FINANCIAL INSTITUTIONS INC
For the period ended Dec 31, 2024. Filed Mar 12, 2025.
View on SEC.govAbout this filing
A company's yearly report to the SEC, with audited financial statements. It is the fullest account a company gives of its business, its finances and the risks it sees.
FY2024 · Filed Mar 12, 2025
What changed in Risk Factors?
Read the current filingPrevious report: 10-K
Period ended 2023-12-31; filed 2024-03-13.
0000950170-24-030754
Item 1A. Risk FactorsCurrent report: 10-K
Period ended 2024-12-31; filed 2025-03-12.
0000950170-25-037918
Item 1A. Risk FactorsThe baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.
Compared 149 previous paragraphs and 161 current paragraphs.
115 unchanged; 23 reworded; 23 added; 10 removed; 1 previous and 0 current paragraphs rearranged.
Tables are not compared: 0 previous and 0 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.
A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.
Added paragraphs (23)
Current report
During the first quarter of 2024, the Bank experienced charge offs associated with fraudulent activity pertaining to deposit transactions conducted over the course of several business days ending in early March 2024 by an in-market business customer of the Bank. The deposit-related fraud event resulted in an $18.2 million pre-tax loss. The Bank is pursuing all available sources of recovery, including legal recourse, to minimize the loss. On December 2, 2024, the primary perpetrator of the fraud pled guilty in the United States District Court of the Western District of New York to two felonies – financial institutions fraud and money laundering. Among other things, the plea agreement requires the perpetrator to pay full restitution to the Bank. There can be no assurance that the Bank will be able to effect any further recovery or that the Bank will receive restitution from the perpetrator of the fraud, in whole or in part.
Current report
If our non-performing assets increase, our earnings will be adversely affected.
Current report
At December 31, 2024, our non-performing assets, which consist of non-performing loans and other real estate owned, were $41.5 million, or 0.68% of total assets. Our non-performing assets adversely affect our net income in various ways:
Current report
we record interest income only on the cash basis or cost-recovery method for non-accrual loans and we do not record interest income for other real estate owned;
Current report
we must provide for loan losses through a current period charge to the provision for credit losses;
Current report
non-interest expense increases when we write down the value of properties in our other real estate owned portfolio to reflect changing market values;
Current report
there are legal fees associated with the resolution of problem assets, as well as carrying costs, such as taxes, insurance, and maintenance fees; and
Current report
the resolution of non-performing assets requires the active involvement of management, which can distract them from more profitable activity.
Current report
If additional borrowers become delinquent and do not pay their loans and we are unable to successfully manage our non-performing assets, our losses and troubled assets could increase significantly, which could have a material adverse effect on our financial condition and results of operations.
Current report
Municipal deposits are price sensitive and could result in an increase in interest expense or funding fluctuations.
Current report
Municipal deposits are a significant source of funds for our lending and investment activities. At December 31, 2024, $1.07 billion, or 21% of our total deposits, consisted of municipal deposits from local government entities such as towns, cities, school districts and other municipalities, which are collateralized by letters of credit from the FHLB of New York (“FHLBNY”) and investment securities. These deposits may be more volatile than other deposits. If a significant amount of these deposits were withdrawn in a short period of time, it could have a negative impact on our short-term liquidity and have an adverse impact on our liquidity, business, financial condition and results of operations.
Current report
Given our dependence on high-average balance municipal deposits as a source of funds, our inability to retain such funds could significantly and adversely affect our liquidity. Further, our municipal deposits are primarily demand deposit accounts and are therefore more sensitive to interest rate risk. If we are forced to pay higher rates on our municipal accounts to retain those funds, or if we are unable to retain such funds and we are forced to resort to other sources of funds for our lending and investment activities, such as borrowings from the FHLBNY, the interest expense associated with these other funding sources may be higher than the rates we are currently paying on our municipal deposits, which would adversely affect our net income.
Current report
For more information with respect to our legal proceedings, please refer to Note 12, Commitments and Contingencies, of the notes to the consolidated financial statements included in Part II, Item 8, of this Annual Report on Form 10-K.
Current report
Non-compliance with the USA PATRIOT Act and the Bank Secrecy Act could subject us to fines, sanctions or other negative actions.
Current report
The USA PATRIOT and Bank Secrecy Acts require financial institutions to develop programs to prevent financial institutions from being used for money laundering and terrorist activities. Once such activities are detected, financial institutions are obligated to file suspicious activity reports with the U.S. Treasury’s Office of Financial Crimes Enforcement Network. These rules require financial institutions to establish procedures for identifying and verifying the identity of customers that open new financial accounts. Failure to comply with these regulations could result in fines or sanctions. Failure to adequately develop, design and maintain our Bank Secrecy Act programs could lead to sanctions and other negative actions, restrictions on conducting acquisitions or establishing new branches and other regulatory actions which would have serious reputational consequences for us, and which would have a material adverse effect on our business, financial condition or results of operations.
