FINANCIAL INSTITUTIONS INC

Previous wording

An investment in our common stock is subject to risks inherent to our business. The material risks and uncertainties that management believes could affect us are described below. Before making an investment decision, you should carefully consider the risks and uncertainties described below, together with all of the other information included or incorporated by reference herein. This Annual Report on Form 10-K is qualified in its entirety by these risk factors. Further, to the extent that any of the information contained in this Annual Report on Form 10-K constitutes forward-looking statements, the risk factors set forth below also are cautionary statements identifying important factors that could cause our actual results to differ materially from those expressed in any forward-looking statements made by or on behalf of us.

Current wording

An investment in our common stock is subject to risks inherent to our business. The material risks and uncertainties that management believe could affect us are described below. Before making an investment decision, you should carefully consider the risks and uncertainties described below, together with all of the other information included or incorporated by reference herein. This Annual Report on Form 10-K is qualified in its entirety by these risk factors. Further, to the extent that any of the information contained in this Annual Report on Form 10-K constitutes forward-looking statements, the risk factors set forth below also are cautionary statements identifying important factors that could cause our actual results to differ materially from those expressed in any forward-looking statements made by or on behalf of us.

Previous wording

As a bank, we are susceptible to fraudulent activity that may be committed against us or our clients, which may result in financial losses or increased costs to us or our clients, disclosure or misuse of our information or our client information, misappropriation of assets, privacy breaches against our clients, litigation or damage to our reputation. We are most subject to fraud and compliance risk in connection with the origination of loans, ACH transactions, wire transactions, ATM and ITM transactions, checking transactions, and debit cards that we have issued to our customers and through our online banking portals.

Current wording

As a bank, we are susceptible to fraudulent activity that may be committed against us or our clients, which may result in financial losses or increased costs to us or our clients, disclosure or misuse of our information or our client information, misappropriation of assets, privacy breaches against our clients, litigation or damage to our reputation. We are most subject to fraud and compliance risk in connection with the origination of loans, ACH transactions, wire transactions, ATM transactions, checking transactions, and debit cards that we have issued to our customers and through our online banking portals.

Previous wording

During the first quarter of 2024, the Bank experienced charge offs associated with fraudulent activity pertaining to deposit transactions conducted over the course of several business days ending in early March 2024 by an in-market business customer of the Bank. The deposit-related fraud event resulted in an $18.2 million pre-tax loss. The Bank is pursuing all available sources of recovery, including legal recourse, to minimize the loss. On December 2, 2024, the primary perpetrator of the fraud pled guilty in the United States District Court of the Western District of New York to two felonies – financial institutions fraud and money laundering. Among other things, the plea agreement requires the perpetrator to pay full restitution to the Bank. There can be no assurance that the Bank will be able to effect any further recovery or that the Bank will receive restitution from the perpetrator of the fraud, in whole or in part.

Current wording

While we have policies and procedures designed to prevent such losses, losses may occur. In March 2024, we experienced a loss associated with fraudulent activity pertaining to deposit transactions conducted over the course of several business days by an in-market business customer of the Bank, which resulted in an $18.2 million pre-tax loss.

Previous wording

At December 31, 2024, our portfolio of commercial business and commercial mortgage loans totaled $1.25 billion, or 28% of total loans. We plan to continue to emphasize the origination of these types of loans, which generally expose us to a greater risk of nonpayment and loss than residential real estate or consumer loans because repayment of such loans often depends on the successful operations and income stream of the borrowers. Additionally, such loans typically involve larger loan balances to single borrowers or groups of related borrowers compared to consumer loans or residential real estate loans. A sudden downturn in the economy, or a prolonged downturn for specific industries, could result in borrowers being unable to repay their loans, thus exposing us to increased credit risk.

Current wording

At December 31, 2025, our portfolio of commercial business and commercial mortgage loans totaled $3.08 billion, or 66% of total loans. We plan to continue to emphasize the origination of these types of loans, which generally expose us to a greater risk of nonpayment and loss than residential real estate or consumer loans because repayment of such loans often depends on the successful operations and income stream of the borrowers. Additionally, such loans typically involve larger loan balances to single borrowers or groups of related borrowers compared to consumer loans or residential real estate loans. A sudden downturn in the economy, or a prolonged downturn for specific industries, could result in borrowers being unable to repay their loans, thus exposing us to increased credit risk.

