NBT BANCORP INC (NBTB) Risk Factors

ITEM 1A. RISK FACTORS

There are risks inherent to the Company’s business. The material risks and uncertainties that management believes affect the Company are described below. Any of the following risks could
affect the Company’s financial condition and results of operations and could be material and/or adverse in nature. You should consider all of the following risks together with all of the other information in this Annual Report on Form 10-K.

Risks Related to our Business and Industry

The Company may be adversely affected by conditions in the financial markets and economic conditions generally.

Key macroeconomic conditions historically have affected the Company’s business, results of operations and financial condition and are likely to affect them in the future. Consumer confidence,
unemployment and other economic indicators are among the factors that often impact consumer spending and payment behavior and demand for credit. The Company relies primarily on interest and fees on our loan receivables to generate net
earnings. The economy in the United States and globally has experienced volatility in recent years and may continue to do so for the foreseeable future. There can be no assurance that economic conditions will not worsen. Unfavorable or
uncertain economic conditions can be caused by declines in economic growth, business activity or investor or business confidence, limitations on the availability or increases in the cost of credit and capital, trade wars or tariffs,
inflation, changes in interest rates, the timing and impact of geopolitical uncertainties, natural disasters, epidemics and pandemics, terrorist attacks, acts of war or a combination of these or other factors. Federal budget deficit
concerns and the potential for political conflict over legislation to fund U.S. government operations and raise the U.S. government’s debt limit may increase the possibility of a default by the U.S. government on its debt obligations,
related credit-rating downgrades, or an economic recession in the United States. A worsening of business and economic conditions could have adverse effects on our business, including the following:

Deterioration in local economic conditions may negatively impact our financial performance.

The Company’s success depends primarily on the general economic conditions in upstate New York, northeastern Pennsylvania, southern New Hampshire, western Massachusetts, Vermont, southern
Maine, central and northwestern Connecticut and the specific local markets in which the Company operates. Unlike larger national or other regional banks that are more geographically diversified, the Company provides banking and financial
services to customers primarily in the upstate New York areas of Norwich, Albany, Amsterdam-Gloversville, Binghamton, Buffalo, Glens Falls, Hudson Valley, Ogdensburg-Massena, Oneonta, Plattsburgh, Rochester, Syracuse and Utica-Rome, the
northeastern Pennsylvania areas of Scranton and Wilkes-Barre, Berkshire County, Massachusetts, southern New Hampshire, Vermont, southern Maine and central and northwestern Connecticut. The local economic conditions in these areas have a
significant impact on the demand for the Company’s products and services as well as the ability of the Company’s customers to repay loans, the value of the collateral securing loans and the stability of the Company’s deposit funding
sources.

17

Table of Contents

A downturn in our local economies could cause significant increases in nonperforming loans, which could negatively impact our earnings. Declines in real estate values in our market areas could
cause any of our loans to become inadequately collateralized, which would expose us to greater risk of loss. Additionally, a decline in real estate values could result in the decline of originations of such loans, as most of our loans and
the collateral securing our loans are located in those areas.

Severe weather, flooding and other effects of climate change and other natural disasters could adversely affect our financial condition, results of
operations or liquidity.

Our branch locations and our customers’ properties may be adversely impacted by flooding, wildfires, high winds and other effects of severe weather conditions. These events can force property
closures, result in property damage and/or result in delays in expansion, development or renovation of our properties and those of our customers. Even if these events do not directly impact our properties or our customers’ properties, they
may impact us and our customers through increased insurance, energy or other costs. In addition, changes in laws or regulations, including federal, state or city laws, relating to climate change could result in increased capital
expenditures to improve the energy efficiency of our branch locations and/or our customers’ properties.

Ongoing legislative or regulatory uncertainties and changes regarding climate risk management and practices may result in higher regulatory, compliance, credit and reputational risks and
costs.

Variations in interest rates could adversely affect our results of operations and financial condition.

