ARROW FINANCIAL CORP

A. GENERAL

The holding company, Arrow Financial Corporation, a New York corporation, was incorporated on March 21, 1983 and is registered as a bank holding company within the meaning of the Bank Holding Company Act of 1956. Arrow owns two nationally-chartered banks in New York (Glens Falls National and Saratoga National), and through such banks indirectly owns various non-bank subsidiaries, including an insurance agency, a registered investment adviser and a REIT. See "The Company and Its Subsidiaries," above.

The holding company’s business consists primarily of the ownership, supervision and control of Arrow's two banks, including the banks' subsidiaries. The holding company provides various advisory and administrative services and coordinates the general policies and operation of the banks. There were 537 full-time equivalent employees, including 38 employees within Arrow's insurance agency subsidiary, at December 31, 2023. See the discussion of our human capital resources in Section G ("HUMAN CAPITAL") of this Item 1.

Arrow offers a broad range of commercial and consumer banking and financial products. The deposit base consists of deposits derived principally from the communities served. The Company targets lending activities to consumers and small- and mid-sized companies in Arrow's regional geographic area. In addition, through an indirect lending program Arrow sources consumer loans from an extensive network of automobile dealers that operate in upstate New York and Vermont. Through the banks' trust operations, the Company provides retirement planning, trust and estate administration services for individuals, and pension, profit-sharing and employee benefit plan administration for corporations.

B. LENDING ACTIVITIES

Arrow engages in a wide range of lending activities, including commercial and industrial lending primarily to small and mid-sized companies; mortgage lending for residential and commercial properties; and consumer installment and home equity financing. An active indirect lending program is maintained through Arrow's sponsorship of automobile dealer programs under which consumer auto loans, primarily from dealers that meet pre-established specifications are sourced. From time to time, a portion of Arrow's residential real estate loan originations are sold into the secondary market, primarily to the Federal Home Loan Mortgage Corporation ("Freddie Mac") and other governmental agencies. Normally, the Company retains the servicing rights on mortgage loans originated and sold into the secondary markets, subject to periodic determinations on the continuing profitability of such activity. Arrow does not engage in subprime mortgage lending as a business line and does not extend or purchase so-called "Alt A," "negative amortization," "option ARMs" or "negative equity" mortgage loans.

Arrow lends primarily to borrowers within the normal retail service area in upstate New York, with the exception of the indirect consumer lending line of business, where Arrow makes loans through an extensive network of automobile dealers that operate in a larger area of New York and Vermont. The loan portfolio does not include any foreign loans or any other significant risk concentrations. From time to time, Arrow buys and offers participations in individual commercial loans, primarily in upstate New York. In recent periods, the total dollar amount of such participations has fluctuated, but generally represents less than 20% of commercial loans outstanding. The majority of the portfolio is collateralized, and most commercial loans are further supported by personal guarantees.

Generally, Arrow continues to implement lending strategies and policies that are intended to protect the quality of the loan portfolio, including strong underwriting and collateral control procedures and credit review systems. Loans are placed on nonaccrual status either due to the delinquency status of principal and/or interest or a judgment by management that the full repayment of principal and interest is unlikely. Home equity lines of credit, secured by real property, are systematically placed on nonaccrual status when 120 days past due, and residential real estate loans are placed on nonaccrual status when 150 days past due. Commercial and commercial real estate loans are evaluated on a loan-by-loan basis and are placed on nonaccrual status when 90 days past due if the full collection of principal and interest is uncertain (See Part II, Item 7.C.II.c. "Risk Elements"). Subsequent cash payments on loans classified as nonaccrual may be applied entirely to principal, although income in some cases may be recognized on a cash basis.

C. SUPERVISION AND REGULATION

The following generally describes the laws and regulations to which Arrow is subject. Bank holding companies, banks and their affiliates are extensively regulated under both federal and state law. To the extent that the following information summarizes statutory or regulatory law, it is qualified in its entirety by reference to the particular provisions of the various statutes and regulations. Any change in applicable law may have a material effect on business operations, customers, prospects and investors.