Previous wording

At December 31, 2024, our non-performing assets, which consist of non-performing loans and other real estate owned, were $41.5 million, or 0.68% of total assets. Our non-performing assets adversely affect our net income in various ways:

Current wording

At December 31, 2025, our non-performing assets, which consist of non-performing loans and other real estate owned, were $35.8 million, or 0.57% of total assets. Our non-performing assets adversely affect our net income in various ways:

Previous wording

In 2006, the federal bank regulatory agencies issued joint guidance entitled “Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices” (the “CRE Guidance”). Although the CRE Guidance did not establish specific lending limits, it provides that a bank’s commercial real estate lending exposure may receive increased supervisory scrutiny where total non-owner occupied commercial real estate loans, including loans secured by apartment buildings, investor commercial real estate and construction and land loans, represent 300% or more of an institution’s total risk-based capital and the outstanding balance of the commercial real estate loan portfolio has increased by 50% or more during the preceding 36 months. Our CRE level equaled 297% of total risk-based capital at December 31, 2024. If our regulators were to impose restrictions on the amount of commercial real estate loans we can hold in our portfolio, or require higher capital ratios as a result of the level of commercial real estate loans held, our earnings would be adversely affected.

Current wording

In 2006, the federal bank regulatory agencies issued joint guidance entitled “Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices” (the “CRE Guidance”). Although the CRE Guidance did not establish specific lending limits, it provides that a bank’s commercial real estate lending exposure may receive increased supervisory scrutiny where total non-owner occupied commercial real estate loans, including loans secured by apartment buildings, investor commercial real estate and construction and land loans, represent 300% or more of an institution’s total risk-based capital and the outstanding balance of the commercial real estate loan portfolio has increased by 50% or more during the preceding 36 months. Our CRE level equaled 295% of total risk-based capital at December 31, 2025. If our regulators were to impose restrictions on the amount of commercial real estate loans we can hold in our portfolio, or require higher capital ratios as a result of the level of commercial real estate loans held, our earnings would be adversely affected.

Previous wording

A portion of our lending involves the purchase of consumer automobile installment sales contracts from automobile dealers located in Western, Central and the Capital District of New York, and Northern and Central Pennsylvania. Effective January 1, 2024, we exited the Pennsylvania automobile market in order to align our focus more fully around our core Upstate New York market. These loans are for the purchase of new or used automobiles. We serve customers that cover a range of creditworthiness, and the required terms and rates are reflective of those risk profiles. While these loans have higher yields than many of our other loans, such loans involve risk elements in addition to normal credit risk. Additional risk elements associated with indirect lending include the limited personal contact with the borrower as a result of indirect lending through non-bank channels, namely automobile dealers. While indirect automobile loans are secured, such loans are secured by depreciating assets and characterized by loan-to-value ratios that could result in us not recovering the full value of an outstanding loan upon default by the borrower. State and federal laws may further limit our ability to recover outstanding principal balances on such loans. If the losses from our indirect loan portfolio are higher than anticipated, it could have a material adverse effect on our financial condition and results of operations.

Current wording

A portion of our lending involves the purchase of consumer automobile installment sales contracts from automobile dealers located in Western, Central and the Capital District of New York, and Northern and Central Pennsylvania prior to our planned exit from the Pennsylvania automobile market in 2024. These loans are for the purchase of new or used automobiles. We serve customers that cover a range of creditworthiness, and the required terms and rates are reflective of those risk profiles. While these loans have higher yields than many of our other loans, such loans involve risk elements in addition to normal credit risk. Additional risk elements associated with indirect lending include the limited personal contact with the borrower as a result of indirect lending through non-bank channels, namely automobile dealers. While indirect automobile loans are secured, such loans are secured by depreciating assets and characterized by loan-to-value ratios that could result in us not recovering the full value of an outstanding loan upon default by the borrower. State and federal laws may further limit our ability to recover outstanding principal balances on such loans. If the losses from our indirect loan portfolio are higher than anticipated, it could have a material adverse effect on our financial condition and results of operations.

Previous wording

At December 31, 2024, we had $3.56 billion of deposit liabilities, or 70% of our total deposits, that have no maturity and, therefore, may be withdrawn by the depositor at any time. These deposit liabilities include our checking, savings, and money market deposit accounts.

Current wording

At December 31, 2025, we had $3.52 billion of deposit liabilities, or 68% of our total deposits, that have no maturity and, therefore, may be withdrawn by the depositor at any time. These deposit liabilities include our checking, savings, and money market deposit accounts.

Previous wording

Market conditions may impact the competitive landscape for deposits in the banking industry. The interest rate environment and future actions of the Federal Reserve may impact pricing and demand for deposits in the banking industry. The withdrawal of more deposits than we anticipate could have an adverse impact on our profitability as this source of funding, if not replaced by similar deposit funding, would need to be replaced with wholesale funding, the sale of interest-earning assets, or a combination of these two actions. The replacement of deposit funding with wholesale funding could cause our overall cost of funding to increase, which would reduce our net interest income. A loss of interest-earning assets could also reduce our net interest income.

