CHEMUNG FINANCIAL CORP (CHMG) Business

ITEM 1.  BUSINESS

General

The Corporation was incorporated on January 2, 1985 under the laws of the State of New York and is headquartered in Elmira, New York. The Corporation was organized for the purpose of acquiring the Bank. The Bank was established in 1833 under the name Chemung Canal Bank, and was subsequently granted a New York State bank charter in 1895. In 1902, the Bank was reorganized as a New York State trust company under the name Elmira Trust Company, and its name was changed to Chemung Canal Trust Company in 1903.

The Corporation became a financial holding company in June 2000. Financial holding company status provided the Corporation with the flexibility to offer an array of financial services, such as insurance products, mutual funds, and brokerage services, which provide additional sources of fee-based income and allows the Corporation to better serve its customers. The Corporation established a financial services subsidiary, CFS, in September 2001 which offers non-banking financial services such as mutual funds, annuities, brokerage services, insurance, and tax preparation services.

The Corporation’s Board of Directors has concluded that expansion of the franchise’s geographic footprint, an increase in the Bank’s interest-earning assets and deposits, as well as the generation of new sources of non-interest income are important components of its strategic plan. Over the past two decades, the Corporation has completed two whole bank acquisitions, including of Canton, Pennsylvania based Canton Bancorp, Inc. in 2009 and Albany, New York based Fort Orange Financial Corp., in 2011, as well as branch acquisitions involving offices in Broome, Cayuga, Cortland, Seneca, Tioga, and Tompkins counties of New York. Additionally, in 2021 the Corporation expanded its geographic footprint into Western New York with the opening of a de novo branch office in Erie County, and established the “Canal Bank, a division of Chemung Canal Trust Company” brand in 2024, concurrent with the opening of a regional banking center in Erie County, located in Williamsville, New York. As a result of these transactions and organic growth, the Corporation had $2.710 billion in consolidated assets, $2.270 billion in loans, $2.271 billion in deposits, and $254.7 million in shareholders’ equity as of December 31, 2025.

Growth Strategy

The Corporation’s growth strategy is to leverage its branch and digital network in current or new markets to build client relationships and grow loans and deposits. Consistent with the Corporation’s community-banking model, and subject to market conditions, emphasis is placed on acquiring stable, low-cost deposits, such as checking account deposits and other low interest-bearing deposits to fund high-quality loans. The Corporation evaluates potential acquisition targets based on the economic viability of their markets, the degree to which they can be effectively integrated into the Corporation’s current operations, and the degree to which they are accretive to capital and earnings.

Description of Business

The Corporation, through the Bank and CFS, provides a wide range of financial services, including demand, savings, and time deposits, commercial, residential, and consumer loans, interest rate swaps, letters of credit, wealth management services, employee benefit plans, insurance products, mutual funds, and brokerage services. The Bank derives its income primarily from interest and fees on loans, interest on investment securities, WMG fee income, and fees received in connection with deposit and other services. The Bank’s operating expenses are interest expense paid on deposits and borrowings, salaries and employee benefit plans, and general operating expenses.

In order to compete with other financial services companies, the Corporation relies upon personal relationships established with clients by its officers, employees, and directors. The Corporation has maintained a strong community orientation by supporting the active participation of officers and employees in local charitable, civic, school, religious, and community development activities. The Corporation believes that its emphasis on local relationship banking together with a prudent approach to lending are important factors in its success and growth.

For additional information, including information concerning the results of operations of the Corporation and its subsidiaries, see Management's Discussion and Analysis of Financial Condition and Results of Operations in Part II, Item 7. Other than as described above, there were no material changes in the manner of doing business by the Corporation or its subsidiaries during the fiscal year ended December 31, 2025.

6

Lending Activities

Lending Strategy

The Corporation’s objective is to channel deposits gathered locally into high-quality, market-yielding loans without taking unacceptable credit and/or interest rate risk. The Corporation seeks to have a diversified loan portfolio consisting of commercial and industrial loans, commercial mortgages, residential mortgages, home equity lines of credit and home equity term loans, direct consumer loans, and indirect automobile loans. The Bank operates with a traditional community bank model where the relationship manager possesses credit skills and is significantly involved in credit decisions. This creates value as clients and prospects know they are working directly with decision makers.

Lending Authority

The Board of Directors establishes the lending policies, underwriting standards, and loan approval limits of the Bank. In accordance with those policies, the Board of Directors has designated certain officers to consider and approve loans within their designated authority. These officers exercise substantial authority over credit and pricing decisions, subject to Corporate loan committee approval for larger credits. The Bank recognizes that exceptions to the lending policies may occasionally occur and has established procedures for approving exceptions to these policies.

In underwriting loans, primary emphasis is placed on the borrower’s financial condition, including ability to generate cash flow to support the debt and other cash expenses. In addition, substantial consideration is given to collateral value and marketability as well as the borrower’s character, reputation and other relevant factors. Interest rates charged by the Bank vary with degree of risk, type, size, complexity, repricing frequency, and other relevant factors associated with the loans. Competition from other financial services companies also impacts interest rates charged on loans.

The Corporation has also implemented reporting systems to monitor loan originations, loan quality, concentration of credit, loan delinquencies, non-performing loans, and potential problem loans.

Lending Segments

The Bank segments its loan portfolio into the following major lending categories: (i) commercial and industrial, (ii) commercial mortgages, (iii) residential mortgages, and (iv) consumer loans.

Commercial and industrial loans primarily consist of loans to small and mid-sized businesses in the Bank's market areas in a diverse range of industries. These loans are of higher risk and typically are made on the basis of the borrower’s ability to make repayment from the cash flow of the borrower’s business. Further, the collateral securing the loans may depreciate over time, may be difficult to appraise, and may fluctuate in value. The credit risk related to commercial and industrial loans is largely influenced by general economic conditions and the resulting impact on a borrower’s operations or on the value of underlying collateral, if any.

Commercial mortgage loans generally have larger balances and involve a greater degree of risk than residential mortgage loans, and they, therefore, pose higher potential losses on an individual basis. Loan repayment is often dependent on the successful operation and management of the properties and/or the businesses occupying the properties, as well as on the collateral securing the loan. Economic events or conditions in real estate markets could have an adverse impact on the cash flows generated by properties securing the Bank’s commercial real estate loans and on the value of such properties.

