bank is a member of the FHLB, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to the rules and requirements of the FHLB, including the purchase of shares of FHLB activity-based stock in the amount of 4.5% of the dollar amount of outstanding advances and FHLB capital stock in an amount equal to the greater of $1,000 or the sum of 0.15% of the mortgage-related assets held by the Bank based upon the previous year-end financial information. The Bank was in compliance with the rules and requirements of the FHLB at December 31, 2015.

Deposit Insurance

Deposits of the Bank are insured up to the applicable limits by the Deposit Insurance Fund (“DIF”) and are subject to deposit insurance assessments to maintain the DIF. The Dodd-Frank Act permanently increased the maximum amount of deposit insurance to $250,000 per deposit category, per depositor, per institution. A depository institution’s DIF assessment is calculated by multiplying its assessment rate by the assessment base, which is defined as the average consolidated total assets less the average tangible equity of the depository institution. The initial base assessment rate is based on its capital level and supervisory ratings (its “CAMEL ratings”), certain financial measures to assess an institution’s ability to withstand asset related stress and funding related stress and, in some cases, additional discretionary adjustments by the FDIC to reflect additional risk factors.

In October 2010, the FDIC adopted a DIF restoration plan to ensure that the fund reserve ratio reaches 1.35% by September 30, 2020, as required by the Dodd-Frank Act. At least semi-annually, the FDIC will update its loss and income projections for the fund and, if needed, will increase or decrease assessment rates, following notice-and-comment rulemaking if required. FDIC insurance expense totaled $4.0 million, $3.9 million and $3.8 million in 2015, 2014 and 2013, respectively.

Under the Federal Deposit Insurance Act, if the FDIC finds that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, the FDIC may determine that such violation or unsafe or unsound practice or condition require the termination of deposit insurance.

8 of 105

Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

On July 21, 2010, the Dodd-Frank Act was signed into law, which resulted in significant changes to the banking industry. The provisions that have received the most public attention have been those that apply to financial institutions larger than the Company; however, the Dodd-Frank Act does contain numerous other provisions that affect all banks and bank holding companies and impacts how the Company and the Bank handle their operations. The Dodd-Frank Act requires various federal agencies, including those that regulate the Company and the Bank, to promulgate new rules and regulations and to conduct various studies and reports for Congress. The federal agencies have either completed or are in the process of completing these rules and regulations and have been given significant discretion in drafting such rules and regulations. Several of the provisions of the Dodd-Frank Act may have the consequence of increasing the Bank’s expenses, decreasing its revenues, and changing the activities in which it chooses to engage. The specific impact of the Dodd-Frank Act on the Company’s current activities or new financial activities the Company may consider in the future, the Company’s financial performance, and the markets in which the Company operates depends on the manner in which the relevant agencies continue to develop and implement the required rules and regulations and the reaction of market participants to these regulatory developments.

Pursuant to FRB regulations mandated by the Dodd-Frank Act, effective October 1, 2011, interchange fees on debit card transactions are limited to a maximum of $.21 per transaction plus 5 basis points of the transaction amount. A debit card issuer may recover an additional one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements prescribed by the FRB. Issuers that, together with their affiliates, have less than $10 billion in assets, such as the Company, are exempt from the debit card interchange fee standards. The FRB also adopted requirements in the final rule that issuers include two unaffiliated networks for routing debit transactions that are applicable to the Company and the Bank.

The final rules issued by the FRB, SEC, OCC, FDIC, and Commodity Futures Trading Commission implementing Section 619 of the Dodd-Frank Act (commonly known as the Volcker Rule) prohibit insured depository institutions and companies affiliated with insured depository institutions from engaging in short-term proprietary trading of certain securities, derivatives, commodity futures and options on these instruments, for their own account. The final rules also impose limits on banking entities’ investments in, and other relationships with, hedge funds or private equity funds. Banking entities with less than $10 billion in total consolidated assets, which generally have very little or no involvement in prohibited proprietary trading or investment activities in covered funds, do not have any compliance obligations under the final rule if they do not engage in any covered activities other than trading in certain government, agency, State or municipal obligations.

The CFPB rules implementing Section 1073 of the Dodd-Frank Act create a comprehensive new system of consumer protections for remittance transfers sent by consumers in the United States to individuals and businesses in foreign countries. The amendments provide new protections, including disclosure requirements, and error resolution and cancellation rights, to consumers who send remittance transfers to other consumers or businesses in a foreign country. The Bank has adopted policies and procedures to comply with the final foreign remittance transfer rules.

The scope and impact of many of the Dodd-Frank Act’s provisions will continue to be determined over time, including as final regulations are issued and become effective. As a result, the Company cannot predict the ultimate impact of the Dodd-Frank Act on the Company or the Bank at this time, including the extent to which it could increase costs or limit the Company’s ability to pursue business opportunities in an efficient manner, or otherwise adversely affect its business, financial condition and results of operations. Nor can the Company predict the impact or substance of other future legislation or regulation. However, it is expected that they at a minimum will increase the Company’s and the Bank’s operating and compliance costs. As rules and regulations continue to be implemented or issued, the Company may need to dedicate additional resources to ensure compliance, which may increase its costs of operations and adversely impact its earnings.

Capital Requirements

The Company and the Bank are required to comply with applicable capital adequacy standards established by the federal banking agencies. The risk-based capital standards that were applicable to the Company and the Bank through December 31, 2014 were based on the 1988 Capital Accord, known as Basel I (“Basel I”), of the Basel Committee on Banking Supervision (the “Basel Committee”). However, in July 2013, the FRB, the OCC and the FDIC approved final rules (the “New Capital Rules”) establishing a new comprehensive capital framework for U.S. banking organizations. These rules went into effect for the Company and the Bank on January 1, 2015, subject to phase-in periods for certain components.

The New Capital Rules implement the Basel Committee’s December 2010 capital framework (known as “Basel III”) for strengthening international capital standards as well as certain provisions of the Dodd-Frank Act. The New Capital Rules substantially revise the risk-based capital requirements applicable to bank holding companies and depository institutions, including the Company and the Bank, compared to the previous U. S. Basel I risk-based capital rules. The New Capital Rules define the components of capital and address other issues affecting the numerator in banking institutions regulatory capital ratios and replace the Basel I risk-weighting approach, with a more risk-sensitive one based, in part, on the standardized approach set forth in “Basel II”. The New Capital Rules also implement the requirements of Section 939A of the Dodd-Frank Act to remove references to credit ratings from the Federal banking agencies’ rules.

9 of 105

The New Capital Rules, among other things: (i) introduces as a new capital measure “Common Equity Tier 1,” (“CET1”), (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting specified revised requirements, (iii) defines CET1 narrowly by requiring that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital, and (iv) expands the scope of the deductions from and adjustments to capital as compared to existing regulations. Under the New Capital Rules, the most common form of Additional Tier 1 capital is non-cumulative perpetual preferred stock, and the most common form of Tier 2 capital is subordinated notes and a portion of the allowance for loan and lease losses, in each case, subject to the New Capital Rules specific requirements.

Under the New Capital Rules, the minimum capital rations as of January 1, 2015 are as follows:

● 4.5% CET1 to total risk-weighted assets;

● 6.0% Tier 1 capital (CET1 plus Additional Tier 1 capital) to total risk-weighted assets;

● 8.0% Total capital (Tier 1 Capital plus Tier 2 capital) to total risk-weighted assets;

● 4.0% Tier 1 capital to total adjusted quarterly average assets (known as “leverage ratio”)

Beginning in 2016, the New Capital Rules will require the Company and the Bank to maintain a “capital conservation buffer” composed entirely of CET1. When it is fully phased-in by the beginning of 2019, banking organizations will be required to maintain a minimum capital conservation buffer of 2.5% (CET1 to Total risk-weighted assets), in addition to the minimum risk-based capital ratios. Therefore, to satisfy both the minimum risk-based capital ratios and the capital conservation buffer, a banking organization will be required to maintain the following: (i) CET1 to total risk-weighted assets of at least 7%, (ii) Tier 1 capital to total risk-weighted assets of at least 8.5%, and (iii) Total capital (Tier 1 capital plus Tier 2 capital) to total risk-weighted assets of at least 10.5% by January 1, 2019, upon full phase-in of the capital conservation buffer. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions that do not maintain a capital conservation buffer of 2.5% or more will face constraints on dividends, common share repurchases and incentive compensation based on the amount of the shortfall.

The New Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, deferred tax assets dependent upon future taxable income and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. Under the general Basel I risk based capital rules, the effects of accumulated other comprehensive income or loss items included in shareholders' equity (for example, marks-to-market of securities held in the available for sale portfolio) were reversed for the purposes of determining regulatory capital. Under the New Capital Rules, the effects of certain accumulated other comprehensive items are not excluded; however, non-advanced approaches banks, including the Company and the Bank, were permitted to, and in the case of the Company and the Bank they did, make a one-time permanent election to continue to exclude these items.

Consistent with the section 171 of the Dodd-Frank Act, the New Capital Rules allow certain bank holding companies to include certain hybrid securities, such as trust preferred securities, in Tier 1 capital if they had less than $15 billion in assets as of December 31, 2009 and the securities were issued before May 19, 2010. Accordingly, the trust preferred securities classified as long-term debt on the Company’s balance sheet will be included as Tier 1 capital while they are outstanding, unless the Company completes an acquisition of a depository institution holding company that did not meet this criteria, or are acquired by such an organization, after January 1, 2014, at which time they would be subject to the stated phase-out requirements of the New Capital Rules and would be included as Tier 2 capital.

Implementation of the deductions and other adjustments to CET1 began on January 1, 2015 and will be phased-in over a 4-year period (beginning at 40% on January 1, 2015 and an additional 20% per year thereafter). The implementation of the capital conservation buffer will begin on January 1, 2016 at the 0.625% level and will be phased in over a four-year period (increasing by that amount on each subsequent January 1, until it reaches 2.5% on January 1, 2019).

With respect to the Bank, the New Capital Rules also revise the prompt corrective action (“PCA”) regulations established pursuant to Section 38 of the Federal Deposit Insurance Act, by (i) introducing a CET1 ratio requirement for each capital category other than critically undercapitalized, with the required CET1 ratio being 6.5% for well-capitalized status; (ii) increasing the minimum Tier 1 capital ratio requirement for each capital category, with the minimum Tier 1 capital ratio for well-capitalized status being 8.0% (as compared to the current 6.0%); and (iii) eliminating the current provision that allows certain highly-rated banking organizations to maintain a 3.0% leverage ratio and still be adequately capitalized. The New Capital Rules do not change the Total risk-based PCA capital requirement for any capital category.

10 of 105

The New Capital Rules prescribe a new standardized approach for risk weighted-assets that expands the risk-weight categories from the current four Basel I-derived categories (0%, 20%, 50% and 100%) to a larger and more risk-sensitive number of categories, depending on the nature of the asset. The new risk-weight categories generally range from 0% for U.S. government and agency securities, to 1250% for certain securitized exposures, and result in higher risk weights for a variety of asset categories. The standardized approach requires financial institutions to transition assets that are 90 days or more past due or on nonaccrual from their original risk weight to 150 percent. Additionally, loans designated as high volatility commercial real estate (“HVCRE”) are assigned a risk-weighting of 140 percent.

Requirements to maintain higher levels of capital or to maintain higher levels of liquid assets could adversely impact the Company's net income and return on equity. The current requirements and the Company's actual capital levels are detailed in Note P of “Notes to Consolidated Financial Statements” filed in Part II, Item 8, “Financial Statements and Supplementary Data.”

Consumer Protection Laws

In connection with its banking activities, the Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending to various sectors of the economy. These laws include the Equal Credit Opportunity Act, GLB Act, the Fair Credit Reporting Act (“FCRA”), the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”), Electronic Funds Transfer Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Dodd-Frank Act, the Real Estate Settlement Procedures Act, the Secure and Fair Enforcement for Mortgage Licensing Act (“SAFE”), and various state law counterparts.

The Dodd-Frank Act created the CFPB with broad powers to supervise and enforce consumer protection laws, including laws that apply to banks in order to prohibit unfair, deceptive or abusive practices. The CFPB has examination authority over all banks and savings institutions with more than $10 billion in assets. Because the Company is below this threshold, the OCC continues to exercise primary examination authority over the Bank with regard to compliance with federal consumer protection laws and regulations. The Dodd-Frank Act weakens the federal preemption rules that have been applicable to national banks and gives attorney generals for the states certain powers to enforce federal consumer protection laws. Further, under the Dodd-Frank Act, it is unlawful for any provider of consumer financial products or services to engage in any unfair, deceptive, or abusive acts or practice (“UDAAP”). A violation of the consumer protection and privacy laws, and in particular UDAAP, could have serious legal, financial, and reputational consequences.

In addition, the GLB Act requires all financial institutions to adopt privacy policies, restrict the sharing of nonpublic customer data with nonaffiliated parties and establishes procedures and practices to protect customer data from unauthorized access. In addition, the FCRA, as amended by the FACT Act, includes provisions affecting the Company, the Bank, and their affiliates, including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. The FACT Act requires persons subject to FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the Federal Trade Commission have extensive rulemaking authority under the FACT Act, and the Company and the Bank are subject to the rules that have been created under the FACT Act, including rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate certain identity theft red flags. The Bank is also subject to data security standards and data breach notice requirements issued by the OCC and other regulatory agencies. The Bank has created policies and procedures to comply with these consumer protection requirements.

The CFPB issued the final rules implementing the ability-to-repay and qualified mortgage (QM) provisions of the Truth in Lending Act, as amended by the Dodd-Frank Act (the “QM Rule”). The ability-to-repay provision requires creditors to make reasonable, good faith determinations that borrowers are able to repay their mortgages before extending the credit based on a number of factors and consideration of financial information about the borrower derived from reasonably reliable third-party documents. Under the Dodd-Frank Act and the QM Rule, loans meeting the definition of “qualified mortgage” are entitled to a presumption that the lender satisfied the ability-to-repay requirements. The presumption is a conclusive presumption/safe harbor for loans meeting the QM requirements, and a rebuttable presumption for higher-priced loans meeting the QM requirements. The definition of a “qualified mortgage” incorporates the statutory requirements, such as not allowing negative amortization or terms longer than 30 years. The QM Rule also adds an explicit maximum 43% debt-to-income ratio for borrowers if the loan is to meet the QM definition, though some mortgages that meet government-sponsored enterprises, Federal Housing Administration, and Veterans Administration underwriting guidelines may, for a period not to exceed seven years, meet the QM definition without being subject to the 43% debt-to-income limits. The Bank has created policies and procedures to comply with these consumer protection requirements.

11 of 105

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The USA Patriot Act also encourages information-sharing among financial institutions, regulators, and law enforcement authorities by providing an exemption from the privacy provisions of the GLB Act for financial institutions that comply with the provision of the Act. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the institution. The Company has approved policies and procedures that are designed to comply with the USA Patriot Act and its regulations.

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others administrated by the Treasury’s Office of Foreign Assets Control (“OFAC”). The OFAC administered sanctions can take many different forms; however, they generally contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments in, or providing investment related advice or assistance to, a sanctioned country; and (ii) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934, as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) new requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) additional responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) the creation of an independent accounting oversight board for the accounting industry; (iv) new standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on non-preferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violations of the securities laws.

Electronic Fund Transfer Act

A federal banking rule under the Electronic Fund Transfer Act prohibits financial institutions from charging consumers fees for paying overdrafts on automated teller machines and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions. The new rule does not govern overdraft fees on the payment of checks and certain other forms of bill payments.

Community Reinvestment Act of 1977

Under the Community Reinvestment Act of 1977 (“CRA”), the Bank is required to help meet the credit needs of its communities, including low- and moderate-income neighborhoods. Although the Bank must follow the requirements of CRA, it does not limit the Bank’s discretion to develop products and services that are suitable for a particular community or establish lending requirements or programs. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibits discrimination in lending practices. The Bank’s failure to comply with the provisions of the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s failure to comply with the Equal Credit Opportunity Act and the Fair Housing Act could result in enforcement actions against it by its regulators as well as other federal regulatory agencies and the Department of Justice. The Bank’s latest CRA rating was “Satisfactory”.

The Bank Secrecy Act

The Bank Secrecy Act (“BSA”) requires all financial institutions, including banks and securities broker-dealers, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. The BSA includes a variety of recordkeeping and reporting requirements (such as cash and suspicious activity reporting), as well as due diligence/know-your-customer documentation requirements. The Company has established an anti-money laundering program and taken other appropriate measures in order to comply with BSA requirements.

12 of 105

Community Bank System, Inc. (the “Company”) was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company is a single bank holding company which wholly-owns five subsidiaries: Community Bank, N.A. (the “Bank” or “CBNA”), Benefit Plans Administrative Services, Inc. (“BPAS”), CFSI Closeout Corp. (“CFSICC”), First of Jermyn Realty Company, Inc. (“FJRC”) and Town & Country Agency LLC (“T&C”). BPAS owns four subsidiaries: Benefit Plans Administrative Services, LLC (“BPA”), a provider of defined contribution plan administration services; Harbridge Consulting Group, LLC (“Harbridge”), a provider of actuarial and benefit consulting services; BPAS Trust Company of Puerto Rico, a Puerto Rican trust company; and Hand Benefits & Trust Company (“HB&T”), a provider of collective investment fund administration and institutional trust services. HB&T owns one subsidiary, Hand Securities, Inc. (“HSI”), an introducing broker dealer. CFSICC, FJRC and T&C are inactive companies. The Company also wholly-owns two unconsolidated subsidiary business trusts formed for the purpose of issuing mandatorily-redeemable preferred securities which are considered Tier I capital under regulatory capital adequacy guidelines.

The Bank’s business philosophy is to operate as a community bank with local decision-making, principally in non-metropolitan markets, providing a broad array of banking and financial services to retail, commercial, and municipal customers. As of December 31, 2014, the Bank operates 182 full-service branches operating as Community Bank, N.A. throughout 35 counties of Upstate New York and six counties of Northeastern Pennsylvania, offering a range of commercial and retail banking services. The Bank owns the following subsidiaries: CBNA Insurance Agency, Inc. (“CBNA Insurance”), CBNA Preferred Funding Corporation (“PFC”), CBNA Treasury Management Corporation (“TMC”), Community Investment Services, Inc. (“CISI”), First Liberty Service Corp. (“FLSC”), Nottingham Advisors, Inc. (“Nottingham”), Brilie Corporation (“Brilie”), and Western Catskill Realty, LLC (“WCR”). CBNA Insurance is a full-service insurance agency offering primarily property and casualty products. PFC primarily acts as an investor in residential real estate loans. TMC provides cash management, investment, and treasury services to the Bank. CISI provides broker-dealer and investment advisory services. FLSC provides banking-related services to the Pennsylvania branches of the Bank. Nottingham provides asset management services to individuals, corporations, corporate pension and profit sharing plans, and foundations. Brilie and WCR are inactive companies.

The Company maintains a website at communitybankna.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information posted on the website is not incorporated into or a part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at http://www.sec.gov.

On February 24, 2015, the Company announced that it had entered into a definitive agreement to acquire Oneida Financial Corp. (“Oneida”), parent company of Oneida Savings Bank headquartered in Oneida, NY for approximately $142 million in Company stock and cash. The acquisition will extend the Company’s Central New York banking service area and complement the Company’s existing non-banking service capacity in the insurance, benefits administration and wealth management businesses. Upon the completion of the merger, Community Bank will add 12 branch locations and approximately $800 million of assets, including loans of $370 million and $690 million of deposits. The acquisition is expected to close during the third quarter of 2015, pending both customary regulatory and Oneida shareholder approval. The Company expects to incur certain one-time, transaction-related costs in 2015.

Acquisition History (2010-2014)

EBS-RMSCO, Inc.

On January 1, 2014, the Company, through its Harbridge subsidiary, completed its acquisition of a professional services practice from EBS-RMSCO, Inc., a subsidiary of The Lifetime Healthcare Companies (“EBS-RMSCO”). This professional services practice, which provides actuarial valuation and consulting services to clients who sponsor pension and post-retirement medical and welfare plans, enhances the Company’s participation in the Western New York market and added $1.2 million of incremental revenue in 2014.

Bank of America Branches

On December 13, 2013, the Bank completed its acquisition of eight retail branch-banking locations across its Northeast Pennsylvania markets from Bank of America, N.A. (“B of A”), acquiring approximately $0.9 million in loans and $303 million of deposits. The assumed deposits consist of $220 million of core deposits (checking, savings and money market accounts) and $83 million of time deposits. Under the terms of the purchase agreement, the Bank paid B of A a blended deposit premium of 2.4%, or approximately $7.3 million.

HSBC and First Niagara Branches

On July 20, 2012, the Bank completed its acquisition of 16 retail branches in central, northern and western New York from HSBC Bank USA, N.A. (“HSBC”), acquiring approximately $106 million in loans and $697 million of deposits. The assumed deposits consist primarily of core deposits (checking, savings and money market accounts) and the purchased loans consist of in-market performing loans, primarily residential real estate loans. Under the terms of the purchase agreement, the Bank paid First Niagara Bank, N.A. (“First Niagara”) (who acquired HSBC’s Upstate New York banking business and assigned its right to purchase the 16 branches to the Bank) a blended deposit premium of 3.4%, or approximately $24 million.

On September 7, 2012, the Bank completed its acquisition of three branches in central New York from First Niagara, acquiring approximately $54 million of loans and $101 million of deposits. The assumed deposits consist primarily of core deposits (checking, savings and money market accounts) and the purchased loans consist of in-market performing loans, primarily residential real estate loans. Under the terms of the purchase agreement, the Bank paid a blended deposit premium of 3.1%, or approximately $3 million.

CAI Benefits, Inc.

On November 30, 2011, BPAS acquired, in an all-cash transaction, certain assets and liabilities of CAI Benefits, Inc. (“CAI”), a provider of actuarial, consulting and retirement plan administration services, with offices in New York City and Northern New Jersey. The transaction added valuable service capacity and enhances distribution prospects in support of the Company’s broader-based employee benefits business, including daily valuation plan and collective investment fund administration.

The Wilber Corporation

On April 8, 2011, the Company acquired The Wilber Corporation, parent company of Wilber National Bank, and its 22 branch-banking centers in the Central, Greater Capital District and Catskill regions of New York for $103 million of stock and cash. The Company acquired approximately $462 million in loans, $297 million of investment securities and $772 million in deposits.

Services

Banking

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank's branches are generally located in smaller towns and cities within its geograph­ic market areas of Upstate New York and Northeastern Pennsylvania. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch and regional levels, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System and the Federal Home Loan Bank of New York ("FHLB"), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Employee Benefit Services

Through BPAS and its subsidiaries, the Company operates a national practice that provides employee benefit trust, collective investment fund, retirement plan administration, actuarial, VEBA/HRA and health and welfare consulting services to a diverse array of clients spanning the United States and Puerto Rico.

Wealth Management

Through the Bank, CISI, Nottingham and CBNA Insurance, the Company operates a wealth management, retirement planning, higher educational planning, fiduciary, risk management, and wealth protection business. Through a third party broker-dealer relationship, the Company offers investment alternatives including stocks, bonds, mutual funds and advisory products.

Segment Information

The Company has identified three operating business segments: Banking, Employee Benefit Services, and Wealth Management. Information about the Company’s business segments is included in Note T of the “Notes to Consolidated Financial Statements” filed herewith in Part II.

