economic conditions may have a greater effect on the Corporation’s earnings and capital than on the earnings and capital of other financial institutions whose real estate loan portfolios are more geographically diverse. In addition, collateral appraisals that are out of date or that do not meet industry recognized standards may create the impression that a loan is adequately collateralized when it is not. 5 Table of ContentsIn addition, collateral appraisals that are out of date or that do not meet industry recognized standards may create the impression that a loan is adequately collateralized when it is not. The Corporation has adopted underwriting and credit monitoring procedures and policies, including regular reviews of appraisals and borrower financial statements, that management believes are appropriate to mitigate the risk of loss. Also, as discussed further in the “Provision and Allowance for Credit Losses” section of Management’s Discussion and Analysis, the Corporation uses an expected loss methodology that is referred to as the current expected credit loss (“CECL”) methodology. CECL requires an estimate of credit losses for the remaining estimated life of the financial asset using historical experience, current conditions, and reasonable and supportable forecasts. Such risk management and accounting policies and procedures, however, may not prevent unexpected losses that could have a material adverse effect on the Corporation’s financial condition, results of operations or liquidity.

A significant portion of the Corporation's loan portfolio consists of commercial real estate loans, including owner occupied properties, non-owner-occupied properties, and other commercial properties. These types of loans are generally viewed as having more risk of default than residential real estate loans and depend on cash flows from the owner’s business or the property’s tenants to service the debt. The borrower’s cash flows may be affected significantly by general economic conditions, a downturn in the local economy or in occupancy rates in the market where the property is located, or other external events, any of which could increase the likelihood of default. Commercial real estate loans also typically have larger loan balances, and, therefore, the deterioration of one or a few of these loans could cause a significant increase in the percentage of the Corporation's non-performing loans. An increase in non-performing loans could result in a loss of earnings from these loans, an increase in the provision for credit losses for loans, and an increase in charge-offs, all of which could have a material adverse effect on the Corporation's business, financial condition, and results of operations.

Over the past few years, the banking regulatory agencies have expressed concerns about weaknesses in the current commercial real estate market. Banking regulators generally give commercial real estate lending greater scrutiny and may require banks with higher levels of commercial real estate loans to implement enhanced risk management practices, including stricter underwriting, internal controls, risk management policies, more granular reporting, and portfolio stress testing, as well as possibly higher levels of allowances for credit losses and capital levels as a result of commercial real estate lending growth and exposures. If the Corporation's banking regulators determine that our commercial real estate lending activities are particularly risky and are subject to such heightened scrutiny, the Corporation may incur significant additional costs or be required to restrict certain of our commercial real estate lending activities. Furthermore, failures in the Corporation's risk management policies, procedures and controls could adversely affect our ability to manage this portfolio going forward and could result in an increased rate of delinquencies in, and increased losses from, this portfolio, which could have a material adverse effect on the Corporation's business, financial condition, and results of operations.

Interest Rate Risk - Business risk arising from changes in interest rates is an inherent factor in operating a banking organization. The Corporation’s assets are predominantly long-term, fixed-rate loans and debt securities. Funding for these assets comes principally from deposits with no stated maturities, term deposits and borrowed funds. Accordingly, there is an inherent risk of lower future earnings or decline in fair value of the Corporation’s financial instruments when interest rates change.

Moreover, the Federal Reserve lowered the Federal Funds rate in 2020 and maintained a rate of 0% to 0.25% throughout 2021 while injecting massive amounts of liquidity into the nation’s monetary system. In 2022 and 2023, the Federal Reserve changed course and raised the rate several times to a range of 5.25% to 5.50% at December 31, 2023. The Federal Reserve’s rate increases, along with an accompanying tightening of the money supply, were conducted in an effort to contain inflation. In 2022, the Federal Reserve changed course, raising the Federal Funds rate several times to a range of 4.25% to 4.50% at December 31, 2022 and then to 4.50% to 4.75% on February 1, 2023. The Federal Reserve’s rate increases, along with an accompanying tightening of the money supply, have been conducted in an effort to contain inflation. In the latter portion of 2024, the Federal Reserve lowered the Federal Funds rate twice to a range of 4.25% to 4.50% at December 31, 2024.