The Bank offers interest rate swaps to certain larger commercial mortgage borrowers. These swaps allow the Bank to originate a mortgage based on short-term SOFR rates and allow the borrower to swap into a longer term fixed rate. The Bank enters into mirroring swaps with a Domestic Systemically Important Bank (D-SIBs) to manage its interest rate risk. The swap agreements are free-standing derivatives and are recorded at fair value in the Corporation's Consolidated Balance Sheets.

The Bank offers fixed-rate and adjustable-rate residential mortgage loans to individuals with maturities of up to 30 years that are fully amortizing with monthly loan payments. Mortgages are generally underwritten according to U.S. government sponsored enterprise guidelines designated as "A" or "A-" and referred to as "conforming loans." The Bank also originates jumbo loans above conforming loan amounts which generally are consistent with secondary market guidelines for these loans; however, these are typically held for investment. The Bank does not offer a subprime mortgage lending program. The Bank's secondary market lending is generally sold on a servicing-retained basis. Residential mortgage loans are generally made on the basis of the borrower’s ability to make repayment from his or her employment and other income, and are secured by real property whose value tends to be more easily ascertainable. Credit risk for these types of loans is generally influenced by general economic conditions, the characteristics of individual borrowers, and the nature of the collateral.

7

The consumer loan segment includes home equity lines of credit and home equity loans, which exhibit many of the same risk characteristics as residential mortgages. Indirect and other consumer loans may entail greater credit risk than residential mortgage and home equity loans, particularly in the case of other consumer loans which are unsecured or, in the case of indirect consumer loans, secured by depreciable assets, such as automobiles, recreational vehicles, or boats. In such cases, any repossessed collateral for a defaulted consumer loan may not provide an adequate source of repayment of the outstanding loan balance. In addition, consumer loan collections are dependent on the borrower’s continuing financial stability, thus are more likely to be affected by adverse personal circumstances such as job loss, divorce, illness, or personal bankruptcy. Furthermore, the application of various federal and state laws, including bankruptcy and insolvency laws, may limit the amount which can be recovered on such loans.

Funding Activities

Funding Strategy

The Corporation’s deposit strategy is to fund the Bank, subject to market conditions, with stable, low-cost deposits, primarily checking account deposits and low interest-bearing deposit accounts. A checking account is the driver of a banking relationship and consumers consider the bank where they have their checking account as their primary bank. These customers will typically turn to their primary bank first when in need of other financial services. In the current environment, the Corporation supplements this strategy with targeted certificate of deposit campaigns. The Corporation also considers brokered deposits to be an element of its deposit strategy and anticipates that it may continue using brokered deposits as a secondary source of funding to support growth. Borrowings may be used on a short-term basis for liquidity purposes or on a long-term basis to fund asset growth.

Funding Sources

The Corporation’s primary sources of funds are deposits, principal and interest payments on loans and securities, borrowings, and funds generated from operations of the Bank. The Bank also has access to advances from the FHLBNY, other financial institutions, and the FRBNY. Contractual loan and securities payments are a relatively stable source of funds, while deposit inflows and outflows and loan prepayments are significantly influenced by general market interest rates and economic conditions. During the year ended December 31, 2025, the Corporation issued $45.0 million of ten-year subordinated notes as an additional source of funding.

The Corporation considers core deposits, consisting of non interest-bearing and interest-bearing checking accounts, savings accounts, and insured money market deposits, to be a significant component of its deposits. The Corporation monitors the activity on these core deposits and, based on historical experience and pricing strategy, believes it will continue to retain a large portion of such accounts. The Bank is currently not limited with respect to the rates that it may offer on deposit products. The Bank believes it is competitive in the types of accounts and interest rates it offers on its deposit products. The Bank regularly evaluates the internal cost of funds, surveys rates offered by competitors, reviews cash flow requirements for lending and liquidity, and executes rate changes when necessary as part of its asset and liability management, profitability and growth strategies.

The flow of deposits is influenced significantly by general and regional economic conditions, changes in prevailing interest rates, and competition. The Bank’s deposits are obtained predominantly from the areas in which its retail offices are located. The Bank relies primarily on customer service, digital product offerings, long-standing relationships and other banking services, including loans and wealth management services, to attract and retain these deposits. However, market interest rates and rates offered by competing financial institutions affect the Bank’s ability to attract and retain deposits. The Bank utilizes a combination of digital and traditional media, including print, television, and radio, when advertising its deposit and lending products.

Investment Activities

The general objective of the Bank's investment portfolio is to provide liquidity when loan demand is high, and to absorb excess funds when demand is low. The securities portfolio also provides a medium for certain interest rate risk measures intended to maintain an appropriate balance between interest income from loans and total interest income. The Bank only invests in high-quality investment-grade securities such as mortgage-backed securities and obligations of states and political subdivisions. Investment decisions are made in accordance with the Bank's investment policy and include consideration of risk, return, duration, and portfolio concentrations. The Bank also utilizes its investment portfolio as the main source of collateral for its municipal depositors.

8

Derivative Financial Instruments

The Bank offers interest rate swaps to commercial loan customers who wish to fix the interest rates on their loans, and the Bank matches these swaps using offsetting swaps with Domestic Systemically Important Banks (D-SIBs). These swaps are considered free standing derivatives and are carried at fair value on the Consolidated Balance Sheets, with gains and losses recorded through other non-interest income. The swaps are not designated as hedging derivatives. Additionally, the Bank participates in risk participation agreements with lead banks on commercial loans in which it participates. The Bank may receive an upfront fee for participating in the credit exposure of the interest rate swap associated with the commercial loan in which it is a participant and the fee received is recognized immediately in other non-interest income. The Bank is exposed to its share of the credit loss equal to the fair value of the lead bank's interest rate swap in the event of nonperformance by the counterparty of the lead bank's interest rate swap.

The Bank has a policy for managing its derivative financial instruments, and the policy and program activity are overseen by the ALCO. Under the policy, derivative financial instruments with counterparties, who are not customers, are limited to a Domestic Systemically Important Bank (D-SIB). Cash and/or certain qualified securities are required to serve as collateral when exposures exceed $100 thousand, with a minimum collateral coverage of $150 thousand. The credit worthiness of the customer is reviewed internally by the Bank's credit department.

