NBT BANCORP INC (NBTB) Business

ITEM 1. BUSINESS

NBT Bancorp Inc. is a registered financial holding company incorporated in the state of Delaware in 1986, with its principal headquarters located in Norwich, New York. The principal assets of
NBT Bancorp Inc. consist of all of the outstanding shares of common stock of its subsidiaries, including: NBT Bank, National Association (the “Bank”), NBT Financial Services, Inc. (“NBT Financial”), NBT Holdings, Inc. (“NBT Holdings”), CNBF
Capital Trust I, NBT Statutory Trust I, NBT Statutory Trust II, Alliance Financial Capital Trust I, Alliance Financial Capital Trust II and Evans Capital Trust I (collectively, the “Trusts”). The principal sources of revenue for NBT Bancorp
Inc. are the management fees and dividends it receives from the Bank, NBT Financial and NBT Holdings. Collectively, NBT Bancorp Inc. and its subsidiaries are referred to herein as (the “Company”). As of December 31, 2025, the Company had
assets of $16.00 billion and stockholders’ equity of $1.90 billion on a consolidated basis.

The Company’s business, primarily conducted through the Bank, consists of providing commercial banking, retail banking and wealth management services primarily to customers in its market area,
which includes upstate New York, northeastern Pennsylvania, southern New Hampshire, western Massachusetts, Vermont, southern Maine and central and northwestern Connecticut. The Company has been, and intends to remain, a community-oriented
financial institution offering a variety of financial services. The Company’s business philosophy is to operate as a community bank with local decision-making, providing a broad array of banking and financial services to retail, commercial
and municipal customers.

The financial condition and operating results of the Company are dependent on its net interest income, which is the difference between the interest and dividend income earned on its earning
assets, primarily loans and securities and the interest expense paid on its interest-bearing liabilities, primarily deposits and borrowings. Among other factors, net income is also affected by provision for loan losses and noninterest
income, such as service charges on deposit accounts, card services income, retirement plan administration fees, wealth management revenue including financial services and trust revenue, insurance services, bank owned life insurance income
and gains/losses on securities sales, as well as noninterest expenses, such as salaries and employee benefits, technology and data services, occupancy, professional fees and outside services, office supplies and postage, amortization of
intangible assets, loan collection and OREO expenses, marketing, FDIC assessment expenses and other expenses.

NBT Bank, National Association

The Bank, a full-service commercial bank formed in 1856, provides a broad range of financial products to individuals, corporations and municipalities through its network of branch locations
throughout upstate New York, northeastern Pennsylvania, southern New Hampshire, western Massachusetts, Vermont, southern Maine and central and northwestern Connecticut.

Deposit products offered by the Bank include demand deposit accounts, savings accounts, interest-bearing checking accounts, MMDA and CD accounts. The Bank offers various types of each deposit
account to accommodate the needs of its customers with varying rates, terms and features. Loan products offered by the Bank include indirect and direct consumer loans, home equity loans, mortgages, business banking loans and commercial
loans, with varying rates, terms and features to accommodate the needs of its customers. The Bank also offers various other products and services through its branch network such as trust and investment services and financial planning and
life insurance services. In addition to its branch network, the Bank also offers access to certain products and services electronically through 24-hour online, mobile and telephone channels as well as to a network of ATM locations that
enable customers to check balances, make deposits, transfer funds, pay bills, access statements, apply for loans and access various other products and services.

NBT Financial Services, Inc.

Through NBT Financial, the Company operates EPIC Advisors, Inc. (“EPIC”), a national benefits administration firm which was acquired by the Company on January 21, 2005. Among other services,
EPIC provides retirement plan administration. EPIC’s headquarters are located in Rochester, New York.

NBT Holdings, Inc.

Through NBT Holdings, the Company operates NBT Insurance Agency, LLC (“NBT Insurance”), a full-service regional insurance agency acquired by the Company on September 1, 2008. NBT Insurance is
headquartered in Norwich, New York. NBT Insurance offers a full array of insurance products, including personal property and casualty, business liability and commercial insurance, tailored to serve the specific insurance needs of
individuals as well as businesses in a range of industries operating in the markets served by the Company.

4

Table of Contents

The Trusts

The Trusts were established to raise additional regulatory capital and to provide funding for certain acquisitions. CNBF Capital Trust I and NBT Statutory Trust I are Delaware statutory
business trusts formed in 1999 and 2005, respectively, for the purpose of issuing trust preferred securities and lending the proceeds to the Company. In connection with the acquisition of CNB Bancorp, Inc., the Company formed NBT Statutory
Trust II in February 2006 to fund the cash portion of the acquisition as well as to provide regulatory capital. In connection with the acquisition of Alliance Financial Corporation (“Alliance”), the Company acquired two statutory trusts,
Alliance Financial Capital Trust I and Alliance Financial Capital Trust II, which were formed in 2003 and 2006, respectively. In connection with the acquisition of Evans Bancorp, Inc. (“Evans”), the Company acquired one statutory trust,
Evans Capital Trust I, which was formed in 2004. The Company guarantees, on a limited basis, payments of distributions on the trust preferred securities and payments on redemption of the trust preferred securities. The Trusts are VIEs for
which the Company is not the primary beneficiary, as defined by FASB ASC. In accordance with ASC, the accounts of the Trusts are not included in the Company’s consolidated financial statements.

