FINANCIAL INSTITUTIONS INC (FISI) Business

ITEM 1. BUSINESS

GENERAL

The Parent is a financial holding company organized in 1931 under the laws of New York State (“New York” or “NYS”). The principal office of the Parent is located at 220 Liberty Street, Warsaw, New York 14569 and its telephone number is (585) 786-1100. The Parent was incorporated on September 15, 1931, but the continuity of the Company’s banking business is traced to the organization of the National Bank of Geneva on March 28, 1817. Except as the context otherwise requires, the Parent and its direct and indirect subsidiaries are collectively referred to in this report as the “Company.” The Parent’s common stock is traded on the Nasdaq Global Select Market under the ticker symbol “FISI.”

The Parent’s primary business is the operation of its subsidiaries. It does not engage in any other substantial business activities. The Parent’s direct wholly-owned subsidiaries are: Five Star Bank, referred to as “FSB” or “the Bank,” which provides a full range of banking services to consumer, commercial and municipal customers in Western and Central New York, and commercial loans in the Mid-Atlantic region, through a loan production office in Ellicott City, Maryland (a suburb of Baltimore, Maryland), and the Central New York region, through an office in Syracuse, New York; and Courier Capital LLC, referred to as “Courier Capital,” which provides customized investment management, investment consulting and retirement plan services to individuals, businesses, institutions, foundations and retirement plans.

As of December 31, 2025, the consolidated financial statements include the accounts of the Parent, the Bank, and Courier Capital. At December 31, 2025, the Company had consolidated total assets of $6.27 billion, deposits of $5.21 billion and shareholders’ equity of $628.9 million and the Bank represented 99%, and Courier Capital represented less than 1% of the consolidated assets of the Company.

Five Star Bank

The Bank is a New York-chartered bank that has its headquarters at 55 North Main Street, Warsaw, NY, a total of 48 full-service banking offices in the New York State counties of Allegany, Cattaraugus, Cayuga, Chemung, Erie, Genesee, Livingston, Monroe, Ontario, Orleans, Seneca, Steuben, Wyoming, and Yates, and commercial loan production offices in Baltimore, Maryland and Syracuse, New York serving the Mid-Atlantic and Central New York regions, respectively.

At December 31, 2025, the Bank had total assets of $6.24 billion, investment securities of $1.01 billion, net loans of $4.61 billion, deposits of $5.29 billion and shareholders’ equity of $662.3 million. The Bank offers deposit products, which include checking and NOW accounts, savings accounts, and certificates of deposit, as its principal source of funding. The Bank’s deposits are insured up to the maximum permitted by the Deposit Insurance Fund (the “DIF”) of the Federal Deposit Insurance Corporation (“FDIC”). The Bank offers a variety of loan products to its customers, including commercial and consumer loans.

Courier Capital, LLC

Courier Capital is an SEC-registered investment advisory and wealth management firm founded in 1967 and headquartered in Western New York, with offices in Buffalo, Rochester and Jamestown, New York, and Pittsburgh, Pennsylvania. We also added an office in Sarasota, Florida in September 2025. With $3.60 billion in assets under management as of December 31, 2025, Courier Capital offers customized investment advice, wealth management, investment consulting and retirement plan services to individuals, businesses and institutions. For the year ended December 31, 2025, Courier Capital had total revenue of $11.6 million.

Five Star REIT, Inc.

Five Star REIT, Inc. (“Five Star REIT”), a wholly-owned subsidiary of the Bank, operates as a real estate investment trust that primarily holds residential mortgages and commercial real estate loans. Five Star REIT provides additional flexibility and planning opportunities for the business of the Bank.

Business Strategy

Our business strategy has been to maintain a community bank philosophy, which consists of focusing on and understanding the individualized banking and other financial services needs of individuals, municipalities and businesses of the communities surrounding our primary service area. We believe this focus allows us to be more responsive to our customers’ needs and provide a high level of personal service that differentiates us from larger competitors, resulting in long-standing and broad-based banking relationships. Our core customers are primarily small- to medium-sized businesses, individuals and community organizations who prefer to build banking and wealth management relationships with a community bank that offers high-quality, competitively priced products and services with personalized service. Because of our identity and origin as a locally operated bank, we believe that our level of personal service provides a competitive advantage over larger banks, which tend to consolidate decision-making authority outside local communities.

- 5 -

Table of Contents

A key aspect of our current business strategy is to foster a community-oriented culture where our customers and employees establish long-standing and mutually beneficial relationships. We believe that we are well-positioned to be a strong competitor within our market area because of our focus on community banking needs and customer service, our comprehensive suite of deposit, loan, and wealth management products and services typically found at larger banks, our highly experienced management team and our strategically located banking centers.

We prioritize customer acquisition through cost-effective, high-demand digital, virtual and physical channels, while maintaining a community bank distinctiveness relative to larger banks and digital-only neobanks. We leverage the retail branch network and customer contact center to build trust and credibility, provide personal financial education and advice, offer convenience, and bridge digital and physical channels. Our enhanced digital capabilities complement a continued focus on a consistent customer experience and engagement across physical and virtual channels, including using branches to create deeper engagement and relationships with customers, balancing customer engagement with efficiency opportunities (e.g., framing outreach to the customer contact center to teach customers how to use digital channels, in addition to addressing the reason for the call), and maintaining and expanding our customer reach digitally, physically or virtually. By employing digital channels across our current products and services, we deepen existing relationships and enter new geographies or market segments that would otherwise be prohibitively expensive targets using traditional approaches. Deepening our existing digital capabilities allows us to capitalize on a shift in customer preferences away from physical branches.

We have evolved to meet changing customer needs by offering complementary physical, digital, and virtual channels. We focus on technology to provide solutions that fit our customer preferences for transacting business with us. Branches are staffed by certified personal bankers who are trained to meet a broad array of customer needs. Our digital banking capabilities and Customer Contact Center provide additional self-serve and phone options through which customer needs are met effectively.

Our primary focus is on organic growth with the goal of increasing the Bank’s market share within existing markets. With that, we will continue to explore market expansion opportunities that complement current market areas as opportunities arise, including small branch acquisitions, as well as evaluating potential growth opportunities within our non-interest income line of business by acquiring businesses that can be incorporated into existing operations. While organic growth remains our primary focus, we believe our capital position remains strong enough to support selective merger and acquisition activity in support of expansion of our core financial service businesses. Consequently, we will continue to evaluate acquisition opportunities in these activities. When evaluating acquisition opportunities, we will balance the potential for earnings accretion with maintaining adequate capital levels, which could result in our common stock being the predominant form of consideration and/or the need for us to raise capital.

Conversations with potential strategic partners occur on a regular basis. The evaluation of any potential opportunity will favor a transaction that complements our core competencies and strategic intent. Additionally, we remain committed to maintaining a diversified revenue stream. Our senior management team has experience in acquisitions and post-acquisition integration of operations and is prepared to act promptly should a potential opportunity arise but will remain disciplined with its approach. We believe this experience positions us to successfully acquire and integrate additional financial services and banking businesses.

HUMAN CAPITAL RESOURCES STRATEGY

Our Company’s vision, purpose and core values collectively make up what we consider to be our “Five Star Promise” and they provide clarity around what we believe as a Company and why we exist. Our vision is to be a high-performing community bank, offering a simple, connected and trusted experience in the markets we serve. Our purpose is to keep the people of Five Star’s well-being at the heart of everything we do, so that our team, our customers and our communities will thrive and realize their dreams. We also champion five core corporate values, our HEART values, that employees at all levels of our Company are expected to live up to by being humble, empowered, ambitious, resilient and transparent.

