NBT BANCORP INC

NBT Bancorp Inc. is a registered financial holding company incorporated in the state of Delaware in 1986, with its principal headquarters located in Norwich, New York. The principal assets of NBT Bancorp Inc. consist of all of the outstanding shares of common stock of its subsidiaries, including: NBT Bank, National Association (the “Bank”), NBT Financial Services, Inc. (“NBT Financial”), NBT Holdings, Inc. (“NBT Holdings”), CNBF Capital Trust I, NBT Statutory Trust I, NBT Statutory Trust II, Alliance Financial Capital Trust I and Alliance Financial Capital Trust II (collectively, the “Trusts”). The principal sources of revenue for NBT Bancorp Inc. are the management fees and dividends it receives from the Bank, NBT Financial and NBT Holdings. Collectively, NBT Bancorp Inc. and its subsidiaries are referred to herein as (the “Company”). As of December 31, 2024, the Company had assets of $13.79 billion and stockholders’ equity of $1.53 billion on a consolidated basis.

The Company’s business, primarily conducted through the Bank, consists of providing commercial banking, retail banking and wealth management services primarily to customers in its market area, which includes upstate New York, northeastern Pennsylvania, southern New Hampshire, western Massachusetts, Vermont, southern Maine and central and northwestern Connecticut. The Company has been, and intends to remain, a community-oriented financial institution offering a variety of financial services. The Company’s business philosophy is to operate as a community bank with local decision-making, providing a broad array of banking and financial services to retail, commercial and municipal customers.

The financial condition and operating results of the Company are dependent on its net interest income, which is the difference between the interest and dividend income earned on its earning assets, primarily loans and securities and the interest expense paid on its interest-bearing liabilities, primarily deposits and borrowings. Among other factors, net income is also affected by provision for loan losses and noninterest income, such as service charges on deposit accounts, card services income, retirement plan administration fees, wealth management revenue including financial services and trust revenue, insurance services, bank owned life insurance income and gains/losses on securities sales, as well as noninterest expenses, such as salaries and employee benefits, technology and data services, occupancy, professional fees and outside services, office supplies and postage, amortization of intangible assets, loan collection and OREO expenses, advertising, FDIC assessment expenses and other expenses.

NBT Bank, National Association

The Bank, a full-service commercial bank formed in 1856, provides a broad range of financial products to individuals, corporations and municipalities throughout upstate New York, northeastern Pennsylvania, southern New Hampshire, western Massachusetts, Vermont, southern Maine and central and northwestern Connecticut.

Through its network of branch locations, the Bank offers a wide range of products and services tailored to individuals, businesses and municipalities. Deposit products offered by the Bank include demand deposit accounts, savings accounts, NOW accounts, MMDA and CD accounts. The Bank offers various types of each deposit account to accommodate the needs of its customers with varying rates, terms and features. Loan products offered by the Bank include indirect and direct consumer loans, home equity loans, mortgages, business banking loans and commercial loans, with varying rates, terms and features to accommodate the needs of its customers. The Bank also offers various other products and services through its branch network such as trust and investment services and financial planning and life insurance services. In addition to its branch network, the Bank also offers access to certain products and services electronically through 24-hour online, mobile and telephone channels that enable customers to check balances, make deposits, transfer funds, pay bills, access statements, apply for loans and access various other products and services.

NBT Financial Services, Inc.

Through NBT Financial, the Company operates EPIC Advisors, Inc. (“EPIC”), a national benefits administration firm which was acquired by the Company on January 21, 2005. Among other services, EPIC provides retirement plan administration. EPIC’s headquarters are located in Rochester, New York.

NBT Holdings, Inc.

Through NBT Holdings, the Company operates NBT Insurance Agency, LLC (“NBT Insurance”), a full-service insurance agency acquired by the Company on September 1, 2008. NBT Insurance is headquartered in Norwich, New York. NBT Insurance offers a full array of insurance products, including personal property and casualty, business liability and commercial insurance, tailored to serve the specific insurance needs of individuals as well as businesses in a range of industries operating in the markets served by the Company.

The Trusts

The Trusts were established to raise additional regulatory capital and to provide funding for certain acquisitions. CNBF Capital Trust I and NBT Statutory Trust I are Delaware statutory business trusts formed in 1999 and 2005, respectively, for the purpose of issuing trust preferred securities and lending the proceeds to the Company. In connection with the acquisition of CNB Bancorp, Inc., the Company formed NBT Statutory Trust II in February 2006 to fund the cash portion of the acquisition as well as to provide regulatory capital. In connection with the acquisition of Alliance Financial Corporation (“Alliance”), the Company acquired two statutory trusts, Alliance Financial Capital Trust I and Alliance Financial Capital Trust II, which were formed in 2003 and 2006, respectively. The Company guarantees, on a limited basis, payments of distributions on the trust preferred securities and payments on redemption of the trust preferred securities. The Trusts are VIEs for which the Company is not the primary beneficiary, as defined by FASB ASC. In accordance with ASC, the accounts of the Trusts are not included in the Company’s consolidated financial statements.

Operating Subsidiaries of the Bank

The Bank has four operating subsidiaries, NBT Capital Corp., Broad Street Property Associates, Inc., NBT Capital Management, Inc. and SBT Mortgage Service Corporation. NBT Capital Corp., formed in 1998, is a venture capital corporation. Broad Street Property Associates, Inc., formed in 2004, is a property management company. NBT Capital Management, Inc., formerly Columbia Ridge Capital Management, Inc., was acquired in 2016 and is a registered investment advisor that provides investment management and financial consulting services. SBT Mortgage Service Corporation, acquired in 2023 in connection with the Salisbury acquisition, is a passive investment company (“PIC”). The PIC holds loans collateralized by real estate originated or purchased by the Bank. Income of the PIC is exempt from the Connecticut Corporate Business Tax.