Significant fluctuations in interest rates, including fluctuations in interest rates triggered by the Federal Reserve’s actions, could have a material adverse effect on the Corporation’s financial condition, results of operations or liquidity.

Limited Geographic Diversification - The Corporation grants commercial, residential and personal loans to customers primarily in the Corporation’s markets of the Northern tier/Northcentral regions of Pennsylvania, Southern tier of New York and Southeastern and Southcentral Pennsylvania. Although the Corporation has a diversified loan portfolio, a significant portion of its debtors’ ability to honor their contracts is dependent on the local economic conditions within these regions. Deterioration in economic conditions could adversely affect the quality of the Corporation’s loan portfolio and the demand for its products and services, and accordingly, could have a material adverse effect on the Corporation’s financial condition, results of operations or liquidity.

Competition - All phases of the Corporation’s business are competitive. Some competitors are much larger in total assets and capitalization than the Corporation, have greater access to capital markets and can offer a broader array of financial services. There can be no assurance that the Corporation will be able to compete effectively in its markets. Additionally, the financial services industry is undergoing rapid technological change with frequent introductions of new technology-driven products and services, including those related to artificial intelligence, to technologies that automate functions previously performed manually, facilitate the ability of customers to engage in financial transactions and otherwise enhance the customer experience. Many of these initiatives take a significant amount of time to develop and implement, are tied to critical systems, and require substantial financial, human, and other resources. The investments by larger competitors in these initiatives may be more substantial than those of the Corporation, which may cause the Corporation to lose market share. Although the Corporation, in making such investments, takes steps to mitigate the risks and uncertainties associated with these initiatives, they are not always implemented on time, within budget, or without negative financial, operational, or customer impact and do not always perform as the Corporation or its customers expect. Moreover, costs associated with implementing technology-driven products or other services, or technology-related or other developments increasing the nature or level of competition, could have a material adverse effect on the Corporation’s financial condition, results of operations or liquidity.

Inability to Attract and Develop Qualified Personnel – The future success of the Corporation will depend in large part on our ability to attract, develop and retain highly qualified management, lending, financial, technological, marketing, sales, and support personnel. Competition for qualified personnel is intense and we cannot ensure success in attracting or retaining qualified personnel. There may be only a limited number of persons with the requisite skills to serve in these positions, and it may be increasingly difficult for us to hire personnel over time. Our ability to retain key officers and employees may be further impacted by legislation and regulation affecting the financial services industry. For example, legislation and bank regulatory action that places restrictions on executive compensation at, and the pay practices of, financial institutions may further impact our ability to compete for talent with other industries that are not subject to the same limitations as financial institutions. Any inability to attract, develop and retain significant numbers of qualified management and other personnel would have a material adverse effect on our business, results of operations and financial condition.

Cyber Security Risks and Technology Dependence – In the ordinary course of business, the Corporation collects and stores sensitive data, including proprietary business information and personally identifiable information of our customers and employees in systems and on networks. In some cases, this confidential or proprietary information is collected, compiled, processed, transmitted or stored by third parties on our behalf. The secure processing, maintenance and use of this information is critical to operations and our business strategy.

Despite these security measures, the Corporation’s computer systems and infrastructure or those of third parties used by us to compile, process or store such information may be vulnerable to attacks by hackers or breached due to employee error, malfeasance, or other disruptions. Financial services institutions and companies engaged in data processing have reported breaches in the security of their websites or other systems, some of which have involved sophisticated and targeted attacks intended to obtain unauthorized access to sensitive information, destroy data, steal financial assets, disable or degrade service, or sabotage systems, often through the introduction of computer viruses or malware, cyber-attacks and other means. Denial of service attacks have been launched against a number of large financial services institutions. The Corporation may be subject to similar attacks in the future. Hacking and identity theft risks could cause serious reputational harm and financial loss to the Corporation. Cyber threats are rapidly evolving and the Corporation may not be able to anticipate or prevent all such attacks. Advancements in the use of artificial intelligence could lead to attacks by exploiting vulnerabilities to manipulate model outputs or bypass security controls. A breach of any kind could compromise systems and the information stored there could be accessed, damaged, locked up, or disclosed. A breach in security could result in legal claims, regulatory penalties, disruption in operations, and damage to the Corporation’s reputation, which could have a material adverse effect on the Corporation’s financial condition, results of operations or liquidity.