Current wording

Market conditions may impact the competitive landscape for deposits in the banking industry. National and local economic conditions, the interest rate environment and future actions of the Federal Reserve may impact pricing and demand for deposits in the banking industry. The withdrawal of more deposits than we anticipate could have an adverse impact on our profitability as this source of funding, if not replaced by similar deposit funding, would need to be replaced with wholesale funding, the sale of interest-earning assets, or a combination of these two actions. The replacement of deposit funding with wholesale funding could cause our overall cost of funding to increase, which would reduce our net interest income. A loss of interest-earning assets could also reduce our net interest income.

Previous wording

Municipal deposits are a significant source of funds for our lending and investment activities. At December 31, 2024, $1.07 billion, or 21% of our total deposits, consisted of municipal deposits from local government entities such as towns, cities, school districts and other municipalities, which are collateralized by letters of credit from the FHLB of New York (“FHLBNY”) and investment securities. These deposits may be more volatile than other deposits. If a significant amount of these deposits were withdrawn in a short period of time, it could have a negative impact on our short-term liquidity and have an adverse impact on our liquidity, business, financial condition and results of operations.

Current wording

Municipal deposits are a significant source of funds for our lending and investment activities. At December 31, 2025, $1.09 billion, or 21% of our total deposits, consisted of municipal deposits from local government entities such as towns, cities, school districts and other municipalities, which are collateralized by letters of credit from the FHLB of New York (“FHLBNY”) and investment securities. These deposits may be more volatile than other deposits. If a significant amount of these deposits were withdrawn in a short period of time, it could have a negative impact on our short-term liquidity and have an adverse impact on our liquidity, business, financial condition and results of operations.

Previous wording

Non-compliance with the USA PATRIOT Act and the Bank Secrecy Act could subject us to fines, sanctions or other negative actions.

Current wording

Non-compliance with the USA PATRIOT Act, the BSA, OFAC sanction regulations, or other applicable state and federal laws could subject us to fines, penalties, or other regulatory actions.

Previous wording

The policies of the Federal Reserve impact us significantly. The Federal Reserve regulates the supply of money and credit in the United States. Its policies directly and indirectly influence the rate of interest earned on loans and paid on borrowings and interest-bearing deposits and can also affect the value of financial instruments we hold. Those policies determine, to a significant extent, our cost of funds for lending and investing and impact our net interest income, our primary source of revenue. Changes in those policies are beyond our control and are difficult to predict. Federal Reserve policies can also affect our borrowers, potentially increasing the risk that they may fail to repay their loans. For example, a tightening of the money supply by the Federal Reserve could reduce the demand for a borrower’s products and services. This could adversely affect the borrower’s earnings and ability to repay its loan, which could have a material adverse effect on our financial condition and results of operations.

Current wording

The policies of the Federal Reserve impact us significantly. The Federal Reserve regulates the supply of money and credit in the United States. Its policies directly and indirectly influence the rate of interest earned on loans and paid on borrowings and interest-bearing deposits and can also affect the value of financial instruments we hold. Those policies determine, to a significant extent, our cost of funds for lending and investing and impact our net interest income, our primary source of revenue. Changes in those policies are beyond our control and are difficult to predict. Federal Reserve policies can also affect our borrowers, potentially increasing the risk that they may fail to repay their loans. For example, a tightening of the money supply by the Federal Reserve could reduce the demand for a borrower’s products and services. This could adversely affect the borrower’s earnings and ability to repay their loan, which could have a material adverse effect on our financial condition and results of operations.

Previous wording

Offering financial products and services to the cannabis industry presents a unique set of regulatory risks due to the conflict between state and federal laws. While the possession and sale of recreational marijuana is legal for adults aged 21 and older in New York State, cannabis remains classified as a Schedule I controlled substance under the federal Controlled Substances Act. In January 2018, under the first Trump administration, the DOJ rescinded the “Cole Memo” and related memoranda which characterized the enforcement of the Controlled Substances Act against persons and entities complying with state regulatory systems permitting the use, manufacture and sale of medical marijuana as an inefficient use of their prosecutorial resources and discretion. The impact of the DOJ’s rescission of the Cole Memo and related memoranda is unclear, but in the future may result in increased enforcement actions against the regulated cannabis industry generally. Under the Biden administration, the United States Attorney General indicated that the DOJ did not intend to pursue cases against parties who comply with the laws in states which have legalized and are effectively regulating marijuana. However, the second Trump administration took office on January 20, 2025, and enforcement policies and practices may be highly variable between political administrations. In addition, federal prosecutors have significant discretion and there can be no assurance that the federal prosecutor for any district in which we or our customers operate will not choose to strictly enforce the federal laws governing cannabis.