Current report
We must maintain sufficient cash flow and liquid assets to satisfy current and future financial obligations, including demand for loans and deposit withdrawals, funding operating costs, and for other corporate purposes, as well as meet regulatory requirements and supervisory expectations. We rely on customer deposits to be a reasonable cost and stable source of funding for the loans we make and the operations of our business. Customer deposits, which include noninterest-bearing deposits, interest-bearing transaction accounts, savings deposits and time deposits of $250,000 or less, have historically provided us with a sizeable source of stable and low-cost funds. In addition to customer deposits, sources of liquidity include brokered deposits and borrowings from securities dealers, the FHLBNY and the FRB of New York, as well as the debt and equity capital markets.
Current report
During 2022 and 2023, in response to accelerated inflation, the Federal Reserve implemented monetary tightening policies, resulting in significantly increased interest rates. In the fourth quarter of 2024, the Federal Reserve started to implement a monetary loosening policy, reducing the Federal Funds target rate three times, resulting in an aggregate decrease of 100-basis points. The result of the changes has provided a flattened yield curve in comparison to an inverted yield curve that had been experienced in 2023 and a majority of 2024.
Current report
Emerging technology, including cloud computing and artificial intelligence (“AI”), introduces new risks while possibly being essential to support business strategy.
Current report
The financial services market continues to see rapid changes with steady and frequent introductions of new technology-driven products and services. Our future success may depend, in part, on our ability to leverage emerging technology to provide feature-rich products and services that provide value to our customers and our operations. At the same time, emerging technologies present new risks directly associated with adoption or indirectly by third-party service provider adoption. The continued expansion of cloud computing services has drastically increased the adoption risk as we depend on our third-party service providers to implement effective controls to manage new risk. While cloud computing services typically support improved availability, performance and elasticity, it also presents increased risk of system and data compromise. Cloud computing services are rapidly evolving as are the technology solutions running in cloud services. Cloud and associated technology have influenced the opportunity for rapid change, which inherently increases change management risk. While the heightened pace of change is often desirable, it may lead to undesirable outcomes impacting operational risk, financial risk, reputations risk and sometimes, regulatory risk.
Current report
The recent emergence of artificial intelligence (“AI”) is a recent example of an emerging technology providing significant value to operations and service, although the mere existence of AI capabilities presents a myriad of risks for consideration. Regardless of direct AI adoption by the Company, we face the risk of associates utilizing unauthorized publicly sourced AI tools to complete business functions. Unauthorized use of AI tools could lead to the unintended exposure of confidential data, use of inaccurate results, and a number of other risks. Additionally, third-party service providers are quickly embedding AI capabilities in their technology to provide more robust and efficient services. Some embedded AI capabilities could risk the exposure of confidential Company data if being used in a multi-tenant environment or being used to train AI systems.
Current report
We rely on third parties to provide critical business services and protect the confidentiality, integrity, and availability of confidential data.
Current report
We, or our service providers, may experience a cyber-attack, system failure, natural disaster, or other uncontrollable events that may disrupt business operations.
Current report
We are subject to evolving laws and regulations relating to cybersecurity protection and data privacy, and failure to comply could expose the Company to regulatory liability, reputational risk and financial risk.
Removed paragraphs (10)
Previous report
Subsequent to year end, the Bank discovered fraudulent activity associated with deposit transactions conducted over the course of several business days ending in early March 2024 by an in-market business customer of the Bank. The Bank continues to investigate this matter to determine the potential exposure to the Company, which the Company currently estimates could be up to $18.9 million, or $14.1 million net of taxes. The ultimate financial impact could be lower and will depend, in part, on the Bank’s success in recovering the funds. The Bank plans to pursue all available sources of recovery to mitigate the potential loss. See Note 24, Subsequent Events, of the notes to consolidated financial statements, included in this Annual Report on Form 10-K, for additional details.
Previous report
As disclosed in Part I, Item 3, “Legal Proceedings,” an action has been brought against us by four individuals who sought and were granted class certification to represent classes of consumers who allege to have obtained direct or indirect financing from us for the purchase of vehicles that we later repossessed. On September 30, 2021, the court granted plaintiffs’ motion for class certification and matters and certified four different classes (two classes of New York consumers and two classes of Pennsylvania consumers). There are approximately 5,200 members in the New York classes and approximately 300 members in the Pennsylvania classes. If we settle these claims or the litigation is not resolved in our favor, we may suffer reputational damage and incur legal costs, settlements or judgments that exceed the amounts covered by our existing insurance policies. We can provide no assurances that our insurer will cover the full legal costs, settlements or judgments we incur. If we are not successful in defending ourselves from these claims, or if our insurer does not cover the full amount of legal costs we incur, the result may materially adversely affect our business, results of operations and financial condition. Further, adverse determinations in such matters could result in actions by our regulators that could materially adversely affect our business, financial condition or results of operations. There can be no guarantee that other proceedings that may have a material adverse effect on our business, results of operations or financial condition will not arise in the near or long-term future.
Previous report
Regulatory scrutiny of bank provision of BaaS solutions and related technology considerations has recently increased.
Previous report
We provide BaaS products and services to third parties. The third parties that use these BaaS solutions, and with which we may partner in marketing efforts, are typically considered FinTech companies but may also include other financial intermediaries. Recently, federal bank regulators have increasingly focused on the risks related to bank and FinTech company partnerships, raising potential concerns regarding risk management, oversight, internal controls, information security, change management, and information technology operational resilience. There have been regulatory enforcement actions against other banks that have not adequately addressed these potential concerns while growing their BaaS offerings. Accordingly, we could be subject to additional regulatory scrutiny with respect to that portion of our business.