Artificial Intelligence Risks and Challenges - The Corporation or its third-party vendors, clients or counterparties may develop or incorporate artificial intelligence ("AI") technology in certain business processes, services, or products. The development and use of AI presents a number of risks and challenges to the Corporation's business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the U.S. and internationally, and includes regulatory schemes targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment, and other laws applicable to the use of AI. These evolving laws and regulations could require changes in the Corporation's implementation of AI technology and increase its compliance costs and

the risk of non-compliance. AI models, particularly generative AI models, may produce output or take action that is incorrect, that reflects biases included in the data on which they are trained, that results in the release of private, confidential, or proprietary information, that infringes on the intellectual property rights of others, or that is otherwise harmful. In addition, the complexity of many AI models makes it difficult to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias, and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, the Corporation may rely on AI models developed by third parties, and, to that extent, would be dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which the Corporation may have limited visibility. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures.

Government Regulation and Monetary Policy - The Corporation and the banking industry are subject to extensive regulation and supervision under federal and state laws and regulations. The requirements and limitations imposed by such laws and regulations limit the way the Corporation conducts its business, undertakes new investments and activities, and obtains financing. These regulations are designed primarily for the protection of the deposit insurance funds and consumers and not to benefit the Corporation’s shareholders. Financial institution regulation has been the subject of significant legislation in recent years and may be the subject of further significant legislation in the future, none of which is in the control of the Corporation. Significant new laws or changes in, or repeals of, existing laws could have a material adverse effect on the Corporation’s financial condition, results of operations or liquidity. For example, the regulatory authorities may take actions that could result in decreases in service charge revenue from deposit accounts, including overdraft privilege and other fees. Further, federal monetary policy, particularly as implemented through the Federal Reserve System, significantly affects short-term interest rates and credit conditions, and any unfavorable change in these conditions could have a material adverse effect on the Corporation’s financial condition, results of operations or liquidity.

Bank Secrecy Act and Related Laws and Regulations - These laws and regulations have significant implications for all financial institutions. In recent years, they have increased due diligence requirements and reporting obligations for financial institutions, created new crimes and penalties, and required the federal banking agencies, in reviewing merger and other acquisition transactions, to consider the effectiveness of the parties to such transactions in combating money laundering activities. Even innocent noncompliance and inconsequential failure to follow the regulations could result in significant fines or other penalties, which could have a material adverse impact on the Corporation’s financial condition, results of operations or liquidity.

The Federal Home Loan Bank of Pittsburgh - Through its subsidiary (C&N Bank), the Corporation is a member of the Federal Home Loan Bank of Pittsburgh (FHLB-Pittsburgh), which is one of 11 regional Federal Home Loan Banks. The Corporation has a line of credit with the FHLB-Pittsburgh that is secured by a blanket lien on its loan portfolio. Access to this line of credit is critical if a funding need arises. However, there can be no assurance that the FHLB-Pittsburgh will be able to provide funding when needed, nor can there be assurance that the FHLB-Pittsburgh will provide funds specifically to the Corporation should its financial condition deteriorate and/or regulators prevent that access. The inability to access this source of funds could have a materially adverse effect on the Corporation’s financial flexibility if alternate financing is not available at acceptable interest rates. The failure of the FHLB-Pittsburgh or the FHLB system in general, may materially impair the Corporation’s ability to meet short- and long-term liquidity needs or to meet growth plans.

The Corporation owns common stock of the FHLB-Pittsburgh to qualify for membership in the FHLB system and access services from the FHLB-Pittsburgh. The FHLB-Pittsburgh faces a variety of risks in its operations including interest rate risk, counterparty credit risk, and adverse changes in its regulatory framework. In addition, the 11 Federal Home Loan Banks are jointly liable for the consolidated obligations of the FHLB system. To the extent that one FHLB cannot meet its obligations, other FHLBs can be called upon to make required payments. Such risks affecting the FHLB-Pittsburgh could adversely impact the value of the Corporation’s investment in the common stock of the FHLB-Pittsburgh and/or affect its access to credit.