Segment Reporting

The Company has identified two reportable segments: Banking and Retirement Plan Administration. See Note 1 and Note 22 to the consolidated financial statements included in Item 8. Financial Statements and Supplementary Data, which are included elsewhere in this report.

Evans Bancorp, Inc. Merger

On September 9, 2024, the Company and the Bank, entered into an Agreement and Plan of Merger (the “Merger Agreement”) with Evans and Evans Bank, Evans’s subsidiary bank, and pursuant to which the Company will acquire Evans. Evans, with assets of approximately $2.19 billion at December 31 2024, is headquartered in Williamsville, New York. Its primary subsidiary, Evans Bank, is a federally-chartered national banking association operating 18 banking locations in Western New York.

Subject to the terms and conditions of the Merger Agreement, which has been approved by the boards of directors of each party, Evans will merge with and into the Company, with the Company as the surviving entity, and immediately thereafter, Evans Bank will merge with and into the Bank, with the Bank as the surviving bank (the “Merger”).

Under the terms of the Merger Agreement, each outstanding share of Evans common stock will be converted into the right to receive 0.91 shares of the Company’s common stock. In December 2024, NBT announced that it had received the regulatory approval from the OCC and the waiver from the Federal Reserve Bank of New York necessary to complete its acquisition of Evans. Also in December 2024, the shareholders of Evans voted to approve the Merger. Evans reported over 75% of the issued and outstanding shares of Evans were represented at a special shareholder meeting and over 96% of the votes cast were voted to approve the Merger. NBT and Evans anticipate closing the transaction in second quarter of 2025 in conjunction with the core system conversion, pending customary closing conditions.

The Company incurred acquisition expenses related to the Merger of $1.5 million for theyear ended December 31, 2024.

Salisbury Bancorp, Inc. Merger

On August 11, 2023, the Company completed its acquisition of Salisbury through the merger of Salisbury with and into the Company, with the Company as the surviving entity, and the merger of Salisbury Bank with and into the Bank, with the Bank as the surviving bank, for $161.7 million in stock. Salisbury Bank was a Connecticut-chartered commercial bank headquartered in Lakeville, Connecticut, operating 13 banking offices in northwestern Connecticut, the Hudson Valley region of New York, and southwestern Massachusetts. In connection with the acquisition, the Company issued 4.32 million shares of common stock and acquired approximately $1.46 billion of identifiable assets, including $1.18 billion of loans, $122.7 million in investment securities which were sold immediately after the merger, $31.2 million of core deposit intangibles and $4.7 million in a wealth management customer intangible, as well as $1.31 billion in deposits. As of the acquisition date, the fair value discount was $78.7 million for loans, net of the reclassification of the PCD allowance, and was $3.0 million for subordinated debt. The Company established a $14.5 million allowance for acquired Salisbury loans which included both the $5.8 million allowance for PCD loans reclassified from loans and the $8.8 million allowance for non-PCD loans recognized through the provision for loan losses.

The Company incurred acquisition expenses related to the Salisbury merger of $10.0 million for the year ended December 31, 2023 and $1.0 million for year ended December 31, 2022.

Competition

The financial services industry, including commercial banking, is highly competitive, and we encounter strong competition for deposits, loans and other financial products and services in our market area. The increasingly competitive environment is the result of the rate environment, changes in regulation, changes in technology and product delivery systems, additional financial service providers and the accelerating pace of consolidation among financial services providers. The Company competes for loans, deposits and customers with other commercial banks, savings and loan associations, securities and brokerage companies, mortgage companies, insurance companies, finance companies, money market funds, credit unions and other nonbank financial service providers.

The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. Banks, securities firms and insurance companies can merge under the umbrella of a financial holding company, which can offer virtually any type of financial service, including banking, securities underwriting, insurance (both agency and underwriting) and merchant banking. In addition, technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems.

Some of the Company’s nonbanking competitors have fewer regulatory constraints and may have lower cost structures. In addition, some of the Company’s competitors have assets, capital and lending limits greater than those of the Company, have greater access to capital markets and offer a broader range of products and services than the Company. These institutions may have the ability to finance wide-ranging advertising campaigns and may be able to offer lower rates on loans and higher rates on deposits than the Company can offer. Some of these institutions offer services, such as credit cards and international banking, which the Company does not directly offer.

Various in-state market competitors and out-of-state banks continue to enter or have announced plans to enter or expand their presence in the market areas where the Company currently operates. With the addition of new financial services providers within our market, the Company expects increased competition for loans, deposits and other financial products and services.

In order to compete with other financial services providers, the Company stresses the community nature of its banking operations and principally relies upon local promotional activities, personal relationships established by officers, directors and employees with the Company’s customers and specialized services tailored to meet the needs of the communities served. We also offer certain customer services, such as agricultural lending, that many of our larger competitors do not offer. While the Company’s position varies by market, the Company’s management believes that it can compete effectively as a result of local market knowledge, local decision making and awareness of customer needs. The Company has banking locations in forty-two counties in the states of New York, Pennsylvania, New Hampshire, Massachusetts, Vermont, Maine and Connecticut.

Data Privacy and Security Practices

The Company’s enterprise security strategy revolves around people, processes and technology. The Company implements a defense-in-depth strategy, integrating physical and logical controls within a layered security model to ensure comprehensive end-to-end protection of Company and client information. The high-level objective of the information security program is to protect the confidentiality, integrity and availability of all information assets in our environment. We accomplish this by building our program around six foundational control areas: program oversight and governance, safeguards and controls, security awareness training, service provider oversight, incident response and business continuity. The Company’s data security and privacy practices follow all applicable laws and regulations including the Gramm-Leach Bliley Act of 2001 (“GLBA”) and applicable privacy laws described under the heading “Supervision and Regulation” in this Item 1. Business section.

