COMMUNITY FINANCIAL SYSTEM, INC.

Previous wording

The Company’s liquidity and ability to fund and run its business could be materially adversely affected by a variety of conditions and factors, including financial and credit market disruptions and volatility, a lack of market or customer confidence in financial markets in general, or deposit competition based on interest rates, which may result in a loss of customer deposits or outflows of cash or collateral and/or adversely affect the Company’s ability to access capital markets on favorable terms. Other conditions and factors that could materially adversely affect the Company’s liquidity and funding include a lack of market or customer confidence in, or negative news about, the Company or the financial services industry generally which also may result in a loss of deposits and/or negatively affect the Company’s ability to access the capital markets; the loss of customer deposits due to reductions in customer savings rates, increased spending due to inflation, or other factors including shifting to alternative investments; counterparty availability; interest rate fluctuations; general economic conditions; and the legal, regulatory, accounting and tax environments governing the Company’s funding transactions. The possibility of a funding crisis exists at all financial institutions. A funding crisis would most likely result from a shock to the financial system that disrupts orderly short-term funding operations or from a significant tightening of monetary policy that limits the national money supply. Many of the foregoing conditions and factors may be caused by events over which the Company has little or no control. There can be no assurance that significant disruption and volatility in the financial markets will not occur in the future. Further, the Company’s customers may be adversely impacted by such conditions, which could have a negative impact on the Company’s business, financial condition and results of operations.

Current wording

The Company’s liquidity and ability to fund and run its business could be materially adversely affected by a variety of conditions and factors, including financial and credit market disruptions and volatility, a lack of market or customer confidence in financial markets in general, or deposit competition based on interest rates, which may result in a loss of customer deposits or outflows of cash or collateral and/or adversely affect the Company’s ability to access capital markets on favorable terms. Other conditions and factors that could materially adversely affect the Company’s liquidity and funding include a lack of market or customer confidence in, or negative news about, the Company or the financial services industry generally which also may result in a loss of deposits and/or negatively affect the Company’s ability to access the capital markets; the loss of customer deposits due to reductions in customer savings rates, increased spending due to inflation, or other factors including shifting to alternative investments such as stablecoins; counterparty availability; interest rate fluctuations; general economic conditions; and the legal, regulatory, accounting and tax environments governing the Company’s funding transactions. The possibility of a funding crisis exists at all financial institutions. A funding crisis would most likely result from a shock to the financial system that disrupts orderly short-term funding operations or from a significant tightening of monetary policy that limits the national money supply. Many of the foregoing conditions and factors may be caused by events over which the Company has little or no control. There can be no assurance that significant disruption and volatility in the financial markets will not occur in the future. Further, the Company’s customers may be adversely impacted by such conditions, which could have a negative impact on the Company’s business, financial condition and results of operations.

Previous wording

Regulatory agencies, including the CPFB, may introduce new regulatory initiatives or pursue more aggressive enforcement policies with respect to a range of regulatory compliance matters. Regulators continue to focus on consumer protection, including product design and pricing constructs, account management and security, credit bureau reporting, disclosure rules, marketing and debt collection practices. New initiatives by applicable regulatory agencies may significantly limit the types and the terms of the products the Company may offer and the fees it may charge for its services which may have a material impact on the Company’s fee income. Any new requirements or increased enforcement of existing requirements could materially and adversely impact the Company’s revenue growth and profitability, including, as a result of increased scrutiny of pricing, underwriting and account management practices; the imposition of fines and customer remediation; higher compliance costs; reputational harm; restrictions on the Company’s ability to offer certain products or services, appropriately price for the value of products or work with certain business partners; and changes to business practices generally. The Company may also be required to add additional compliance personnel or incur other significant compliance-related expenses. The Company’s business, results of operations or competitive position may be adversely affected as a result.