Bank Regulatory Authorities with Jurisdiction over Arrow and its Subsidiary Banks

Arrow is a registered bank holding company within the meaning of the Bank Holding Company Act of 1956 ("BHC Act") and as such is subject to regulation by the Board of Governors of the Federal Reserve System ("FRB"). As a "bank holding company" under New York State law, Arrow is also subject to regulation by the New York State Department of Financial Services. Arrow's two subsidiary banks are both national banks and are subject to supervision and examination by the Office of the Comptroller of the Currency ("OCC"). The banks are members of the Federal Reserve System and the deposits of each bank are insured by the Deposit Insurance Fund of the Federal Deposit Insurance Corporation ("FDIC"). The BHC Act generally prohibits Arrow from engaging, directly or indirectly, in activities other than banking, activities closely related to banking, and certain other financial activities. Under the BHC Act, a bank holding company generally must obtain FRB approval before acquiring, directly or indirectly, voting shares of another bank or bank holding company, if after the acquisition the acquiror would own 5 percent or more of a class of the voting shares of that other bank or bank holding company. Bank holding companies are able to acquire banks or other bank holding companies located in all 50 states, subject to certain limitations. Bank holdings companies that meet certain qualifications may choose to apply to the FRB for designation as “financial holding companies.” Upon receipt of such designation, a financial holding company may engage in a broader array of activities, such as insurance underwriting, securities underwriting and merchant banking. Arrow has not attempted to become, and has not been designated as, a financial holding company.

The FRB and the OCC have broad regulatory, examination and enforcement authority. The FRB and the OCC conduct regular examinations of the entities they regulate. In addition, banking organizations are subject to requirements for periodic reporting to the regulatory authorities. The FRB and OCC have the authority to implement various remedies if they determine that the financial condition, capital, asset quality, management, earnings, liquidity or other aspects of a banking organization's operations are unsatisfactory or if they determine the banking organization is violating or has violated any law or regulation. The authority of the federal bank regulators over banking organizations includes, but is not limited to, prohibiting unsafe or unsound practices; requiring affirmative action to correct a violation or unsafe or unsound practice; issuing administrative orders; requiring the organization to increase capital; requiring the organization to sell subsidiaries or other assets; restricting dividends, distributions and repurchases of the organization's stock; restricting the growth of the organization; assessing civil money penalties; removing officers and directors; and terminating deposit insurance. The FDIC may terminate a depository institution's deposit insurance upon a finding that the institution's financial condition is unsafe or unsound or that the institution has engaged in unsafe or unsound practices for certain other reasons.

Regulatory Supervision of Other Arrow Subsidiaries

The insurance agency subsidiary of Glens Falls National is subject to the licensing and other provisions of New York State Insurance Law and is regulated by the New York State Department of Financial Services. Arrow's investment adviser subsidiary is subject to the licensing and other provisions of the federal Investment Advisers Act of 1940 and is regulated by the SEC.

Regulation of Transactions between Banks and their Affiliates

Transactions between banks and their "affiliates" are regulated by Sections 23A and 23B of the Federal Reserve Act (FRA). Each of Arrow's non-bank subsidiaries (other than the business trusts formed to issue the TRUPs) is a subsidiary of one of the subsidiary banks, and also is an "operating subsidiary" under Sections 23A and 23B. This means each non-bank subsidiary is considered to be part of the bank that owns it and thus is not an affiliate of that bank for purposes of Section 23A and 23B. However, each of the two banks is an affiliate of the other bank, under Section 23A, and Arrow, the holding company, is also an affiliate of each bank under both Sections 23A and 23B. Extensions of credit that a bank may make to affiliates, or to third parties secured by securities or obligations of the affiliates, are substantially limited by the FRA and the Federal Deposit Insurance Act (FDIA). Such acts further restrict the range of permissible transactions between a bank and any affiliate, including a bank affiliate. Furthermore, under the FRA, a bank may engage in certain transactions, including loans and purchases of assets, with a non-bank affiliate, only if certain special conditions, including collateral requirements for loans, are met and if the other terms and conditions of the transaction, including interest rates and credit standards, are substantially the same as, or at least as favorable to the bank as, those prevailing at the time for comparable transactions by the bank with non-affiliated companies or, in the absence of comparable transactions, on terms and conditions that would be offered by the bank to non-affiliated companies.

Regulatory Capital Standards

An important area of banking regulation is the federal banking system's promulgation and enforcement of minimum capitalization standards for banks and bank holding companies.

