TOMPKINS FINANCIAL CORP

The disclosures set forth in this Item 1. Business are qualified by the section captioned "Forward-Looking Statements" in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations of this Report and other cautionary statements set forth elsewhere in this Report.

General

Tompkins Financial Corporation ("Tompkins" or the "Company") is headquartered in Ithaca, New York and is registered as a Financial Holding Company with the Federal Reserve Board under the Bank Holding Company Act of 1956, as amended. The Company is a locally-oriented, community-based financial services organization that offers a full array of products and services, including commercial and consumer banking, leasing, trust and investment management, financial planning and wealth management, and insurance services. At December 31, 2024, the Company had one wholly-owned banking subsidiary, Tompkins Community Bank. Banking services consist primarily of attracting deposits from the areas served by Tompkins Community Bank's 54 banking offices (38 offices in New York and 16 offices in Pennsylvania), and using those deposits to originate a variety of commercial loans, agricultural loans, consumer loans, real estate loans, and leases in those same areas. Tompkins Community Bank provides a full array of trust and wealth management services under the Tompkins Financial Advisors brand, including investment management, trust and estate, financial and tax planning as well as life, disability and long-term care insurance services. The Company also has a wholly-owned insurance agency subsidiary, Tompkins Insurance Agencies, Inc. ("Tompkins Insurance"). The Company’s principal offices are located at 118 E. Seneca St., P.O. Box 460, Ithaca, New York, 14850, and its telephone number is (888) 503-5753. The Company’s common stock is traded on the NYSE American under the symbol "TMP."

Tompkins was organized in 1995, under the laws of the State of New York, as a bank holding company for Tompkins Trust Company (the "Trust Company"), a commercial bank that has operated in Ithaca, New York and surrounding communities since 1836. In January 2021, Tompkins combined its four wholly-owned banking subsidiaries into one bank, with the Bank of Castile, Mahopac Bank, and VIST Bank merging with and into the Trust Company. Immediately following the merger, the Trust Company changed its name to Tompkins Community Bank.

The Tompkins strategy centers around its core values and a commitment to delivering long-term value to our clients, communities, and shareholders. A key strategic initiative for the Company is a focus on responsible and sustainable growth, including initiatives to grow organically through our current businesses, as well as through possible acquisitions of financial institutions, branches, and financial services businesses. As such, the Company has acquired, and from time to time considers acquiring, banks, thrift institutions, branch offices of banks or thrift institutions, or other businesses that would complement the Company’s business or its geographic reach. The Company generally targets merger or acquisition partners that are culturally similar and have experienced management and possess either significant market presence or have potential for improved profitability through financial management, economies of scale and expanded services. The Company has pursued acquisition opportunities in the past, and continues to review new opportunities.

The Company also has defined strategic initiatives around digital delivery of services to meet the changing needs of client expectations, while maintaining our commitment to excellence in the delivery of personal service when self-serve options are unable to meet the needs of our clients. Our strategy includes a focus on building a scalable foundation based on a continuous improvement approach necessary for our long-term success. This foundation includes investments in automation, analytics and security to drive ongoing consistency, efficiency, and security in our operations. We also recognize the need to develop and acquire talent that is well prepared to succeed in our changing industry. Initiatives in this area include a focus on characteristics such as collaboration, innovation and agility.

Narrative Description of Business

The Company has identified three business segments, consisting of banking, insurance and wealth management.

Banking services consist primarily of attracting deposits from the areas served by the Company’s banking subsidiary and using those deposits to originate a variety of commercial loans, agricultural loans, consumer loans, real estate loans, and leases in those same areas. The Company’s lending function is managed within the guidelines of a comprehensive Board of Directors-approved lending policy. Policies and procedures are reviewed on a regular basis. Reporting systems are in place to provide management with ongoing information related to loan production, loan quality, concentrations of credit, loan delinquencies and nonperforming and potential problem loans. The Company has an independent third party loan review process that samples, reviews, and validates the risk identification and assessment made by the lenders and credit personnel. The results of these reviews are presented to the Board of Directors of the Company’s banking subsidiary, and the bank's Credit Oversight Committee.

The Company’s principal expenses are interest on deposits, interest on borrowings, and operating and general administrative expenses, as well as provisions for credit loss expenses. Funding sources, other than deposits, include borrowings, securities sold under agreements to repurchase, and cash flow from lending and investing activities. The Company’s principal source of revenue is interest income on loans and securities.

The Company maintains a portfolio of securities such as U.S. Treasury securities, obligations of U.S. government agencies and U.S. government sponsored entities, obligations of states and political subdivisions thereof, and equity securities. Management typically invests in securities with short to intermediate average lives in order to better match the interest rate sensitivities of its assets and liabilities. Investment decisions are made within policy guidelines established by the Company’s Board of Directors. The investment policy is based on the asset/liability management goals of the Company, and is monitored by the Company’s Asset/Liability Management Committee. The intent of the policy is to establish a portfolio of high quality diversified securities, which optimizes net interest income within safety and liquidity limits deemed acceptable by the Asset/Liability Management Committee.

The Company has operated its insurance agency subsidiary, Tompkins Insurance, since 2001. Insurance services include property and casualty insurance, employee benefit consulting, life, long-term care and disability insurance. Tompkins Insurance is headquartered in Batavia, New York. Over the years, Tompkins Insurance has acquired smaller insurance agencies in the market areas served by Tompkins Community Bank and successfully consolidated them into Tompkins Insurance. Tompkins Insurance offers services to customers of Tompkins Community Bank by sharing offices with Tompkins Community Bank. In addition to these shared offices, Tompkins Insurance has four stand-alone offices in Western New York.