Previous report
Our insurance brokerage subsidiary is subject to risk related to the insurance industry.
Previous report
SDN derives the bulk of its revenue from commissions and fees earned from brokerage services. SDN does not determine the insurance premiums on which its commissions are based. Insurance premiums are cyclical in nature and may vary widely based on market conditions. As a result, insurance brokerage revenues and profitability can be volatile. As insurance companies outsource the production of premium revenue to non-affiliated brokers or agents such as SDN, those insurance companies may seek to further minimize their expenses by reducing the commission rates payable to insurance agents or brokers, which could adversely affect SDN’s revenues. In addition, there have been and may continue to be various trends in the insurance industry toward alternative insurance markets including, among other things, increased use of self-insurance, captives, and risk retention groups. While SDN has been able to participate in certain of these activities and earn fees for such services, there can be no assurance that we will realize revenues and profitability as favorable as those realized from SDN’s traditional brokerage activities.
Previous report
Additionally, in early 2023, the failures of Silicon Valley Bank, Signature Bank, and First Republic Bank resulted in decreased confidence in banks among depositors, other counterparties and investors. Such events and developments could materially and adversely affect our business or financial condition, including through declines in deposits, increased costs of funds, potential liquidity pressures, increased regulation, and declines and volatility in the price of our common stock.
Previous report
We face competition in staying current with technological changes and banking alternatives to compete and meet customer demands.
Previous report
The financial services market, including banking services, faces rapid changes with frequent introductions of new technology-driven products and services. Our future success may depend, in part, on our ability to use technology to provide products and services that provide convenience to customers and to create additional efficiencies in our operations. Some of our competitors have substantially greater resources to invest in technological improvements than we currently have. We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers. In addition, technology and other changes are allowing consumers to utilize alternative methods to complete financial transactions that have historically involved banks. For example, consumers can now maintain funds in brokerage accounts or mutual funds that would have historically been held as bank deposits. Consumers can also complete transactions such as paying bills and transferring funds directly without using a traditional bank as an intermediary. The process of eliminating banks as intermediaries could result in the loss of customer deposits, the related income generated from those deposits and additional fee income. We may not be able to effectively compete with these banking alternatives for consumer deposits. As a result, our ability to effectively compete to retain or acquire new business may be impaired, and our business, financial condition or results of operations, may be adversely affected.
Previous report
A breach in security of our or third-party information systems, including the occurrence of a cyber incident or a deficiency in cybersecurity, or a failure by us to comply with New York State cybersecurity regulations, may subject us to liability, result in a loss of customer business or damage our brand image.
Reworded paragraphs (23)
Previous wording
We make various assumptions and judgments about the collectability of our loan portfolio, including the creditworthiness of our borrowers and the value of the real estate and other assets serving as collateral, and we provide an allowance for estimated credit losses based on a number of factors. We believe that the allowance for credit losses is adequate. However, if our assumptions or judgments are wrong, the allowance for loan losses may not be sufficient to cover the actual credit losses. We may have to increase the allowance in the future in response to the request of one of our primary banking regulators, to adjust for changing conditions and assumptions, or as a result of any deterioration in the quality of our loan portfolio. The actual amount of future provisions for credit losses may vary from the amount of past provisions.
Current wording
We make various assumptions and judgments about the collectability of our loan portfolio, including the creditworthiness of our borrowers and the value of the real estate and other assets serving as collateral, and we provide an allowance for estimated credit losses based on a number of factors. We believe that the allowance for credit losses is adequate. However, if our assumptions or judgments are wrong, the allowance for credit losses may not be sufficient to cover the actual credit losses. We may have to increase the allowance in the future in response to the request of one of our primary banking regulators, to adjust for changing conditions and assumptions, or as a result of any deterioration in the quality of our loan portfolio. The actual amount of future provisions for credit losses may vary from the amount of past provisions.
Previous wording
As a bank, we are susceptible to fraudulent activity that may be committed against us or our clients, which may result in financial losses or increased costs to us or our clients, disclosure or misuse of our information or our client information, misappropriation of assets, privacy breaches against our clients, litigation or damage to our reputation. We are most subject to fraud and compliance risk in connection with the origination of loans, ACH transactions, wire transactions, ATM transactions, checking transactions, and debit cards that we have issued to our customers and through our online banking portals.
Current wording
As a bank, we are susceptible to fraudulent activity that may be committed against us or our clients, which may result in financial losses or increased costs to us or our clients, disclosure or misuse of our information or our client information, misappropriation of assets, privacy breaches against our clients, litigation or damage to our reputation. We are most subject to fraud and compliance risk in connection with the origination of loans, ACH transactions, wire transactions, ATM and ITM transactions, checking transactions, and debit cards that we have issued to our customers and through our online banking portals.
Previous wording
While the Company believes this recent incident is an isolated occurrence, there can be no assurance that such fraudulent actions will not occur again or that such acts will be detected in a timely manner. We maintain a system of internal controls and insurance coverage to mitigate against such risks, including data processing system failures and errors, and customer fraud. If our internal controls fail to prevent or detect any such occurrence, or if any resulting loss is not insured or exceeds applicable insurance limits, it could have a material adverse effect on our business, financial condition and results of operations.
