Failure to Complete the Merger Could Negatively Impact the Stock Prices and Future Business and Financial Results of the Company.

The consummation of the merger may be delayed, the merger may be consummated on terms different than those contemplated by the merger agreement, or the merger may not be consummated at all. If the merger is not completed, the ongoing businesses of the Company may be adversely affected, and the Company will be subject to several risks, including the following:

the Company could incur substantial costs relating to the proposed merger, such as legal, accounting, financial advisor, filing, printing and mailing fees;

the Company is subject to certain restrictions on the conduct of its business prior to completing the merger, which may adversely affect its ability to execute certain of its business strategies; and

the Company’s management’s and employees’ attention may be diverted from our day-to-day business and operational matters as a result of efforts relating to the attempt to consummate the merger.

In addition, if the merger is not completed, the Company may experience negative reactions from the financial markets and from their respective customers and employees. The Company also could be subject to litigation related to any failure to complete the merger or to enforcement proceedings commenced against the Company to perform their respective obligations under the merger agreement. Such events could materially affect the Company’s stock prices and business and financial results.

Shareholder Litigation Could Prevent or Delay the Closing of the Merger or Otherwise Negatively Affect the Business and Operations of the Company.

The Company may incur costs in connection with the defense or settlement of any shareholder lawsuits filed in connection with the proposed merger. Such litigation could have an adverse effect on the financial condition and results of operations of the Company and could prevent or delay the consummation of the merger.

Credit Risks

Commercial Real Estate and Commercial Business Loans Expose the Company to Increased Credit Risks



At December 31, 2024, the Company's portfolio of commercial real estate loans totaled $1.0 billion, or 56% of total loans outstanding, and the Company's portfolio of commercial and industrial ("C&I") loans totaled $260 million, or 15% of total loans outstanding. The Company plans to continue to emphasize the origination of commercial loans as they generally earn a higher rate of interest than other loan products offered by the Bank. However, commercial loans generally expose a lender to greater risk of non-payment and loss than one-to-four family residential mortgage loans because repayment of commercial real estate and C&I loans often depends on the successful operations and the income stream of the borrowers. Commercial mortgages are collateralized by real property while C&I loans are typically secured by business assets such as equipment and accounts receivable. Commercial loans typically involve larger loan balances to single borrowers or groups of related borrowers compared to one-to-four-family residential mortgage loans. Also, many of the Company's commercial borrowers have more than one commercial real estate or C&I loan outstanding with the Company. Consequently, an adverse development with respect to one loan or one credit relationship can expose the Company to a significantly greater risk of loss compared to an adverse development with respect to a one-to-four-family residential mortgage loan. Commercial real estate loans in non-accrual status at December 31, 2024 were $12.4 million, compared with $20.2 million at December 31, 2023. C&I loans in non-accrual status were $1.5 million and $1.8 million at December 31, 2024 and December 31, 2023, respectively. Increases in the delinquency levels of commercial real estate and C&I loans could result in an increase in non-performing loans and the provision for credit losses, which could have a material adverse effect on the Company's results of operations and financial condition.



Continuing Concentration of Loans in the Company's Primary Market Area May Increase the Company's Risk



Unlike larger banks that are more geographically diversified, the Company provides banking and financial services to customers located primarily in Western New York and the Finger Lakes Region of New York State. Therefore, the Company's success depends primarily on the general economic conditions in those areas. The Company's business lending and marketing strategies focus on loans to small and medium-sized businesses in this geographic region. Moreover, the Company's assets are heavily concentrated in mortgages on properties located in Western New York and the Finger Lakes Region of New York State. Accordingly, the Company's business and operations are vulnerable to downturns in the economy of those areas. A downturn in the economy or recession in these regions could result in a decrease in loan originations and increases in delinquencies and foreclosures, which would more greatly affect the Company than if the Company's lending were more geographically diversified. In addition, the Company may suffer losses if there is a decline in the value of properties underlying the Company's mortgage loans which would have a material adverse impact on the Company's operations.

In the Event the Company's Allowance for Credit Losses is Not Sufficient to Cover Actual Loan Losses, the Company's Earnings Could Decrease



The Company maintains an allowance for credit losses which represents the amount of losses expected in the loan portfolio. There is a risk that the Company may experience significant loan losses which could exceed the recorded amount of the allowance for credit losses. The Company adopted Current Expected Credit Loss (CECL), effective January 1, 2023 which requires financial institutions to determine periodic estimates of lifetime expected credit losses on loans and recognize the expected credit losses as allowances for credit losses.The Company expects to adopt a new accounting standard, referred to as Current Expected Credit Loss (CECL), effective January 1, 2023. CECL requires financial institutions to determine periodic estimates of lifetime expected credit losses on loans and recognize the expected credit losses as allowances for loan losses. When determining the allowance, expected credit losses over the contractual term of the loans (taking into account prepayments) will be estimated based on various assumptions and judgments about the collectability of its loan portfolio, considering relevant information about past events, current conditions, and reasonable and supportable forecasts that affect the collectibility of the reported amount. The emphasis on the origination of commercial real estate and C&I loans is a significant factor in evaluating the allowance for credit losses. As the Company continues to increase the amount of these loans in the portfolio, additional or increased provisions for credit losses may be necessary and would adversely affect the results of operations. In addition, bank regulators periodically review the Company's loan portfolio and credit underwriting procedures, as well as its allowance for credit losses, and may require the Company to increase its provision for credit losses or recognize further loan charge-offs. In addition, bank regulators periodically review the Company's loan portfolio and credit underwriting procedures, as well as its allowance for loan losses, and may require the Company to increase its provision for loan losses or recognize further loan charge-offs. An increase in our allowance for credit losses may have a material adverse effect on our financial condition and results of operations. An increase in our allowance for loan losses may have a material adverse effect on our financial condition and results of operations.