Bank Capital Rules. In July 2013, federal bank regulators, including the FRB and the OCC, approved revised bank capital rules aimed at implementing capital requirements pursuant to Dodd-Frank. These rules were also intended to coordinate U.S. bank capital standards with the then-current drafts of the Basel III proposed bank capital standards for all of the developed world's banking organizations. The federal regulators' revised capital rules (the "Capital Rules"), which impose significantly higher minimum capital ratios on U.S. financial institutions than the rules they replaced, became effective for Arrow and its subsidiary banks on January 1, 2015, and were fully phased in by the end of 2019.

In 2020, federal bank regulators introduced an optional simplified measure of capital adequacy for qualifying community banking organizations (CBLR). A qualifying community banking organization that opts into the CBLR framework and meets all the requirements under the CBLR framework will be considered to have met the well-capitalized ratio requirements under the “prompt corrective action” regulations and will not be required to report or calculate risk-based capital ratios.

The CBLR final rule became effective as of January 1, 2020, and Arrow and both subsidiary banks have opted out of utilizing the CBLR framework. Therefore, the Capital Rules promulgated under Dodd-Frank remain applicable to Arrow and both subsidiary banks.

The Capital Rules which remain applicable to Arrow consist of two basic types of capital measures, a leverage ratio and a set of risk-based capital measures. Within these two broad types of rules, however, significant changes were made in the revised Capital Rules, as discussed below.

Leverage Ratio. The Capital Rules increased the minimum required leverage ratio from 3.0% to 4.0%. The leverage ratio continues to be defined as the ratio of the institution's "Tier 1" capital (as defined under the new leverage rule) to total tangible assets (as defined under the revised leverage rule).

Risk-Based Capital Measures. Current risk-based capital measures assign various risk weightings to all of the institution's assets, by asset type, and to certain off balance sheet items, and then establish minimum levels of capital to the aggregate dollar amount of such risk-weighted assets. Under the risk-based Capital Rules, there are eight major risk-weighted categories of assets (although there are several additional super-weighted categories for high-risk assets that are generally not held by community banking organizations like Arrow). The Capital Rules include a measure called the "common equity tier 1 capital ratio" (CET1). For this ratio, only common equity (basically, common stock plus surplus plus retained earnings) qualifies as capital (i.e., CET1). Preferred stock and trust preferred securities, which qualified as Tier 1 capital under the old Tier 1 risk-based capital measure (and continue to qualify as capital under the revised Tier 1 risk-based capital measure), are not included in CET1 capital. Under these rules, CET1 capital also includes most elements of accumulated other comprehensive income (AOCI), including unrealized securities gains and losses, as part of both total regulatory capital (numerator) and total assets (denominator). However, smaller banking organizations like Arrow's were given the opportunity to make a one-time irrevocable election to include or not to include certain elements of AOCI, most notably unrealized securities gains or losses. Arrow made such an election, and therefore does not include unrealized securities gains and losses in calculating the CET1 ratio under the Capital Rules. The minimum CET1 ratio under these rules, effective January 1, 2015, is 4.50%, which remained constant throughout the phase-in period.

Consistent with the general theme of higher capital levels, the Capital Rules also increased the minimum ratio for Tier 1 risk-based capital from 4.0% to 6.0%, effective January 1, 2015. The minimum level for total risk-based capital under the Capital Rules remained at 8.0%.

The Capital Rules also incorporated a capital concept, the so-called "capital conservation buffer" (set at 2.5%, after full phase-in), which must be added to each of the minimum required risk-based capital ratios (i.e., the minimum CET1 ratio, the minimum Tier 1 risk-based capital ratio and the minimum total risk-based capital ratio). The capital conservation buffer was phased-in over four years beginning January 1, 2016 (see the table below). When, during economic downturns, an institution's capital begins to erode, the first deductions from a regulatory perspective would be taken against the capital conservation buffer. To the extent that such deductions should erode the buffer below the required level (2.5% of total risk-based assets after full phase-in), the institution will not necessarily be required to replace the buffer deficit immediately, but will face restrictions on paying dividends and other negative consequences until the buffer is fully replenished.

Also under the Capital Rules, and as required under Dodd-Frank, TRUPs issued by small- to medium-sized banking organizations (such as Arrow) that were outstanding on the Dodd-Frank grandfathering date for TRUPS (May 19, 2010) will continue to qualify as tier 1 capital, up to a limit of 25% of tier 1 capital, until the TRUPs mature or are redeemed, subject to certain limitations. See the discussion of grandfathered TRUPs in Section E ("CAPITAL RESOURCES AND DIVIDENDS") of Item 7.