Wealth Management Strategy

With $2.338 billion of assets under management or administration as of December 31, 2025, including $301.8 million of assets held under management or administration for the Corporation, WMG is responsible for the largest component of the Corporation's non-interest income. Wealth management services provided by the Bank include services as executor and trustee under wills and agreements, and guardian, custodian, trustee, and agent for pension, profit-sharing and other employee benefit trusts, as well as various investment, pension, estate planning, and employee benefit administrative services. The Corporation’s growth strategy also includes the acquisition of trust businesses to generate new sources of fee income.

Market Area and Competition

The Bank operates 30 branch offices located in 13 counties in New York and Bradford County in Pennsylvania. Bank branch offices operating under the “Chemung Canal Trust Company” brand are located in the following New York counties: Chemung, Broome, Cayuga, Cortland, Schuyler, Seneca, Steuben, Tioga and Tompkins, as well as in Bradford County, Pennsylvania. The Bank also operates under the names “Capital Bank, a division of Chemung Canal Trust Company,” with branch offices in Albany, Saratoga, and Schenectady counties in New York, and “Canal Bank, a division of Chemung Canal Trust Company,” with a branch office in Erie County, New York.

According to the FDIC's annual Summary of Deposits – Market Share Report as of June 30, 2025, the Bank held a majority of market deposits in Chemung County, where it is headquartered, with 64.56% of total market deposits. Overall, the Bank's legacy market, consisting of the counties operating under the Chemung Canal Trust Company brand as described in the preceding paragraph, comprised 13.2% of the market's $14.8 billion in total deposits. The Bank's Capital Bank and Canal Bank divisions comprised 1.81% and 0.06% of their respective markets' total deposits of $26.9 billion and $57.5 billion.

Albany, Saratoga, and Schenectady counties rely heavily on business related to New York State government activities, the nanotechnology industry, and colleges located within these counties. The Capital region of New York has become a hub for both private and public investment in semiconductor-related activity, highlighted by the announcement of a $10 billion partnership to establish the only publicly-owned EUV lithography research facility in North America, which is anticipated to be completed by the end of 2026. Major partners in the initiative include Applied Materials, Micron, IBM, and Tokyo Electron, and the facility aims to complement the existing semiconductor supply chain presence of companies such as ASML and GlobalFoundries, as well as enhance the research capabilities of local universities such as Rensselaer Polytechnic Institute and SUNY Polytechnic. Regeneron announced an investment of over $2 billion to establish a major new manufacturing facility in Saratoga Springs, New York, creating 1,000 new full-time jobs. Tompkins County is dominated by the presence of Cornell University and Ithaca College. The world headquarters of Corning Incorporated, the region’s largest employer, is located in Steuben County. The remaining New York counties have a combination of service, small manufacturing and tourism-related businesses, with colleges located in Broome, Chemung, and Cortland counties. Bradford County's largest employers are a combination of service and small manufacturing businesses, along with the natural gas industry.

During 2021, the Corporation entered the Buffalo Metropolitan Area market. After New York City, this region is the second largest population center in New York State. Erie County has a diverse mix of industrial, light manufacturing, high technology and service-oriented private sector companies. The region also has reliance on higher education with the University at Buffalo, Buffalo State University, and several private colleges. The region's largest employers are affiliated with the healthcare industry, primarily located in the medical corridor, as well as financial institutions.

9

Within all these market areas, the Bank encounters intense competition in the lending and deposit gathering aspects of its business from local, regional and national commercial banks and thrift institutions, credit unions, and other providers of financial services such as brokerage firms, investment companies, insurance companies, fintech, and internet banking entities. The Bank also competes with non-financial institutions, including retail stores and certain utilities that maintain their own credit programs, as well as governmental agencies that make loans to certain borrowers. Many of these competitors are not subject to regulation as extensive as that affecting the Bank and, as a result, may have a competitive advantage over the Bank in certain respects. This is particularly true of credit unions because their pricing structure is not encumbered by the payment of income taxes and are not subject to certain regulations such as CRA.

Similarly, the competition for the Bank's wealth management services is primarily from local offices of national brokerage firms, independent investment advisors, national and regional banks, as well as internet based brokerage and advisory firms. The Bank operates full-service wealth management centers in Chemung, Broome, and Albany counties in New York.

Human Capital Resources

In order to accomplish our mission to remain a strong financial-services organization and create value for shareholders, clients, employees and the communities we serve, we must attract and retain the highest quality talent in each of our markets. We offer an inclusive, safe and healthy work environment, maintain the highest standards of business ethics and provide opportunities for career development and advancement, along with a competitive benefits package.

Employee Profile

As of December 31, 2025 we employed 348 full-time equivalent employees in 30 locations in New York and Pennsylvania. None of our employees are represented by any collective bargaining unit or is a party to a collective bargaining agreement. We believe our relationship with our employees to be good. As of December 31, 2025, our workforce was 71% female and 29% male, and our average tenure was 7.8 years. Our Executive Management Team had an average tenure of 11.5 years with the Corporation. We believe having a workforce that reflects the unique communities in which we operate is crucial for our ongoing success.

Total Rewards

We offer a competitive total rewards package for all employees, including competitive base pay, incentive plans for all employees, a 401(k) match, a non-discretionary company 401(k) contribution, health, dental, and vision insurance, life insurance, company contributions to a health savings account, paid time off, family leave, flexible work schedules, tuition reimbursement and student loan repayment assistance, and the opportunity to volunteer in the community during work hours.

Health and Safety

The health, safety and well-being of our employees is paramount to the success of our business. In addition to our insurance offerings and leave programs, we offer an employee assistance program, along with welfare programs, fitness reimbursements, and an on-site flu-shot clinic.

Talent

We believe investing in our employees not only helps with retention, but also keeps employees engaged and focused. We encourage all employees to join career circles, find a mentor, apply for our leadership program, job shadow, participate in moderated employee discussions, and attend other trainings offered. The success of our company depends on the success of our employees.

Available Information

The SEC maintains a website at www.sec.gov that contains reports, proxy and information statements, and other information regarding the Corporation. In addition, the Corporation maintains a corporate website at www.chemungcanal.com. The Corporation makes available free of charge through the Bank's website its annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and any amendments to those reports filed with the SEC pursuant to Section 13(a) or 15(d) of the Exchange Act. These items are available as soon as reasonably practicable after we electronically file or furnish such material with the SEC. The contents of the Bank's website are not a part of this report. These materials are also available free of charge by written request to: Kathleen S. McKillip, Corporate Secretary, Chemung Financial Corporation, One Chemung Canal Plaza, Elmira, NY 14901.

