CNB FINANCIAL CORP/PA (CCNE) Business

ITEM 1.  BUSINESS

CNB Financial Corporation (the "Corporation") is a financial holding company registered under the Bank Holding Company Act of 1956, as amended (the "BHC Act"). It was incorporated under the laws of the Commonwealth of Pennsylvania in 1983 for the purpose of engaging in the business of a financial holding company. On April 26, 1984, the Corporation acquired all of the outstanding capital stock of County National Bank, a national banking chartered institution. In December 2006, County National Bank changed its name to CNB Bank (the "Bank") and became a state bank chartered in Pennsylvania and subject to regulation by the Pennsylvania Department of Banking and Securities and the Federal Deposit Insurance Corporation. In October 2013, the Corporation acquired FC Banc Corp. and its subsidiary, The Farmers Citizens Bank. In July 2016, the Corporation acquired Lake National Bank, and in July 2020, the Corporation acquired Bank of Akron.

On July 23, 2025, the Corporation completed its previously announced acquisition of ESSA Bancorp, Inc. ("ESSA") and its subsidiary bank, ESSA Bank & Trust Company ("ESSA Bank"), pursuant to the definitive merger agreement (the "Merger Agreement") dated as of January 9, 2025. The Corporation’s acquisition of ESSA was an all-stock transaction. Under the terms of the Merger Agreement, ESSA merged with and into the Corporation, with the Corporation as the surviving entity, and immediately thereafter, ESSA Bank merged with and into the Bank, with the Bank as the surviving bank. Banking offices of ESSA Bank operate under the trade name ESSA Bank, a division of CNB Bank.

Pursuant to the Merger Agreement, each outstanding share of ESSA common stock was converted into the right to receive 0.8547 shares of the Corporation’s common stock. The total consideration paid to ESSA shareholders was approximately $202.6 million, comprised of approximately 8,359,430 shares of the Corporation's common stock, valued at approximately $202.5 million based on the July 23, 2025 closing price of $24.23 per share of the Corporation's common stock, and $21 thousand in cash in lieu of fractional shares. The ESSA acquisition has extended CNB Bank’s branch network into the Northeastern Region including the Lehigh Valley of Pennsylvania through the addition of ESSA’s 20 community offices.

In addition to the Bank, the Corporation has four other subsidiaries. CNB Securities Corporation is incorporated in Delaware and currently maintains investments in debt and equity securities. CNB Insurance Agency, incorporated in Pennsylvania, provides for the sale of nonproprietary annuities and other insurance products. CNB Risk Management, Inc. is a Delaware-based captive insurance company which insures against certain risks unique to the operations of the Corporation and its subsidiaries and for which insurance may not be currently available or economically feasible in today's insurance marketplace. Holiday Financial Services Corporation ("Holiday"), incorporated in Pennsylvania, offers small balance unsecured loans and secured loans, primarily collateralized by automobiles and equipment, to borrowers with higher risk characteristics and currently has nine offices within the Corporation’s market area.

CNB Bank

The Bank was originally chartered as a national bank in 1934 and is now a Pennsylvania-chartered bank. The CNB Bank franchise operates nineteen full-service branch locations in Central and North Central Pennsylvania.

ERIEBANK, a division of the Bank, began operations in 2005. In July 2016, the Corporation acquired Lake National Bank, which operated two full-service branches in Mentor, Ohio, approximately 20 miles east of Cleveland, Ohio. The Bank continues to operate one of these branch locations within its ERIEBANK franchise, with the other location ceasing operations in August 2020. In December 2021, the Corporation opened a full-service branch in Cleveland, Ohio. The Bank currently operates fourteen full-service branch locations within its ERIEBANK franchise, a division of the Bank, with its headquarters in Erie, Pennsylvania.

In October 2013, the Corporation acquired FC Banc Corp. and its subsidiary, The Farmers Citizens Bank. The Bank currently operates seven full-service branch locations as FCBank, a division of the Bank, with its headquarters in Worthington, Ohio.

1

Table of Contents

In 2016, the Bank received regulatory approval to conduct business in the State of New York as BankOnBuffalo, a division of the Bank. In July 2020, the Corporation acquired Bank of Akron, with its branch locations operating with BankOnBuffalo. The Bank currently operates twelve full-service branch locations, one mobile branch and two drive-up office as BankOnBuffalo, a division of the Bank, with its headquarters in Buffalo, New York.

In 2021, the Bank received regulatory approval to conduct business in the Commonwealth of Virginia as Ridge View Bank, a division of the Bank. The Bank currently operates three full-serve branch locations and one loan production office in Southwest Virginia.

In 2023, the Bank launched Impressia Bank, a full-service banking division dedicated to the professional and financial development and advancement of women business owners and women leaders. This women-focused commercial bank operates within the existing geographic footprint of each of CNB Bank’s other divisions and also has an online presence.

In 2025, the Corporation acquired ESSA Bancorp, Inc., and its subsidiary, ESSA Bank & Trust Company. The Bank currently operates twenty full-service branch locations as ESSA Bank, a division of the Bank, with its headquarters in Stroudsburg, Pennsylvania.

