TRUSTCO BANK CORP N Y (TRST) Business

Item 1. Business

General

TrustCo Bank Corp NY (“TrustCo” or the “Company”) is a savings and loan
holding company having its principal place of business at 5 Sarnowski Drive, Glenville, New York 12302. TrustCo was incorporated under the laws of New York in 1981 to be the parent holding company of The Schenectady Trust Company, which
subsequently was renamed Trustco Bank New York and, later, Trustco Bank, National Association. The Company’s principal subsidiary, Trustco Bank (also referred to as the “Bank”), is the successor by merger to Trustco Bank, National Association.

As of December 31, 2025, TrustCo had $6.4 billion in total assets and $5.6 billion in deposits. Furthermore, TrustCo had 6,582 shareholders of record as of December 31, 2025 and the closing price of the
TrustCo common stock on December 31 (the last trading day of 2025) was $41.33.

Subsidiaries

Trustco Bank

Trustco Bank is a federal savings bank engaged in providing general banking services to individuals and businesses.

The Bank provides a wide range of both personal and business banking services, including a full array of deposit products for both individuals and businesses.  Trustco Bank also offers trust
and investment services through its Financial Services Department.  The Bank is supervised and regulated by the federal Office of the Comptroller of the Currency (“OCC”).

Its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) to the extent permitted by law. The Bank’s
subsidiary, Trustco Realty Corp., is a real estate investment trust (or “REIT”) that was formed to acquire, hold and manage real estate mortgage assets,
including residential mortgage loans and mortgage backed securities. The income earned on these assets, net of expenses, is distributed in the form of dividends.  Under current New York State tax law, 60% of the dividends received by the Bank
from Trustco Realty Corp. are excluded from total taxable income for New York State income tax purposes. The Bank accounted for substantially all of TrustCo’s 2025 consolidated net income and average
assets.  The Bank’s other active subsidiaries, Trustco Insurance Agency, Inc. and ORE Property, Inc., did not engage in any significant business activities during 2025 and 2024.

Trustco Financial Services, the name under which Trustco Bank’s trust department operates, serves as executor of estates and trustee of personal
trusts, provides asset and wealth management services, provides estate planning and related advice, provides custodial services, and acts as trustee for various types of employee benefit plans and corporate pension and profit sharing trusts.
The aggregate market value of the assets under trust, custody, or management of the trust department of the Bank was approximately $1.27 billion as of December 31, 2025.

5

Index

The daily operations of the Bank remain the responsibility of its officers, subject to the oversight of its Board of Directors and overall supervision by TrustCo. The activities of the Bank
are included in TrustCo’s consolidated financial statements.

ORE Subsidiary Corp.

In 1993, TrustCo created ORE Subsidiary Corp., a New York corporation, to hold and manage certain foreclosed properties acquired by the Bank. The accounts of this subsidiary are included in
TrustCo’s consolidated financial statements.

Our Market Area

At year-end 2025, the Bank operated 154 automatic teller machines and 134 banking offices in Albany, Columbia, Dutchess, Greene, Montgomery, Orange, Putnam, Rensselaer, Rockland, Saratoga,
Schenectady, Schoharie, Ulster, Warren, Washington, and Westchester counties of New York; Brevard, Charlotte, Flagler, Hillsborough, Indian River, Lake, Manatee, Martin, Orange, Osceola, Palm Beach, Polk, Sarasota, Seminole, and Volusia
counties in Florida; Bennington County in Vermont; Berkshire County in Massachusetts; and Bergen County in New Jersey.  The largest part of such business consists of accepting deposits and making loans and investments.  Trustco Bank also lends
in Fulton county of New York, and Collier, Lee, Marion, Pasco, Pinellas, St. Johns, and St. Lucie counties of Florida, where it has no branch locations.  The Bank’s locations are selected to be easily accessible and provide convenient services
to businesses and individuals throughout our market area.

Our market area has a high level of retail and commercial business activity. Businesses are concentrated in the service sector and retail trade areas. Major employers in our market area include certain medical centers, municipalities, and
school districts.