To facilitate talent attraction and retention, we strive to make the Company an inclusive, safe and healthy workplace, with opportunities for all of our employees to grow and develop in their careers, supported by strong compensation, benefits, health and welfare programs.

Employee Profile

As of December 31, 2025, we had 631 employees situated across the United States (the “U.S.”). This represents an increase of 33 employees, or 6%, from December 31, 2024, which was primarily attributable to investments in personnel and filling of open positions in 2025.

As of December 31, 2025, approximately 65% of our current workforce was female, 35% male, and our average tenure was 6.44 years, which slightly decreased from 6.84 years at December 31, 2024.

- 6 -

Table of Contents

Total Rewards

As part of our compensation philosophy, we believe that we must offer and maintain market competitive total rewards programs for our employees in order to attract and retain superior talent. In addition to competitive market base wages, our rewards programs include performance-based bonus opportunities, equity compensation, Company-sponsored retirement plans, healthcare and insurance benefits, health savings and flexible spending accounts, paid time off, family leave, hybrid remote work opportunities, flexible work schedules, and employee assistance programs. We also provide tuition and training reimbursement programs to support the professional and personal development of our employees.

Health and Safety

The success of our business is fundamentally connected to the well-being of our people. Accordingly, we are committed to the health, safety and wellness of our employees. We provide our employees and their families with access to a variety of flexible and convenient health and welfare programs, including benefits that support their physical and mental health by providing tools and resources to help them improve or maintain their health status and that offer choice where possible so they can customize their benefits to meet their needs and the needs of their families.

Talent Recruitment, Retention and Development

A core tenet of our talent system is to both develop talent from within and supplement with external hires. This approach has yielded loyalty and commitment among our employees, which in turn grows our business, our products, and our customers, while also adding new talent, skill sets and ideas to support a continuous improvement mindset and our goals of a diverse and inclusive workforce.

We conduct intentional, strategic hiring to supplement the organization with new skill sets and perspectives. Our talent acquisition team uses internal and external resources to recruit highly skilled and talented workers, and, additionally, we incent employee referrals for open positions.

Our performance management framework positions our leaders as coaches who continuously develop and grow talent through ongoing performance and development discussions, formal talent and development assessments, goal setting and feedback and performance-based compensation programs. Since 2022, we have conducted annual talent calibrations to assess internal talent and identify gaps and development opportunities.

We seek to develop a high-performing and engaged team and we have adapted our approach to training over time to support that goal. Our learning management platform, Five Star University, enables professional development, competency training and upskilling for an evolving workforce. Through this platform, we are able to deliver e-Learning training that employees can complete on their own time as well as live instructor-led training on a variety of topics, including compliance, anti-discrimination, active shooter prevention, people leadership skills, and more.

Our employees are empowered to play an active role in evolving our Company and its culture, including through annual and periodic engagement surveys that measure employee satisfaction and provide valuable feedback to leadership. We were pleased to be Certified by Great Place To Work® for the third time in 2025, placing us in an elite group of global employers who achieved an outstanding culture based on anonymous survey data collected from their own employees. We also maintain a positive culture through promoting recognition, utilizing an engagement tool where employees can post peer-to-peer recognition for accomplishments and career milestones that are adaptive to our growing footprint as well as formal, annual recognition through our HEART awards.

Inclusivity

We strive toward having a powerful team of employees, knowing we are better together with our combined wisdom and intellect. We focus on understanding, accepting, and valuing the differences between people. To accomplish this, we have an established council which is made up of designated employee representatives from throughout our operating footprint. This council meets regularly to provide feedback and ideas that inform our human capital strategy and approach to employee engagement. Based on the council’s input, we established a series of trainings to raise awareness of unconscious bias and equip leaders to build inclusive team experiences.

MARKET AREAS AND COMPETITION

We provide a wide range of banking and financial services to individuals, municipalities and businesses through a network of 48 offices and an extensive ATM network throughout Western and Central New York. The region includes the counties of Allegany, Cattaraugus, Cayuga, Chautauqua, Chemung, Erie, Genesee, Livingston, Monroe, Ontario, Orleans, Schuyler, Seneca, Steuben, Wayne, Wyoming and Yates. Our banking activities, though concentrated in the communities where we maintain branches, also extend into neighboring counties. During 2025, our consumer indirect lending presence included the Capital District of New York, and we have commercial loan production offices in Baltimore, Maryland and Syracuse, New York, serving the Mid-Atlantic and Central New York regions, respectively.

Our market area is economically diversified in that we serve both rural markets and the larger markets in and around Rochester and Buffalo, New York. Rochester and Buffalo are the two largest metropolitan areas in New York outside of New York City, with a combined population of over two million people. We anticipate continuing to increase our presence in and around these metropolitan statistical areas and complementary market areas in the coming years.

- 7 -

Table of Contents

We face significant competition in both making loans and attracting deposits, as Western and Central New York have a high density of financial institutions. Our competition for loans comes principally from commercial banks, savings banks, savings and loan associations, mortgage banking companies, credit unions, and other financial services companies. Our competition for deposits has historically come from commercial banks, savings banks and credit unions. We face additional competition for deposits from non-traditional FinTech firms and non-depository competitors such as the mutual fund industry, securities and brokerage firms and insurance companies. We generally compete with other financial service providers on factors such as level of customer service, responsiveness to customer needs, availability and pricing of products, and geographic location. Our industry frequently experiences merger activity, which affects competition by eliminating some institutions while potentially strengthening the franchises of others.

The following table presents the Bank’s market share percentage for total deposits as of June 30, 2025, in each county where we have operations in New York. The table also indicates the ranking by deposit size in each market. All information in the table was obtained from S&P Global Market Intelligence, which compiles deposit data published by the FDIC as of June 30, 2025, and updates the information for any bank mergers and acquisitions completed subsequent to the reporting date.

(1)
Number of full-service branches current as of December 31, 2025; does not include limited- or mobile-branches.

INVESTMENT ACTIVITIES

Our investment policy is contained within our overall Asset-Liability Management and Investment Policy. This policy dictates that investment decisions will be made based on the safety of the investment, liquidity requirements, potential returns, cash flows targets, need for collateral, and desired risk parameters. In pursuing these objectives, we consider the ability of an investment to provide earnings consistent with factors related to quality, maturity, marketability, pledgeability and risk diversification. Our Chief Financial Officer and Treasurer, guided by our Asset–Liability Committee (“ALCO”), is responsible for investment portfolio decisions within the established policies.

Our investment securities strategy is focused on providing liquidity to meet loan demand and redeeming liabilities, providing collateral to meet pledging requirements, maximizing after tax income, managing credit risks, managing overall interest rate risks and maximizing portfolio yield. Our current policy generally limits securities purchases to the following:

•
U.S. treasury securities;

•
U.S. government agency securities, which are securities issued by official Federal government bodies (e.g., the Government National Mortgage Association (“GNMA”) and the Small Business Administration (“SBA”)), and U.S. government-sponsored enterprise securities, which are securities issued by independent organizations that are in part sponsored by the federal government (e.g., the Federal Home Loan Bank (“FHLB”) system, the Federal National Mortgage Association (“FNMA”), the Federal Home Loan Mortgage Corporation (“FHLMC”) and the Federal Farm Credit Bureau);

•
Mortgage-backed securities (“MBS”), which include mortgage-backed pass-through securities, collateralized mortgage obligations, and multi-family MBS issued by GNMA, FNMA and FHLMC;

•
Government Guaranteed Loans (“GGLs”) or loans to business enterprises guaranteed by the Small Business Administration (“SBA”) or U.S. Department of Agriculture (“USDA”). Includes SBA “Guaranteed Interest Certificates,” which represent a beneficial interest in the entire SBA-guaranteed portion of an individual loan, provided the loan is for commercial and industrial purposes.