10

Supervision, Regulation, and Evaluation

The Corporation and the Bank are subject to comprehensive regulation, supervision, and examination by regulatory authorities. Numerous statutes and regulations apply to the Corporation’s and, to a greater extent, the Bank’s operations, including required reserves, investments, loans, deposits, issuances of securities, payments of dividends, and establishment of branches. Set forth below is a brief description of some of these laws and regulations. The description does not purport to be complete, and is qualified in its entirety by reference to the text of the applicable laws and regulations.

The Corporation

Bank Holding Company Act

The Corporation is a bank holding company registered with, and subject to regulation and evaluation by, the FRB pursuant to the BHCA, as amended. The FRB regulates and requires the filing of reports describing the activities of bank holding companies, and conducts periodic examinations to test compliance with applicable regulatory requirements. The FRB has enforcement authority over bank holding companies, including, among other things, the ability to assess civil money penalties, to issue cease and desist or removal orders, and to require a bank holding company to divest subsidiaries.

The Corporation generally may engage in the activities permissible for a bank holding company, which includes banking, managing or controlling banks, performing certain servicing activities for subsidiaries, and engaging in other activities that the FRB has determined to be so closely related to banking as to be a proper incident thereto, as set forth in FRB Regulation Y. As the Corporation has elected financial holding company status, it may also engage in a broader range of activities that are determined by the FRB and the Secretary of the Treasury to be financial in nature or incidental to financial activities or, with the prior approval of the FRB, activities that are determined by the FRB to be complementary to a financial activity and that do not pose a substantial risk to the safety and soundness of depository institutions or the financial system generally.

The BHCA prohibits a bank holding company from acquiring direct or indirect ownership or control of more than 5% of the voting shares of any bank, or increasing such ownership or control of any bank, without the prior approval of the FRB.

Interstate Banking and Branching

Under the Riegle-Neal Act, subject to certain concentration limits and other requirements, adequately capitalized bank holding companies, such as the Corporation, are permitted to acquire banks and bank holding companies located in any state. Any bank that is a subsidiary of a bank holding company is permitted to receive deposits, renew time deposits, close loans, service loans, and receive loan payments as an agent for any other bank subsidiary of that bank holding company. Subject to certain conditions, banks are permitted to acquire branch offices outside of their home states by merging with out-of-state banks, purchasing branches in other states, and establishing de novo branch offices in other states.

In April 2008, banking regulators in the states of New Jersey, New York, and Pennsylvania entered into a Memorandum of Understanding (the "Interstate MOU") to clarify their respective roles, as home and host state regulators, regarding interstate branching activity on a regional basis pursuant to the Riegle-Neal Amendments Act of 1997. The Interstate MOU established the regulatory responsibilities of the respective state banking regulators regarding bank regulatory examinations and is intended to reduce the regulatory burden on state-chartered banks branching within the region by elimination of duplicative host state compliance exams.

Under the Interstate MOU, the activities of branches the Bank operates in Pennsylvania would be governed by New York state law to the same extent that the Federal law governs the activities of the branch of an out-of-state national bank in such host states. Issues regarding whether a particular host state law is preempted are to be determined in the first instance by the NYSDFS. In the event that the NYSDFS and the applicable host state regulator disagree regarding whether a particular host state law is pre-empted, the NYSDFS and the applicable host state regulator would use their reasonable best efforts to consider all points of view to resolve the disagreement.

New York Law

The Corporation is organized under New York law and is subject to the New York Business Corporation Law, which governs the rights and obligations of directors and shareholders and other corporate matters.

The Corporation is also a bank holding company as defined in the New York Banking Law by virtue of its ownership and control of the Bank. Generally, this means that the NYSDFS must approve the Corporation’s acquisition of control of other banking institutions and similar transactions.

11

Federal Securities Law

The Corporation is subject to the information, reporting, proxy solicitation, insider trading, and other rules contained in the Exchange Act, the disclosure requirements of the Securities Act and the regulations of the SEC thereunder. In addition, the Corporation must comply with the corporate governance and listing standards of the Nasdaq Stock Market to maintain the listing of its common stock on the exchange. These standards include rules relating to a listed company's board of directors, audit committees and independent director oversight of executive compensation, the director nomination process, a code of conduct, and shareholder meetings.

The SEC has adopted certain proxy disclosure rules regarding executive compensation and corporate governance, with which the Corporation must comply. They include: (i) disclosure of total compensation of key officers of the Corporation, including disclosure of restricted and unrestricted stock awards compensation; (ii) disclosure regarding any potential conflict of interest of any compensation consultants of the Corporation; (iii) disclosure regarding audit and compensation committee independence and experience, qualifications, and skills of its directors and any director nominees; (iv) “say-on-pay” disclosure; (v) pay vs. performance disclosure; and (vi) information relating to the leadership structure of the Corporation’s Board of Directors and the Board of Directors' role in the risk management process. In October 2022, the SEC adopted a final rule implementing the incentive-based compensation recovery (“clawback”) provisions of the Dodd-Frank Act. The final rule directed national securities exchanges, including Nasdaq, to require listed companies to develop and implement clawback policies to recover erroneously awarded incentive-based compensation from current or former executive officers in the event of a required accounting restatement due to material noncompliance with any financial reporting requirement under the securities laws, and to disclose their clawback policies and any actions taken under these policies. The Corporation has met such requirements.

Sarbanes-Oxley

The Corporation is also subject to Sarbanes-Oxley. Sarbanes-Oxley established laws affecting public companies’ corporate governance, accounting obligations, and corporate reporting by: (i) creating a federal accounting oversight body; (ii) revamping auditor independence rules; (iii) enacting corporate responsibility and governance measures; (iv) enhancing disclosures by public companies, their directors, and their executive officers; (v) strengthening the powers and resources of the SEC; and (vi) imposing criminal and civil penalties for securities fraud and related wrongful conduct.

The SEC has adopted regulations under Sarbanes-Oxley, including: (i) executive compensation disclosure rules; (ii) standards of independence for directors who serve on the Corporation’s audit committee; (iii) disclosure requirements as to whether at least one member of the Corporation’s audit committee qualifies as a “financial expert” as defined in SEC regulations; (iv) whether the Corporation has adopted a code of ethics applicable to its chief executive officer, chief financial officer, or those persons performing similar functions; (v) and disclosure requirements regarding the operations of Board of Directors' nominating committees and the means, if any, by which security holders may communicate with directors.