Competition

TrustCo faces strong competition in its market areas, both in attracting deposits and making loans. The Company’s most direct competition for deposits, historically, has come from commercial banks,
savings associations, and credit unions that are located or have branches in the Bank’s market areas. The competition ranges from other locally based commercial banks, savings banks, and credit unions
to branch offices of the largest financial institutions in the United States. In its principal market areas, the Capital District area of New York State and central Florida, TrustCo’s principal
competitors are local branch operations of super-regional banks, branch offices of money center banks, and locally based commercial banks and savings institutions. The Bank is the largest for profit depository institution headquartered in the
Capital District area of New York State. The Company also faces competition for deposits from national brokerage houses, short-term money market funds, and other corporate and government securities mutual funds.

Factors affecting the acquisition of deposits include pricing, office locations and hours of operation, the variety of deposit accounts offered, and the quality of customer service provided. Competition for loans has increased as interest
rates have remained elevated and housing inventory has tightened in many of the Bank’s market areas. Commercial banks, savings institutions, traditional mortgage brokers affiliated with local offices, and nationally franchised real estate
brokers are all active and aggressive competitors. The Company competes in this environment by providing a full range of financial services based on a tradition of financial strength and integrity dating from its inception. The Company also
expects competition to increase in the future as a result of legislative, regulatory and technological changes and the continuing trend of consolidation in the financial services industry. Technological advances, for example, have lowered
barriers to entry, allowed banks and other financial services companies to expand their geographic reach by providing services over the internet, and made it possible for non-depository institutions to offer products and services that
traditionally have been provided by banks. The Company competes for loans principally through the interest rates and loan fees it charges and the efficiency and quality of services it provides to borrowers.  Furthermore, management believes
that a community-based financial organization is better positioned to establish personalized financial relationships with both commercial customers and individual households. The Company’s community commitment and involvement in its primary
market areas, as well as its commitment to quality and personalized financial services, are factors that contribute to the Company’s competitiveness.

6

Index

Lending Activities

One of our core goals is to support the communities in which we operate. We seek loans from within our primary market area, which generally is defined as the counties in which our banking offices are located. Approval of all loans is subject
to our policies and standards described in more detail below.  We have adopted comprehensive lending policies, underwriting standards and loan review procedures. Management and our Board of Directors reviews and approves these policies and
procedures on a regular basis.  Management has also implemented reporting systems designed to monitor loan originations, loan quality, concentrations of credit, loan delinquencies, nonperforming loans, and potential problem loans. Our
management and various committees periodically review our lines of business to monitor asset quality trends and the appropriateness of credit policies. In addition, we establish total borrower exposure limits and monitor concentration risk. As
part of this process, the overall composition of the portfolio is reviewed to gauge diversification of risk, client concentrations, industry group, loan type, geographic area, or other relevant classifications of loans. Specific segments of the
portfolio are monitored and reported to our Board on a quarterly basis. We recognize that exceptions to the below-listed policy guidelines may occur and have established procedures for approving exceptions to these policy guidelines.

Residential Real Estate Loans

We originate 1-4 family, owner-occupied residential real estate loans. Historically, the vast majority of our residential loan originations are fixed-rate loans which are held in portfolio. Residential real estate loans also include home
equity lines of credit, or HELOCs, and home equity loans. Our home equity portfolio includes revolving open-ended equity loans with interest-only or minimal monthly principal payments and closed-end amortizing loans. Open-ended equity loans
typically have an interest-only draw period followed by a repayment period.

Commercial Loans

Commercial loans are primarily made based on identified cash flows of the borrower with consideration given to underlying collateral and personal or other guarantees. Our policy sets forth guidelines for debt service coverage ratios,
loan-to-value (“LTV”) ratios and documentation standards. Specifically, we have established debt service coverage ratio limits that require a borrower’s cash flow to be sufficient to cover principal and interest payments on all new and existing
debt. The majority of our commercial loans are secured by the assets being financed or other business assets such as accounts receivable or inventory.