At December 31, 2024, the Company had a gross loan portfolio of $1.8 billion and the allowance for credit losses was $24.2 million, which represented 1.36% of the total amount of gross loans. If the Company's assumptions and judgments prove to be incorrect or bank regulators require the Company to increase its provision for credit losses or recognize further loan charge-offs, the Company may have to increase its allowance for credit losses or loan charge-offs which could have an adverse effect on the Company's operating results and financial condition. If the Company's assumptions and judgments prove to be incorrect or bank regulators require the Company to increase its provision for loan losses or recognize further loan charge-offs, the Company may have to increase its allowance for loan losses or loan charge-offs which could have an adverse effect on the Company's operating results and financial condition. Additionally, there can be no assurances that the Company's allowance for credit losses will be adequate to protect the Company against loan losses that it may incur. Additionally, there can be no assurances that the Company's allowance for loan losses will be adequate to protect the Company against loan losses that it may incur.



Environmental Factors May Create Liability



In the course of its business, the Bank has acquired, and may acquire in the future, property securing loans that are in default. There is a risk that the Bank could be required to investigate and clean-up hazardous or toxic substances or chemical releases at such properties after acquisition by the Bank in a foreclosure action, and that the Bank may be held liable to a governmental entity or third parties for property damage, personal injury and investigation and clean-up costs incurred by such parties in connection with such contamination. The Bank may in the future be required to perform an investigation or clean-up activities in connection with environmental claims. Any such occurrence could have a material adverse effect on our business, financial condition, and results of operations.



Liquidity Risks

A Lack of Liquidity Could Adversely Affect the Company’s Financial Condition and Results of Operations and Result in Regulatory Restrictions.

The Company must maintain sufficient funds to respond to the needs of depositors and borrowers. Deposits have traditionally been the Company’s primary source of funds for use in lending and investment activities and are emphasized due to the relatively lower cost of these funds. The Company also receives funds from loan repayments, investment maturities and income on other interest-earning assets, as well as borrowings. If the Company is required to rely more heavily on more expensive funding sources to support liquidity and future growth, its revenues may not increase proportionately to cover its increased costs, which would adversely affect its operating margins, profitability and growth prospects. Alternatively, the Company may need to sell a portion of its investment securities portfolio to raise funds, which, as discussed below, could result in a loss.

Any decline in funding could adversely impact the Company’s ability to originate loans, invest in securities, pay expenses, or fulfill obligations such as repaying its borrowings or meeting deposit withdrawal demands, any of which could have a material adverse impact on its liquidity, business, financial condition and results of operations. A lack of liquidity could also attract increased regulatory scrutiny and potential restraints imposed by regulators. Depending on the capitalization status and regulatory treatment of depository institutions, including whether an institution is subject to a supervisory prompt corrective action directive, regulatory restrictions and prohibitions may include restrictions on growth, restrictions on interest rates paid on deposits, restrictions or prohibitions on payment of dividends and restrictions on the acceptance of brokered deposits.

Rising Interest Rates Have Decreased the Value of the Company’s Securities Portfolio, and the Company Would Realize Losses if it Were Required to Sell Such Securities to Meet Liquidity Needs

As a result of inflationary pressures and the resulting rapid increases in interest rates over the last year, the trading value of previously issued government and other fixed income securities has declined significantly. These securities make up a majority of the securities portfolio of most banks in the U.S., including the Company’s, resulting in unrealized losses embedded in the securities portfolios. While the Company does not currently intend to sell these securities, if the Company were required to sell such securities to meet liquidity needs, it may incur losses, which could impair the Company’s capital, financial condition, and results of operations and require the Company to raise additional capital on unfavorable terms, thereby negatively impacting its profitability. If the Company violates these laws and regulations, or its policies, procedures and systems are deemed deficient, it would be subject to liability, including fines and regulatory actions, which may include restrictions on its ability to pay dividends and the necessity to obtain regulatory approvals to proceed with certain aspects of its business plan, including its acquisition plans. While the Company has taken

actions to maximize its funding sources, there is no guarantee that such actions will be successful or sufficient in the event of sudden liquidity needs.