Wealth management services consist of investment management, trust and estate, financial and tax planning as well as life, disability and long-term care insurance services. Wealth management services are provided under the trade name Tompkins Financial Advisors. Tompkins Financial Advisors has office locations, and services are available, at certain of Tompkins Community Bank's branch locations.

Subsidiaries

Tompkins Community Bank

Tompkins Community Bank operates 54 branches, 38 branches in New York, and 16 located in Pennsylvania. Tompkins has operated in Ithaca, New York and surrounding communities since 1836. Tompkins Community Bank provides wealth management services through Tompkins Financial Advisors, a division of Tompkins Community Bank. As of December 31, 2024, Tompkins Community Bank had consolidated total assets of $8.1 billion, consolidated total loans of $6.0 billion, and consolidated total deposits of $6.5 billion. A description of markets served by Tompkins Community Bank are included below:

Tompkins Central New York ("CNY")

We operate 12 branches in our CNY market, with the largest market area being Tompkins County, which has a population of approximately 104,000. Education plays a significant role in the Tompkins County economy with Cornell University and Ithaca College being two of the county’s major employers. Tompkins Community Bank has a full-service office in Cortland, New York and a full-service office in Auburn, New York. Both of these offices are located in counties contiguous to Tompkins County. Tompkins Community Bank also has two full-service branches in Fayetteville and Syracuse, New York which are located in Onondaga County.

Tompkins Western New York ("WNY")

We operate 14 banking offices in our WNY market, in towns situated in and around the areas commonly known as the Genesee Valley region of New York State. The main business office for WNY is located in Batavia, New York and is shared with Tompkins Insurance. Our WNY market is a six-county market, much of which is rural in nature, but also includes Monroe County (population approximately 748,000), where the city of Rochester is located, and Erie County (population approximately 946,000) located near Buffalo, New York. The population of the counties in our WNY market, other than Monroe and Erie, is approximately 198,000.

Tompkins Hudson Valley New York ("HV")

We operate 12 banking offices in our HV market. The 12 banking offices include 4 full-service offices in Putnam County, New York, 3 full-service offices in Dutchess County, New York, and 5 full-service offices in Westchester County, New York. Putnam County has a population of approximately 98,000 and is about 60 miles north of Manhattan. Dutchess County has a population of approximately 297,000, and Westchester County has a population of approximately 991,000.

Tompkins Pennsylvania ("PA")

We operate 16 banking offices in Pennsylvania, including one limited-service office. The 16 banking offices include 10 offices in Berks County, 3 offices in Montgomery County, 1 office in Philadelphia County, 1 office in Delaware County and 1 office in Schuylkill County. The population of the counties served by PA is Philadelphia: 1.6 million, Montgomery: 869,000, Delaware: 577,000, Berks: 433,000 and Schuylkill: 144,000. The main office is located in Wyomissing, Pennsylvania.

Tompkins Insurance Agencies, Inc.

Tompkins Insurance is headquartered in Batavia, New York. Insurance services include property and casualty insurance, employee benefit consulting, and life, long-term care and disability insurance. Tompkins Insurance offers services to customers of the Tompkins Community Bank by sharing offices within Western New York, Central New York and Pennsylvania. In addition to these shared offices, Tompkins Insurance has four stand-alone offices in Western New York.

Competition

Competition for commercial banking and other financial services is strong in the Company’s market areas. In one or more aspects of its business, Tompkins Community Bank competes with other commercial banks, savings and loan associations, credit unions, finance companies, internet-based financial services companies, mutual funds, insurance companies, brokerage and investment banking companies, and other financial intermediaries. Some of these competitors have substantially greater resources and lending capabilities and may offer services that the Company does not currently provide. In addition, many of the Company’s non-bank competitors are not subject to the same extensive State and Federal regulations that govern financial holding companies and Federally-insured banks.

Competition among financial institutions is based upon interest rates offered on deposit accounts, interest rates charged on loans and other credit and service charges, the quality and scope of the services rendered, the convenience of facilities and services, and, in the case of loans to commercial borrowers, relative lending limits. Management believes that a community-based financial organization is better positioned to establish personalized financial relationships with both commercial customers and individual households. The Company’s community commitment and involvement in its primary market areas, as well as its commitment to quality and personalized financial services, are factors that contribute to the Company’s competitiveness. Management believes that Tompkins Community Bank can compete successfully in its primary market areas by making prudent lending decisions quickly and more efficiently than its competitors, without compromising asset quality or profitability. In addition, the Company focuses on providing unparalleled customer service, which includes offering a strong suite of products and services, including products that are accessible to our customers through digital channels. Although management feels that this business model has caused the Company to grow its customer base in recent years and allows it to compete effectively in the markets it serves, we cannot assure you that such factors will result in future success.