Current wording

Regulatory agencies may introduce new regulatory initiatives or pursue more aggressive enforcement policies with respect to a range of regulatory compliance matters. Regulators continue to focus on consumer protection, including product design and pricing constructs, account management and security, credit bureau reporting, disclosure rules, marketing and debt collection practices. New initiatives by applicable regulatory agencies may significantly limit the types and the terms of the products the Company may offer and the fees it may charge for its services which may have a material impact on the Company’s fee income. Any new requirements or increased enforcement of existing requirements could materially and adversely impact the Company’s revenue growth and profitability, including, as a result of increased scrutiny of pricing, underwriting and account management practices; the imposition of fines and customer remediation; higher compliance costs; reputational harm; restrictions on the Company’s ability to offer certain products or services, appropriately price for the value of products or work with certain business partners; and changes to business practices generally. The Company may also be required to add additional compliance personnel or incur other significant compliance-related expenses. The Company’s business, results of operations or competitive position may be adversely affected as a result.

Previous wording

Legislators and regulators are increasingly adopting or revising privacy, data protection, data management, resiliency, data transfer, third party oversight, account access, artificial intelligence and machine learning and information security and cybersecurity laws, including data localization, authentication and notification laws. As such laws are interpreted and applied (in some cases, with significant differences or conflicting requirements across jurisdictions), compliance and technology costs will continue to increase, particularly in the context of ensuring that adequate privacy, data protection, data management, incident management, resiliency, third party management, data transfer, security controls, account access mechanisms and controls related to artificial intelligence and machine learning are in place. Additionally, new laws and regulations related to automated decision making, artificial intelligence and machine learning as well as the application of existing laws and regulations to these technologies may restrict or impose burdensome and costly requirements on the Company’s ability to use them or impact other aspects of the Company’s business.

Current wording

Legislators and regulators are increasingly adopting or revising privacy, data protection, data management, resiliency, data transfer, third-party oversight, account access, artificial intelligence (“AI”) and machine learning and information security and cybersecurity laws, including data localization, authentication and notification laws. As such laws are interpreted and applied (in some cases, with significant differences or conflicting requirements across jurisdictions), compliance and technology costs will continue to increase, particularly in the context of ensuring that adequate privacy, data protection, data management, incident management, resiliency, third-party management, data transfer, security controls, account access mechanisms and controls related to artificial intelligence and machine learning are in place. Additionally, new laws and regulations related to automated decision making, artificial intelligence and machine learning as well as the application of existing laws and regulations to these technologies may restrict or impose burdensome and costly requirements on the Company’s ability to use them or impact other aspects of the Company’s business.

Previous wording

The methods used to obtain unauthorized access, disable or degrade service or sabotage systems are constantly evolving and may be difficult to anticipate or to detect for long periods of time. The constantly changing nature of the threats means that the Company may not be able to prevent all data security breaches or misuse of data. Any failure, interruption or breach in security of these systems could result in failures or disruptions in the Company’s online banking system, its general ledger, and its deposit and loan servicing and origination systems or other systems. Furthermore, if personal, confidential or proprietary information of customers or clients in the Company’s or third-party service providers’ possession were to be mishandled or misused, the Company could suffer significant regulatory consequences, reputational damage and financial loss. Such mishandling or misuse could include circumstances where, for example, such information was erroneously provided to parties who are not permitted to have the information, either by fault of the Company’s systems, employees, or counterparties, or where such information was intercepted or otherwise inappropriately taken by third parties. The Company has policies and procedures designed to prevent or limit the effect of the possible failure, interruption or security breach of its information systems; however, any such failure, interruption or security breach could adversely affect the Company’s business and results of operations through loss of assets or by requiring it to expend significant resources to correct the defect, as well as exposing the Company to customer dissatisfaction and civil litigation, regulatory fines or penalties or losses not covered by insurance.