Operating Subsidiaries of the Bank

The Bank has four operating subsidiaries, NBT Capital Corp., Broad Street Property Associates, Inc., NBT Capital Management, Inc. and SBT Mortgage Service Corporation. NBT Capital Corp.,
formed in 1998, is a venture capital corporation. Broad Street Property Associates, Inc., formed in 2004, is a property management company. NBT Capital Management, Inc., formerly Columbia Ridge Capital Management, Inc., was acquired in 2016
and is a registered investment advisor that provides investment management and financial consulting services. SBT Mortgage Service Corporation, acquired in 2023 in connection with the Salisbury acquisition, is a passive investment company
(“PIC”). The PIC holds loans collateralized by real estate originated or purchased by the Bank. Income of the PIC is exempt from the Connecticut Corporate Business Tax. Evans National Holding Corp., acquired in 2025 in connection with the
Evans acquisition, is a real estate investment trust.

Segment Reporting

The Company has identified two reportable segments: Banking and Retirement Plan Administration. See Note 1 and Note 22 to the consolidated financial statements included in Item 8. Financial
Statements and Supplementary Data, which are included elsewhere in this report.

Evans Bancorp, Inc. Merger

On May 2, 2025, the Company completed the acquisition of Evans, through the merger of Evans with and into the Company, with the Company surviving the merger, and the merger of Evans Bank with
and into the Bank, with the Bank as the surviving bank. Total consideration for the acquisition was $221.8 million in common stock. Evans, with assets of $2.19 billion at December 31, 2024, was headquartered in Williamsville, New York. Its
primary subsidiary, Evans Bank, was a federally-chartered national banking association operating 18 banking locations in Western New York. The acquisition enhances the Company’s presence in Western New York, including the Buffalo and
Rochester communities. In connection with the acquisition, the Company issued 5.1 million shares of common stock and acquired approximately $131.2 million of identifiable net assets, including $1.67 billion of loans, $255.5 million in AFS
investment securities, which were sold during the second quarter of 2025, $33.2 million of core deposit intangibles and $1.86 billion in deposits. As of the acquisition date, the fair value discount was $95.2 million for loans, net of the
reclassification of the PCD allowance and $0.6 million net discount related to long-term debt.

The Company incurred acquisition expenses related to the merger of $19.5 million and $1.5 million for the years ended December 31, 2025 and 2024, respectively.

5

Table of Contents

Competition

The financial services industry, including commercial banking, is highly competitive, and we encounter strong competition for deposits, loans and other financial products and services in our
market area. The increasingly competitive environment is the result of the rate environment, changes in regulation, changes in technology and product delivery systems, additional financial service providers and the accelerating pace of
consolidation among financial services providers. The Company competes for loans, deposits and customers with other commercial banks, savings and loan associations, securities and brokerage companies, mortgage companies, insurance
companies, finance companies, money market funds, credit unions and other nonbank financial service providers.

The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. Banks, securities firms and
insurance companies can merge under the umbrella of a financial holding company, which can offer virtually any type of financial service, including banking, securities underwriting, insurance (both agency and underwriting) and merchant
banking. In addition, technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems.

Some of the Company’s nonbanking competitors have fewer regulatory constraints and may have lower cost structures. In addition, some of the Company’s competitors have assets, capital and
lending limits greater than those of the Company, have greater access to capital markets and offer a broader range of products and services than the Company. These institutions may have the ability to finance wide-ranging marketing
campaigns and may be able to offer lower rates on loans and higher rates on deposits than the Company can offer. Some of these institutions offer services, such as credit cards and international banking, which the Company does not directly
offer.

Various in-state market competitors and out-of-state banks continue to enter or have announced plans to enter or expand their presence in the market areas where the Company currently operates.
With the addition of new financial services providers within our market, the Company expects increased competition for loans, deposits and other financial products and services.

In order to compete with other financial services providers, the Company stresses the community nature of its banking operations and principally relies upon local promotional activities,
personal relationships established by officers, directors and employees with the Company’s customers and specialized services tailored to meet the needs of the communities served. We also offer certain customer services, such as
agricultural lending, that many of our larger competitors do not offer. While the Company’s position varies by market, the Company’s management believes that it can compete effectively as a result of local market knowledge, local decision
making and awareness of customer needs. The Company has banking locations in forty-seven counties in the states of New York, Pennsylvania, New Hampshire, Massachusetts, Vermont, Maine and Connecticut.

Data Privacy and Security Practices

The Company employs a defense-in-depth strategy, which involves a layered approach combining physical and logical controls to ensure comprehensive protection of Company and client information. The high-level
objective of the information security program is to protect the confidentiality, integrity and availability of all information assets in our environment. We accomplish this by building our program around six foundational control areas:
program oversight and governance, safeguards and controls, security awareness training, service provider oversight, incident response and business continuity. The Company’s data security and privacy practices follow all applicable laws and
regulations including the Gramm-Leach Bliley Act of 2001 (“GLBA”) and applicable privacy laws described under the heading “Supervision and Regulation” in this Item 1. Business section.

The controls identified in our enterprise security program are managed by various stakeholders throughout the Company and monitored by the information security team. All employees complete
security and privacy training upon hire and annually thereafter, supplemented by ad hoc sessions. We engage external consultants for periodic audits, including penetration testing, using simulated cyberattacks to identify vulnerabilities-on
public-facing websites and corporate networks. The Board receives regular reports from the Information Security Officer on program status. Additional resources are available at
www.nbtbank.com/Personal/Customer-Support/Fraud-Information-Center.

For more information regarding the Company’s cybersecurity policies and practices, see Item 1C. Cybersecurity below.

6

Table of Contents

Human Capital Resources

At December 31, 2025, the Company had 2,303 full-time equivalent employees. The Company’s employees are not presently represented by any collective bargaining group.

Our employees are the foundation of our success. We are committed to attracting, developing and retaining exceptional talent while fostering a culture of inclusion and belonging grounded in
our values. We strive to create an environment where every individual feels respected, supported and empowered to contribute fully. A workforce enriched by diverse perspectives is a competitive advantage which strengthens our ability to
understand markets, serve customers and deliver results.