Interest Rate Risks

Changes in Interest Rates Could Adversely Affect the Company's Business, Results of Operations and Financial Condition



The Company's results of operations and financial condition are significantly affected by changes in interest rates. The Company's results of operations depend substantially on its net interest income, which is the difference between the interest income earned on its interest-earning assets and the interest expense paid on its interest-bearing liabilities. Because the Company's interest-bearing liabilities generally re-price or mature more quickly than its interest-earning assets, changes in interest rates could result in a decrease in its net interest income. Management is unable to predict fluctuations in market interest rates, which are affected by many factors, including inflation, recession, unemployment, monetary policy, domestic and international disorder and instability in domestic and foreign financial markets, and investor and consumer demand. During 2022 and 2023, in response to accelerated inflation, the Federal Reserve implemented monetary tightening policies, resulting in significantly increased interest rates. In 2024, however, the Federal Reserve decreased the federal funds rate three times, resulting in an aggregate decrease of 100 basis points.



Changes in interest rates also affect the value of the Company's interest-earning assets, and in particular, the Company's securities portfolio. Generally, the value of securities fluctuates inversely with changes in interest rates. At December 31, 2024, the Company's securities available for sale totaled $259 million. Net unrealized losses on securities available for sale amounted to $42.5 million, net of tax, at December 31, 2024, compared to $40.7 million, net of tax, at December 31, 2023. Included in the net unrealized losses for 2023 was the impact of the $5 million loss on sale of securities as well as the changing interest rate environment in 2023. Decreases in the fair value of securities available for sale could have an adverse effect on stockholders' equity or earnings. For additional information on the loss on sale of securities see Note 3 to the Consolidated Financial Statements included in Item 8 of this Annual Report on Form 10-K.

The Company also is subject to reinvestment risk associated with changes in interest rates. Changes in interest rates may affect the average life of loans and mortgage-related securities. Decreases in interest rates can result in increased prepayments of loans and mortgage-related securities, as borrowers refinance to reduce borrowing costs. Under these circumstances, the Company is subject to reinvestment risk to the extent that it is unable to reinvest the cash received from such prepayments at rates that are comparable to the rates on existing loans and securities. Additionally, increases in interest rates may decrease loan demand and make it more difficult for borrowers to repay adjustable rate loans.



A significant portion of our loans have fixed interest rates and longer terms than our deposits and borrowings. As is the case with many banks and savings institutions, our emphasis on increasing the development of core deposits, those with no stated maturity date, has resulted in our interest-bearing liabilities having a shorter duration than our assets. Accordingly, in a rising interest rate environment, our net interest income could be adversely affected if the rates we pay on deposits and borrowings increase more rapidly than the rates we earn on loans. Rising interest rates may also result in increased loan delinquencies and loan losses and a decrease in demand for our products and services.

Regulatory Risks

The Company Operates in a Highly Regulated Environment and May Be Adversely Affected By Changes in Laws and Regulations



The Company and its subsidiaries are subject to regulation, supervision and examination by the OCC, FRB, and by the FDIC, as insurer of its deposits. Such regulation and supervision govern the activities in which a bank and its holding company may engage and are intended primarily for the protection of the deposit insurance funds and depositors. Regulatory requirements affect the Bank's lending practices, capital structure, investment practices, dividend policy and growth. Regulatory requirements affect the Company's lending practices, capital structure, investment practices, dividend policy and growth. These regulatory authorities have extensive discretion in connection with their supervisory and enforcement activities, including the imposition of restrictions on the operation of a bank, the imposition of deposit insurance premiums and other assessments, the classification of assets by a bank and the adequacy of a bank's allowance for credit losses. Any change in such regulation and oversight could have a material adverse impact on the Bank, the Company and their business, financial condition and results of operations.



Additionally, the CFPB has the authority to issue consumer finance regulations and is authorized, individually or jointly with bank regulatory agencies, to conduct investigations to determine whether any person is, or has, engaged in conduct that violates new and existing consumer financial laws or regulations. Because we have less than $10 billion in total consolidated assets, the FRB and OCC, not the CFPB, are responsible for examining and supervising our compliance with these consumer protection laws and regulations.



Noncompliance with applicable regulations may lead to adverse consequences for the Company. A successful regulatory challenge to an institution's performance under the CRA or fair lending laws and regulations could result in a wide variety of sanctions, including

the required payment of damages and civil money penalties, injunctive relief, imposition of restrictions on mergers and acquisitions activity and restrictions on expansion. Private parties may also have the ability to challenge an institution's performance under fair lending laws in private class action litigation. Such actions could have a material adverse effect on our business, financial condition and results of operations.



The Company also faces a risk of noncompliance and subsequent enforcement action in connection with federal Bank Secrecy Act and other anti-money laundering and counter terrorist financing statutes and regulations. The federal banking agencies and the U.S. Treasury Department's Financial Crimes Enforcement Network are authorized to impose significant civil money penalties for violations of those requirements and have recently engaged in coordinated enforcement efforts against banks and other financial services providers with the U.S. Department of Justice, Drug Enforcement Administration and Internal Revenue Service. If the Company or the Bank violates these laws and regulations, or its policies, procedures and systems are deemed deficient, they would be subject to liability, including fines and regulatory actions, which may include restrictions on the Company’s ability to pay dividends and the necessity to obtain regulatory approvals to proceed with certain aspects of their business plans, including acquisition plans. If the Company violates these laws and regulations, or its policies, procedures and systems are deemed deficient, it would be subject to liability, including fines and regulatory actions, which may include restrictions on its ability to pay dividends and the necessity to obtain regulatory approvals to proceed with certain aspects of its business plan, including its acquisition plans. Any of these results could have a material adverse effect on the Company's business, financial condition, results of operations and growth prospects.