Supervision and Regulation

Regulatory Agencies

As a registered financial holding company, the Company is regulated under the Bank Holding Company Act of 1956 as amended ("BHC Act"), and is subject to examination and comprehensive regulation by the Federal Reserve Board ("FRB"). The Company is also subject to the jurisdiction of the Securities and Exchange Commission ("SEC") and is subject to disclosure and regulatory requirements under the Securities Act of 1933, as amended (the "Securities Act"), and the Securities Exchange Act of 1934, as amended (the "Exchange Act"). The Company's activities, or those of its subsidiary bank, Tompkins Community Bank, are also subject to regulation under the Federal Reserve Act, the Federal Deposit Insurance Act, the Dodd-Frank Act, the Truth-in-Lending Act (which governs disclosures of credit terms to consumer borrowers), the Truth-in-Savings Act, the Equal Credit Opportunity Act, the Fair Credit Reporting Act (which governs the manner in which consumer debts may be collected by collection agencies), the Home Mortgage Disclosure Act (which requires financial institutions to provide certain information about home mortgage and refinanced loans), the Servicemembers Civil Relief Act, Section 5 of the Federal Trade Commission Act (which prohibits unfair or deceptive acts and practices in or affecting commerce), the Real Estate Settlement Procedures Act, and the Electronic Funds Transfer Act, as well as other federal, state and local laws. The Company’s common stock is traded on the NYSE American under the Symbol "TMP" and as a result the Company is subject to the rules of the NYSE American for listed companies.

Tompkins Community Bank is a state chartered bank and a non-member of the Federal Reserve System and is subject to examination and comprehensive regulation by various regulatory authorities, including the Federal Deposit Insurance Corporation ("FDIC"), and the New York State Department of Financial Services ("NYSDFS"). Each of these agencies issues regulations and requires the filing of reports describing the activities and financial condition of the entities under its jurisdiction. Likewise, such agencies conduct examinations on a recurring basis to evaluate the safety and soundness of the institutions, and to test compliance with various regulatory requirements, including: consumer protection, privacy, fair lending, the Community Reinvestment Act, the Bank Secrecy Act, sales of non-deposit investments, electronic data processing, and trust department activities.

The Company’s insurance subsidiary is subject to examination and regulation by the NYSDFS and the Pennsylvania Insurance Department.

The Company’s wealth management subsidiary is subject to examination and regulation by various regulatory agencies. The trust division of Tompkins Community Bank is subject to examination and comprehensive regulation by the FDIC and NYSDFS.

Federal Home Loan Bank ("FHLB") System

The Federal Home Loan Banks (the "FHLBs") are a group of cooperatives that lending institutions use to finance housing and economic development in local communities. We are a member of the FHLB of New York ("FHLBNY"). FHLB members are required to maintain a minimum investment in capital stock of the applicable FHLB. The board of directors of the FHLBNY may increase the minimum investment requirements in the event it has concluded that additional capital is required to allow it to meet its own regulatory capital requirements. Any increase in the minimum investment requirements outside of specified ranges requires the approval of the Federal Housing Finance Agency. Because the extent of any obligation to increase our investment in the FHLBNY depends entirely upon the occurrence of a future event, the amount of any future investment in the capital stock of the FHLBNY is not determinable.

Regulatory Reform

Legislation, some of which may be extensive and comprehensive in nature, is introduced in Congress and New York's legislature from time to time. Such legislation may change applicable statutes and the operating environment in substantial and unpredictable ways. We cannot determine the ultimate effect that future legislation or implementing regulations would have upon our financial condition or upon our results of operations or the results of operations of any of our subsidiaries.

The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the "Dodd-Frank Act") by way of example, contains a comprehensive set of provisions designed to govern the practices and oversight of financial institutions and other participants in the financial markets. The Dodd-Frank Act made extensive changes in the regulation of financial institutions and their holding companies. Some of the changes brought about by the Dodd-Frank Act were modified by the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 (the "Regulatory Relief Act"), signed into law on May 24, 2018.

Debit-Card Interchange Fees

FRB regulations mandated by the Dodd-Frank Act limit interchange fees on debit cards to a maximum of 21 cents per transaction plus 5 basis points of the transaction amount. Issuers that, together with their affiliates, have less than $10 billion in assets, such as the Company, are exempt from the debit card interchange fee standards. However, FRB regulations prohibit all card issuers, including Tompkins Community Bank, from restricting the number of networks over which electronic debit transactions may be processed to fewer than two unaffiliated networks, or inhibiting a merchant's ability to direct the routing of the electronic debit transaction over any network that the card issuer has enabled to process them.

Volcker Rule

The Dodd-Frank Act required the federal financial regulatory agencies to adopt rules that prohibit banks and their affiliates from engaging in proprietary trading and investing in certain covered funds. The statutory provision is commonly called the "Volcker Rule," and is not applicable to depository institutions and their holding companies whose total assets do not exceed $10 billion. As of December 31, 2024, the Company's total assets on a consolidated basis were $8.1 billion.

Federal Bank Holding Company ("BHC") Regulation

We are a bank holding company subject to regulation under the BHC Act and the examination and reporting requirements of the FRB. In general, the BHC Act limits the business of bank holding companies to banking, managing or controlling banks, and other activities that the FRB has determined to be closely related to banking. In addition, we have elected to be treated as a financial holding company under the BHC Act and therefore may engage in any activity, or acquire and retain the shares of a company engaged in any activity, that is either (i) financial in nature or incidental to such financial activity (as determined by the FRB in consultation with the Secretary of the Treasury) or (ii) complementary to a financial activity and does not pose a substantial risk to the safety and soundness of depository institutions or the financial system generally (as solely determined by the FRB), without prior approval of the FRB.