Support of Subsidiary Banks

The Dodd-Frank Act, discussed in the section of this document entitled “Additional Important Legislation and Regulation,” codifies the FRB’s long-standing policy of requiring bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. Accordingly, the Corporation is expected to commit resources to support its banking subsidiaries, including at times when it may not be advantageous for the Corporation to do so.

Capital Distributions

A bank holding company is generally required to give the FRB prior written notice of any purchase or redemption of then outstanding equity securities if the gross consideration for the purchase or redemption, when combined with the net consideration paid for all such purchases or redemptions during the preceding 12 months, is equal to 10% or more of the company’s consolidated net worth. The FRB may disapprove such a purchase or redemption if it determines that the proposal would constitute an unsafe and unsound practice, or would violate any law, regulation, FRB order or directive, or any condition imposed by, or written agreement with, the FRB. There is an exception to this approval requirement for well capitalized bank holding companies that meet certain other conditions.

The FRB has issued a policy statement regarding capital distributions, including dividends, by bank holding companies. In general, the FRB’s policies provide that dividends should be paid only out of current earnings and only if the prospective rate of earnings retention by the bank holding company appears consistent with the organization’s capital needs, asset quality, and overall financial condition. Under applicable laws, the ability of a bank holding company to pay dividends may be restricted if a subsidiary bank becomes undercapitalized. In addition, the FRB has issued guidance which requires consultation with the agency prior to a bank holding company’s payment of dividends or repurchase or redemption of its stock under certain circumstances. These regulatory policies could affect the ability of the Corporation to pay dividends, repurchase its stock, or otherwise engage in capital distributions.

12

The Bank

General

The Bank is a commercial bank chartered under the laws of New York State and is supervised by the NYSDFS. The Bank is also a member bank of the FRB and, therefore, the FRBNY serves as its primary federal regulator. The FDIC insures the Bank’s deposit accounts up to applicable limits. The Bank must file reports with the FFIEC, the FRB and the FDIC concerning its activities and financial condition and must obtain regulatory approval before commencing certain activities or engaging in transactions such as mergers and other business combinations or the establishment, closing, purchase, or sale of branch offices. This structure gives the regulatory authorities extensive discretion in the enforcement of laws and regulations and the supervision of the Bank.

Loans to One Borrower

The Bank generally may not make a loan or extend credit to a single or related group of borrowers in excess of 15% of its unimpaired capital and surplus. Up to an additional 10% of unimpaired capital and surplus can be lent if the additional amount is fully secured by certain readily marketable collateral. As of December 31, 2025, the Bank’s legal lending limit on loans to one borrower was $48.5 million for loans not fully secured by readily marketable collateral and $53.4 million for loans secured by readily marketable collateral. The Bank’s internal limit on loans is set at $15.0 million. As of December 31, 2025, the Bank did not have any loans or agreements to extend credit to a single or related group of borrowers in excess of its legal lending limit.

Branching

Subject to the approval of the NYSDFS and FRB, New York-chartered member commercial banks may establish branch offices anywhere within New York State, except in communities having populations of less than 50,000 inhabitants in which another New York-chartered commercial bank or a national bank has its principal office. Additionally, under the Dodd-Frank Act, state-chartered banks may generally branch into other states to the same extent as commercial banks chartered under the laws of that state may branch.

Payment of Dividends

The Bank is subject to substantial regulatory restrictions affecting its ability to pay dividends to the Corporation. Under FRB and NYSDFS regulations, the Bank may not pay a dividend without prior approval of the FRB and the NYSDFS if the total amount of all dividends declared during such calendar year, including the proposed dividend, exceeds the sum of its retained net income to date during the calendar year and its retained net income over the preceding two calendar years. As of December 31, 2025, approximately $51.0 million was available for the payment of dividends by the Bank to the Corporation without prior approval. The Bank's ability to pay dividends also is subject to the Bank being in compliance with regulatory capital requirements. As of December 31, 2025, the Bank was in compliance with these requirements.

Standards for Safety and Soundness

The FRB has adopted guidelines prescribing safety and soundness standards. These guidelines establish general standards relating to capital adequacy, asset quality, management, earnings performance, liquidity levels and funds management practices, sensitivity to market risk, and overall risk management practices. In evaluating these safety and soundness standards, the FRB considers internal controls and information systems, internal audit systems, loan documentation, credit underwriting, exposure to changes in interest rates, asset growth, compensation, fees, and benefits, cybersecurity practices and compliance with applicable rules and regulations. In general, the guidelines require appropriate systems and practices to identify, measure, manage, and monitor the risks and exposures specified in the guidelines. The FRB may order an institution that has been given notice that it is not satisfying these safety and soundness standards to submit a compliance plan, and if an institution fails to do so, the FRB must issue an order directing action to correct the deficiency and may issue an order directing other action. If an institution fails to comply with such an order, the FRB may seek to enforce such order in judicial proceedings and to impose civil money penalties.

Real Estate Lending Standards

The FRB has adopted guidelines that generally require each FRB state member bank to establish and maintain written internal real estate lending standards that are consistent with safe and sound banking practices and appropriate to the size of the bank and the nature and scope of its real estate lending activities. The standards also must be consistent with accompanying FRB guidelines, which include loan-to-value ratios for the different types of real estate loans.

13

Transactions with Related Parties

The Federal Reserve Act governs transactions between the Bank and its affiliates, specifically the Corporation, and CFS. In general, an affiliate of the Bank is any company that controls, is controlled by, or is under common control with the Bank. Generally, the Federal Reserve Act limits the extent to which the Bank or its subsidiaries may engage in “covered transactions” with any one affiliate to 10% of the Bank’s capital stock and surplus, and contains an aggregate limit of 20% of capital stock and surplus for covered transactions with all affiliates. Covered transactions include loans, asset purchases, the issuance of guarantees, and similar transactions. Certain transactions must be collateralized according to the requirements of the statute. In addition, all covered transactions and other transactions between the Bank and its affiliates must be on terms and conditions that are substantially the same as, or at least as favorable to, the Bank.

Section 22(h) of the Federal Reserve Act and its implementing Regulation O restricts a bank's loans to its directors, executive officers, and principal stockholders ("Insiders"). Loans to Insiders (and their related entities) may not exceed, together with all other outstanding loans to such persons and affiliated entities, the Bank's total capital and surplus. Loans to Insiders above specified amounts must receive the prior approval of the Bank's Board of Directors. The loans must be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with unaffiliated persons and that do not involve more than the normal risk of repayment or present other unfavorable features, except that such Insiders may receive preferential loans made under a benefit or compensation program that is widely available to the Bank's employees and does not give preference to the Insider over the employees. Loans to executive officers are subject to additional restrictions on the types and amounts of permissible loans.