•
Investment grade municipal securities, including revenue, tax and bond anticipation notes, statutory installment notes and general obligation bonds;

•
Certain creditworthy unrated securities issued by municipalities;

•
Certificates of deposit;

•
Subordinated debt issues for a public bank holding company;

- 8 -

Table of Contents

•
Equity securities at the holding company level;

•
Derivative instruments; and

•
Limited partnership investments.

LENDING ACTIVITIES

General

We offer a broad range of loans including commercial business and revolving lines of credit, commercial mortgages, equipment loans, residential mortgage loans and home equity loans and lines of credit, automobile loans and personal loans. Newly originated and refinanced fixed rate residential mortgage loans are either retained in our portfolio or sold to the secondary market with servicing rights retained.

We continually evaluate and update our lending policy. The key elements of our lending philosophy include the following:

•
To ensure consistent underwriting, employees must share a common view of the risks inherent in lending activities as well as the standards to be applied in underwriting and managing credit risk;

•
Pricing of credit products are risk-based;

•
The loan portfolio must be diversified to limit the potential impact of negative events; and

•
Careful, timely exposure monitoring through dynamic use of our risk rating system is required to provide early warning and assure proactive management of potential problems.

Commercial Lending

We primarily originate commercial business loans and lines of credit in our market areas and underwrite them based on the borrower’s ability to service the loan from operating income. We offer a broad range of commercial lending products, including term loans and lines of credit. Short- and medium-term commercial loans, primarily collateralized, are made available to businesses for working capital (including inventory and receivables), business expansion (including acquisition of real estate, expansion and improvements) and the purchase of equipment. As a general practice, where possible, a first position collateral lien is placed on any available real estate, equipment or other assets owned by the borrower and a personal guarantee of the owner is obtained. Term loans generally have a term up to 7 years, or up to 10 years with an SBA guarantee, while revolving lines generally have a 3-year term or less. As of December 31, 2025, our commercial business loan portfolio totaled $738.3 million, or 16% of our total loan portfolio. As of December 31, 2025, $165.7 million, or 22%, of our aggregate commercial business loan portfolio were at fixed interest rates, while $572.6 million, or 78%, were at variable interest rates.

We also offer commercial mortgage loans to finance the purchase or renovation of real property, which generally consists of loans to businesses or developers seeking to construct or renovate commercial properties, commercial mortgages for the purpose of purchasing or renovating existing residential multifamily properties, commercial owner-occupied properties, in which the borrowing entity occupies at least 50% of the property, or other non-owner occupied commercial properties. Commercial construction loans typically have a 3-year term or less, while other commercial mortgages generally have a term of up to 10 years. The majority of our commercial mortgage loans are secured by first liens on real estate and are typically amortized over a 15- to 30-year period. The underwriting analysis includes credit verification, appraisals and a review of the borrower’s financial condition and repayment capacity. As of December 31, 2025, our commercial mortgage loan portfolio totaled $2.34 billion, or 50.3% of our total loan portfolio. As of December 31, 2025, $753.7 million, or 32%, of the loans in our aggregate commercial mortgage portfolio were at fixed interest rates, while $1.59 billion, or 68%, were at variable interest rates.

We utilize government loan guarantee programs when available and appropriate.

Government Guarantee Programs

We participate in government loan guarantee programs offered by the SBA, USDA, Rural Economic and Community Development and Farm Service Agency, among others. As of December 31, 2025, we had loans with an aggregate principal balance of $40.9 million that were covered by guarantees under these programs. The guarantees typically cover only a certain percentage of these loans. By participating in these programs, we are able to broaden our base of borrowers while reducing credit risk.

- 9 -

Table of Contents

Residential Real Estate Lending

We originate fixed and variable rate one-to-four family residential mortgage loans and lines collateralized by owner-occupied properties located in our market areas. We offer a variety of real estate loan products, including home improvement loans, closed-end home equity loans, and home equity lines of credit, which are generally amortized over periods of up to 30 years. Loans collateralized by one-to-four family residential real estate generally have been originated in amounts of no more than 80% of appraised value or have mortgage insurance. Mortgage title insurance and hazard insurance are normally required. As of December 31, 2025, our residential real estate loan portfolio totaled $657.0 million, or 14% of our total loan portfolio. As of December 31, 2025, our residential real estate lines portfolio totaled $75.1 million, or 2% of our total loan portfolio. As of December 31, 2025, $457.3 million, or 70%, of the loans in our residential real estate loan portfolio were at fixed interest rates, while $199.8 million, or 30%, were at variable interest rates. The residential real estate lines portfolio primarily consists of variable rate lines. Approximately 92% of the loans and lines in our residential real estate portfolios were in first lien positions at December 31, 2025. We do not engage in sub-prime or other high-risk residential mortgage lending as a line of business.

We sell certain one-to-four family residential mortgages to the secondary mortgage market and typically retain the right to service the mortgages. We typically follow the underwriting and appraisal guidelines of the secondary market, including the FHLMC and the Federal Housing Administration, and service the loans in a manner that satisfies the secondary market agreements. As of December 31, 2025, our residential mortgage servicing portfolio totaled $293.3 million, the majority of which has been sold to the FHLMC.

Consumer Lending

We offer a variety of loan products to our consumer customers, including automobile loans, secured installment loans and other types of secured and unsecured personal loans. As of December 31, 2025, our consumer indirect portfolio totaled $807.3 million, or 17% of our total loan portfolio. Outstanding consumer loan balances were concentrated in indirect automobile loans.

We originate indirect consumer loans for a mix of new and used vehicles predominately through franchised new car dealers. The consumer indirect loan portfolio is primarily comprised of loans with terms that typically range from 36–84 months. We have developed relationships with franchised new car dealers in Western, Central and the Capital District of New York. The consumer indirect loan portfolio primarily consists of fixed rate loans with relatively short durations.

We also originate other consumer automobile loans, recreational vehicle loans, boat loans, personal loans (collateralized and uncollateralized) and deposit account collateralized loans. The terms of these loans typically range from 12–60 months and vary based upon the nature of the collateral and the size of loan. A portion of the consumer lending program is underwritten on a secured basis using the customer’s financed automobile, mobile home, boat or recreational vehicle as collateral. The other loans in our consumer portfolio approximated $9 million as of December 31, 2025, all of which were fixed interest rate loans.

Credit Administration

Our loan policy establishes standardized underwriting guidelines, as well as the loan approval process and the committee structures necessary to facilitate and ensure the highest possible loan quality decision-making in a timely and businesslike manner. The policy establishes requirements for extending credit based on the size, risk rating and type of credit involved. The policy also sets limits on individual lending authority and various forms of joint lending authority, while designating which loans are required to be approved at the committee level.

Our credit objectives are to:

•
Compete effectively and service the legitimate credit needs of the communities within our market;

•
Enhance our reputation for superior quality and timely delivery of products and services;

•
Provide pricing that reflects the entire relationship and is commensurate with the risk profiles of our borrowers;

•
Retain, develop and acquire profitable, multi-product, value-added relationships with high-quality borrowers;

•
Focus on government guaranteed lending to meet the needs of the small businesses in our communities;

•
Develop efforts to serve majority, minority, low and moderate income and other traditionally underserved communities; and

•
Comply with all relevant laws and regulations.

To render an independent and objective evaluation of our asset quality and credit administration process, our policy includes loan reviews, performed by our Credit Review function under the supervision of the Chief Risk Officer and governance provided by our Audit and Risk Oversight committees of the Board of Directors.