The Company’s earnings and financial condition, like that of most financial institutions, are largely dependent upon net interest income, which is the difference between interest and dividend income earned
from loans and securities and interest expense paid on deposits and borrowings. The narrowing of interest rate spreads could adversely affect the Company’s earnings and financial condition. Interest rates remain elevated compared to recent
years and may increase. The Company cannot predict with certainty, or control, changes in interest rates. Regional and local economic conditions and the policies of regulatory authorities, including monetary policies of the FRB, affect
rates and, therefore, interest income and interest expense. High interest rates could also affect the amount of loans that the Company can originate because higher rates could cause customers to apply for fewer mortgages or cause depositors
to shift funds from accounts that have a comparatively lower cost to accounts with a higher cost. The Company may also experience customer attrition due to competitor pricing on both deposits and loans. If the cost of interest-bearing
deposits increases at a rate greater than the yields on interest-earning assets increase, net interest income will be negatively affected. Changes in the asset and liability mix may also affect net interest income. Similarly, lower interest
rates cause higher yielding assets to prepay and floating or adjustable rate assets to reset to lower rates. If the Company is not able to reduce its funding costs sufficiently, due to either competitive factors or the maturity schedule of
existing liabilities, then the Company’s NIM will decline.

Any substantial or unexpected change in, or prolonged change in market interest rates could have a material adverse effect on the Company’s financial condition and results of operations. See
the section captioned “Net Interest Income” in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations and Item 7A. Quantitative and Qualitative Disclosure About Market Risk located elsewhere in this
report for further discussion related to the Company’s management of interest rate risk.

Our lending, and particularly our emphasis on commercial lending, exposes us to the risk of losses upon borrower default.

As of December 31, 2025, approximately 56% of the Company’s loan portfolio consisted of commercial and industrial, agricultural, commercial construction and CRE loans. These types of loans
generally expose a lender to greater risk of non-payment and loss than residential mortgage loans because repayment of the loans often depends on the successful operation of the property, the income stream of the borrowers and, for
construction loans, the accuracy of the estimate of the property’s value at completion of construction and the estimated cost of construction. Such loans typically involve larger loan balances to single borrowers or groups of related
borrowers compared to residential mortgage loans. Because the Company’s loan portfolio contains a significant number of commercial and industrial, agricultural, construction and CRE loans with relatively large balances, the deterioration of
one or a few of these loans could cause a significant increase in nonperforming loans. An increase in nonperforming loans could result in a net loss of earnings from these loans, an increase in the provision for loan losses and/or an
increase in loan charge-offs, all of which could have a material adverse effect on the Company’s financial condition and results of operations. See the section captioned “Loans” in Item 7. Management’s Discussion and Analysis of Financial
Condition and Results of Operations located elsewhere in this report for further discussion related to our commercial and industrial, agricultural, construction and CRE loans.

18

Table of Contents

Our allowance for credit losses may not be sufficient to cover actual loan losses, which could have a material adverse effect on our business, financial
condition and results of operations.

The Company maintains an allowance for credit losses, which is an allowance established through a provision for loan losses charged to expense, that represents management’s best estimate of expected credit
losses within the existing portfolio of loans. The allowance, in the judgment of management, is necessary to reserve for estimated loan losses and risks inherent in the loan portfolio. The determination of the appropriate level of the
allowance for credit losses inherently involves a high degree of subjectivity and requires the Company to make significant estimates of current credit risks, forecast economic conditions and future trends, all of which may undergo material
changes. Changes in economic conditions affecting borrowers, new information regarding existing loans, identification of additional problem loans and other factors, both within and outside of the Company’s control, may require an increase
in the allowance for credit losses. Bank regulatory agencies periodically review the Company’s allowance for credit losses and may require an increase in the provision for credit losses or the recognition of further loan charge-offs, based
on judgments different from those of management. In addition, if charge-offs in future periods exceed the allowance for credit losses, the Company may need additional provisions to increase the allowance for credit losses. These potential
increases in the allowance for credit losses would result in a decrease in net income and, possibly, capital and may have a material adverse effect on the Company’s financial condition and results of operations. See the section captioned
“Risk Management – Credit Risk” in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations located elsewhere in this report for further discussion related to the Company’s process for determining the
appropriate level of the allowance for loan losses. Management expects that the CECL model may create more volatility in the level of our allowance for credit losses from quarter to quarter as changes in the level of allowance for credit
losses will be dependent upon, among other things, macroeconomic forecasts and conditions, loan portfolio volumes and credit quality.