The Bank had one loan production office, two drive-up office, one mobile office, and 75 full-service branch offices located in various communities in its market area at December 31, 2025. The CNB Bank franchise's primary market areas are the Pennsylvania counties of Blair, Cambria, Centre, Clearfield, Elk, Indiana, Jefferson, and McKean. ERIEBANK, a division of the Bank, operates in the Pennsylvania counties of Crawford, Erie, and Warren and in the Ohio counties of Ashtabula, Cuyahoga, Geauga, Lake, and Lorain. FCBank, a division of the Bank, operates in the Ohio counties of Crawford, Delaware, Franklin, Knox, Marion, Morrow and Richland. BankOnBuffalo, a division of the Bank, operates in the New York counties of Erie, Niagara, and Ontario. Ridge View Bank, a division of the Bank, operates in the Virginia counties of Botetourt, Craig, Franklin, New River Valley, and Roanoke. ESSA Bank, a division of the Bank, operates in the Pennsylvania counties of Delaware, Chester, Lackawanna, Lehigh, Luzerne, Monroe, and Northampton. Impressia Bank, a division of the Bank, operates in the Bank’s primary market areas.

The Bank is a full-service bank engaging in a full range of banking activities and services for individual, business, governmental and institutional customers. These activities and services principally include checking, savings, and time deposit accounts; real estate, commercial, industrial, residential and consumer loans; and a variety of other specialized financial services. The Bank’s Private Client Solutions division offers a full range of client services, including private banking and wealth and asset management.

Competition

The financial services industry in the Corporation’s service area continues to be extremely competitive, both among commercial banks and with other financial service providers such as consumer finance companies, thrifts, investment firms, mutual funds, and credit unions. The increased competition has resulted from changes in legal and regulatory guidelines as well as from economic conditions. Mortgage banking firms, leasing companies, financial affiliates of industrial companies, brokerage firms, retirement fund management firms, and even government agencies provide additional competition for loans and other financial services. Some of the financial service providers operating in the Corporation’s market area operate on a large-scale regional or national basis and possess greater resources than those of the Corporation. The Corporation is generally competitive with all competing financial institutions in its service area with respect to interest rates paid on time and savings deposits, service charges on deposit accounts, and interest rates charged on loans.

2

Table of Contents

Supervision and Regulation

The Corporation is a bank holding company that has elected financial holding company status, and the Bank is a Pennsylvania state‑chartered bank. The Corporation is subject to the oversight and regulation of the Board of Governors of the Federal Reserve System (the "Federal Reserve Board") and the Pennsylvania Department of Banking and Securities under the Bank Holding Company Act ("BHC Act"). Prior to February 12, 2026, the Bank was a Pennsylvania state‑chartered, non‑member bank supervised by the Pennsylvania Department of Banking and Securities and the Federal Deposit Insurance Corporation ("FDIC") as its primary federal regulator. Effective February 12, 2026, the Bank became a member bank of the Federal Reserve System, and its primary federal regulator is now the Federal Reserve Board. Therefore, the Bank remains a Pennsylvania state-chartered bank and continues to be subject to oversight by the Pennsylvania Department of Banking and Securities, but it is now a member bank with the Federal Reserve Board as its primary federal regulator, instead of the FDIC. The Corporation and the Bank are also subject to various requirements and restrictions under federal and state law, such as requirements to maintain reserves against deposits, restrictions on the types, amounts and terms and conditions of loans that may be granted, and limitations on the types of investments that may be made and the types of services that may be offered. Various consumer financial protection laws and regulations also affect the operation of the Bank and, pursuant to the Dodd-Frank Wall Street Reform and Consumer Protection Act (the "Dodd-Frank Act"), the Consumer Financial Protection Bureau ("CFPB") is authorized to write additional rules on consumer financial products and services which could affect the operations of the Bank and Holiday. In addition to the impact of regulation, commercial banks are significantly affected by the actions of the Federal Reserve Board, including actions taken with respect to interest rates, as the Federal Reserve Board attempts to control the money supply and credit availability in the U.S. in order to influence the economy.

The following summary sets forth certain of the material elements of the regulatory framework applicable to bank holding companies and their subsidiaries and provides certain specific information about us and our subsidiaries. It does not describe all of the provisions of the statutes, regulations and policies that are identified. To the extent that the following information describes statutory and regulatory provisions, it is qualified in its entirety by express reference to each of the particular statutory and regulatory provisions. A change in applicable statutes, regulations or regulatory policy may have a material effect on our business.

Bank Holding Company Regulation

As a bank holding company that controls a Pennsylvania state-chartered bank, the Corporation is subject to regulation and examination by the Pennsylvania Department of Banking and Securities and the Federal Reserve Board. We are required to file with the Federal Reserve Board an annual report and such additional information and submissions as the Federal Reserve Board may require pursuant to the BHC Act and applicable regulations. For instance, the BHC Act requires each bank holding company to obtain the approval of the Federal Reserve Board before it may acquire substantially all the assets of any bank, or before it may acquire ownership or control of any voting shares of any bank if, after such acquisition, it would own or control, directly or indirectly, more than five percent of any class of voting shares of such bank. Such a transaction may also require approval of the Pennsylvania Department of Banking and Securities.

Pursuant to provisions of the BHC Act and regulations promulgated by the Federal Reserve Board thereunder, the Corporation may only engage in, or own companies that engage in, activities deemed by the Federal Reserve Board to be permissible for bank holding companies or financial holding companies. Activities permissible for bank holding companies include those that are so closely related to banking or managing or controlling banks as to be a proper incident thereto. Activities for financial holding companies include those that are "so closely related to banking as to be a proper incident thereto" as well as certain additional activities deemed "financial in nature or incidental to such financial activity" or complementary to a financial activity and that do not pose a substantial risk to the safety and soundness of the banking organization or the financial system.