Current wording

The methods used to obtain unauthorized access, disable or degrade service or sabotage systems are constantly evolving and may be difficult to anticipate or to detect for long periods of time. Cyberattacks can originate from a variety of sources, including foreign governments and third-parties affiliated with them, organized crime or terrorist organizations, and malicious individuals both outside and inside a targeted company, including through use of relatively new AI tools or methods that can be used to create deepfakes for impersonation or to enable attack campaigns more quickly and effectively. The constantly changing nature of the threats means that the Company may not be able to prevent all data security breaches or misuse of data. Any failure, interruption or breach in security of these systems could result in failures or disruptions in the Company’s online banking system, its general ledger, and its deposit and loan servicing and origination systems or other systems. Furthermore, if personal, confidential or proprietary information of customers or clients in the Company’s or third-party service providers’ possession were to be mishandled or misused, the Company could suffer significant regulatory consequences, reputational damage and financial loss. Such mishandling or misuse could include circumstances where, for example, such information was erroneously provided to parties who are not permitted to have the information, either by fault of the Company’s systems, employees, or counterparties, or where such information was intercepted or otherwise inappropriately taken by third parties. The Company has policies and procedures designed to prevent or limit the effect of the possible failure, interruption or security breach of its information systems; however, any such failure, interruption or security breach could adversely affect the Company’s business and results of operations through loss of assets or by requiring it to expend significant resources to correct the defect, as well as exposing the Company to customer dissatisfaction and civil litigation, regulatory fines or penalties or losses not covered by insurance.

Previous wording

The Company’s main markets are located in the states of New York, Pennsylvania, Vermont, Massachusetts, and New Hampshire. Most of the Company’s customers are individuals and small and medium-sized businesses which are dependent upon the regional economy. Accordingly, the local economic conditions in these areas have a significant impact on the demand for the Company’s products and services as well as the ability of the Company’s customers to repay loans, the value of the collateral securing loans and the stability of the Company’s deposit funding sources. An economic downturn in these markets could negatively impact the Company.

Current wording

The Company’s main markets are currently located in the states of New York, Pennsylvania, Vermont, Massachusetts, and New Hampshire. Most of the Company’s customers are individuals and small and medium-sized businesses which are dependent upon the regional economy. Accordingly, the local economic conditions in these areas have a significant impact on the demand for the Company’s products and services as well as the ability of the Company’s customers to repay loans, the value of the collateral securing loans and the stability of the Company’s deposit funding sources. An economic downturn in these markets could negatively impact the Company.

Previous wording

General political, economic, and social conditions in the U.S. and in countries abroad affect markets in the U.S. and ultimately the Company’s business. In particular, U.S. markets may be affected by the new government administration, including but not limited to government agency staff reductions and related operating issues, uncertainty related to policy changes that directly or indirectly impact consumer spending and business investment, the level and volatility of interest rates, availability and market conditions of financing, economic growth, historically high levels of inflation, supply chain disruptions, consumer spending, employment levels, labor shortages, wage escalation or stagnation, changes in home prices, commercial property values, the growth of global trade and commerce, the availability and cost of capital and credit, and investor sentiment and confidence. Additionally, U.S. energy and commodity markets may be adversely affected by the current or anticipated impact of climate change, extreme weather events or natural disasters, the emergence or continuation of widespread health emergencies or pandemics, cyberattacks or campaigns, military conflict, terrorism or other geopolitical events. The scarcity or unavailability of affordable casualty insurance on consumers’ homes and autos, as well as businesses’ property, plant, and equipment, would impair asset prices and have a negative impact on economic activity and growth. Also, any sudden or prolonged market downturn in the U.S., as a result of the above factors or otherwise, could result in a decline in net interest income and noninterest income and adversely affect the Company’s results of operations and financial condition, including capital and liquidity levels. The economic developments in connection with the pandemic, including supply chain disruptions, increased inflation, changes to the Company’s customers’ industries, and the potential emergence of pandemics and other health crises in the U.S. and abroad have adversely impacted and may continue to adversely impact financial markets and macroeconomic conditions and could result in additional market volatility and disruptions globally.