Strong competition within our industry and market area could adversely affect our performance and slow our growth.

The Company faces substantial competition in all areas of its operations from a variety of different competitors, many of which are larger and may have more financial resources. Such
competitors primarily include national, regional and community banks within the various markets in which the Company operates. Additionally, various banks continue to enter or have announced plans to enter the market areas in which the
Company currently operates. The Company also faces competition from many other types of financial institutions, including, without limitation, savings and loans, credit unions, finance companies, brokerage firms, insurance companies and
other financial intermediaries. The financial services industry could continue to become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. Technology has lowered barriers to
entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. Many of the Company’s competitors have fewer regulatory constraints and may
have lower cost structures. Additionally, due to their size, many competitors may be able to achieve economies of scale and, as a result, may offer a broader range of products and services as well as better pricing for those products and
services than the Company can.

The Company’s ability to compete successfully depends on a number of factors, including, among other things:

Failure to perform in any of these areas could significantly weaken the Company’s competitive position, which could adversely affect the Company’s growth and profitability, which, in turn,
could have a material adverse effect on the Company’s financial condition and results of operations.

19

Table of Contents

The Company is subject to liquidity risk, which could adversely affect net interest income and earnings.

The purpose of the Company’s liquidity management is to meet the cash flow obligations of its customers for both deposits and loans. Regulators are increasingly focused on liquidity risk after
the bank failures of 2023. The primary liquidity measurement the Company utilizes is called basic surplus, which captures the adequacy of the Company’s access to reliable sources of cash relative to the stability of its funding mix of
average liabilities. This approach recognizes the importance of balancing levels of cash flow liquidity from short and long-term securities with the availability of dependable borrowing sources, which can be accessed when necessary.
However, competitive pressure on deposit pricing could result in a decrease in the Company’s deposit base or an increase in funding costs. In addition, liquidity will come under additional pressure if loan growth exceeds deposit growth.
These scenarios could lead to a decrease in the Company’s basic surplus measure to an amount below the minimum policy level of 5%. To manage this risk, the Company has the ability to purchase brokered time deposits, borrow against
established borrowing facilities with other banks (federal funds) and enter into repurchase agreements with investment companies. Depending on the level of interest rates applicable to these alternatives, the Company’s net interest income,
and therefore earnings, could be adversely affected. See the section captioned “Liquidity Risk” in Item 7.

Our ability to service our debt, pay dividends and otherwise pay our obligations as they come due is substantially dependent on capital distributions
from our subsidiaries.

The Company is a separate and distinct legal entity from its subsidiaries. It receives substantially all of its revenue from dividends from its subsidiaries. These dividends are the principal
source of funds to pay dividends on the Company’s common stock and interest and principal on the Company’s debt. Various federal and/or state laws and regulations limit the amount of dividends that the Bank may pay to the Company. In
addition, the Company’s right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors. In the event the Bank is unable to pay dividends to the
Company, the Company may not be able to service debt, pay obligations or pay dividends on the Company’s common stock. The inability to receive dividends from the Bank could have a material adverse effect on the Company’s business, financial
condition and results of operations.

A reduction in the Company’s credit rating could adversely affect our business and/or the holders of our securities.