Deposit Insurance

The FDIC insures the deposits of the Bank up to regulatory limits and the deposits are subject to the deposit insurance premium assessments of the DIF. The FDIC currently maintains a risk-based assessment system under which assessment rates vary based on the level of risk posed by the institution to the DIF. Therefore, the assessment rate may change if any of these measurements change.

For institutions of the Bank’s asset size, the FDIC operates a risk-based premium system that determines assessment rates from financial modeling designed to estimate the probability of the bank’s failure over a three-year period. The FDIC has authority to increase insurance assessments. As of December 31, 2025, assessment rates for institutions of the Bank’s size ranged from 2.5 to 32 basis points. The FDIC may also issue special assessments.

Insurance of deposits may be terminated by the FDIC upon a finding that an institution has engaged in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed in writing. Management of the Bank does not know of any practice, condition, or violation that may lead to termination of the Bank’s deposit insurance.

Regulatory Capital Requirements

Federal regulations require banks to meet certain minimum capital standards. The minimum capital standards consist of a common equity Tier 1 (“CET1”) capital ratio of 4.5% of risk-weighted assets, a uniform leverage ratio of 4%, a Tier 1 capital ratio of 6% of risk-weighted assets, and a total capital ratio of 8% of risk-weighted assets. In order to be considered well capitalized, the Bank must have a CET1 ratio of 6.5%, a Tier 1 ratio of 8%, a total risk-based capital ratio of 10% and a leverage ratio of 5%. The regulatory standards require unrealized gains and losses on certain “available for sale” securities holdings to be included for purposes of calculating regulatory capital unless a one-time opt-out is exercised. The Bank has exercised this one-time opt-out and therefore excluded unrealized gains and losses on certain “available-for-sale” securities holdings for purposes of calculating regulatory capital. Additional restraints are also imposed on the inclusion in regulatory capital of mortgage-servicing assets, deferred tax assets and minority interests.

Common equity Tier 1 capital is generally defined as common stockholders’ equity, including retained earnings but excluding accumulated other comprehensive income. Tier 1 capital is generally defined as Common equity Tier 1 capital and Additional Tier 1 capital. Additional Tier 1 capital generally includes certain noncumulative perpetual preferred stock and related surplus and minority interests in equity accounts of consolidated subsidiaries. Total capital includes Tier 1 capital and Tier 2 capital. Tier 2 capital is comprised of capital instruments and related surplus meeting specific requirements, and may include cumulative preferred stock, long-term perpetual preferred stock, mandatory convertible securities, subordinated debt and intermediate preferred stock. Also included in Tier 2 capital is the allowance for credit losses limited to a maximum of 1.25% of risk-weighted assets. Additionally, a bank that retains credit risk in connection with an asset sale may be required to maintain additional regulatory capital because of the recourse back to the bank. In assessing an institution’s capital adequacy, the federal regulators, including the FRB with respect to a state member bank such as the Bank, take into consideration not only these numeric factors but also qualitative factors as well and has the authority to establish higher capital requirements for individual institutions where necessary.

14

In determining the amount of risk-weighted assets, all assets, including certain off-balance sheet assets, are multiplied by a risk-weight factor assigned by federal regulations based on the risks believed inherent in the type of asset. The capital requirements assign a higher risk weight to asset categories believed to present a great risk. For example, a risk weight of 0% is assigned to cash and U.S. government securities, a risk weight of 50% is generally assigned to prudently underwritten first lien one to four family residential mortgages, a risk weight of 100% is assigned to commercial and consumer loans, a risk weight of 150% is assigned to certain past due loans and a risk weight of between 0% and 600% is assigned to permissible equity interests, depending on certain specified factors.

The regulations limit a banking organization’s capital distributions and certain discretionary bonus payments to executives if the banking organization does not hold a “capital conservation buffer” consisting of 2.5% of common equity Tier 1 capital to risk-weighted assets in addition to the amount necessary to meet its minimum risk-based capital requirements.

The Corporation is not subject to FRB consolidated capital requirements applicable to bank holding companies, which are similar to those applicable to the Bank, until it reaches $3.0 billion in assets.

In assessing a state member bank’s capital adequacy, the FRB takes into consideration not only these numeric factors but also qualitative factors, and has the authority to establish higher capital requirements for individual banks where necessary. Prompt corrective action regulations provide five classifications: well capitalized, adequately capitalized, undercapitalized, significantly undercapitalized, and critically undercapitalized, although these terms are not used to represent overall financial condition. The Bank, in accordance with its internal prudential standards, targets as its goal the maintenance of capital ratios which exceed these minimum requirements and that are consistent with its risk profile. As of December 31, 2025, the Bank exceeded all regulatory capital ratios necessary to be considered well capitalized.

On October 29, 2019, the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporations (collectively, the " Agencies") adopted a final rule (the "Final Rule") to simplify the regulatory capital requirements for eligible community banks and holding companies that opt into the Community Bank Leverage Ratio ("CBLR") framework, as required by Section 201 of the Economic Growth, Relief, and Consumer Protection Act of 2018. Under the Final Rule, a depository institution or holding company that satisfies certain qualifying criteria, including having less than $10 billion in average total consolidated assets and a leverage ratio of greater than 9%, would be considered a "qualifying community banking organization" and may elect (but is not required) to use the CBLR framework. If this election is made, the qualifying community banking organization would be considered to have satisfied the Agencies' generally applicable risk-weighted and leverage capital requirements (the "Basel III capital framework") and would be considered to be well capitalized under the Agencies' prompt corrective action ("PCA") rules. Under the CBLR framework, a qualifying community banking organization would satisfy the regulatory capital requirements by calculating and reporting a single leverage ratio, i.e., the CBLR, which would require significantly less data than needed to calculate the capital ratios, under the Basel III capital framework and eliminate the time consuming need to risk-weight assets. In November 2025, the federal banking agencies issued a proposed rule to lower the community bank leverage ratio to 8%. The proposed rule was not effective as of December 31, 2025. As of December 31, 2025, the Bank has not elected to use the community bank leverage ratio.