We assign risk ratings to loans in the commercial business and commercial mortgage portfolios. We use those risk ratings to:

•
Profile the risk and exposure in the loan portfolio and identify developing trends and relative levels of risk;

•
Identify deteriorating credits;

•
Reflect the probability that a given customer may default on its obligations; and

•
Assist with risk-based pricing.

- 10 -

Table of Contents

Through the loan approval process, loan administration and loan review program, management seeks to continuously monitor our credit risk profile and assess the overall quality of the loan portfolio and adequacy of the allowance for credit losses.

We have several procedures in place to assist in maintaining the overall quality of our loan portfolio. Delinquent loan reports are monitored by credit administration to identify adverse levels and trends. Loans, including loans individually evaluated for impairment, are generally classified as non-accruing if they are past due as to maturity or payment of principal or interest for a period of more than 90 days, unless such loans are well-collateralized and in the process of collection. Loans that are on a current payment status or past due less than 90 days may also be classified as non-accruing if repayment in full of principal and/or interest is uncertain.

Allowance for Credit Losses

The allowance for credit losses is established through charges to earnings in the form of a provision for credit losses. The allowance reflects management’s estimate of the amount of probable credit losses in the portfolio, based on factors including, but not limited to:

•
Specific allocations for individually evaluated credits;

•
Segmentation of credit exposures by similar credit characteristics;

•
Historical net charge-off experience by segment;

•
Correlation of segmented historical losses to a loss driver;

•
Evaluation of historical loss emergence by segment;

•
Evaluation and establishment of look-back periods by segment;

•
Evaluation of prepayment and curtailment experience by segment;

•
Evaluation of average life for each segment;

•
Levels and trends in delinquent and non-accruing loans;

•
Trends in volume and terms of loans;

•
Effects of changes in lending policy;

•
National and local economic trends and conditions excluding the loss driver, which is national unemployment;

•
Regulatory environment;

•
Portfolio administration;

•
Potential funding of unfunded commitments;

•
Evaluation of held to maturity investments; and

•
Evaluation of deferred interest receivable.

Our methodology for estimating the allowance for credit losses includes the following:

1.
Collateral dependent commercial business and commercial mortgage loans, as well as non-collateral dependent criticized loans of two-million dollars and greater are typically reviewed individually and assigned a specific loss allowance, if considered necessary, in accordance with U.S. generally accepted accounting principles (“GAAP”).

2.
Loans not analyzed for a specific reserve are segmented into “pools” of loans based upon similar risk characteristics. This is referred to as the pooled loan component of the allowance for credit losses estimate. The Company has identified nine portfolio segments of loans including Commercial Loans/Lines, Commercial Mortgage–Construction, Commercial Mortgage–Multifamily, Commercial Mortgage–Owner Occupied, Commercial Mortgage–Non-owner Occupied, Residential Real Estate Loans, Residential Real Estate Lines of Credit, Indirect Loans, and Other Consumer Loans. Each segment, or pool, is quantitatively analyzed using a discounted cash flow approach over the life of the loan. The pooled loans estimate is based upon periodic review of the collectability of the loans quantitatively correlating historical loan experience with (or industry indices where there are not statistically meaningful defaults for a pool) reasonable and supportable forecasts using forward looking information. Adjustments to the quantitative evaluation may be made for differences in current or expected qualitative risk characteristics such as changes in underwriting standards, delinquency level, regulatory environment, economic condition, Company management and the status of portfolio administration including the Company’s credit risk review function.

3.
The Company’s held to maturity (“HTM”) debt securities are also required to utilize the current expected credit losses approach to estimate expected credit losses. The Company’s HTM debt securities included securities that are issued by U.S. government or U.S. government-sponsored enterprises. These securities, widely recognized as “risk free,” carry the explicit and/or implicit guarantee of the U.S. government and have a long history of zero credit loss. The Company also carries a portfolio of HTM municipal bonds. The Company measures its allowance for credit losses on HTM debt securities on a collective basis by major security type. The estimate is based on historical credit losses, if any, adjusted for current conditions and reasonable and supportable forecasts. The Company considers the nature of the collateral, potential future changes in collateral values and available loss information.

4.
The Company had made the election under the FASB’s Accounting Standards Codification (“ASC”) Topic 326, Financial Instruments—Credit Losses, of not measuring an allowance for credit losses for accrued interest receivable due to the Company’s policy of writing off uncollectible accrued interest receivable balances in a timely manner, as described above.

- 11 -

Table of Contents

5.
The reserve for unfunded commitments (the “Unfunded Reserve”) represents the expected credit losses on off-balance sheet commitments such as unfunded commitments to extend credit and standby letters of credit. However, a liability is not recognized for commitments unconditionally cancellable by the Company. The unfunded reserve is recognized as a liability (other liabilities in the consolidated statements of financial condition), with adjustments to the reserve recognized as a provision for credit loss expense in the consolidated statements of operations. The unfunded reserve is determined by estimating expected future funding, under each segment, and applying the expected loss rates. Expected future funding is based on historical averages of funding rates (i.e., the likelihood of draws taken). To estimate future funding on unfunded balances, current funding rates are compared to historical funding rates.

Management presents a quarterly review of the adequacy of the allowance for credit losses to the Audit Committee of our Board of Directors based on the methodology described above. See also the section titled “Allowance for Credit Losses” in Part II, Item 7, Management’s Discussion and Analysis of Financial Condition and Results of Operations, of this Annual Report on Form 10-K.

SOURCES OF FUNDS

Our primary sources of funds are deposits and borrowed funds.

Deposits

We maintain a full range of deposit products and accounts to meet the needs of the residents and businesses in our primary service area. Products include an array of checking and savings account programs for individuals, municipalities, and businesses, including money market accounts, certificates of deposit, sweep investment capabilities as well as Individual Retirement Accounts and other qualified plan accounts. We rely primarily on competitive pricing of our deposit products, customer service and long-standing relationships with customers to attract and retain these deposits and seek to make our services convenient to the community by offering a choice of several delivery systems and channels, including telephone, mail, online, automated teller machines (“ATMs”), debit cards, point-of-sale transactions, automated clearing house transactions (“ACH”), remote deposit, and mobile banking via telephone or wireless devices. We also take advantage of the use of technology by offering business customers banking access via the Internet and various advanced cash management systems.

We also participate in reciprocal deposit programs, which enable depositors to receive FDIC insurance coverage for deposits exceeding the maximum insurable amount. Through these programs, deposits in excess of the maximum insurable amount are placed with multiple participating financial institutions. Reciprocal deposits totaled $829.2 million at December 31, 2025.

Borrowings

We have access to a variety of borrowing sources and use both short-term and long-term borrowings to support our asset base. Borrowings from time-to-time include subordinated notes, federal funds purchased, securities sold under agreements to repurchase, brokered deposits, FHLB advances, and borrowings from the discount window of the Federal Reserve Bank (“FRB”).

Other sources of funds include scheduled amortization and prepayments of principal from loans and mortgage-backed securities, maturities and calls of investment securities and funds provided by operations.

OTHER INFORMATION

We also make available, free of charge through our website, all reports filed with or furnished to the Securities and Exchange Commission (“SEC”), including our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q and Current Reports on Form 8-K, as well as any amendments to those reports, as soon as reasonably practicable after those documents are filed with or furnished to the SEC. These filings may be viewed by accessing the SEC Filings subsection of the Financials section of our website (www.FISI-investors.com). Information available on our website is not a part of, and is not incorporated into, this Annual Report on Form 10-K.

