S&T BANCORP INC

We are subject to a variety of regulatory expectations and requirements regarding cybersecurity and data privacy. Federal regulators have issued statements regarding cybersecurity addressing the controls that financial institutions should design and business continuity planning and recovery processes that should be in place. Additionally, the FDIC, OCC and FRB issued a final rule that became effective in May 2022, requiring banking organizations that experience a computer-security incident to notify certain entities and its federal regulator of the computer-security incident as soon as possible and no later than 36 hours after the bank determines a computer-security incident has occurred. This rule also requires banking organizations to notify their customers of a computer-security incident that has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours. Moreover, in March 2022, the Cyber Incident Reporting for Critical Infrastructure Act, or CIRCIA, was enacted and once final rules are adopted, will require certain covered entities to report a covered cyber incident to the U.S. Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency, or CISA, within 72 hours after a covered entity reasonably believes an incident has occurred. Separate reporting to CISA will also be required within 24 hours if a ransom payment is made as a result of a ransomware attack. In April 2024, the CISA issued proposed rules under the CIRCIA that would clarify the scope of cyber incidents to be reported and would further define covered entities subject to the CIRCIA. Public comments were due in July 2024 and the final rules are expected to be adopted later in 2025. Furthermore, in September 2023, the SEC’s Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure rules went into effect requiring, among other disclosure obligations, companies to publicly disclose the occurrence of a material cybersecurity incident, including the material aspects of the nature, scope and timing of the incident and the material impact on the company including financial condition and results of operation beginning with any material cybersecurity incidents occurring on or after December 18, 2023.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations, including data breach notification requirements. We actively monitor developments regarding regulatory expectations and federal and state requirements with respect to cybersecurity and data breach notifications.

Competition

S&T Bank competes with other local, regional and national financial services providers, such as other financial holding companies, commercial banks, credit unions, finance companies, brokerage and insurance firms and financial technology companies, including competitors that provide their products and services online and through mobile devices. Some of our competitors are not subject to the same level of regulation and oversight that is required of banks and bank holding companies and are thus able to operate under lower cost structures. Our wealth management business competes with trust companies, mutual fund companies, investment advisory firms, law firms, brokerage firms and other financial services companies.

Changes in bank regulation, such as changes in the products and services banks can offer and permitted involvement in non-banking activities by bank holding companies, as well as bank mergers and acquisitions, can affect our ability to compete with other financial services providers. Our ability to do so will depend upon how successfully we can respond to the evolving competitive, regulatory, technological and demographic developments affecting our operations.

Our customers are primarily in Pennsylvania and the contiguous states of Ohio, New York, West Virginia, New Jersey, Delaware and Maryland. The majority of our commercial and consumer loans are made to businesses and individuals in these states resulting in a geographic concentration. Our market area has a high density of financial institutions, some of which are significantly larger institutions with greater financial resources than us, and many of which are our competitors to varying degrees. Our competition for loans comes principally from commercial banks, mortgage banking companies, credit unions, online lenders and other financial service companies. Our most direct competition for deposits has historically come from commercial banks and credit unions. We face additional competition for deposits from non-depository competitors such as the mutual fund industry, securities and brokerage firms, insurance companies and financial technology companies. Since larger competitors have advantages in attracting business from larger corporations, we do not generally attempt to compete for that business. Instead, we concentrate our efforts on attracting the business of individuals, and small and medium-size businesses. We consider our competitive advantages to be customer service and responsiveness to customer needs, the convenience of banking offices and hours, access to electronic banking services and the availability and pricing of our customized banking solutions. We emphasize personalized banking and the advantage of local decision-making in our banking business.

The financial services industry is likely to become more competitive as further technological advances enable more companies to provide financial services on a more efficient and convenient basis. Technological innovations have lowered traditional barriers to entry and enabled many companies to compete in financial services markets. Many customers now expect a choice of banking options for the delivery of services, including traditional banking offices, telephone, internet, mobile, ATMs, self-service branches, in-store branches and/or digital and technology based solutions. These delivery channels are offered by traditional banks and savings associations, credit unions, brokerage firms, asset management groups, financial technology companies, finance and insurance companies, internet-based companies and mortgage banking firms.