Commercial Real Estate Loans

Commercial real estate loans are primarily made based on identified cash flows of the borrower with consideration given to underlying real estate collateral and personal guarantees. We have adopted guidelines for debt service coverage
ratios, LTV ratios and documentation standards for commercial real estate loans. Specifically, our policy establishes a maximum LTV specific to property type and minimum debt service coverage ratio limits that require a borrower’s cash flow to
be sufficient to cover principal and interest payments on all new and existing debt. Commercial real estate loans may be fixed or variable-rate loans with interest rates tied to indexes. Generally, we require appraisals for loans that are
secured by real property.

Consumer Loans

Our consumer loan portfolio includes personal installment loans, automobile financing, and overdraft lines of credit. The majority of our consumer loans are short-term and have fixed rates of interest that are priced based on current market
interest rates and the financial strength of the borrower.

Investment Activities

The goals of our investment policy are to provide and maintain liquidity to meet deposit withdrawal and loan funding needs, to help mitigate interest rate and market risk, to diversify our assets, and to generate a reasonable rate of
return on funds within the context of our interest rate and credit risk objectives. The Board reviews and approves our investment policy annually. Authority to make investments under the approved investment policy guidelines is delegated to
our selected senior management. Investment activity is summarized and reported to the Board. We classify the majority of our securities as available-for-sale. The breakdown of investment portfolio is described in detail in the Annual Report
to Shareholders for the year ended December 31, 2025 (“2025 Annual Report to Shareholders”).

7

Index

Sources of Funds

General.  Deposits, borrowings and loan repayments are the major sources of our funds for lending and other investment purposes. Scheduled loan repayments are a relatively stable
source of funds, while deposit inflows and outflows and loan prepayments are significantly influenced by general interest rates and money market conditions.

Deposit Accounts.  Deposits are attracted from within our market area by the sales efforts of our branch network, commercial loan officers, advertising and through our website. We
offer a broad selection of deposit instruments, including noninterest-bearing demand deposits (such as checking accounts), interest-bearing demand accounts (such as NOW and money market accounts), savings accounts and term certificates of
deposit. We also offer a variety of deposit accounts designed for businesses operating in our market area. Our business banking deposit products include a commercial checking account, sweep accounts, money market accounts and checking accounts
specifically designed for businesses. We also offer remote deposit capture products for customers to meet their online banking needs.

Deposit account terms vary according to the minimum balance required, the time periods the funds must remain on deposit, and the interest rate, among other factors. In determining the terms of our deposit accounts, we consider the rates
offered by our competition, our liquidity needs, profitability to us, and customer preferences and concerns. We generally review our deposit mix and pricing on a weekly basis. Our deposit pricing strategy has generally been to offer competitive
rates and to periodically offer special rates in order to attract deposits of a specific type or term.

Supervision and Regulation

Banking is a highly regulated industry, with numerous federal and state laws and regulations governing the organization and operation of banks and their affiliates. As a savings and loan
holding company, TrustCo and its non-bank subsidiaries are supervised and regulated by the Board of Governors of the Federal Reserve System (“Federal Reserve Board” or
the “FRB”). The OCC is the Bank’s primary federal regulator and supervises and examines the Bank. Under the Home Owners’ Loan Act of 1934 and OCC
regulations, Trustco Bank must obtain prior OCC approval for acquisitions, and its business operations and activities are restricted. Because the FDIC provides deposit insurance to the Bank, the Bank also is subject to its supervision and
regulation even though the FDIC is not the Bank’s primary federal regulator.

The following summary of laws and regulations applicable to the Company and those applicable to the Bank is not intended to be a complete description of those laws and regulations or their
effects on the Company and the Bank. The summary is qualified in its entirety by reference to the particular statutory and regulatory provisions described.  Changes in applicable law or regulation, and in
their interpretation and application by regulatory agencies and other governmental authorities, cannot be predicted, but may have a material effect on our business, financial condition or results of operations.

Dividends

Most of TrustCo’s revenues consist of cash dividends paid to TrustCo by the Bank, payment of which is subject to various regulatory limitations,
including continued compliance with minimum regulatory capital requirements, and the receipt of regulatory approval (or non-objection) from the Bank’s and the Company’s
regulators.