Our talent strategy goes beyond hiring to include continuous development, performance recognition and career growth. We invest in our people and celebrate achievements to ensure every employee
has the opportunity to thrive and make a meaningful impact.

Investment in Our People

We believe that investing in our people is essential to sustaining a high-performing culture. We prioritize attracting, developing and retaining top talent, recognizing that a positive
employee experience is essential, especially in today’s competitive labor market.

We offer a comprehensive Total Rewards Program that supports the health, well-being and financial security of our employees while maintaining responsible cost management. This commitment is
central to our Human Resource strategic pillars of positioning the Company as an employer of choice, aligning people strategies with business goals, and enhancing engagement and retention. This strategy includes enhanced benefits such as
paid parental leave, flexible work arrangements, paid time off, retirement transition options and a robust Employee Assistance Program with expanded coverage and health resources.

Our incentive programs are designed to recognize contributions at all levels and motivate employees to achieve shared success, while incorporating strong risk management practices. By
supporting overall well-being and rewarding performance, we create an environment where employees can thrive personally and professionally.

Engaging Employees

We recognize that employee engagement is essential to sustaining strong company performance. While our retention rate remains consistently strong, we continue to invest in strategies to
motivate, connect and engage our employees. These include career planning conversations, ongoing coaching, goal setting, individualized development plans and enhanced communication, all of which contribute to long-term satisfaction and
growth.

Our 2025 Employee Engagement Survey highlighted key themes such as culture, leadership, growth and development and communication. Building on these insights, in 2026, we will conduct pulse
surveys to target specific areas we want to learn more about, assess progress and identify new opportunities. The results will guide pointed initiatives to strengthen engagement across the organization and provide clarity for business
strategies, decision-making and corporate-led development programs. By listening to our employees and acting on their feedback, we ensure that engagement remains a cornerstone of our success.

Learning and Career Development

Our top priority is to attract and retain exceptional talent by fostering continuous learning and internal career growth. Every employee has access to the LinkedIn Learning Library, offering
thousands of courses in a concise, easily consumable format to help individuals build skills and achieve their career aspirations. Today, 90% of our employees actively use this resource, demonstrating a strong commitment to personal
development.

For those new to the banking industry, our Personal Advancement Through Honing Self-Awareness program provides guidance in defining career goals through assessments, training and facilitated
discussions with Talent Development Business Partners. Employees pursuing undergraduate or graduate degrees benefit from our Tuition Reimbursement Program, supporting their academic and professional ambitions.

Beyond employee-driven development, we offer strategic programs designed to attract and grow top talent early in their careers and to accelerate the advancement of high potential and emerging
leaders. These initiatives align with our succession planning objectives. The Management Development Program targets college seniors by offering accelerated career paths and executive mentoring. Our high potential leadership programs are
tailored for professionals with prior experience and seasoned leaders with direct management responsibilities. These programs feature mentorship, coaching, 360-degree feedback, individual development plans, presentation skills training and
increased visibility to senior leadership.

All programs are delivered through a blend of virtual and in-person learning environments, ensuring flexibility and accessibility. Our robust annual talent review and succession planning
process, involving senior management and the Board, reinforces our commitment to leadership continuity and organizational strength. We feel that development is not just an initiative, it is a cornerstone of our culture, empowering employees
to grow, lead and succeed.

7

Table of Contents

Conduct and Ethics

We uphold the highest standards of ethical conduct and workplace respect. The Board, senior management and our Ethics Committee strongly endorse a zero-tolerance policy toward harassment, bias and unethical
behavior.

Our values-based Code of Business Conduct and Ethics is prominently communicated through our website and internal platforms, ensuring clarity and accessibility for all employees. To reinforce these
principles, we provide frequent, role-specific training for managers and employees, along with regular updates on our Whistleblower Policy and reporting mechanisms. These measures reflect our guiding motto: “The right people. Doing the
right things. In the right way.”

Community Engagement

The Company is engaged in the communities where we do business and where our employees and directors live and work. We live out our core value of community involvement through investments of
both money and the time of our employees.

Through our active contribution program, administered by market-based committees with representation from all lines of business, the Company contributed over $3 million in 2025. Our teams’
efforts to distribute philanthropic resources across our footprint ensure alignment with local needs and support for hundreds of organizations that provide health and human services and promote education, affordable housing, economic
development, the arts and agriculture.

A consistent way the Company and our employees support our communities across our markets is through giving to United Way chapters in the form of corporate pledges and employee campaign
contributions. In 2025, these commitments resulted in over $375,000 in funding for United Way chapters that provide resources to local organizations offering critical education, financial, food security and health services.

In addition to corporate financial support of community organizations and causes, employees are encouraged and empowered to volunteer and be a resource in their communities. They invest their
financial and other expertise as board members and serve in roles where they offer direct support to those in need by engaging in all kinds of volunteer activities. In 2025, the Company’s employees reported 12,500 hours of volunteer
service.

The NBT CEI-Boulos Impact Fund is a $10 million real estate equity investment fund with the Bank as the sole investor. The fund, launched in 2022, is designed to support individuals and
communities with low- and moderate income through investments in high-impact, community supported, CRE projects located within the Bank’s Community Reinvestment Act assessment areas in New York. A Social Impact Advisory Board was also
appointed to review proposed investments based on each project’s social and environmental impact, alignment with community needs and community support. Areas of the fund’s targeted impact include: projects that support job creation;
affordable and workforce housing; Main Street revitalization/historic preservation developments that do not contribute to displacement; developments that serve nonprofit organizations; and environmentally sustainable real estate
developments.