The Corporation must obtain permission from or provide notice to the Federal Reserve Board prior to engaging in most new business activities.

Regulation of CNB Bank

Federal and state banking laws and regulations govern, among other things, the scope of a bank’s business, the investments a bank may make, the reserves against deposits a bank must maintain, the loans a bank makes and collateral it takes, the activities of a bank with respect to mergers and acquisitions, the establishment of branches, management practices, and numerous other aspects of banking operations.

3

Table of Contents

Source of Strength Doctrine

Under Section 616 of the Dodd-Frank Act, a bank holding company is required to serve as a source of financial strength to its subsidiary banks and may not conduct its operations in an unsafe or unsound manner. In addition, it is the Federal Reserve Board’s policy that a bank holding company must also serve as a source of managerial strength to its subsidiary banks, and a bank holding company should stand ready to use available resources to provide adequate capital funds to its subsidiary banks during periods of financial stress or adversity and should maintain the financial flexibility and capital-raising capacity to obtain additional resources for assisting its subsidiary banks. A bank holding company’s failure to meet its obligations to serve as a source of strength to its subsidiary banks will generally be considered by the Federal Reserve Board to be an unsafe and unsound banking practice, a violation of the Federal Reserve Board regulations, or both. This doctrine is commonly known as the "source of strength" doctrine.

Identity Theft

The Fair Credit Reporting Act’s Red Flags Rule requires financial institutions with covered accounts (e.g., consumer bank accounts and loans) to develop, implement, and administer an identity theft prevention program. This program must include reasonable policies and procedures to detect suspicious patterns or practices that indicate the possibility of identity theft, such as inconsistencies in personal information or changes in account activity.

Capital Adequacy

The Capital Rules adopted in 2013 by the Federal Reserve Board, the FDIC, and the Office of the Comptroller of the Currency ("OCC") generally implement the Basel Committee on Banking Supervision’s capital framework, referred to as Basel III, for strengthening international capital standards. The Capital Rules revised the definitions and components of regulatory capital, increased risk-based capital requirements, and made selected changes to the calculation of risk-weighted assets. The risk-weighting categories in the Capital Rules are standardized and include a risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. government and agency securities to 600% for certain equity exposures, and resulting in higher risk weights for a variety of assets.

The Capital Rules: (i) include "Common Equity Tier 1" ("CET1") and a related regulatory capital ratio of CET1 to risk-weighted assets; (ii) specify that Tier 1 capital consists of CET1 and "Additional Tier 1 capital" instruments meeting certain revised requirements; (iii) mandate that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital; and (iv) expand the scope of the deductions from and adjustments to capital as compared to existing regulations. Under the Capital Rules, for most banking organizations, including the Corporation, the most common form of Additional Tier 1 capital is non-cumulative perpetual preferred stock, and the most common forms of Tier 2 capital are subordinated notes and a portion of the allocation for allowance for credit losses, in each case, subject to the Capital Rules’ specific requirements.

Pursuant to the Capital Rules, the minimum capital ratios are as follows:

•4.5% CET1 to risk-weighted assets;

•6.0% Tier 1 capital (that is, CET1 plus Additional Tier 1 capital) to risk-weighted assets;

•8.0% Total capital (that is, Tier 1 capital plus Tier 2 capital) to risk-weighted assets; and

•4.0% Tier 1 capital to average consolidated assets as reported on consolidated financial statements (called "leverage ratio").

The Capital Rules also include a "capital conservation buffer," composed entirely of CET1, in addition to these minimum risk-weighted asset ratios (which are each of the first three ratios described above, but not the leverage ratio). The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions that do not hold the requisite capital conservation buffer will face constraints on dividends, capital instrument repurchases, interest payments on capital instruments and discretionary bonus payments based on the amount of the shortfall. Thus, the capital standards applicable to the Corporation include an additional capital conservation buffer of 2.5% of CET1, effectively resulting in minimum ratios inclusive of the capital conservation buffer of (i) CET1 to risk-weighted assets of at least 7%, (ii) Tier 1 capital to risk-weighted assets of at least 8.5%, and (iii) total capital to risk-weighted assets of at least 10.5%.

4

Table of Contents

The Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing assets, deferred tax assets arising from temporary differences that could not be realized through net operating loss carrybacks, and significant investments in non-consolidated financial entities be deducted from CET1 above certain thresholds. In July 2019, the OCC, the Federal Reserve Board and the FDIC adopted a final rule intended to simplify the Capital Rules described above for non-advanced approaches rule institutions, including provisions related to these deductions and adjustments. Institutions were required to implement the provisions of the simplification rule by April 1, 2020.

The Capital Rules also permit most banking organizations to retain, through a one-time permanent election, the capital treatment that existed before the 2013 Capital Rules were issued for accumulated other comprehensive income. The Corporation made the one-time permanent election to retain the previous capital treatment for accumulated other comprehensive income.

The Capital Rules also preclude certain hybrid securities, such as trust preferred securities, from inclusion in bank holding companies’ Tier 1 capital, although bank holding companies that had total consolidated assets of less than $15 billion at December 31, 2009 may include trust preferred securities issued prior to May 19, 2010 as a component of Tier 1 capital.