Current wording
While the Bank believes this incident was an isolated occurrence and has since instituted a remediation plan designed to strengthen its risk mitigation practices, there can be no assurance that such fraudulent actions will not occur again or that such acts will be detected in a timely manner. We maintain a system of internal controls and insurance coverage to mitigate against such risks, including data processing system failures and errors, and customer fraud. If our internal controls fail to prevent or detect any such occurrence, or if any resulting loss is not insured or exceeds applicable insurance limits, it could have a material adverse effect on our business, financial condition and results of operations.
Previous wording
At December 31, 2023, our portfolio of commercial business and commercial mortgage loans totaled $2.74 billion, or 61% of total loans. We plan to continue to emphasize the origination of these types of loans, which generally expose us to a greater risk of nonpayment and loss than residential real estate or consumer loans because repayment of such loans often depends on the successful operations and income stream of the borrowers. Additionally, such loans typically involve larger loan balances to single borrowers or groups of related borrowers compared to consumer loans or residential real estate loans. A sudden downturn in the economy, or a prolonged downturn for specific industries, could result in borrowers being unable to repay their loans, thus exposing us to increased credit risk.
Current wording
At December 31, 2024, our portfolio of commercial business and commercial mortgage loans totaled $1.25 billion, or 28% of total loans. We plan to continue to emphasize the origination of these types of loans, which generally expose us to a greater risk of nonpayment and loss than residential real estate or consumer loans because repayment of such loans often depends on the successful operations and income stream of the borrowers. Additionally, such loans typically involve larger loan balances to single borrowers or groups of related borrowers compared to consumer loans or residential real estate loans. A sudden downturn in the economy, or a prolonged downturn for specific industries, could result in borrowers being unable to repay their loans, thus exposing us to increased credit risk.
Previous wording
In 2006, the federal bank regulatory agencies issued joint guidance entitled “Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices” (the “CRE Guidance”). Although the CRE Guidance did not establish specific lending limits, it provides that a bank’s commercial real estate lending exposure may receive increased supervisory scrutiny where total non-owner occupied commercial real estate loans, including loans secured by apartment buildings, investor commercial real estate and construction and land loans, represent 300% or more of an institution’s total risk-based capital and the outstanding balance of the commercial real estate loan portfolio has increased by 50% or more during the preceding 36 months. Our non-owner occupied commercial real estate level equaled 285% of total risk-based capital at December 31, 2023. If our regulators were to impose restrictions on the amount of commercial real estate loans we can hold in our portfolio, or require higher capital ratios as a result of the level of commercial real estate loans held, our earnings would be adversely affected.
Current wording
In 2006, the federal bank regulatory agencies issued joint guidance entitled “Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices” (the “CRE Guidance”). Although the CRE Guidance did not establish specific lending limits, it provides that a bank’s commercial real estate lending exposure may receive increased supervisory scrutiny where total non-owner occupied commercial real estate loans, including loans secured by apartment buildings, investor commercial real estate and construction and land loans, represent 300% or more of an institution’s total risk-based capital and the outstanding balance of the commercial real estate loan portfolio has increased by 50% or more during the preceding 36 months. Our CRE level equaled 297% of total risk-based capital at December 31, 2024. If our regulators were to impose restrictions on the amount of commercial real estate loans we can hold in our portfolio, or require higher capital ratios as a result of the level of commercial real estate loans held, our earnings would be adversely affected.
Previous wording
As a result of our growth over the past several years, certain portions of our loan portfolio, such as the increased size of our commercial loan portfolio, are of relatively recent origin. Loans may not begin to show signs of credit deterioration or default until they have been outstanding for some period of time, a process referred to as “seasoning.” As a result, a portfolio of older loans will usually behave more predictably than a newer portfolio. Because these portions of our portfolio are relatively new, the current level of delinquencies and defaults may not represent the level that may prevail as the portfolio becomes more seasoned. If delinquencies and defaults increase, we may be required to increase our provision for loan losses, which could have an adverse effect on our business, financial condition and results of operations.
Current wording
As a result of our growth over the past several years, certain portions of our loan portfolio, such as the increased size of our commercial loan portfolio, are of relatively recent origin. Loans may not begin to show signs of credit deterioration or default until they have been outstanding for some period of time, a process referred to as “seasoning.” As a result, a portfolio of older loans will usually behave more predictably than a newer portfolio. Because these portions of our portfolio are relatively new, the current level of delinquencies and defaults may not represent the level that may prevail as the portfolio becomes more seasoned. If delinquencies and defaults increase, we may be required to increase our provision for credit losses, which could have an adverse effect on our business, financial condition and results of operations.
Previous wording
At December 31, 2023, we had $3.81 billion of deposit liabilities, or 73% of our total deposits, that have no maturity and, therefore, may be withdrawn by the depositor at any time. These deposit liabilities include our checking, savings, and money market deposit accounts.
Current wording
At December 31, 2024, we had $3.56 billion of deposit liabilities, or 70% of our total deposits, that have no maturity and, therefore, may be withdrawn by the depositor at any time. These deposit liabilities include our checking, savings, and money market deposit accounts.