In 2023, the NBT CEI-Boulos Impact Fund announced its first equity investment in The Flanigan Square Transformation Project that now provides affordable workforce housing and a grocery store
in a historically underinvested North Central neighborhood in Troy as part of an approximately $75 million socially impactful, environmentally conscious, transit-oriented and community informed master plan. The NBT CEI-Boulos Impact Fund
made a $3.84 million equity investment for a majority ownership stake in two of the three components of the project. The Bargain Grocery opened in 2024, and 72 units of affordable and workforce housing are available with the opening of the
Flanigan Square Lofts in 2025.

Flexible Banking Products

The Company offers a comprehensive array of financial products and services for consumers and businesses with options that are beneficial to unbanked and underbanked individuals. Deposit
accounts include low balance savings and checking options that feature minimal or no monthly service fees, provide assistance rebuilding positive deposit relationships, and assistance for those just starting a new banking relationship. The
NBT iSelect Account was introduced in 2021 and has received certification for meeting the Bank On National Account Standards every year since its inception. Over 26,000 NBT iSelect Accounts have been opened since 2021. These accounts
feature no monthly charges for maintenance, inactivity or dormancy, no overdraft fees and no minimum balance requirement. The Company’s modern digital banking platform incorporates ready access through online and mobile services to current
credit score information and a personal financial management tool for budget and expense tracking.

The Company is committed to making homeownership accessible to individuals and families across the communities we serve. Our suite of home lending products includes innovative and flexible
options, such as government guaranteed programs through the Federal Housing Administration (“FHA”), the USDA Rural Housing Program and the U.S. Department of Veterans Affairs (“VA”). We also offer a variety of in-house programs, including
Habitat for Humanity, Home in the City, Portfolio Housing Agency and Portfolio 97. Our home lending team includes specialists dedicated to affordable housing initiatives, and we maintain longstanding partnerships with housing agencies
across our footprint. These partners provide first-time homebuyer education as well as assistance with down payments and closing costs, helping to ensure that more borrowers can achieve sustainable homeownership.

8

Table of Contents

Environmental

The Company is focused on the environment and committed to business practices and activities that encourage sustainability and minimize our environmental impact. In larger facilities, the
Company conserves energy through the use of building energy management systems and motion sensor lighting controls. In new construction and renovations, the Company incorporates high-efficiency mechanical equipment, LED lighting, and modern
building techniques to reduce our carbon footprint wherever possible. The Company has an ongoing initiative to replace existing lighting with LED lighting to reduce energy consumption.

Services like mobile and online banking, remote deposit capture, electronic loan payments, eStatements and combined statements enable us to support all customers in their efforts to consume
less fuel and paper. Across our footprint, we host community shred days with multiple confidential document destruction companies to promote safe document disposal and recycling.

Supervision and Regulation

The Company, the Bank and certain of its non-banking subsidiaries are subject to extensive regulation under federal and state laws. The regulatory framework applicable to bank holding
companies and their subsidiary banks is intended to protect depositors, federal deposit insurance funds and the stability of the U.S. banking system. This system is not designed to protect equity investors in bank holding companies, such as
the Company.

Set forth below is a summary of the significant laws and regulations applicable to the Company and its subsidiaries. The description that follows is qualified in its entirety by reference to
the full text of the statutes, regulations and policies that are described. Such statutes, regulations and policies are subject to ongoing review by Congress and state legislatures and federal and state regulatory agencies. A change in any
of the statutes, regulations or regulatory policies applicable to the Company and its subsidiaries could have a material effect on the results of the Company.

Overview

The Company is a registered bank holding company and financial holding company under the Bank Holding Company Act of 1956, as amended (the “BHC Act”), and is subject to the supervision of, and
regular examination by, the FRB as its primary federal regulator. The Company is also subject to the jurisdiction of the SEC, and is subject to the disclosure and other regulatory requirements of the Securities Act of 1933, as amended, and
the Securities Exchange Act of 1934, as amended (the “Exchange Act”), as administered by the SEC. The Company’s common stock is listed on the NASDAQ Global Select market under the ticker symbol, “NBTB,” and the Company is subject to the
NASDAQ rules.

The Bank is chartered as a national banking association under the National Bank Act. The Bank is subject to the supervision of, and to regular examination by, the OCC as its chartering
authority and primary federal regulator. The Bank is also subject to the supervision and regulation, to a limited extent, of the FDIC as its deposit insurer. Financial products and services offered by the Company and the Bank are subject to
federal consumer protection laws and implementing regulations promulgated by the Consumer Financial Protection Bureau (“CFPB”). The Company and the Bank are also subject to oversight by state attorneys general for compliance with state
consumer protection laws. The Bank’s deposits are insured by the FDIC up to the applicable deposit insurance limits in accordance with FDIC laws and regulations. The non-bank subsidiaries of the Company and the Bank are subject to federal
and state laws and regulations, including regulations of the FRB and the OCC, respectively.

Since the enactment of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”), U.S. banks and financial services firms have been subject to enhanced regulation and
oversight. It is not clear at this time what the effects on the Company and the Bank will be of any legislation or regulatory changes that may be enacted or implemented by the current administration or otherwise in the future.