In September 2019, the OCC, the Federal Reserve Board and the FDIC adopted a final rule that is intended to further simplify the Capital Rules for depository institutions and their holding companies that have less than $10 billion in total consolidated assets, such as us, if such institutions meet certain qualifying criteria. This final rule became effective on January 1, 2020. Under this final rule, if we meet the qualifying criteria, including having a leverage ratio (equal to Tier 1 capital divided by average total consolidated assets) greater than 9%, we will be eligible to opt into the community bank leverage ratio framework. If we opt into this framework, we will be considered to have satisfied the generally applicable risk-based and leverage capital requirements in the Capital Rules (as modified pursuant to the simplification rule) and will be considered to have met the well-capitalized ratio requirements for Prompt Corrective Action ("PCA") purposes. To date, we have not opted in to this community bank leverage ratio framework.

Dividend Restrictions

The Corporation is a legal entity separate and distinct from the Bank. Declaration and payment of cash dividends by the Corporation depends upon cash dividend payments to the Corporation by the Bank, which is our primary source of revenue and cash flow.

As a Pennsylvania state-chartered bank, the Bank is subject to regulatory restrictions on the payment and amounts of dividends under the Pennsylvania Banking Code. Further, the ability of banking subsidiaries to pay dividends is also subject to their profitability, financial condition, capital expenditures and other cash flow requirements.

The payment of dividends by the Bank and the Corporation may also be affected by other factors, such as the requirement to maintain adequate capital above regulatory requirements. The federal banking agencies have indicated that paying dividends that deplete a depository institution’s capital base to an inadequate level would be an unsafe and unsound banking practice. A depository institution may not pay any dividend if payment would cause it to become undercapitalized or if it already is undercapitalized. Moreover, the federal banking agencies have issued policy statements that provide that bank holding companies and insured banks should generally only pay dividends out of current operating earnings. Federal banking regulators have the authority to prohibit banks and bank holding companies from paying a dividend if the regulators deem such payment to be an unsafe or unsound practice.

Prompt Corrective Action and Safety and Soundness

Under applicable PCA statutes and regulations, depository institutions are placed into one of five capital categories, ranging from "well capitalized" to "critically undercapitalized." The PCA statute and regulations provide for progressively more stringent supervisory measures as an insured depository institution’s capital category declines. An institution that is not well capitalized is generally prohibited from accepting brokered deposits and offering interest rates on deposits higher than the prevailing rate in its market. An undercapitalized depository institution must submit an acceptable restoration plan to the appropriate federal banking agency. One requisite element of such a plan is that the institution’s parent holding company must guarantee compliance by the institution with the plan, subject to certain limitations.

At December 31, 2025, the Bank qualified as "well capitalized" under applicable regulatory capital standards.

5

Table of Contents

Bank holding companies and insured depository institutions may also be subject to potential enforcement actions of varying levels of severity by the federal banking agencies for unsafe or unsound practices in conducting their business, or for violation of any law, rule, regulation, condition imposed in writing by the agency, or term of a written agreement with the agency. In more serious cases, enforcement actions may include the issuance of directives to increase capital; the issuance of formal and informal agreements; the imposition of civil monetary penalties; the issuance of a cease and desist order that can be judicially enforced; the issuance of removal and prohibition orders against officers, directors, and other institution affiliated parties; the termination of the insured depository institution’s deposit insurance; the appointment of a conservator or receiver for the insured depository institution; and the enforcement of such actions through injunctions or restraining orders based upon a judicial determination that the FDIC, as receiver, would be harmed if such equitable relief was not granted.

On May 30, 2023, ESSA Bank entered into a consent order with the United States of America, as approved by the United States District Court for the Eastern District of Pennsylvania, Civil Action No. 23-cv-2065l (the "ESSA Consent Order") to resolve allegations of violations of the Fair Housing Act and Equal Credit Opportunity Act within the Philadelphia-Camden-Wilmington, PA-NJ-DE-MD Metropolitan Statistical area. The ESSA Consent Order required ESSA Bank to, among other things, (i) invest a minimum of $2.92 million in a loan subsidy fund to increase credit opportunities to residents of majority-Black and Hispanic census tracts in ESSA Bank’s lending area, and (ii) devote a minimum of $125,000 on community partnerships and $250,000 toward advertising, outreach, consumer financial education, and credit counseling focused on majority-Black and Hispanic census tracts within ESSA Bank’s lending area. In addition, ESSA Bank was required to continue to maintain the positions of the two new mortgage loan officers hired pursuant to the ESSA Consent Order in its existing branches in West Philadelphia and its full-time Community Development Officer position to oversee these efforts throughout the term of the ESSA Bank Consent Order. As required by the terms of the ESSA Consent Order, the Bank, as the resulting institution in the merger with ESSA Bank, agreed to and assumed all obligations under the ESSA Consent Order in connection with the merger.

Community Reinvestment Act

Under the Community Reinvestment Act of 1977 ("CRA"), the Bank’s primary federal regulator is required to assess the Bank’s record in meeting the credit needs of the communities it serves, including low‑ and moderate‑income neighborhoods. Because the Bank became a member bank of the Federal Reserve System effective February 12, 2026, the Federal Reserve Board is now the Bank’s primary federal regulator for CRA purposes. CRA performance evaluations are considered in evaluating applications for such things as mergers, acquisitions, and applications to open branches. The Bank received a CRA rating of "Satisfactory" at its most recent CRA exam. The federal banking agencies—the Federal Reserve, FDIC, and OCC—issued substantially updated CRA regulations in October 2023, with technical amendments in March 2024. However, in July 2025, the federal bank regulatory agencies issued a proposal to rescind the CRA regulations issued in October 2023 and replace them with the prior CRA regulations, with certain technical amendments. The federal banking agencies continue to apply the prior CRA regulations, and not the regulations issued in October 2023, in the interim as the October 2023 regulations are subject to legal action and have not taken effect.