The controls identified in our enterprise security program are managed by various stakeholders throughout the Company and monitored by the information security team. All employees are required to complete information security and privacy training when they join the Company and then complete annual online training certification and ad hoc face to face trainings. The Company engages outside consultants to perform periodic audits of our information and data security controls and processes including penetration testing of the Company’s public facing websites and corporate networks. The Board requires the Company’s Information Security Officer to report to them the status of the overall information security and data privacy program on a recurring basis. More information can be located on the Company’s website www.nbtbank.com/Personal/Customer-Support/Fraud-Information-Center.

For more information regarding the Company’s cybersecurity policies and practices, see Item 1C. Cybersecurity below.

Human Capital Resources

At December 31, 2024, the Company had 2,083 full-time equivalent employees. The Company’s employees are not presently represented by any collective bargaining group.

Our employees are key to our success as an organization. We are committed to attracting, retaining and promoting top quality talent regardless of sex, sexual orientation, gender identity, race, color, national origin, age, religion and physical ability. We strive to identify and select the best candidates for all open positions based on qualifying factors for each job. We are dedicated to providing a workplace for our employees that is supportive and free of any form of discrimination or harassment; recognizing and rewarding our employees based on their individual results and performance as well as that of their department and the Company overall; and recognizing and respecting all of the characteristics and differences that make each of our employees unique.

We believe employing a workforce with a variety of backgrounds and experiences enhances our ability to serve our customers and our communities. By promoting and fostering a workforce that we believe is reflective of our customers and communities, we seek to better understand the financial needs of our prospects and customers and provide them with relevant financial service products. Understanding and supporting our community has always been a priority to us. Embracing diverse perspectives, experiences and backgrounds empowers employees to contribute and feel valued.

Investment in Our People

The Company’s focus on investing in our people includes key initiatives to attract, develop and retain our valued employees. Talent acquisition, retention, and the overall employee experience continue to be top priorities considering the challenging labor market.

The Company offers total rewards that address employees at various stages of their personal lives and careers. Productivity is enhanced when an organization supports employees in their efforts to manage their overall wellbeing, and in 2024 the Company launched an Employee Wellbeing strategy focusing on emotional, physical, financial, social and work-life goals. The strategy is supported by paid parental leave, more flexibility in work schedules, paid leave benefits, a retirement transition option, a comprehensive Employee Assistance Program with expanded coverage in 2025 and including various health guides. The Company’s incentive programs recognize employees at all levels and are designed to motivate employees to support the achievement of company success, with appropriate risk assessment and prevention measures designed to prevent fraud.

Engaging Employees

While our employee retention rate remains consistently high, we continue to place significant effort on retaining our valued employees through career planning conversations, an on-going coaching process, goal setting, individual development plans and enhanced communications, which all play a part in employee satisfaction. The themes of our 2024 Employee Engagement Survey centered around culture, leadership, employee growth and development, and communication. In the first quarter of 2025, we will conduct our next Employee Engagement Survey to learn about our progress. The results from the survey will continue to be used to define specific initiatives to enhance engagement around the organization and add clarity to our business strategies, decision making and corporate-led development programs.

Learning and Career Development

The Company’s main priority is to attract and retain top talent by encouraging and promoting internal development. All employees have access to the LinkedIn Learning Library, which is intended to make learning and development accessible in a concise, easily consumable format that enables employees to acquire the skills they need to achieve individual career aspirations. Currently, 85% of our employees are active in the learning library and are taking full advantage of this resource.

Our Personal Advancement Through Honing Self-Awareness program is designed to support employees who are new to the banking industry and need assistance in defining career goals. Employees voluntarily enroll in the program and find support in navigating their own career development through assessments, training and facilitated discussions with our Talent Development Business Partners. For employees who identify undergraduate or graduate degrees as a part of their development goals, the Company provides a tuition reimbursement program.

In addition to employee guided development, there are distinct programs strategically designed to attract top talent early in their careers and to further foster the growth and retention of our high potential and emerging leaders. These programs have been designed to meet the objectives outlined in our succession plan. Our Management Development Program aims to attract diverse talent, primarily college seniors by offering accelerated career advancement and mentoring with senior executives. The Company also offers two programs designed for high potential employees, one for employees with prior professional experience and another one targeted to our more experienced employees with direct leadership responsibility. Both programs include a mentor, a coach, 360-degree feedback, individual development plans, presentation skill development and increased visibility to executive leadership. All development programs are designed to be delivered in both virtual and in person learning environments. The Company also has a robust annual talent review and succession planning process that includes the Board and senior management.

Conduct and Ethics

The Board, senior management and the ethics committee have vigorously endorsed a no-tolerance stance for workplace harassment, biases and unethical behavior. The Company’s values-based Code of Business Conduct and Ethics is extensively communicated on our website and targeted internal communications platforms. Frequent training specific to managers and employees, regular publication of our whistleblower policy and reporting mechanisms provide framework to the Company’s motto of: “The right people. Doing the right things. In the right way.”

Community Engagement

The Company is engaged in the communities where we do business and where our employees and directors live and work. We live out our core value of community involvement through investments of both money and the time of our employees.

Through our active contribution program, administered by market-based committees with representation from all lines of business, the Company contributed over $2.3 million in 2024. Our teams’ efforts to distribute philanthropic resources across our footprint ensure alignment with local needs and support for hundreds of organizations that provide health and human services and promote education, affordable housing, economic development, the arts and agriculture.

A consistent way the Company and our employees support our communities across our markets is through giving to United Way chapters in the form of corporate pledges and employee campaign contributions. In 2024, these commitments resulted in nearly $365,000 in funding for United Way chapters that provide resources to local organizations offering critical education, financial, food security and health services.