The following is a summary of the definitions of capital under the various risk-based measures in the Capital Rules:

Common Equity Tier 1 Capital (CET1): Equals the sum of common stock instruments and related surplus (net of treasury stock), retained earnings, accumulated other comprehensive income (AOCI), and qualifying minority interests, minus applicable regulatory adjustments and deductions. Such deductions will include AOCI, if the organization has exercised its irrevocable option not to include AOCI in capital (Arrow made such an election). Mortgage-servicing assets, deferred tax assets, and investments in financial institutions are limited to 15% of CET1 in the aggregate and 10% of CET1 for each such item individually.

Additional Tier 1 Capital: Equals the sum of noncumulative perpetual preferred stock, tier 1 minority interests, grandfathered TRUPs, and Troubled Asset Relief Program instruments, minus applicable regulatory adjustments and deductions.

Tier 2 Capital: Equals the sum of subordinated debt and preferred stock, total capital minority interests not included in Tier 1, and allowance for loan and lease losses (not exceeding 1.25% of risk-weighted assets) minus applicable regulatory adjustments and deductions.

The following table presents the Capital Rules applicable to Arrow and its subsidiary banks:

At December 31, 2023, Arrow and its two subsidiary banks exceeded, by a substantial amount, each of the applicable minimum capital ratios established under the revised Capital Rules, including the minimum CET1 Ratio, the minimum Tier 1 Risk-Based Capital Ratio, the minimum Total Risk-Based Capital Ratio, and the minimum Leverage Ratio, and including in the case of each risk-based ratio, the phased-in portion of the capital buffer. See Note 20, Regulatory Matters, to the Consolidated Financial Statements for a presentation of Arrow's period-end ratios for 2023 and 2022.

Regulatory Capital Classifications. Under applicable banking law, federal banking regulators are required to take prompt corrective action with respect to depository institutions that do not meet minimum capital requirements. The regulators have established five capital classifications for banking institutions, ranging from the highest category of "well-capitalized" to the lowest category of "critically under-capitalized". Under the Capital Rules, a banking institution is considered "well-capitalized" if it meets the following capitalization standards on the date of measurement: a CET1 risk-based capital ratio of 6.50% or greater, a Tier 1 risk-based capital ratio of 8.00% or greater, and a total risk-based capital ratio of 10.00% or greater, provided the institution is not subject to any regulatory order or written directive regarding capital maintenance.

As of December 31, 2023, Arrow and its two subsidiary banks qualified as "well-capitalized" under the revised capital classification scheme.

Dividend Restrictions; Other Regulatory Sanctions

A holding company's ability to pay dividends or repurchase its outstanding stock, as well as its ability to expand its business, including for example, through acquisitions of additional banking organizations or permitted non-bank companies, may be restricted if its capital falls below minimum regulatory capital ratios or fails to meet other informal capital guidelines that the regulators may apply from time to time to specific banking organizations. In addition to these potential regulatory limitations on payment of dividends, the holding company's ability to pay dividends to shareholders, and the subsidiary banks' ability to pay dividends to the holding company are also subject to various restrictions under applicable corporate laws, including banking laws (which affect the subsidiary banks) and the New York Business Corporation Law (which affects the holding company). The ability of the holding company and banks to pay dividends or repurchase shares in the future is, and is expected to continue to be, influenced by regulatory policies, the Capital Rules and other applicable law.

In cases where banking regulators have significant concerns regarding the financial condition, assets or operations of a bank holding company and/or one of its banks, the regulators may take enforcement action or impose enforcement orders, formal or informal, against the holding company or the particular bank. If the ratio of tangible equity to total assets of a bank falls to 2% or below, the bank will likely be closed and placed in receivership, with the FDIC as receiver.

Cybersecurity

In addition to the provisions in the Gramm-Leach-Bliley Act relating to data security (discussed below), Arrow and its subsidiaries are subject to many federal and state laws, regulations and regulatory interpretations which impose standards and requirements related to cybersecurity.

In March 2015, federal regulators issued related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack. Financial institutions that fail to observe this regulatory guidance on cybersecurity may be subject to various regulatory sanctions, including financial penalties.