Competition

The banking and financial services industry is highly competitive in the New York and Pennsylvania markets. The Company competes actively for loans, deposits and customers with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, insurance companies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The table below summarizes the Bank’s deposits and market share by the forty-one counties of New York and Pennsylvania in which it has customer facilities. Market share is based on deposits of all commercial banks, credit unions, savings and loan associations, and savings banks.

Number of Towns Where Deposits as of Company 6/30/2014(1) Market Towns/ Has 1st or 2nd County State (000's omitted) Share (1) Branches ATM's Cities Market Position Lewis NY $164,915 72.03% 4 4 3 3 Franklin NY 233,642 56.94% 8 6 6 6 Hamilton NY 50,677 55.01% 2 2 2 2 Allegany NY 249,209 51.31% 9 10 8 8 Cattaraugus NY 387,929 42.90% 10 11 7 6 Seneca NY 219,590 39.20% 4 3 4 3 Otsego NY 355,218 36.67% 10 10 6 5 St. Lawrence NY 399,003 36.40% 12 9 11 10 Schuyler NY 49,715 27.55% 1 1 1 1 Clinton NY 333,606 26.87% 4 7 2 2 Jefferson NY 366,379 26.60% 7 9 6 6 Yates NY 86,885 26.07% 3 2 2 1 Wyoming PA 128,849 25.99% 4 4 3 3 Chautauqua NY 316,539 21.99% 13 12 11 8 Essex NY 135,816 21.73% 5 5 4 4 Livingston NY 164,112 20.40% 5 6 5 4 Steuben NY 180,604 19.67% 8 7 7 4 Delaware NY 163,535 17.07% 5 5 5 5 Wayne NY 126,234 16.17% 3 3 2 2 Ontario NY 234,970 13.23% 8 13 5 3 Oswego NY 162,122 12.89% 4 5 4 3 Tioga NY 35,906 9.07% 2 2 2 1 Lackawanna PA 412,446 7.97% 12 11 8 4 Luzerne PA 456,629 7.83% 11 15 8 3 Herkimer NY 43,828 7.58% 1 1 1 1 Chemung NY 74,810 7.22% 2 2 1 0 Susquehanna PA 51,458 6.80% 3 1 3 2 Schoharie NY 25,636 6.29% 1 1 1 0 Carbon PA 43,205 4.86% 2 2 2 1 Bradford PA 49,027 4.32% 2 2 2 1 Cayuga NY 40,735 3.98% 2 2 2 1 Chenango NY 28,510 3.72% 2 2 1 1 Washington NY 18,156 2.65% 1 0 1 1 Warren NY 32,205 2.19% 1 1 1 1 Oneida NY 58,214 1.86% 1 1 1 1 Broome NY 28,753 1.21% 1 1 1 0 Ulster NY 25,757 0.76% 1 1 1 1 Onondaga NY 30,395 0.34% 2 4 2 0 Erie NY 102,663 0.30% 4 4 3 2 Tompkins NY 4,772 0.27% 1 0 1 0 Saratoga NY 7,256 0.20% 1 1 1 0 $6,079,910 6.46% 182 188 147 110 (1) Deposits and Market Share data as of June 30, 2014, the most recent information available from SNL Financial LLC, adjusted for branch consolidations occurring after June 30, 2014.

Employees

As of December 31, 2014, the Company employed 1,920 full-time employees, 136 part-time employees and 126 temporary employees. None of the Company’s employees are represented by a collective bargaining agreement. The Company offers a variety of employment benefits and considers its relationship with its employees to be good.

Supervision and Regulation

General

The banking industry is highly regulated with numerous statutory and regulatory requirements that are designed primarily for the protection of depositors and the financial system, and not for the purpose of protecting shareholders. Set forth below is a description of the material information governing the laws and regulations applicable to the Company and the Bank. This summary is not complete and the reader should refer to these laws and regulations for more detailed information. The Company’s and the Bank’s failure to comply with applicable laws and regulations could result in a range of sanctions and administrative actions imposed upon the Company and/or the Bank, including the imposition of civil money penalties, formal agreements and cease and desist orders. Changes in applicable law or regulations, and in their interpretation and application by regulatory agencies, cannot be predicted, and may have a material effect on the Company’s business and results.

The Company and its subsidiaries are subject to the laws and regulations of the federal government and the states and jurisdictions in which they conduct business. The Company, as a bank holding company, is subject to extensive regulation, supervision and examination by the Board of Governors of the Federal Reserve System (“FRB”) as its primary federal regulator. The Bank is a nationally-chartered bank and is subject to extensive regulation, supervision and examination by the Office of the Comptroller of the Currency (“OCC”) as its primary federal regulator, and as to certain matters, the FRB, the Consumer Financial Protection Bureau (“CFPB”), and the FDIC.

The Company is also subject to the jurisdiction of the SEC and is subject to disclosure and regulatory requirement under the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended. The Company’s common stock is listed on the New York Stock Exchange (“NYSE”) and it is subject to NYSE’s rules for listed companies. Affiliated entities, including BPAS, HB&T, HSI, BPAS Trust Company of Puerto Rico, Nottingham, CISI, HSI and CBNA Insurance are subject to the jurisdiction of certain state and federal regulators and self-regulatory organizations including, but not limited to, the SEC, the Texas Department of Banking, the Financial Industry Regulatory Authority (“FINRA”), Puerto Rico Office of the Commissioner of Financial Institutions, and state securities and insurance regulators.

Federal Bank Holding Company Regulation

The Company is registered as a bank holding company under the Bank Holding Company Act of 1956, as amended (the “BHC Act”). The BHC Act limits the type of activities in which the Company and its subsidiaries may engage and the types of companies it may acquire or organize. In general, the Company and the Bank are prohibited from engaging in or acquiring direct or indirect control of any entity engaged in non-banking activities unless such activities are closely related to banking, as determined by the BHC Act. In addition, the Company must obtain the prior approval of the FRB to acquire control of any bank; to acquire, with certain exceptions, more than five percent of the outstanding voting stock of any other entity; or to merge or consolidate with another bank holding company. As a result of such laws and regulation, the Company is restricted as to the types of business activities it may conduct and the Bank is subject to limitations on, among others, the types of loans and the amounts of loans it may make to any one borrower. The Financial Modernization Act of 1999 (also known as the Gramm-Leach-Bliley Act (the “GLB Act”)) created, among other things, the “financial holding company,” an entity which may engage in a broader range of activities that are “financial in nature,” including insurance underwriting, securities underwriting and merchant banking. Bank holding companies which are well capitalized and well managed under regulatory standards may convert to financial holding companies relatively easily through a notice filing with the FRB, which acts as the “umbrella regulator” for such entities. The Company may seek to become a financial holding company in the future.

Federal Reserve System Regulation

Because the Company is a bank holding company it is subject to regulatory capital requirements and required by the FRB to, among other things, maintain cash reserves against its deposits. The Bank is under similar capital requirements administered by the OCC as discussed below. FRB policy has historically required a bank holding company to act as a source of financial and managerial strength to its subsidiary banks. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) codifies this historical policy as a statutory requirement. To the extent the Bank is in need of capital, the Company could be expected to provide additional capital, including borrowings from the FRB for such purpose. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors’ funds.

The FRB has established minimum capital requirements for the Company and the Bank. The FRB capital adequacy guidelines apply on a consolidated basis and require bank holding companies to maintain a minimum ratio of Tier 1 capital to total average assets (or “leverage ratio”) of 4%. The FRB capital adequacy guidelines also require bank holding companies to maintain a minimum ratio of Tier 1 capital to risk-weighted assets of 4% and a minimum ratio of qualifying total capital to risk-weighted assets of 8%. As of December 31, 2014, the Company’s leverage ratio was 9.96%, its ratio of Tier 1 capital to risk-weighted assets was 17.27%, and its ratio of qualifying total capital to risk-weighted assets was 18.42%. For additional information on the Company’s capital requirements see “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Capital” and Note P to the Financial Statements. The FRB may set higher minimum capital requirements for bank holding companies whose circumstances warrant it, such as companies anticipating significant growth or facing unusual risks. Any holding company whose capital does not meet the minimum capital adequacy guidelines is considered to be undercapitalized and is required to submit an acceptable plan to the FRB for achieving capital adequacy. Such a company’s ability to pay dividends to its shareholders and expand its lines of business through the acquisition of new banking or nonbanking subsidiaries also could be restricted.

The FRB also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the FRB, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust our strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond their control.

The Office of Comptroller of the Currency Regulation

The Bank is supervised and regularly examined by the OCC. The various laws and regulations administered by the OCC affect the Company’s practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects the Bank’s business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and the location of its offices. The OCC generally prohibits a depository institution from making any capital distributions, including the payment of a dividend, or paying any management fee to its parent holding company if the depository institution would become undercapitalized due to the payment. Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the OCC. The Bank is well capitalized under regulatory standards administered by the OCC. For additional information on our capital requirements see “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Capital” and Note P to the Financial Statements.

Federal Home Loan Bank

The Bank is a member of the FHLB, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to the rules and requirements of the FHLB, including the purchase of shares of FHLB activity-based stock in the amount of 4.5% of the dollar amount of outstanding advances and FHLB capital stock in an amount equal to the greater of $1,000 or the sum of 0.15% of the mortgage-related assets held by the Bank based upon the previous year-end financial information. The Bank was in compliance with the rules and requirements of the FHLB at December 31, 2014.

Deposit Insurance

Substantially all of the deposits of the Bank are insured up to applicable limits by the Deposit Insurance Fund (“DIF”) and are subject to deposit insurance assessments to maintain the DIF. The Dodd-Frank Act permanently increased the maximum amount of deposit insurance to $250,000 per deposit category, per depositor, per institution retroactive to January 1, 2008. On April 1, 2011, the deposit insurance assessment base changed from total domestic deposits to the average consolidated total assets minus the average tangible equity of the depository institution, pursuant to a rule issued by the FDIC as required by the Dodd-Frank Act. Additionally, the deposit insurance assessment system was revised to create a two scorecard system, one for most large institutions that have more than $10 billion in assets and another for “highly complex” institutions that have over $50 billion in assets and are fully owned by a parent with over $500 billion in assets. The Bank is not affected by the two scorecard system as total assets are below the minimum threshold.

In October 2010, the FDIC adopted a DIF restoration plan to ensure that the fund reserve ratio reaches 1.35% by September 30, 2020, as required by the Dodd-Frank Act. At least semi-annually, the FDIC will update its loss and income projections for the fund and, if needed, will increase or decrease assessment rates, following notice-and-comment rulemaking if required. FDIC insurance expense totaled $3.9 million, $3.8 million and $3.8 million in 2014, 2013 and 2012, respectively.

Under the Federal Deposit Insurance Act, if the FDIC finds that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, the FDIC may determine that such violation or unsafe or unsound practice or condition require the termination of deposit insurance.

Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

On July 21, 2010, the Dodd-Frank Act was signed into law, which resulted in significant changes to the banking industry. The provisions that have received the most public attention have been those that apply to financial institutions larger than the Company; however, the Dodd-Frank Act does contain numerous other provisions that affect all banks and bank holding companies and impacts how the Company and the Bank handle their operations. The Dodd-Frank Act requires various federal agencies, including those that regulate the Company and the Bank, to promulgate new rules and regulations and to conduct various studies and reports for Congress. The federal agencies are in the process of promulgating these rules and regulations and have been given significant discretion in drafting such rules and regulations. Several of the provisions of the Dodd-Frank Act may have the consequence of increasing the Bank’s expenses, decreasing its revenues, and changing the activities in which it chooses to engage. The specific impact of the Dodd-Frank Act on the Company’s current activities or new financial activities the Company may consider in the future, the Company’s financial performance, and the markets in which the Company operates depends on the manner in which the relevant agencies continue to develop and implement the required rules and regulations and the reaction of market participants to these regulatory developments.

The Dodd-Frank Act includes provisions that, among other things applies the same leverage and risk-based capital requirements that apply to insured depository institutions to most bank holding companies, which, among other things as applied to the Company, going forward will preclude the Company from including in Tier 1 Capital trust preferred securities or cumulative preferred stock, if any, issued on or after May 19, 2010. The Company has not issued any trust preferred securities since May 19, 2010.

Pursuant to FRB regulations mandated by the Dodd-Frank Act, effective October 1, 2011, interchange fees on debit card transactions are limited to a maximum of $.21 per transaction plus 5 basis points of the transaction amount. A debit card issuer may recover an additional one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements prescribed by the FRB. Issuers that, together with their affiliates, have less than $10 billion in assets, such as the Company, are exempt from the debit card interchange fee standards. The FRB also adopted requirements in the final rule that issuers include two unaffiliated networks for routing debit transactions that are applicable to the Company and the Bank.

On December 10, 2013, the FRB, SEC, OCC, FDIC and Commodity Futures Trading Commission issued the final rules implementing Section 619 of the Dodd-Frank Act (commonly known as the Volcker Rule) which became effective on April 1, 2014. The final rules prohibit insured depository institutions and companies affiliated with insured depository institutions from engaging in short-term proprietary trading of certain securities, derivatives, commodity futures and options on these instruments, for their own account. The final rules also impose limits on banking entities’ investments in, and other relationships with, hedge funds or private equity funds. Banking entities with less than $10 billion in total consolidated assets, which generally have very little or no involvement in prohibited proprietary trading or investment activities in covered funds, do not have any compliance obligations under the final rule if they do not engage in any covered activities other than trading in certain government, agency, State or municipal obligations.

On February 7, 2012, the CFPB issued the final rules implementing Section 1073 of the Dodd-Frank Act to create a comprehensive new system of consumer protections for remittance transfers sent by consumers in the United States to individuals and businesses in foreign countries. The final rules became effective on October 28, 2013. The amendments provide new protections, including disclosure requirements, and error resolution and cancellation rights, to consumers who send remittance transfers to other consumers or businesses in a foreign country. The Bank has adopted policies and procedures to comply with the final foreign remittance transfer rules.

The scope and impact of many of the Dodd-Frank Act’s provisions will continue to be determined over time as final regulations are issued and become effective. As a result, the Company cannot predict the ultimate impact of the Dodd-Frank Act on the Company or the Bank at this time, including the extent to which it could increase costs or limit the Company’s ability to pursue business opportunities in an efficient manner, or otherwise adversely affect its business, financial condition and results of operations. Nor can the Company predict the impact or substance of other future legislation or regulation. However, it is expected that they at a minimum will increase the Company’s and the Bank’s operating and compliance costs. As rules and regulations continue to be issued, the Company may need to dedicate additional resources to ensure compliance, which may increase its costs of operations and adversely impact its earnings.

Basel III

In December 2010, the Basel Committee, a group of bank regulatory supervisors from around the world, released its final framework for strengthening international capital and liquidity regulation, now officially identified by the Basel Committee as “Basel III.” In July 2013, the FRB, FDIC and OCC released the final rules implementing Basel III in the United States. For community banks with less than $15 billion in assets, the new minimum capital requirements are effective on January 1, 2015 and the capital conservation buffer and deductions from CET1 capital (defined below) phase in over time.

The Basel III final capital framework, among other things: introduces as a new capital measure “Common Equity Tier 1,” or “CET1,” specifies that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting specified requirements, defines CET1 narrowly by requiring that most adjustments to regulatory capital measures be made to CET1 and not to the other components of capital, and expands the scope of the adjustments as compared to existing regulations. When fully phased in on January 1, 2019, Basel III requires banks to maintain:

● a minimum ratio of CET1 to risk-weighted assets of at least 4.5 percent, plus a 2.5 percent “capital conservation buffer” (which is added to the 4.5 percent CET1 ratio as that buffer is phased in, effectively resulting in a minimum ratio of CET1 to risk-weighted assets of at least 7 percent);

● a minimum ratio of Tier 1 capital to risk-weighted assets of at least 6.0 percent, plus the capital conservation buffer (which is added to the 6.0 percent Tier 1 capital ratio as that buffer is phased in, effectively resulting in a minimum Tier 1 capital ratio of 8.5 percent upon full implementation);

● a minimum ratio of Total (that is, Tier 1 plus Tier 2) capital to risk-weighted assets of at least 8.0 percent, plus the capital conservation buffer (which is added to the 8.0 percent total capital ratio as that buffer is phased in, effectively resulting in a minimum total capital ratio of 10.5 percent upon full implementation);

● as a newly adopted international standard, a minimum leverage ratio of 3.0 percent, calculated as the ratio of Tier 1 capital to balance sheet exposures plus certain off-balance sheet exposures (as the average for each quarter of the month-end ratios for the quarter); and

● provides for a “countercyclical capital buffer,” generally to be imposed when national regulators determine that excess aggregate credit growth becomes associated with a buildup of systemic risk, that would be a CET1 add-on to the capital conservation buffer in the range of 0 percent to 2.5 percent when fully implemented (potentially resulting in total buffers of between 2.5 percent and 5 percent).

The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the conservation buffer (or below the combined capital conservation buffer and countercyclical capital buffer, when the latter is applied) will face constraints on dividends, equity repurchases and compensation based on the amount of the shortfall. Banking institutions will be required to meet the following minimum capital ratios based upon the final Basel III rules:

● 4.5 percent CET1 to risk-weighted assets;

● 6.0 percent Tier 1 capital to risk-weighted assets; and

● 8.0 percent Total capital to risk-weighted assets.

The Basel III final framework provides for a number of new deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, deferred tax assets and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10 percent of CET1 or all such categories in the aggregate exceed 15 percent of CET1. Implementation of the deductions and other adjustments to CET1 will begin on January 1, 2015 and will be phased-in over a five-year period (20 percent per year). The implementation of the capital conservation buffer will begin on January 1, 2016 at 0.625 percent and be phased in over a four-year period (increasing by that amount on each subsequent January 1, until it reaches 2.5 percent on January 1, 2019). The Company fully expects to be in compliance with the higher Basel III capital standards as they become effective.

Consumer Protection Laws

In connection with its banking activities, the Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending to various sectors of the economy. These laws include the Equal Credit Opportunity Act, GLB Act, the Fair Credit Reporting Act (“FCRA”), the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”), Electronic Funds Transfer Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Dodd-Frank Act, the Real Estate Settlement Procedures Act, the Secure and Fair Enforcement for Mortgage Licensing Act (“SAFE”), and various state law counterparts.

The Dodd-Frank Act created the CFPB with broad powers to supervise and enforce consumer protection laws, including laws that apply to banks in order to prohibit unfair, deceptive or abusive practices. The CFPB has examination authority over all banks and savings institutions with more than $10 billion in assets. Because the Company is below this threshold, the OCC continues to exercise primary examination authority over the Bank with regard to compliance with federal consumer protection laws and regulations. The Dodd-Frank Act weakens the federal preemption rules that have been applicable to national banks and gives attorneys general for the states certain powers to enforce federal consumer protection laws. Further, under the Dodd-Frank Act, it is unlawful for any provider of consumer financial products or services to engage in any unfair, deceptive, or abusive acts or practice (“UDAAP”). A violation of the consumer protection and privacy laws, and in particular UDAAP, could have serious legal, financial, and reputational consequences.

In addition, the GLB Act requires all financial institutions to adopt privacy policies, restrict the sharing of nonpublic customer data with nonaffiliated parties and establishes procedures and practices to protect customer data from unauthorized access. In addition, the FCRA, as amended by the FACT Act, includes provisions affecting the Company, the Bank, and their affiliates, including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. The FACT Act requires persons subject to FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the Federal Trade Commission have extensive rulemaking authority under the FACT Act, and the Company and the Bank are subject to the rules that have been created under the FACT Act, including rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate certain identity theft red flags. The Bank is also subject to data security standards and data breach notice requirements issued by the OCC and other regulatory agencies. The Bank has created policies and procedures to comply with these consumer protection requirements.

On January 10, 2013, the CFPB issued the final rules implementing the ability-to-repay and qualified mortgage (QM) provisions of the Truth in Lending Act, as amended by the Dodd-Frank Act (the “QM Rule”). The ability-to-repay provision requires creditors to make reasonable, good faith determinations that borrowers are able to repay their mortgages before extending the credit based on a number of factors and consideration of financial information about the borrower derived from reasonably reliable third-party documents. Under the Dodd-Frank Act and the QM Rule, loans meeting the definition of “qualified mortgage” are entitled to a presumption that the lender satisfied the ability-to-repay requirements. The presumption is a conclusive presumption/safe harbor for loans meeting the QM requirements, and a rebuttable presumption for higher-priced loans meeting the QM requirements. The definition of a “qualified mortgage” incorporates the statutory requirements, such as not allowing negative amortization or terms longer than 30 years. The QM Rule also adds an explicit maximum 43% debt-to-income ratio for borrowers if the loan is to meet the QM definition, though some mortgages that meet government-sponsored enterprises, Federal Housing Administration, and Veterans Administration underwriting guidelines may, for a period not to exceed seven years, meet the QM definition without being subject to the 43% debt-to-income limits. The QM Rule became effective on January 10, 2014 and the Bank has created policies and procedures to comply with these consumer protection requirements.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The USA Patriot Act also encourages information-sharing among financial institutions, regulators, and law enforcement authorities by providing an exemption from the privacy provisions of the GLB Act for financial institutions that comply with the provision of the Act. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the institution. The Company has approved policies and procedures that are designed to comply with the USA Patriot Act and its regulations.

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others administrated by the Treasury’s Office of Foreign Assets Control (“OFAC”). The OFAC administered sanctions can take many different forms depending upon the country; however, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments in, or providing investment related advice or assistance to, a sanctioned country; and (ii) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934, as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) new requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) additional responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) the creation of an independent accounting oversight board for the accounting industry; (iv) new standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on non-preferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violations of the securities laws.

Electronic Fund Transfer Act

Effective July 1, 2010, a federal banking rule under the Electronic Fund Transfer Act prohibits financial institutions from charging consumers fees for paying overdrafts on automated teller machines and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions. The new rule does not govern overdraft fees on the payment of checks and regular electronic bill payments. The adoption of this regulation lowered fee income immediately after its effective date.

Community Reinvestment Act of 1977

Under the Community Reinvestment Act of 1977 (“CRA”), the Bank is required to help meet the credit needs of its communities, including low- and moderate-income neighborhoods. Although the Bank must follow the requirements of CRA, it does not limit the Bank’s discretion to develop products and services that are suitable for a particular community or establish lending requirements or programs. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibits discrimination in lending practices. The Bank’s failure to comply with the provisions of the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s failure to comply with the Equal Credit Opportunity Act and the Fair Housing Act could result in enforcement actions against it by its regulators as well as other federal regulatory agencies and the Department of Justice. The Bank’s latest CRA rating was “Satisfactory”.

The Bank Secrecy Act

The Bank Secrecy Act (“BSA”) requires all financial institutions, including banks and securities broker-dealers, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. The BSA includes a variety of recordkeeping and reporting requirements (such as cash and suspicious activity reporting), as well as due diligence/know-your-customer documentation requirements. The Company has established an anti-money laundering program and taken other appropriate measures in order to comply with BSA requirements.