Current wording

Offering financial products and services to the cannabis industry presents a unique set of regulatory risks due to the conflict between state and federal laws. While the possession and sale of recreational marijuana is legal for adults aged 21 and older in New York State, cannabis remains classified as a Schedule I controlled substance under the federal Controlled Substances Act. In January 2018, under the first Trump administration, the DOJ rescinded the “Cole Memo” and related memoranda which characterized the enforcement of the Controlled Substances Act against persons and entities complying with state regulatory systems permitting the use, manufacture and sale of medical marijuana as an inefficient use of their prosecutorial resources and discretion. The impact of the DOJ’s rescission of the Cole Memo and related memoranda is unclear. Enforcement policies and practices may be highly variable between political administrations. In addition, federal prosecutors have significant discretion and there can be no assurance that the federal prosecutor for any district in which we or our customers operate will not choose to strictly enforce the federal laws governing cannabis.

Previous wording

As indicated in Note 1, Summary of Significant Accounting Policies–Recent Accounting Pronouncements, to the consolidated financial statements included in Part II, Item 8, of this Annual Report on Form 10-K, the regulations, rules, standards, policies, and interpretations underlying GAAP are constantly evolving and may change significantly over time. If we fail to interpret any one or more of these GAAP provisions correctly, or if our methodology in applying them to our financial reporting or disclosures is at all flawed, our financial statements may contain inaccuracies that, if severe enough, could warrant a later restatement by us, which in turn could result in a material adverse event.

Current wording

As indicated in Note 1, Summary of Significant Accounting Policies—Accounting Standards Recently Adopted or Issued, to the consolidated financial statements included in Part II, Item 8, of this Annual Report on Form 10-K, the regulations, rules, standards, policies, and interpretations underlying GAAP are constantly evolving and may change significantly over time. If we fail to interpret any one or more of these GAAP provisions correctly, or if our methodology in applying them to our financial reporting or disclosures is at all flawed, our financial statements may contain inaccuracies that, if severe enough, could warrant a later restatement by us, which in turn could result in a material adverse event.

Previous wording

As of December 31, 2024, we had $58.1 million of goodwill and $2.6 million of other intangible assets. Significant and sustained declines in our stock price and market capitalization, significant declines in our expected future cash flows, significant adverse changes in the business climate or slower growth rates may necessitate our taking charges in the future related to the impairment of our goodwill. Future regulatory actions could also have a material impact on assessments of goodwill for impairment. If the fair value of our net assets improves at a faster rate than the market value of our reporting units, or if we were to experience increases in book values of a reporting unit in excess of the increase in fair value of equity, we may also have to take charges related to the impairment of our goodwill. If we were to conclude that a future write-down of our goodwill is necessary, we would record the appropriate charge, which could have a material adverse effect on our results of operations.

Current wording

As of December 31, 2025, we had $58.1 million of goodwill and $2.2 million of other intangible assets. Significant and sustained declines in our stock price and market capitalization, significant declines in our expected future cash flows, significant adverse changes in the business climate or slower growth rates may necessitate our taking charges in the future related to the impairment of our goodwill. Future regulatory actions could also have a material impact on assessments of goodwill for impairment. If the fair value of our net assets improves at a faster rate than the market value of our reporting units, or if we were to experience increases in book values of a reporting unit in excess of the increase in fair value of equity, we may also have to take charges related to the impairment of our goodwill. If we were to conclude that a future write-down of our goodwill is necessary, we would record the appropriate charge, which could have a material adverse effect on our results of operations.

Previous wording

Identifiable intangible assets other than goodwill consist of core deposit intangibles and other intangible assets (primarily customer relationships). Adverse events or circumstances could impact the recoverability of these intangible assets including loss of core deposits, significant losses of customer accounts and/or balances, increased competition or adverse changes in the economy. To the extent these intangible assets are deemed unrecoverable, a non-cash impairment charge would be recorded which could have a material adverse effect on our results of operations.

Current wording

Identifiable intangible assets other than goodwill consist of other intangible assets (primarily customer relationships). Adverse events or circumstances could impact the recoverability of these intangible assets including significant losses of customer accounts and/or balances, increased competition or adverse changes in the economy. To the extent these intangible assets are deemed unrecoverable, a non-cash impairment charge would be recorded which could have a material adverse effect on our results of operations.

Previous wording

Liquidity is essential to our businesses.

Current wording

Liquidity is essential to our business.

