FINANCIAL INSTITUTIONS INC

Management is responsible for establishing and maintaining adequate internal control over financial reporting for Financial Institutions, Inc. and its subsidiaries (the “Company”), as such term is defined in Exchange Act Rule 13a-15(f). The Company’s system of internal control over financial reporting has been designed to provide reasonable assurance to the Company’s management and board of directors regarding the reliability of financial reporting and the preparation and fair presentation of financial statements for external purposes in accordance with U.S. generally accepted accounting principles.

Any system of internal control over financial reporting, no matter how well designed, has inherent limitations, including the possibility that a control can be circumvented or overridden and misstatements due to error or fraud may occur and not be detected. Also, because of changes in conditions, internal control effectiveness may vary over time. Accordingly, even an effective system of internal control will provide only reasonable assurance with respect to financial statement preparation and presentation.

The Company’s management has, including the Company’s principal executive officer and principal financial officer as identified below, assessed the effectiveness of the Company’s internal control over financial reporting as of December 31, 2024. To make this assessment, we used the criteria for effective internal control over financial reporting described in Internal Control—Integrated Framework (2013), issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on our assessment and based on such criteria, we believe that, as of December 31, 2024, the Company’s internal control over financial reporting was effective.

RSM US LLP, the Company’s independent registered public accounting firm that audited the Company’s consolidated financial statements as of and for the year ended December 31, 2024 has issued a report on internal control over financial reporting as of December 31, 2024. That report appears herein.

• 67 -