If a bank holding company elects to be treated as a financial holding company, as we have, (i) the bank holding company and all of its depository institution subsidiaries must be "well-capitalized" and "well-managed," as defined in the FRB's Regulation Y and (ii) the bank holding company must file a declaration with the FRB that it elects to be a "financial holding company," which we have done. A depository institution subsidiary is considered to be "well-capitalized" if it satisfies the requirements for this status discussed in the section captioned "Capital Adequacy and Prompt Corrective Action," below. A depository institution subsidiary is considered "well-managed" if it received a composite rating and management rating of at least "satisfactory" in its most recent examination. A financial holding company’s status will also depend upon it maintaining its status as "well-capitalized" and "well-managed" under applicable FRB regulations. If a financial holding company ceases to meet these capital and management requirements, the FRB’s regulations provide that the financial holding company must enter into an agreement with the FRB to comply with all applicable capital and management requirements. Until the financial holding company returns to compliance, the FRB may impose limitations or conditions on the conduct of its activities, and the company may not commence any of the broader financial activities permissible for financial holding companies or acquire a company engaged in such financial activities without prior approval of the FRB. If the company does not return to compliance within 180 days, the FRB may require divestiture of the holding company’s depository institutions. Bank holding companies and banks must also be "well-capitalized" and "well-managed" in order to acquire banks located outside their home state.

In order for a financial holding company to commence any new activity permitted by the BHC Act or to acquire a company engaged in any new activity permitted by the BHC Act, each insured depository institution subsidiary of the financial holding company must have received a rating of at least "satisfactory" in its most recent examination under the Community Reinvestment Act ("CRA"). See the section captioned "Community Reinvestment Act", below.

The FRB has the power to order any bank holding company or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the FRB has reasonable grounds to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company.

Share Repurchases and Dividends

The ability of the Company to pay dividends on or to repurchase its common stock, and the ability of Tompkins Community Bank to pay dividends to the Company, may be restricted due to several factors including: (a) applicable federal and state banking codes, (b) covenants contained in our borrowing agreements (as applicable), and (c) the regulatory authority of the FRB, the FDIC, and the NYSDFS. Our ability to pay dividends to our stockholders or to repurchase shares of our common stock is also subject to restrictions set forth in the New York Business Corporation Law.

Notification to the FRB is required prior to our declaring and paying a cash dividend to our stockholders during any period in which our quarterly and/or cumulative twelve month net earnings are insufficient to fund the dividend amount, among other requirements. Under such circumstances, we may not pay a dividend should the FRB object until such time as we receive approval from the FRB or no longer need to provide notice under applicable regulations. In addition, prior approval of the FRB may be required in certain circumstances prior to our repurchasing shares of our common stock.

In connection with any decision regarding dividends and share repurchase programs, our Board will take into account general business conditions, our financial results, projected cash flows, capital requirements, contractual, legal and regulatory restrictions on the payment of dividends by Tompkins Community Bank to the Company, and such other factors as deemed relevant. We can provide no assurance that we will continue to declare dividends on a quarterly basis, or otherwise, or to repurchase shares of our common stock. The declaration of dividends by the Company is subject to the discretion of our Board.

The Company's primary source of liquidity is the receipt of cash dividends from Tompkins Community Bank. Various statutes and regulations limit the availability of cash dividends from Tompkins Community Bank and the dividends paid by Tompkins Community Bank are regulated by the NYSDFS and the FDIC under their general supervisory authority as it relates to a bank's capital requirements. Tompkins Community Bank may declare a dividend without the approval of the NYSDFS and FDIC as long as the total dividends declared in a calendar year do not exceed its net income for the current fiscal year, plus the retained net income for the prior two fiscal years.

Transactions with Affiliates and Other Related Parties

Transactions between Tompkins Community Bank and its affiliates are regulated under federal banking law. Subject to certain exceptions set forth in the Federal Reserve Act and its implementing regulations, found in FRB Regulation W, a bank may enter into "covered transactions" with its affiliates if the aggregate amount of the covered transactions with any single affiliate does not exceed 10 percent of the bank's capital stock and surplus or 20 percent of the bank's capital stock and surplus for covered transactions with all affiliates. Covered transactions include, among other things, extension of credit, the investment in securities, the purchase of assets, the acceptance of collateral or the issuance of a guaranty. The Dodd-Frank Act significantly expanded the coverage and scope of the limitations on affiliate transactions within a banking organization. Additionally, most transactions that a bank engages in with an affiliate, including where an affiliate performs a service for the bank, must be on similar terms and conditions as the bank would agree to with a non-affiliate.

Tompkins Community Bank's authority to extend credit to its directors, executive officers and 10% shareholders (collectively, "Reg O Insiders"), as well as to entities controlled by such persons, is governed by the requirements of Sections 22(g) and 22(h) of the Federal Reserve Act and Regulation O as promulgated by the FRB. Among other things, these provisions require that extensions of credit to Reg O Insiders (i) be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with persons or entities that are not Reg O Insiders (or their related parties), and that do not involve more than the normal risk of repayment or present other unfavorable features; and (ii) not exceed certain limitations on the amount of credit extended to such persons, individually and in the aggregate, which limits are based, in part, on the amount of the bank’s capital. In addition, extensions of credit in excess of certain limits must be approved by the bank’s board of directors. Additional restrictions apply to extensions of credit to executive officers of Tompkins Community Bank. A similar scope of restrictions on insider transactions is required by Title 3, Part 11 of NYSDFS Banking regulations.