All of the reports we file with the SEC, including this Annual Report on Form 10-K, Quarterly Reports on Form 10-Q and Current Reports on Form 8-K, as well as any amendments thereto may be accessed at www.sec.gov.

- 12 -

Table of Contents

SUPERVISION AND REGULATION

We are subject to extensive regulation under federal and state laws. The regulatory framework is intended primarily for the protection of depositors, federal deposit insurance funds and the banking system as a whole and not for the protection of shareholders and creditors.

Elements of the laws and regulations applicable to the Company and the Bank and material to our operations are described below. The description is qualified in its entirety by reference to the full text of the statutes, regulations and policies that are described. Also, such statutes, regulations and policies are continually under review by Congress, state legislatures, and federal and state regulatory agencies. A change in statutes, regulations or regulatory policies applicable to the Company or the Bank could have a material effect on the business, financial condition and results of operations of the Company.

Holding Company Regulation

The Company is subject to comprehensive regulation by the Board of Governors of the Federal Reserve System, frequently referred to as the Federal Reserve Board (“FRB” or “Federal Reserve”), under the Bank Holding Company Act (the “BHC Act”), as amended by, among other laws, the Gramm-Leach-Bliley Act of 1999 (the “GLBA”) and the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”). The Company is registered with the Federal Reserve as a financial holding company (“FHC”). The Company must file reports with the FRB and submit such additional information as the FRB may require, and the Company and its non-banking affiliates are subject to examination by the FRB. Under federal regulation and FRB policy, an FHC must serve as a source of strength for its subsidiary banks. Under the FRB’s policy, the FRB may require, and has required in the past, a holding company to contribute additional capital to an undercapitalized subsidiary bank. The BHC Act provides that an FHC must obtain FRB approval before:

•
Acquiring, directly or indirectly, ownership or control of any voting shares of another bank, financial holding company or bank holding company if, after such acquisition, it would own or control more than 5% of such shares (unless it already owns or controls the majority of such shares);

•
Acquiring all or substantially all the assets of another bank, financial holding company or bank holding company, or

•
Merging or consolidating with another financial holding company or bank holding company.

The BHC Act generally prohibits a bank holding company from acquiring direct or indirect ownership or control of more than 5% of the voting shares of any company which is not a bank or bank holding company, or from engaging directly or indirectly in activities other than those of banking, managing or controlling banks, or providing services for its subsidiaries. However, the GLBA amended portions of the BHC Act to authorize FHCs, such as the Company, to directly or through non-bank subsidiaries engage in securities, insurance and other activities that are financial in nature or incidental to a financial activity. In order to undertake and maintain these activities, an FHC must certify that all the depository institutions controlled by the company are well capitalized and well managed.

The Dodd-Frank Act, Economic Growth Act, and Volcker Rule

The Dodd-Frank Act significantly changed the regulation of financial institutions, such as community banks, thrifts, small bank and thrift holding companies, and the financial services industry.

Although it was enacted in 2010, certain provisions of the Dodd-Frank Act have yet to be fully implemented and may be impacted by future legislation, rulemaking or executive orders. Our management continues to monitor the ongoing implementation of the Dodd-Frank Act and, as new regulations are issued, will assess their effect on our business, financial condition and results of operations.

In May 2018, the Economic Growth, Regulatory Relief and Consumer Protection Act (“Economic Growth Act”) was enacted and impacted several of the provisions of the Dodd-Frank Act. The law provided certain regulatory relief to community banks, like the Bank, with less than $10 billion in total consolidated assets. This relief includes an exemption from the Volcker Rule (i.e., a provision of the Dodd-Frank Act which prohibits banks and their affiliates from engaging in proprietary trading and from investing and sponsoring hedge funds and private equity funds.)

Depository Institution Regulation

The Bank is organized under the laws of the state of New York. It is a member of the Federal Reserve System, and its deposits are insured under the Deposit Insurance Fund (“DIF”) of the FDIC up to applicable legal limits. The lending, investment, deposit-taking, and other business authorities of the Bank is governed primarily by state and federal law and regulations, and the Bank is prohibited from engaging in any operations not authorized by such laws and regulations. The Bank is subject to extensive regulation, supervision and examination by, and the enforcement authority of, the New York State Department of Financial Services (the “NY DFS”) and the FRB, and to a lesser extent by the FDIC, as its deposit insurer. This regulatory structure includes:

•
Real estate lending standards, which provide guidelines concerning loan-to-value ratios for various types of real estate loans;

•
Risk-based capital rules, including accounting for interest rate risk, concentration of credit risk and the risks posed by non-traditional activities;

•
Rules requiring depository institutions to develop and implement internal procedures to evaluate and control credit and settlement exposure to their correspondent banks;

- 13 -

Table of Contents

•
Rules restricting types and amounts of equity investments; and

•
Rules addressing various safety and soundness issues, including operations and managerial standards, standards for asset quality, earnings and compensation standards.

Capital Requirements

The Company and the Bank are each required to comply with applicable capital adequacy standards established by the Federal Reserve. The current risk-based capital standards applicable to the Company and the Bank are based on the final capital framework for strengthening international capital standards, known as Basel III, of the Basel Committee on Banking Supervision.

The Basel III Rules, among other things, (i) introduce a capital measure called CET1, which consists primarily of retained earnings and common stock, (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments, such as preferred stock and certain convertible securities, meeting certain revised requirements, (iii) define CET1 narrowly by requiring that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital, and (iv) expand the scope of the deductions/adjustments to capital as compared to historical regulations.

Under the Basel III Rules, the current minimum capital ratios, including an additional capital conservation buffer (2.5%) applicable to the Company and the Bank, are:

•
7.0% CET1 to risk-weighted assets;

•
8.5% Tier 1 capital (that is, CET1 plus Additional Tier 1 capital) to risk-weighted assets; and

•
10.5% Total capital (that is, Tier 1 capital plus Tier 2 capital) to risk-weighted assets.

Banking institutions that do not hold capital above the required minimum levels, including the capital conservation buffer, will face constraints on paying dividends and compensation based on the amount of the shortfall.

The Basel III Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage-servicing rights (“MSRs”), certain deferred tax assets and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such items, in the aggregate, exceed 15% of CET1.

The Basel III Rules prescribe a standardized approach for risk weightings for a variety of asset classes that, depending on the nature of the assets, generally ranges from 0% for U.S. government and agency securities, to 600% for certain equity exposures.

The Economic Growth Act provided for a potential exception from the Basel III Rules for community banks that maintain a Community Bank Leverage Ratio (“CBLR”) of at least 8.0% to 10.0%. The CBLR is calculated by dividing Tier 1 capital by the bank’s average total consolidated assets. In the final rules approved by the FRB in November 2019, qualifying community banking organizations that opt in to using the CBLR are considered to be in compliance with the Basel III Rules as long as the bank maintains a CBLR of greater than 9.0%. In November 2025, the federal banking agencies issued a proposed rule to lower the CBLR to 8%. If a bank is not a qualifying community banking organization, does not opt in to using the CBLR, or cannot maintain the CBLR, the bank would have to comply with the Basel III Rules. We did not opt into using the CBLR and determined to comply with the Basel III Rules instead of using the CBLR framework.

Leverage Requirements

Bank holding companies and banks are also required to comply with minimum leverage ratio requirements. These requirements provide for a minimum ratio of Tier 1 capital to total consolidated quarterly average assets (as defined for regulatory purposes), net of the loan loss reserve, goodwill and certain other intangible assets (the “leverage ratio”), of 4.0%.