Community Bank System, Inc. (the “Company”) was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company is a single bank holding company which wholly-owns five subsidiaries: Community Bank, N.A. (the “Bank” or “CBNA”), Benefit Plans Administrative Services, Inc. (“BPAS”), CFSI Closeout Corp. (“CFSICC”), First of Jermyn Realty Company, Inc. (“FJRC”) and Town & Country Agency LLC (“T&C”). BPAS owns four subsidiaries, Benefit Plans Administrative Services, LLC (“BPA”), a provider of defined contribution plan administration services; Harbridge Consulting Group, LLC (“Harbridge”), a provider of actuarial and benefit consulting services; BPAS Trust Company of Puerto Rico; and Hand Benefits & Trust Company (“HB&T”), a provider of Collective Investment Fund administration and institutional trust services. At December 31, 2013, HB&T owned two subsidiaries, Flex Corp. (“Flex”), a provider of administration, servicing and marketing of various flexible employee benefit programs, which was merged with BPA on January 1, 2014, and Hand Securities, Inc. (“HSI”), an introducing broker dealer. CFSICC, FJRC and T&C are inactive companies. The Company also wholly-owns two unconsolidated subsidiary business trusts formed for the purpose of issuing mandatorily-redeemable preferred securities which are considered Tier I capital under regulatory capital adequacy guidelines.

The Bank’s business philosophy is to operate as a community bank with local decision-making, principally in non-metropolitan markets, providing a broad array of banking and financial services to retail, commercial, and municipal customers. As of December 31, 2013, the Bank operates 183 full-service branches operating as Community Bank, N.A. throughout 35 counties of Upstate New York and six counties of Northeastern Pennsylvania, offering a range of commercial and retail banking services. The Bank owns the following subsidiaries: CBNA Insurance Agency, Inc. (“CBNA Insurance”), CBNA Preferred Funding Corporation (“PFC”), CBNA Treasury Management Corporation (“TMC”), Community Investment Services, Inc. (“CISI”), First Liberty Service Corp. (“FLSC”), Nottingham Advisors, Inc. (“Nottingham”), Brilie Corporation (“Brilie”), and Western Catskill Realty, LLC (“WCR”). CBNA Insurance is a full-service insurance agency offering primarily property and casualty products. PFC primarily acts as an investor in residential real estate loans. TMC provides cash management, investment, and treasury services to the Bank. CISI provides broker-dealer and investment advisory services. FLSC provides banking-related services to the Pennsylvania branches of the Bank. Nottingham provides asset management services to individuals, corporations, corporate pension and profit sharing plans, and foundations. Brilie and WCR are inactive companies.

The Company maintains a website at communitybankna.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information posted on the website is not incorporated into or a part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at http://www.sec.gov.

Acquisition History (2009-2013)

Bank of America Branches

On December 13, 2013, the Bank completed its acquisition of eight retail branch-banking locations across its Northeast Pennsylvania markets from Bank of America, N.A. (“B of A”), acquiring approximately $0.9 million in loans and $303 million of deposits. The assumed deposits consist of $220 million of core deposits (checking, savings and money market accounts) and $83 million of time deposits. Under the terms of the purchase agreement, the Bank paid B of A a blended deposit premium of 2.4%, or approximately $7.3 million.

HSBC and First Niagara Branches

On July 20, 2012, the Bank completed its acquisition of 16 retail branches in central, northern and western New York from HSBC Bank USA, N.A. (“HSBC”), acquiring approximately $106 million in loans and $697 million of deposits. The assumed deposits consist primarily of core deposits (checking, savings and money market accounts) and the purchased loans consist of in-market performing loans primarily residential real estate loans. Under the terms of the purchase agreement, the Bank paid First Niagara Bank, N.A. (“First Niagara”) (who acquired HSBC’s Upstate New York banking business and assigned its right to purchase the 16 branches to the Bank) a blended deposit premium of 3.4%, or approximately $24 million.

On September 7, 2012, the Bank completed its acquisition of three branches in central New York from First Niagara, acquiring approximately $54 million of loans and $101 million of deposits. The assumed deposits consist primarily of core deposits (checking, savings and money market accounts) and the purchased loans consist of in-market performing loans, primarily residential real estate loans. Under the terms of the purchase agreement, the Bank paid a blended deposit premium of 3.1%, or approximately $3 million.

CAI Benefits, Inc.

On November 30, 2011, BPAS acquired, in an all-cash transaction, certain assets and liabilities of CAI Benefits, Inc. (“CAI”), a provider of actuarial, consulting and retirement plan administration services, with offices in New York City and Northern New Jersey. The transaction added valuable service capacity and enhances distribution prospects in support of the Company’s broader-based employee benefits business, including daily valuation plan and collective investment fund administration.

The Wilber Corporation

On April 8, 2011, the Company acquired The Wilber Corporation, parent company of Wilber National Bank, and its 22 branch-banking centers in the Central, Greater Capital District and Catskill regions of New York for $103 million of stock and cash. The Company acquired approximately $462 million in loans, $297 million of investment securities and $772 million in deposits.

Services

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank's branches are generally located in smaller towns and cities within its geograph­ic market areas of Upstate New York and Northeastern Pennsylvania. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch and regional levels, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System and the Federal Home Loan Bank of New York ("FHLB"), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Competition

The banking and financial services industry is highly competitive in the New York and Pennsylvania markets. The Company competes actively for loans, deposits and customers with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, insurance companies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The table below summarizes the Bank’s deposits and market share by the forty-one counties of New York and Pennsylvania in which it has customer facilities. Market share is based on deposits of all commercial banks, credit unions, savings and loan associations, and savings banks.

Number of Towns Where Deposits as of Company 6/30/2013(1) Market Towns/ Has 1st or 2nd County State (000's omitted) Share (1) Branches ATM's Cities Market Position Lewis NY $152,501 67.57% 4 4 3 3 Franklin NY 261,245 59.02% 9 7 6 6 Hamilton NY 48,201 56.73% 2 2 2 2 Allegany NY 214,835 47.99% 9 10 8 8 Cattaraugus NY 400,594 45.30% 10 11 7 7 Otsego NY 396,546 39.67% 10 10 6 5 Seneca NY 186,216 35.85% 4 3 4 3 St. Lawrence NY 402,847 35.19% 12 9 11 10 Schuyler NY 51,992 31.18% 1 1 1 1 Yates NY 88,014 28.37% 3 2 2 1 Clinton NY 323,965 26.92% 5 8 2 2 Wyoming PA 122,682 26.37% 4 4 3 3 Jefferson NY 362,054 25.90% 7 9 6 6 Livingston NY 164,536 21.46% 5 6 5 4 Chautauqua NY 306,806 21.46% 13 13 11 8 Essex NY 112,593 20.16% 4 5 4 4 Steuben NY 178,626 19.87% 8 7 7 4 Delaware NY 172,190 17.97% 5 5 5 5 Wayne NY 129,977 17.67% 3 3 2 2 Ontario NY 234,459 13.39% 8 13 5 4 Oswego NY 140,039 11.53% 4 5 4 2 Lackawanna PA 427,816 8.70% 12 12 8 4 Tioga NY 34,152 8.56% 2 2 2 1 Luzerne PA 463,301 8.02% 11 16 8 4 Chemung NY 78,196 7.87% 2 2 1 0 Schoharie NY 29,770 7.22% 1 1 1 0 Susquehanna PA 49,580 6.76% 3 1 3 2 Herkimer NY 39,520 6.72% 1 1 1 1 Carbon PA 45,560 4.96% 2 2 2 1 Chenango NY 31,761 4.75% 2 2 1 1 Cayuga NY 42,417 4.22% 2 2 2 1 Bradford PA 46,006 4.20% 2 2 2 1 Washington NY 17,905 2.72% 1 0 1 1 Warren NY 32,788 2.22% 1 1 1 1 Oneida NY 55,944 1.81% 1 1 1 1 Broome NY 26,217 1.15% 1 1 1 0 Ulster NY 26,438 0.78% 1 1 1 1 Erie NY 106,225 0.35% 4 4 3 2 Onondaga NY 30,279 0.35% 2 3 2 0 Saratoga NY 12,068 0.33% 1 1 1 0 Tompkins NY 4,732 0.26% 1 0 1 0 $6,051,593 6.75% 183 192 147 112 (1) Deposits and Market Share data as of June 30, 2013, the most recent information available from SNL Financial LLC, adjusted for deposits acquired with the Bank of America branch acquisition and branch consolidations occurring after June 30, 2013.

Employees

As of December 31, 2013, the Company employed 1,940 full-time employees, 122 part-time employees and 153 temporary employees. None of the Company’s employees are represented by a collective bargaining agreement. The Company offers a variety of employment benefits and considers its relationship with its employees to be good.

Supervision and Regulation

General

The banking industry is highly regulated with numerous statutory and regulatory requirements that are designed primarily for the protection of depositors and the financial system, and not for the purpose of protecting shareholders. Set forth below is a description of the material information governing the laws and regulations applicable to the Company and the Bank. This summary is not complete and the reader should refer to these laws and regulation for more detailed information. The Company’s and the Bank’s failure to comply with applicable laws and regulations could result in a range of sanctions and administrative actions imposed upon the Company and/or the Bank, including the imposition of civil money penalties, formal agreements and cease and desist orders. Changes in applicable law or regulations, and in their interpretation and application by regulatory agencies, cannot be predicted, and may have a material effect on the Company’s business and results.

The Company and its subsidiaries are subject to the laws and regulations of the federal government and the states in which they conduct business. The Company, as a bank holding company, is subject to extensive regulation, supervision and examination by the Board of Governors of the Federal Reserve System (“FRB”) as its primary federal regulator. The Bank is a nationally-chartered bank and is subject to extensive regulation, supervision and examination by the Office of the Comptroller of the Currency (“OCC”) as its primary federal regulator, and as to certain matters, the FRB, the Bureau of Consumer Financial Protection (“CFPB”), and the FDIC.

The Company is also subject to the jurisdiction of the SEC and is subject to disclosure and regulatory requirement under the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended. The Company’s common stock is listed on the New York Stock Exchange (“NYSE”) and it is subject to NYSE’s rules for listed companies. Affiliated entities, including BPAS, HB&T, Nottingham, CISI, his and CBNA Insurance are subject to the jurisdiction of certain state and federal regulators and self-regulatory organizations including, but not limited to, the SEC, the Texas Department of Banking, the Financial Industry Regulatory Authority (“FINRA”), and state securities and insurance regulators.

Federal Bank Holding Company Regulation

The Company is registered as a bank holding company under the Bank Holding Company Act of 1956, as amended (the “BHC Act”). The BHC Act limits the type of activities in which the Company and its subsidiaries may engage and the types of companies it may acquire or organize. In general, the Company and the Bank are prohibited from engaging in or acquiring direct or indirect control of any entity engaged in non-banking activities unless such activities are closely related to banking, as determined by the BHC Act. In addition, the Company must obtain the prior approval of the FRB to acquire control of any bank; to acquire, with certain exceptions, more than five percent of the outstanding voting stock of any other entity; or to merge or consolidate with another bank holding company. As a result of such laws and regulation, the Company is restricted as to the types of business activities it may conduct and the Bank is subject to limitations on, among others, the types of loans and the amounts of loans it may make to any one borrower. The Financial Modernization Act of 1999 (also known as the Gramm-Leach-Bliley Act (the “GLB Act”)) created, among other things, the “financial holding company,” an entity which may engage in a broader range of activities that are “financial in nature,” including insurance underwriting, securities underwriting and merchant banking. Bank holding companies which are well capitalized and well managed under regulatory standards may convert to financial holding companies relatively easily through a notice filing with the FRB, which acts as the “umbrella regulator” for such entities. The Company may seek to become a financial holding company in the future.

Federal Reserve System Regulation

Because the Company is a bank holding company it is subject to regulatory capital requirements and required by the FRB to, among other things, maintain cash reserves against its deposits. The Bank is under similar capital requirements administered by the OCC as discussed below. FRB policy has historically required a bank holding company to act as a source of financial and managerial strength to its subsidiary banks. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) codifies this historical policy as a statutory requirement. To the extent the Bank is in need of capital, the Company could be expected to provide additional capital, including borrowings from the FRB for such purpose. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors’ funds.

The FRB has established minimum capital requirements for the Company and the Bank. The FRB capital adequacy guidelines apply on a consolidated basis and require bank holding companies to maintain a minimum ratio of Tier 1 capital to total average assets (or “leverage ratio”) of 4%. The FRB capital adequacy guidelines also require bank holding companies to maintain a minimum ratio of Tier 1 capital to risk-weighted assets of 4% and a minimum ratio of qualifying total capital to risk-weighted assets of 8%. As of December 31, 2013, the Company’s leverage ratio was 9.29%, its ratio of Tier 1 capital to risk-weighted assets was 16.42%, and its ratio of qualifying total capital to risk-weighted assets was 17.57%. For additional information on the Company’s capital requirements see “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Capital” and Note P to the Financial Statements. The FRB may set higher minimum capital requirements for bank holding companies whose circumstances warrant it, such as companies anticipating significant growth or facing unusual risks. Any holding company whose capital does not meet the minimum capital adequacy guidelines is considered to be undercapitalized and is required to submit an acceptable plan to the FRB for achieving capital adequacy. Such a company’s ability to pay dividends to its shareholders and expand its lines of business through the acquisition of new banking or nonbanking subsidiaries also could be restricted.

The FRB also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the FRB, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust our strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond our control.

The Office of Comptroller of the Currency Regulation

The Bank is supervised and regularly examined by the OCC. The various laws and regulations administered by the OCC affect the Company’s practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects the Bank’s business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and the location of its offices. The OCC generally prohibits a depository institution from making any capital distributions, including the payment of a dividend, or paying any management fee to its parent holding company if the depository institution would become undercapitalized due to the payment. Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the OCC. The Bank is well capitalized under regulatory standards administered by the OCC. For additional information on our capital requirements see “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Capital” and Note P to the Financial Statements.

Federal Home Loan Bank

The Bank is a member of the FHLB, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to the rules and requirements of the FHLB, including the purchase of shares of FHLB activity-based stock in the amount of 4.5% of the dollar amount of outstanding advances and FHLB capital stock in an amount equal to the greater of $1,000 or the sum of .20% of the mortgage-related assets held by the Bank based upon the previous year-end financial information. The Bank was in compliance with the rules and requirements of the FHLB at December 31, 2013.

Deposit Insurance

Substantially all of the deposits of the Bank are insured up to applicable limits by the Deposit Insurance Fund (“DIF”) and are subject to deposit insurance assessments to maintain the DIF. The Dodd-Frank Act permanently increased the maximum amount of deposit insurance to $250,000 per deposit category, per depositor, per institution retroactive to January 1, 2008. On April 1, 2011, the deposit insurance assessment base changed from total domestic deposits to the average consolidated total assets minus the average tangible equity of the depository institution, pursuant to a rule issued by the FDIC as required by the Dodd-Frank Act. Additionally, the deposit insurance assessment system was revised to create a two scorecard system, one for most large institutions that have more than $10 billion in assets and another for “highly complex” institutions that have over $50 billion in assets and are fully owned by a parent with over $500 billion in assets. The Bank is not affected by the two scorecard system as total assets are below the minimum threshold.

In October 2010, the FDIC adopted a DIF restoration plan to ensure that the fund reserve ratio reaches 1.35% by September 30, 2020, as required by the Dodd-Frank Act. At least semi-annually, the FDIC will update its loss and income projections for the fund and, if needed, will increase or decrease assessment rates, following notice-and-comment rulemaking if required. FDIC insurance expense totaled $3.8 million, $3.8 million and $3.9 million in 2013, 2012 and 2011, respectively.

Under the Federal Deposit Insurance Act, if the FDIC finds that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC, the FDIC may determine that such violation or unsafe or unsound practice or condition require the termination of deposit insurance.

Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

On July 21, 2010, the Dodd-Frank Actwas signed into law, which resulted in significant changes to the banking industry. The provisions that have received the most public attention have been those that apply to financial institutions larger than the Company; however, the Dodd-Frank Act does contain numerous other provisions that will affect all banks and bank holding companies and impacts how the Company and the Bank handle their operations. The Dodd-Frank Act requires various federal agencies, including those that regulate the Company and the Bank, to promulgate new rules and regulations and to conduct various studies and reports for Congress. The federal agencies are in the process of promulgating these rules and regulations and have been given significant discretion in drafting such rules and regulations. Several of the provisions of the Dodd-Frank Act may have the consequence of increasing the Bank’s expenses, decreasing its revenues, and changing the activities in which it chooses to engage. The specific impact of the Dodd-Frank Act on the Company’s current activities or new financial activities the Company may consider in the future, the Company’s financial performance, and the markets in which the Company operates depends on the manner in which the relevant agencies continue to develop and implement the required rules and regulations and the reaction of market participants to these regulatory developments.

The Dodd-Frank Act includes provisions that, among other things:

· Changes the assessment base for federal deposit insurance from the amount of insured deposits to consolidated assets less tangible capital, eliminate the ceiling on the size of the DIF, and increase the floor applicable to the size of the DIF.

· Makes permanent the $250,000 limit on deposits for federal deposit insurance, retroactive to January 1, 2008.

· Repeals the federal prohibitions on the payment of interest on demand deposits, thereby permitting depository institutions to pay interest on business transaction and other accounts.

· Centralizes responsibility for consumer financial protection by creating the CFPB, a new agency that started in July 2011 with responsibility for implementing, examining, and enforcing compliance with federal consumer laws.

· Restricts the preemption of certain state consumer financial protection laws by federal law and disallow subsidiaries and affiliates of national banks from availing themselves of such preemption.

· Applies the same leverage and risk-based capital requirements that apply to insured depository institutions to most bank holding companies, which, among other things as applied to the Company, going forward will preclude the Company from including in Tier 1 Capital trust preferred securities or cumulative preferred stock, if any, issued on or after May 19, 2010. The Company has not issued any trust preferred securities since May 19, 2010.

· Requires the OCC to seek to make its capital requirements for national banks countercyclical.

· Imposes comprehensive regulation of the over-the-counter derivatives market, which would include certain provisions that would effectively prohibit insured depository institutions from conducting certain derivatives businesses in the institution itself.

· Amends the Electronic Fund Transfer Act to, among several changes, give the FRB the authority to establish rules regarding interchange fees charged for electronic debit transactions by payment card issuers having assets over $10 billion and to enforce a new statutory requirement that such fees be reasonable and proportional to the actual cost of a transaction to the issuer.

· Increases the authority of the FRB to examine the Company and any of its non-bank subsidiaries.

Further, pursuant to FRB regulations mandated by the Dodd-Frank Act, effective October 1, 2011, interchange fees on debit card are limited to a maximum of $.21 per transaction plus 5 basis points of the transaction amount. A debit card issuer may recover an additional one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements prescribed by the FRB. Issuers that, together with their affiliates, have less than $10 billion in assets, such as the Company, are exempt from the debit card interchange fee standards. The FRB also adopted requirements in the final rule that issuers include two unaffiliated networks for routing debit transactions that are applicable to the Company and the Bank.

On December 10, 2013, the FRB, SEC, OCC, FDIC and Commodity Futures Trading Commission issued the final rules implementing Section 619 of the Dodd-Frank Act (commonly known as the Volcker Rule) which become effective on April 1, 2014. The final rules prohibit insured depository institutions and companies affiliated with insured depository institutions from engaging in short-term proprietary trading of certain securities, derivatives, commodity futures and options on these instruments, for their own account. The final rules also impose limits on banking entities’ investments in, and other relationships with, hedge funds or private equity funds. Banking entities with less than $10 billion in total consolidated assets, which generally have very little or no involvement in prohibited proprietary trading or investment activities in covered funds, do not have any compliance obligations under the final rule if they do not engage in any covered activities other than trading in certain government, agency, State or municipal obligations.

On February 7, 2012, the CFPB issued the final rules implementing Section 1073 of the Dodd-Frank Act to create a comprehensive new system of consumer protections for remittance transfers sent by consumers in the United States to individuals and businesses in foreign countries. The final rules became effective on October 28, 2013. The amendments provide new protections, including disclosure requirements, and error resolution and cancellation rights, to consumers who send remittance transfers to other consumers or businesses in a foreign country. The Bank has adopted policies and procedures to comply with the final foreign remittance transfer rules.

The scope and impact of many of the Dodd-Frank Act’s provisions will continue to be determined over time as final regulations are issued and become effective. As a result, the Company cannot predict the ultimate impact of the Dodd-Frank Act on the Company or the Bank at this time, including the extent to which it could increase costs or limit the Company’s ability to pursue business opportunities in an efficient manner, or otherwise adversely affect its business, financial condition and results of operations. Nor can the Company predict the impact or substance of other future legislation or regulation. However, it is expected that they at a minimum will increase the Company’s and the Bank’s operating and compliance costs. As continued rules and regulations are issued, the Company may need to dedicate additional resources to ensure compliance, which may increase its costs of operations and adversely impact its earnings.

Basel III

In December 2010, the Basel Committee, a group of bank regulatory supervisors from around the world, released its final framework for strengthening international capital and liquidity regulation, now officially identified by the Basel Committee as “Basel III.” In July 2013, the FRB, FDIC and OCC released the final rules implementing Basel III in the United States. For community banks with less than $15 billion in assets, the new minimum capital requirements are effective on January 1, 2015 and the capital conservation buffer and deductions from CET1 capital (defined below) phase in over time.

The Basel III final capital framework, among other things: introduces as a new capital measure “Common Equity Tier 1,” or “CET1,” specifies that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting specified requirements, defines CET1 narrowly by requiring that most adjustments to regulatory capital measures be made to CET1 and not to the other components of capital, and expands the scope of the adjustments as compared to existing regulations. When fully phased in on January 1, 2019, Basel III requires banks to maintain:

· a minimum ratio of CET1 to risk-weighted assets of at least 4.5 percent, plus a 2.5 percent “capital conservation buffer” (which is added to the 4.5 percent CET1 ratio as that buffer is phased in, effectively resulting in a minimum ratio of CET1 to risk-weighted assets of at least 7 percent),

· a minimum ratio of Tier 1 capital to risk-weighted assets of at least 6.0 percent, plus the capital conservation buffer (which is added to the 6.0 percent Tier 1 capital ratio as that buffer is phased in, effectively resulting in a minimum Tier 1 capital ratio of 8.5 percent upon full implementation),

· a minimum ratio of Total (that is, Tier 1 plus Tier 2) capital to risk-weighted assets of at least 8.0 percent, plus the capital conservation buffer (which is added to the 8.0 percent total capital ratio as that buffer is phased in, effectively resulting in a minimum total capital ratio of 10.5 percent upon full implementation),

· as a newly adopted international standard, a minimum leverage ratio of 3.0 percent, calculated as the ratio of Tier 1 capital to balance sheet exposures plus certain off-balance sheet exposures (as the average for each quarter of the month-end ratios for the quarter), and

· provides for a “countercyclical capital buffer,” generally to be imposed when national regulators determine that excess aggregate credit growth becomes associated with a buildup of systemic risk, that would be a CET1 add-on to the capital conservation buffer in the range of 0 percent to 2.5 percent when fully implemented (potentially resulting in total buffers of between 2.5 percent and 5 percent).

The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the conservation buffer (or below the combined capital conservation buffer and countercyclical capital buffer, when the latter is applied) will face constraints on dividends, equity repurchases and compensation based on the amount of the shortfall. Banking institutions will be required to meet the following minimum capital ratios based upon the final Basel III rules:

· 4.5 percent CET1 to risk-weighted assets;

· 6.0 percent Tier 1 capital to risk-weighted assets; and

· 8.0 percent Total capital to risk-weighted assets.