Mergers and Acquisitions

The BHC Act, the Bank Merger Act, the Change in Bank Control Act and other federal and state statutes regulate acquisitions of interests in commercial banks. The BHC Act requires the prior approval of the FRB for the direct or indirect acquisition by a bank holding company of more than 5.0% of the voting shares of a commercial bank or its parent holding company and for a person, other than a bank holding company, to acquire 25% or more of any class of voting securities of a bank or bank holding company. Under the Bank Merger Act, the prior approval of the appropriate bank regulatory agencies is required for a member bank to merge with another bank or purchase the assets or assume the deposits of another bank. In reviewing applications seeking approval of merger and acquisition transactions, the bank regulatory authorities will consider, among other things, the competitive effect and public benefits of the transactions, the capital position of the combined organization, the risks to the stability of the U.S. banking or financial system, the applicant’s performance record under the CRA (see the section captioned "Community Reinvestment Act", below) and fair housing laws and the effectiveness of the subject organizations in combating money laundering activities.

Source of Strength Doctrine

The Dodd-Frank Act requires bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. Under this requirement, Tompkins is expected to commit resources to support Tompkins Community Bank, including at times when it may not be advantageous for Tompkins to do so. Any capital loans by a bank holding company to a subsidiary bank are subordinated in right of payment to deposits and to certain other indebtedness of such subsidiary bank. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Capital Adequacy and Prompt Corrective Action

Bank holding companies and banks are subject to various regulatory capital requirements administered by state and federal agencies. These agencies may establish higher minimum requirements if, for example, a banking organization previously has received special attention or has a high susceptibility to interest rate risk. Risk-based capital requirements determine the adequacy of capital based on the risk inherent in various classes of assets and off-balance sheet items. Under the Dodd-Frank Act, the Federal Reserve must apply consolidated capital requirements to depository institution holding companies that are no less stringent than those currently applied to depository institutions. The Dodd-Frank Act additionally requires capital requirements to be counter-cyclical so that the required amount of capital increases in times of economic expansion and decreases in times of economic contraction, consistent with safety and soundness.

Under federal regulations, bank holding companies and banks must meet certain risk-based capital requirements, commonly known as "Basel III". The Basel III capital framework, among other things, (i) includes the capital measure, "Common Equity Tier 1" ("CET1"), (ii) specifies that Tier 1 capital consists of CET1 and "Additional Tier 1 capital" instruments meeting specified requirements, (iii) defines CET1 narrowly by requiring that most adjustments to regulatory capital measures be made to CET1 and not to the other components of capital and (iv) expands the scope of the adjustments as compared to existing regulations. Financial institutions are also required to maintain a minimum "capital conservation buffer" to avoid restrictions on capital distributions such as dividends and equity repurchases and other payments such as discretionary bonuses to executive officers.

The Basel III capital rules require Tompkins to maintain minimum capital ratios, which include an additional capital conservation buffer of 2.5%, as follows: (i) a minimum ratio of CET1 to risk-weighted assets of 7.0%, (ii) a minimum ratio of Tier 1 capital to risk-weighted assets of 8.5%, (iii) a minimum ratio of Total capital (that is, Tier 1 plus Tier 2) to risk-weighted assets of 10.5%, and (iv) a minimum leverage ratio of 4.0%, calculated as the ratio of Tier 1 capital to average assets. Banking institutions that fail to meet the effective minimum ratios once the capital conservation buffer is taken into account, as detailed above, will be subject to constraints on capital distributions, including dividends and share repurchases, and certain discretionary executive compensation. The severity of the constraints depends on the amount of the shortfall and the institution’s "eligible retained income" (that is, the greater of (i) net income for the preceding four quarters, net of distributions and associated tax effects not reflected in net income and (ii) average net income over the preceding four quarters).

The Federal Deposit Insurance Act ("FDIA") requires federal banking agencies to take "prompt corrective action" ("PCA") should an insured depository institution fail to meet certain capital adequacy standards. If an insured depository institution is classified in one of the undercapitalized categories, it is required to submit a capital restoration plan to the appropriate federal banking agency and the holding company must guarantee the performance of that plan. Based upon its capital levels, a bank that is classified as well-capitalized, adequately capitalized or undercapitalized, may be treated as though it were in the next lower capital category if the appropriate federal banking agency, after notice and opportunity for hearing, determines that an unsafe or unsound condition or an unsafe or unsound practice, warrants such treatment. A depository institution is deemed to be “well-capitalized” if the institution has a total risk-based capital ratio of 10.0% or greater, a CET1 ratio of 6.5% or greater, a Tier 1 risk-based capital ratio of 8.0% or greater, and a leverage ratio of 5.0% or greater, and the institution is not subject to an order, written agreement, capital directive or prompt corrective action directive to meet and maintain a specific level for any capital measure.

For further information concerning the regulatory capital requirements, actual capital amounts and the ratios of Tompkins and Tompkins Community Bank, see the discussion in "Note 19 - Regulations and Supervision" in the Notes to Consolidated Financial Statements in Part II, "Item 8. Financial Statements and Supplementary Data" of this Report on Form 10-K.

Deposit Insurance

Substantially all of Tompkins Community Bank's deposits are insured up to applicable limits by the Deposit Insurance Fund ("DIF") of the FDIC and are subject to deposit insurance assessments to maintain the DIF. The Dodd-Frank Act permanently increased the maximum amount of deposit insurance to $250,000 per deposit category, per depositor, per institution retroactive to January 1, 2008.