Previous wording

We must maintain sufficient cash flow and liquid assets to satisfy current and future financial obligations, including demand for loans and deposit withdrawals, funding operating costs, and for other corporate purposes, as well as meet regulatory requirements and supervisory expectations. We rely on customer deposits to be a reasonable cost and stable source of funding for the loans we make and the operations of our business. Customer deposits, which include noninterest-bearing deposits, interest-bearing transaction accounts, savings deposits and time deposits of $250,000 or less, have historically provided us with a sizeable source of stable and low-cost funds. In addition to customer deposits, sources of liquidity include brokered deposits and borrowings from securities dealers, the FHLBNY and the FRB of New York, as well as the debt and equity capital markets.

Current wording

We must maintain sufficient cash flow and liquid assets to satisfy current and future financial obligations, including demand for loans and deposit withdrawals, funding operating costs, and for other corporate purposes, as well as meeting regulatory requirements and supervisory expectations. We rely on customer deposits to be a reasonable cost and stable source of funding for the loans we make and the operations of our business. Customer deposits, which include noninterest-bearing deposits, interest-bearing transaction accounts, savings deposits and time deposits of $250,000 or less, have historically provided us with a sizeable source of stable and low-cost funds. In addition to customer deposits, sources of liquidity include brokered deposits and borrowings from securities dealers, the FHLBNY and the FRB of New York, as well as the debt and equity capital markets.

Previous wording

Our earnings and cash flows depend largely upon our net interest income. Interest rates are highly sensitive to many factors that are beyond our control, including general economic conditions and policies of governmental and regulatory agencies, particularly the Federal Reserve. Changes in monetary policy, including changes in interest rates, could influence the interest we receive on loans and investments and the amount of interest we pay on deposits and borrowings, which may affect our net interest margins. Such changes could also affect (i) demand for our products and services and price competition, in turn affecting our ability to originate loans and obtain deposits; (ii) the fair value of our financial assets and liabilities; (iii) the average duration of our mortgage-backed securities portfolio and other interest-earning assets; (iv) levels of defaults on loans; and (v) loan prepayments.

Current wording

Our earnings and cash flow depend largely upon our net interest income. Interest rates are highly sensitive to many factors that are beyond our control, including general economic conditions and policies of governmental and regulatory agencies, particularly the Federal Reserve. Changes in monetary policy, including changes in interest rates, could influence the interest we receive on loans and investments and the amount of interest we pay on deposits and borrowings, which may affect our net interest margins. Such changes could also affect (i) demand for our products and services and price competition, in turn affecting our ability to originate loans and obtain deposits; (ii) the fair value of our financial assets and liabilities; (iii) the average duration of our mortgage-backed securities portfolio and other interest-earning assets; (iv) levels of defaults on loans; and (v) loan prepayments.

Previous wording

Earnings could also be adversely affected if the interest rates received on loans and other investments fall more quickly than the interest rates paid on deposits and other borrowings. In addition, in a falling rate environment, or the recent pandemic-related environment where the Federal Reserve held the federal reference rate near 0.00%, loans may be prepaid sooner than we expect, which could result in a delay between when we receive the prepayment and when we are able to redeploy the funds into new interest-earning assets and in a decrease in the amount of interest income we are able to earn on those assets. If we are unable to manage these risks effectively, our financial condition and results of operations could be materially adversely affected.

Current wording

Earnings could also be adversely affected if the interest rates received on loans and other investments fall more quickly than the interest rates paid on deposits and other borrowings. In addition, in a falling or low rate environment, loans may be prepaid sooner than we expect, which could result in a delay between when we receive the prepayment and when we are able to redeploy the funds into new interest-earning assets and in a decrease in the amount of interest income we are able to earn on those assets. If we are unable to manage these risks effectively, our financial condition and results of operations could be materially adversely affected.

Previous wording

The financial services market continues to see rapid changes with steady and frequent introductions of new technology-driven products and services. Our future success may depend, in part, on our ability to leverage emerging technology to provide feature-rich products and services that provide value to our customers and our operations. At the same time, emerging technologies present new risks directly associated with adoption or indirectly by third-party service provider adoption. The continued expansion of cloud computing services has drastically increased the adoption risk as we depend on our third-party service providers to implement effective controls to manage new risk. While cloud computing services typically support improved availability, performance and elasticity, it also presents increased risk of system and data compromise. Cloud computing services are rapidly evolving as are the technology solutions running in cloud services. Cloud and associated technology have influenced the opportunity for rapid change, which inherently increases change management risk. While the heightened pace of change is often desirable, it may lead to undesirable outcomes impacting operational risk, financial risk, reputations risk and sometimes, regulatory risk.