Soundness of Other Financial Institutions - In addition to the FHLB-Pittsburgh, the Corporation maintains other credit facilities that provide it with additional liquidity. These facilities include secured and unsecured borrowings from the Federal Reserve Bank and third-party commercial banks. The Corporation believes that it maintains a strong liquidity position and that it is well positioned to withstand foreseeable market conditions. However, legal agreements with counterparties typically include provisions allowing them to restrict or terminate the Corporation’s access to these credit facilities with or without advance notice and at their sole discretion.

Financial institutions are interconnected because of trading, clearing, counterparty, and other relationships. Financial market conditions have been negatively impacted in the past and such disruptions or adverse changes in the Corporation’s results of operations or financial condition could, in the future, have a negative impact on available sources of liquidity. Such a situation may arise due to circumstances that are outside the Corporation’s control, such as general market disruptions or operational problems affecting the Corporation or third parties. The Corporation’s efforts to monitor and manage liquidity risk may not be successful or sufficient to deal with dramatic or unanticipated reductions in available liquidity. The Corporation’s efforts to monitor and manage liquidity risk may not be successful or sufficient to deal with dramatic or 7 Table of Contentsunanticipated reductions in available liquidity. In such events, the Corporation’s cost of funds may increase, thereby reducing net interest income, or the Corporation may need to sell a portion of its securities and/or loan portfolio, which, depending upon market conditions, could necessitate realizing a loss.

Moreover, the Corporation is exposed to the risk that when a bank or other financial institution experiences financial difficulties, there could be an adverse “contagion” impact on other banking institutions. For example, the failures of Silicon Valley Bank in California, Signature Bank in New York and First Republic Bank in California in 2023 caused an element of panic and uncertainty in the investor community and among bank customers generally, including, specifically, deposit customers. These types of events may reduce customer confidence and may affect sources of funding and liquidity, increase regulatory requirements and costs, adversely affect financial markets and/or have negative reputational ramifications for institutions in the banking industry, including, possibly, the Corporation.

Securities Markets – The fair value of the Corporation’s available-for-sale debt securities, as well as the revenues the Corporation earns from its wealth management services, are sensitive to price fluctuations and market events.

Declines in the values of the Corporation’s securities holdings, combined with adverse changes in the expected cash flows from these investments, would negatively impact their value for liquidity management purposes and could result in the recording of an allowance for credit losses. At December 31, 2024, the fair value of the Corporation’s available-for-sale debt securities portfolio was $402.4 million, or 10.6% less than the amortized cost basis. The unrealized decrease in fair value was consistent with the increases in market interest rates that occurred subsequent to the purchases of the securities, and no allowance for credit losses was required on available-for-sale debt securities in an unrealized loss position at December 31, 2024. Further increases in interest rates would cause the fair value of the available-for-sale debt securities portfolio to decrease further. The unrealized decrease in fair value was consistent with the significant increases in market interest rates that occurred in 2022, and there were no credit-related declines in fair value and no other-than-temporary losses recorded at December 31, 2022. Further increases in interest rates would cause the fair value of the available-for-sale debt securities portfolio to decrease further. For additional information regarding debt securities, see the “Securities” section of Management’s Discussion and Analysis and Note 6 to the consolidated financial statements.

The Corporation’s trust revenue is determined, in part, from the value of the underlying investment portfolios. Accordingly, if the values of those investment portfolios decrease, whether due to factors influencing U.S. or international securities markets, in general, or otherwise, the Corporation’s revenue could be negatively impacted. In addition, the Corporation’s ability to sell its brokerage services is dependent, in part, upon consumers’ level of confidence in securities markets.

Mortgage Banking – Since 2009, the Corporation has originated and sold residential mortgage loans to the secondary market through the MPF Xtra program. Since 2014, the Corporation has also originated and sold residential mortgage loans to the secondary market through the MPF Original program. Both of these programs are administered by the Federal Home Loan Banks of Pittsburgh and Chicago. At December 31, 2024, the total outstanding balance of residential mortgages sold and serviced through the two programs amounted to $329,766,000. The Corporation must strictly adhere to the MPF Xtra and MPF Original program guidelines for origination, underwriting and servicing loans, and failure to do so may result in the Corporation being forced to repurchase loans or being dropped from the program. As of December 31, 2024, the total outstanding balance of residential mortgage loans the Corporation has repurchased as a result of identified instances of noncompliance amounted to $2,671,000. If the volume of such forced repurchases of loans were to increase significantly, or if the Corporation were to be dropped from the programs, it could have a material adverse effect on the Corporation’s financial condition, results of operations or liquidity.