Prompt Corrective Action

The FDIA requires the federal banking agencies to resolve the problems of insured banks at the least possible loss to the DIF. The FRB has adopted prompt corrective action regulations to carry out this statutory mandate. The FRB’s regulations authorize, and in some situations, require, the FRB to take certain supervisory actions against undercapitalized state member banks, including the imposition of restrictions on asset growth and other forms of expansion. The prompt corrective action regulations place state member banks in one of the following five categories based on the bank’s capital:

•well capitalized (at least 5% leverage capital, 6.5% common equity Tier 1 risk-based capital, 8% Tier 1 risk-based capital and 10% total risk-based capital);

•adequately capitalized (at least 4% leverage capital, 4.5% common equity Tier 1 risk-based capital, 6% Tier 1 risk-based capital and 8% total risk-based capital);

•undercapitalized (less than 4% leverage capital, 4.5% common equity Tier 1 risk-based capital, 6% Tier 1 risk-based capital or 8% total risk-based capital);

•significantly undercapitalized (less than 3% leverage capital, 3% common equity Tier 1 risk-based capital, 4% Tier 1 risk-based capital or 6% total risk-based capital); and

•critically undercapitalized (less than 2% tangible capital).

15

As an institution’s capital decreases within the three undercapitalized categories listed above, the severity of the action that is authorized or required to be taken by the FRB for state member banks under the prompt corrective action regulations increases. All banks are prohibited from paying dividends or other capital distributions or paying management fees to any controlling person if, following such distribution, the bank would be undercapitalized. The FRB is required to monitor closely the condition of an undercapitalized institution and to restrict the growth of its assets.

An undercapitalized state member bank is required to file a capital restoration plan with the FRB within 45 days (or other timeframe prescribed by the FRB) of the date the bank receives notice that it is within any of the three undercapitalized categories, and the plan must be guaranteed by its parent holding company, subject to a cap on the guarantee that is the lesser of: (i) an amount equal to 5.0% of the bank’s total assets at the time it was notified that it became undercapitalized; and (ii) the amount that is necessary to restore the bank’s capital ratios to the levels required to be classified as “adequately classified,” as those ratios and levels are defined as of the time the bank failed to comply with the plan. If the bank fails to submit an acceptable plan, it is treated as if it were “significantly undercapitalized.” Banks that are significantly or critically undercapitalized are subject to a wider range of regulatory requirements and restrictions, including, with respect to critically undercapitalized status, the appointment of a receiver or conservator within specified periods of time.

The NYSDFS possesses enforcement power over New York State-chartered banks pursuant to New York law. This includes authority to order a New York State bank to, among other things, cease an apparent violation of law, discontinue unauthorized or unsafe banking practices or maintain prescribed books and accounts. Such orders are enforceable by financial penalties. Upon a finding by the NYSDFS that a bank director or officer has violated any law or regulation or continued unauthorized or unsafe practices in conducting its business after having been notified by the NYSDFS to discontinue such violation or practices, such director or officer may be removed from office after notice and an opportunity to be heard. The NYSDFS also has authority to appoint a conservator or receiver (which may be the FDIC) for a bank under certain circumstances.

Under federal law, the FRB possesses authority to bring enforcement actions against member banks and their ‘‘institution-affiliated parties,’’ including directors, officers, employees and, under certain circumstances, a stockholder, attorney, appraiser or accountant. Such enforcement action can occur for matters such as failure to comply with applicable law or regulations or engaging in unsafe or unsound banking practices. Possible enforcement actions range from an informal measure, such as a memorandum of understanding, to formal actions, such as a written agreement, cease and desist order, civil money penalty, capital directive, removal of directors or officers or the appointment of a conservator or receiver. The FRB also possesses authority to bring enforcement actions against bank holding companies, their nonbanking subsidiaries and their “institution-affiliated parties.”

Federal Home Loan Bank

The Bank is a member of the FHLBNY, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to the rules and requirements of the FHLBNY, including the requirement for the Bank to acquire and hold shares of capital stock in the FHLBNY. The Bank was in compliance with the rules and requirements of the FHLBNY as of December 31, 2025.

Community Reinvestment Act

Under the federal CRA, the Bank, consistent with its safe and sound operation, must help meet the credit needs of its entire community, including low and moderate income neighborhoods. The FRBNY and NYSDFS periodically assess the Bank's compliance with CRA requirements. The Bank received a “satisfactory” rating for CRA on its last performance evaluations which were conducted by the NYSDFS as of March 31, 2023, and the FRB as of September 25, 2023.

16

Fair Lending and Consumer Protection Laws

The Bank must also comply with the federal Equal Credit Opportunity Act and the New York Executive Law 296-a, which prohibit creditors from discrimination in their lending practices on bases specified in these statutes. In addition, the Bank is subject to a number of federal statutes and regulations implementing them, which are designed to protect the general public, borrowers, depositors, and other customers of depository institutions. These include the Bank Secrecy Act, the Truth in Lending Act, the Home Ownership and Equity Protection Act, the Truth in Savings Act, the Home Mortgage Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Electronic Funds Transfers Act, the Fair Credit Reporting Act, the Right to Financial Privacy Act, the Expedited Funds Availability Act, the Flood Disaster Protection Act, the Fair Debt Collection Practices Act, Helping Families Save Their Homes Act, and the Consumer Protection for Depository Institutions Sales of Insurance regulation. The FRB and, in some instances, other regulators, including the U.S. Department of Justice, the FTC, the CFPB and state Attorneys General, may take enforcement action against institutions that fail to comply with these laws.

Prohibitions against Tying Arrangements

Subject to some exceptions, regulations under the BHCA and the Federal Reserve Act prohibits banks from extending credit to or offering any other service, or fixing or varying the consideration for such extension of credit or service, on the condition that the customer obtain some additional service from the bank or its affiliates or not obtain services of a competitor of the bank.

Privacy Regulations

Regulations under the Federal Reserve Act generally require the Bank to disclose its privacy policy. The policy must identify with whom the Bank shares its customers’ “nonpublic personal information,” at the time of establishing the customer relationship and annually thereafter. In addition, the Bank must provide its customers with the ability to “opt out” of having their personal information shared with unaffiliated third parties and not to disclose account numbers or access codes to non-affiliated third parties for marketing purposes. The Bank’s privacy policy complies with Federal Reserve Act regulations.