Current wording

The financial services market continues to see rapid changes with steady and frequent introductions of new technology-driven products and services. Our future success may depend, in part, on our ability to leverage emerging technology to provide feature-rich products and services that provide value to our customers and our operations. At the same time, emerging technologies present new risks directly associated with adoption or indirectly by third-party service provider adoption. The continued expansion of cloud computing services has drastically increased the risk of dependency on our third-party service providers to implement effective controls to manage the risk of cloud service reliability and security. While cloud computing services typically support improved availability, performance and elasticity, it also presents increased risk of system and data compromise. And, while improved availability is a goal of cloud computing, service outages can be more significantly impactful. Cloud computing services are rapidly evolving as are the technology solutions running in cloud services. Cloud and associated technology have influenced the opportunity for rapid change, which inherently increases change management risk. While the heightened pace of change is often desirable, it may lead to undesirable outcomes impacting operational risk, financial risk, reputations risk and sometimes, regulatory risk. As such, the adoption of cloud services must include comprehensive assessment and risk management.

Previous wording

The recent emergence of artificial intelligence (“AI”) is a recent example of an emerging technology providing significant value to operations and service, although the mere existence of AI capabilities presents a myriad of risks for consideration. Regardless of direct AI adoption by the Company, we face the risk of associates utilizing unauthorized publicly sourced AI tools to complete business functions. Unauthorized use of AI tools could lead to the unintended exposure of confidential data, use of inaccurate results, and a number of other risks. Additionally, third-party service providers are quickly embedding AI capabilities in their technology to provide more robust and efficient services. Some embedded AI capabilities could risk the exposure of confidential Company data if being used in a multi-tenant environment or being used to train AI systems.

Current wording

The emergence of AI is an example of an emerging technology providing significant value to operations and service, although the mere existence of AI capabilities presents a myriad of risks for consideration. Regardless of AI adoption by the Company, we face the risk of associates utilizing unauthorized publicly sourced AI tools to complete business functions. Unauthorized use of AI tools could lead to the unintended exposure of confidential data, use of inaccurate results, and a number of other risks. Additionally, third-party service providers are quickly embedding AI capabilities in their technology to provide more robust and efficient services. Some embedded AI capabilities could risk the exposure of confidential Company data if being used in a multi-tenant environment or being used to train AI systems.

Previous wording

Third-party vendors provide key components of our business infrastructure, such as infrastructure service delivery, application delivery, and an increased volume managed service functions. While we have selected these third-party vendors carefully, we relinquish many aspects of control. Issues induced by these third parties, including a service disruption or poor service performance, could adversely affect our ability to deliver products and services to our customers or otherwise conduct our business efficiently, effectively, and in accordance with the expectations of our customers and regulators. Replacing these third-party providers could also entail significant time and expense, further emphasizing the need for stringent vendor due diligence processes.

Current wording

Third-party vendors provide key components of our business infrastructure, such as infrastructure service delivery, application delivery, and a growing volume of managed service functions. While we select these third-party vendors carefully, we relinquish many aspects of control and rely on oversight processes to minimize risk. Issues induced by these third parties, including a service disruption or poor service performance, could adversely affect our ability to deliver products and services to our customers or otherwise conduct our business efficiently, effectively, and in accordance with the expectations of our customers and regulators. Replacing these third-party providers could also entail significant time and expense, further emphasizing the need for stringent vendor due diligence processes.

Previous wording

Each year, more third-party service providers perform significant operational services on our behalf. These third-party vendors are subject to similar risks as us relating to cybersecurity, technology infrastructure, processes and talent. One or more of our vendors may experience a cybersecurity event or operational disruption and, if any such event does occur, it may not be adequately addressed, either operationally or financially, by the third-party vendor causing direct impact to our business. And, with the increased volume of cloud computing, our business could be directly impacted if similar disruptions are experienced by fourth-party vendors. Some of our vendors may have limited indemnification obligations or may not have the financial capacity to satisfy their indemnification obligations. Financial or operational difficulties of a vendor could also impair our operations if those difficulties interfere with the vendor’s ability to serve us. If a critical vendor is unable to meet our needs in a timely manner or if the services or products provided by such a vendor are terminated or otherwise delayed and if we are not able to develop alternative sources for these services and products quickly and cost-effectively, it could have a material adverse effect on our business. Due to significant levels of dependency, critical services may require redundant service providers to reduce vendor risk, although this inherently increases financial risk a third-party risk with the redundant vendor and cost.