Previous wording
Offering financial products and services to the cannabis industry presents a unique set of regulatory risks due to the conflict between state and federal laws. While the possession and sale of recreational marijuana is legal for adults aged 21 and older in New York State, cannabis remains classified as a Schedule I controlled substance under the federal Controlled Substances Act. In January 2018, the DOJ rescinded the “Cole Memo” and related memoranda which characterized the enforcement of the Controlled Substances Act against persons and entities complying with state regulatory systems permitting the use, manufacture and sale of medical marijuana as an inefficient use of their prosecutorial resources and discretion. The impact of the DOJ’s rescission of the Cole Memo and related memoranda is unclear, but in the future may result in increased enforcement actions against the regulated cannabis industry generally. More recently, the United States Attorney General has indicated that the DOJ under his leadership does not intend to pursue cases against parties who comply with the laws in states which have legalized and are effectively regulating marijuana. However, enforcement policies and practices may be highly variable between political administrations. In addition, federal prosecutors have significant discretion and there can be no assurance that the federal prosecutor for any district in which we or our customers operate will not choose to strictly enforce the federal laws governing cannabis.
Current wording
Offering financial products and services to the cannabis industry presents a unique set of regulatory risks due to the conflict between state and federal laws. While the possession and sale of recreational marijuana is legal for adults aged 21 and older in New York State, cannabis remains classified as a Schedule I controlled substance under the federal Controlled Substances Act. In January 2018, under the first Trump administration, the DOJ rescinded the “Cole Memo” and related memoranda which characterized the enforcement of the Controlled Substances Act against persons and entities complying with state regulatory systems permitting the use, manufacture and sale of medical marijuana as an inefficient use of their prosecutorial resources and discretion. The impact of the DOJ’s rescission of the Cole Memo and related memoranda is unclear, but in the future may result in increased enforcement actions against the regulated cannabis industry generally. Under the Biden administration, the United States Attorney General indicated that the DOJ did not intend to pursue cases against parties who comply with the laws in states which have legalized and are effectively regulating marijuana. However, the second Trump administration took office on January 20, 2025, and enforcement policies and practices may be highly variable between political administrations. In addition, federal prosecutors have significant discretion and there can be no assurance that the federal prosecutor for any district in which we or our customers operate will not choose to strictly enforce the federal laws governing cannabis.
Previous wording
As indicated in Note 1, Summary of Significant Accounting Policies – Recent Accounting Pronouncements, to the Consolidated Financial Statements included in Item 8 of this Annual Report on Form 10-K, the regulations, rules, standards, policies, and interpretations underlying GAAP are constantly evolving and may change significantly over time. If we fail to interpret any one or more of these GAAP provisions correctly, or if our methodology in applying them to our financial reporting or disclosures is at all flawed, our financial statements may contain inaccuracies that, if severe enough, could warrant a later restatement by us, which in turn could result in a material adverse event.
Current wording
As indicated in Note 1, Summary of Significant Accounting Policies–Recent Accounting Pronouncements, to the consolidated financial statements included in Part II, Item 8, of this Annual Report on Form 10-K, the regulations, rules, standards, policies, and interpretations underlying GAAP are constantly evolving and may change significantly over time. If we fail to interpret any one or more of these GAAP provisions correctly, or if our methodology in applying them to our financial reporting or disclosures is at all flawed, our financial statements may contain inaccuracies that, if severe enough, could warrant a later restatement by us, which in turn could result in a material adverse event.
Previous wording
As of December 31, 2023, we had $67.1 million of goodwill and $5.4 million of other intangible assets. Significant and sustained declines in our stock price and market capitalization, significant declines in our expected future cash flows, significant adverse changes in the business climate or slower growth rates may necessitate our taking charges in the future related to the impairment of our goodwill. Future regulatory actions could also have a material impact on assessments of goodwill for impairment. If the fair value of our net assets improves at a faster rate than the market value of our reporting units, or if we were to experience increases in book values of a reporting unit in excess of the increase in fair value of equity, we may also have to take charges related to the impairment of our goodwill. If we were to conclude that a future write-down of our goodwill is necessary, we would record the appropriate charge, which could have a material adverse effect on our results of operations.
Current wording
As of December 31, 2024, we had $58.1 million of goodwill and $2.6 million of other intangible assets. Significant and sustained declines in our stock price and market capitalization, significant declines in our expected future cash flows, significant adverse changes in the business climate or slower growth rates may necessitate our taking charges in the future related to the impairment of our goodwill. Future regulatory actions could also have a material impact on assessments of goodwill for impairment. If the fair value of our net assets improves at a faster rate than the market value of our reporting units, or if we were to experience increases in book values of a reporting unit in excess of the increase in fair value of equity, we may also have to take charges related to the impairment of our goodwill. If we were to conclude that a future write-down of our goodwill is necessary, we would record the appropriate charge, which could have a material adverse effect on our results of operations.