In addition to corporate financial support of community organizations and causes, employees are encouraged and empowered to volunteer and be a resource in their communities. They invest their financial and other expertise as board members and serve in roles where they offer direct support to those in need by engaging in all kinds of volunteer activities. In 2024, the Company’s employees reported over 10,500 hours of volunteer service.

The NBT CEI-Boulos Impact Fund is a $10 million real estate equity investment fund with the Bank as the sole investor. The fund, launched in 2022, is designed to support individuals and communities with low- and moderate-income through investments in high-impact, community supported, CRE projects located within the Bank’s Community Reinvestment Act assessment areas in New York. A Social Impact Advisory Board was also appointed to review proposed investments based on each project’s social and environmental impact, alignment with community needs and community support. Areas of the fund’s targeted impact include: projects that support job creation; affordable and workforce housing; Main Street revitalization/historic preservation developments that do not contribute to displacement; developments that serve nonprofit organizations; and environmentally sustainable real estate developments.

In 2023, the NBT CEI-Boulos Impact Fund announced its first equity investment in The Flanigan Square Transformation Project that will provide affordable workforce housing and a grocery store in a historically underinvested North Central neighborhood in Troy as part of an approximately $75 million socially impactful, environmentally conscious, transit-oriented and community informed master plan. The NBT CEI-Boulos Impact Fund made a $3.84 million equity investment for a majority ownership stake in two of the three components of the project. Progress is continuing with this project with the Bargain Grocery opening in 2024 and Flanigan Square Lofts expected to open in early 2025.

Products

The Company offers a comprehensive array of financial products and services for consumers and businesses with options that are beneficial to unbanked and underbanked individuals. Deposit accounts include low balance savings and checking options that feature minimal or no monthly service fees, provide assistance rebuilding positive deposit relationships, and assistance for those just starting a new banking relationship. The NBT iSelect Account was introduced in 2021 and has received certification for meeting the Bank On National Account Standards every year since its inception. Over 18,000 NBT iSelect Accounts have been opened since 2021. These accounts feature no monthly charges for maintenance, inactivity or dormancy, no overdraft fees and no minimum balance requirement. An enhanced digital banking platform incorporates ready access through online and mobile services to current credit score information and a personal financial management tool for budget and expense tracking.

The Company is focused on making home ownership accessible to everyone in the communities we serve. Our suite of home lending products features innovative and flexible options, including government guaranteed programs like Federal Housing Administration (“FHA”), USDA Rural Housing Program and U.S. Department of Veterans Affairs (“VA”) loans. In addition, we have many offerings developed in house, including our Habitat for Humanity, Home in the City, Portfolio Housing Agency and Portfolio 97 programs. Our home lending team includes affordable housing loan originators, and we maintain longstanding relationships with affordable housing agency partners across our banking footprint that offer first-time homebuyer education programs and assistance with down payments and closing costs.

Environmental

The Company is focused on the environment and committed to business practices and activities that encourage sustainability and minimize our environmental impact. In larger facilities, the Company conserves energy through the use of building energy management systems and motion sensor lighting controls. In new construction and renovations, the Company incorporates high-efficiency mechanical equipment, LED lighting, and modern building techniques to reduce our carbon footprint wherever possible. The Company has an ongoing initiative to replace existing lighting with LED lighting to reduce energy consumption.

Services like mobile and online banking, remote deposit capture, electronic loan payments, eStatements and combined statements enable us to support all customers in their efforts to consume less fuel and paper. We continue to digitize loan origination and deposit account opening processes, reducing trips to the bank and paper documents for our customers. Across our footprint, we host community shred days with multiple confidential document destruction companies to promote safe document disposal and recycling.

Supervision and Regulation

The Company, the Bank and certain of its non-banking subsidiaries are subject to extensive regulation under federal and state laws. The regulatory framework applicable to bank holding companies and their subsidiary banks is intended to protect depositors, federal deposit insurance funds and the stability of the U.S. banking system. This system is not designed to protect equity investors in bank holding companies, such as the Company.

Set forth below is a summary of the significant laws and regulations applicable to the Company and its subsidiaries. The description that follows is qualified in its entirety by reference to the full text of the statutes, regulations and policies that are described. Such statutes, regulations and policies are subject to ongoing review by Congress and state legislatures and federal and state regulatory agencies. A change in any of the statutes, regulations or regulatory policies applicable to the Company and its subsidiaries could have a material effect on the results of the Company.

Overview

The Company is a registered bank holding company and financial holding company under the Bank Holding Company Act of 1956, as amended (the “BHC Act”), and is subject to the supervision of, and regular examination by, the FRB as its primary federal regulator. The Company is also subject to the jurisdiction of the SEC, and is subject to the disclosure and other regulatory requirements of the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended (the “Exchange Act”), as administered by the SEC. The Company’s common stock is listed on the NASDAQ Global Select market under the ticker symbol, “NBTB,” and the Company is subject to the NASDAQ rules.

The Bank is chartered as a national banking association under the National Bank Act. The Bank is subject to the supervision of, and to regular examination by, the OCC as its chartering authority and primary federal regulator. The Bank is also subject to the supervision and regulation, to a limited extent, of the FDIC as its deposit insurer. Financial products and services offered by the Company and the Bank are subject to federal consumer protection laws and implementing regulations promulgated by the Consumer Financial Protection Bureau (“CFPB”). The Company and the Bank are also subject to oversight by state attorneys general for compliance with state consumer protection laws. The Bank’s deposits are insured by the FDIC up to the applicable deposit insurance limits in accordance with FDIC laws and regulations. The non-bank subsidiaries of the Company and the Bank are subject to federal and state laws and regulations, including regulations of the FRB and the OCC, respectively.