Future FDIC Insurance Premium Increases May Adversely Affect the Company's Earnings



The Company is generally unable to control the amount of premiums that it is required to pay for FDIC insurance. The FDIC increased initial base insurance deposit assessment rates by 2 basis points effective January 1, 2023. If there are additional bank or financial institution failures or other similar occurrences, the FDIC may again increase the premiums assessed upon insured institutions. Such increases and any future increases or required prepayments of FDIC insurance premiums may adversely impact the Company's results of operations.

The Company is a Financial Holding Company and Depends on Its Subsidiaries for Dividends, Distributions and Other Payments



The Company is a legal entity separate and distinct from its banking and other subsidiaries. The Company's principal source of cash flow, including cash flow to pay dividends to the Company's stockholders and principal and interest on its outstanding debt, is dividends from the Bank. There are statutory and regulatory limitations on the payment of dividends by the Bank, as well as the payment of dividends by the Company to its stockholders. Regulations of the OCC affect the ability of the Bank to pay dividends and other distributions and to make loans to the Company. If the Bank is unable to make dividend payments and sufficient capital is not otherwise available, the Company may not be able to make dividend payments to its common stockholders or principal and interest payments on its outstanding debt.



If Regulators Impose Limitations on the Company's Commercial Real Estate Lending Activities, Earnings Could Be Adversely Affected



In 2006, the federal bank regulatory agencies issued joint guidance entitled "Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices" (the "CRE Guidance"). Although the CRE Guidance did not establish specific lending limits, it provides that a bank's commercial real estate lending exposure may receive increased supervisory scrutiny where total non-owner occupied commercial real estate loans, including loans secured by apartment buildings, investor commercial real estate and construction and land loans, represent 300% or more of an institution's total risk-based capital and the outstanding balance of the commercial real estate loan portfolio has increased by 50% or more during the preceding 36 months. The Bank's non-owner occupied commercial real estate level equaled 295% of total risk-based capital at December 31, 2024. Including owner-occupied commercial real estate, the ratio of commercial real estate loans to total risk-based capital ratio would be 371% at December 31, 2024. If the Bank’s regulators were to impose restrictions on the amount of commercial real estate loans it can hold in its portfolio, or require higher capital ratios as a result of the level of commercial real estate loans held, the Company's earnings would be adversely affected. The Bank's non-owner occupied commercial real estate level equaled 318% of total risk-based capital at December 31, 2021. Including owner-occupied commercial real estate, the ratio of commercial real estate loans to total risk-based capital ratio would be 392% at December 31, 2021. If the Company's regulators were to impose restrictions on the amount of commercial real estate loans it can hold in its portfolio, or require higher capital ratios as a result of the level of commercial real estate loans held, the Company's earnings would be adversely affected.



Operational Risks

The Company’s Internal Controls May Fail or Be Circumvented

Management regularly reviews and updates our internal controls and corporate governance policies and procedures. Any system of controls, however well-designed and operated, is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met. A failure to implement and maintain effective internal control over financial reporting could result in errors in our financial statements that may lead to a restatement of our financial statements or cause us to fail to meet our reporting obligations. Any failure or circumvention of our controls and procedures, or failure to comply with regulations related to controls and procedures, could have a material adverse effect on our operations, net income, financial condition, reputation, compliance with laws and regulations, or may result in untimely or inaccurate financial reporting.

The Potential for Business Interruption Exists Throughout the Company's Organization



Integral to the Company's performance is the continued efficacy of our technical systems, operational infrastructure, relationships with third parties and the vast array of associates and key executives in the Company's day-to-day and ongoing operations. Failure by any or all of these resources subjects the Company to risks that may vary in size, scale and scope. This includes, but is not limited to, operational or technical failures, pandemics, ineffectiveness or exposure due to interruption in third party support as expected, as well as the loss of key individuals or failure on the part of key individuals to perform properly. Such events could affect the stability of the Company's deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue, cause the Company to incur additional expenses, or disrupt our third party vendors' operations, any of which could result in a material adverse effect on the Company's financial condition and results of operations. Although the Company has established disaster recovery plans and procedures, the occurrence of any such events could have a material adverse effect on the Company.



Lack of System Integrity or Credit Quality Related to Funds Settlement Could Result in a Financial Loss



The Bank settles funds on behalf of financial institutions, other businesses and consumers and receives funds from clients, card issuers, payment networks and consumers on a daily basis for a variety of transaction types. Transactions facilitated by the Bank include debit card, credit card and electronic bill payment transactions, supporting consumers, financial institutions and other businesses. These payment activities rely upon the technology infrastructure that facilitates the verification of activity with counterparties and the facilitation of the payment. If the continuity of operations or integrity of processing were compromised this could result in a financial loss to the Bank, and therefore the Company, due to a failure in payment facilitation. In addition, the Bank may issue credit to consumers, financial institutions or other businesses as part of the funds settlement. A default on this credit by a counterparty could result in a financial loss to the Bank, and therefore to the Company.