Previous wording
Our current growth strategy is multi-faceted. We seek to expand our branch network into nearby areas, continue to invest in our digital banking strategy, develop new sustainable revenue streams through BaaS, make strategic acquisitions of loans, portfolios, other regional banks and non-banking firms whose businesses we feel may be complementary with ours, and to continue to organically grow our core deposits. Any failure by us to effectively implement any one or more of these growth strategies could have several negative effects, including a possible decline in the size or the quality, or both, of our loan portfolio or a decrease in profitability caused by an increase in operating expenses.
Current wording
Our current growth strategy is multi-faceted. We seek to expand our branch network into nearby areas, continue to invest in our digital banking strategy, make strategic acquisitions of loans, portfolios, other regional banks and non-banking firms whose businesses we feel may be complementary with ours, and to continue to organically grow our core deposits. Any failure by us to effectively implement any one or more of these growth strategies could have several negative effects, including a possible decline in the size or the quality, or both, of our loan portfolio or a decrease in profitability caused by an increase in operating expenses.
Previous wording
Liquidity is essential to our business as we must be able to meet the cash needs of borrowers and depositors. Our liquidity could be impaired by an inability to access the capital markets or unforeseen outflows of cash. Reduced liquidity may arise due to circumstances that we may be unable to control, such as a general market disruption or an operational problem that affects third parties or us. Our efforts to monitor and manage liquidity risk may not be successful or sufficient to deal with dramatic or unanticipated reductions in our liquidity. In such events, our cost of funds may increase, thereby reducing our net interest income, or we may need to sell a portion of our investment and/or loan portfolio, which, depending upon market conditions, could result in us realizing a loss.
Current wording
If we are unable to continue to fund assets through customer bank deposits or access funding sources on reasonable terms or if we suffer an increase in borrowing costs or otherwise fail to manage liquidity effectively, our liquidity, operating margins, financial condition and results of operations may be materially adversely affected. Reduced liquidity may arise due to circumstances that we may be unable to control, such as a general market disruption or an operational problem that affects third parties or us. Our efforts to monitor and manage liquidity risk may not be successful or sufficient to deal with dramatic or unanticipated reductions in our liquidity. In such events, our cost of funds may increase, thereby reducing our net interest income, or we may need to sell a portion of our investment and/or loan portfolio, which, depending upon market conditions, could result in us realizing a loss.
Previous wording
During 2022 and 2023, in response to accelerated inflation, the Federal Reserve implemented monetary tightening policies, resulting in significantly increased interest rates. If the interest rates paid on deposits and other borrowings increase at a faster rate than the interest rates received on loans and other investments, our net interest income, and therefore earnings, could be adversely affected. In addition, our net interest margin may contract in a rising rate environment because our funding costs may increase faster than the yield we earn on our interest-earning assets. In a rising rate environment, demand for loans may decrease and loans with adjustable interest rates are more likely to experience a higher rate of default. Additionally, changes in interest rates also affect the fair value of the securities portfolio. Generally, the value of securities moves inversely with changes in interest rates. The combination of these events may adversely affect our financial condition and results of operations.
Current wording
If the interest rates paid on deposits and other borrowings increase at a faster rate than the interest rates received on loans and other investments, our net interest income, and therefore earnings, could be adversely affected. In addition, our net interest margin may contract in a rising rate environment because our funding costs may increase faster than the yield we earn on our interest-earning assets. In a rising rate environment, demand for loans may decrease and loans with adjustable interest rates are more likely to experience a higher rate of default. Additionally, changes in interest rates also affect the fair value of the securities portfolio. Generally, the value of securities moves inversely with changes in interest rates. The combination of these events may adversely affect our financial condition and results of operations.
Previous wording
Third-party vendors provide key components of our business infrastructure such as internet connections, network access and core application processing. While we have selected these third-party vendors carefully, we do not control their actions. Any problems caused by these third parties, including as a result of them not providing us their services for any reason or them performing their services poorly, could adversely affect our ability to deliver products and services to our customers or otherwise conduct our business efficiently and effectively. Replacing these third-party vendors could also entail significant delay and expense.
Current wording
Third-party vendors provide key components of our business infrastructure, such as infrastructure service delivery, application delivery, and an increased volume managed service functions. While we have selected these third-party vendors carefully, we relinquish many aspects of control. Issues induced by these third parties, including a service disruption or poor service performance, could adversely affect our ability to deliver products and services to our customers or otherwise conduct our business efficiently, effectively, and in accordance with the expectations of our customers and regulators. Replacing these third-party providers could also entail significant time and expense, further emphasizing the need for stringent vendor due diligence processes.
Previous wording
Third parties perform significant operational services on our behalf. These third-party vendors are subject to similar risks as us relating to cybersecurity, breakdowns or failures of their own systems or employees. One or more of our vendors may experience a cybersecurity event or operational disruption and, if any such event does occur, it may not be adequately addressed, either operationally or financially, by the third-party vendor. Certain of our vendors may have limited indemnification obligations or may not have the financial capacity to satisfy their indemnification obligations. Financial or operational difficulties of a vendor could also impair our operations if those difficulties interfere with the vendor’s ability to serve us. If a critical vendor is unable to meet our needs in a timely manner or if the services or products provided by such a vendor are terminated or otherwise delayed and if we are not able to develop alternative sources for these services and products quickly and cost-effectively, it could have a material adverse effect on our business. Federal banking regulators have proposed rules on managing the risks of how banks select, engage and manage their outside vendors and issued voluntary guidance for banks on similar issues. These regulations and guidance may affect the circumstances and conditions under which we work with third parties and the cost of managing such relationships.