The Basel III final framework provides for a number of new deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, deferred tax assets and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10 percent of CET1 or all such categories in the aggregate exceed 15 percent of CET1. Implementation of the deductions and other adjustments to CET1 will begin on January 1, 2015 and will be phased-in over a five-year period (20 percent per year). The implementation of the capital conservation buffer will begin on January 1, 2016 at 0.625 percent and be phased in over a four-year period (increasing by that amount on each subsequent January 1, until it reaches 2.5 percent on January 1, 2019). The Company fully expects to be in compliance with the higher Basel III capital standards as they become effective.

Consumer Protection Laws

In connection with its lending activities, the Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending to various sectors of the economy. These laws include the Equal Credit Opportunity Act, GLB Act, the Fair Credit Reporting Act (“FCRA”), the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”), Electronic Funds Transfer Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Dodd-Frank Act, the Real Estate Settlement Procedures Act, the Secure and Fair Enforcement for Mortgage Licensing Act (“SAFE”), and various state law counterparts.

The Dodd-Frank Act created the CFPB with broad powers to supervise and enforce consumer protection laws, including laws that apply to banks in order to prohibit unfair, deceptive or abusive practices. The CFPB has examination authority over all banks and savings institutions with more than $10 billion in assets. Because the Company is below this threshold, the OCC continues to exercise primary examination authority over the Bank with regard to compliance with federal consumer protection laws and regulations. The Dodd-Frank Act weakens the federal preemption rules that have been applicable to national banks and gives attorney generals for the states certain powers to enforce federal consumer protection laws.

In addition, the GLB Act requires all financial institutions to adopt privacy policies, restrict the sharing of nonpublic customer data with nonaffiliated parties and establishes procedures and practices to protect customer data from unauthorized access. In addition, the FCRA, as amended by the FACT Act, includes provisions affecting the Company, the Bank, and their affiliates, including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. The FACT Act requires persons subject to FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the Federal Trade Commission have extensive rulemaking authority under the FACT Act, and the Company and the Bank are subject to the rules that have been created under the FACT Act, including rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate certain identity theft red flags. The Bank is also subject to data security standards and data breach notice requirements issued by the OCC and other regulatory agencies. The Bank has created policies and procedures to comply with these consumer protection requirements.

On January 10, 2013, the CFPB issued the final rules implementing the ability-to-repay and qualified mortgage (QM) provisions of the Truth in Lending Act, as amended by the Dodd-Frank Act (the “QM Rule”). The ability-to-repay provision requires creditors to make reasonable, good faith determinations that borrowers are able to repay their mortgages before extending the credit based on a number of factors and consideration of financial information about the borrower derived from reasonably reliable third-party documents. Under the Dodd-Frank Act and the QM Rule, loans meeting the definition of “qualified mortgage” are entitled to a presumption that the lender satisfied the ability-to-repay requirements. The presumption is a conclusive presumption/safe harbor for loans meeting the QM requirements, and a rebuttable presumption for higher-priced loans meeting the QM requirements. The definition of a “qualified mortgage” incorporates the statutory requirements, such as not allowing negative amortization or terms longer than 30 years. The QM Rule also adds an explicit maximum 43% debt-to-income ratio for borrowers if the loan is to meet the QM definition, though some mortgages that meet government-sponsored enterprises, Federal Housing Administration, and Veterans Administration underwriting guidelines may, for a period not to exceed seven years, meet the QM definition without being subject to the 43% debt-to-income limits. The QM Rule became effective on January 10, 2014 and the Bank has created policies and procedures to comply with these consumer protection requirements.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The USA Patriot Act also encourages information-sharing among financial institutions, regulators, and law enforcement authorities by providing an exemption from the privacy provisions of the GLB Act for financial institutions that comply with the provision of the Act. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the institution. The Company has approved policies and procedures that are designed to comply with the USA Patriot Act.

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others administrated by the Treasury’s Office of Foreign Assets Control (“OFAC”). The OFAC administered sanctions can take many different forms depending upon the country; however, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments in, or providing investment related advice or assistance to, a sanctioned country; and (ii) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934, as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) new requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) additional responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) the creation of an independent accounting oversight board for the accounting industry; (iv) new standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on non-preferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violation of the securities laws.

Electronic Fund Transfer Act

Effective July 1, 2010, a federal banking rule under the Electronic Fund Transfer Act prohibits financial institutions from charging consumers fees for paying overdrafts on automated teller machines and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions. The new rule does not govern overdraft fees on the payment of checks and regular electronic bill payments. The adoption of this regulation lowered fee income immediately after its effective date.

Community Reinvestment Act of 1977

Under the Community Reinvestment Act of 1977 (“CRA”), the Bank is required to help meet the credit needs of its communities, including low- and moderate-income neighborhoods. Although the Bank must follow the requirements of CRA, it does not limit the Bank’s discretion to develop products and services that are suitable for a particular community or establish lending requirements or programs. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibits discrimination in lending practices. The Bank’s failure to comply with the provisions of the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s failure to comply with the Equal Credit Opportunity Act and the Fair Housing Act could result in enforcement actions against it by its regulators as well as other federal regulatory agencies and the Department of Justice. The Bank’s latest CRA rating was “Satisfactory”.

The Bank Secrecy Act

The Bank Secrecy Act (“BSA”) requires all financial institutions, including banks and securities broker-dealers, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. The BSA includes a variety of recordkeeping and reporting requirements (such as cash and suspicious activity reporting), as well as due diligence/know-your-customer documentation requirements. The Company has established an anti-money laundering program and taken other appropriate measures in order to comply with BSA requirements.

Community Bank System, Inc. ("the Company") was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company is a single bank holding company which wholly-owns five subsidiaries: Community Bank, N.A. (“the Bank” or “CBNA”), Benefit Plans Administrative Services, Inc. (“BPAS”), CFSI Closeout Corp. (“CFSICC”), First of Jermyn Realty Company, Inc. (“FJRC”) and Town & Country Agency LLC (“T&C”). BPAS owns three subsidiaries, Benefit Plans Administrative Services LLC (“BPA”), a provider of defined contribution plan administration services; Harbridge Consulting Group LLC (“Harbridge”), a provider of actuarial and benefit consulting services; and Hand Benefits & Trust Company (“HB&T”), a provider of Collective Investment Fund administration and institutional trust services. HB&T owns two subsidiaries, Flex Corp. (“Flex”), a provider of administration, servicing and marketing of various flexible employee benefit programs and Hand Securities, Inc. (“HSI”), an introducing broker dealer. CFSICC, FJRC and T&C are inactive companies. The Company also wholly-owns two unconsolidated subsidiary business trusts formed for the purpose of issuing mandatorily-redeemable preferred securities which are considered Tier I capital under regulatory capital adequacy guidelines.

The Bank’s business philosophy is to operate as a community bank with local decision-making, principally in non-metropolitan markets, providing a broad array of banking and financial services to retail, commercial, and municipal customers. As of December 31, 2012 the Bank operates 179 full-service branches throughout 35 counties of Upstate New York, where it operates as Community Bank, N.A. and five counties of Northeastern Pennsylvania, where it is known as First Liberty Bank & Trust, offering a range of commercial and retail banking services. The Bank owns the following subsidiaries: CBNA Insurance Agency, Inc. (“CBNA Insurance”), CBNA Preferred Funding Corporation (“PFC”), CBNA Treasury Management Corporation (“TMC”), Community Investment Services, Inc. (“CISI”), First Liberty Service Corp. (“FLSC”), Nottingham Advisors, Inc. (“Nottingham”), Brilie Corporation (“Brilie”), and Western Catskill Realty, LLC (“WCR”). CBNA Insurance is a full-service insurance agency offering primarily property and casualty products. PFC primarily acts as an investor in residential real estate loans. TMC provides cash management, investment, and treasury services to the Bank. CISI provides broker-dealer and investment advisory services. FLSC provides banking-related services to the Pennsylvania branches of the Bank. Nottingham provides asset management services to individuals, corporate pension and profit sharing plans, and foundations. Brilie and WCR are inactive companies.

The Company maintains websites at communitybankna.com and firstlibertybank.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information posted on the website is not incorporated into or a part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at http://www.sec.gov.

Acquisition History (2008-2012)

HSBC and First Niagara Branches

On July 20, 2012, Community Bank, N.A. (the” Bank”), the wholly-owned banking subsidiary of the Company, completed its acquisition of 16 retail branches in central, northern and western New York from HSBC Bank USA, N.A. (“HSBC”), acquiring approximately $106 million in loans and $697 million of deposits. The assumed deposits consist primarily of core deposits (checking, savings and money market accounts) and the purchased loans consist of in-market performing loans primarily residential real estate loans. Under the terms of the purchase agreement, the Bank paid First Niagara Bank, N.A. (“First Niagara”) (who acquired HSBC’s Upstate New York banking business and assigned its right to purchase the 16 branches to the Bank) a blended deposit premium of 3.4%, or approximately $24 million.

On September 7, 2012, the Bank completed its acquisition of three branches in central New York from First Niagara, acquiring approximately $54 million of loans and $101 million of deposits. The assumed deposits consist primarily of core deposits (checking, savings and money market accounts) and the purchased loans consist of in-market performing loans, primarily residential real estate loans. Under the terms of the purchase agreement, the Bank paid a blended deposit premium of 3.1%, or approximately $3 million.

CAI Benefits, Inc.

On November 30, 2011, BPAS acquired, in an all-cash transaction, certain assets and liabilities of CAI, a provider of actuarial, consulting and retirement plan administration services, with offices in New York City and Northern New Jersey. The transaction added valuable service capacity and enhances distribution prospects in support of the Company’s broader-based employee benefits business, including daily valuation plan and collective investment fund administration.

The Wilber Corporation

On April 8, 2011, the Company acquired The Wilber Corporation, parent company of Wilber National Bank, and its 22 branch-banking centers in the Central, Greater Capital District and Catskill regions of New York for $103 million of stock and cash. The Company acquired approximately $462 million in loans, $297 million of investment securities and $772 million in deposits.

Citizens Branches

On November 7, 2008, the Company acquired 18 branch-banking centers in northern New York from Citizens Financial Group, Inc. (“Citizens”) in an all-cash transaction. The Company acquired approximately $109 million in loans and $565 million in deposits at a blended deposit premium of 13%. In support of the transaction, the Company issued approximately $50 million of equity capital in the form of common stock in October 2008.

Alliance Benefit Group MidAtlantic

On July 7, 2008, BPAS acquired the Philadelphia division of Alliance Benefit Group MidAtlantic (“ABG”) from BenefitStreet, Inc. in an all-cash transaction. ABG was a provider of retirement plan consulting, daily valuation administration, actuarial and ancillary support services.

Services

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank's branches are generally located in smaller towns and cities within its geograph­ic market areas of Upstate New York and Northeastern Pennsylvania. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch and regional levels, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System and the Federal Home Loan Bank of New York ("FHLB"), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Competition

The banking and financial services industry is highly competitive in the New York and Pennsylvania markets. The Company competes actively for loans, deposits and customers with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, insurance companies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The table below summarizes the Bank’s deposits and market share by the forty counties of New York and Pennsylvania in which it has customer facilities. Market share is based on deposits of all commercial banks, credit unions, savings and loan associations, and savings banks.

Number of Towns Where Deposits as of Company 6/30/2012(1) Market Towns/ Has 1st or 2nd County State (000's omitted) Share (1) Branches ATM's Cities Market Position Lewis NY $145,984 65.34% 4 4 3 3 Franklin NY 265,148 58.31% 9 7 6 6 Hamilton NY 38,629 53.12% 2 2 2 2 Allegany NY 212,633 47.78% 9 10 8 8 Cattaraugus NY 392,553 46.46% 10 11 7 6 Otsego NY 408,127 41.30% 10 10 6 5 Seneca NY 195,465 36.80% 4 3 4 3 St. Lawrence NY 393,575 35.11% 12 8 11 10 Schuyler NY 54,166 31.82% 1 1 1 1 Jefferson NY 394,200 28.98% 8 8 6 6 Wyoming PA 120,618 27.85% 4 4 3 3 Clinton NY 325,666 27.12% 6 9 2 2 Yates NY 81,023 27.03% 3 2 2 1 Livingston NY 176,362 22.19% 5 6 5 5 Essex NY 119,748 21.16% 5 6 5 5 Steuben NY 177,926 20.39% 8 7 7 4 Chautauqua NY 290,105 20.24% 13 13 11 8 Delaware NY 171,778 18.57% 5 5 5 5 Wayne NY 132,259 18.26% 4 4 2 2 Ontario NY 248,045 14.17% 8 13 5 5 Oswego NY 123,674 10.28% 4 5 4 2 Schoharie NY 33,331 8.58% 1 1 1 0 Lackawanna PA 405,052 8.39% 11 11 8 4 Tioga NY 33,251 8.19% 2 2 2 1 Chemung NY 78,703 7.71% 2 2 1 0 Herkimer NY 41,893 7.15% 1 1 1 1 Susquehanna PA 44,109 6.31% 3 1 3 2 Chenango NY 37,366 6.29% 2 2 1 1 Cayuga NY 41,020 4.39% 2 2 2 1 Luzerne PA 240,922 4.20% 6 7 6 3 Bradford PA 39,211 3.59% 2 2 2 1 Washington NY 18,328 2.76% 1 0 1 1 Warren NY 32,795 2.30% 1 1 1 1 Oneida NY 56,299 1.86% 1 1 1 1 Broome NY 34,532 1.53% 1 1 1 1 Ulster NY 25,586 0.80% 1 1 1 1 Saratoga NY 15,195 0.43% 1 1 1 0 Erie NY 116,855 0.39% 4 4 3 2 Onondaga NY 28,824 0.34% 2 3 2 0 Tompkins NY 5,590 0.32% 1 0 1 0 $5,796,546 6.68% 179 181 144 113 (1) Deposits and Market Share data as of June 30, 2012, the most recent information available from SNL Financial LLC, adjusted for deposits acquired with the HSBC and First Niagara Branch Acquisitions.

Employees

As of December 31, 2012, the Company employed 1,908 full-time employees, 157 part-time employees and 123 temporary employees. None of the Company’s employees are represented by a collective bargaining agreement. The Company offers a variety of employment benefits and considers its relationship with its employees to be good.

Supervision and Regulation

General

The banking industry is highly regulated. Statutory and regulatory controls are designed primarily for the protection of depositors and the financial system, and not for the purpose of protecting shareholders. The following discussion is not intended to be a complete list of all the activities regulated by the banking laws or of the impact of such laws and regulations on the Company and the Bank. Changes in applicable law or regulations, and in their interpretation and application by regulatory agencies, cannot be predicted, but may have a material effect on our business and results.

The Company and its subsidiaries are subject to the laws and regulations of the federal government and the states in which they conduct business. The Company, as a bank holding company, is subject to extensive regulation, supervision and examination by the Board of Governors of the Federal Reserve System (“FRB”) as its primary federal regulator. The Bank is a nationally-chartered bank and is subject to extensive regulation, supervision and examination by the Office of the Comptroller of the Currency (“OCC”) as its primary federal regulator. The Bank is also subject to the regulations and supervision of the FRB and the FDIC.

The Company is subject to the jurisdiction of the Securities and Exchange Commission (“SEC”) and is subject to disclosure and regulatory requirement under the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended. Affiliated entities, including BPAS, HB&T, Nottingham, CISI, and HSI are subject to the jurisdiction of the SEC, the New York Stock Exchange, the Texas Department of Banking, the Financial Industry Regulatory Authority (“FINRA”) and state securities regulators, among others.

Set forth below is a description of the material information governing the laws and regulations applicable to the Company:

Federal Bank Holding Company Regulation

The Company is registered under, and is subject to, the Bank Holding Company Act of 1956, as amended. This Act limits the type of companies that the Company may acquire or organize and the activities in which it or they may engage. In general, the Company and the Bank are prohibited from engaging in or acquiring direct or indirect control of any corporation engaged in non-banking activities unless such activities are so closely related to banking as to be a proper incident thereto. In addition, the Company must obtain the prior approval of the FRB to acquire control of any bank; to acquire, with certain exceptions, more than five percent of the outstanding voting stock of any other corporation; or to merge or consolidate with another bank holding company. As a result of such laws and regulation, the Company is restricted as to the types of business activities it may conduct and the Bank is subject to limitations on, among others, the types of loans and the amounts of loans it may make to any one borrower. The Financial Modernization Act of 1999 created, among other things, the “financial holding company”, a new entity which may engage in a broader range of activities that are “financial in nature”, including insurance underwriting, securities underwriting and merchant banking. Bank holding companies which are well capitalized and well managed under regulatory standards may convert to financial holding companies relatively easily through a notice filing with the FRB, which acts as the “umbrella regulator” for such entities. The Company may seek to become a financial holding company in the future.

Federal Reserve System Regulation

The Company, as a bank holding company, is subject to regulatory capital requirements and is required by the FRB to, among other things, maintain cash reserves against its deposits. The Bank is under similar capital requirements administered by the OCC. FRB policy has historically required a bank holding company to act as a source of financial and managerial strength to its subsidiary banks. The Dodd-Frank Act (as defined below) codifies this policy as a statutory requirement. After exhausting other sources of funds, the Company may seek borrowings from the FRB for such purposes. Bank holding companies registered with the FRB are, among other things, restricted from making direct investments in real estate. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors’ funds.

The FRB also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the FRB, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust their strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond their control.

The Company and the Bank are subject to minimum capital requirements established by the FRB, the OCC and the FDIC. For information on these capital requirements and the Company’s and the Bank’s capital ratios see “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Capital” and Note P to the Financial Statements.

Office of Comptroller of the Currency Regulation

The Bank is supervised and regularly examined by the OCC. The various laws and regulations administered by the OCC affect corporate practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and location of offices. The OCC generally prohibits a depository institution from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the depository institution would thereafter be undercapitalized. Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the OCC. The Bank is well capitalized under regulatory standards administered by the OCC.

Insurance of Deposit Accounts

The Bank is a member of the Deposit Insurance Fund (“DIF”), which is administered by the FDIC. On July 22, 2010, the FDIC amended its insurance regulations to insure deposit accounts up to a maximum of $250,000 (previously $100,000) for each separately insured depositor. Additionally, on November 9, 2010, the FDIC issued a final rule implementing Section 343 of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (“the Dodd-Frank Act”) which provides certain noninterest-bearing transaction accounts with unlimited insurance coverage, regardless of the dollar amount, which terminated on December 31, 2012.

The FDIC imposes an assessment against all depository institutions for deposit insurance. This assessment is based on the risk category of the institution and, prior to 2009, ranged from five to 43 basis points of the institution’s deposits. On December 22, 2008, as a result of decreases in the reserve ratio of the DIF, the FDIC published a final rule raising the current deposit insurance assessment rates uniformly for all institutions by seven basis points for the first quarter of 2009. On May 22, 2009, the FDIC adopted a final rule imposing a five basis point special assessment on each insured depository institution’s assets minus Tier 1 capital as of June 30, 2009, payable on September 30, 2009. The Company’s special assessment amounted to $2.5 million.

In the fourth quarter of 2009, the FDIC adopted a rule that required insured depository institutions to prepay their quarterly risk-based assessments for the fourth quarter of 2009, and for all of 2010, 2011 and 2012, on December 30, 2009. For purposes of calculating the amount to prepay, the FDIC required that institutions use their total base assessment rate in effect on September 30, 2009 and increase that assessment base quarterly at a 5 percent annual growth rate through the end of 2012. The FDIC also increased annual assessment rates uniformly by three basis points beginning in 2011. The Company’s prepayment for 2010, 2011 and 2012 amounted to $21.4 million. Effective April 1, 2011, the FDIC changed the basis for premium payments from a percentage of average deposits to a percentage of average consolidated Bank assets less average tangible capital, resulting in lower 2011 and 2012 premiums for the Company.

Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

On July 21, 2010, President Obama signed into law the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (“Dodd-Frank Act”). This law results in significant changes to the banking industry. The provisions that have received the most public attention have been those that apply to financial institutions larger than the Company; however, the Dodd-Frank Act does contain numerous other provisions that will affect all banks and bank holding companies and impacts how the Company and the Bank handle their operations. The Dodd-Frank Act requires various federal agencies, including those that regulate the Company and the Bank, to promulgate new rules and regulations and to conduct various studies and reports for Congress. The federal agencies are in the process of promulgating these rules and regulations and have been given significant discretion in drafting such rules and regulations. Several of the provisions of the Dodd-Frank Act may have the consequence of increasing the Bank’s expenses, decreasing its revenues, and changing the activities in which it chooses to engage. The specific impact of the Dodd-Frank Act on the Company’s current activities or new financial activities the Company may consider in the future, the Company’s financial performance, and the markets in which the Company operates depends on the manner in which the relevant agencies develop and implement the required rules and regulations and the reaction of market participants to these regulatory developments.

The Dodd-Frank Act includes provisions that, among other things:

· Change the assessment base for federal deposit insurance from the amount of insured deposits to consolidated assets less tangible capital, eliminate the ceiling on the size of the DIF, and increase the floor applicable to the size of the DIF.

· Make permanent the $250,000 limit on deposits for federal deposit insurance, retroactive to January 1, 2008, and provided unlimited federal deposit insurance through December 31, 2012 for non-interest bearing demand transaction accounts at all insured depository institutions.

· Repeal the federal prohibitions on the payment of interest on demand deposits, thereby permitting depository institutions to pay interest on business transaction and other accounts.

· Centralize responsibility for consumer financial protection by creating the Consumer Financial Protection Bureau (“CFPB”), a new agency started in July 2011 with responsibility for implementing, examining, and enforcing compliance with federal consumer laws.

· Restrict the preemption of state law by federal law and disallow subsidiaries and affiliates of national banks from availing themselves of such preemption.

· Apply the same leverage and risk-based capital requirements that apply to insured depository institutions to most bank holding companies, which, among other things as applied to the Company, going forward will preclude the Company from including in Tier 1 Capital trust preferred securities or cumulative preferred stock, if any, issued on or after May 19, 2010. The Company has not issued any trust preferred securities since May 19, 2010.

· Require the OCC to seek to make its capital requirements for national banks countercyclical.

· Impose comprehensive regulation of the over-the-counter derivatives market, which would include certain provisions that would effectively prohibit insured depository institutions from conducting certain derivatives businesses in the institution itself.

· Amend the Electronic Fund Transfer Act to, among other things, give the FRB the authority to establish rules regarding interchange fees charged for electronic debit transactions by payment card issuers having assets over $10 billion and to enforce a new statutory requirement that such fees be reasonable and proportional to the actual cost of a transaction to the issuer.

· Increase the authority of the FRB to examine the Company and any of its non-bank subsidiaries.