OCC regulations impose limitations upon all capital distributions by the Bank, including cash dividends. Under the regulations, an application to and the approval of the OCC is required prior
to any capital distribution if the institution does not meet the criteria for “expedited treatment” of applications under OCC regulations (generally,
examination ratings in the two top categories), the total capital distributions for the calendar year exceed net income for that year plus the amount of retained net income for the preceding two years, the institution would be undercapitalized
following the distribution, or the distribution would otherwise be contrary to a statute, regulation, or agreement with the OCC. If an application is not required, the institution must still provide prior notice of the capital distribution to
the OCC and the Federal Reserve Board if, like the Bank, the institution is a subsidiary of a savings and loan holding company. The OCC may not approve a dividend if the institution would be undercapitalized following the distribution, the
proposed capital distribution raises safety and soundness concerns, or the capital distribution would violate a prohibition contained in any statute, regulation, or agreement between the bank and a regulator or a condition imposed in a
previously approved application or notice.

8

Index

As noted above, a savings institution, such as the Bank, that is a subsidiary of a savings and loan holding company and that proposes to make a capital distribution must also submit written
notice to the Federal Reserve Board prior to such distribution, and Federal Reserve Board may object to the distribution based on safety and soundness or other concerns. The Federal Reserve Board may deny a dividend notice if following the
dividend, the savings  association will be less than adequately capitalized, the proposed dividend raises safety and soundness concerns, or the proposed dividend violates a prohibition contained in any statute, regulation, enforcement action,
or agreement between the association or holding company and an appropriate federal banking agency, a condition imposed on the association or holding company in an application or notice approved by an appropriate federal banking agency, or any
formal or informal enforcement action involving the association or holding company.

Compliance with regulatory standards regarding capital distributions could also limit the amount of dividends that TrustCo may pay to its shareholders.

See Note 14 to the consolidated financial statements contained in TrustCo’s 2025 Annual Report to Shareholders for information concerning the Bank’s regulatory capital requirements.

Regulatory Capital Requirements and Prompt Corrective Action.

Regulatory Capital Rules. The Company and the Bank are subject to regulatory capital requirements contained in rules published by the Federal
Reserve Board, OCC, and FDIC that establish a comprehensive capital framework for all U.S. banking organizations, including the Company and the Bank.

The capital rules, among other things, provide a “Common Equity Tier 1” (“CET1”) capital measure, Tier 1 capital and total capital to risk-weighted assets ratios and a Tier 1 capital to average consolidated assets (or “leverage”) ratio. CET1 capital is generally defined as common
stock instruments that meet eligibility criteria in the final capital rule (principally, instruments representing the most subordinated claim upon liquidation, having no maturity date and being redeemable via discretionary purchases only with
regulatory approval, not being subject to any expectations that the stock will be repurchased, redeemed, or cancelled, and not being secured by the banking organization or any related entity), retained earnings, accumulated other comprehensive
income, and common equity Tier 1 minority interests, subject to certain limitations. Tier 1 capital for the Company and the Bank consists of CET1 capital plus “additional Tier 1 capital,” which generally includes certain noncumulative perpetual preferred stock and related surplus and minority interests in equity accounts of consolidated subsidiaries. Total capital includes Tier 1 capital
and Tier 2 capital. Tier 2 capital is comprised of capital instruments and related surplus meeting specified requirements, and may include cumulative preferred stock and long-term perpetual preferred stock, mandatory convertible securities,
intermediate preferred stock, and subordinated debt. Also included in Tier 2 capital is the allowance for loan and lease losses limited to a maximum of 1.25% of risk-weighted assets and, for institutions that have exercised an opt-out election
regarding the treatment of accumulated other comprehensive income (“AOCI”), up to 45% of net unrealized gains on available-for-sale equity securities with
readily determinable fair market values. Institutions that have not exercised the AOCI opt-out have AOCI incorporated into common equity Tier 1 capital (including unrealized gains and losses on available-for-sale-securities). The Company has
made this opt-out election. Calculation of all types of regulatory capital is subject to deductions and adjustments specified in the regulations.