Current wording
Each year, more third-party service providers perform significant operational services on our behalf. These third-party vendors are subject to similar risks as us relating to cybersecurity, technology infrastructure, processes and talent. One or more of our vendors may experience a cybersecurity event or operational disruption and, if any such event does occur, it may not be adequately addressed, either operationally or financially, by the third-party vendor causing direct impact to our business. And, with the increased volume of cloud computing, our business could be directly impacted if similar disruptions are experienced by fourth-party vendors. Some of our vendors may have limited indemnification obligations or may not have the financial capacity to satisfy their indemnification obligations. Financial or operational difficulties of a vendor could also impair our operations if those difficulties interfere with the vendor’s ability to serve us. If a critical vendor is unable to meet our needs in a timely manner or if the services or products provided by such a vendor are terminated or otherwise delayed and if we are not able to develop alternative sources for these services and products quickly and cost-effectively, it could have a material adverse effect on our business. Due to significant levels of dependency, critical services may require redundant service providers to reduce vendor risk, although this inherently increases financial risk a third-party risk with the redundant vendor and cost.
Previous wording
We rely heavily on communications, information systems (both internal and provided by third parties) and the internet to conduct our business. Our business depends on our ability to process and monitor a large volume of daily transactions in compliance with legal, regulatory and internal standards and specifications. In addition, a significant portion of our operations relies heavily on the secure processing, storage and transmission of personal and confidential information of our customers and clients. These risks may increase in the future as our customers continue to adapt to mobile payment and other internet-based product offerings and we expand the availability of web-based products and applications.
Current wording
We rely heavily on communications, information technology (both on-premises and via service providers) and internet service to conduct our business. Our business depends on our ability to process and monitor a large volume of daily transactions in compliance with legal, regulatory, and internal standards and specifications. In addition, a significant portion of our operations relies heavily on the secure processing, storage and transmission of personal and confidential information of our customers and clients. These risks have increased as our customers have adopted digital banking solutions, and we have migrated many former on-premises services and technology to hosted third-party service providers. The dependency on these services, provided on-premises or in hosted environments, are threatened daily by ever-evolving cyber criminals, system failures, natural disasters, and other uncontrollable events such as a global pandemic. Uncontrollable events test the operational resiliency of companies across the world, every year. Whether it be hurricanes, tornados, or wildfires, companies risk the loss of facilities, technical infrastructure and even the lives of irreplaceable talent, and the lack of quality business continuity and disaster recovery plans heightens the impact risk. The risk of failing to train and test these plans could challenge the ability to recover. Similarly, cyber-attacks also challenge our preparedness to respond and recover. The volume and impact of cyber-attacks continues to grow and regardless of security controls, every company is susceptible to a compromise, making the existence of an incident response plan critical. Failure to train and test the plan periodically is a critical risk to any company. Potential attacks have attempted to obtain unauthorized access to confidential information to obtain for sale or destroy, often through the introduction of computer viruses or malware (ransomware), cyber-attacks and other means. Such security attacks can originate from a wide variety of sources, including people who are involved with organized crime or rogue attackers taking advantage of modern tolls and services that have become readily available. Those same parties may also attempt to fraudulently induce employees, customers or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or clients. We are also subject to the risk that our employees may intercept and transmit unauthorized confidential or proprietary information. An interception, misuse or mishandling of personal, confidential or proprietary information being sent to or received from a customer or third party could result in legal liability, remediation costs, regulatory action and reputational harm, any of which could adversely affect operations and financial condition. The failure to train and periodically test for possible threats, greatly increases the risk of compromise and impact.
Previous wording
Furthermore, as the threat of cyber-attacks continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our systems, or to investigate and remediate vulnerabilities in our systems. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our systems can itself create a risk of systems disruptions and security issues.
Current wording
As the threat of cyber-attacks continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our systems, or to investigate and remediate vulnerabilities in our systems. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our systems can itself create a risk of systems disruptions and security issues.
Previous wording
We are subject to cybersecurity regulations promulgated by the NY DFS. Any failure by us to comply with these regulations could also result in regulatory sanctions, public disclosure and reputational damage even if we do not experience a significant cybersecurity breach.
Current wording
We are subject to cybersecurity regulations promulgated by agencies such as the FRB, NY DFS, and the SEC, as well as laws, such as those under the GLBA. Any failure by us to comply with laws and regulations could result in regulatory sanctions, public disclosure and reputational damage even if we do not experience a significant cybersecurity breach. Most regulatory agencies have enhanced cybersecurity requirements and oversight, requiring increased focus and investment in cybersecurity controls. The failure to keep up with regulatory cybersecurity requirements not only presents the risk of regulatory sanctions but also presents an ill-advised risk due to sub-standard cyber risk controls, thus increasing the risk compromise. Insurance carriers have also enhanced their cybersecurity posture requirements and oversight. Failure to meet reasonable cybersecurity control requirements could risk the Company’s ability to obtain cyber liability insurance or influence significantly higher rates. The lack of cyber liability insurance is not only a financial risk, but a regulatory risk.