In February 2018, the SEC issued the “Commission Statement and Guidance on Public Company Cybersecurity Disclosures” to assist public companies in preparing disclosures about cybersecurity risks and incidents. With the increased frequency and magnitude of cybersecurity incidents, the SEC stated that it is critical that public companies take all required actions to inform investors about material cybersecurity risks and incidents in a timely fashion. Additionally, in October 2018 the SEC issued the “Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934 Regarding Certain Cyber-Related Frauds Perpetrated Against Public Companies and Related Internal Controls Requirements” which cited business email compromises that led to the incidents and that internal accounting controls may need to be reassessed in light of these emerging risks. Certain Arrow subsidiaries are also subject to certain New York State cybersecurity regulations.

In July 2023, the SEC adopted amendments intended to enhance and standardize disclosures related to cybersecurity. The amendments were effective December 18, 2023 and require timely disclosure of material cybersecurity incidents and annual disclosures related to cybersecurity risk management, strategy, and governance. Under the new rules, a material cybersecurity incident is required to be disclosed on a Form 8-K within four business days after the learning of a material incident. The SEC has defined a cybersecurity incident to mean “an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through a registrant’s information systems that jeopardizes the confidentiality, integrity, or availability of a registrant’s information systems or any information residing therein.” Arrow has undertaken and implemented a number of procedures and control steps to comply with these expanded cybersecurity reporting requirements as outlined below under Item 1C. Cybersecurity.

Privacy and Confidentiality Laws

Arrow and its subsidiaries are subject to a variety of laws that regulate customer privacy and confidentiality. The Gramm-Leach-Bliley Act requires financial institutions to adopt privacy policies, to restrict the sharing of nonpublic customer information with nonaffiliated parties upon the request of the customer, and to implement data security measures to protect customer information. Certain state laws may impose additional privacy and confidentiality restrictions. The Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactions Act of 2003, regulates use of credit reports, providing of information to credit reporting agencies and sharing of customer information with affiliates, and sets identity theft prevention standards.

Anti-Money Laundering, the U.S. Patriot Act and OFAC

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act of 2001 initially adopted in 2001 and re-adopted by the U.S. Congress in 2006 with certain changes (the “Patriot Act”), imposes substantial record-keeping and due diligence obligations on banks and other financial institutions, with a particular focus on detecting and reporting money-laundering transactions involving domestic or international customers. The U.S. Treasury Department has issued and will continue to issue regulations clarifying the Patriot Act's requirements.

Under the Patriot Act and other federal anti-money laundering laws and regulations, including, but not limited to, the Currency and Foreign Transactions Report Act (collectively, “Anti-Money Laundering Laws”), financial institutions, including banks, must maintain certain anti-money laundering compliance, customer identification and due diligence programs that include established internal policies, procedures, and controls. Financial institutions are also prohibited from entering into specified financial transactions and account relationships and must meet enhanced standards for due diligence and customer identification. Financial institutions must take reasonable steps to conduct enhanced scrutiny of account relationships to guard against money laundering and to report suspicious transactions. Law enforcement authorities have been granted increased access to financial information maintained by financial institutions. Bank regulators routinely examine institutions for compliance with these obligations and they must consider an institution's compliance in connection with the regulatory review of applications, including applications for banking mergers and acquisitions. The U.S. Treasury Department's Financial Crises Enforcement Network (“FinCEN”) issued a final rule in 2016 increasing customer due diligence requirements for banks, including adding a requirement to identify and verify the identity of beneficial owners of customers that are legal entities, subject to certain exclusions and exemptions. The Company has established procedures for compliance with these requirements. Compliance with the provisions of the Patriot Act and other Anti-Money Laundering Laws results in substantial costs on all financial institutions.

The U.S. Department of the Treasury's Office of Foreign Assets Control (“OFAC”) is responsible for helping to insure that United States persons, including banks, do not engage in transactions with certain prohibited parties, as defined by various Executive Orders and Acts of Congress. OFAC publishes lists of persons, organizations, and countries suspected of aiding, harboring or engaging in terrorist acts, including, but not limited to, Specially Designated Nationals and Blocked Persons. If Arrow finds a name on any transaction, account or wire transfer that is on an OFAC list, Arrow must freeze or block such account or transaction, file a suspicious activity report, if required, notify the appropriate authorities and maintain appropriate records.