Prompt Corrective Action

The Federal Deposit Insurance Act, as amended (“FDIA”), requires, among other things, the federal banking agencies to take “prompt corrective action” with respect to depository institutions that do not meet minimum capital requirements. The FDIA establishes five capital categories for FDIC-insured banks: well capitalized, adequately capitalized, undercapitalized, significantly undercapitalized and critically undercapitalized. A depository institution is deemed to be “well capitalized” if the institution has a total risk-based capital ratio of 10.0% or greater, a CET 1 ratio of 6.5% or greater, a Tier 1 risk-based capital ratio of 8.0% or greater, a leverage ratio of 5.0% or greater, and the institution is not subject to an order, written agreement, capital directive or prompt corrective action directive to meet and maintain a specific level for any capital measure.

The FDIA imposes progressively more restrictive constraints on operations, management and capital distributions, depending on the capital category in which an institution is classified.

For further information regarding the capital ratios and leverage ratio of the Company and the Bank, see section titled “Sources and Uses of Capital Resources” in Part II, Item 7, Management’s Discussion and Analysis of Financial Condition and Results of Operations, included in this Annual Report on Form 10-K. The current requirements and the actual levels for the Company and the Bank are detailed in Note 13, Regulatory Matters, of the notes to consolidated financial statements, included in Part II, Item 8, of this Annual Report on Form 10-K.

- 14 -

Table of Contents

Brokered Deposits

The FDIA and FDIC regulations thereunder limit the ability of banks to accept, renew or rollover brokered deposits unless the institution is well-capitalized under the prompt corrective action framework discussed above, or unless it is adequately capitalized and obtains a waiver from the FDIC. Less-than-well-capitalized banks also are subject to restrictions on the interest rates that they may pay on deposits. The characterization of deposits as “brokered” may result in the imposition of higher deposit assessments on such deposits. In December 2020, the FDIC issued a final rule amending its regulations governing brokered deposits. The rule sought to clarify and modernize the FDIC’s regulatory framework for brokered deposits. Notable aspects of the rule include: (i) the establishment of bright-line standards for determining whether an entity meets the statutory definition of “deposit broker”; (ii) the identification of a number of business relationships in which the agent or nominee is automatically not deemed to be a “deposit broker” because their primary purpose is not the placement of funds with depository institutions (the “primary purpose exception”); (iii) the establishment of a more transparent application process for entities that seek the “primary purpose exception,” but do not qualify as one of the identified business relationships to which the exception is automatically applicable; and (iv) the clarification that third parties that have an exclusive deposit-placement arrangement with only one insured depository institution is not considered a “deposit broker.” The final rule took effect in April 2021 and full compliance with the rule has been required since January 1, 2022. Further, as mandated by the Economic Growth Act, the FDIC’s brokered deposit regulations provide a limited exception for reciprocal deposits for banks that are well managed and well capitalized (or adequately capitalized and have obtained a waiver from the FDIC as mentioned above). Under the limited exception, qualified banks are able to exempt from treatment as “brokered” deposits up to $5 billion or 20% of the institution’s total liabilities in reciprocal deposits (which are defined as deposits received by a financial institution through a deposit placement network with the same maturity (if any) and in the same aggregate amount as deposits placed by the institution in other network member banks).

Dividends

The FRB policy is that an FHC should pay cash dividends only to the extent that its net income for the past year is sufficient to cover both the cash dividends and a rate of earnings retention that is consistent with the holding company’s capital needs, asset quality and overall financial condition, and that it is inappropriate for an FHC experiencing serious financial problems to borrow funds to pay dividends. Furthermore, a bank that is classified under the prompt corrective action regulations as “undercapitalized” will be prohibited from paying any dividends.

Notification to the FRB is required prior to our declaring and paying a cash dividend to our stockholders during any period in which our quarterly and/or cumulative twelve-month period net earnings are insufficient to fund the dividend amount, among other requirements. Under such circumstances, we may not pay a dividend should the FRB object until such time as we receive approval from the FRB or no longer need to provide notice under applicable regulations.

The primary source of cash for dividends we pay is the dividends we receive from the Bank. The Bank is subject to various regulatory policies and requirements relating to the payment of dividends, including requirements to maintain capital above regulatory minimums. Under New York banking law, the Bank may declare and pay dividends from its net profits, unless there is an impairment of capital. Additionally, approval of the NY DFS is required prior to paying a dividend if the dividend declared by the Bank exceeds the sum of the Bank’s net profits for that year and its retained net profits for the preceding two calendar years. The Bank declared dividends of $32.0 million and $21.0 million in 2025 and 2024, respectively.

Federal Deposit Insurance Assessments

The Bank is a member of the FDIC and pays an insurance premium to the FDIC to fund the DIF based upon the Bank’s assessable assets on a quarterly basis. Deposits are insured up to applicable limits by the FDIC and such insurance is backed by the full faith and credit of the U.S. Government.

The current level of deposit insurance is $250 thousand. The coverage limit is per depositor, per insured depository institution for each account ownership category.

Under the Dodd-Frank Act, the FDIC defined the deposit insurance assessment base for an insured depository institution as an amount equal to the institution’s average consolidated total assets during the assessment period minus average tangible equity. For institutions of the Bank’s asset size, the FDIC operates a risk-based premium system that determines assessment rates from financial modeling designed to estimate the probability of the bank’s failure over a three-year period. Assessment rates for institutions of the Bank’s size ranged from 2.5- to 32-basis points effective January 1, 2023.

The FDIC may also issue special assessments. In 2023, the FDIC issued a special assessment, applicable to banks with uninsured deposits in excess of $5 billion, in order to recover losses sustained by the DIF as a result of the March 2023 failures of Silicon Valley Bank and Signature Bank.

- 15 -

Table of Contents

The FDIC is authorized to conduct examinations of and require reporting by FDIC-insured institutions. It is also authorized to terminate a depository bank’s deposit insurance upon a finding by the FDIC that the bank’s financial condition is unsafe or unsound, the institution has engaged in unsafe or unsound practices, or it has violated any applicable law, regulation, order or condition enacted or imposed by the bank’s regulatory agency. The termination of deposit insurance for the Bank would have a material adverse effect on our earnings, operations and financial condition. Management does not know of any practice, condition or violation that might lead to termination of deposit insurance.

Consumer Laws and Regulations

In addition to the laws and regulations discussed herein, the Bank is also subject to certain federal and state laws and regulations that are designed to protect consumers in transactions with banks. Many of these laws are implemented through regulations issued by the Consumer Financial Protection Bureau (the “CFPB”) though, for institutions of the Bank’s asset size, compliance with those regulations is subject to supervision and examination by the federal banking regulator, i.e., the FRB in the Bank’s case. While the list set forth herein is not exhaustive, consumer protection laws include, among others, the Fair Credit Reporting Act, the Truth in Lending Act, the Truth in Savings Act, the Electronic Funds Transfer Act, the Expedited Funds Availability Act, the Equal Credit Opportunity Act, the Fair Housing Act, the Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, the Fair Debt Collection Practices Act, the Servicemembers Civil Relief Act, and these laws’ respective state-law counterparts, as well as state usury laws and federal and state laws regarding unfair, deceptive and abusive acts and practices, and each of these laws’ implementing regulations. These and other federal and state laws, among other things, require disclosures of the cost of credit and terms of deposit accounts, provide substantive consumer rights, prohibit discrimination in credit transactions, regulate the use of credit report information, provide financial privacy protections, prohibit unfair, deceptive and abusive practices, restrict the Banks’s ability to raise interest rates and subject the Bank to substantial regulatory oversight. Violations of applicable consumer protection laws can result in significant potential liability from litigation brought by customers, including actual damages, restitution and attorneys’ fees. Federal and state bank regulators, federal law enforcement agencies, state attorneys general and state and local consumer protection agencies may also seek to enforce consumer protection requirements and obtain these and other remedies, including regulatory sanctions, customer rescission rights, fines and civil money penalties. Failure to comply with consumer protection requirements may also result in our failure to obtain any required bank regulatory approval for merger or acquisition transactions the Company may wish to pursue or our prohibition from engaging in such transactions even if approval is not required.