Basel III

In December 2010, the Basel Committee, a group of bank regulatory supervisors from around the world, released its final framework for strengthening international capital and liquidity regulation, now officially identified by the Basel Committee as “Basel III.” Basel III, when implemented by the U.S. bank regulatory agencies and fully phased-in, will require bank holding companies and their bank subsidiaries to maintain substantially more capital, with a greater emphasis on common equity. The Basel III final capital framework, among other things: introduces as a new capital measure “Common Equity Tier 1”, or “CET1”, specifies that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting specified requirements, defines CET1 narrowly by requiring that most adjustments to regulatory capital measures be made to CET1 and not to the other components of capital, and expands the scope of the adjustments as compared to existing regulations. When fully phased in on January 1, 2019, Basel III requires banks to maintain:

· a minimum ratio of CET1 to risk-weighted assets of at least 4.5 percent, plus a 2.5 percent “capital conservation buffer” (which is added to the 4.5 percent CET1 ratio as that buffer is phased in, effectively resulting in a minimum ratio of CET1 to risk-weighted assets of at least 7 percent),

· a minimum ratio of Tier 1 capital to risk-weighted assets of at least 6.0 percent, plus the capital conservation buffer (which is added to the 6.0 percent Tier 1 capital ratio as that buffer is phased in, effectively resulting in a minimum Tier 1 capital ratio of 8.5 percent upon full implementation),

· a minimum ratio of Total (that is, Tier 1 plus Tier 2) capital to risk-weighted assets of at least 8.0 percent, plus the capital conservation buffer (which is added to the 8.0 percent total capital ratio as that buffer is phased in, effectively resulting in a minimum total capital ratio of 10.5 percent upon full implementation),

· as a newly adopted international standard, a minimum leverage ratio of 3.0 percent, calculated as the ratio of Tier 1 capital to balance sheet exposures plus certain off-balance sheet exposures (as the average for each quarter of the month-end ratios for the quarter), and

· provides for a “countercyclical capital buffer”, generally to be imposed when national regulators determine that excess aggregate credit growth becomes associated with a buildup of systemic risk, that would be a CET1 add-on to the capital conservation buffer in the range of 0 percent to 2.5 percent when fully implemented (potentially resulting in total buffers of between 2.5 percent and 5 percent).

The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the conservation buffer (or below the combined capital conservation buffer and countercyclical capital buffer, when the latter is applied) will face constraints on dividends, equity repurchases and compensation based on the amount of the shortfall.

The Basel III revisions governing liquidity and capital requirements are subject to prolonged observation and transition periods. The transition period for banks to meet the revised Tier 1 common requirement will begin in 2013, with implementation on January 1, 2019. The implementation of the Basel III final framework, scheduled to commence on January 1, 2013 has been deferred. Once the final implementation guidance is approved, banking institutions will be required to meet the following minimum capital ratios:

· 3.5 percent CET1 to risk-weighted assets;

· 4.5 percent Tier 1 capital to risk-weighted assets; and

· 8.0 percent Total capital to risk-weighted assets.

The Basel III final framework provides for a number of new deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, deferred tax assets and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10 percent of CET1 or all such categories in the aggregate exceed 15 percent of CET1. Implementation of the deductions and other adjustments to CET1 will begin on January 1, 2014 and will be phased-in over a five-year period (20 percent per year). The implementation of the capital conservation buffer will begin on January 1, 2016 at 0.625 percent and be phased in over a four-year period (increasing by that amount on each subsequent January 1, until it reaches 2.5 percent on January 1, 2019).

The Dodd-Frank Act requires the Federal Reserve to adopt regulations imposing a continuing “floor” of the Basel I-based capital requirements in cases where the Basel II-based capital requirements and any changes in capital regulations resulting from Basel III otherwise would permit lower requirements. In November 2012, the Federal Reserve announced the final rule on implementation will not occur until 2013. Given that the Basel III rules are subject to implementation and change and the scope and content of capital regulations that U.S. federal banking agencies may adopt under the Dodd-Frank Act is uncertain, we cannot be certain of the impact new capital regulations will have on our capital ratios. The Company fully expects to be in compliance with the higher Basel III capital standards, as well as any additional Dodd-Frank Act capital requirements, as they become effective.

Consumer Protection Laws

In connection with its lending activities, the Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending to various sectors of the economy. These laws include the Equal Credit Opportunity Act, the Gramm-Leach-Bliley Act (“GLB Act”), the Fair Credit Reporting Act (“FCRA”), the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”), Electronic Funds Transfer Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Dodd-Frank Act, the Real Estate Settlement Procedures Act, the Secure and Fair Enforcement for Mortgage Licensing Act (“SAFE”), and various state law counterparts.

The Dodd-Frank Act created the CFPB with broad powers to supervise and enforce consumer protection laws, including laws that apply to banks in order to prohibit unfair, deceptive or abusive practices. The CFPB has examination authority over all banks and savings institutions with more than $10 billion in assets. The Dodd-Frank Act weakens the federal preemption rules that have been applicable to national banks and gives attorney generals for the states certain powers to enforce federal consumer protection laws.

In addition, the GLB Act requires all financial institutions to adopt privacy policies, restrict the sharing of nonpublic customer data with nonaffiliated parties and establishes procedures and practices to protect customer data from unauthorized access. In addition, the FCRA, as amended by the FACT Act, includes provisions affecting the Company, the Bank, and their affiliates, including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. The FACT Act requires persons subject to FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the Federal Trade Commission have extensive rulemaking authority under the FACT Act, and the Company and the Bank are subject to the rules that have been created under the FACT Act, including rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate certain identity theft red flags. The Bank is also subject to data security standards and data breach notice requirements issued by the OCC and other regulatory agencies. The Bank has created policies and procedures to comply with these consumer protection requirements.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The USA Patriot Act also encourages information-sharing among financial institutions, regulators, and law enforcement authorities by providing an exemption from the privacy provisions of the GLB Act for financial institutions that comply with the provision of the Act. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the institution. The Company has approved policies and procedures that are designed to comply with the USA Patriot Act.

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others administrated by the Treasury’s Office of Foreign Assets Control (“OFAC”). The OFAC administered sanctions can take many different forms depending upon the country; however, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments in, or providing investment related advice or assistance to, a sanctioned country; and (ii) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934 as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) new requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) additional responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) the creation of an independent accounting oversight board for the accounting industry; (iv) new standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on non-preferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violation of the securities laws.

Electronic Fund Transfer Act

Effective July 1, 2010, a new federal banking rule under the Electronic Fund Transfer Act prohibits financial institutions from charging consumers fees for paying overdrafts on automated teller machines and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions. The new rule does not govern overdraft fees on the payment of checks and regular electronic bill payments. The adoption of this regulation lowered fee income in the fourth quarter of 2010 and all of 2011 and 2012.

Community Reinvestment Act of 1977

Under the Community Reinvestment Act of 1977 (“CRA”), the Bank is required to help meet the credit needs of its communities, including low- and moderate-income neighborhoods. Although the Bank must follow the requirements of CRA, it does not limit the Bank’s discretion to develop products and services that are suitable for a particular community or establish lending requirements or programs. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibits discrimination in lending practices. The Bank’s failure to comply with the provisions of the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s failure to comply with the Equal Credit Opportunity Act and the Fair Housing Act could result in enforcement actions against it by its regulators as well as other federal regulatory agencies and the Department of Justice. The Bank’s latest CRA rating was Satisfactory.

The Bank Secrecy Act

The Bank Secrecy Act (“BSA”) requires all financial institutions, including banks and securities broker-dealers, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. The BSA includes a variety of recordkeeping and reporting requirements (such as cash and suspicious activity reporting), as well as due diligence/know-your-customer documentation requirements. The Company has established an anti-money laundering program and taken other appropriate measures in order to comply with BSA requirements.

Community Bank System, Inc. ("the Company") was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company is a single bank holding company which wholly-owns five subsidiaries: Community Bank, N.A. (“the Bank” or “CBNA”), Benefit Plans Administrative Services, Inc. (“BPAS”), CFSI Closeout Corp. (“CFSICC”), First of Jermyn Realty Company, Inc. (“FJRC”) and Town & Country Agency LLC (“T&C”). BPAS owns three subsidiaries, Benefit Plans Administrative Services LLC (“BPA”), a provider of defined contribution plan administration services; Harbridge Consulting Group LLC (“Harbridge”), a provider of actuarial and benefit consulting services; and Hand Benefits & Trust Company (“HB&T”), a provider of Collective Investment Fund administration and institutional trust services. CFSICC, FJRC and T&C are inactive companies. The Company also wholly-owns two unconsolidated subsidiary business trusts formed for the purpose of issuing mandatorily-redeemable preferred securities which are considered Tier I capital under regulatory capital adequacy guidelines.

The Bank’s business philosophy is to operate as a community bank with local decision-making, principally in non-metropolitan markets, providing a broad array of banking and financial services to retail, commercial, and municipal customers. The Bank operates 168 customer facilities throughout 35 counties of Upstate New York, where it operates as Community Bank, N.A. and five counties of Northeastern Pennsylvania, where it is known as First Liberty Bank & Trust, offering a range of commercial and retail banking services. The Bank owns the following subsidiaries: Community Investment Services, Inc. (“CISI”), CBNA Treasury Management Corporation (“TMC”), CBNA Preferred Funding Corporation (“PFC”), Nottingham Advisors, Inc. (“Nottingham”), First Liberty Service Corp. (“FLSC”), Brilie Corporation (“Brilie”), CBNA Insurance Agency, Inc. (“CBNA Insurance”) and Western Catskill Realty, LLC (“WCR”). CISI provides broker-dealer and investment advisory services. TMC provides cash management, investment, and treasury services to the Bank. PFC primarily acts as an investor in residential real estate loans. Nottingham provides asset management services to individuals, corporate pension and profit sharing plans, and foundations. FLSC provides banking-related services to the Pennsylvania branches of the Bank. Brilie and WCR are inactive companies. CBNA Insurance is a full-service insurance agency offering primarily property and casualty products.

The Company maintains websites at communitybankna.com and firstlibertybank.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information posted on the website is not incorporated into or a part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at http://www.sec.gov.

On January 19, 2012, the Bank, the wholly-owned banking subsidiary of the Company, entered into an Assignment, Purchase and Assumption Agreement (the “HSBC Branch Agreement”) and a Purchase and Assumption Agreement (the “First Niagara Branch Agreement”) (collectively, the “Agreements”) with First Niagara Bank, N.A. (“First Niagara”). Under the Agreements, the Bank will acquire 19 branches in Central, Northern, and Western New York consisting of three branches purchased directly from First Niagara and 16 branches which are currently owned by HSBC Bank USA, National Association (“HSBC”). First Niagara is assigning its rights to the HSBC branches in connection with its pending acquisition of HSBC’s Upstate New York banking franchise. Upon its completion, the branch acquisitions will strengthen and extend the Company’s Upstate New York presence. Under the terms of the Agreements, Community Bank will acquire approximately $218 million in loans and $955 million in deposits at a blended deposit premium of 3.22%. The branch acquisitions are expected to close during the third quarter of 2012 subject to regulatory review and approval and customary closing conditions. The Company expects to incur certain one-time, transaction-related costs in 2012.

The Company completed a public stock offering in late January 2012. The offering raised $57.5 million through the issuance of 2.13 million shares. The net proceeds of the offering were approximately $54.9 million. The Company intends to use the net proceeds from this offering to support the HSBC and First Niagara branch acquisitions.

Acquisition History (2007-2011)

CAI Benefits, Inc.

On November 30, 2011, BPAS acquired, in an all-cash transaction, certain assets and liabilities of CAI, a provider of actuarial, consulting and retirement plan administration services, with offices in New York City and Northern New Jersey. The transaction is expected to add approximately $4 million of revenue to this business line in 2012.

The Wilber Corporation Acquisition

On April 8, 2011, the Company acquired The Wilber Corporation, parent company of Wilber National Bank, and its 22 branch-banking centers in the Central, Greater Capital District and Catskill regions of New York for $103 million of stock and cash. The Company acquired approximately $462 million in loans, $297 million of investment securities and $772 million in deposits.

Citizens Branches Acquisition

On November 7, 2008, the Company acquired 18 branch-banking centers in northern New York from Citizens Financial Group, Inc. (“Citizens”) in an all-cash transaction. The Company acquired approximately $109 million in loans and $565 million in deposits at a blended deposit premium of 13%. In support of the transaction, the Company issued approximately $50 million of equity capital in the form of common stock in October 2008.

Alliance Benefit Group MidAtlantic

On July 7, 2008, BPAS acquired the Philadelphia division of Alliance Benefit Group MidAtlantic (“ABG”) from BenefitStreet, Inc. in an all-cash transaction. ABG was a provider of retirement plan consulting, daily valuation administration, actuarial, and ancillary support services.

TLNB Financial Corporation

On June 1, 2007, the Company acquired TLNB Financial Corporation, parent company of Tupper Lake National Bank (“TLNB”), in an all-cash transaction valued at approximately $17.8 million. Based in Tupper Lake, New York, TLNB operated five branches in the northeastern New York State cities of Tupper Lake, Plattsburgh and Saranac Lake, as well as an insurance subsidiary, TLNB Insurance Agency, Inc.

Hand Benefits & Trust, Company

On May 18, 2007, BPAS acquired HB&T in an all-cash transaction. HB&T was a Houston, Texas based provider of employee benefit plan administration and trust services.

Services

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank's branches are generally located in smaller towns and cities within its geograph­ic market areas of Upstate New York and Northeastern Pennsylvania. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch and regional levels, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System and the Federal Home Loan Bank of New York ("FHLB"), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Competition

The banking and financial services industry is highly competitive in the New York and Pennsylvania markets. The Company competes actively for loans, deposits and customers with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, insurance companies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The table below summarizes the Bank’s deposits and market share by the forty counties of New York and Pennsylvania in which it has customer facilities. Market share is based on deposits of all commercial banks, credit unions, savings and loan associations, and savings banks.

Number of Towns Where Deposits as of Company 6/30/2011 Market Towns/ Has 1st or 2nd County State (000's omitted) Share (1) Facilities ATM's Cities Market Position Hamilton NY $35,739 52.50% 2 1 2 2 Lewis NY 113,165 46.57% 4 4 3 3 Franklin NY 244,835 46.07% 8 8 7 6 Allegany NY 205,771 44.42% 9 10 8 8 Otsego NY 427,769 40.69% 10 9 6 5 Yates NY 89,144 30.32% 2 2 1 0 Cattaraugus NY 313,215 29.24% 10 9 6 7 Wyoming PA 121,304 24.23% 4 3 3 3 Seneca NY 96,158 23.97% 4 3 4 2 St. Lawrence NY 372,524 22.66% 14 8 11 10 Essex NY 117,357 19.93% 6 5 5 5 Clinton NY 240,334 16.52% 5 7 2 2 Chautauqua NY 257,785 15.02% 12 12 10 7 Delaware NY 161,538 13.68% 5 4 5 5 Schuyler NY 19,625 12.36% 1 1 1 0 Jefferson NY 201,103 11.56% 5 5 4 2 Livingston NY 86,018 10.25% 3 4 3 3 Ontario NY 151,205 8.73% 7 12 6 4 Schoharie NY 32,763 8.48% 1 1 1 0 Steuben NY 171,285 7.90% 8 7 7 4 Lackawanna PA 404,132 7.76% 11 11 8 4 Tioga NY 31,465 7.63% 2 2 2 1 Chenango NY 42,282 7.19% 2 2 1 1 Chemung NY 80,554 7.08% 2 2 1 0 Herkimer NY 40,003 6.67% 1 1 1 1 Susquehanna PA 37,363 5.51% 3 1 3 2 Wayne NY 55,181 5.12% 2 4 2 1 Cayuga NY 42,963 4.28% 2 2 2 1 Luzerne PA 232,719 3.67% 6 7 6 3 Oswego NY 49,051 3.59% 2 2 2 2 Washington NY 19,238 3.05% 1 0 1 1 Bradford PA 29,293 2.55% 2 2 2 1 Warren NY 34,311 2.44% 1 1 1 1 Oneida NY 53,878 1.17% 2 1 1 1 Broome NY 39,611 0.83% 1 1 1 1 Ulster NY 24,981 0.65% 1 1 1 1 Saratoga NY 15,126 0.41% 1 1 1 0 Onondaga NY 25,064 0.26% 2 3 2 0 Tompkins NY 4,946 0.21% 1 0 1 0 Erie NY 46,426 0.19% 3 3 3 1 $4,767,224 5.09% 168 162 137 101

(1) Deposit market share data as of June 30, 2011 the most recent information available. Source: SNL Financial LLC

Employees

As of December 31, 2011, the Company employed 1,784 full-time employees, 144 part-time employees and 102 temporary employees. None of the Company's employees are represented by a collective bargaining agreement. The Company offers a variety of employment benefits and considers its relationship with its employees to be good.

Supervision and Regulation

General

The Company and its subsidiaries are subject to the laws and regulations of the federal government and the states in which they conduct business. The Company, as a bank holding company, is subject to extensive regulation, supervision and examination by the Board of Governors of the Federal Reserve System (“FRB”) as its primary federal regulator. The Bank is a nationally-chartered bank and is subject to extensive regulation, supervision and examination by the Office of the Comptroller of the Currency (“OCC”) as its primary federal regulator. The Bank is also subject to the regulations and supervision of the FRB and the Federal Deposit Insurance Corporation (“FDIC”).

The Company is subject to the jurisdiction of the Securities and Exchange Commission (“SEC”) and is subject to disclosure and regulatory requirement under the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended. Nottingham Advisors, Inc., Community Investment Services, Inc. and Hand Securities, Inc. are subject to the jurisdiction of the SEC, the New York Stock Exchange, the Financial Industry Regulatory Authority (“FINRA”) and state securities regulators, among others.

Set forth below is a description of the material information governing the laws and regulations applicable to the Company:

Federal Bank Holding Company Regulation

The Company is registered under, and is subject to, the Bank Holding Company Act of 1956, as amended. This Act limits the type of companies that the Company may acquire or organize and the activities in which it or they may engage. In general, the Company and the Bank are prohibited from engaging in or acquiring direct or indirect control of any corporation engaged in non-banking activities unless such activities are so closely related to banking as to be a proper incident thereto. In addition, the Company must obtain the prior approval of the FRB to acquire control of any bank; to acquire, with certain exceptions, more than five percent of the outstanding voting stock of any other corporation; or to merge or consolidate with another bank holding company. As a result of such laws and regulation, the Company is restricted as to the types of business activities it may conduct and the Bank is subject to limitations on, among others, the types of loans and the amounts of loans it may make to any one borrower. The Financial Modernization Act of 1999 created, among other things, the “financial holding company”, a new entity which may engage in a broader range of activities that are “financial in nature”, including insurance underwriting, securities underwriting and merchant banking. Bank holding companies which are well capitalized and well managed under regulatory standards may convert to financial holding companies relatively easily through a notice filing with the FRB, which acts as the “umbrella regulator” for such entities. The Company may seek to become a financial holding company in the future.

Federal Reserve System Regulation

The Company, as a bank holding company, is subject to regulatory capital requirements and is required by the FRB to, among other things, maintain cash reserves against its deposits. The Bank is under similar capital requirements administered by the OCC. FRB policy has historically required a bank holding company to act as a source of financial and managerial strength to its subsidiary banks. The Dodd-Frank Act (as defined below) codifies this policy as a statutory requirement. After exhausting other sources of funds, the Company may seek borrowings from the FRB for such purposes. Bank holding companies registered with the FRB are, among other things, restricted from making direct investments in real estate. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors’ funds.

The FRB also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the FRB, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust their strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond their control.

The Company and the Bank are subject to minimum capital requirements established by the FRB, the OCC and the FDIC. For information on these capital requirements and the Company’s and the Bank’s capital ratios see “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Capital” and Note P to the Financial Statements.

Office of Comptroller of the Currency Regulation

The Bank is supervised and regularly examined by the OCC. The various laws and regulations administered by the OCC affect corporate practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and location of offices. The OCC generally prohibits a depository institution from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the depository institution would thereafter be undercapitalized. Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the OCC. The Bank is well capitalized under regulatory standards administered by the OCC.

Insurance of Deposit Accounts

The Bank is a member of the Deposit Insurance Fund (“DIF”), which is administered by the FDIC. On July 22, 2010, the FDIC amended its insurance regulations to insure deposit accounts up to a maximum of $250,000 (previously $100,000) for each separately insured depositor. Additionally, on November 9, 2010, the FDIC issued a final rule implementing Section 343 of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (“the Dodd-Frank Act”) which provides certain noninterest-bearing transaction accounts with unlimited insurance coverage, regardless of the dollar amount, through December 31, 2012.

The FDIC imposes an assessment against all depository institutions for deposit insurance. This assessment is based on the risk category of the institution and, prior to 2009, ranged from five to 43 basis points of the institution’s deposits. On December 22, 2008, as a result of decreases in the reserve ratio of the DIF, the FDIC published a final rule raising the current deposit insurance assessment rates uniformly for all institutions by seven basis points for the first quarter of 2009. On May 22, 2009, the FDIC adopted a final rule imposing a five basis point special assessment on each insured depository institution’s assets minus Tier 1 capital as of June 30, 2009, payable on September 30, 2009. The Company’s special assessment amounted to $2.5 million.

In the fourth quarter of 2009, the FDIC adopted a rule that required insured depository institutions to prepay their quarterly risk-based assessments for the fourth quarter of 2009, and for all of 2010, 2011 and 2012, on December 30, 2009. For purposes of calculating the amount to prepay, the FDIC required that institutions use their total base assessment rate in effect on September 30, 2009 and increase that assessment base quarterly at a 5 percent annual growth rate through the end of 2012. The FDIC also increased annual assessment rates uniformly by three basis points beginning in 2011. The Company’s prepayment for 2010, 2011 and 2012 amounted to $21.4 million.

Effective April 1, 2011, the FDIC changed the basis for premium payments from a percentage of average deposits to a percentage of average consolidated Bank assets less average tangible capital, resulting in lower 2011 premiums for the Company.

Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

On July 21, 2010, President Obama signed into law the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (“Dodd-Frank Act”). This law results in significant changes to the banking industry. The provisions that have received the most public attention have been those that apply to larger financial institutions; however, the Dodd-Frank Act does contain numerous other provisions that will affect all banks and bank holding companies and impacts how the Company and the Bank handle their operations. The Dodd-Frank Act requires various federal agencies, including those that regulate the Company and the Bank, to promulgate new rules and regulations and to conduct various studies and reports for Congress. The federal agencies are in the process of promulgating these rules and regulations and have been given significant discretion in drafting such rules and regulations. Several of the provisions of the Dodd-Frank Act may have the consequence of increasing the Bank’s expenses, decreasing its revenues, and changing the activities in which it chooses to engage. The specific impact of the Dodd-Frank Act on the Company's current activities or new financial activities the Company may consider in the future, the Company's financial performance, and the markets in which the Company operates depends on the manner in which the relevant agencies develop and implement the required rules and regulations and the reaction of market participants to these regulatory developments.

The Dodd-Frank Act includes provisions that, among other things:

· Change the assessment base for federal deposit insurance from the amount of insured deposits to consolidated assets less tangible capital, eliminate the ceiling on the size of the DIF, and increase the floor applicable to the size of the DIF.

· Make permanent the $250,000 limit on deposits for federal deposit insurance, retroactive to January 1, 2008, and provide unlimited federal deposit insurance through December 31, 2012 for non-interest bearing demand transaction accounts at all insured depository institutions.

· Repeal the federal prohibitions on the payment of interest on demand deposits, thereby permitting depository institutions to pay interest on business transaction and other accounts.

· Centralize responsibility for consumer financial protection by creating a new agency responsible for implementing, examining, and enforcing compliance with federal consumer financial laws under the newly created Consumer Financial Protection Bureau (“CFPB”).

· Restrict the preemption of state law by federal law and disallow subsidiaries and affiliates of national banks from availing themselves of such preemption.