Financial Services Companies Depend on the Accuracy and Completeness of Information about Customers and Counterparties



In deciding whether to extend credit or enter into other transactions, the Company may rely on information furnished by or on behalf of customers and counterparties, including financial statements, credit reports, and other financial information. The Company may also rely on representations of those customers, counterparties, or other third parties, such as independent auditors, as to the accuracy and completeness of that information. Reliance on inaccurate or misleading financial statements, credit reports, or other financial information could cause the Company to enter into unfavorable transactions, which could have a material adverse effect on the Company's financial condition and results of operations.



Because the Nature of the Financial Services Business Involves a High Volume of Transactions, the Company Faces Significant Operational Risks



The Company relies on the ability of its employees and systems to process a high number of transactions. Operational risk is the risk of loss resulting from the Company's operations, including but not limited to, the risk of fraud by employees or persons outside of the Company, the execution of unauthorized transactions by employees, errors relating to transaction processing and technology, breaches of the internal control system and compliance requirements, and business continuation and disaster recovery. This risk of loss also includes the potential legal actions that could arise as a result of an operational deficiency or as a result of noncompliance with applicable regulatory standards, adverse business decisions or their implementation, and customer attrition due to potential negative publicity. In the event of a breakdown in the internal control system, improper operation of systems or improper employee actions, the Company could suffer financial loss, face regulatory action and suffer damage to its reputation, any of which could have a material adverse effect on the Company's financial condition or results of operation.



The Company's Information Systems May Experience an Interruption or Breach in Security



The Company relies heavily on communications and information systems to conduct its business. As a financial institution, we process a significant number of customer transactions and possess a significant amount of sensitive customer information. As technology advances, the ability to initiate transactions and access data has become more widely distributed among mobile phones, personal computers, automated teller machines, remote deposit capture sites and similar access points. Any failure, interruption, or breach in security or operational integrity of our communications and information systems, or the systems of third parties on which we rely to process transactions, could result in failures or disruptions in the Company's customer relationship management, general ledger, deposit, loan, and other systems. There can be no assurance that failures, interruptions, or security breaches of the Company's information systems will not occur or, if they do occur, that they will be adequately addressed. Unauthorized third parties regularly seek to gain access to nonpublic, private and other information through computer systems. If customers' personal, nonpublic, confidential, or proprietary information in the Company's possession were to be mishandled or misused, we could suffer significant regulatory consequences, reputational damage, and financial loss. Such mishandling or misuse could include, for example, if such information were erroneously provided to parties who are not permitted to have the information, either by fault of the Company's systems, employees or counterparties, or where such information is intercepted or otherwise inappropriately taken by third parties. The occurrence of any failures, interruptions, or security breaches of the Company's information systems could, among other consequences, damage the

Company's reputation, result in a loss of customer business, subject the Company to additional regulatory scrutiny, result in increased insurance premiums, or expose the Company to civil litigation and possible financial liability, any of which could have a material adverse effect on the Company's financial condition and results of operations.



In addition, as cybersecurity and data privacy risks for banking organizations and the broader financial system have significantly increased in recent years, cybersecurity and data privacy issues have become the subject of increasing legislative and regulatory focus. The federal bank regulatory agencies have proposed enhanced cyber risk management standards, which would apply to a wide range of large financial institutions and their third-party service providers, and would focus on cyber risk governance and management, management of internal and external dependencies, and incident response, cyber resilience and situational awareness. We may become subject to new legislation or regulation concerning cybersecurity or the privacy of personally identifiable information and personal financial information or of any other information we may store or maintain. We could be adversely affected if new legislation or regulations are adopted or if existing legislation or regulations are modified such that we are required to alter our systems or require changes to our business practices or privacy policies. If cybersecurity, data privacy, data protection, data transfer or data retention laws are implemented, interpreted or applied in a manner inconsistent with our current practices, we may be subject to fines, litigation or regulatory enforcement actions or ordered to change our business practices, policies or systems in a manner that adversely impacts our operating results In addition, increased cost of compliance with cybersecurity regulations, at the federal and state level, could have a material adverse effect on the Company's financial condition and results of operations.

The Company May Be Adversely Affected by the Soundness of Other Financial Institutions



Financial services institutions are interrelated as a result of counterparty relationships. The Company has exposure to many different industries and counterparties, and routinely executes transactions with counterparties in the financial services industry. As a result, defaults by, or even rumors or questions about, one or more financial services institutions, or the financial services industry generally, could lead to losses or defaults by us or by other institutions and impact our business. Many of these transactions expose us to credit risk in the event of default of our counterparty or customer. In addition, our credit risk may be further increased when the collateral held by us cannot be relied upon or is liquidated at prices not sufficient to recover the full amount of the financial instrument exposure due to us. Any such losses could materially and adversely affect our results of operations.

The most important counterparty for the Company, in terms of liquidity, is the Federal Home Loan Bank of New York ("FHLBNY"). The Company uses FHLBNY as its primary source of borrowed overnight funds and also has several long-term advances with FHLBNY. At December 31, 2024, the Company had a total of $80 million in borrowed funds with FHLBNY. The Company has placed sufficient collateral in the form of commercial and residential real estate loans at FHLBNY. As a member of the Federal Home Loan Bank System, the Bank is required to hold stock in FHLBNY. The Bank held FHLBNY stock with a carrying value of $6.2 million as of December 31, 2024.