Since the enactment of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”), U.S. banks and financial services firms have been subject to enhanced regulation and oversight. It is not clear at this time what the effects on the Company and the Bank will be of any legislation or regulatory changes that may be enacted or implemented by the Trump administration.

Federal Bank Holding Company Regulation

The Company is a bank holding company as defined by the BHC Act. The BHC Act generally limits the business of the Company to banking, managing or controlling banks and other activities that the FRB has determined to be so closely related to banking “as to be a proper incident thereto.” The Company has also qualified for and elected to be a financial holding company. Financial holding companies may engage in any activity, or acquire and retain the shares of a company engaged in any activity, that is either (1) financial in nature or incidental to such financial activity (as determined by the FRB in consultation with the Secretary of the Treasury), or (2) complementary to a financial activity and that does not pose a substantial risk to the safety and soundness of depository institutions or the financial system (as solely determined by the FRB). If a bank holding company seeks to engage in the broader range of activities permitted under the BHC Act for financial holding companies, (1) the bank holding company and all of its depository institution subsidiaries must be “well-capitalized” and “well-managed,” as defined in the FRB’s Regulation Y and (2) it must file a declaration with the FRB that it elects to be a “financial holding company.” In order for a financial holding company to commence any activity that is financial in nature, incidental thereto, or complementary to a financial activity, or to acquire a company engaged in any such activity permitted by the BHC Act, each insured depository institution subsidiary of the financial holding company must have received a rating of at least “satisfactory” in its most recent examination under the Community Reinvestment Act of 1977 (the “CRA”). See the section titled “Community Reinvestment Act of 1977” for further information relating to the CRA. The FRB has the power to order any bank holding company or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the FRB has reasonable grounds to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company.

Regulation of Mergers and Acquisitions

The BHC Act, the Bank Merger Act and other federal and state statutes regulate acquisitions of depository institutions and their holding companies. The BHC Act requires prior FRB approval for a bank holding company to acquire, directly or indirectly, 5% or more of any class of voting securities of a commercial bank or its parent holding company and for a company, other than a bank holding company, to acquire 25% or more of any class of voting securities of a bank or bank holding company (and sometimes a lower percentage if there are other indications of control). Under the Change in Bank Control Act, any person, including a company, may not acquire, directly or indirectly, control of a bank without providing 60 days’ prior notice and receiving a non-objection from the appropriate federal banking agency.

Under the Bank Merger Act, prior approval of the OCC is required for a national bank to merge with another bank where the national bank is the surviving bank or to purchase the assets or assume the deposits of another bank. In reviewing applications seeking approval of merger and acquisition transactions, the federal banking agencies will consider, among other criteria, the competitive effect and public benefits of the transactions, the capital position of the combined banking organization, the applicant’s performance record under the CRA and the effectiveness of the subject organizations in combating money laundering activities.

As a financial holding company, the Company is permitted to acquire control of non-depository institutions engaged in activities that are financial in nature and in activities that are incidental to financial activities without prior FRB approval. However, the BHC Act, as amended by the Dodd-Frank Act, requires prior written approval from the FRB or prior written notice to the FRB before a financial holding company may acquire control of a company with consolidated assets of $10 billion or more.

Capital Distributions

The principal source of the Company’s liquidity is dividends from the Bank. The OCC oversees the ability of the Bank to make capital distributions, including dividends. The OCC generally prohibits a depository institution from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the bank would thereafter be undercapitalized. The OCC’s prior approval is required if the total of all dividends declared by a national bank in any calendar year would exceed the sum of the bank’s net income for that year and its undistributed net income for the preceding two calendar years, less any required transfers to surplus. The National Bank Act also prohibits national banks from paying dividends that would be greater than the bank’s undivided profits after deducting statutory bad debt in excess of the bank’s allowance for loan losses.

The federal banking agencies have indicated that paying dividends that deplete a bank’s capital base to an inadequate level would be an unsafe and unsound banking practice and that banking organizations should generally pay dividends only out of current operating earnings. The appropriate federal regulatory authority is authorized to determine, based on the financial condition of a bank holding company or a bank, that the payment of dividends would be an unsafe or unsound practice and to prohibit such payment.

Affiliate and Insider Transactions

Transactions between the Bank and its affiliates, including the Company, are governed by Sections 23A and 23B of the Federal Reserve Act (the “FRA”) and the FRB’s implementation of Regulation W. An “affiliate” of a bank includes any company or entity that controls, is controlled by or is under common control with such bank. In a bank holding company context, at a minimum, the parent holding company of a bank and companies that are controlled by such parent holding company, are affiliates of the bank. Generally, Sections 23A and 23B of the FRA are intended to protect insured depository institutions from losses in transactions with affiliates. These sections place quantitative and qualitative limitations on covered transactions between the Bank and its affiliates and require that all transactions between a bank and its affiliates occur on market terms that are consistent with safe and sound banking practices.

Section 22(h) of the FRA and its implementation of Regulation O restricts loans to the Bank’s and its affiliates’ directors, executive officers and principal stockholders (“Insiders”). Under Section 22(h), loans to Insiders and their related interests may not exceed, together with all other outstanding loans to such persons and affiliated entities, the Bank’s loan-to-one borrower limit. Loans to Insiders above specified amounts must receive the prior approval of the Bank’s Board of Directors. Further, under Section 22(h) of the FRA, loans to directors, executive officers and principal stockholders must be made on terms substantially the same as offered in comparable transactions to other persons, except that such Insiders may receive preferential loans made under a benefit or compensation program that is widely available to the Bank’s employees and does not give preference to the Insider over the employees. Section 22(g) of the FRA places additional limitations on loans to the Bank’s and its affiliates’ executive officers.

Federal Deposit Insurance and Brokered Deposits

The FDIC’s deposit insurance limit is $250,000 per depositor, per insured bank, for each account ownership category, in accordance with applicable FDIC regulations. The Bank’s deposit accounts are fully insured by the FDIC Deposit Insurance Fund (the “DIF”) up to the deposit insurance limits in accordance with applicable laws and regulations.