Restrictions on Transactions with Affiliates and Insiders

The Bank is subject to the restrictions of Sections 23A and 23B of the Federal Reserve Act and the implementing Regulation W. The Bank's "affiliates" for purposes of these sections include, among other potential entities, the Corporation and its direct subsidiaries. Section 23A requires that loans or extensions of credit by the Bank to an affiliate, purchases by the Bank of securities issued by an affiliate, purchases by the Bank of assets from an affiliate (except as may be exempted by order or regulation), the Bank’s acceptance of securities or debt obligations issued by an affiliate as collateral for a loan or extension of the credit to a third party, the Bank’s acceptance of a guarantee or letter of credit on behalf of an affiliate, a transaction with an affiliate involving the borrowing or lending of securities to the extent the transaction causes the Bank to have credit exposure to the affiliate, and a derivative transaction with an affiliate, to the extent the Bank will have credit exposure to the affiliate (collectively, "Covered Transactions") be on terms and conditions consistent with safe and sound banking practices. Section 23A also imposes various qualitative and quantitative requirements and restrictions on Covered Transactions and imposes collateralization and other requirements on certain of these transactions. Section 23B requires that all Covered Transactions and certain other transactions, including the sale of securities or other assets by the Bank to an affiliate and the payment of money or the furnishing of services by the Bank to an affiliate, be on terms comparable to those prevailing for similar transactions with nonaffiliates.

6

Table of Contents

The Bank is also subject to Sections 22(g) and 22(h) of the Federal Reserve Act, and the implementation of Regulation O issued by the Federal Reserve Board. These provisions impose limitations on loans and extensions of credit by the Bank to its and its affiliates' executive officers, directors and principal shareholders and their related interests. The limitations restrict the terms and aggregate amount of such transactions. Regulation O also imposes certain recordkeeping and reporting requirements.

Deposit Insurance and Premiums

The deposits of the Bank are insured up to applicable limits per insured depositor by the FDIC. The standard maximum deposit insurance amount is $250,000 per depositor, per insured depository institution, per ownership category, in accordance with applicable FDIC regulations.

The FDIC uses a risk-based assessment system that imposes insurance premiums based on a risk matrix that takes into account the bank’s capital level and supervisory rating. The base for insurance assessments is the average consolidated total assets less tangible equity capital of a financial institution. Assessment rates are calculated using formulas that take into account the risk of the institution being assessed.

In November 2023, the FDIC announced a special assessment on all insured depository institutions with more than $5 billion in total assets, including the Bank, in order to recover the loss to the DIF associated with protecting uninsured depositors following the closures of Silicon Valley Bank and Signature Bank. The special assessment was originally intended to be collected over an eight-quarter collection period, beginning with the first quarterly assessment period of 2024. The FDIC announced in August 2025 that the collection period will be extended for at least one more quarter. This extension of the collection period reflects the adjustment needed given changes to the loss estimates or changes in the amounts collected by the FDIC as compared to estimates. The assessment base for the special assessment is equal to an insured depository institution’s ("IDI’s") estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion, applicable either to the IDI, if an IDI is not a subsidiary of a holding company, or at the banking organization level, to the extent that an IDI is part of a holding company with one or more subsidiary IDIs.

Financial Privacy and Data Security

The Corporation is subject to federal laws, including the Gramm-Leach-Bliley Act, and certain state laws containing consumer privacy protection provisions. These provisions limit the ability of banks and other financial institutions to disclose nonpublic information about consumers to affiliated and non-affiliated third parties and limit the reuse of certain consumer information received from non-affiliated financial institutions. These provisions require notice of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain nonpublic personal information to affiliates or non-affiliated third parties by means of opt-out or opt-in authorizations.

The Gramm-Leach-Bliley Act requires that financial institutions implement comprehensive written information security programs that include administrative, technical, and physical safeguards to protect consumer information. Federal banking agencies have also adopted guidelines for establishing information security standards and programs to protect such information. Further, pursuant to interpretive guidance issued under the Gramm-Leach-Bliley Act and certain state laws, financial institutions are required to notify customers of security breaches that result in unauthorized access to their nonpublic personal information.

Incentive Compensation

The Dodd-Frank Act requires the federal banking agencies and the Securities and Exchange Commission (the "SEC") to establish joint regulations or guidelines prohibiting incentive-based payment arrangements at specified regulated entities, including the Corporation and the Bank, with at least $1 billion in total consolidated assets that encourage inappropriate risks by providing an executive officer, employee, director or principal shareholder with excessive compensation, fees, or benefits that could lead to material financial loss to the entity. The federal banking agencies and the SEC proposed such regulations in 2016, and issued re-proposed regulations in substantially the same form in May 2024, which have not been finalized. If the regulations are adopted in the form proposed or a similar form, they will restrict the manner in which executive compensation is structured.

