FINANCIAL INSTITUTIONS INC

Effectiveness of Controls and Procedures

As of the end of the period covered by this report, the Company carried out an evaluation, under the supervision and with the participation of the Company’s management, including the Company’s Chief Executive Officer (Principal Executive Officer) and Chief Financial Officer (Principal Financial Officer), of the effectiveness of the design and operation of the Company’s disclosure controls and procedures pursuant to Rule 13a-15(b), as adopted by the Securities and Exchange Commission (“SEC”) under the Securities Exchange Act of 1934 (“Exchange Act”). Based upon that evaluation, the Chief Executive Officer and Chief Financial Officer concluded that the Company’s disclosure controls and procedures were effective as of the end of the period covered by this Annual Report on Form 10-K.

Disclosure controls and procedures are the controls and other procedures that are designed to ensure that information required to be disclosed in the reports that the Company files or submits under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed in the reports that the Company files or submits under the Exchange Act is accumulated and communicated to management, including the Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosure.

Management Report on Internal Control over Financial Reporting and Attestation Report of Independent Registered Public Accounting Firm

Management of the Company is responsible for establishing and maintaining adequate internal control over financial reporting. Management assessed the Company’s internal control over financial reporting based on criteria established in the Internal Control—Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Based on this assessment, management has concluded that, as of December 31, 2023, the Company maintained effective internal control over financial reporting. Management’s Report on Internal Control over Financial Reporting is included under Item 8 “Financial Statements and Supplementary Data” in Part II of this Form 10-K.

RSM US LLP, an independent registered public accounting firm, has audited the consolidated financial statements as of and for the year ended December 31, 2023 which are included in this Annual Report on Form 10-K, and has issued a report on the effectiveness of the Company’s internal control over financial reporting as of December 31, 2023. The Report of the Independent Registered Public Accounting Firm that attests the effectiveness of internal control over financial reporting is included under Item 8 “Financial Statements and Supplementary Data” in Part II of this Form 10-K.

Changes in Internal Control over Financial Reporting

There were no changes in the Company’s internal control over financial reporting that occurred during the quarter ended December 31, 2023 that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.