Tompkins Community Bank pays deposit insurance premiums to the FDIC based on assessment rates established by the FDIC. Deposit insurance premiums are based on assets. The FDIC calculates deposit insurance assessment rates for established small banks, generally those banks with less than $10 billion of assets that have been insured for at least five years, using the CAMELS rating system and other factors. The CAMELS rating system is a supervisory rating system designed to take into account and reflect all financial and operational risks that a bank may face, including capital adequacy, asset quality, management capability, earnings, liquidity and sensitivity to market risk. To determine a bank’s assessment rate, each of seven financial ratios and a weighted average of CAMELS component ratings are multiplied by a corresponding pricing multiplier. The sum of these products is added to a uniform amount, with the resulting sum being an institution’s initial base assessment rate (subject to minimum or maximum assessment rates based on a bank’s CAMELS composite rating). This method takes into account various measures, including an institution’s leverage ratio, brokered deposit ratio, one year asset growth, the ratio of net income before taxes to total assets, and considerations related to asset quality.

On June 21, 2022, the FDIC adopted an Amended Restoration Plan and a notice of proposed rulemaking to increase the likelihood that the reserve ratio would be restored to at least 1.35% by September 30, 2028. The FDIC's Board of Directors also increased initial base deposit insurance assessment rate schedules uniformly by 2 basis points, effective in the first quarterly assessment period of 2023.

On November 16, 2023, the FDIC issued a final rule implementing a special assessment to recover the loss to the DIF arising from the protection of uninsured depositors following the closures of Silicon Valley Bank and Signature Bank. The assessment base for the special assessment is equal to a bank's estimated uninsured deposits, reported for the quarter ended December 31,

2022, adjusted to exclude the first $5 billion in estimated uninsured deposits from the bank, or for banks that are part of a holding company with one or more subsidiary banks, at the banking organization level. The Company is not subject to the special assessment as its uninsured deposits for the December 31, 2022, reporting period, the measurement period for the special assessment, were below the $5 billion exclusion.

Under the FDIA, the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.

FDIC insurance expense totaled $5.7 million, $4.3 million, and $2.8 million in 2024, 2023 and 2022, respectively.

Depositor Preference

The FDIA provides that, in the event of the "liquidation or other resolution" of an insured depository institution, such as Tompkins Community Bank, the claims of depositors of the institution, including the claims of the FDIC, as subrogee of the insured depositors, and certain claims for administrative expenses of the FDIC as receiver, will have priority over other general unsecured claims against the institution. If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors, including the parent bank holding company, with respect to any extensions of credit they have made to such insured depository institutions, as well as the shareholders of the parent bank holding company, who are unlikely to recover in the event a bank holding company's sole bank subsidiary fails.

Community Reinvestment Act ("CRA")

The CRA and the regulations issued thereunder are intended to encourage banks to help meet the credit needs of their entire service area, including low- and moderate-income neighborhoods, consistent with the safe and sound operations of such banks. These regulations also provide for regulatory assessment of a bank’s record in meeting the needs of its service area when considering applications to establish branches, merger applications and applications to acquire the assets and assume the liabilities of another bank. As of December 31, 2024, the Company’s subsidiary bank had a CRA rating of satisfactory.

On October 24, 2023, the Federal Reserve Board, FDIC, and OCC issued a joint final rule that amends the regulations implementing the Community Reinvestment Act to better achieve the purposes of the law. The changes are designed to

•Encourage banks to expand access to credit, investment, and basic banking services in low-and moderate-income communities.

•Adapt to changes in the banking industry, including internet and mobile banking.

•Provide greater clarity, consistency, and transparency in the application of CRA regulations.

•Tailor CRA evaluations and data collection to bank size and type.

Most of the final rule's requirements have an effective date of January 1, 2026. The remaining requirements, including data reporting requirements become applicable on January 1, 2027. While the final rule is currently enjoined as to a group of trade associations while a federal court considers a lawsuit filed by those trade associations challenging the rule, the Company continues to prepare for compliance with the amendments.

Federal Securities Laws

The common stock of the Company is registered with the SEC under the Exchange Act. Therefore, the Company is subject to the reporting, information disclosure, proxy solicitation and other requirements imposed on public companies by the SEC under the Exchange Act. Additionally, Company insiders are subject to securities trading limitations and are required to file insider ownership reports with the SEC. The SEC and NYSE American have adopted regulations under the Sarbanes-Oxley Act of 2002 ("Sarbanes-Oxley") and the Dodd-Frank Act that apply to the Company as an exchange-traded, public company, which seek to improve corporate governance, accounting, and reporting requirements, provide enhanced penalties for financial reporting improprieties and improve the reliability of disclosures in SEC filings. For example, the Sarbanes-Oxley requirements include: (1) requirements for audit committees, including independence and financial expertise; (2) certification of financial statements by the chief executive officer and chief financial officer of reporting companies; (3) standards for auditors and regulation of audits; (4) disclosure and reporting requirements for reporting companies and their directors and executive officers; and (5) a range of civil and criminal penalties for fraud and other violations of securities laws.

Anti-Money Laundering and the USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 ("USA PATRIOT Act"), the Bank Secrecy Act of 1970 ("BSA"), the Money Laundering Control Act of 1986, and other federal laws, collectively impose obligations on all financial institutions, including the Company, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. The bank regulatory agencies have increased the regulatory scrutiny of the BSA and anti-money laundering programs maintained by financial institutions. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal and reputational consequences for the institution, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required.