Current wording

Each year, more third-party service providers perform significant operational services on our behalf. These third-party vendors are subject to similar risks as us relating to cybersecurity, technology infrastructure, processes and talent. One or more of our vendors may experience a cybersecurity event or operational disruption and, if any such event does occur, it may not be adequately addressed, either operationally or financially, by the third-party vendor causing direct impact to our business. And, with the increased volume of cloud computing, our business could be directly impacted if similar disruptions are experienced by fourth-party vendors, which has been a growing trend in recent years. Some of our vendors may have limited indemnification obligations or may not have the financial capacity to satisfy their indemnification obligations. Financial or operational difficulties of a vendor could also impair our operations if those difficulties interfere with the vendor’s ability to serve us. If a critical vendor is unable to meet our needs in a timely manner or if the services or products provided by such a vendor are terminated or otherwise delayed and if we are not able to develop alternative sources for these services and products quickly and cost-effectively, it could have a material adverse effect on our business. Due to significant levels of dependency, critical services may require redundant service providers to reduce vendor risk, although this inherently increases financial risk a third-party risk with the redundant vendor and cost.

Previous wording

We rely heavily on communications, information technology (both on-premises and via service providers) and internet service to conduct our business. Our business depends on our ability to process and monitor a large volume of daily transactions in compliance with legal, regulatory, and internal standards and specifications. In addition, a significant portion of our operations relies heavily on the secure processing, storage and transmission of personal and confidential information of our customers and clients. These risks have increased as our customers have adopted digital banking solutions, and we have migrated many former on-premises services and technology to hosted third-party service providers. The dependency on these services, provided on-premises or in hosted environments, are threatened daily by ever-evolving cyber criminals, system failures, natural disasters, and other uncontrollable events such as a global pandemic. Uncontrollable events test the operational resiliency of companies across the world, every year. Whether it be hurricanes, tornados, or wildfires, companies risk the loss of facilities, technical infrastructure and even the lives of irreplaceable talent, and the lack of quality business continuity and disaster recovery plans heightens the impact risk. The risk of failing to train and test these plans could challenge the ability to recover. Similarly, cyber-attacks also challenge our preparedness to respond and recover. The volume and impact of cyber-attacks continues to grow and regardless of security controls, every company is susceptible to a compromise, making the existence of an incident response plan critical. Failure to train and test the plan periodically is a critical risk to any company. Potential attacks have attempted to obtain unauthorized access to confidential information to obtain for sale or destroy, often through the introduction of computer viruses or malware (ransomware), cyber-attacks and other means. Such security attacks can originate from a wide variety of sources, including people who are involved with organized crime or rogue attackers taking advantage of modern tolls and services that have become readily available. Those same parties may also attempt to fraudulently induce employees, customers or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or clients. We are also subject to the risk that our employees may intercept and transmit unauthorized confidential or proprietary information. An interception, misuse or mishandling of personal, confidential or proprietary information being sent to or received from a customer or third party could result in legal liability, remediation costs, regulatory action and reputational harm, any of which could adversely affect operations and financial condition. The failure to train and periodically test for possible threats, greatly increases the risk of compromise and impact.

Current wording

We rely heavily on communications, information technology (both on-premises and via service providers) and internet service to conduct our business. Our business depends on our ability to process and monitor a large volume of daily transactions in compliance with legal, regulatory, and internal standards and specifications. In addition, a significant portion of our operations relies heavily on the secure processing, retention, disposal, and transmission of personal and confidential information of our customers and clients. These risks have increased as our customers have adopted digital banking solutions, and we have migrated many former on-premises services and technology to hosted third-party service providers. The dependency on these services, provided on-premises or in hosted environments, are threatened daily by ever-evolving cyber criminals, system failures, natural disasters, and other uncontrollable events such as a global pandemic. Uncontrollable events test the operational resiliency of companies across the world, every year. Whether it be hurricanes, tornados, or wildfires, companies risk the loss of facilities, technical infrastructure and even the lives of irreplaceable talent, and the lack of quality business continuity and disaster recovery plans heightens the risk impact. The risk of failing to train and test these plans could challenge the ability to recover. Similarly, cyber-attacks also challenge our preparedness to respond and recover. The volume and impact of cyber-attacks continue to grow and regardless of security controls, every company is susceptible to a compromise, making the existence of an incident response plan critical. Failure to train and test the plan periodically is a critical risk to any company. Modern cyber-attacks attempt to obtain unauthorized access to directly access financial assets or indirectly benefit by accessing confidential data for future gains. Cyber-attacks may be executed in multiple stages but generally begin with social engineering attacks which pose a significant risk to employees and customers. Such security attacks can originate from a wide variety of sources, including people who are involved with organized crime or rogue attackers taking advantage of modern schemes and services that have become readily available. Those same parties initiate social engineering attacks to fraudulently induce employees, customers or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or clients. We are also subject to the risk that our employees may intercept and transmit unauthorized confidential or proprietary information. An interception, misuse or mishandling of personal, confidential or proprietary information being sent to or received from a customer or third party could result in legal liability, remediation costs, regulatory action and reputational harm, any of which could adversely affect operations and financial condition. The f…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

As the threat of cyber-attacks continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our systems, or to investigate and remediate vulnerabilities in our systems. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our systems can itself create a risk of systems disruptions and security issues.