There are 11 branches of the FHLB, including New York. If a branch were at risk of breaching risk-based capital requirements, it could suspend dividends, cut dividend payments, and/or not buy back excess FHLB stock that members hold. FHLBNY has stated that they expect to be able to continue to pay dividends, redeem excess capital stock, and provide competitively priced advances in the future. Nonetheless, the 11 FHLB branches are jointly liable for the consolidated obligations of the FHLB system. To the extent that one FHLB branch cannot meet its obligations to pay its share of the system's debt; other FHLB branches can be called upon to make the payment.

Systemic weakness in the FHLB could result in higher costs of FHLB borrowings, reduced value of FHLB stock, and increased demand for alternative sources of liquidity that are more expensive, such as brokered time deposits, the discount window at the Federal Reserve, or lines of credit with correspondent banks.



A Decline in the Value of the Company's Deferred Tax Assets Could Adversely Affect the Company's Operating Results and Regulatory Capital Ratios



The Company's tax strategies depend on the ability to generate taxable income in future periods. The Company's tax strategies will be less effective in the event the Company fails to generate anticipated amounts of taxable income. The value of the Company's deferred tax assets is subject to an evaluation of whether it is more likely than not that they will be realized for financial statement purposes. In making this determination, management considers all positive and negative evidence available, including the Company's historical levels of taxable income, the opportunity for net operating loss carrybacks, and projections for future taxable income over the statutory tax loss carryover period. If the Company were to conclude that a significant portion of deferred tax assets were not more likely than not to be realized, the required valuation allowance could adversely affect the Company's financial position, results of operations and regulatory capital ratios. In addition, the value of the Company's deferred tax assets could be adversely affected by a change in statutory tax rates.

Strategic Risks

Expansion or Contraction of the Company's Branch Network May Adversely Affect its Financial Results



The Company cannot assure that the opening of new branches will be accretive to earnings or that it will be accretive to earnings within a reasonable period of time. Numerous factors contribute to the performance of a new branch, such as suitable location, qualified personnel, and an effective marketing strategy. Additionally, it takes time for a new branch to gather sufficient loans and deposits to generate income sufficient to cover its operating expenses. Difficulties the Bank experiences in opening new branches may have a material adverse effect on the Company's financial condition and results of operations. Difficulties the Company experiences in opening new branches may have a material adverse effect on the Company's financial condition and results of operations. The Company cannot assure that the closing of branches will not be dilutive to earnings.



Mergers and Acquisitions Involve Numerous Risks and Uncertainties



The Company may pursue mergers and acquisitions opportunities. Mergers and acquisitions involve a number of risks and challenges, including the expenses involved; diversion of management’s time and attention; integration of branches and operations acquired; potential exposure to unknown risks; increased regulatory scrutiny; the outflow of customers from the acquired branches; the successful retention of personnel from acquired companies or branches; competing effectively in geographic areas not previously served; managing growth resulting from the transaction; and dilution in the acquirer's book and tangible book value per share.



Anti-Takeover Laws and Certain Agreements and Charter Provisions May Adversely Affect Share Value



Certain provisions of the Company's certificate of incorporation and state and federal banking laws, including regulatory approval requirements, could make it more difficult for a third party to acquire control of the Company without approval of the Company's board of directors. Under federal law, subject to certain exemptions, a person, entity or group must notify the FRB before acquiring control of a bank holding company. Acquisition of 10% or more of any class of voting stock of a bank holding company, including shares of the Company's common stock, creates a rebuttable presumption that the acquiror "controls" the bank holding company if certain other conditions are met. Also, a bank holding company must obtain the prior approval of the FRB before, among other things, acquiring direct or indirect ownership or control of more than 5% of the voting shares of any bank, including the Bank. There also are provisions in the Company's certificate of incorporation that may be used to delay or block a takeover attempt. Taken as a whole, these statutory provisions and provisions in the Company's certificate of incorporation could result in the Company being less attractive to a potential acquiror and thus could adversely affect the market price of the Company's common stock.



General Risk Factors

The Company May Incur Impairment to its Goodwill

Goodwill arises when a business is purchased for an amount greater than the fair value of the net assets acquired. The Company has recognized $1.8 million of goodwill as an asset on our balance sheet in connection with the acquisition of Fairport Savings Bank on May 1, 2020. The Company evaluates goodwill for impairment at least annually. The Company has recognized goodwill as an asset on our balance sheet in connection with the acquisition of various insurance agencies and the acquisition of FSB on May 1, 2020. The Company evaluates goodwill for impairment at least annually. Although the Company determined that goodwill was not impaired during 2023, a significant and sustained decline in the Company’s stock price and market capitalization, a significant decline in our expected future cash flows, a significant adverse change in the business climate, slower growth rates or other factors could result in impairment of goodwill. If the Company were to conclude that a future write-down of the goodwill was necessary, it would record the appropriate charge to earnings, which could be materially adverse to its financial condition and results of operations. If the Company were to conclude that a future write-down of the goodwill was necessary, it 23Table of Contents would record the appropriate charge to earnings, which could be materially adverse to its financial condition and results of operations.