The Anti-Money Laundering Act of 2020 ("AMLA"), which amends the BSA, was enacted in January 2021. The AMLA is intended to be a comprehensive reform and modernization to U.S. bank secrecy and anti-money laundering laws. Among other things, it codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the development of standards for evaluating technology and internal processes for BSA compliance; and expands enforcement- and investigation-related authority, including increasing available sanctions for certain BSA violations and instituting BSA whistleblower incentives and protections.

Financial Privacy

The Gramm-Leach-Bliley Act of 1999 ("GLBA") requires that financial institutions implement comprehensive written information security programs that include administrative, technical and physical safeguards designed to protect consumer information. Under the GLBA, federal banking regulators adopted rules that limit the ability of banks and other financial institutions to disclose non-public information about consumers to non-affiliated third parties. These limitations require disclosure of privacy policies and certain security breaches to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a non-affiliated third party. These provisions affect, among other things, how consumer information is transmitted through diversified financial companies and conveyed to outside vendors.

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, designated nationals and others. These are known as the "OFAC" rules based on their administration by the U.S. Treasury Department Office of Foreign Assets Control ("OFAC"). The OFAC-administered sanctions targeting designated countries take many different forms. Generally, however, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on "U.S. persons" engaging in financial transactions relating to making investments in, or providing investment-related advice or assistance to, a sanctioned country; and (ii) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to a U.S. jurisdiction (including property in the possession or control of U.S. persons). These sanctions that are applicable to countries and individuals also are imposed against some non-governmental organizations, associations, or other criminal networks. Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, strategic and reputational consequences, and result in civil money penalties against the Company and Tompkins Community Bank.

Consumer Protection Laws

In connection with its lending and leasing activities, Tompkins Community Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending. These consumer financial laws include the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Fair and Accurate Credit Transaction Act, Electronic Funds Transfer Act, the Expedited Funds Availability Act, the Truth in Lending Act, the Truth in Savings Act, the Home Mortgage Disclosure Act, and the Real Estate Settlement Procedures Act, and similar laws at the state level. Tompkins Community Bank's failure to comply with any of the consumer financial laws can result in civil actions, regulatory enforcement action by the federal banking agencies and the U.S. Department of Justice.

Additionally, the Dodd-Frank Act established the Consumer Financial Protection Bureau ("CFPB") with broad powers to supervise and enforce consumer protection laws. The CFPB has broad rule-making authority for a wide range of consumer protection laws that apply to all banks and savings institutions, including the authority to prohibit "unfair, deceptive or abusive" acts and practices. The CFPB has examination and enforcement authority over all banks and savings institutions with more than $10 billion in assets. Tompkins Community Bank is required to comply with the rules of the CFPB; however, these rules are generally enforced by our primary regulator, the FDIC.

Cybersecurity

The Company is subject to data security standards and privacy and data breach notice requirements as established by federal and state regulators. See Item 1C. Cybersecurity for a detailed discussion of cybersecurity and Item 1A. Risk Factors for a discussion of risks related to cybersecurity.

Incentive Compensation

The Dodd-Frank Act required the federal bank regulatory agencies and the SEC to establish joint regulations or guidelines prohibiting incentive-based payment arrangements at specified regulated entities, such as the Company, having at least $1 billion in total assets that encourage inappropriate risks by providing an executive officer, employee, director or principal shareholder with excessive compensation, fees, or benefits or that could lead to material financial loss to the entity. In addition, these regulators must establish regulations or guidelines requiring enhanced disclosure to regulators of incentive-based compensation arrangements. The agencies proposed such regulations in May 2016, and in May 2024 reproposed the text of the 2016 proposed regulations. If these or other regulations are adopted in a form similar to that initially proposed, they will impose limitations on the manner in which the Company may structure compensation for its executives. Given the uncertainty at this time whether or when a final rule will be adopted, management cannot determine the potential impact on the Company.

In October 2022, the SEC adopted a final rule pursuant to the Dodd-Frank Act directing the national securities exchanges and associations, including the NYSE American LLC, on which the Company's stock is listed for trading, to implement listing standards that require listed companies to adopt policies mandating the recovery or “clawback” of incentive-based, executive compensation in connection with accounting restatements due to material noncompliance with federal securities laws. The NYSE American's listing standards pursuant to the SEC's rule became effective in October 2023. The Company has adopted a clawback policy that is intended to comply with the NYSE American listing standards.The Company's rights under this policy to recover excess incentive compensation are in addition to any other remedies available to the Company under applicable law, policy or agreement, including without limitation those rights described under Section 304 of Sarbanes-Oxley.

Additionally, the FRB, OCC and FDIC have issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors. Management believes the current and past compensation practices of the Company do not encourage excessive risk taking or undermine the safety and soundness of the organization.

The FRB reviews, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Company, that are not "large, complex banking organizations." The findings of the supervisory initiatives are included in reports of examination and deficiencies can lead to limitations on the Company’s abilities and even enforcement actions.

The Company is also subject to the NYSDFS' "Guidance on Incentive Compensation Arrangements," applicable to all New York state regulated banks (including Tompkins Community Bank), which provides that incentive compensation may not be tied to employee performance indicators unless the bank has effective risk management, oversight and control systems in place. We believe the Company is compliant with all applicable state and federal regulations regarding incentive compensation.