Current wording

As the threat of cyber-attacks continue to evolve, we may be required to increase the resources dedicated to minimize and respond to these risks. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our systems can itself create a risk of systems disruptions and security issues.

Previous wording

We are subject to cybersecurity regulations promulgated by agencies such as the FRB, NY DFS, and the SEC, as well as laws, such as those under the GLBA. Any failure by us to comply with laws and regulations could result in regulatory sanctions, public disclosure and reputational damage even if we do not experience a significant cybersecurity breach. Most regulatory agencies have enhanced cybersecurity requirements and oversight, requiring increased focus and investment in cybersecurity controls. The failure to keep up with regulatory cybersecurity requirements not only presents the risk of regulatory sanctions but also presents an ill-advised risk due to sub-standard cyber risk controls, thus increasing the risk compromise. Insurance carriers have also enhanced their cybersecurity posture requirements and oversight. Failure to meet reasonable cybersecurity control requirements could risk the Company’s ability to obtain cyber liability insurance or influence significantly higher rates. The lack of cyber liability insurance is not only a financial risk, but a regulatory risk.

Current wording

We are subject to cybersecurity regulations promulgated by agencies such as the FRB, NY DFS, and the SEC, as well as laws, such as those under the GLBA. Any failure by us to comply with laws and regulations could result in regulatory sanctions, public disclosure and reputational damage even if we do not experience a significant cybersecurity breach. Most regulatory agencies have enhanced cybersecurity requirements and oversight, requiring increased focus and investment in cybersecurity controls. The failure to keep up with regulatory cybersecurity requirements not only presents the risk of regulatory sanctions but also presents an ill-advised risk due to sub-standard cyber risk controls, thus increasing the risk of compromise. Insurance carriers have also enhanced their cybersecurity posture requirements and oversight. Failure to meet reasonable cybersecurity control requirements could risk the Company’s ability to obtain cyber liability insurance, which poses financial and regulatory risks, or influence significantly higher rates.

Previous wording

Our business may be adversely affected by conditions in the financial markets and economic conditions generally, including macroeconomic pressures such as inflation, supply chain issues, and geopolitical risks associated with international conflict.

Current wording

Our business may be adversely affected by conditions in the financial markets and economic conditions generally, including macroeconomic pressures such as inflation, supply chain issues, geopolitical risks associated with international conflict.

Previous wording

Our financial performance generally, and in particular the ability of borrowers to pay interest on and repay principal of outstanding loans and the value of collateral securing those loans, as well as demand for loans and other products and services we offer, is highly dependent on the business environment in the markets where we operate, in the State of New York and in the United States as a whole. Additionally, international conflict, such as the war in Ukraine and the impact of sanctions on Russia and Russian companies may impact global markets, which may create unfavorable or uncertain economic conditions. A favorable business environment is generally characterized by, among other factors, economic growth, efficient capital markets, low inflation, low unemployment, high business and investor confidence, and strong business earnings. Unfavorable or uncertain economic and market conditions can be caused by declines in economic growth, business activity or investor or business confidence; limitations on the availability or increases in the cost of credit and capital; increases in inflation or interest rates; tariffs; high unemployment, natural disasters; or a combination of these or other factors. The occurrence of any of these conditions could have a material adverse effect on our financial condition and results of operations.

Current wording

Our financial performance generally, and in particular the ability of borrowers to pay interest on and repay principal of outstanding loans and the value of collateral securing those loans, as well as demand for loans and other products and services we offer, is highly dependent on the business environment in the markets where we operate, in the State of New York and in the United States as a whole. Additionally, international conflict may create unfavorable or uncertain economic conditions. A favorable business environment is generally characterized by, among other factors, economic growth, efficient capital markets, low inflation, low unemployment, high business and investor confidence, and strong business earnings. Unfavorable or uncertain economic and market conditions can be caused by declines in economic growth, business activity or investor or business confidence; political instability; limitations on the availability or increases in the cost of credit and capital; increases in inflation or interest rates; tariffs and trade wars; high unemployment, natural disasters; or a combination of these or other factors. The occurrence of any of these conditions could have a material adverse effect on our financial condition and results of operations.