Community Reinvestment Act

Arrow's subsidiary banks are subject to the Community Reinvestment Act ("CRA") and implementing regulations. CRA regulations establish the framework and criteria by which the bank regulatory agencies assess an institution's record of helping to meet the credit needs of its community, including low and moderate-income individuals. CRA ratings are taken into account by regulators in reviewing certain applications made by Arrow and its bank subsidiaries.

The Dodd-Frank Act

Dodd-Frank significantly changed the regulatory structure for financial institutions and their holding companies, for example, through provisions requiring the Capital Rules. Among other provisions, Dodd-Frank implemented corporate governance revisions that apply to all public companies, not just financial institutions, permanently increased the FDIC’s standard maximum deposit insurance amount to $250,000, changed the FDIC insurance assessment base to assets rather than deposits and increased the reserve ratio for the deposit insurance fund to ensure the future strength of the fund. The federal prohibition on the payment of interest on certain demand deposits was repealed, thereby permitting depository institutions to pay interest on business transaction accounts. Dodd-Frank established a new federal agency, the Consumer Financial Protection Bureau (the “CFPB”), centralizing significant aspects of consumer financial protection under this agency. Limits were imposed for debit card interchange fees for issuers that have assets greater than $10 billion, which also could affect the amount of interchange fees collected by financial institutions with less than $10 billion in assets. Dodd-Frank also imposed new requirements related to mortgage lending, including prohibitions against payment of steering incentives and provisions relating to underwriting standards, disclosures, appraisals and escrows. The Volcker Rule prohibited banks and their affiliates from engaging in proprietary trading and investing in certain unregistered investment companies.

Federal banking regulators and other agencies including, among others, the FRB, the OCC and the CFPB, have been engaged in extensive rule-making efforts under Dodd-Frank, and the Community Bank Leverage Ratio has impacted certain Dodd-Frank requirements, as explained above.

Incentive Compensation

Dodd-Frank required the federal bank regulatory agencies and the SEC to establish joint regulations or guidelines prohibiting incentive-based payment arrangements at specified regulated entities, such as the Company, having at least $1 billion in total assets that encourage inappropriate risks by providing an executive officer, employee, director or principal shareholder with excessive compensation, fees, or benefits or that could lead to material financial loss to the entity. In addition, these regulators must establish regulations or guidelines requiring enhanced disclosure to regulators of incentive-based compensation arrangements.

The federal bank regulators issued proposed rules to address incentive-based compensation arrangements in June 2016. Final rules have not yet been issued by the federal bank regulatory agencies under this Dodd-Frank provision.

In 2010, the FRB, OCC and FDIC issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors. Management believes the current and past compensation practices of the Company do not encourage excessive risk taking or undermine the safety and soundness of the organization.

The FRB will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Company, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

Deposit Insurance Laws and Regulations

In February 2011, the FDIC finalized a new assessment system that took effect in the second quarter of 2011. The final rule changed the assessment base from domestic deposits to average assets minus average tangible equity, adopted a new large-bank pricing assessment scheme, and set a target size for the Deposit Insurance Fund. The rule (as mandated by Dodd-Frank) finalized a target size for the Deposit Insurance Fund Reserve Ratio at 2.0% of insured deposits.

Due to increased growth in insured deposits during the first half of 2020, on September 15, 2020, the FDIC established a plan to restore the Deposit Insurance Fund Reserve Ratio to at least 1.35% by September 30, 2028, as required by the FDIA, utilizing the rate schedule in effect at that time. In response to updated analysis and projections for the fund balance and the Deposit Insurance Fund Reserve Ratio, the FDIC adopted a final rule in October 2022 increasing the initial base deposit insurance assessment rate schedules by two percent effective January 1, 2023 and beginning on the first quarterly assessment period of 2023. The increase is intended to ensure that the reserve ratio meets the minimum ratio of 1.35% by the September 30, 2028 statutory deadline. Arrow is unable to predict whether or to what extent the FDIC may elect to impose additional special assessments on insured institutions in upcoming years, especially in light of recent high-profile large bank failures.

Reserve Requirements

Pursuant to regulations of the FRB, all banking organizations are required to maintain average daily reserves at mandated ratios against their transaction accounts and certain other types of deposit accounts. These reserves must be maintained in the form of vault cash or in an account at a Federal Reserve Bank. In March 2020, the Federal Reserve Board reduced reserve requirement ratios to zero percent to free up liquidity in the banking industry to support lending to households and businesses.