9

Table of Contents

Federal Bank Holding Company Regulation

The Company is a bank holding company as defined by the BHC Act. The BHC Act generally limits the business of the Company to banking, managing or controlling banks and other activities that
the FRB has determined to be so closely related to banking “as to be a proper incident thereto.” The Company has also qualified for and elected to be a financial holding company. Financial holding companies may engage in any activity, or
acquire and retain the shares of a company engaged in any activity, that is either (1) financial in nature or incidental to such financial activity (as determined by the FRB in consultation with the Secretary of the Treasury), or (2)
complementary to a financial activity and that does not pose a substantial risk to the safety and soundness of depository institutions or the financial system (as solely determined by the FRB). If a bank holding company seeks to engage in
the broader range of activities permitted under the BHC Act for financial holding companies, (1) the bank holding company and all of its depository institution subsidiaries must be “well capitalized” and “well managed,” as defined in the
FRB’s Regulation Y and (2) it must file a declaration with the FRB that it elects to be a “financial holding company.” In order for a financial holding company to commence any activity that is financial in nature, incidental thereto, or
complementary to a financial activity, or to acquire a company engaged in any such activity permitted by the BHC Act, each insured depository institution subsidiary of the financial holding company must have received a rating of at least
“satisfactory” in its most recent examination under the Community Reinvestment Act of 1977 (the “CRA”). See the section captioned “Community Reinvestment Act of 1977” for further information relating to the CRA. The FRB has the power to
order any bank holding company or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the FRB has reasonable grounds to believe that continuation of such activity or such ownership or
control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company.

Regulation of Mergers and Acquisitions

The BHC Act, the Bank Merger Act and other federal and state statutes regulate acquisitions of depository institutions and their holding companies. The BHC Act requires prior FRB approval for
a bank holding company to acquire, directly or indirectly, 5% or more of any class of voting securities of a commercial bank or its parent holding company and for a company, other than a bank holding company, to acquire 25% or more of any
class of voting securities of a bank or bank holding company (and sometimes a lower percentage if there are other indications of control). Under the Change in Bank Control Act, any person, including a company, may not acquire, directly or
indirectly, control of a bank without providing 60 days’ prior notice and receiving a non-objection from the appropriate federal banking agency.

Under the Bank Merger Act, prior approval of the OCC is required for a national bank to merge with another bank where the national bank is the surviving bank or to purchase the assets or
assume the deposits of another bank. In reviewing applications seeking approval of merger and acquisition transactions, the federal banking agencies will consider, among other criteria, the competitive effect and public benefits of the
transactions, the capital position of the combined banking organization, the applicant’s performance record under the CRA and the effectiveness of the subject organizations in combating money laundering activities.

As a financial holding company, the Company is permitted to acquire control of non-depository institutions engaged in activities that are financial in nature and in activities that are
incidental to financial activities without prior FRB approval. However, the BHC Act, as amended by the Dodd-Frank Act, requires prior written approval from the FRB or prior written notice to the FRB before a financial holding company may
acquire control of a company with consolidated assets of $10 billion or more.

Capital Distributions

The principal source of the Company’s liquidity is dividends from the Bank. The OCC oversees the ability of the Bank to make capital distributions, including dividends. The OCC generally
prohibits a depository institution from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the bank would thereafter be undercapitalized. The OCC’s prior approval
is required if the total of all dividends declared by a national bank in any calendar year would exceed the sum of the bank’s net income for that year and its undistributed net income for the preceding two calendar years, less any required
transfers to surplus. The National Bank Act also prohibits national banks from paying dividends that would be greater than the bank’s undivided profits after deducting statutory bad debt in excess of the bank’s allowance for loan losses.

The federal banking agencies have indicated that paying dividends that deplete a bank’s capital base to an inadequate level would be an unsafe and unsound banking practice and that banking
organizations should generally pay dividends only out of current operating earnings. The appropriate federal regulatory authority is authorized to determine, based on the financial condition of a bank holding company or a bank, that the
payment of dividends would be an unsafe or unsound practice and to prohibit such payment.

10

Table of Contents

Affiliate and Insider Transactions

Transactions between the Bank and its affiliates, including the Company, are governed by Sections 23A and 23B of the Federal Reserve Act (the “FRA”) and the FRB’s implementation of Regulation
W. An “affiliate” of a bank includes any company or entity that controls, is controlled by or is under common control with such bank. In a bank holding company context, at a minimum, the parent holding company of a bank and companies that
are controlled by such parent holding company, are affiliates of the bank. Generally, Sections 23A and 23B of the FRA are intended to protect insured depository institutions from losses in transactions with affiliates. These sections place
quantitative and qualitative limitations on covered transactions between the Bank and its affiliates and require that all transactions between a bank and its affiliates occur on market terms that are consistent with safe and sound banking
practices.

Section 22(h) of the FRA and its implementation of Regulation O restricts loans to the Bank’s and its affiliates’ directors, executive officers and principal stockholders (“Insiders”). Under
Section 22(h), loans to Insiders and their related interests may not exceed, together with all other outstanding loans to such persons and affiliated entities, the Bank’s loan-to-one borrower limit. Loans to Insiders above specified amounts
must receive the prior approval of the Bank’s Board of Directors. Further, under Section 22(h) of the FRA, loans to directors, executive officers and principal stockholders must be made on terms substantially the same as offered in
comparable transactions to other persons, except that such Insiders may receive preferential loans made under a benefit or compensation program that is widely available to the Bank’s employees and does not give preference to the Insider
over the employees. Section 22(g) of the FRA places additional limitations on loans to the Bank’s and its affiliates’ executive officers.

Federal Deposit Insurance and Brokered Deposits

The FDIC’s deposit insurance limit is $250,000 per depositor, per insured bank, for each account ownership category, in accordance with applicable FDIC regulations. The Bank’s deposit accounts
are fully insured by the FDIC Deposit Insurance Fund (the “DIF”) up to the deposit insurance limits in accordance with applicable laws and regulations.

The FDIC uses a risk-based assessment system that imposes insurance premiums based upon a risk matrix that takes into account a bank’s capital level and supervisory rating (“CAMELS rating”).
The risk matrix uses different risk categories distinguished by capital levels and supervisory ratings. As a result of the Dodd-Frank Act, the base for deposit insurance assessments is the consolidated average assets less average tangible
equity. Assessment rates are calculated using formulas that take into account the risk of the institution being assessed.