The credit rating agency rating our indebtedness regularly evaluates the Company and the Bank. Credit ratings are based on a number of factors, including our financial strength and ability to
generate earnings, as well as factors not entirely within our control, including conditions affecting the financial services industry generally and the economy and changes in rating methodologies. There can be no assurance that the Company
will maintain our current credit ratings. A downgrade of the credit ratings of the Company or the Bank could adversely affect our access to liquidity and capital, significantly increase our cost of funds, and decrease the number of
investors and counterparties willing to lend to the Company or purchase our securities. This could affect our growth, profitability, and financial condition, including liquidity.

The Company relies on third parties to provide key components of its business infrastructure.

The Company relies on third parties to provide key components for its business operations, such as data processing and storage, recording and monitoring transactions, online banking interfaces
and services, internet connections and network access. While the Company selects these third party vendors carefully, it does not control their actions. Any problems caused by these third parties, including those resulting from breakdowns
or other disruptions in communication services provided by a vendor, failure of a vendor to handle current or higher volumes, cyber-attacks and security breaches at a vendor, failure of a vendor to provide services for any reason or poor
performance of services by a vendor, could adversely affect the Company’s ability to deliver products and services to its customers and otherwise conduct its business. Financial or operational difficulties of a third party vendor could also
hurt the Company’s operations if those difficulties interfere with the vendor’s ability to serve the Company. Replacing these third party vendors also could create significant delays and expense that adversely affect the Company’s business
and performance.

There are substantial risks and uncertainties associated with the introduction or expansion of lines of business or new products and services within
existing lines of business.

From time to time, the Company may implement new lines of business or offer new products and services within existing lines of business. There are substantial risks and uncertainties
associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and/or new products and services, the Company may invest significant time and resources.
Initial timetables for the introduction and development of new lines of business and/or new products or services may not be achieved and price and profitability targets may not prove attainable. External factors, such as compliance with
regulations, competitive alternatives and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service. Furthermore, any new line of business and/or new product or service
could have a significant impact on the effectiveness of the Company’s system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business or new products or services could
have a material adverse effect on the Company’s business, results of operations and financial condition.

20

Table of Contents

Risks Related to Legal, Governmental and Regulatory Changes

We are subject to extensive government regulation and supervision, which may interfere with our ability to conduct our business and may negatively impact
our financial results.

We are subject to extensive federal and state regulation and supervision. Banking regulations are primarily intended to protect depositors’ funds, the DIF and the safety and soundness of the banking system as
a whole, not stockholders. These regulations affect the Company’s lending practices, capital structure, investment practices, dividend policy and growth, among other things. Congress and federal regulatory agencies continually review
banking laws, regulations and policies for possible changes. Furthermore, political and policy goals of elected officials may change over time, which could impact the rulemaking, supervision, examination and enforcement priorities of
federal banking agencies. Changes to statutes, regulations or regulatory policies, including changes in interpretation or implementation of statutes, regulations or policies, could affect the Company in substantial and unpredictable ways.
Such changes could subject the Company to additional costs, limit the types of financial services and products the Company may offer and/or limit the pricing the Company may charge on certain banking services, among other things. Compliance
personnel and resources may increase our costs of operations and adversely impact our earnings.

Failure to comply with laws, regulations or policies could result in sanctions by regulatory agencies, civil money penalties and/or reputation damage, which could have a material adverse
effect on our business, financial condition and results of operations. While the Company has policies and procedures designed to prevent any such violations, there can be no assurance that such violations will not occur. See the section
captioned “Supervision and Regulation” in Item 1. Business of this report for further information.

We are subject to heightened regulatory requirements because we exceed $10 billion in total consolidated assets.

As of December 31, 2025, we had total assets of approximately $16.00 billion. The Dodd-Frank Act, including the Durbin Amendment, and its implementing regulations impose enhanced supervisory
requirements on bank holding companies with more than $10 billion in total consolidated assets. For bank holding companies with more than $10 billion in total consolidated assets, such requirements include, among other things:

The Economic Growth, Regulatory Reform and Consumer Protection Act (“EGRRCPA”), which was enacted in 2018, amended the Dodd-Frank Act to raise the $10 billion stress testing threshold to $250
billion, among other things. The federal financial regulators issued final rules in 2019 to increase the threshold for these stress testing requirements from $10 billion to $250 billion, consistent with the EGRRCPA.