Community Reinvestment Act

Pursuant to the federal Community Reinvestment Act (the “CRA”), and its New York state analogue, the Bank is obligated, consistent with safe and sound banking practices, to help meet the credit needs of its entire community, including low- and moderate-income neighborhoods. The Federal Reserve Bank of New York and NY DFS periodically assess the Bank’s record of performance under the CRA and the New York state analogue, respectively, and issue one of the following ratings: “Outstanding,” “Satisfactory,” “Needs to Improve,” or “Substantial Noncompliance.”

The most recently completed evaluation of the Bank’s performance under the CRA was conducted by the Federal Reserve Bank of New York in April 2025 and resulted in an overall rating of “Satisfactory.”

The last CRA evaluation completed by NY DFS of New York’s analogue was in December 2024 and this performance evaluation resulted in an overall rating by the NY DFS of “Satisfactory.”

Privacy and Cybersecurity

Federal banking regulators, as required under the GLBA, have adopted rules limiting the ability of banks and other financial institutions to disclose nonpublic information about consumers to non-affiliated third parties. The rules require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to non-affiliated third parties. The privacy provisions of the GLBA affect how consumer information is transmitted through diversified financial services companies and conveyed to outside vendors.

In November 2021, the federal bank regulatory agencies issued a final rule requiring banking organizations to notify their primary federal regulator as soon as possible and no later than 36 hours after determining that a “computer-security incident” that rises to the level of a “notification incident,” as those terms are defined in the final rule, has occurred. A notification incident is a “computer-security incident” that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector.

The final rule also requires bank service providers to notify any affected bank to or on behalf of which the service provider provides services “as soon as possible” after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for four or more hours. The rule was effective April 1, 2022, with compliance required by May 1, 2022.

- 16 -

Table of Contents

The NY DFS requires New York State-chartered or licensed banks regulated by the NY DFS, such as us, to adopt broad cybersecurity protections. In particular, we have established a program designed to ensure the safety of our information systems, adopted a written cybersecurity policy, and designated an information security officer. We are subject to ongoing compliance and reporting requirements of the NY DFS. In November 2023, the NY DFS amended its cybersecurity regulations to include heightened governance requirements and an expansion of the breadth and depth of required policies and procedures, among other things.

Digital Banking

Technological developments continue to significantly alter the ways in which financial institutions and their customers conduct their business. The growth of the Internet has caused banks to adopt and refine alternative distribution and marketing systems. The federal bank regulatory agencies have targeted various aspects of Internet banking, including security and systems. There can be no assurance that federal or state bank regulatory agencies will not adopt new regulations that will materially affect the Bank’s Internet operations or restrict any such further operations.

Cannabis Banking

The Marijuana Regulation and Taxation Act was signed into law on March 31, 2021, legalizing the possession and sale of recreational marijuana in New York State for adults aged 21 or older, and the state has issued adult-use cannabis cultivation, processing and retail dispensary licenses. In December 2025, the President issued an Executive Order directing federal agencies to reschedule marijuana to Schedule III of the Controlled Substance Act. We have implemented a program to provide financial products and services to legal cannabis-related businesses and partner with other financial institutions who provide such services. Our exposure to these types of businesses has been tempered by our exit from the BaaS line of business.

Offering financial products and services to the cannabis industry presents a unique set of regulatory risks due to the conflict between state and federal laws, as marijuana still remains illegal at the federal level. In January 2018, the U.S. Department of Justice (the “DOJ”) rescinded the “Cole Memo” and related memoranda which characterized the enforcement of the Controlled Substances Act against persons and entities complying with state regulatory systems permitting the use, manufacture and sale of medical marijuana as an inefficient use of their prosecutorial resources and discretion. The impact of the DOJ’s rescission of the Cole Memo and related memoranda is unclear, but in the future may result in increased enforcement actions against the regulated cannabis industry generally. Enforcement policies and practices may be highly variable between political administrations, and it is unclear what effect the Executive Order will have. In addition, federal prosecutors have significant discretion and there can be no assurance that the federal prosecutor for any district in which we operate will not choose to strictly enforce the federal laws governing cannabis. In the future, enforcement actions may be taken against cannabis-related businesses or financial services providers that are viewed as aiding and abetting such activities.

The Financial Crimes Enforcement Network (“FinCEN”) published guidelines in 2014 for financial institutions servicing state-legal cannabis businesses. These guidelines clarify how financial institutions can provide services to marijuana-related businesses “in a manner consistent with their obligations to know their customers and to report possible criminal activity.” The Bank has and will continue to follow this and other FinCEN guidance in the areas of cannabis banking.

Anti-Money Laundering and the USA Patriot Act

A major focus of governmental policy on financial institutions is combating money laundering and terrorist financing. The USA PATRIOT Act of 2001 substantially broadened the scope of U.S. anti-money laundering laws and regulations by imposing significant new compliance and due diligence obligations, creating new crimes and penalties and expanding the extra-territorial jurisdiction of the United States. Financial institutions are prohibited from entering into specified financial transactions and account relationships and must use enhanced due diligence procedures in their dealings with certain types of high-risk customers and implement a written customer identification program. Financial institutions must take certain steps to assist government agencies in detecting and preventing money laundering and report certain types of suspicious transactions.

Regulatory authorities routinely examine financial institutions for compliance with these obligations. The failure of a financial institution to maintain and implement an adequate program to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal and reputational consequences for the institution, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required. Regulatory authorities have increased their regulatory scrutiny of the Bank Secrecy Act (“BSA”) and anti-money laundering and countering the financing of terrorism (“AML/CFT”) programs maintained by financial institutions and have imposed cease and desist orders and civil money penalties against institutions found to be violating these obligations. The Bank has adopted policies and procedures which are in compliance with these requirements.

- 17 -

Table of Contents

The Anti-Money Laundering Act of 2020 (“AMLA”), which amends the BSA, was enacted in January 2021. The AMLA was intended to comprehensively reform and modernize U.S. anti-money laundering and anti-terrorist financing laws. Among other things, it codified a risk-based approach to anti-money laundering compliance for financial institutions; required the U.S. Department of the Treasury to promulgate priorities for anti-money laundering and countering the financing of terrorism policy; required the development of standards for testing technology and internal processes for BSA compliance; expanded enforcement and investigation-related authority, including the increase of available sanctions for certain BSA violations; and expanded BSA whistleblower incentives and protections. In June 2021, FinCEN issued the priorities for anti-money laundering and countering the financing of terrorism policy required under AMLA. The national priorities include: (i) corruption, (ii) cybercrime, (iii) terrorist financing, (iv) fraud, (v) transnational crime, (vi) drug trafficking, (vii) human trafficking and (viii) proliferation financing. In June 2024, FinCEN issued a proposed rule under the AMLA to amend its existing regulations to expressly require that banks’ AML/CFT compliance programs (a) be effective, risk-based, and reasonably designed, (b) include a formal risk assessment process, and (c) incorporate the national priorities into its risk assessment, among other things. The federal banking agencies, including the FRB, concurrently proposed rules to amend their own AML/CFT-related regulations to align with the changes proposed by FinCEN and incorporate other longstanding supervisory expectations. The Bank reviews and monitors its AML/CFT compliance program to ensure it complies with the changes reflected in the AMLA and the regulations that implement it.