Under FDIC laws and regulations, no FDIC-insured depository institution can accept brokered deposits unless it is well capitalized or unless it is adequately capitalized and receives a waiver
from the FDIC. Applicable laws and regulations also limit the interest rate that any depository institution that is not well capitalized may pay on brokered deposits.

Under the Federal Deposit Insurance Act (“FDIA”), the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or
unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC. The Bank’s management is not aware of any practice, condition or violation that might lead to the
termination of its deposit insurance.

Federal Home Loan Bank System

The Bank is also a member of the FHLB of New York, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to
the rules and requirements of the FHLB, including the requirement to acquire and hold shares of capital stock in the FHLB in an amount at least equal to the sum of 0.125% of mortgage related assets at the beginning of each year. The Bank
was in compliance with FHLB rules and requirements as of December 31, 2025.

11

Table of Contents

Debit Card Interchange Fees

The Dodd-Frank Act requires that any interchange transaction fee charged for a debit transaction be reasonable and proportional to the cost incurred by the issuer for the transaction. FRB
regulations mandated by the Dodd-Frank Act limit interchange fees on debit cards to a maximum of 21 cents per transaction plus 5 bps of the transaction amount. The rule also permits a fraud-prevention adjustment of 1 cent per transaction
conditioned upon an issuer developing, implementing and updating reasonably designed fraud-prevention policies and procedures. Issuers that, together with their affiliates, have less than $10 billion of assets, are exempt from the debit
card interchange fee standards. In addition, FRB regulations prohibit all issuers, including the Company and the Bank, from restricting the number of networks over which electronic debit transactions may be processed to less than two
unaffiliated networks.

In October 2023, the FRB issued a proposal under which the maximum permissible interchange fee for an electronic debit transaction would be the sum of 14.4 cents per transaction and 4 bps
multiplied by the value of the transaction. Furthermore, the fraud-prevention adjustment would increase from a maximum of 1 cent to 1.3 cents per debit card transaction. The proposal would adopt an approach for future adjustments to the
interchange fee cap, which would occur every other year based on issuer cost data gathered by the FRB from large debit card issuers. The comment period for this proposal ended in May 2024 but no final rule has been published to date. In
December 2025, nine major financial trade organizations urged the Fed to withdraw this proposal given the passage of time, arguing that the 2021 data upon which the 2023 proposed rule was based does not support informed decision-making, and
there is still uncertainty with respect to the outcome of litigation challenging these FRB regulations. The extent to which any such proposed changes in permissible interchange fees will impact our future revenues is currently uncertain.

Source of Strength Doctrine

FRB policy requires bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. Section 616 of the Dodd-Frank Act codifies the requirement that
bank holding companies serve as a source of financial strength to their subsidiary depository institutions. A bank holding company’s failure to meet its obligations to serve as a source of strength to its subsidiary banks will generally be
considered by the FRB to be an unsafe and unsound banking practice or a violation of FRB regulations or both. As a result, the Company is expected to commit resources to support the Bank, including at times when the Company may not be in a
financial position to provide such resources. Any capital loan by the Company to the Bank is subordinate in right of payment to deposits and to certain other indebtedness of such subsidiary banks. The U.S. Bankruptcy Code provides that, in
the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority
of payment.

In addition, under the National Bank Act, if the Bank’s capital stock is impaired by losses or otherwise, the OCC is authorized to require payment of the deficiency by assessment upon the
Company. If the assessment is not paid within three months, the OCC could order a sale of Bank stock held by the Company to cover any deficiency.

Capital Adequacy

In July 2013, the FRB, the OCC and the FDIC approved final rules (the “Capital Rules”) that established a new capital framework for U.S. banking organizations. The Capital Rules generally
implement the Basel Committee on Banking Supervision’s (the “Basel Committee”) December 2010 final capital framework referred to as “Basel III” for strengthening international capital standards. The Capital Rules revised the definitions and
the components of regulatory capital, as well as addressed other issues affecting the numerator in banking institutions’ regulatory capital ratios. The Capital Rules also addressed asset risk weights and other matters affecting the
denominator in banking institutions’ regulatory capital ratios and replace the existing general risk-weighting approach with a more risk-sensitive approach.

12

Table of Contents

The Capital Rules: (1) require a capital measure called “Common Equity Tier 1” (“CET1”) and related regulatory capital ratio of CET1 to risk-weighted assets; (2) specify that Tier 1 capital
consists of CET1 and “Additional Tier 1 capital” instruments meeting certain revised requirements; (3) mandate that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital; and
(4) expand the scope of the deductions from and adjustments to capital as compared to existing regulations. Under the Capital Rules, for most banking organizations, including the Company, the most common form of Additional Tier 1 capital is
non-cumulative perpetual preferred stock and the most common forms of Tier 2 capital are subordinated notes and a portion of the allocation for loan losses, in each case, subject to the Capital Rules’ specific requirements.

Pursuant to the Capital Rules, the minimum capital ratios are:

The Capital Rules also require a “capital conservation buffer,” composed entirely of CET1, on top of these minimum risk-weighted asset ratios. The capital conservation buffer is designed to
absorb losses during periods of economic stress. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer will face constraints on dividends, equity and other capital
instrument repurchases and compensation based on the amount of the shortfall. The additional capital conservation buffer applicable to the Company and the Bank is 2.5% of CET1, and effectively results in minimum ratios inclusive of the
capital conservation buffer of (1) CET1 to risk-weighted assets of at least 7%, (2) Tier 1 capital to risk-weighted assets of at least 8.5% and (3) Total capital to risk-weighted assets of at least 10.5%. The risk-weighting categories in
the Capital Rules are standardized and include a risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. government and agency securities, to 600% for certain equity exposures and
resulting in higher risk weights for a variety of asset classes. The Capital Rules provide for a number of deductions from and adjustments to CET1.