The Company's Business May Be Adversely Affected by Conditions in the Financial Markets and Economic Conditions Generally

The Company's financial performance generally, and in particular the ability of borrowers to pay interest on and repay principal of outstanding loans and the value of collateral securing those loans, is highly dependent upon the business environment in the markets where the Company operates, in Western New York and the Finger Lakes Region of New York State, and in the United States as a whole.

A favorable business environment is generally characterized by, among other factors, economic growth, efficient capital markets, low inflation, high business and investor confidence, and strong business earnings. Unfavorable or uncertain economic and market conditions can be caused by: declines in economic growth, declines in housing and real estate valuations, business activity or investor or business confidence; changes in monetary or fiscal policy of the federal government; limitations on the availability or increases in the cost of credit and capital; increases in inflation or interest rates; public health emergencies; geopolitical conflicts; natural disasters; or a combination of these or other factors.

The Company's performance could be negatively affected to the extent there is deterioration in business and economic conditions, including persistent inflation, rising prices, and supply chain issues or labor shortages, which have direct or indirect material adverse impacts on us, our customers, and our counterparties. Recessionary conditions may significantly affect the markets in which we do business, the financial condition of our borrowers, the value of our loans and investments, and our ongoing operations, costs and profitability. Declines in real estate values and sales volumes and increased unemployment levels may result in higher than expected loan delinquencies, increases in our levels of nonperforming and classified assets and a decline in demand for our products and services. Such events may cause us to incur losses and may adversely affect our capital, liquidity, and financial condition.



Strong Competition Within the Company's Market Area May Limit the Company's Growth and Profitability



Competition in the banking and financial services industry is intense. The Company competes with commercial banks, savings institutions, mortgage brokerage firms, credit unions, finance companies, mutual funds, brokerage and investment banking firms, and financial technology companies operating locally within the Company's market area and elsewhere. The Company competes with commercial banks, savings institutions, mortgage brokerage firms, credit unions, finance companies, mutual funds, insurance companies, brokerage and investment banking firms, and financial technology companies operating locally within the Company's market area and elsewhere. Many of these competitors (whether regional or national institutions) have substantially greater resources and lending limits than the Company does, and may offer certain services that the Company does not or cannot provide. The Company's profitability depends upon its continued ability to successfully compete in this market area.



Loss of Key Employees May Disrupt Relationships with Certain Customers



The Company’s success depends, in large part, on its ability to attract and retain skilled people. The Company's business is primarily relationship-driven in that many of the key employees of the Bank have extensive customer relationships. Loss of a key employee with such customer relationships may lead to the loss of business if the customers were to follow that employee to a competitor. While management believes that the Company's relationships with its key business producers are good, the Company cannot guarantee that all of its key personnel will remain with the organization. Further, competition for highly talented people can be intense, and we may not be able to hire sufficiently skilled people or retain them. Loss of such key personnel, particularly if they enter into an employment relationship with one of the Company's competitors, could result in the loss of some of the Company's customers. Loss of such key personnel, particularly if they enter into an employment relationship with one of the Company's competitors, could result in the loss of some of the Company's customers. Such losses could have a material adverse effect on the Company's business, financial condition and results of operations.



Damage to the Company's Reputation Could Adversely Impact Our Business



The Company's business reputation is important to its success. The ability to attract and retain customers, investors, employees and advisors may depend upon external perceptions of the Company. Damage to the Company's reputation could cause significant harm to its business and prospects and may arise from numerous sources, including litigation or regulatory actions, failing to deliver minimum standards of service and quality, compliance failures, unethical behavior and the misconduct of employees, advisors and counterparties. Negative perceptions or publicity regarding these matters could damage the Company's reputation among existing and potential customers, investors, employees and advisors. Adverse developments with respect to the financial services industry may also, by association, negatively impact the Company's reputation or result in greater regulatory or legislative scrutiny or litigation against the Company. Preserving and enhancing the Company's reputation also depends on maintaining systems and procedures that address known risks and regulatory requirements, as well as its ability to identify and mitigate additional risks that arise due to changes in businesses and the marketplaces in which the Company operates, the regulatory environment and client expectations. If any of these developments has a material effect on the Company's reputation, its business could suffer.

Furthermore, shareholders and other stakeholders have begun to consider how corporations are addressing environmental, social and governance (“ESG”) issues. Governments, investors, customers and the general public are increasingly focused on ESG practices and disclosures, and views about ESG are diverse and rapidly changing. These shifts in investing priorities may result in adverse effects on the trading price of the Company’s common stock if investors determine that the Company has not made sufficient progress on, or has overly focused, on ESG matters. These 24Table of Contents shifts in investing priorities may result in adverse effects on the trading price of the Company’s common stock if investors determine that the Company has not made sufficient progress on ESG matters. The Company could also face potential negative publicity in traditional media or social media if shareholders or other stakeholders determine that we have not adequately considered or addressed, or has overly focused on, ESG matters. The Company could also face potential negative ESG-related publicity in traditional media or social media if shareholders or other stakeholders determine that we have not adequately considered or addressed ESG matters. If the Company, or our relationships with certain customers, vendors or suppliers became the subject of negative publicity, our ability to attract and retain customers and employees, and our financial condition and results of operations, could be adversely impacted.