Our regulators will consider our compliance with these regulatory requirements that apply to us (in addition to regulatory requirements that applied to us previously) when examining our
operations or considering any request for regulatory approval. We may, therefore, incur associated compliance costs and may be required to maintain compliance procedures.

Failure to comply with these requirements may negatively impact the results of our operations and financial condition. To ensure compliance, we will be required to invest significant
resources, which may necessitate hiring additional personnel and implementing additional internal controls. These additional compliance costs may have a material adverse effect on our business, results of operations and financial condition.

21

Table of Contents

Our controls and procedures may fail or be circumvented, which may result in a material adverse effect on our business.

Management regularly reviews and updates our internal controls, disclosure controls and procedures and corporate governance policies and procedures. Any system of controls, however well
designed and operated, is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met. Any failure or circumvention of the controls and procedures or failure to
comply with regulations related to controls and procedures could have a material adverse effect on our business, results of operations and financial condition.

We may be held responsible for environmental liabilities with respect to properties to which we obtain title, resulting in significant financial loss.

A significant portion of our loan portfolio at December 31, 2025 was secured by real estate. In the course of our business, we may foreclose and take title to real estate and could be subject
to environmental liabilities with respect to these properties. We may be held liable to a government entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection
with environmental contamination or may be required to clean up hazardous or toxic substances, or chemical releases at a property. The costs associated with investigation and remediation activities could be substantial. In addition, if we
are the owner or former owner of a contaminated site, we may be subject to common law claims by third parties based on damages and costs resulting from environmental contamination emanating from the property. These costs and claims could
adversely affect our business, results of operations, financial condition and liquidity.

We may be adversely affected by the soundness of other financial institutions including the FHLB of New York.

Our ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services companies are
interrelated as a result of trading, clearing, counterparty or other relationships. We have exposure to many different industries and counterparties and we routinely execute transactions with counterparties in the financial services
industry, including brokers and dealers, commercial banks, investment banks, mutual and hedge funds and other institutional clients. As a result, defaults by, or even rumors or questions about, one or more financial services companies, or
the financial services industry generally, have led to market-wide liquidity problems and could lead to losses or defaults by us or by other institutions. Many of these transactions expose us to credit risk in the event of default of our
counterparty or client. In addition, our credit risk may be exacerbated if the collateral held by us cannot be realized or is liquidated at prices not sufficient to recover the full amount of the loan or derivative exposure due us. There is
no assurance that any such losses would not materially and adversely affect our business, financial condition or results of operations.

The Company owns common stock of FHLB of New York in order to qualify for membership in the FHLB system, which enables it to borrow funds under the FHLB of New York’s advance program. The
carrying value and fair value of our FHLB of New York common stock was $13.6 million as of December 31, 2025. There are 11 branches of the FHLB, including New York, which are jointly liable for the consolidated obligations of the FHLB
system. To the extent that one FHLB branch cannot meet its obligations to pay its share of the system’s debt, other FHLB branches can be called upon to make the payment. Any adverse effects on the FHLB of New York could adversely affect the
value of our investment in its common stock and negatively impact our results of operations.

22

Table of Contents

Provisions of our certificate of incorporation and bylaws, as well as Delaware law and certain banking laws, could delay or prevent a takeover of us by a
third party.

Provisions of the Company’s certificate of incorporation and bylaws, the corporate law of the State of Delaware and state and federal banking laws, including regulatory approval requirements,
could delay, defer or prevent a third party from acquiring the Company, despite the possible benefit to the Company’s stockholders, or otherwise adversely affect the market price of the Company’s common stock. These provisions include
supermajority voting requirements for certain business combinations and advance notice requirements for nominations for election to the Board and for proposing matters that stockholders may act on at stockholder meetings. In addition, the
Company is subject to Delaware law, which among other things prohibits the Company from engaging in a business combination with any interested stockholder for a period of three years from the date the person became an interested stockholder
unless certain conditions are met. These provisions may discourage potential takeover attempts, discourage bids for the Company’s common stock at a premium over market price or adversely affect the market price of and the voting and other
rights of the holders of the Company’s common stock. These provisions could also discourage proxy contests and make it more difficult for you and other stockholders to elect directors other than candidates nominated by the Board.