D. RECENT LEGISLATIVE DEVELOPMENTS

The American Rescue Plan Act of 2021

On March 11, 2021, the American Rescue Plan Act of 2021 ("American Rescue Plan") was signed into law to speed up the recovery from the economic and health effects of the COVID-19 pandemic and the ongoing recession. The American Rescue Plan is a $1.9 trillion economic stimulus bill that builds upon both the CARES Act and the CAA.

Several provisions within the American Rescue Plan impact financial institutions. Key provisions include direct stimulus payments for the majority of Americans, extending unemployment benefits and continuing eviction and foreclosure moratoriums. In addition, over $350 billion has been allocated to state, local and tribal governments to bridge budget shortfalls.

Other Legislative Initiatives

From time to time, various legislative and regulatory initiatives are introduced in Congress and state legislatures, as well as by regulatory authorities. These initiatives may include proposals to expand or contract the powers of bank holding companies and depository institutions or proposals to change the financial institution regulatory environment. Such legislation could change banking laws and the operating environment of our Company in substantial, but unpredictable ways. Arrow cannot predict whether any such legislation will be enacted, and, if enacted, the effect that it, or any implementing regulations would have on the Company's financial condition or results of operations.

E. STATISTICAL DISCLOSURE – (Regulation S-K, Subpart 1400)

Set forth below is an index identifying the location in this Report of various items of statistical information required to be included in this Report by the SEC’s industry guide for Bank Holding Companies.

F. COMPETITION

Arrow faces intense competition in all markets served. Competitors include traditional local commercial banks, savings banks and credit unions, non-traditional internet-based lending alternatives, as well as local offices of major regional and money center banks. Like all banks, the Company encounters strong competition in the mortgage lending space from a wide variety of other mortgage originators, all of whom are principally affected in this business by the rate and terms set, and the lending practices established from time-to-time by the very large government sponsored enterprises ("GSEs") engaged in residential mortgage lending, most importantly, “Fannie Mae” and “Freddie Mac.” For many years, these GSEs have purchased and/or guaranteed a very substantial percentage of all newly-originated mortgage loans in the U.S. Additionally, non-banking financial organizations, such as consumer finance companies, insurance companies, securities firms, money market funds, mutual funds, credit card companies and wealth management enterprises offer substantive equivalents of the various other types of loan and financial products and services and transactional accounts that are offered, even though these non-banking organizations are not subject to the same regulatory restrictions and capital requirements that apply to Arrow. Under federal banking laws, such non-banking financial organizations not only may offer products and services comparable to those offered by commercial banks, but also may establish or acquire their own commercial banks.

G. HUMAN CAPITAL

Arrow believes that its employees are among its most important assets. Accordingly, Arrow has prioritized investment in the well-being, performance, engagement and development of its employees. This includes, but is not limited to, providing access to well-being resources and assistance, offering competitive compensation and benefits to attract and retain top-level talent, empowering team members to take an active role in the formation and execution of the business strategy, and fostering a diverse and inclusive work environment that reflects the many values of the communities that Arrow serves. One example is through the creation of Arrow University, we are investing in our people by bringing employee learning and development to the forefront. We offer opportunities to employees at all levels for personal and professional growth, technical training, and career exploration and enhancement. At December 31, 2023, Arrow had 537 full-time equivalent employees.

H. ENVIRONMENTAL, SOCIAL AND GOVERNANCE (ESG)

We believe that meeting the evolving needs of our customers and being good stewards of our communities is critical. We are committed to operating in a manner that provides and maintains safe and healthy working conditions. We operate in compliance with applicable laws and regulations and are firmly committed to responsibly conducting business.

Arrow remains committed to strengthening financial lives within our communities through the power of care, capability, commitment and collaboration. Through our partnership, we aim to deliver meaningful engagement that translates into long‐term value for our team, our customers and our investors. We are dedicated to providing professional development and holistic support to our team and are working on many ways to demonstrate the value of differences, particularly around diversity, equity, inclusion and belonging (“DEIB”).