Climate-Related Risk and Disclosure

In recent years, federal, state and international lawmakers and regulators have increased their focus on financial institutions' and other companies' risk oversight, disclosures and practices in connection with climate change and other environmental, social and governance (“ESG”) matters. For example, in March 2024, the SEC issued a final rule which would require public issuers, including us, to significantly expand the scope of climate-related disclosures in their SEC filings. However, on April 4, 2024, the SEC issued a stay of the final rule pending the completion of judicial review of petitions seeking review of the final rules, and as of the date of this Report, the SEC's stay of the final rule remained in place.

On October 21, 2021, the Financial Stability Oversight Council published a report identifying climate-related financial risks as an “emerging threat” to financial stability. On October 24, 2023, the OCC, the FDIC and the Federal Reserve jointly finalized principles for climate-related financial risk management for national banks with more than $100 billion in total assets. Although these risk management principles do not apply to Tompkins directly based upon our current size, the OCC has indicated that all banks, regardless of their size, may have material exposures to climate-related financial and other risks that require prudent management. As climate-related supervisory guidance is formalized, and relevant risk areas and corresponding control expectations are further refined, we may be required to expend significant capital and incur compliance, operating, maintenance and remediation costs in order to conform to such requirements.

Other Governmental Initiatives

From time to time, legislative and regulatory initiatives are introduced in Congress and state legislatures, as well as by regulatory authorities. These initiatives may include proposals to expand or contract the powers of bank holding companies and depository institutions, proposals to change the financial institution regulatory environment, or proposals that affect public companies generally. Such legislation could change banking laws and the operating environment of Tompkins in substantial, but unpredictable ways. We cannot predict whether any such legislation will be enacted, and, if enacted, the effect that it, or any implementing regulations would have on our financial condition or results of operations.

Employees and Human Capital

Tompkins' culture is underpinned by its core values, including a commitment to our employees. As of December 31, 2024, the Company had 1,011 total employees, which included 941 full-time employees and 70 part-time and temporary employees. Of the Company’s total employees, 846 are employed by Tompkins Community Bank, and 165 employees are employed by our subsidiary Tompkins Insurance Agencies, Inc. No employees are covered by a collective bargaining agreement, and the Company believes its employee relations are excellent.

The Company’s demand for qualified candidates at all levels of its organization grows as the Company’s business grows. In 2024, Tompkins' centralized Talent Acquisition Team reported challenges in recruiting and retaining qualified talent in our insurance sales positions due to competition for a limited number of experienced individuals. The Company is also mindful of macroeconomic factors impacting the financial services industry, such as inflation and continued low unemployment in all four of its markets, and it routinely undertakes a salary and benefit review to confirm that its total compensation is aligned with the market.

A key component of the Company's recruitment and retention strategy is to offer employees at all levels the opportunity to participate in the Company’s success. The Company maintains a robust Profit-Sharing plan for all employees who meet minimum service requirements. As of December 31, 2024, 84% of all employees received a profit-sharing contribution during 2024. The Company also offers incentive and/or equity compensation plans or programs to employees at many levels of the Company and, as of December 31, 2024, 55% of all employees had an opportunity to earn supplemental compensation reflective of their position and overall contributions towards the Company’s strategic objectives. Another important tool in the Company's recruiting and retention strategy is the availability of a remote or hybrid scheduling option for the majority of team members. As of the date of this report, just under half of the Company's employees have taken advantage of this opportunity.

The Company continues to broaden the scope of its talent development initiatives across its geographically diverse footprint in order to sustain a value-driven and growth-oriented environment where employees can perform at their peak and the next generation of leaders are prepared to lead. The Company offers an array of programs including continuing education dedicated to strengthen employee engagement, personal accountability, productivity, and emotional well-being including customized programs, growth-focused coaching sessions, career-path roadmaps, curated learning resources and tuition assistance. The Company provides a blend of in person and virtual learning environments to ensure opportunities are available to all team members across its footprint. The Company also has a robust talent review and succession process. Significant time is spent at the Senior Leadership and Management level identifying and providing development for potential successors.

The Company strives to promote a culture where all people feel welcome to be our customers, employees, directors, and shareholders. Our leadership team sponsors initiatives and events that recognize and engage our employees, and strengthen our employees’ sense of belonging within our organization. These initiatives include educational opportunities, celebrating cultural events, and sponsoring local teams that enhance our employee engagement. These Local Acorn Community Alliance teams were established in each of the Company's markets to support our external service efforts, through their focus on providing education and volunteering opportunities that meet the needs of their local communities.

Available Information

The Company maintains a website at www.tompkinsfinancial.com. The Company makes available free of charge through its website its annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, its proxy statements related to its shareholders’ meetings, and amendments to these reports or statements, filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act, as soon as reasonably practicable after the Company electronically files such material with, or furnishes such material to, the SEC. Copies of these reports are also available at no charge to any person who requests them, with such requests directed to Tompkins Financial Corporation, Investor Relations Department, P.O. Box 460, Ithaca, New

York 14851, telephone no. (888) 503-5753. The SEC maintains an Internet website that contains reports, proxy and information statements and other information regarding issuers that file electronically with the SEC, including material filed by the Company, at www.sec.gov. The information contained on the Company's website is provided for the information of the reader and they are not intended to be active links. The Company is not including the information contained on the Company’s website as a part of, or incorporating it by reference into, this Annual Report on Form 10-K, or into any other report filed with or furnished to the SEC by the Company.