Previous wording
We may not pay or may reduce the dividends on our common stock.
Current wording
We may not pay or may reduce the dividends on our common stock, and our ability to pay dividends is subject to certain restrictions.
Previous wording
Holders of our common stock are only entitled to receive such dividends as our Board of Directors may declare out of funds legally available for such payments. Although we have historically declared cash dividends on our common stock, we are not required to do so and may reduce or eliminate our common stock dividend in the future. This could adversely affect the market price of our common stock.
Current wording
Holders of our common stock are only entitled to receive such dividends as our Board of Directors may declare out of funds legally available for such payments. In addition, we are a bank holding company, and our ability to declare and pay dividends is dependent on federal regulatory considerations, including the guidelines of the Federal Reserve regarding capital adequacy and dividends. Although we have historically declared cash dividends on our common stock, we are not required to do so and may reduce or eliminate our common stock dividend in the future. Any change in the level of our dividends or the suspension of the payment thereof could have an adverse effect on the market price of our common stock.
Previous wording
changes in accounting policies or procedures as required by the FASB or other regulatory agencies;
Current wording
changes in accounting policies or procedures as required by the Financial Accounting Standards Board (“FASB”) or other regulatory agencies;
Previous wording
Our financial performance generally, and in particular the ability of borrowers to pay interest on and repay principal of outstanding loans and the value of collateral securing those loans, as well as demand for loans and other products and services we offer, is highly dependent on the business environment in the markets where we operate, in the State of New York and in the United States as a whole. Additionally, international conflict, such as the war in Ukraine and the impact of sanctions on Russia and Russian companies may impact global markets, which may create unfavorable or uncertain economic conditions. A favorable business environment is generally characterized by, among other factors, economic growth, efficient capital markets, low inflation, low unemployment, high business and investor confidence, and strong business earnings. Unfavorable or uncertain economic and market conditions can be caused by declines in economic growth, business activity or investor or business confidence; limitations on the availability or increases in the cost of credit and capital; increases in inflation or interest rates; high unemployment, natural disasters; or a combination of these or other factors. The occurrence of any of these conditions could have a material adverse effect on our financial condition and results of operations.
Current wording
Our financial performance generally, and in particular the ability of borrowers to pay interest on and repay principal of outstanding loans and the value of collateral securing those loans, as well as demand for loans and other products and services we offer, is highly dependent on the business environment in the markets where we operate, in the State of New York and in the United States as a whole. Additionally, international conflict, such as the war in Ukraine and the impact of sanctions on Russia and Russian companies may impact global markets, which may create unfavorable or uncertain economic conditions. A favorable business environment is generally characterized by, among other factors, economic growth, efficient capital markets, low inflation, low unemployment, high business and investor confidence, and strong business earnings. Unfavorable or uncertain economic and market conditions can be caused by declines in economic growth, business activity or investor or business confidence; limitations on the availability or increases in the cost of credit and capital; increases in inflation or interest rates; tariffs; high unemployment, natural disasters; or a combination of these or other factors. The occurrence of any of these conditions could have a material adverse effect on our financial condition and results of operations.
Previous wording
U.S. and international regulators, investors and other stakeholders are increasingly focused on environmental, social, and governance (“ESG”) matters. Additionally, shareholder activism and potential regulatory reform may lead to substantial new regulations and disclosure obligations, including with respect to ESG matters, which may lead to additional compliance costs and impact the manner in which we operate our business in ways that may materially adversely impact our results of operations and financial condition. We could also face potential negative publicity in traditional media or social media if investors determine that we have not adequately considered or addressed ESG matters, which may result in adverse effects on the trading price of our common stock.
Current wording
Despite the recent changes in federal governmental leadership, state legislatures, U.S. and international regulatory agencies, investors and other stakeholders at times may be focused on environmental, social, and governance (“ESG”) matters. Additionally, shareholder activism and potential regulatory reform may lead to substantial new regulations and disclosure obligations, including with respect to ESG matters, which may lead to additional compliance costs and impact the manner in which we operate our business in ways that may materially adversely impact our results of operations and financial condition. We could also face potential negative publicity in traditional media or social media if investors determine that we have not adequately considered or addressed ESG matters or if we have placed too much emphasis on ESG matters, which may result in adverse effects on the trading price of our common stock.
Rearranged previous paragraphs (1)
Previous report — wording carried elsewhere
In addition, several U.S. financial institutions have experienced significant distributed denial-of-service attacks, some of which involved sophisticated and targeted attacks intended to disable or degrade service or sabotage systems. Other potential attacks have attempted to obtain unauthorized access to confidential information or destroy data, often through the introduction of computer viruses or malware, cyber-attacks and other means. Such security attacks can originate from a wide variety of sources, including persons who are involved with organized crime or who may be linked to terrorist organizations or hostile foreign governments. Those same parties may also attempt to fraudulently induce employees, customers or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or clients. We are also subject to the risk that our employees may intercept and transmit unauthorized confidential or proprietary information. An interception, misuse or mishandling of personal, confidential or proprietary information being sent to or received from a customer or third party could result in legal liability, remediation costs, regulatory action and reputational harm, any of which could adversely affect our results of operations and financial condition.