7

Table of Contents

USA PATRIOT Act

Under Title III of the USA PATRIOT Act, all financial institutions are required to take certain measures to identify their customers, prevent money laundering, monitor customer transactions, and report suspicious activity to U.S. law enforcement agencies. Financial institutions also are required to respond to requests for information from federal banking agencies and law enforcement agencies. Information sharing among financial institutions for the above purposes is encouraged by an exemption granted to complying financial institutions from the privacy provisions of the Gramm-Leach-Bliley Act and other privacy laws. Financial institutions that hold correspondent accounts for foreign banks or provide private banking services to foreign individuals are required to take measures to avoid dealing with certain foreign individuals or entities, including foreign banks with profiles that raise money laundering concerns, and are prohibited from dealing with foreign "shell banks" and persons from jurisdictions of particular concern. The primary federal banking agencies and the Secretary of the Treasury have adopted regulations to implement several of these provisions. All financial institutions also are required to establish internal anti-money laundering programs. The effectiveness of a financial institution in combating money laundering activities is a factor to be considered in any application submitted by the financial institution under the Bank Merger Act. The Bank has in place a Bank Secrecy Act and USA PATRIOT Act compliance program and engages in very few transactions of any kind with foreign financial institutions or foreign persons.

Office of Foreign Assets Control Regulation

The United States government has imposed economic sanctions that affect transactions with designated foreign countries, nationals, and others. These are typically known as the "OFAC" rules based on their administration by the U.S. Treasury Department Office of Foreign Assets Control. The Office of Foreign Assets Control-administered sanctions targeting countries take many different forms. Generally, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on U.S. persons engaging in financial transactions relating to making investments in, or providing investment-related advice or assistance to, a sanctioned country; and (ii) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (property and bank deposits) cannot be paid out, withdrawn, set off, or transferred in any manner without a license from the Office of Foreign Assets Control. Failure to comply with these sanctions could have serious legal and reputational consequences.

Other Federal Laws and Regulations

State usury and other credit laws limit the amount of interest and various other charges collected or contracted by a bank on loans. The Bank is also subject to lending limits on loans to one borrower and regulatory guidance on concentrations of credit. The Bank’s loans and other products and services are also subject to numerous federal and state consumer financial protection laws, including, but not limited to, the following:

•Truth-In-Lending Act, which governs disclosures of credit terms to consumer borrowers;

•Truth-in-Savings Act, which governs disclosures of the terms of deposit accounts to consumers;

•Home Mortgage Disclosure Act, requiring financial institutions to provide information to regulators to enable determinations as to whether financial institutions are fulfilling their obligations to meet the home lending needs of the communities they serve and not discriminating in their lending practices;

•Equal Credit Opportunity Act, prohibiting discrimination on the basis of race, sex or other prohibited factors in extending credit;

•Real Estate Settlement Procedures Act, which imposes requirements relating to real estate settlements, including requiring lenders to disclose certain information regarding the nature and cost of real estate settlement services;

•Fair Credit Reporting Act, covering numerous areas relating to certain types of consumer information and identity theft;

•Privacy provisions of the Gramm-Leach-Bliley Act and related regulations, which require that financial institutions provide privacy policies to consumers, to allow customers to "opt out" of certain sharing of their nonpublic personal information, and to safeguard sensitive and confidential customer information;

•Electronic Funds Transfer Act, which is a consumer protection law regarding electronic fund transfers; and

•Numerous other federal and state laws and regulations, including those related to consumer protection and bank operations.

8

Table of Contents

Governmental Policies

Our earnings are significantly affected by the monetary and fiscal policies of governmental authorities, including the Federal Reserve Board. Among the instruments of monetary policy used by the Federal Reserve Board to implement these objectives are open-market operations in U.S. Government securities and federal funds, changes in the discount rate on member bank borrowings and changes in reserve requirements against member bank deposits. These instruments of monetary policy are used in varying combinations to influence the overall level of bank loans, investments and deposits, and the interest rates charged on loans and paid for deposits. The Federal Reserve Board frequently uses these instruments of monetary policy, especially its open-market operations and the discount rate, to influence the level of interest rates and to affect the strength of the economy, the level of inflation or the price of the dollar in foreign exchange markets. The monetary policies of the Federal Reserve Board have had a significant effect on the operating results of banking institutions in the past and are expected to continue to do so in the future. It is not possible to predict the nature of future changes in monetary and fiscal policies, or the effect which they may have on our business and earnings.

Other Legislative Initiatives

Proposals may be introduced in the United States Congress, in the Pennsylvania Legislature, and/or by various bank regulatory authorities that could alter the powers of, and restrictions on, different types of banking organizations and which could restructure part or all of the existing regulatory framework for banks, bank and financial holding companies and other providers of financial services. Moreover, other bills may be introduced in Congress which would further regulate, deregulate or restructure the financial services industry, including proposals to substantially reform the regulatory framework. It is not possible to predict whether any such proposals will be enacted into law or, even if enacted, what effect such action may have on our business and earnings.

Human Capital

As of December 31, 2025, the Corporation had a total of 950 employees, of which 917 were full time and 33 were part time.

The Corporation respects and values the responsibilities of the Corporation to act with integrity in a number of community-focused areas, including being reasonably environmentally considerate, and avoiding discrimination of any investors, customers, or employees by promoting a company culture that reflects of the communities the Corporation serves. The Corporation emphasizes relevant governance principles and compliance considerations in strategic planning, human capital management and leadership development (which includes recruiting and retaining employees), and vendor management, as relationships with third parties represent critical connections to and extensions of the values, operating principles, and the commitment to legal and regulatory compliance of the Corporation and the Board of Directors.