Current wording

General political, economic, and social conditions in the U.S. and in countries abroad affect markets in the U.S. and ultimately the Company’s business. In particular, U.S. markets may be affected by the current government administrationand the domestic political environment, including but not limited to government agency staff reductions and related operating issues, uncertainty related to policy changes that directly or indirectly impact consumer spending and business investment, the level and volatility of interest rates, availability and market conditions of financing, economic growth, historically high levels of inflation, supply chain disruptions, consumer spending, employment levels, labor shortages, wage escalation or stagnation, changes in home prices, commercial property values, the growth of global trade and commerce, the availability and cost of capital and credit, and investor sentiment and confidence. Additionally, U.S. energy and commodity markets may be adversely affected by the current or anticipated impact of climate change, extreme weather events or natural disasters, the emergence or continuation of widespread health emergencies or pandemics, cyberattacks or campaigns, military conflict, terrorism or other geopolitical events. The scarcity or unavailability of affordable casualty insurance on consumers’ homes and autos, as well as businesses’ property, plant, and equipment, would impair asset prices and have a negative impact on economic activity and growth. Also, any sudden or prolonged market downturn in the U.S., as a result of the above factors or otherwise, could result in a decline in net interest income and noninterest income and adversely affect the Company’s results of operations and financial condition, including capital and liquidity levels.

Previous wording

Actions taken by the Federal Reserve Board, including changes in its target funds rate, balance sheet management, and lending facilities are beyond the Company’s control and difficult to predict. These actions can affect interest rates and the value of financial instruments and other assets and liabilities and can impact the Company’s borrowers. Sudden changes in monetary policy, for example in response to high inflation, could lead to financial market volatility, increases in market interest rates, and a flattening or inversion of the yield curve. For example, higher inflation, or volatility and uncertainty related to inflation, could reduce demand for the Company’s products, adversely affect the creditworthiness of the Company’s borrowers, or result in lower values for the Company’s investment securities and other interest-earning assets.

Current wording

Actions taken by the FRB, including changes in its target funds rate, balance sheet management, and lending facilities are beyond the Company’s control and difficult to predict. These actions can affect interest rates and the value of financial instruments and other assets and liabilities and can impact the Company’s borrowers. Sudden changes in monetary policy, for example in response to high inflation, could lead to financial market volatility, increases in market interest rates, and a flattening or inversion of the yield curve. For example, higher inflation, or volatility and uncertainty related to inflation, could reduce demand for the Company’s products, adversely affect the creditworthiness of the Company’s borrowers, or result in lower values for the Company’s investment securities and other interest-earning assets.

Previous wording

Recent negative developments affecting the banking industry have eroded customer confidence in the banking system and may have adverse impacts on the Company’s business.

Current wording

Certain negative developments affecting the banking industry have eroded customer confidence in the banking system and may have adverse impacts on the Company’s business.

Previous wording

The Company anticipates increased regulatory scrutiny, within the course of routine examinations and new regulations designed to address the recent negative developments in the banking industry, all of which may increase the Company’s costs of doing business and reduce its profitability.

Current wording

The Company anticipates increased regulatory scrutiny, within the course of routine examinations and new regulations designed to address certain negative developments in the banking industry, all of which may increase the Company’s costs of doing business and reduce its profitability.

Previous wording

At December 31, 2024, 9% of the loan portfolio was acquired and was not underwritten by the Company at origination, and therefore is not necessarily reflective of the Company’s historical credit risk experience. The Company performed extensive credit due diligence prior to each acquisition and marked the loans to fair value upon acquisition, with such fair valuation considering expected credit losses that existed at the time of acquisition. However, there is a risk that credit losses could be larger than currently anticipated, thus adversely affecting earnings.

Current wording

At December 31, 2025, 7% of the loan portfolio was acquired and was not underwritten by the Company at origination, and therefore is not necessarily reflective of the Company’s historical credit risk experience. The Company performed extensive credit due diligence prior to each acquisition and marked the loans to fair value upon acquisition, with such fair valuation considering expected credit losses that existed at the time of acquisition. However, there is a risk that credit losses could be larger than currently anticipated, thus adversely affecting earnings.