Changes in the Company’s Accounting Policies or in Accounting Standards Could Materially Affect How the Company Reports its Financial Results

Our accounting policies are fundamental to understanding our financial results and condition. Some of these policies require the use of estimates and assumptions that may affect the value of our assets or liabilities and financial results. Some of our accounting policies are critical because they require management to make difficult, subjective and complex judgments about matters that are inherently uncertain and because it is likely that materially different amounts would be reported under different conditions or using different assumptions. If such estimates or assumptions underlying our financial statements are incorrect, we may experience material losses.

Additionally, from time to time, the FASB and the SEC change the financial accounting and reporting standards or the interpretation of those standards that govern the preparation of our external financial statements. These changes are beyond our control, can be hard

to predict and could materially impact how we report our results of operations and financial condition. We could be required to apply a new or revised standard retroactively, resulting in our restating prior period financial statements in material amounts.

Item 1B.UNRESOLVED STAFF COMMENTS

None.

Item 1C. CYBERSECURITY

Overall Risk Management and Strategy

The Company manages its cybersecurity risk in a manner consistent with its overall risk management process in which recognized and emerging risks are identified, assessed, controlled, and monitored on a continual basis. The Company’s cybersecurity risk management follows the “Three Lines of Defense” framework, which is as follows: (1) in the first line of defense, our Information Security function manages cybersecurity risks and controls; (2) in the second line of defense, independent internal risk management provides cybersecurity risk governance oversight; and (3) our Internal Audit function provides independent assurance over cybersecurity practices as the third line of defense.

The Company leverages third parties to support the development and independent validation of cybersecurity risk management practices. Third-party cybersecurity risk oversight includes engaging consultants in the development and deployment of cybersecurity control processes, and a managed security services provider to provide 24/7 alert monitoring and remediation services, semi-annual independent vulnerability and penetration tests from rotating providers, and an annual information security audit coordinated by the Company’s Internal Audit function.

All third-party service providers to the Company are subject to risk assessments to identify the risks, including cybersecurity-related risks, posed by that individual third-party. Changes in vendor services result in a reassessment of risk. Based on the results of the risk assessment, the Company requires each third-party service provider to meet certain due diligence requirements. These due diligence requirements require third-party service providers to provide the Company with evidence of appropriate policies, an independent examination of their control environment, financial results, and operational resilience, as appropriate.

To date, no prior internal cybersecurity incident has materially affected the Company, however, external incidents have increased attention to risk management processes which continually identify and assess threats to the Company’s operations with consideration to strategy, financial results, and business resilience.

Governance

The Enterprise Risk Committee of the Board of Directors is responsible for the oversight of cybersecurity risk at the Company. The Company has established a Cyber and Technology Risk Appetite Statement, which is approved annually by the Enterprise Risk Committee. Changes in cybersecurity risk are monitored throughout the year and are reported to the Enterprise Risk Committee.

The Enterprise Risk Committee is kept informed of these risks through reporting by the Chief Information Security Officer (“CISO”) and is also charged with reviewing cybersecurity policies, results of an annual information security risk assessment, NYS DFS Compliance Status, and other information security risk assessments or analysis of significant events that may occur throughout the year. The Enterprise Risk Committee additionally reviews the results of vulnerability and penetration testing, tabletop exercises, and other examinations performed, whether internal or external, with a focus on cybersecurity. The Enterprise Risk Committee is kept informed of cybersecurity risks through the Company’s first and second lines of defense, including the Company’s CISO, which provide the following to the Enterprise Risk Committee on a quarterly basis, or more frequently as needed: an analysis comparing actual results against the Company’s Cyber and Technology Risk Appetite Statement, an evaluation on current cybersecurity risks facing the company, and identification of any new or emerging risks associated with cybersecurity. The Audit Committee of the Board of Directors is also informed of any cybersecurity risk that is identified in annual information security specific internal audits or material cybersecurity risks that may have an impact on the financial statements and related disclosures of the Company.

The Company has established a clear chain of command in the management of cybersecurity risks by designating a CISO and Chief Information Officer (“CIO”), who jointly lead the Company’s incident response team, which also includes the company’s management team. The CISO has certifications in information security, and together, the CISO and CIO have over 25 years of cybersecurity experience combined. The CISO and CIO meet with Company senior leadership at least quarterly through an Information Technology Steering Committee in which management assess information security risk. The Company has subscribed to threat intelligence feeds that are reviewed throughout the day to ensure risks are identified and assessed in a timely manner.

The Company monitors industry events and leverages additional resources to monitor any new threats and vulnerability information. Systemic prevention controls are deployed to protect endpoints, as well as to prevent malicious code, emails, and websites from attempts to gain access to the network. Company personnel are trained on a recurring basis on best practices to protect the Company from cybersecurity risks. The Company’s assets are subject to recovery procedures to bring the asset back to its required state of operations, and these recovery procedures are tested internally by the Company to verify the capabilities of these procedures. The Company has developed an Incident Response Policy and Plan that assigns appropriate responsibilities in the event of an incident. This assignment of responsibilities allows the Company to assess and respond to any incident in a timely manner. This plan is tested on a recurring basis to maintain preparedness in the event of an actual incident.