The Company has risk related to legal proceedings.

The Company is involved in judicial, regulatory, and arbitration proceedings concerning matters arising from our business activities and fiduciary responsibilities. The Company establishes
reserves for legal claims when payments associated with the claims become probable and the costs can be reasonably estimated. We may still incur legal costs for a matter even if a reserve is not established. In addition, the actual cost of
resolving a legal claim may be substantially higher than any amounts reserved for that matter. The ultimate resolution of a pending or future legal proceeding, depending on the remedy sought and granted, could materially adversely affect
our results of operations and financial condition.

Risks Related to Information Technology, Cybersecurity and Data Privacy

The Company faces operational risks and cybersecurity risks associated with incidents which have the potential to disrupt our operations, cause material
harm to our financial condition, result in misappropriation of assets, compromise confidential information and/or damage our business relationships and cannot guarantee that the steps we and our service providers take in response to these
risks will be effective.

We depend upon data processing, communication systems, and information exchange on a variety of platforms and networks and over the internet to conduct business operations. In addition, we rely on the
services of a variety of vendors to meet our data processing and communication needs. Although we require third party providers to maintain certain levels of security, such providers remain vulnerable to breaches, security incidents, system
unavailability or other malicious attacks that could compromise sensitive information. Further, new technologies such as AI may be more capable of evading safeguard measures. The risk of experiencing security incidents and disruptions,
particularly through cyber-attacks or cyber intrusions, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions by organized crime, hackers, terrorists, nation-states, activists and other
external parties has increased. These security incidents may result in disruption of our operations; material harm to our financial condition, cash flows and the market price of our common stock; misappropriation of assets; compromise or
corruption of confidential information; liability for information or assets stolen during the incident; remediation costs; increased cybersecurity and insurance costs; regulatory enforcement; litigation; and damage to our stakeholder and
customer relationships.

Moreover, in the normal course of business, we and our service providers collect and retain certain personal information provided by our customers, employees and vendors. If this information
gets mishandled, misused, improperly accessed, lost or stolen, we could suffer significant financial, business, reputational, regulatory or other harm. These risks may increase as we continue to increase and expand our usage of web-based
products and applications.

These risks require continuous and likely increasing attention and resources from us to, among other actions, identify and quantify potential cybersecurity risks, and upgrade and expand our
technologies, systems and processes to adequately address the risk. We provide on-going training for our employees to assist them in detecting phishing, malware and other malicious schemes. Such attention diverts time and resources from
other activities and, while we have implemented policies and procedures designed to maintain the security and integrity of the information we and our service providers collect on our and their computer systems, there can be no assurance
that our efforts will be effective. Likewise, while we have implemented security measures to prevent unauthorized access to personal information and prevent or limit the effect of possible incidents, we can provide no assurance that a
security breach or disruption will not be successful or damaging, or, if any such breach or disruption does occur, that it can be sufficiently or timely remediated.

Even the most well protected information, networks, systems and facilities remain potentially vulnerable because the techniques used in such attempted security breaches evolve and generally
are not recognized until launched against a target, and in some cases are designed not to be detected and, in fact, may not be detected. Accordingly, we may be unable to anticipate these techniques or to implement adequate security barriers
or other preventative measures, and thus it is impossible for us to entirely mitigate this risk.

23

Table of Contents

The Company may be adversely affected by fraud.