Strategic Planning and Related Training

The Corporation has established a formal Strategic Plan, the framework of which has, as its foundation, the core values and principles that have been fundamental to the Corporation’s long-term success. These attributes include respect, integrity, accountability, leadership, professionalism, collaboration, client-focused, innovation, inclusion, and volunteerism. In establishing these core values and principles as the foundation upon which all other strategic objectives are anchored, the Corporation seeks to further develop and sustain a corporate culture with sensitivity to the entirety of the Corporation’s business and demographic footprint and environment in which it operates. The differences among the Corporation's Board of Directors and employees, and its customers and community members, are respected and embraced to drive innovative products, services, and solutions that effectively meet the variety of needs among the Corporation’s broad group of stakeholders.

9

Table of Contents

Human Capital Management and Leadership Development

The Corporation firmly believes in the importance of succession planning and, as such, has in place a formal succession planning process for all named executive officers, members of the executive management team, and regional presidents. The succession plan was successfully utilized in 2024 after the resignation of a named executive officer, resulting in a seamless transition of related areas of responsibility to other members of the Senior Management within the Corporation. A critical factor of the Corporation’s succession plan is the training and development of its management team to create a strong internal pipeline of talent to produce the future leaders of the Corporation. The Corporation’s succession planning process is further strengthened by the Corporation's presence in diversified markets that lead to opportunities to attract and retain talent with broad-based skills and experiences.

The Corporation is dedicated to recognizing the unique contribution of each employee and is committed to supporting a workplace that understands, accepts and values the similarities and differences between individuals. The Corporation’s key human capital management objectives are to recruit, hire, develop and promote a deeply and broadly experienced employee team that collectively translates into an exceptional workforce committed to fostering, promoting, preserving, and reflecting the entire spectrum of the Corporation’s communities and culture, while successfully executing the Corporation’s business strategies and exemplifying its corporate values. To support these objectives, the Corporation’s Employee Experience processes and programs are designed and operated to:

•Attract and develop talented employees, specifically skilled for their position, from across the spectrum of professional experience, life experience, socio-economic background, and geographic representation;

•Prepare all members of the Corporation's team for critical roles and leadership positions both now and the future, in serving as employees and valuable community members;

•Reward and support employees fairly and without discrimination based on successful performance and through competitive pay and benefit programs;

•Enhance the Corporation’s culture through efforts to better understand, foster, promote, and preserve a culture in alignment with the Corporation's core values; and

•Evolve and invest in technology, tools, and resources to better support employees of varying skills and backgrounds at work.

To monitor changes in the Corporation's employee and management groups relative to both composition and growth, the Corporation uses, among other tools, recurring management and employee surveys, profile analyses, third-party compensation surveys, and summaries of year-over-year changes to the pools of employees and management within the Corporation's various banking divisions and the Corporation as a whole, and utilizes the results to track progress and improve the effectiveness of the Corporation’s leadership development and workforce profile and personnel management practices.

The Corporation offers a robust range of training programs tailored to meet the needs of employees across all levels and departments. Through the CNB Academy, the Corporation’s learning management system, the Corporation delivers targeted learning solutions that empower employees to excel in their roles while advancing their professional growth. The Corporation’s training programs are designed to support a culture of continuous learning and career progression. From foundational skills in client interactions to advanced leadership development, employees are equipped with the tools and knowledge to succeed in their current roles and prepare for future opportunities. Career-focused programs like the Mentoring Program, Career Path Planning, and Rising Professionals enable employees to map and achieve their long-term aspirations. By aligning training programs with strategic planning, the Corporation ensures employees are empowered to deliver exceptional service and contribute to organizational success. Through the Corporation’s integrated approach, it builds a resilient, innovative workforce that is prepared to adapt to industry challenges and opportunities while upholding the core values that define its institution.

A critical measure is the opportunity for individuals from all professional and demographic backgrounds to advance into senior leadership positions. These leaders have a greater ability to drive innovation and change and provide the Corporation with financial services expertise to ensure the Corporation benefits from the active engagement and perspectives of all groups within its workforce and communities.

10

Table of Contents

Community Involvement and Social Impacts

The Corporation serves as a cornerstone institution of both financial support and community service in the markets in which it serves. The Corporation is committed to strengthening these communities through the active volunteering of its employees. The Corporation’s employees actively participate in their local communities through volunteer activities in education, economic development, human and health services, and community reinvestment. During 2025, the Corporation’s employees collectively reported service of 32,421 hours in voluntary support to 1,374 organizations, with 74% of employees actively participating. Additionally, there were approximately $1.4 million in donations, from both the Corporation and employees through internal fundraising efforts, to community organizations and events within the communities the Corporation serves. To encourage employees to give back to their communities, the Corporation's Volunteer Time Off Program, which provides employees with up to 16 hours of paid time off annually to volunteer for nonprofit organizations and local causes that may need volunteer assistance during typical weekday business hours. In 2025, the program was met with tremendous enthusiasm, with employees dedicating a collective total of 3,446 hours to volunteer service across the communities the Corporation serves. Importantly, employees contributed over nine times additional volunteering hours of their own time beyond those hours covered by the Volunteer Time Off Program. From participating in local food drives to mentoring youth and supporting nonprofit initiatives, the program has helped strengthen the Corporation’s ties to its communities while fostering a culture of service among its team members. This initiative reflects the Corporation’s core values of giving back and making a meaningful difference in the lives of others.