ITEM 1B. UNRESOLVED STAFF COMMENTS

Not applicable.

​

ITEM 1C. CYBERSECURITY

Risk Management and Strategy- The Corporation’s cybersecurity risk management program is designed to assess, identify, and manage material risks from cybersecurity threats and is an integral part of the overall risk management program. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties’ operations, systems, or data. The Corporation assesses its cyber security procedures and controls on an on-going basis as safeguarding its systems and data is critical to its operations and business strategy.

The Corporation uses third-party vendors, including a managed security service provider, to assist in monitoring, detecting, and managing cyber threats. The Board of Directors has established risk management guidelines for third-party vendors. Further, the Corporation conducts due diligence reviews of third-party vendors before contracts or agreements for provision of services are signed and conducts ongoing due diligence and oversight procedures with the frequency of the procedures determined based on a risk assessment of the services provided. The Corporation generally has agreements in place with its service providers that include requirements related to cybersecurity and data privacy. Due diligence and oversight procedures may include, but are not limited to, reviews of financial information, internal control reports, business continuity and disaster recovery plans, and information security and cyber security policies and associated tests of effectiveness. The Corporation cannot guarantee, however, that such agreements, due diligence, and oversight procedures will prevent a cyber incident from impacting our systems or information. Additionally, the Corporation may not be able to obtain adequate or any reimbursement from its insurance coverage or from its service providers in the event it should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, the Corporation may be held responsible for cyber incidents attributed to its service providers in relation to any data that the Corporation shares with them.

​

During 2024, the Corporation did not experience a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the Corporation, including its business strategy, results of consolidated operations or financial condition. Refer to the risk factor captioned “Cyber Security Risks and Technology Dependence” in Part I, Item 1A. “Risk Factors” for additional information.

​

Governance- The Board of Directors provides oversight of the risk management program and setting the Corporation’s cyber risk profile, which includes risks from cybersecurity threats, enterprise cyber strategy, and key cyber initiatives. The Board has appointed a Risk Management Committee currently made up of six members of the Board with governance and oversight of the Corporation’s enterprise-wide risk management program. The members of the Risk Management Committee collectively have years of business management and professional experience in the banking industry and other industries including exposure to cyber risk management considerations. The Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters. In fulfilling its role, the Risk Management Committee is actively engaged with management regarding cyber security procedures and controls to manage and mitigate cybersecurity-related risks. Management provides at least quarterly information security reports to the Risk Management Committee who provides a report to the Board of its discussions and decisions. These reports to the Risk Management Committee address management’s efforts to monitor, detect and prevent cyber threats. In addition, the Board of Directors is engaged, as needed, in accordance with the Incident Response Plan.

​

The Corporation has an information security program that is primarily managed by the Information Security Department, which is led by the Chief Risk Management Officer and the Director of Information Security and supported by the Information Technology Operations Department, which is led by the Chief Information Officer. The Information Security Department is led by the Director of Information Security, and is responsible for day-to-day management of the information security program including system monitoring, vulnerability scans, employee security training including phishing exercises, security controls, and building strong relationships with security vendors. The Chief Risk Management Officer, the Chief Information Officer, the Director of Information Security and the other members of the Information Security Department are qualified by years of experience, post-secondary education, industry certifications and regular continuing education. A network penetration test and vulnerability assessment are performed at a minimum annually by a third-party vendor. The Information Security Committee is the management committee responsible for the oversight of the Information Security Program and is also responsible for policy development and information security risk assessment. This committee meets at least quarterly to discuss and review the information security program. The Information Security Program is updated at least annually and the Board of Directors, with input from the Risk Management Committee, approves all material changes.

​

The Corporation has an Incident Response Plan that provides a documented guideline for handling potential threats and taking appropriate measures including timely notification and escalation to executive leadership and the Board of Directors. The Incident Response Plan is managed by the Incident Response Team which includes the Director of Information Security, Chief Risk Management Officer, Chief Information Officer, and other essential members of management. The Incident Response Plan is reviewed and tested at least annually.

​