In addition, under the prior general risk-based capital rules, the effects of AOCI items included in stockholders’ equity (for example, marks-to-market of securities held in the AFS portfolio)
under GAAP were excluded for the purposes of determining regulatory capital ratios. Under the Capital Rules, the effects of certain AOCI items are not excluded; however, banking organizations not using the advanced approaches, including the
Company and the Bank, were permitted to make a one-time permanent election to continue to exclude these items in January 2015. The Capital Rules also preclude certain hybrid securities, such as trust preferred securities issued after May
19, 2010, from inclusion in bank holding companies’ Tier 1 capital.

Management believes that the Company is in compliance with the targeted capital ratios.

Prompt Corrective Action and Safety and Soundness

Pursuant to Section 38 of the FDIA, federal banking agencies are required to take “prompt corrective action” (“PCA”) should an insured depository institution fail to meet certain capital
adequacy standards. At each successive lower capital category, an insured depository institution is subject to more restrictions and prohibitions, including restrictions on growth, restrictions on interest rates paid on deposits,
restrictions or prohibitions on payment of dividends and restrictions on the acceptance of brokered deposits. Furthermore, if an insured depository institution is classified in one of the undercapitalized categories, it is required to
submit a capital restoration plan to the appropriate federal banking agency and the holding company must guarantee the performance of that plan. Based upon its capital levels, a bank that is classified as well capitalized, adequately
capitalized or undercapitalized, may be treated as though it were in the next lower capital category if the appropriate federal banking agency, after notice and opportunity for hearing, determines that an unsafe or unsound condition or an
unsafe or unsound practice, warrants such treatment.

For purposes of PCA, to be: (1) well capitalized, an insured depository institution must have a total risk based capital ratio of at least 10%, a Tier 1 risk based capital ratio of at least
8%, a CET1 risk based capital ratio of at least 6.5%, and a Tier 1 leverage ratio of at least 5%; (2) adequately capitalized, an insured depository institution must have a total risk based capital ratio of at least 8%, a Tier 1 risk based
capital ratio of at least 6%, a CET1 risk based capital ratio of at least 4.5%, and a Tier 1 leverage ratio of at least 4%; (3) undercapitalized, an insured depository institution would have a total risk based capital ratio of less than 8%,
a Tier 1 risk based capital ratio of less than 6%, a CET1 risk based capital ratio of less than 4.5%, and a Tier 1 leverage ratio of less than 4%; (4) significantly undercapitalized, an insured depository institution would have a total risk
based capital ratio of less than 6%, a Tier 1 risk based capital ratio of less than 4%, a CET1 risk based capital ratio of less than 3%, and a Tier 1 leverage ratio of less than 3%; (5) critically undercapitalized, an insured depository
institution would have a ratio of tangible equity to total assets that is less than or equal to 2%. At December 31, 2025, the Bank qualified as “well capitalized” under applicable regulatory capital standards.

Bank holding companies and insured depository institutions may also be subject to potential enforcement actions of varying levels of severity by the federal banking agencies for unsafe or
unsound practices in conducting their business or for violation of any law, rule, regulation, condition imposed in writing by the agency or term of a written agreement with the agency. In more serious cases, enforcement actions may include
the issuance of directives to increase capital; the issuance of formal and informal agreements; the imposition of civil monetary penalties; the issuance of a cease and desist order that can be judicially enforced; the issuance of removal
and prohibition orders against officers, directors and other institution-affiliated parties; the termination of the insured depository institution’s deposit insurance; the appointment of a conservator or receiver for the insured depository
institution; and the enforcement of such actions through injunctions or restraining orders based upon a judicial determination that the FDIC, as receiver, would be harmed if such equitable relief was not granted.

13

Table of Contents

Volcker Rule

Section 619 of the Dodd-Frank Act, commonly known as the Volcker Rule, restricts the ability of banking entities from: (1) engaging in “proprietary trading” and (2) investing in or sponsoring
certain covered funds, subject to certain limited exceptions.

Depositor Preference

The FDIA provides that, in the event of the “liquidation or other resolution” of an insured depository institution, the claims of depositors of the institution, including the claims of the
FDIC as subrogee of insured depositors and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution. If an insured depository institution fails,
insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors, including the parent bank holding company, with respect to any extensions of credit they have made to such
insured depository institution.

Consumer Protection and CFPB Supervision

The Dodd-Frank Act centralized responsibility for consumer financial protection by creating the CFPB, an independent agency charged with responsibility for implementing, enforcing and
examining compliance with federal consumer financial laws. The Company grew its asset base in excess of $10 billion in 2020. The Company is now subject to the CFPB’s examination authority with regard to compliance with federal consumer
financial laws and regulations, in addition to the OCC as the primary regulatory of the Bank. Under the Dodd-Frank Act, state attorneys general are also empowered to enforce rules issued by the CFPB.

The Company is subject to federal consumer financial statutes and the regulations promulgated thereunder including, but not limited to:

The Bank’s failure to comply with any of the consumer financial laws can result in civil actions, regulatory enforcement action by the federal banking agencies and the U.S. Department of
Justice.