The FDIC uses a risk-based assessment system that imposes insurance premiums based upon a risk matrix that takes into account a bank’s capital level and supervisory rating (“CAMELS rating”). The risk matrix uses different risk categories distinguished by capital levels and supervisory ratings. As a result of the Dodd-Frank Act, the base for deposit insurance assessments is the consolidated average assets less average tangible equity. Assessment rates are calculated using formulas that take into account the risk of the institution being assessed.

In November 2023, the FDIC announced a special assessment on all insured depository institutions with more than $5 billion in total assets, including the Bank, in order to recover the loss to the DIF associated with protecting uninsured depositors following the closures of Silicon Valley Bank and Signature Bank. The special assessment is being collected over an eight-quarter collection period, and potentially longer, beginning with the first quarterly assessment period of 2024. The assessment base for the special assessment is equal to an insured depository institution’s estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion. The Company’s uninsured deposits as of December 31, 2022 were under $5 billion and therefore the Company was not subject to this special assessment.

Under FDIC laws and regulations, no FDIC-insured depository institution can accept brokered deposits unless it is well-capitalized or unless it is adequately capitalized and receives a waiver from the FDIC. Applicable laws and regulations also limit the interest rate that any depository institution that is not well-capitalized may pay on brokered deposits.

Under the Federal Deposit Insurance Act (“FDIA”), the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC. The Bank’s management is not aware of any practice, condition or violation that might lead to the termination of its deposit insurance.

Federal Home Loan Bank System

The Bank is also a member of the FHLB of New York, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to the rules and requirements of the FHLB, including the requirement to acquire and hold shares of capital stock in the FHLB in an amount at least equal to the sum of 0.125% of mortgage related assets at the beginning of each year. The Bank was in compliance with FHLB rules and requirements as of December 31, 2024.

Debit Card Interchange Fees

The Dodd-Frank Act requires that any interchange transaction fee charged for a debit transaction be reasonable and proportional to the cost incurred by the issuer for the transaction. FRB regulations mandated by the Dodd-Frank Act limit interchange fees on debit cards to a maximum of 21 cents per transaction plus 5 bps of the transaction amount. The rule also permits a fraud-prevention adjustment of 1 cent per transaction conditioned upon an issuer developing, implementing and updating reasonably designed fraud-prevention policies and procedures. Issuers that, together with their affiliates, have less than $10 billion of assets, are exempt from the debit card interchange fee standards. In addition, FRB regulations prohibit all issuers, including the Company and the Bank, from restricting the number of networks over which electronic debit transactions may be processed to less than two unaffiliated networks.

In October 2023, the FRB issued a proposal under which the maximum permissible interchange fee for an electronic debit transaction would be the sum of 14.4 cents per transaction and 4 bps multiplied by the value of the transaction. Furthermore, the fraud-prevention adjustment would increase from a maximum of 1 cent to 1.3 cents per debit card transaction. The proposal would adopt an approach for future adjustments to the interchange fee cap, which would occur every other year based on issuer cost data gathered by the FRB from large debit card issuers. The comment period for this proposal ended in May 2024 but no final rule has been published to date. The extent to which any such proposed changes in permissible interchange fees will impact our future revenues is currently uncertain.

Source of Strength Doctrine

FRB policy requires bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. Section 616 of the Dodd-Frank Act codifies the requirement that bank holding companies serve as a source of financial strength to their subsidiary depository institutions. A bank holding company’s failure to meet its obligations to serve as a source of strength to its subsidiary banks will generally be considered by the FRB to be an unsafe and unsound banking practice or a violation of FRB regulations or both. As a result, the Company is expected to commit resources to support the Bank, including at times when the Company may not be in a financial position to provide such resources. Any capital loan by the Company to the Bank is subordinate in right of payment to deposits and to certain other indebtedness of such subsidiary banks. The U.S. Bankruptcy Code provides that, in the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

In addition, under the National Bank Act, if the Bank’s capital stock is impaired by losses or otherwise, the OCC is authorized to require payment of the deficiency by assessment upon the Company. If the assessment is not paid within three months, the OCC could order a sale of Bank stock held by the Company to cover any deficiency.

Capital Adequacy

In July 2013, the FRB, the OCC and the FDIC approved final rules (the “Capital Rules”) that established a new capital framework for U.S. banking organizations. The Capital Rules generally implement the Basel Committee on Banking Supervision’s (the “Basel Committee”) December 2010 final capital framework referred to as “Basel III” for strengthening international capital standards. The Capital Rules revised the definitions and the components of regulatory capital, as well as addressed other issues affecting the numerator in banking institutions’ regulatory capital ratios. The Capital Rules also addressed asset risk weights and other matters affecting the denominator in banking institutions’ regulatory capital ratios and replace the existing general risk-weighting approach with a more risk-sensitive approach.

The Capital Rules: (1) require a capital measure called “Common Equity Tier 1” (“CET1”) and related regulatory capital ratio of CET1 to risk-weighted assets; (2) specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting certain revised requirements; (3) mandate that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital; and (4) expand the scope of the deductions from and adjustments to capital as compared to existing regulations. Under the Capital Rules, for most banking organizations, including the Company, the most common form of Additional Tier 1 capital is non-cumulative perpetual preferred stock and the most common forms of Tier 2 capital are subordinated notes and a portion of the allocation for loan losses, in each case, subject to the Capital Rules’ specific requirements.