Office of Foreign Assets Control Regulation

The U.S. Treasury Department’s Office of Foreign Assets Control, or “OFAC”, administers and enforces economic and trade sanctions against targeted foreign countries and regimes, nationals, and others, under authority of various laws, regulations, and executive orders. OFAC publishes lists of specially designated nationals and sanctioned countries. The Bank is responsible for, among other things, blocking accounts of, and transactions with, such sanctioned parties or jurisdictions, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence. Failure to comply with these sanctions could have serious legal and reputational consequences, including, causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required.

Interstate Branching

Pursuant to the Dodd-Frank Act, national and state-chartered banks may open an initial branch in states other than their home state (e.g., host states) by establishing a de novo branch at any location in such host state at which a bank chartered in such host state could establish a branch. Applications to establish such branches must still be filed with the appropriate primary federal regulator.

Transactions with Affiliates

FII, FSB, Five Star REIT, Courier Capital, and Five Star Advisors LLC, are affiliates within the meaning of the Federal Reserve Act and its implementing regulation, Regulation W. The Federal Reserve Act and Regulation W impose limitations on a bank with respect to extensions of credit to, investments in, and certain other transactions with, its affiliates, including its parent FHC and the holding company’s other subsidiaries. Furthermore, bank loans and extensions of credit to affiliates also are subject to various collateral requirements.

Section 23A of the Federal Reserve Act and Regulation W limit the aggregate outstanding amount of any insured depository institution’s loans and other “covered transactions” with any particular affiliate to no more than 10% of the institution’s capital stock and surplus, and limits the aggregate outstanding amount of any insured depository institution’s covered transactions with all of its affiliates to no more than 20% of its capital stock and surplus. “Covered transactions” are defined by law and regulation to include a loan or extension of credit to an affiliate, as well as a purchase of securities issued by an affiliate, a purchase of assets from the affiliate, the acceptance of securities issued by the affiliate as collateral for a loan, and the issuance of a guarantee, acceptance or letter of credit on behalf of an affiliate. Section 23A of the Federal Reserve Act and Regulation W also generally require that an insured depository institution’s loans to its affiliates be, at a minimum, 100% secured. Section 23B of the Federal Reserve Act and Regulation W generally require that an insured depository institution’s transactions with its affiliates, including but not limited to “covered transactions,” be on terms and under circumstances that are substantially the same or at least as favorable to the Bank, as those prevailing for comparable transactions with or involving non-affiliates. The Dodd-Frank Act significantly expanded the coverage and scope of the limitations on affiliate transactions within a banking organization. For example, the Dodd-Frank Act applies the 10% of capital and surplus limit on covered transactions to financial subsidiaries and amended the definition of “covered transaction” to include (i) securities borrowing or lending transactions with an affiliate, and (ii) all derivatives transactions with an affiliate, to the extent that either causes a bank or its affiliate to have credit exposure to the securities borrowing/lending or derivative counterparty.

- 18 -

Table of Contents

Investment Advisory Regulation

Courier Capital is a provider of investment consulting and financial planning services and, as such, is considered an “investment adviser” under the U.S. Investment Advisers Act of 1940, as amended (the “Advisers Act”). An investment adviser is any person or entity that provides advice to others, or that issues reports or analyses, regarding securities for compensation. While an FHC is generally excluded from regulation under the Advisers Act, the SEC has stated that this exclusion does not apply to investment adviser subsidiaries of FHCs, such as Courier Capital. Because Courier Capital has over $100 million in assets under management, it is considered a “large adviser,” which requires registration with the SEC by filing Form ADV, including Part 3 to Form ADV, or Form CRS, which discloses the material terms of the advisor’s relationship with retail customers. Courier Capital must update these forms at least once each year and more frequently under certain specified circumstances. This registration covers Courier Capital and its employees as well as other persons under their control and supervision, such as independent contractors, provided that their activities are undertaken on behalf of Courier Capital.

In addition to these registration requirements, the Advisers Act contains numerous other provisions that impose obligations on investment advisors. For example, Section 206 includes anti-fraud provisions that courts have interpreted as establishing fiduciary duties extending to all services undertaken on behalf of the client. These duties include, but are not limited to, the disclosure of all material facts to clients, providing only suitable investment advice, and seeking best price execution of trades. Section 206 also has specific rules relating to, among other things, advertising, safeguarding client assets, the engagement of third parties, the duty to supervise persons acting on the investment adviser’s behalf, and the establishment of an effective internal compliance program and a code of ethics.

Courier Capital is subject to each of these obligations and, as applicable, restrictions, and is also subject to examination by the SEC’s Office of Compliance, Investigations, and Examinations to assess its overall compliance with the Advisers Act and the effectiveness of its internal controls.

During 2024, the Bank entered into a business relationship with Principal Securities, Inc., an investment adviser registered under the Advisers Act, and subject to its provisions, to provide investment advisory and broker-dealer services to the Bank’s customers.

Incentive Compensation

Our compensation practices are subject to oversight by the Federal Reserve. The federal banking agencies’ guidance on incentive compensation policies intends to ensure that the incentive compensation policies of banking organizations do not encourage excessive risk-taking and undermine the safety and soundness of those organizations. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

The FRB reviews, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Company, that are not “large, complex banking organizations.” These reviews are tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives are included in reports of examination. Deficiencies are incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

The Dodd-Frank Act requires the federal banking agencies and the SEC to establish joint regulations or guidelines prohibiting incentive-based payment arrangements at specified regulated entities having at least $1 billion in total consolidated assets (which would include the Company and the Bank) that encourage inappropriate risks by providing an executive officer, employee, director or principal shareholder with excessive compensation, fees or benefits or that could lead to material financial loss to the entity. In addition, the agencies must establish regulations or guidelines requiring enhanced disclosure to regulators of incentive-based compensation arrangements. In May 2016, the federal bank regulatory agencies and the SEC invited public comments on a proposed rule to accomplish this mandate. In May 2024, several federal banking agencies sought to re-propose the incentive compensation regulation, but the FRB did not adopt the proposal; in 2025, the FDIC withdrew its authorization for the proposal.

- 19 -

Table of Contents

Other Future Legislation and Changes in Regulations

In addition to the specific proposals described above, from time to time, various legislative and regulatory initiatives are introduced in Congress and state legislatures, as well as by regulatory agencies. Such initiatives may include proposals to expand or contract the powers of FHCs and depository institutions or proposals to substantially change the financial institution regulatory system. Such proposals could change banking statutes and regulations and/or our operating environment in substantial and unpredictable ways. If enacted, such legislation and regulations could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among banks, savings associations, credit unions, and other financial institutions. We cannot predict whether any such legislation or regulations will be enacted or issued, and, if enacted or issued, the effect that they would have on our financial condition or results of operations. A change in statutes, regulations or regulatory policies applicable to us or our subsidiaries could have a material effect on our business.

Regulatory and Economic Policies

Our business and earnings are affected by general and local economic conditions and by the monetary and fiscal policies of the U.S. government, its agencies and various other governmental regulatory authorities. The FRB regulates the supply of money in order to influence general economic conditions. Among the instruments of monetary policy available to the FRB are (i) conducting open market operations in U.S. government obligations, (ii) changing the discount rate on financial institution borrowings, (iii) imposing or changing reserve requirements against financial institution deposits, and (iv) restricting certain borrowings and imposing or changing reserve requirements against certain borrowings by financial institutions and their affiliates. These methods are used in varying degrees and combinations to directly affect the availability of bank loans and deposits, as well as the interest rates charged on loans and paid on deposits. For that reason, the policies of the FRB could have a material effect on our earnings.