· Apply the same leverage and risk-based capital requirements that apply to insured depository institutions to most bank holding companies, which, among other things as applied to the Company, going forward will preclude the Company from including in Tier 1 Capital trust preferred securities or cumulative preferred stock, if any, issued on or after May 19, 2010. The Company has not issued any trust preferred securities since May 19, 2010.

· Require the OCC to seek to make its capital requirements for national banks countercyclical.

· Impose comprehensive regulation of the over-the-counter derivatives market, which would include certain provisions that would effectively prohibit insured depository institutions from conducting certain derivatives businesses in the institution itself.

· Amend the Electronic Fund Transfer Act to, among other things, give the FRB the authority to establish rules regarding interchange fees charged for electronic debit transactions by payment card issuers having assets over $10 billion and to enforce a new statutory requirement that such fees be reasonable and proportional to the actual cost of a transaction to the issuer.

· Increase the authority of the FRB to examine the Company and any of its non-bank subsidiaries.

Consumer Protection Laws

In connection with its lending activities, the Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending to various sectors of the economy. These laws include the Equal Credit Opportunity Act, the Gramm-Leach-Bliley Act (“GLB Act”), the Fair Credit Reporting Act (“FCRA”), the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”), Electronic Funds Transfer Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Dodd-Frank Act, the Real Estate Settlement Procedures Act, and various state law counterparts.

The Dodd-Frank Act creates the CFPB with broad powers to supervise and enforce consumer protection laws, including laws that apply to banks in order to prohibit unfair, deceptive or abusive practices. The CFPB has examination authority over all banks and savings institutions with more than $10 billion in assets. The Dodd-Frank Act weakens the federal preemption rules that have been applicable to national banks and gives attorney generals for the states certain powers to enforce federal consumer protection laws.

In addition, the GLB Act requires all financial institutions to adopt privacy policies, restrict the sharing of nonpublic customer data with nonaffiliated parties and establishes procedures and practices to protect customer data from unauthorized access. In addition, the FCRA, as amended by the FACT Act, includes provisions affecting the Company, the Bank, and their affiliates, including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. The FACT Act requires persons subject to FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the Federal Trade Commission have extensive rulemaking authority under the FACT Act, and the Company and the Bank are subject to the rules that have been created under the FACT Act, including rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate certain identity theft red flags. The Bank is also subject to data security standards and data breach notice requirements issued by the OCC and other regulatory agencies. The Bank has created policies and procedures to comply with these consumer protection requirements.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The USA Patriot Act also encourages information-sharing among financial institutions, regulators, and law enforcement authorities by providing an exemption from the privacy provisions of the GLB Act for financial institutions that comply with the provision of the Act. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the institution. The Company has approved policies and procedures that are designed to comply with the USA Patriot Act.

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others administrated by the Treasury’s Office of Foreign Assets Control (“OFAC”). The OFAC administered sanctions can take many different forms depending upon the country; however, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments in, or providing investment related advice or assistance to, a sanctioned country; and (ii) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934 as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) new requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) additional responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) the creation of an independent accounting oversight board for the accounting industry; (iv) new standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on non-preferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violation of the securities laws.

The Emergency Economic Stabilization Act of 2008

The Emergency Economic Stabilization Act of 2008 (“EESA”) provides the U.S. Secretary of the Treasury with broad authority to implement certain actions to help restore stability and liquidity to U.S. markets. The EESA authorizes the U.S. Treasury to, among other things, purchase up to $700 billion of mortgages, mortgage-backed securities and certain other financial instruments from financial institutions for the purpose of stabilizing and providing liquidity to the U.S. financial markets. The Company did not originate or invest in sub-prime assets and, therefore, does not expect to participate in the sale of any of our assets into these programs. One of the provisions resulting from the legislation is the Troubled Asset Relief Program Capital Purchase Program (“TARP Capital Purchase Program”), which provides direct equity investment in perpetual preferred stock by the U.S. Treasury Department in qualified financial institutions. The program is voluntary and requires an institution to comply with a number of restrictions and provisions, including limits on executive compensation, stock redemptions, and declaration of dividends. The Company chose not to participate in the TARP Capital Purchase Program.

Electronic Fund Transfer Act

Effective July 1, 2010, a new federal banking rule under the Electronic Fund Transfer Act prohibits financial institutions from charging consumers fees for paying overdrafts on automated teller machines and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions. The new rule does not govern overdraft fees on the payment of checks and regular electronic bill payments. The adoption of this regulation lowered fee income in the fourth quarter of 2010 and all of 2011.

Community Reinvestment Act of 1977

Under the Community Reinvestment Act of 1977 (“CRA”), the Bank is required to help meet the credit needs of its communities, including low- and moderate-income neighborhoods. Although the Bank must follow the requirements of CRA, it does not limit the Bank’s discretion to develop products and services that are suitable for a particular community or establish lending requirements or programs. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibits discrimination in lending practices. The Bank’s failure to comply with the provisions of the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s failure to comply with the Equal Credit Opportunity Act and the Fair Housing Act could result in enforcement actions against it by its regulators as well as other federal regulatory agencies and the Department of Justice. The Bank’s latest CRA rating was Satisfactory.

The Bank Secrecy Act

The Bank Secrecy Act (“BSA”) requires all financial institutions, including banks and securities broker-dealers, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. The BSA includes a variety of recordkeeping and reporting requirements (such as cash and suspicious activity reporting), as well as due diligence/know-your-customer documentation requirements. The Company has established an anti-money laundering program and taken other appropriate measures in order to comply with BSA requirements.

Community Bank System, Inc. ("the Company") was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company is a single bank holding company which wholly-owns five subsidiaries: Community Bank, N.A. (“the Bank” or “CBNA”), Benefit Plans Administrative Services, Inc. (“BPAS”), CFSI Closeout Corp. (“CFSICC”), First of Jermyn Realty Company, Inc. (“FJRC”) and Town & Country Agency LLC (“T&C”). BPAS owns three subsidiaries, Benefit Plans Administrative Services LLC (“BPA”), a provider of defined contribution plan administration services; Harbridge Consulting Group LLC (“Harbridge”), a provider of actuarial and benefit consulting services; and Hand Benefits & Trust Company (“HB&T”), a provider of Collective Investment Fund administration and institutional trust services. CFSICC, FJRC and T&C are inactive companies. The Company also wholly-owns two unconsolidated subsidiary business trusts formed for the purpose of issuing mandatorily-redeemable preferred securities which are considered Tier I capital under regulatory capital adequacy guidelines.

The Company maintains websites at communitybankna.com and firstlibertybank.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q and current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information on the website is not part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at http://www.sec.gov.

The Bank’s business philosophy is to operate as a community bank with local decision-making, principally in non-metropolitan markets, providing a broad array of banking and financial services to retail, commercial, and municipal customers. The Bank operates 148 customer facilities throughout 28 counties of Upstate New York, where it operates as Community Bank, N.A. and five counties of Northeastern Pennsylvania, where it is known as First Liberty Bank & Trust, offering a range of commercial and retail banking services. The Bank owns the following subsidiaries: Community Investment Services, Inc. (“CISI”), CBNA Treasury Management Corporation (“TMC”), CBNA Preferred Funding Corporation (“PFC”), Nottingham Advisors, Inc. (“Nottingham”), First Liberty Service Corp. (“FLSC”), Brilie Corporation (“Brilie”) and CBNA Insurance Agency, Inc. (“CBNA Insurance”). CISI provides broker-dealer and investment advisory services. TMC provides cash management, investment, and treasury services to the Bank. PFC primarily acts as an investor in residential real estate loans. Nottingham provides asset management services to individuals, corporate pension and profit sharing plans, and foundations. FLSC provides banking-related services to the Pennsylvania branches of the Bank. Brilie is an inactive company. CBNA Insurance is a full-service insurance agency offering primarily property and casualty products.

On October 25, 2010, the Company announced that it had entered into a definitive agreement to acquire The Wilber Corporation (“Wilber”), parent company of the Wilber National Bank in Oneonta, NY, for $101.8 million in stock and cash. The acquisition will extend the Company’s Central New York service area to the contiguous Central Leatherstocking, Greater Capital District and Catskills regions of Upstate New York. The acquisition is expected to close during the second quarter of 2011, pending both customary regulatory and Wilber shareholder approval. Upon the completion of the merger, Community Bank will add 22 branch locations in eight counties and approximately $870 million of assets, including loans of $510 million, and over $720 million of deposits. The Company expects to incur certain one-time, transaction-related costs in 2011.

Acquisition History (2006-2010)

Citizens Branches Acquisition

On November 7, 2008, the Company acquired 18 branch-banking centers in northern New York from Citizens Financial Group, Inc. (“Citizens”) in an all-cash transaction. The Company acquired approximately $109 million in loans and $565 million in deposits at a blended deposit premium of 13%. In support of the transaction, the Company issued approximately $50 million of equity capital in the form of common stock in October 2008.

Alliance Benefit Group MidAtlantic

On July 7, 2008, BPAS, a wholly-owned subsidiary of the Company, acquired the Philadelphia division of Alliance Benefit Group MidAtlantic (“ABG”) from BenefitStreet, Inc. in an all-cash transaction. ABG was a provider of retirement plan consulting, daily valuation administration, actuarial and ancillary support services.

Hand Benefits & Trust, Company

On May 18, 2007, BPAS acquired HB&T in an all-cash transaction. HB&T was a Houston, Texas based provider of employee benefit plan administration and trust services.

TLNB Financial Corporation

On June 1, 2007, the Company acquired TLNB Financial Corporation, parent company of Tupper Lake National Bank (“TLNB”), in an all-cash transaction valued at approximately $17.8 million. Based in Tupper Lake, NewYork, TLNB operated five branches in the northeastern New York State cities of Tupper Lake, Plattsburgh and Saranac Lake, as well as an insurance subsidiary, TLNB Insurance Agency, Inc.

ONB Corporation

On December 1, 2006, the Company acquired ONB Corporation (“ONB”), the parent company of Ontario National Bank, a federally-chartered national bank, in an all-cash transaction valued at approximately $16 million. ONB operated four branches in the villages of Clifton Springs, Phelps, and Palmyra, New York.

ES&L Bancorp, Inc.

On August 11, 2006, the Company acquired ES&L Bancorp, Inc. (“Elmira”), the parent company of Elmira Savings and Loan, F.A., a federally-chartered thrift, in an all-cash transaction valued at approximately $40 million. Elmira operated two branches in the cities of Elmira and Ithaca, New York.

Services

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank's branches are generally located in smaller towns and cities within its geograph­ic market areas of Upstate New York and Northeastern Pennsylvania. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch and regional levels, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System and the Federal Home Loan Bank of New York ("FHLB"), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Competition

The banking and financial services industry is highly competitive in the New York and Pennsylvania markets. The Company competes actively for loans, deposits and customers with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, insurance companies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The table below summarizes the Bank’s deposits and market share by the thirty-three counties of New York and Pennsylvania in which it has customer facilities. Market share is based on deposits of all commercial banks, credit unions, savings and loan associations, and savings banks.

Number of Deposits as of Towns Where Company 6/30/2010 Market Towns/ Has 1st or 2nd County State (000's omitted) Share(1) Facilities ATM's Cities Market Position Hamilton NY $36,359 52.9% 2 1 2 2 Franklin NY 255,245 47.5% 10 7 7 7 Allegany NY 197,435 44.8% 9 9 8 8 Lewis NY 109,900 43.9% 5 3 3 3 Seneca NY 164,471 38.2% 4 3 4 3 Cattaraugus NY 305,248 28.9% 10 9 7 7 Yates NY 73,933 27.1% 2 2 1 0 Wyoming PA 109,972 22.6% 4 3 3 3 St. Lawrence NY 354,462 22.5% 15 8 11 10 Essex NY 117,817 20.5% 5 5 5 5 Clinton NY 231,287 15.6% 5 7 2 1 Chautauqua NY 240,575 14.2% 12 12 10 7 Schuyler NY 20,580 13.3% 1 1 1 0 Jefferson NY 193,543 11.3% 5 5 4 2 Livingston NY 85,191 11.2% 3 4 3 3 Ontario NY 160,133 9.3% 7 12 6 4 Steuben NY 187,799 9.2% 8 7 7 4 Tioga NY 31,861 7.8% 2 2 2 1 Lackawanna PA 403,855 7.6% 11 11 8 4 Chemung NY 81,971 7.1% 2 2 1 0 Herkimer NY 36,445 6.0% 1 1 1 1 Wayne NY 57,101 5.3% 2 4 2 1 Susquehanna PA 29,826 4.4% 3 1 3 2 Oswego NY 47,932 3.9% 2 2 2 2 Cayuga NY 38,326 3.9% 2 2 2 1 Luzerne PA 235,118 3.6% 6 7 6 3 Washington NY 19,807 3.2% 1 0 1 1 Warren NY 33,166 2.4% 1 1 1 1 3,859,358 11.0% 140 131 113 86 Bradford PA 22,785 2.1% 2 2 2 1 Oneida NY 57,019 1.3% 2 1 1 1 Tompkins NY 5,225 0.2% 1 0 1 0 Onondaga NY 16,875 0.2% 2 2 1 0 Erie NY 40,797 0.1% 2 2 2 1 $4,002,059 4.8% 149 138 120 89

(1) Deposit market share data as of June 30, 2010 the most recent information available. Source: SNL Financial LLC

Employees

As of December 31, 2010, the Company employed 1,627 full-time equivalent employees. The Company offers a variety of employment benefits and considers its relationship with its employees to be good.

Supervision and Regulation

General

The Company and its subsidiaries are subject to the laws and regulations of the federal government and the states in which they conduct business. The Company, as a bank holding company, is subject to extensive regulation, supervision and examination by the Board of Governors of the Federal Reserve System (“FRB”) as its primary federal regulator. The Bank is a nationally-chartered bank and is subject to extensive regulation, supervision and examination by the Office of the Comptroller of the Currency (“OCC”) as its primary federal regulator. The Bank is also subject to the regulations and supervision of the FRB and the Federal Deposit Insurance Corporation (“FDIC”).

The Company is subject to the jurisdiction of the Securities and Exchange Commission (“SEC”) and is subject to disclosure and regulatory requirement under the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended. Nottingham Advisors, Inc., Community Investment Services, Inc. and Hand Securities, Inc. are subject to the jurisdiction of the SEC, the Financial Industry Regulatory Authority (“FINRA”) and state securities regulators.

Set forth below is a description of the material information governing the laws and regulations applicable to the Company:

Federal Bank Holding Company Regulation

The Company is registered under, and is subject to, the Bank Holding Company Act of 1956, as amended. This Act limits the type of companies that the Company may acquire or organize and the activities in which it or they may engage. In general, the Company and the Bank are prohibited from engaging in or acquiring direct or indirect control of any corporation engaged in non-banking activities unless such activities are so closely related to banking as to be a proper incident thereto. In addition, the Company must obtain the prior approval of the FRB to acquire control of any bank; to acquire, with certain exceptions, more than five percent of the outstanding voting stock of any other corporation; or to merge or consolidate with another bank holding company. As a result of such laws and regulation, the Company is restricted as to the types of business activities it may conduct and the Bank is subject to limitations on, among others, the types of loans and the amounts of loans it may make to any one borrower. The Financial Modernization Act of 1999 created, among other things, the “financial holding company”, a new entity which may engage in a broader range of activities that are “financial in nature”, including insurance underwriting, securities underwriting and merchant banking. Bank holding companies which are well capitalized and well managed under regulatory standards may convert to financial holding companies relatively easily through a notice filing with the FRB, which acts as the “umbrella regulator” for such entities. The Company may seek to become a financial holding company in the future.

Federal Reserve System Regulation

The Company, as a bank holding company, is subject to regulatory capital requirements and is required by the FRB to, among other things, maintain cash reserves against its deposits. The Bank is under similar capital requirements administered by the OCC. FRB policy has historically required a bank holding company to act as a source of financial and managerial strength to its subsidiary banks. The Dodd-Frank Act (as defined below) codifies this policy as a statutory requirement. After exhausting other sources of funds, the Company may seek borrowings from the FRB for such purposes. Bank holding companies registered with the FRB are, among other things, restricted from making direct investments in real estate. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors’ funds.

The FRB also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the FRB, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust their strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond their control.

The Company and the Bank are subject to minimum capital requirements established by the FRB, the OCC and the FDIC. For information on these capital requirements and the Company’s and the Bank’s capital ratios see “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Capital” and Note P to the Financial Statements.

Office of Comptroller of the Currency Regulation

The Bank is supervised and regularly examined by the OCC. The various laws and regulations administered by the OCC affect corporate practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and location of offices. The OCC generally prohibits a depository institution from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the depository institution would thereafter be undercapitalized. Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the OCC. The Bank is well capitalized under regulatory standards administered by the OCC.

Insurance of Deposit Accounts

The Bank is a member of the Deposit Insurance Fund (“DIF”), which is administered by the FDIC. On July 22, 2010, the FDIC amended its insurance regulations to insure deposit accounts up to a maximum of $250,000 (previously $100,000) for each separately insured depositor. Additionally, on November 9, 2010, the FDIC issued a final rule implementing Section 343 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (“the Dodd-Frank Act”) which provides certain noninterest-bearing transaction accounts with unlimited insurance coverage, regardless of the dollar amount, until December 31, 2012.

The FDIC imposes an assessment against all depository institutions for deposit insurance. This assessment is based on the risk category of the institution and, prior to 2009, ranged from five to 43 basis points of the institution’s deposits. On December 22, 2008, as a result of decreases in the reserve ratio of the DIF, the FDIC published a final rule raising the current deposit insurance assessment rates uniformly for all institutions by seven basis points for the first quarter of 2009. On May 22, 2009, the FDIC adopted a final rule imposing a five basis point special assessment on each insured depository institution’s assets minus Tier 1 capital as of June 30, 2009, payable on September 30, 2009. The Company’s special assessment amounted to $2.5 million.

In the fourth quarter of 2009, the FDIC adopted a rule that required insured depository institutions to prepay their quarterly risk-based assessments for the fourth quarter of 2009, and for all of 2010, 2011 and 2012, on December 30, 2009. For purposes of calculating the amount to prepay, the FDIC required that institutions use their total base assessment rate in effect on September 30, 2009 and increase that assessment base quarterly at a 5 percent annual growth rate through the end of 2012. The FDIC also increased annual assessment rates uniformly by three basis points beginning in 2011. The Company’s prepayment for 2010, 2011 and 2012 amounted to $21.4 million.

Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

On July 21, 2010, the President signed into law the Dodd-Frank Act. This new law will result in significant changes to the banking industry. The provisions that have received the most public attention have been those that apply to larger financial institutions; however, the Dodd-Frank Act does contain numerous other provisions that will affect all banks and bank holding companies and will impact how the Company and the Bank handle their operations. The Dodd-Frank Act requires various federal agencies, including those that regulate the Company and the Bank, to promulgate new rules and regulations and to conduct various studies and reports for Congress. The federal agencies are in the process of promulgating these rules and regulations and have been given significant discretion in drafting such rules and regulations. Several of the provisions of the Dodd-Frank Act may have the consequence of increasing the Bank’s expenses, decreasing its revenues, and changing the activities in which it chooses to engage. The specific impact of the Dodd-Frank Act on our current activities or new financial activities we may consider in the future, our financial performance, and the markets in which we operate will depend on the manner in which the relevant agencies develop and implement the required rules and regulations and the reaction of market participants to these regulatory developments.

The Dodd-Frank Act includes provisions that, among other things, will:

· Require publicly traded companies, like the Company, to give shareholders a non-binding vote on executive compensation and “golden parachute” payments and allow greater access by shareholders to the Company’s proxy materials in order to nominate directors;

· Change the assessment base for federal deposit insurance from the amount of insured deposits to consolidated assets less tangible capital, eliminate the ceiling on the size of the DIF, and increase the floor applicable to the size of the DIF.

· Make permanent the $250,000 limit on deposits for federal deposit insurance, retroactive to January 1, 2008, and provide unlimited federal deposit insurance until January 1, 2013 for non-interest bearing demand transaction accounts at all insured depository institutions.

· Repeal the federal prohibitions on the payment of interest on demand deposits, thereby permitting depository institutions to pay interest on business transaction and other accounts.

· Centralize responsibility for consumer financial protection by creating a new agency responsible for implementing, examining, and enforcing compliance with federal consumer financial laws under the newly created Consumer Financial Protection Bureau (“CFPB”).

· Restrict the preemption of state law by federal law and disallow subsidiaries and affiliates of national banks from availing themselves of such preemption.

· Apply the same leverage and risk-based capital requirements that apply to insured depository institutions to most bank holding companies, which, among other things as applied to the Company, going forward will preclude the Company from including in Tier 1 Capital trust preferred securities or cumulative preferred stock, if any, issued on or after May 19, 2010. The Company has not issued any trust preferred securities since May 19, 2010.

· Require the OCC to seek to make its capital requirements for national banks countercyclical.

· Impose comprehensive regulation of the over-the-counter derivatives market, which would include certain provisions that would effectively prohibit insured depository institutions from conducting certain derivatives businesses in the institution itself.

· Amend the Electronic Fund Transfer Act to, among other things, give the FRB the authority to establish rules regarding interchange fees charged for electronic debit transactions by payment card issuers having assets over $10 billion and to enforce a new statutory requirement that such fees be reasonable and proportional to the actual cost of a transaction to the issuer.

· Increase the authority of the FRB to examine the Company and any of its non-bank subsidiaries.

Consumer Protection Laws

In connection with its lending activities, the Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending to various sectors of the economy. These laws include the Equal Credit Opportunity Act, the Gramm-Leach-Bliley Act (“GLB Act”), the Fair Credit Reporting Act (“FCRA”), the Fair and Accurate Credit Transactions Act of 2003(“FACT Act”), the Truth in Lending Act, the Home Mortgage Disclosure Act, the Dodd-Frank Act, the Real Estate Settlement Procedures Act, and various state law counterparts.

The Dodd-Frank Act creates the CFPB with broad powers to supervise and enforce consumer protection laws, including laws that apply to banks in order to prohibit unfair, deceptive or abusive practices. The CFPB has examination authority over all banks and savings institutions with more than $10 billion in assets. The Dodd-Frank Act weakens the federal preemption rules that have been applicable to national banks and gives attorney generals for the states certain powers to enforce federal consumer protection laws.

In addition, the GLB Act requires all financial institutions to adopt privacy policies, restrict the sharing of nonpublic customer data with nonaffiliated parties and establishes procedures and practices to protect customer data from unauthorized access. In addition, the FCRA, as amended by the FACT Act, includes provisions affecting the Company, the Bank, and their affiliates, including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. The FACT Act requires persons subject to FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the Federal Trade Commission have extensive rulemaking authority under the FACT Act, and the Company and the Bank are subject to the rules that have been created under the FACT Act, including rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate certain identity theft red flags. The Bank is also subject to data security standards and data breach notice requirements issued by the OCC and other regulatory agencies. The Bank has created policies and procedures to comply with these consumer protection requirements.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The USA Patriot Act also encourages information-sharing among financial institutions, regulators, and law enforcement authorities by providing an exemption from the privacy provisions of the GLB Act for financial institutions that comply with the provision of the Act. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal, financial and reputational consequences for the institution. The Company has approved policies and procedures that are designed to comply with the USA Patriot Act.

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others administrated by the Treasury’s Office of Foreign Assets Control (“OFAC”). The OFAC administered sanctions can take many different forms depending upon the country; however, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments in, or providing investment related advice or assistance to, a sanctioned country; and (ii) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, financial, and reputational consequences.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934 as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) new requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) additional responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) the creation of an independent accounting oversight board for the accounting industry; (iv) new standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on non-preferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violation of the securities laws.