14

Table of Contents

USA PATRIOT Act

The Bank Secrecy Act (“BSA”), as amended by the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA PATRIOT Act”),
imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the
financing of terrorism. Financial institutions also are required to respond to requests for information from federal banking agencies and law enforcement agencies. Information sharing among financial institutions for the above purposes is
encouraged by an exemption granted to complying financial institutions from the privacy provisions of the GLBA and other privacy laws. Financial institutions that hold correspondent accounts for foreign banks or provide private banking
services to foreign individuals are required to take measures to avoid dealing with certain foreign individuals or entities, including foreign banks with profiles that raise money laundering concerns and are prohibited from dealing with
foreign “shell banks” and persons from jurisdictions of particular concern. The primary federal banking agencies and the Secretary of the Treasury have adopted regulations to implement several of these provisions. Since May 11, 2018, the
Bank has been required to comply with the Customer Due Diligence Rule, which clarified and strengthened the existing obligations for identifying new and existing customers and explicitly included risk-based procedures for conducting ongoing
customer due diligence. All financial institutions also are required to establish internal anti-money laundering programs. The effectiveness of a financial institution in combating money laundering activities is a factor to be considered in
any application submitted by the financial institution under the Bank Merger Act. The Company has a BSA and USA PATRIOT Act Board-approved compliance program commensurate with its risk profile.

Identity Theft Prevention

The FCRA’s Red Flags Rule requires financial institutions with covered accounts (e.g., consumer bank accounts and loans) to develop, implement and administer an identity theft prevention
program. Our program includes policies and procedures to detect suspicious patterns or practices, such as inconsistencies in personal information or unusual account activity, that may indicate identity theft.

Office of Foreign Assets Control Regulation

The United States government has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others. These are typically known as the “OFAC” rules
based on their administration by the U.S. Treasury Department Office of Foreign Assets Control (“OFAC”). The OFAC-administered sanctions targeting countries take many different forms. Generally, they contain one or more of the following
elements: (1) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on “U.S. persons” engaging in financial
transactions relating to making investments in or providing investment-related advice or assistance to a sanctioned country; and (2) a blocking of assets in which the government or specially designated nationals of the sanctioned country
have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (property and bank deposits) cannot be paid out, withdrawn, set off or
transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal and reputational consequences.

Financial Privacy and Data Security

The Company and the Bank are subject to federal laws, including the GLBA and certain state laws containing consumer privacy protection provisions. These provisions limit the ability of banks
and other financial institutions to disclose nonpublic information about consumers to affiliated and non-affiliated third parties and limit the reuse of certain consumer information received from nonaffiliated financial institutions. These
provisions require notice of privacy policies to clients and, in some circumstances, allow consumers to prevent disclosure of certain nonpublic personal information to affiliates or non-affiliated third parties by means of “opt out” or “opt
in” authorizations.

The GLBA requires that financial institutions implement comprehensive written information security programs that include administrative, technical and physical safeguards to protect consumer
information. Further, pursuant to interpretive guidance issued under the GLBA and certain state laws, financial institutions are required to notify clients of security breaches resulting in unauthorized access to their personal information.
The Bank follows all GLBA obligations.

The Bank is also subject to data security standards, privacy and data breach notice requirements, primarily those issued by the OCC. The federal banking agencies, through the Federal Financial
Institutions Examination Council, have adopted guidelines to encourage financial institutions to address cybersecurity risks and identify, assess and mitigate these risks, both internally and at critical third party services providers.

The Company continues to invest in advanced technologies and partnerships to strengthen its cybersecurity posture and mitigate emerging threats.

15

Table of Contents

Community Reinvestment Act of 1977

The Bank has a responsibility under the CRA, as implemented by OCC regulations, to help meet the credit needs of the communities it serves, including low- and moderate-income neighborhoods.
The CRA does not establish specific lending requirements or programs for financial institutions nor does it limit an institution’s discretion to develop the types of products and services that it believes are best suited to its particular
community, consistent with the CRA. Regulators periodically assess the Bank’s record of compliance with the CRA. The Bank’s failure to comply with the CRA could, at a minimum, result in regulatory restrictions on its activities and the
activities of the Company. The Bank’s most current CRA rating was “Satisfactory.”

Future Legislative and Regulatory Initiatives

Congress, state legislatures and financial regulatory agencies may introduce various legislative and regulatory initiatives that could affect the financial services industry, generally. Such initiatives may
include proposals to expand or contract the powers of bank holding companies and/or depository institutions or proposals to substantially change the financial institution regulatory system. This includes changes in priorities and operations
of regulatory agencies in connection with new leadership or otherwise. Such legislation or regulatory changes could change banking statutes and the regulatory and operating environment of the Company in substantial and unpredictable ways.
If enacted or implemented, such legislation or regulatory changes could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among banks, savings associations, credit
unions and other financial institutions. The Company cannot predict whether any such legislation will be enacted, and, if enacted, the effect that it or any implementing regulations would have on the financial condition or results of
operations of the Company. A change in statutes, regulations or regulatory policies applicable to the Company or any of its subsidiaries could have a material effect on the business of the Company.

Available Information

The Company’s website is www.nbtbancorp.com. The Company makes available free of charge through its website its Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on
Form 8-K and any amendments to those reports as soon as reasonably practicable after such material is electronically filed with or furnished to the SEC pursuant to Section 13(a) or 15(d) of the Exchange Act. We also make available through
our website other reports filed with or furnished to the SEC under the Exchange Act, including our proxy statements and reports filed by officers and directors under Section 16(a) of that Act, as well as our Code of Business Conduct and
Ethics and other codes/committee charters. The references to our website do not constitute incorporation by reference of the information contained in the website and such information should not be considered part of this document.

This Annual Report on Form 10-K and other reports filed with the SEC are available on the SEC’s website, which contains reports, proxy and information statements and other information
regarding issuers that file electronically with the SEC. The SEC’s website address is www.sec.gov.