The USA PATRIOT Act

The Bank is subject to the USA PATRIOT Act, which gives the federal government powers to address terrorist threats through enhanced domestic security measures, expanded surveillance powers, increased information sharing, and broadened anti-money laundering requirements. The USA PATRIOT Act imposes affirmative obligations on financial institutions, including the Bank, to establish anti-money laundering programs which require: (i) the establishment of internal policies, procedures, and controls; (ii) the designation of an anti-money laundering compliance officer; (iii) ongoing employee training programs; (iv) an independent audit function to test the anti-money laundering program; and (v) due diligence of customers using a risk-based approach. The FRB must consider the Bank’s effectiveness in combating money laundering when ruling on merger and other applications.

CFS

CFS is subject to supervision by other regulatory authorities as determined by the activities in which it is engaged. Insurance activities are supervised by the NYSDFS and Pennsylvania Insurance Department, and brokerage activities are subject to supervision by the SEC and FINRA.

17

Additional Important Legislation and Regulation

The Regulatory Relief Act

On May 24, 2018, the Regulatory Relief Act was enacted, which repeals or modifies certain provisions of the Dodd-Frank Act and eases regulations on all but the largest banks. The Regulatory Relief Act’s provisions include, among other things: (i) exempting banks with less than $10 billion in assets from the ability-to-repay requirements for certain qualified residential mortgage loans held in portfolio; (ii) allows usage of Uniform Standards of Professional Appraisal Practice (USPAP) compliant evaluations for certain transactions valued at less than $400,000 in rural areas instead of appraisals, providing specific criteria are met; (iii) exempting banks that originate fewer than 500 open-end and 500 closed-end mortgages from HMDA’s expanded data disclosures; (iv) clarifying that, subject to various conditions, reciprocal deposits of another depository institution obtained using a deposit broker through a deposit placement network for purposes of obtaining maximum deposit insurance would not be considered brokered deposits subject to the FDIC’s brokered-deposit regulations; (v) raising eligibility for the 18-month exam cycle from $1 billion to banks with $3 billion in assets; (vi) allowing qualifying federal savings banks to elect to operate with National Bank powers; and (vii) simplifying capital calculations by requiring regulators to establish for institutions under $10 billion in assets a community bank leverage ratio at a percentage not less than 8% and not greater than 10% that such institutions may elect to replace the general applicable risk-based capital requirements for determining well capitalized status.

The Dodd-Frank Act

The Dodd-Frank Act, enacted on July 21, 2010, significantly changed the bank regulatory landscape and has impacted and will continue to impact the lending, deposit, investment, trading, and operating activities of financial institutions and their holding companies. Among other things, the Dodd-Frank Act (i) created the Consumer Financial Protection Bureau as an independent bureau to assume responsibility for the implementation of the federal financial consumer protection and fair lending laws and regulations, a function previously assigned to prudential regulators; (although institutions of less than $10 billion in assets continue to be examined for compliance with consumer protection and fair lending laws and regulations by, and be subject to the primary enforcement authority of their primary federal bank regulator rather than the Consumer Financial Protection Bureau); (ii) directed changes in the way that institutions are assessed for deposit insurance; (iii) as discussed under “Regulatory Capital Requirements,” mandated the revision of regulatory capital requirements; (iv) codified the FRB’s long-standing policy that a bank holding company must serve as a source of financial and managerial strength for its subsidiary banks; (v) required regulations requiring originators of certain securitized loans to retain a percentage of the risk for the transferred loans; (vi) stipulated regulatory rate-setting for certain debit card interchange fees; (vii) repealed restrictions on the payment of interest on commercial demand deposits; (viii) enacted the so-called Volcker Rule, which generally prohibits banking organizations from engaging in proprietary trading and from investing in, sponsoring or having certain relationships with hedge funds; (ix) contained a number of reforms related to mortgage originations; and (x) as discussed under “Federal Securities Law,” enacted certain proxy disclosures regarding executive compensation and corporate governance.

Cybersecurity

The NYSDFS requires New York chartered banks to establish and maintain a cybersecurity program designed to protect consumers and ensure the safety and soundness of the bank. NYSDFS requires regulated financial institutions to establish a cybersecurity program; designed to protect the confidentiality, integrity and availability of its Information Systems; implement and maintain a written policy or policies setting forth its policies and procedures for the protection of its systems and Nonpublic Information stored on those systems; designate a Chief Information Security Officer responsible for implementing, overseeing, and enforcing its program and policy; and have policies and procedures designed to ensure the security of information systems and nonpublic information accessible to, or held by Third Party Service Providers.

In November, 2023, the NYSDFS finalized amendments to its cybersecurity regulations that represent a significant update to the regulation of cybersecurity practices. The amendments generally fall within the following five categories: (i) increased mandatory controls associated with common attack vectors, (ii) enhanced requirements for privileged accounts, (iii) enhanced notification obligations, (iv) expansion of cyber governance practices, and (v) additional cybersecurity requirements for larger companies.

Banking organizations are required to notify their primary federal regulator as soon as possible and no later than 36 hours of determining that a “computer-security incident” that arises to the level of a “notification incident” has occurred. A notification incident is a “computer-security incident” that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or affect the stability of the financial sector. Bank service providers are also required to notify any affected bank to or on behalf of which the service provider provides services “as soon as possible” after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for four or more hours.

18

Gramm-Leach-Bliley Act

Under the privacy and data security provisions of the Financial Modernization Act of 1999, also known as the GLB Act, and rules promulgated thereunder, all financial institutions, including the Corporation, the Bank and CFS are required to establish policies and procedures to restrict the sharing of nonpublic customer data with nonaffiliated parties at the customer's request and to protect customer data from unauthorized access. In addition, the FCRA, as amended by the FACT Act, includes many provisions affecting the Corporation, Bank, and/or CFS including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. For instance, the FCRA requires persons subject to the FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the FTC have extensive rulemaking authority under the FACT Act, and the Corporation and the Bank are subject to the rules that have been promulgated by the FRB and FTC thereunder, including recent rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate the risk of identity theft through red flags. The GLB Act and the FCRA also impose requirements regarding data security and the safeguarding of customer information. The Bank is subject to the Security Guidelines, which implement section 501(b) of the GLB Act and section 216 of the FACT Act. The Security Guidelines establish standards relating to administrative, technical, and physical safeguards to ensure the security, confidentiality, integrity, and the proper disposal of customer information.

The Corporation has developed policies and procedures for itself and its subsidiaries to maintain compliance with all privacy, information sharing and notification provisions of the GLB Act and the FCRA.