Pursuant to the Capital Rules, the minimum capital ratios are:

The Capital Rules also require a “capital conservation buffer,” composed entirely of CET1, on top of these minimum risk-weighted asset ratios. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer will face constraints on dividends, equity and other capital instrument repurchases and compensation based on the amount of the shortfall. The capital conservation buffer was phased in incrementally until when, on January 1, 2019, the capital conservation buffer was fully phased in, resulting in the capital standards applicable to the Company and the Bank including an additional capital conservation buffer of 2.5% of CET1, and effectively resulting in minimum ratios inclusive of the capital conservation buffer of (1) CET1 to risk-weighted assets of at least 7%, (2) Tier 1 capital to risk-weighted assets of at least 8.5% and (3) Total capital to risk-weighted assets of at least 10.5%. The risk-weighting categories in the Capital Rules are standardized and include a risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. government and agency securities, to 600% for certain equity exposures and resulting in higher risk weights for a variety of asset classes. The Capital Rules provide for a number of deductions from and adjustments to CET1.

In addition, under the prior general risk-based capital rules, the effects of AOCI items included in stockholders’ equity (for example, marks-to-market of securities held in the AFS portfolio) under GAAP were excluded for the purposes of determining regulatory capital ratios. Under the Capital Rules, the effects of certain AOCI items are not excluded; however, banking organizations not using the advanced approaches, including the Company and the Bank, were permitted to make a one-time permanent election to continue to exclude these items in January 2015. The Capital Rules also preclude certain hybrid securities, such as trust preferred securities issued after May 19, 2010, from inclusion in bank holding companies’ Tier 1 capital.

Management believes that the Company is in compliance with the targeted capital ratios.

Prompt Corrective Action and Safety and Soundness

Pursuant to Section 38 of the FDIA, federal banking agencies are required to take “prompt corrective action” (“PCA”) should an insured depository institution fail to meet certain capital adequacy standards. At each successive lower capital category, an insured depository institution is subject to more restrictions and prohibitions, including restrictions on growth, restrictions on interest rates paid on deposits, restrictions or prohibitions on payment of dividends and restrictions on the acceptance of brokered deposits. Furthermore, if an insured depository institution is classified in one of the undercapitalized categories, it is required to submit a capital restoration plan to the appropriate federal banking agency and the holding company must guarantee the performance of that plan. Based upon its capital levels, a bank that is classified as well-capitalized, adequately capitalized or undercapitalized, may be treated as though it were in the next lower capital category if the appropriate federal banking agency, after notice and opportunity for hearing, determines that an unsafe or unsound condition or an unsafe or unsound practice, warrants such treatment.

For purposes of PCA, to be: (1) well-capitalized, an insured depository institution must have a total risk based capital ratio of at least 10%, a Tier 1 risk based capital ratio of at least 8%, a CET1 risk based capital ratio of at least 6.5%, and a Tier 1 leverage ratio of at least 5%; (2) adequately capitalized, an insured depository institution must have a total risk based capital ratio of at least 8%, a Tier 1 risk based capital ratio of at least 6%, a CET1 risk based capital ratio of at least 4.5%, and a Tier 1 leverage ratio of at least 4%; (3) undercapitalized, an insured depository institution would have a total risk based capital ratio of less than 8%, a Tier 1 risk based capital ratio of less than 6%, a CET1 risk based capital ratio of less than 4.5%, and a Tier 1 leverage ratio of less than 4%; (4) significantly undercapitalized, an insured depository institution would have a total risk based capital ratio of less than 6%, a Tier 1 risk based capital ratio of less than 4%, a CET1 risk based capital ratio of less than 3%, and a Tier 1 leverage ratio of less than 3%; (5) critically undercapitalized, an insured depository institution would have a ratio of tangible equity to total assets that is less than or equal to 2%. At December 31, 2024, the Bank qualified as “well-capitalized” under applicable regulatory capital standards.

Bank holding companies and insured depository institutions may also be subject to potential enforcement actions of varying levels of severity by the federal banking agencies for unsafe or unsound practices in conducting their business or for violation of any law, rule, regulation, condition imposed in writing by the agency or term of a written agreement with the agency. In more serious cases, enforcement actions may include the issuance of directives to increase capital; the issuance of formal and informal agreements; the imposition of civil monetary penalties; the issuance of a cease and desist order that can be judicially enforced; the issuance of removal and prohibition orders against officers, directors and other institution-affiliated parties; the termination of the insured depository institution’s deposit insurance; the appointment of a conservator or receiver for the insured depository institution; and the enforcement of such actions through injunctions or restraining orders based upon a judicial determination that the FDIC, as receiver, would be harmed if such equitable relief was not granted.

Volcker Rule

Section 619 of the Dodd-Frank Act, commonly known as the Volcker Rule, restricts the ability of banking entities from: (1) engaging in “proprietary trading” and (2) investing in or sponsoring certain covered funds, subject to certain limited exceptions. Under the Economic Growth, Regulatory Reform and Consumer Protection Act (“EGRRCPA”), depository institutions and their holding companies with less than $10 billion in assets, are excluded from the prohibitions of the Volcker Rule. During 2020, the Company crossed the $10 billion threshold, accordingly, we are subject to the Volcker Rule again. Given the Company’s size and the scope of its activities, the implementation of the Volcker Rule did not have a significant effect on its consolidated financial statements.

Depositor Preference

The FDIA provides that, in the event of the “liquidation or other resolution” of an insured depository institution, the claims of depositors of the institution, including the claims of the FDIC as subrogee of insured depositors and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution. If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors, including the parent bank holding company, with respect to any extensions of credit they have made to such insured depository institution.

Consumer Protection and CFPB Supervision

The Dodd-Frank Act centralized responsibility for consumer financial protection by creating the CFPB, an independent agency charged with responsibility for implementing, enforcing and examining compliance with federal consumer financial laws. The Company grew its asset base in excess of $10 billion in 2020. The Company is now subject to the CFPB’s examination authority with regard to compliance with federal consumer financial laws and regulations, in addition to the OCC as the primary regulatory of the Bank. Under the Dodd-Frank Act, state attorneys general are also empowered to enforce rules issued by the CFPB.