Employees

•Annual engagement with a diversity and inclusion consultant to assess diversity within our employee base and support for setting and tracking goals to encourage the advancement of minorities, women, veterans and persons with disabilities

•Learning and professional development through the Employee Experience Department

•Wellness and mental health services to our employees through outside Employee Assistance Program (EAP) contracted services

•Ongoing outreach to measure employee engagement

•Incorporated inclusion and belonging into our human resources policies, practices and learning and development programs

•Encouraged and facilitated employee giving including through payroll deduction, dress-down days, and a fundraising campaign that totaled more than $103,000 out of their own pockets, a true reflection of our culture of giving.

Arrow is proud of our many contributions to our customers and communities, including our commitment to complying with environmental regulations, meeting the financial needs of the low- to moderate-income population and giving back in dollars and volunteer hours.

Customers

•Included energy-saving features into the renovation of our branches, such as interior and exterior LED lighting and energy-efficient plumbing in 60 percent of our branch network

•Incorporated the above environmentally friendly attributes into our Glens Falls, New York, headquarters renovation, which includes approximately 76,000 square feet of office space; motion-activated lighting; significant improvements to exterior wall and roof insulation; new HVAC systems with higher efficiency, which meet modern fresh-air and ventilation requirements; energy-efficient windows and entry doors; low-VOC materials; a separate tie-in to the city stormwater and sewer system to bypass the municipal treatment of rainwater collected off the building; and green plantings on a portion of the roof

•Installed solar panels at 20 South Street, part of our corporate headquarters, to support the main campus with approximately 3,000 square feet of green energy

•Reduced emissions via remote work and video conferencing for large segments of employees

•Provided and encouraged digital banking options and paperless statements

•Installed electric vehicle charging stations at our SNB Main Office

•Lending program to facilitate first-time home ownership

•Bank On-certified checking product for the unbanked or underbanked population with no overdraft fees

•Partnership with numerous organizations to meet the financial needs of the low- to moderate-income population

•Educated and empowered our customers to prevent, detect and report fraud on their accounts with us

•Introduced easy-to-use fraud prevention digital services for businesses to monitor and approve activity on their accounts

Communities

•Maintained our philanthropic support of environmental sustainability in our community, including organizations that impact soil and water conservation, land conservation, sustainable farming, mountain and lake protection and stewardship, and parks and recreation

•Donated nearly $3 million in giving in the last five years and more than 31,000 hours served in the last four years

•More than $781,000, including more than $103,000 from employee donations directly and nearly 11,200 hours donated to our communities in 2023, a 19 percent increase over 2022, in support of arts and culture, child care, economic and workforce development, emergency assistance, food security, financial literacy, mental and physical health, safe and affordable housing, transportation and more

•Prioritization of donations to organizations that make it their mission to provide affordable homeownership, environmental or sustainable activities and programming, economic empowerment, health and human services and social progress

•CRA rating of “Satisfactory” for meeting the credit needs of our communities and a CRA rating of “Outstanding” for community development

Arrow believes that strong corporate governance is the foundation to delivering on our commitments to stakeholders. Arrow adheres to a comprehensive governance program, including:

Shareholders and Corporate Governance

•Longstanding dedication to diversity on Arrow’s Board of Directors, exceeding NASDAQ requirements

•Both Glens Falls National Bank and Saratoga National Bank have maintained their Bauer Financial 5-Star "Exceptional Performance" ratings for the 16th and 14th consecutive years, respectively

•Developed ESG Investment Models for our socially conscious clients

•Strong cybersecurity protections and training

•Strong dedication to information security and data privacy

I. EXECUTIVE OFFICERS OF THE REGISTRANT

The names and ages of the executive officers of Arrow and positions held by each are presented in the following table:

J. AVAILABLE INFORMATION

Arrow's Internet address iswww.arrowfinancial.com. The Company makes available, free of charge on or through Arrow's website, the annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports as soon as practicable after they are filed or furnished with the SEC pursuant to the Exchange Act. We intend to use our website to disclose material non-public information and various other documents related to corporate operations, including Corporate Governance Guidelines, the charters of principal board committees, and codes of ethics and to comply with our disclosure obligations under Regulation FD. Accordingly, investors should monitor our website, in addition to following and reviewing our news releases, filings with the SEC and public conference calls and other presentations. The Company has adopted a financial code of ethics that applies to Arrow’s chief executive officer, chief financial officer and principal accounting officer and a business code of ethics that applies to all directors, officers and employees of the holding company and its subsidiaries. Both of these can be found at: https://www.arrowfinancial.com/Corporate/Governance.