The Emergency Economic Stabilization Act of 2008

The Emergency Economic Stabilization Act of 2008 (“EESA”) provides the U.S. Secretary of the Treasury with broad authority to implement certain actions to help restore stability and liquidity to U.S. markets. The EESA authorizes the U.S. Treasury to, among other things, purchase up to $700 billion of mortgages, mortgage-backed securities and certain other financial instruments from financial institutions for the purpose of stabilizing and providing liquidity to the U.S. financial markets. The Company did not originate or invest in sub-prime assets and, therefore, does not expect to participate in the sale of any of our assets into these programs. One of the provisions resulting from the legislation is the Troubled Asset Relief Program Capital Purchase Program (“TARP Capital Purchase Program”), which provides direct equity investment in perpetual preferred stock by the U.S. Treasury Department in qualified financial institutions. The program is voluntary and requires an institution to comply with a number of restrictions and provisions, including limits on executive compensation, stock redemptions, and declaration of dividends. The Company chose not to participate in the TARP Capital Purchase Program.

Electronic Fund Transfer Act

Effective July 1, 2010, a new federal banking rule under the Electronic Fund Transfer Act prohibits financial institutions from charging consumers fees for paying overdrafts on automated teller machines and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions. The new rule does not govern overdraft fees on the payment of checks and regular electronic bill payments. The adoption of this regulation lowered fee income in the fourth quarter of 2010 and is expected to lower fee income further in 2011.

Community Reinvestment Act of 1977

Under the Community Reinvestment Act of 1977 (“CRA”), the Bank is required to help meet the credit needs of its communities, including low- and moderate-income neighborhoods. Although the Bank must follow the requirements of CRA, it does not limit the Bank’s discretion to develop products and services that are suitable for a particular community or establish lending requirements or programs. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibits discrimination in lending practices. The Bank’s failure to comply with the provisions of the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s failure to comply with the Equal Credit Opportunity Act and the Fair Housing Act could result in enforcement actions against it by its regulators as well as other federal regulatory agencies and the Department of Justice. The Bank’s latest CRA rating was Satisfactory.

Community Bank System, Inc. ("the Company") was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company is a single bank holding company which wholly-owns five subsidiaries: Community Bank, N.A. (“the Bank” or “CBNA”), Benefit Plans Administrative Services, Inc. (“BPAS”), CFSI Closeout Corp. (“CFSICC”), First of Jermyn Realty Company, Inc. (“FJRC”) and Town & Country Agency LLC (“T&C”). BPAS owns three subsidiaries, Benefit Plans Administrative Services LLC (“BPA”), a provider of defined contribution plan administration services; Harbridge Consulting Group LLC (“Harbridge”), a provider of actuarial and benefit consulting services; and Hand Benefits & Trust Company (“HB&T”), a provider of Collective Investment Fund administration and institutional trust services. CFSICC, FJRC and T&C are inactive companies. The Company also wholly-owns two unconsolidated subsidiary business trusts formed for the purpose of issuing mandatorily redeemable preferred securities which are considered Tier I capital under regulatory capital adequacy guidelines.

The Company maintains websites at communitybankna.com and firstlibertybank.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q and current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information on the website is not part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at http://www.sec.gov.

The Bank’s business philosophy is to operate as a community bank with local decision-making, principally in non-metropolitan markets, providing a broad array of banking and financial services to retail, commercial, and municipal customers. The Bank operates 147 customer facilities throughout 28 counties of Upstate New York, where it operates as Community Bank, N.A. and five counties of Northeastern Pennsylvania, where it is known as First Liberty Bank & Trust, offering a range of commercial and retail banking services. The Bank owns the following subsidiaries: Community Investment Services, Inc. (“CISI”), CBNA Treasury Management Corporation (“TMC”), CBNA Preferred Funding Corporation (“PFC”), Nottingham Advisors, Inc. (“Nottingham”), First Liberty Service Corp. (“FLSC”), Brilie Corporation (“Brilie”) and CBNA Insurance Agency, Inc. (“CBNA Insurance”). CISI provides broker-dealer and investment advisory services. TMC provides cash management, investment, and treasury services to the Bank. PFC primarily acts as an investor in residential real estate loans. Nottingham provides asset management services to individuals, corporate pension and profit sharing plans, and foundations. FLSC provides banking-related services to the Pennsylvania branches of the Bank. Brilie is an inactive company. CBNA Insurance is a full-service insurance agency offering primarily property and casualty products.

Acquisition History (2005-2009)

Citizens Branches Acquisition

On November 7, 2008, the Company acquired 18 branch-banking centers in northern New York from Citizens Financial Group, Inc. (“Citizens”) in an all cash transaction. The Company acquired approximately $109 million in loans and $565 million in deposits at a blended deposit premium of 13%. In support of the transaction, the Company issued approximately $50 million of equity capital in the form of common stock in October 2008.

Alliance Benefit Group MidAtlantic

On July 7, 2008, Benefit Plans Administrative Services, Inc. (“BPAS”), a wholly owned subsidiary of the Company, acquired the Philadelphia division of Alliance Benefit Group MidAtlantic (“ABG”) from BenefitStreet, Inc. in an all cash transaction. ABG was a provider of retirement plan consulting, daily valuation administration, actuarial and ancillary support services.

Hand Benefits & Trust, Inc.

On May 18, 2007, BPAS, a whollyowned subsidiary of the Company, acquired Hand Benefits & Trust, Inc. (“HB&T”) in an all cash transaction. HB&T was a Houston, Texas based provider of employee benefit plan administration and trust services.

TLNB Financial Corporation

On June 1, 2007, the Company acquired TLNB Financial Corporation, parent company of Tupper Lake National Bank (“TLNB”), in an all-cash transaction valued at approximately $17.8 million. Based in Tupper Lake, NewYork, TLNB operated five branches in the northeastern New York State cities of Tupper Lake, Plattsburgh and Saranac Lake, as well as an insurance subsidiary, TLNB Insurance Agency, Inc.

ONB Corporation

On December 1, 2006, the Company acquired ONB Corporation (“ONB”), the parent company of Ontario National Bank, a federally-chartered national bank, in an all-cash transaction valued at approximately $16 million. ONB operated four branches in the villages of Clifton Springs, Phelps, and Palmyra, New York.

ES&L Bancorp, Inc.

On August 11, 2006, the Company acquired ES&L Bancorp, Inc. (“Elmira”), the parent company of Elmira Savings and Loan, F.A., a federally-chartered thrift, in an all-cash transaction valued at approximately $40 million. Elmira operated two branches in the cities of Elmira and Ithaca, New York.

Services

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank's branches are generally located in smaller towns and cities within its geograph­ic market areas of Upstate New York and Northeastern Pennsylvania. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch and regional levels, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System and the Federal Home Loan Bank of New York ("FHLB"), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Competition

The banking and financial services industry is highly competitive in the New York and Pennsylvania markets. The Company competes actively for loans, deposits and customers with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, insurance companies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The table below summarizes the Bank’s deposits and market share by the thirty-three counties of New York and Pennsylvania in which it has customer facilities. Market share is based on deposits of all commercial banks, credit unions, savings and loan associations, and savings banks.

Number of Towns Where Deposits as of Company 6/30/2009 Market Towns/ Has 1st or 2nd County State (000's omitted) Share(1) Facilities ATM's Cities Market Position Franklin NY $253,090 54.3% 10 7 7 7 Hamilton NY 34,031 52.6% 2 0 2 2 Allegany NY 196,769 48.6% 9 8 8 8 Lewis NY 106,776 41.8% 4 3 3 3 Seneca NY 159,368 39.8% 4 3 4 3 Cattaraugus NY 293,443 36.0% 10 8 7 6 St. Lawrence NY 361,109 30.8% 15 7 11 10 Yates NY 70,491 26.9% 2 2 1 0 Wyoming PA 87,635 25.7% 4 3 4 3 Essex NY 117,396 23.9% 5 4 5 5 Steuben NY 173,948 21.9% 8 7 7 4 Clinton NY 239,041 19.6% 5 10 2 2 Chautauqua NY 232,318 15.8% 12 11 10 7 Jefferson NY 184,626 12.7% 5 5 4 2 Schuyler NY 19,746 12.6% 1 1 1 0 Livingston NY 80,804 11.8% 3 4 3 3 Ontario NY 149,753 9.3% 7 12 6 4 Lackawanna PA 421,800 9.1% 12 12 8 4 Chemung NY 90,175 7.7% 2 2 1 0 Tioga NY 30,782 7.3% 2 2 2 1 Wayne NY 57,731 7.2% 2 4 2 1 Herkimer NY 34,521 5.9% 1 1 1 1 Susquehanna PA 25,682 4.1% 2 0 2 2 Luzerne PA 224,388 3.9% 6 7 6 3 Cayuga NY 34,990 3.9% 2 2 2 1 Washington NY 22,290 3.8% 1 0 1 1 Oswego NY 44,589 3.5% 2 2 2 2 Warren NY 35,959 2.7% 1 1 1 1 3,783,251 11.8% 139 128 113 86 Bradford PA 21,357 2.4% 2 2 2 1 Oneida NY 56,309 1.8% 2 1 1 1 Tompkins NY 8,055 0.5% 1 0 1 0 Onondaga NY 13,521 0.2% 1 2 1 0 Erie NY 39,496 0.1% 2 2 2 1 $3,921,989 4.9% 147 135 120 89

(1) Deposit market share data as of June 30, 2009 the most recent information available. Source: SNL Financial LLC

Employees

As of December 31, 2009, the Company employed 1,595 full-time equivalent employees. The Company offers a variety of employment benefits and considers its relationship with its employees to be good.

Supervision and Regulation

Bank holding companies and national banks are regulated by state and federal law. The following is a summary of certain laws and regulations that govern the Company and the Bank. To the extent that the following information describes statutory or regulatory provisions, it is qualified in its entirety by reference to the actual statutes and regulations thereunder.

Federal Bank Holding Company Regulation

The Company is registered under, and is subject to, the Bank Holding Company Act of 1956, as amended. This Act limits the type of companies that Community Bank System, Inc. may acquire or organize and the activities in which it or they may engage. In general, the Company and the Bank are prohibited from engaging in or acquiring direct or indirect control of any corporation engaged in non-banking activities unless such activities are so closely related to banking as to be a proper incident thereto. In addition, the Company must obtain the prior approval of the Board of Governors of the Federal Reserve System (the “FRB”) to acquire control of any bank; to acquire, with certain exceptions, more than five percent of the outstanding voting stock of any other corporation; or to merge or consolidate with another bank holding company. As a result of such laws and regulation, the Company is restricted as to the types of business activities it may conduct and the Bank is subject to limitations on, among others, the types of loans and the amounts of loans it may make to any one borrower. The Financial Modernization Act of 1999 created, among other things, the "financial holding company", a new entity which may engage in a broader range of activities that are "financial in nature", including insurance underwriting, securities underwriting and merchant banking. Bank holding companies which are well capitalized and well managed under regulatory standards may convert to financial holding companies relatively easily through a notice filing with the FRB, which acts as the "umbrella regulator" for such entities. The Company may seek to become a financial holding company in the future.

Federal Reserve System

The Company is required by the Board of Governors of the Federal Reserve System to maintain cash reserves against its deposits. After exhausting other sources of funds, the Company may seek borrowings from the Federal Reserve for such purposes. Bank holding companies registered with the FRB are, among other things, restricted from making direct investments in real estate. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors' funds.

The Federal Reserve System also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the Federal Reserve System, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to model various interest rate changes and adjust their strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond their control.

The Company and the Bank are subject to minimum capital requirements established, respectively, by the FRB, the OCC (as defined below) and the Federal Deposit Insurance Corporation (“FDIC”). For information on these capital requirements and the Company’s and the Bank's capital ratios see "Management's Discussion and Analysis of Financial Condition and Results of Operations - Capital" and Note P to the Financial Statements.

Office of Comptroller of the Currency

The Bank is supervised and regularly examined by the Office of the Comptroller of the Currency (the “OCC”). The various laws and regulations administered by the OCC affect corporate practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and location of offices. There are no regulatory orders or outstanding issues resulting from regulatory examinations of the Bank.

Insurance of Deposit Accounts

The Bank is a member of the Deposit Insurance Fund (“DIF”), which is administered by the FDIC. Deposit accounts at the Bank are insured by the FDIC, generally up to a maximum of $100,000 for each separately insured depositor and up to a maximum of $250,000 for self-directed retirement accounts. However, the FDIC increased the deposit insurance available on all deposit accounts to $250,000, effective until December 31, 2013. In addition, certain noninterest-bearing transaction accounts maintained with financial institutions participating in the FDIC’s Transaction Account Guarantee Program are fully insured regardless of the dollar amount until June 30, 2010. The Bank has opted to participate in the FDIC’s Transaction Account Guarantee Program.

The FDIC imposes an assessment against all depository institutions for deposit insurance. This assessment is based on the risk category of the institution and, prior to 2009, ranged from five to 43 basis points of the institution’s deposits. On December 22, 2008, as a result of decreases in the reserve ratio of the DIF, the FDIC published a final rule raising the current deposit insurance assessment rates uniformly for all institutions by seven basis points for the first quarter of 2009. On May 22, 2009, the FDIC adopted a final rule imposing a five basis point special assessment on each insured depository institution’s assets minus Tier 1 capital as of June 30, 2009, payable on September 30, 2009. The Company’s special assessment amounted to $2.5 million.

In the fourth quarter of 2009, the FDIC adopted a rule that required insured depository institutions to prepay their quarterly risk-based assessments for the fourth quarter of 2009, and for all of 2010, 2011 and 2012, on December 30, 2009. For purposes of calculating the amount to prepay, the FDIC required that institutions use their total base assessment rate in effect on September 30, 2009 and increase that assessment base quarterly at a 5 percent annual growth rate through the end of 2012. The FDIC also increased annual assessment rates uniformly by three basis points beginning in 2011. The Company’s prepayment for 2010, 2011 and 2012 amounted to $21.4 million.

Consumer Protection Laws

In connection with its lending activities, the Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending to various sectors of the economy. These laws include the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Fair and Accurate Credit Transactions Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, and various state law counterparts.

In addition, federal law contains extensive customer privacy protection provisions. Under these provisions, a financial institution must provide to its customers, at the inception of the customer relationship and annually thereafter, the institution’s policies and procedures regarding the handling of customers’ nonpublic personal financial information. These provisions also provide that, except for certain limited exceptions, a financial institution may not provide such personal information to unaffiliated third parities unless the institution discloses to the customer that such information may be provided and the customer is given the opportunity to opt out of such disclosure.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institutions, including banks and broker dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provisions of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The Company has approved policies and procedures that are designed to be compliant with the USA Patriot Act.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (the “Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934 as amended. In particular, the Sarbanes-Oxley Act established, among other things: (i) new requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) additional responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) the creation of an independent accounting oversight board for the accounting industry; (iv) new standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on nonpreferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violation of the securities laws.

The Emergency Economic Stabilization Act of 2008

On October 3, 2008, The Emergency Economic Stabilization Act of 2008 (“EESA”) was enacted that provides the U.S. Secretary of the Treasury with broad authority to implement certain actions to help restore stability and liquidity to U.S. markets. The EESA authorizes the U.S. Treasury to, among other things, purchase up to $700 billion of mortgages, mortgage-backed securities and certain other financial instruments from financial institutions for the purpose of stabilizing and providing liquidity to the U.S. financial markets. The Company did not originate or invest in sub-prime assets and, therefore, does not expect to participate in the sale of any of our assets into these programs. One of the provisions resulting from the legislation is the Troubled Asset Relief Program Capital Purchase Program (“TARP Capital Purchase Program”), which provides direct equity investment in perpetual preferred stock by the U.S. Treasury Department in qualified financial institutions. The program is voluntary and requires an institution to comply with a number of restrictions and provisions, including limits on executive compensation, stock redemptions, and declaration of dividends. The Company chose not to participate in the TARP Capital Purchase Program.

Community Bank System, Inc. ("the Company") was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company is a single bank holding company which wholly-owns five subsidiaries: Community Bank, N.A. (“the Bank”), Benefit Plans Administrative Services, Inc. (“BPAS”), CFSI Closeout Corp. (“CFSICC”), First of Jermyn Realty Company, Inc. (“FJRC”) and Town & Country Agency LLC (“T&C”). BPAS owns three subsidiaries, Benefit Plans Administrative Services LLC (“BPA”), Harbridge Consulting Group LLC (“Harbridge”) and Hand Benefit & Trust Company (“HBT”). BPAS provides administration, consulting and actuarial services to sponsors of employee benefit plans. CFSICC, FJRC and T&C are inactive companies. The Company also wholly-owns two unconsolidated subsidiary business trusts formed for the purpose of issuing mandatorily redeemable preferred securities which are considered Tier I capital under regulatory capital adequacy guidelines.

The Company maintains a website at communitybankna.com and firstlibertybank.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q and current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information on the website is not part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at http://www.sec.gov.

The Bank’s business philosophy is to operate as a community bank with local decision-making, principally in non-metropolitan markets, providing a broad array of banking and financial services to retail, commercial, and municipal customers. The Bank operates 145 customer facilities throughout 28 counties of Upstate New York, where it operates as Community Bank, N.A. and five counties of Northeastern Pennsylvania, where it is known as First Liberty Bank & Trust, offering a range of commercial and retail banking services. The Bank owns the following subsidiaries: Community Investment Services, Inc. (“CISI”), CBNA Treasury Management Corporation (“TMC”), CBNA Preferred Funding Corporation (“PFC”), Nottingham Advisors, Inc. (“Nottingham”), First Liberty Service Corp. (“FLSC”), Brilie Corporation (“Brilie”) and CBNA Insurance Agency, Inc (“CBNA Insurance”). CISI provides broker-dealer and investment advisory services. TMC provides cash management, investment, and treasury services to the Bank. PFC primarily acts as an investor in residential real estate loans. Nottingham provides asset management services to individuals, corporate pension and profit sharing plans, and foundations. FLSC provides banking-related services to the Pennsylvania branches of the Bank. Brilie is an inactive company. CBNA Insurance is a full-service property and casualty insurance agency.

Acquisition History (2004-2008)

Citizens Branches Acquisition

On November 7, 2008, the Company acquired 18 branch-banking centers in northern New York from Citizens Financial Group, Inc. (“Citizens”) in an all cash transaction. The Company acquired approximately $109 million in loans and $565 million in deposits at a blended deposit premium of 12%. In support of the transaction, the Company issued approximately $50 million of equity capital in the form of common stock in October 2008.

Alliance Benefit Group MidAtlantic

On July 7, 2008, Benefit Plans Administrative Services, Inc. (“BPAS”), a wholly owned subsidiary of the Company, acquired the Philadelphia division of Alliance Benefit Group MidAtlantic (ABG) from BenefitStreet, Inc. in an all cash transaction. ABG provides retirement plan consulting, daily valuation administration, actuarial and ancillary support services.

Hand Benefits & Trust, Inc.

On May 18, 2007, BPAS, a wholly owned subsidiary of the Company, acquired Hand Benefits & Trust, Inc. (“HBT”) in an all cash transaction. HBT is a Houston, Texas based provider of employee benefit plan administration and trust services.

TLNB Financial Corporation

On June 1, 2007, the Company acquired TLNB Financial Corporation, parent company of Tupper Lake National Bank (“TLNB”), in an all-cash transaction valued at approximately $17.8 million. Based in Tupper Lake, NewYork, TLNB operated five branches in the northeastern New York State cities of Tupper Lake, Plattsburgh and Saranac Lake, as well as an insurance subsidiary, TLNB Insurance Agency, Inc.

ONB Corporation

On December 1, 2006, the Company acquired ONB Corporation (“ONB”), the parent company of Ontario National Bank, a federally-chartered national bank, in an all-cash transaction valued at approximately $16 million. ONB operated four branches in the villages of Clifton Springs, Phelps, and Palmyra, New York.

ES&L Bancorp, Inc.

On August 11, 2006, the Company acquired ES&L Bancorp, Inc. (“Elmira”), the parent company of Elmira Savings and Loan, F.A., a federally-chartered thrift, in an all-cash transaction valued at approximately $40 million. Elmira operated two branches in the cities of Elmira and Ithaca, New York.

Dansville Branch Acquisition

On December 3, 2004, the Company acquired a branch office in Dansville, NewYork (“Dansville”) from HSBC Bank USA, N.A. with deposits of $32.6 million and loans of $5.6 million.

First Heritage Bank

On May 14, 2004, the Company acquired First Heritage Bank (“First Heritage”), a closely held bank headquartered in Wilkes-Barre, PA with three branches in Luzerne County, Pennsylvania. First Heritage’s three branches operate as part of First Liberty Bank & Trust, a division of Community Bank, N.A. Consideration included 2,592,213 shares of common stock with a fair value of $52 million, employee stock options with a fair value of $3.0 million, and $7.0 million of cash (including capitalized acquisition costs of $1.0 million).

Services

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank's branches are generally located in smaller towns and cities within its geograph­ic market areas of Upstate New York and Northeastern Pennsylvania. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch and regional levels, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System and the Federal Home Loan Bank of New York ("FHLB"), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Competition

The banking and financial services industry is highly competitive in the New York and Pennsylvania markets. The Company competes actively for loans, deposits and customers with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, insurance companies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The table below summarizes the Bank’s deposits and market share by the thirty-three counties of New York and Pennsylvania in which it has customer facilities. Market share is based on deposits of all commercial banks, credit unions, savings and loan associations, and savings banks.

Number of Towns Where Deposits as of Company 6/30/2008 Market Towns/ Has 1st or 2nd County State (000's omitted) (1) Share Facilities ATM's Cities Market Position Allegany NY $193,007 48.2% 9 8 8 8 Hamilton* NY $27,712 47.2% 2 0 2 2 Franklin* NY $235,664 45.8% 11 7 7 6 Lewis* NY $109,825 44.3% 5 3 4 4 Seneca NY $154,307 39.1% 4 3 4 3 Cattaraugus NY $283,212 28.9% 10 8 7 7 Yates NY $69,225 27.5% 2 2 1 1 St. Lawrence NY $337,210 23.2% 12 7 11 10 Clinton* NY $275,417 21.5% 8 10 3 3 Wyoming PA $85,348 21.2% 4 3 4 3 Essex* NY $77,787 15.9% 4 4 4 3 Chautauqua NY $223,494 13.9% 12 11 10 7 Schuyler NY $18,392 12.1% 1 1 1 0 Livingston NY $81,625 11.9% 3 4 3 3 Steuben NY $176,768 10.7% 8 7 7 5 Ontario NY $152,849 9.9% 7 12 6 4 Lackawanna PA $448,417 9.5% 12 12 8 4 Jefferson NY $138,670 9.3% 5 5 4 2 Tioga NY $34,557 8.4% 2 2 2 1 Chemung NY $94,869 7.4% 2 2 1 0 Herkimer NY $35,082 5.9% 1 1 1 1 Wayne NY $55,679 5.7% 2 4 2 1 Susquehanna PA $24,060 4.1% 2 0 2 2 Oswego NY $43,952 4.1% 2 2 2 2 Luzerne PA $235,429 3.9% 6 7 6 2 Cayuga NY $34,969 3.9% 2 2 2 1 Washington* NY $20,888 3.4% 1 0 1 1 Warren* NY $38,297 2.9% 1 1 1 1 $3,706,711 11.5% 140 128 114 87 Bradford PA $22,450 2.5% 2 2 2 1 Oneida NY $53,988 1.3% 1 1 1 1 Tompkins NY $9,460 0.5% 1 0 1 0 Onondaga NY $12,603 0.1% 1 2 1 0 Erie NY $38,671 0.1% 2 2 2 1 $3,843,883 4.8% 147 135 121 90

(1) Deposit market share data as of June 30, 2008 the most recent information available. Source: SNL Financial LLC

* Includes balances of Citizens’ branches acquired in November 2008.