The Company is subject to federal consumer financial statutes and the regulations promulgated thereunder including, but not limited to:

The Bank’s failure to comply with any of the consumer financial laws can result in civil actions, regulatory enforcement action by the federal banking agencies and the U.S. Department of Justice.

USA PATRIOT Act

The Bank Secrecy Act (“BSA”), as amended by the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA PATRIOT Act”), imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. Financial institutions also are required to respond to requests for information from federal banking agencies and law enforcement agencies. Information sharing among financial institutions for the above purposes is encouraged by an exemption granted to complying financial institutions from the privacy provisions of the GLBA and other privacy laws. Financial institutions that hold correspondent accounts for foreign banks or provide private banking services to foreign individuals are required to take measures to avoid dealing with certain foreign individuals or entities, including foreign banks with profiles that raise money laundering concerns and are prohibited from dealing with foreign “shell banks” and persons from jurisdictions of particular concern. The primary federal banking agencies and the Secretary of the Treasury have adopted regulations to implement several of these provisions. Since May 11, 2018, the Bank has been required to comply with the Customer Due Diligence Rule, which clarified and strengthened the existing obligations for identifying new and existing customers and explicitly included risk-based procedures for conducting ongoing customer due diligence. All financial institutions also are required to establish internal anti-money laundering programs. The effectiveness of a financial institution in combating money laundering activities is a factor to be considered in any application submitted by the financial institution under the Bank Merger Act. The Company has a BSA and USA PATRIOT Act Board-approved compliance program commensurate with its risk profile.

Identity Theft Prevention

The FCRA’s Red Flags Rule requires financial institutions with covered accounts (e.g., consumer bank accounts and loans) to develop, implement and administer an identity theft prevention program. This program must include reasonable policies and procedures to detect suspicious patterns or practices that indicate the possibility of identity theft, such as inconsistencies in personal information or changes in account activity.

Office of Foreign Assets Control Regulation

The United States government has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others. These are typically known as the “OFAC” rules based on their administration by the U.S. Treasury Department Office of Foreign Assets Control (“OFAC”). The OFAC-administered sanctions targeting countries take many different forms. Generally, they contain one or more of the following elements: (1) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments in or providing investment-related advice or assistance to a sanctioned country; and (2) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal and reputational consequences.

Financial Privacy and Data Security

The Company and the Bank are subject to federal laws, including the GLBA and certain state laws containing consumer privacy protection provisions. These provisions limit the ability of banks and other financial institutions to disclose nonpublic information about consumers to affiliated and non-affiliated third parties and limit the reuse of certain consumer information received from nonaffiliated financial institutions. These provisions require notice of privacy policies to clients and, in some circumstances, allow consumers to prevent disclosure of certain nonpublic personal information to affiliates or non-affiliated third parties by means of “opt out” or “opt in” authorizations.

The GLBA requires that financial institutions implement comprehensive written information security programs that include administrative, technical and physical safeguards to protect consumer information. Further, pursuant to interpretive guidance issued under the GLBA and certain state laws, financial institutions are required to notify clients of security breaches resulting in unauthorized access to their personal information. The Bank follows all GLBA obligations.

The Bank is also subject to data security standards, privacy and data breach notice requirements, primarily those issued by the OCC. The federal banking agencies, through the Federal Financial Institutions Examination Council, have adopted guidelines to encourage financial institutions to address cyber security risks and identify, assess and mitigate these risks, both internally and at critical third party services providers.

Community Reinvestment Act of 1977

The Bank has a responsibility under the CRA, as implemented by OCC regulations, to help meet the credit needs of the communities it serves, including low- and moderate-income neighborhoods. The CRA does not establish specific lending requirements or programs for financial institutions nor does it limit an institution’s discretion to develop the types of products and services that it believes are best suited to its particular community, consistent with the CRA. Regulators periodically assess the Bank’s record of compliance with the CRA. The Bank’s failure to comply with the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s most current CRA rating was “Satisfactory.”

Future Legislative and Regulatory Initiatives

Congress, state legislatures and financial regulatory agencies may introduce various legislative and regulatory initiatives that could affect the financial services industry, generally. Such initiatives may include proposals to expand or contract the powers of bank holding companies and/or depository institutions or proposals to substantially change the financial institution regulatory system. This includes changes in priorities and operations of regulatory agencies in connection with new leadership or otherwise. Such legislation or regulatory changes could change banking statutes and the regulatory and operating environment of the Company in substantial and unpredictable ways. If enacted or implemented, such legislation or regulatory changes could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among banks, savings associations, credit unions and other financial institutions. The Company cannot predict whether any such legislation will be enacted, and, if enacted, the effect that it or any implementing regulations would have on the financial condition or results of operations of the Company. A change in statutes, regulations or regulatory policies applicable to the Company or any of its subsidiaries could have a material effect on the business of the Company.

Available Information

The Company’s website is www.nbtbancorp.com. The Company makes available free of charge through its website its Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and any amendments to those reports as soon as reasonably practicable after such material is electronically filed with or furnished to the SEC pursuant to Section 13(a) or 15(d) of the Exchange Act. We also make available through our website other reports filed with or furnished to the SEC under the Exchange Act, including our proxy statements and reports filed by officers and directors under Section 16(a) of that Act, as well as our Code of Business Conduct and Ethics and other codes/committee charters. The references to our website do not constitute incorporation by reference of the information contained in the website and such information should not be considered part of this document.

This Annual Report on Form 10-K and other reports filed with the SEC are available on the SEC’s website, which contains reports, proxy and information statements and other information regarding issuers that file electronically with the SEC. The SEC’s website address is www.sec.gov.