As a financial institution, the Company is inherently exposed to operational risk in the form of theft and other fraudulent activity by employees, customers and other third parties targeting
the Company and/or the Company’s customers or data. Such activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering and other dishonest acts. Although the Company devotes substantial
resources to maintaining effective policies and internal controls to identify and prevent such incidents, given the increasing sophistication of possible perpetrators, the Company may experience financial losses or reputational harm as a
result of fraud.

We continually encounter technological change and the failure to understand and adapt to these changes could have a material adverse impact on our
business.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services (including those related to or
involving AI, machine learning, blockchain and other technologies). The effective use of technology increases efficiency and enables financial institutions to serve customers better and to reduce costs. The Company’s future success depends,
in part, upon its ability to address the needs of its customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in the Company’s operations. Many of the
Company’s competitors have substantially greater resources to invest in technological improvements. The Company may not be able to effectively implement new technology-driven products and services or be successful in marketing these
products and services to its customers. Failure to successfully keep pace with technological changes affecting the financial services industry could have a material adverse impact on the Company’s business and, in turn, the Company’s
financial condition and results of operations.

The development and use of AI exposes us to risks that may adversely impact our business.

We or our third-party providers may develop or incorporate AI technology in certain business processes, services, or products. The development and use of AI poses a number of risks and challenges to our
business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, and we may be subject to increasing regulations related to our use of these technologies, including regulations related to privacy, data
security, and intellectual property rights, which could expose us to legal risks. AI models, particularly generative AI models, may produce incorrect, biased, or misleading results, expose confidential information, or infringe on
intellectual property rights. Further, we may rely on AI models developed by third parties, and, to that extent, would be subject to additional risks, including limited oversight of how these models are developed and trained and potential
exposure to unauthorized data usage. If our AI models, or those developed by third parties, produce inaccurate or controversial results, we could face legal liability, regulatory scrutiny, reputational harm, or operational inefficiencies.
These risks could negatively impact our business, financial results, and the perception of our security measures. The Company’s use of AI currently varies across platforms, with certain third party systems incorporating AI capabilities into
routine business operations. As our adoption and internal development of AI enabled tools continues to evolve, we evaluate these technologies through our established Solutions Development Lifecycle (SDLC), which includes model validation
and other risk management controls.

Risks Related to an Investment in the Company’s Securities

There may be future sales or other dilution of the Company’s equity, which may adversely affect the market price of the Company’s stock.

The Company is not restricted from issuing additional common stock, including any securities that are convertible into or exchangeable for, or that represent the right to receive, common
stock. The Company also grants shares of common stock to employees and directors under the Company’s incentive plan each year. The issuance of any additional shares of the Company’s common stock or preferred stock or securities convertible
into, exchangeable for or that represent the right to receive common stock or the exercise of such securities could be substantially dilutive to stockholders of the Company’s common stock. Holders of the Company’s common stock have no
preemptive rights that entitle such holders to purchase their pro rata share of any offering of shares of any class or series. Because the Company’s decision to issue securities in any future offering will depend on market conditions, its
acquisition activity and other factors, the Company cannot predict or estimate the amount, timing or nature of its future offerings. Thus, the Company’s stockholders bear the risk of the Company’s future offerings reducing the market price
of the Company’s common stock and diluting their stock holdings in the Company.

24

Table of Contents

General Risks

The risks presented by acquisitions could adversely affect our financial condition and results of operations.

The business strategy of the Company has included and may continue to include growth through acquisition. Any acquisitions will be accompanied by the risks commonly encountered in
acquisitions. These risks may include, among other things:

We cannot provide any assurance that we will be successful in overcoming these risks or any other problems encountered in connection with acquisitions. Our inability to overcome these risks
could have an adverse effect on the achievement of our business strategy and results of operations.

We rely on our management and other key personnel, and the loss of any of them may adversely affect our operations.

We are and will continue to be dependent upon the services of our executive management team. In addition, we will continue to depend on our ability to retain and recruit key client
relationship managers. The unexpected loss of services of any key management personnel, or the inability to recruit and retain qualified personnel in the future, could have an adverse effect on our business and financial condition.