The Corporation also promotes economic development through investments in community‑strengthening initiatives, such as affordable housing and revitalization efforts. In 2024, the Corporation invested in two new projects that demonstrate its commitment in this area. Located in a distressed section of downtown Rochester, New York, the Corporation supported a project to rehabilitate four historic commercial buildings into a mixed‑use community with four commercial spaces and eleven residential apartments through a combination of debt financing of $9.6 million and an equity investment of $4.1 million in historic tax credits generated by the project. The commercial space will be available at affordable rents to generate economic and small‑business opportunities, particularly marketed toward local and minority/women‑owned business enterprises. Additionally, in Parma, Ohio, the Corporation provided debt financing of $5.5 million and made an equity investment of $4.2 million in low‑income housing tax credits to support a project to rehabilitate a low‑income senior housing facility with 63 units. The project includes extensive improvements to make the facility more energy‑efficient and to increase the number of units that are handicap accessible.

The Corporation remains deeply committed to promoting financial well‑being within its communities. Through a variety of initiatives, the Corporation aims to empower individuals with the knowledge and tools they need to achieve financial wellness. In 2025, the Corporation continued to expand its Financial Wellness Center, offering a robust series of free, publicly available online trainings that cover a wide range of basic finance topics, from budgeting basics to retirement planning. The series was expanded to support the financial education of small business owners and added personal finance courses on emergency savings, additional budgeting resources, and lowering debt. In 2025, the Corporation partnered with ten schools to host five financial reality fairs for middle school and high school students, providing hands‑on experiences to help them understand budgeting, saving, and preparing for unexpected expenses. In addition, the Small Business Essentials Fair was created and deployed to support small business owners to ensure they have the financial and educational resources for success. To support a broader financial education outreach, virtual lunch‑and‑learn sessions were offered on topics focusing on basic financial education, protecting seniors from fraud, and cybersecurity. These initiatives are a sample of the robust financial education programs that the Corporation offered in 2025 and reflect the Corporation’s dedication to fostering a financially informed and resilient community.

The Corporation continued to focus on increasing its outreach to those who have been traditionally underserved by the financial institution industry. Examples of some the Corporation’s key recent initiatives are outlined below.

•Introduced in 2025, CNB Bank’s Open Your Door Program is designed to help more individuals and families achieve the goal of homeownership. This program provides meaningful financial advantages, including low down payment options, flexible underwriting criteria, no private mortgage insurance requirements, waived processing and application fees, and a no‑closing‑cost option, all aimed at reducing barriers for qualified buyers. These features make the program a valuable resource for expanding access to affordable housing throughout the Corporation's footprint.

11

Table of Contents

•CNB Bank partners with GreenPath Financial Wellness, a national nonprofit with more than 60 years of experience providing trusted financial counseling and debt management support. Through this partnership, customers gain free access to certified financial counselors, personalized budgeting assistance, and expert guidance for managing credit card debt, housing challenges, and long‑term financial goals. GreenPath’s NFCC and HUD‑certified counselors offer confidential, one‑on‑one support to help individuals reduce financial stress, improve financial stability, and take control of their financial future.

•In 2025, CNB Bank's new financial education center and community banking office opened in downtown Erie, Pennsylvania. Located on Parade Street, this location provides financial education and accessible banking to underserved communities, promoting economic empowerment, and narrowing the wealth gap. This location was the first bank to open on Parade Street in over a decade.

•Launched in May 2023, Impressia Bank is CNB Bank’s sixth division and is dedicated to empowering women business owners and leaders. Headquartered in Buffalo, NY, with additional team members located in Ohio and Pennsylvania, Impressia Bank provides specialized services such as SBA and grant advisory services, wealth management, and private banking. Impressia’s mission is to close the gender funding gap and advance economic empowerment for women by offering innovative financial solutions, mentorship, and leadership development opportunities.

•BankOnBuffalo’s BankOnWheels initiative enhances financial inclusion by delivering banking services to underserved communities. By addressing disparities in access to financial resources, BankOnWheels empowers individuals and communities to fully participate in the economy. The first of its kind operated by any financial institution in Western New York, BankOnWheels is a full-service, yet fully mobile bank branch, which will enable the Bank to deliver essential banking services to communities with little or no access to such services today. The BankOnWheels rotates between four locations in the cities of Buffalo and Niagara Falls, which are located in communities underserved by banks.

•In May 2023, CNB Bank launched the At Ease Program, tailored to meet the unique financial needs of veterans, active-duty service members, and their families. This program offers specialized benefits, including waived fees, free financial tools, and mobile banking services, reflecting the Corporation's commitment to honoring and supporting the military community.

Available Information

The Corporation makes available free of charge on its website (www.cnbbank.bank) its Annual Report on Form 10-K, its quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended, as soon as practicable after it electronically files such material with, or furnishes it to, the SEC. Information on the Corporation’s website is not incorporated by reference into this report.

Shareholders may obtain a copy of the Corporation’s Annual Report on Form 10-K free of charge by writing to: CNB Financial Corporation, 1 South Second Street, PO Box 42, Clearfield, PA 16830, Attn: Shareholder Relations.

The SEC maintains an internet site that contains reports, proxy statements and other information about electronic filers such as the Corporation. The site is available at http://www.sec.gov.