Employees

As of December 31, 2008, the Company employed 1,615 full-time equivalent employees. The Company offers a variety of employment benefits and considers its relationship with its employees to be good.

Supervision and Regulation

Bank holding companies and national banks are regulated by state and federal law. The following is a summary of certain laws and regulations that govern the Company and the Bank. To the extent that the following information describes statutory or regulatory provisions, it is qualified in its entirety by reference to the actual statutes and regulations thereunder.

Federal Bank Holding Company Regulation

The Company is registered under, and is subject to, the Bank Holding Company Act of 1956, as amended. This Act limits the type of companies that Community Bank System, Inc. may acquire or organize and the activities in which it or they may engage. In general, the Company and the Bank are prohibited from engaging in or acquiring direct or indirect control of any corporation engaged in non-banking activities unless such activities are so closely related to banking as to be a proper incident thereto. In addition, the Company must obtain the prior approval of the Board of Governors of the Federal Reserve System (the “FRB”) to acquire control of any bank; to acquire, with certain exceptions, more than five percent of the outstanding voting stock of any other corporation; or to merge or consolidate with another bank holding company. As a result of such laws and regulation, the Company is restricted as to the types of business activities it may conduct and the Bank is subject to limitations on, among others, the types of loans and the amounts of loans it may make to any one borrower. The Financial Modernization Act of 1999 created, among other things, the "financial holding company", a new entity which may engage in a broader range of activities that are "financial in nature", including insurance underwriting, securities underwriting and merchant banking. Bank holding companies which are well capitalized and well managed under regulatory standards may convert to financial holding companies relatively easily through a notice filing with the FRB, which acts as the "umbrella regulator" for such entities. The Company may seek to become a financial holding company in the future.

Federal Reserve System

The Company is required by the Board of Governors of the Federal Reserve System to maintain cash reserves against its deposits. After exhausting other sources of funds, the Company may seek borrowings from the Federal Reserve for such purposes. Bank holding companies registered with the FRB are, among other things, restricted from making direct investments in real estate. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors' funds.

The Federal Reserve System also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the Federal Reserve System, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to anticipate changes and adjust their strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond their control.

The Company and the Bank are subject to minimum capital requirements established, respectively, by the FRB, the OCC (as defined below) and the Federal Deposit Insurance Corporation (“FDIC”). For information on these capital requirements and the Company’s and the Bank's capital ratios see "Management's Discussion and Analysis of Financial Condition and Results of Operations - Capital" and Note P to the Financial Statements.

Office of Comptroller of the Currency

The Bank is supervised and regularly examined by the Office of the Comptroller of the Currency (the “OCC”). The various laws and regulations administered by the OCC affect corporate practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and location of offices. There are no regulatory orders or outstanding issues resulting from regulatory examinations of the Bank.

Insurance of Deposit Accounts

The Bank is a member of the Deposit Insurance Fund, which is administered by the FDIC. Deposit accounts at the Bank are insured by the FDIC, generally up to a maximum of $100,000 for each separately insured depositor and up to a maximum of $250,000 for self-directed retirement accounts. However, the FDIC increased the deposit insurance available on all deposit accounts to $250,000, effective until December 31, 2009. In addition, certain noninterest-bearing transaction accounts maintained with financial institutions participating in the FDIC’s Transaction Account Guarantee Program are fully insured regardless of the dollar amount until December 31, 2009. The Bank has opted to participate in the FDIC’s Transaction Account Guarantee Program.

The FDIC imposes an assessment against all depository institutions for deposit insurance. This assessment is based on the risk category of the institution and, prior to 2009, ranged from five to 43 basis points of the institution’s deposits. On October 7, 2008, as a result of decreases in the reserve ratio of the DIF, the FDIC issued a proposed rule establishing a Restoration Plan for the DIF. On December 22, 2008, the FDIC published a final rule raising the current deposit insurance assessment rates uniformly for all institutions by seven basis points for the first quarter of 2009. The FDIC expects to issue a second final rule in early 2009, to be effective April 1, 2009, to change the way that the FDIC’s assessment system differentiates for risk and to set new assessment rates beginning with the second quarter of 2009.

Consumer Protection Laws

In connection with its lending activities, the Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending to various sectors of the economy. These laws include the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Fair and Accurate Credit Transactions Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, and the Real Estate Settlement Procedures Act, and various state law counterparts.

In addition, federal law currently contains extensive customer privacy protection provision. Under these provisions, a financial institution must provide to its customers, at the inception of the customer relationship and annually thereafter, the institution’s policies and procedures regarding the handling of customers’ nonpublic personal financial information. These provisions also provide that, except for certain limited exceptions, a financial institution may not provide such personal information to unaffiliated third parities unless the institution discloses to the customer that such information may be provided and the customer is given the opportunity to opt out of such disclosure.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institution, including banks and broker dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provision of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The Company has approved policies and procedures that are believed to be compliant with the USA Patriot Act.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (the “Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934. In particular, the Sarbanes-Oxley Act established, among other things: (i) new requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) additional responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) the creation of an independent accounting oversight board for the accounting industry; (iv) new standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on nonpreferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violation of the securities laws.

The Emergency Economic Stabilization Act of 2008

On October 3, 2008, The Emergency Economic Stabilization Act of 2008 (“EESA”) was enacted that provides the U.S. Secretary of the Treasury with broad authority to implement certain actions to help restore stability and liquidity to U.S. markets. The EESA authorizes the U.S. Treasury to, among other things, purchase up to $700 billion of mortgages, mortgage-backed securities and certain other financial instruments from financial institutions for the purpose of stabilizing and providing liquidity to the U.S. financial markets. The Company did not originate or invest in sub-prime assets and, therefore, does not expect to participate in the sale of any of our assets into these programs. One of the provisions resulting from the legislation is the Troubled Asset Relief Program Capital Purchase Program (“TARP Capital Purchase Program”), which provides direct equity investment in perpetual preferred stock by the U.S. Treasury Department in qualified financial institutions. The program is voluntary and requires an institution to comply with a number of restrictions and provisions, including limits on executive compensation, stock redemptions, and declaration of dividends. The Company chose not to participate in the TARP Capital Purchase Program.

Community Bank System, Inc. ("the Company") was incorporated on April 15, 1983, under the Delaware General Corporation Law. Its principal office is located at 5790 Widewaters Parkway, DeWitt, New York 13214. The Company is a single bank holding company which wholly-owns five subsidiaries: Community Bank, N.A. (“the Bank”), Benefit Plans Administrative Services, Inc. (“BPAS”), CFSI Closeout Corp. (“CFSICC”), First of Jermyn Realty Company, Inc. (“FJRC”) and Town & Country Agency LLC (“T&C”). BPAS owns three subsidiaries, Benefit Plans Administrative Services LLC (“BPA”), Harbridge Consulting Group LLC (“Harbridge”) and Hand Benefit & Trust Company (“HBT”). BPAS provides administration, consulting and actuarial services to sponsors of employee benefit plans. CFSICC, FJRC and T&C are inactive companies. The Company also wholly-owns two unconsolidated subsidiary business trusts formed for the purpose of issuing mandatorily redeemable preferred securities which are considered Tier I capital under regulatory capital adequacy guidelines.

The Company maintains a website at communitybankna.com and firstlibertybank.com. Annual reports on Form 10-K, quarterly reports on Form 10-Q and current reports on Form 8-K, and amendments to those reports, are available on the Company’s website free of charge as soon as reasonably practicable after such reports or amendments are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). The information on the website is not part of this filing. Copies of all documents filed with the SEC can also be obtained by visiting the SEC’s Public Reference Room at 100 F Street, NE, Washington, DC 20549, by calling the SEC at 1-800-SEC-0330 or by accessing the SEC’s website at http://www.sec.gov.

The Bank’s business philosophy is to operate as a community bank with local decision-making, principally in non-metropolitan markets, providing a broad array of banking and financial services to retail, commercial, and municipal customers. The Bank operates 145 customer facilities throughout 28 counties of Upstate New York, where it operates as Community Bank, N.A. and five counties of Northeastern Pennsylvania, where it is known as First Liberty Bank & Trust, offering a range of commercial and retail banking services. The Bank owns the following subsidiaries: Community Investment Services, Inc. (“CISI”), CBNA Treasury Management Corporation (“TMC”), CBNA Preferred Funding Corporation (“PFC”), Nottingham Advisors, Inc. (“Nottingham”), First Liberty Service Corp. (“FLSC”), Brilie Corporation (“Brilie”) and CBNA Insurance Agency, Inc (“CBNA Insurance”). CISI provides broker-dealer and investment advisory services. TMC provides cash management, investment, and treasury services to the Bank. PFC primarily acts as an investor in residential real estate loans. Nottingham provides asset management services to individuals, corporate pension and profit sharing plans, and foundations. FLSC provides banking-related services to the Pennsylvania branches of the Bank. Brilie is an inactive company. CBNA Insurance is a full-service property and casualty insurance agency.

Acquisition History (2004-2008)

Citizens Branches Acquisition

On November 7, 2008, the Company acquired 18 branch-banking centers in northern New York from Citizens Financial Group, Inc. (“Citizens”) in an all cash transaction. The Company acquired approximately $109 million in loans and $565 million in deposits at a blended deposit premium of 12%. In support of the transaction, the Company issued approximately $50 million of equity capital in the form of common stock in October 2008.

Alliance Benefit Group MidAtlantic

On July 7, 2008, Benefit Plans Administrative Services, Inc. (“BPAS”), a wholly owned subsidiary of the Company, acquired the Philadelphia division of Alliance Benefit Group MidAtlantic (ABG) from BenefitStreet, Inc. in an all cash transaction. ABG provides retirement plan consulting, daily valuation administration, actuarial and ancillary support services.

Hand Benefits & Trust, Inc.

On May 18, 2007, BPAS, a wholly owned subsidiary of the Company, acquired Hand Benefits & Trust, Inc. (“HBT”) in an all cash transaction. HBT is a Houston, Texas based provider of employee benefit plan administration and trust services.

TLNB Financial Corporation

On June 1, 2007, the Company acquired TLNB Financial Corporation, parent company of Tupper Lake National Bank (“TLNB”), in an all-cash transaction valued at approximately $17.8 million. Based in Tupper Lake, NewYork, TLNB operated five branches in the northeastern New York State cities of Tupper Lake, Plattsburgh and Saranac Lake, as well as an insurance subsidiary, TLNB Insurance Agency, Inc.

ONB Corporation

On December 1, 2006, the Company acquired ONB Corporation (“ONB”), the parent company of Ontario National Bank, a federally-chartered national bank, in an all-cash transaction valued at approximately $16 million. ONB operated four branches in the villages of Clifton Springs, Phelps, and Palmyra, New York.

ES&L Bancorp, Inc.

On August 11, 2006, the Company acquired ES&L Bancorp, Inc. (“Elmira”), the parent company of Elmira Savings and Loan, F.A., a federally-chartered thrift, in an all-cash transaction valued at approximately $40 million. Elmira operated two branches in the cities of Elmira and Ithaca, New York.

Dansville Branch Acquisition

On December 3, 2004, the Company acquired a branch office in Dansville, NewYork (“Dansville”) from HSBC Bank USA, N.A. with deposits of $32.6 million and loans of $5.6 million.

First Heritage Bank

On May 14, 2004, the Company acquired First Heritage Bank (“First Heritage”), a closely held bank headquartered in Wilkes-Barre, PA with three branches in Luzerne County, Pennsylvania. First Heritage’s three branches operate as part of First Liberty Bank & Trust, a division of Community Bank, N.A. Consideration included 2,592,213 shares of common stock with a fair value of $52 million, employee stock options with a fair value of $3.0 million, and $7.0 million of cash (including capitalized acquisition costs of $1.0 million).

Services

The Bank is a community bank committed to the philosophy of serving the financial needs of customers in local communities. The Bank's branches are generally located in smaller towns and cities within its geograph­ic market areas of Upstate New York and Northeastern Pennsylvania. The Company believes that the local character of its business, knowledge of the customers and their needs, and its comprehensive retail and business products, together with responsive decision-making at the branch and regional levels, enable the Bank to compete effectively in its geographic market. The Bank is a member of the Federal Reserve System and the Federal Home Loan Bank of New York ("FHLB"), and its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

Competition

The banking and financial services industry is highly competitive in the New York and Pennsylvania markets. The Company competes actively for loans, deposits and customers with other national and state banks, thrift institutions, credit unions, retail brokerage firms, mortgage bankers, finance companies, insurance companies, and other regulated and unregulated providers of financial services. In order to compete with other financial service providers, the Company stresses the community nature of its operations and the development of profitable customer relationships across all lines of business.

The table below summarizes the Bank’s deposits and market share by the thirty-three counties of New York and Pennsylvania in which it has customer facilities. Market share is based on deposits of all commercial banks, credit unions, savings and loan associations, and savings banks.

Number of Towns Where Deposits as of Company 6/30/2008 Market Towns/ Has 1st or 2nd County State (000's omitted) (1) Share Facilities ATM's Cities Market Position Allegany NY $193,007 48.2% 9 8 8 8 Hamilton* NY $27,712 47.2% 2 0 2 2 Franklin* NY $235,664 45.8% 11 7 7 6 Lewis* NY $109,825 44.3% 5 3 4 4 Seneca NY $154,307 39.1% 4 3 4 3 Cattaraugus NY $283,212 28.9% 10 8 7 7 Yates NY $69,225 27.5% 2 2 1 1 St. Lawrence NY $337,210 23.2% 12 7 11 10 Clinton* NY $275,417 21.5% 8 10 3 3 Wyoming PA $85,348 21.2% 4 3 4 3 Essex* NY $77,787 15.9% 4 4 4 3 Chautauqua NY $223,494 13.9% 12 11 10 7 Schuyler NY $18,392 12.1% 1 1 1 0 Livingston NY $81,625 11.9% 3 4 3 3 Steuben NY $176,768 10.7% 8 7 7 5 Ontario NY $152,849 9.9% 7 12 6 4 Lackawanna PA $448,417 9.5% 12 12 8 4 Jefferson NY $138,670 9.3% 5 5 4 2 Tioga NY $34,557 8.4% 2 2 2 1 Chemung NY $94,869 7.4% 2 2 1 0 Herkimer NY $35,082 5.9% 1 1 1 1 Wayne NY $55,679 5.7% 2 4 2 1 Susquehanna PA $24,060 4.1% 2 0 2 2 Oswego NY $43,952 4.1% 2 2 2 2 Luzerne PA $235,429 3.9% 6 7 6 2 Cayuga NY $34,969 3.9% 2 2 2 1 Washington* NY $20,888 3.4% 1 0 1 1 Warren* NY $38,297 2.9% 1 1 1 1 $3,706,711 11.5% 140 128 114 87 Bradford PA $22,450 2.5% 2 2 2 1 Oneida NY $53,988 1.3% 1 1 1 1 Tompkins NY $9,460 0.5% 1 0 1 0 Onondaga NY $12,603 0.1% 1 2 1 0 Erie NY $38,671 0.1% 2 2 2 1 $3,843,883 4.8% 147 135 121 90

(1) Deposit market share data as of June 30, 2008 the most recent information available. Source: SNL Financial LLC

* Includes balances of Citizens’ branches acquired in November 2008.

Employees

As of December 31, 2008, the Company employed 1,615 full-time equivalent employees. The Company offers a variety of employment benefits and considers its relationship with its employees to be good.

Supervision and Regulation

Bank holding companies and national banks are regulated by state and federal law. The following is a summary of certain laws and regulations that govern the Company and the Bank. To the extent that the following information describes statutory or regulatory provisions, it is qualified in its entirety by reference to the actual statutes and regulations thereunder.

Federal Bank Holding Company Regulation

The Company is registered under, and is subject to, the Bank Holding Company Act of 1956, as amended. This Act limits the type of companies that Community Bank System, Inc. may acquire or organize and the activities in which it or they may engage. In general, the Company and the Bank are prohibited from engaging in or acquiring direct or indirect control of any corporation engaged in non-banking activities unless such activities are so closely related to banking as to be a proper incident thereto. In addition, the Company must obtain the prior approval of the Board of Governors of the Federal Reserve System (the “FRB”) to acquire control of any bank; to acquire, with certain exceptions, more than five percent of the outstanding voting stock of any other corporation; or to merge or consolidate with another bank holding company. As a result of such laws and regulation, the Company is restricted as to the types of business activities it may conduct and the Bank is subject to limitations on, among others, the types of loans and the amounts of loans it may make to any one borrower. The Financial Modernization Act of 1999 created, among other things, the "financial holding company", a new entity which may engage in a broader range of activities that are "financial in nature", including insurance underwriting, securities underwriting and merchant banking. Bank holding companies which are well capitalized and well managed under regulatory standards may convert to financial holding companies relatively easily through a notice filing with the FRB, which acts as the "umbrella regulator" for such entities. The Company may seek to become a financial holding company in the future.

Federal Reserve System

The Company is required by the Board of Governors of the Federal Reserve System to maintain cash reserves against its deposits. After exhausting other sources of funds, the Company may seek borrowings from the Federal Reserve for such purposes. Bank holding companies registered with the FRB are, among other things, restricted from making direct investments in real estate. Both the Company and the Bank are subject to extensive supervision and regulation, which focus on, among other things, the protection of depositors' funds.

The Federal Reserve System also regulates the national supply of bank credit in order to influence general economic conditions. These policies have a significant influence on overall growth and distribution of loans, investments and deposits, and affect the interest rates charged on loans or paid for deposits.

Fluctuations in interest rates, which may result from government fiscal policies and the monetary policies of the Federal Reserve System, have a strong impact on the income derived from loans and securities, and interest paid on deposits and borrowings. While the Company and the Bank strive to anticipate changes and adjust their strategies for such changes, the level of earnings can be materially affected by economic circumstances beyond their control.

The Company and the Bank are subject to minimum capital requirements established, respectively, by the FRB, the OCC (as defined below) and the Federal Deposit Insurance Corporation (“FDIC”). For information on these capital requirements and the Company’s and the Bank's capital ratios see "Management's Discussion and Analysis of Financial Condition and Results of Operations - Capital" and Note P to the Financial Statements.

Office of Comptroller of the Currency

The Bank is supervised and regularly examined by the Office of the Comptroller of the Currency (the “OCC”). The various laws and regulations administered by the OCC affect corporate practices such as payment of dividends, incurring debt, and acquisition of financial institutions and other companies. It also affects business practices, such as payment of interest on deposits, the charging of interest on loans, types of business conducted and location of offices. There are no regulatory orders or outstanding issues resulting from regulatory examinations of the Bank.

Insurance of Deposit Accounts

The Bank is a member of the Deposit Insurance Fund, which is administered by the FDIC. Deposit accounts at the Bank are insured by the FDIC, generally up to a maximum of $100,000 for each separately insured depositor and up to a maximum of $250,000 for self-directed retirement accounts. However, the FDIC increased the deposit insurance available on all deposit accounts to $250,000, effective until December 31, 2009. In addition, certain noninterest-bearing transaction accounts maintained with financial institutions participating in the FDIC’s Transaction Account Guarantee Program are fully insured regardless of the dollar amount until December 31, 2009. The Bank has opted to participate in the FDIC’s Transaction Account Guarantee Program.

The FDIC imposes an assessment against all depository institutions for deposit insurance. This assessment is based on the risk category of the institution and, prior to 2009, ranged from five to 43 basis points of the institution’s deposits. On October 7, 2008, as a result of decreases in the reserve ratio of the DIF, the FDIC issued a proposed rule establishing a Restoration Plan for the DIF. On December 22, 2008, the FDIC published a final rule raising the current deposit insurance assessment rates uniformly for all institutions by seven basis points for the first quarter of 2009. The FDIC expects to issue a second final rule in early 2009, to be effective April 1, 2009, to change the way that the FDIC’s assessment system differentiates for risk and to set new assessment rates beginning with the second quarter of 2009.

Consumer Protection Laws

In connection with its lending activities, the Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending to various sectors of the economy. These laws include the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Fair and Accurate Credit Transactions Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, and the Real Estate Settlement Procedures Act, and various state law counterparts.

In addition, federal law currently contains extensive customer privacy protection provision. Under these provisions, a financial institution must provide to its customers, at the inception of the customer relationship and annually thereafter, the institution’s policies and procedures regarding the handling of customers’ nonpublic personal financial information. These provisions also provide that, except for certain limited exceptions, a financial institution may not provide such personal information to unaffiliated third parities unless the institution discloses to the customer that such information may be provided and the customer is given the opportunity to opt out of such disclosure.

USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”) imposes obligations on U.S. financial institution, including banks and broker dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. In addition, provision of the USA Patriot Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions. The Company has approved policies and procedures that are believed to be compliant with the USA Patriot Act.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (the “Sarbanes-Oxley Act”) implemented a broad range of corporate governance, accounting and reporting reforms for companies that have securities registered under the Securities Exchange Act of 1934. In particular, the Sarbanes-Oxley Act established, among other things: (i) new requirements for audit and other key Board of Directors committees involving independence, expertise levels, and specified responsibilities; (ii) additional responsibilities regarding the oversight of financial statements by the Chief Executive Officer and Chief Financial Officer of the reporting company; (iii) the creation of an independent accounting oversight board for the accounting industry; (iv) new standards for auditors and the regulation of audits, including independence provisions which restrict non-audit services that accountants may provide to their audit clients; (v) increased disclosure and reporting obligations for the reporting company and its directors and executive officers including accelerated reporting of company stock transactions; (vi) a prohibition of personal loans to directors and officers, except certain loans made by insured financial institutions on nonpreferential terms and in compliance with other bank regulator requirements; and (vii) a range of new and increased civil and criminal penalties for fraud and other violation of the securities laws.

The Emergency Economic Stabilization Act of 2008

On October 3, 2008, The Emergency Economic Stabilization Act of 2008 (“EESA”) was enacted that provides the U.S. Secretary of the Treasury with broad authority to implement certain actions to help restore stability and liquidity to U.S. markets. The EESA authorizes the U.S. Treasury to, among other things, purchase up to $700 billion of mortgages, mortgage-backed securities and certain other financial instruments from financial institutions for the purpose of stabilizing and providing liquidity to the U.S. financial markets. The Company did not originate or invest in sub-prime assets and, therefore, does not expect to participate in the sale of any of our assets into these programs. One of the provisions resulting from the legislation is the Troubled Asset Relief Program Capital Purchase Program (“TARP Capital Purchase Program”), which provides direct equity investment in perpetual preferred stock by the U.S. Treasury Department in qualified financial institutions. The program is voluntary and requires an institution to comply with a number of restrictions and provisions, including limits on executive compensation, stock redemptions, and declaration of dividends. The Company chose not to participate in the TARP Capital Purchase Program.