Under the capital rules, the minimum capital ratios are:

9

Index

At December 31, 2025, the Bank had a Tier 1 leverage ratio (Tier 1 capital to total average consolidated assets) of 8.06%, CET1 capital ratio (CET1 capital to risk-weighted assets) of a 13.98%, Tier 1 capital ratio (Tier 1 capital to
risk-weighted assets) of 13.98%, and a total capital ratio (total capital to risk-weighted assets) of 15.23%.  Also at December 31, 2025, the Company had a Tier 1 leverage ratio (Tier 1 capital to total average consolidated assets) of 10.62%,
CET1 capital ratio (CET1 capital to risk-weighted assets) of 18.54%, a Tier 1 capital ratio (Tier 1 capital to risk-weighted assets) of 18.540% and a total capital ratio (total capital to risk-weighted assets) of 19.80%.

In order to avoid constraints on dividends, equity repurchases and certain compensation, the capital rules require the Company’s and the Bank’s capital to exceed the regulatory standards plus a capital conservation buffer. To meet the requirement, the organization must maintain an amount of CET1 capital that exceeds the buffer level of 2.5%
above each of the minimum risk-weighted asset ratios, (i) CET1 to risk-weighted assets of more than 7.0%, (ii) Tier 1 capital to risk-weighted assets of more than 8.5%, and (iii) total capital (Tier 1 plus Tier 2) to risk-weighted assets of
more than 10.5%.

The OCC has the ability to establish an individual minimum capital requirement for a particular institution, which would vary from the capital levels that would otherwise be required under the capital
regulations, based on such factors as concentrations of credit risk, levels of interest rate risk, and the risks of non-traditional activities, as well as others. The OCC has not imposed any such requirement on the Bank.

The capital rules contain standards for the calculation of risk-weighted assets.  The exposure amount for on-balance sheet assets is generally the carrying value of the exposure as determined
under GAAP.  A bank may assign a 50% risk weight to a first-lien residential mortgage exposure that:

Other first-lien residential exposures, as well as junior-lien exposures if the bank does not hold the first lien, are assigned a 100% risk weight.

If a banking organization has elected to opt out of the AOCI provisions discussed above, the exposure amount for available for sale or held-to-maturity debt securities is the carrying value
(including accrued but unpaid interest and fees) of the exposure, less any net unrealized gains plus any unrealized losses. Exposures to debt directly and unconditionally guaranteed by the U.S. federal government and its agencies receive a 0%
risk weight. Exposures conditionally guaranteed by the federal government, Federal Reserve Board, or a federal government agency would receive a 20% risk weight. Further, the capital rules assign a 20% risk weight to non-equity exposures to
government-sponsored entities (“GSEs”) and a 100% risk weight to preferred stock issued by a GSE. A GSE is defined as an entity established or chartered by the
federal government to serve public purposes but whose debt obligations are not “explicitly guaranteed” by the full faith and credit of the federal government.
Banking organizations must assign a 20% risk weight to general obligations of a public sector entity (for example, a state, local authority or other governmental subdivision below the sovereign level) that is organized under U.S. law and a 50%
risk weight for a revenue obligation of such an entity.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms, referred to as “Basel III
Endgame” or “Basel IV”. Among other things, these standards revise the Basel Committee’s standardized approach for credit risk (including recalibrating risk weights and introducing new capital requirements for certain “unconditionally
cancellable commitments,” such as unused credit card and home equity lines of credit) and provide a new standardized approach for operational risk capital. Although the Basel III Endgame framework contemplated implementation beginning January
1, 2023, with an aggregate output floor phasing in through January 1, 2028, implementation is jurisdiction-specific. In July 2023, the U.S. federal banking agencies proposed to revise the capital requirements, and the proposed rule contemplated
a transition period beginning July 1, 2025 and full compliance beginning July 1, 2028; however, the rule has not yet been finalized as of the date of this filing. The proposed rule is primarily applicable to large institutions exceeding
specified asset and foreign-exposure thresholds, and it consequently is not expected to apply to institutions of the Company’s size. The Company continues to monitor the rulemaking process.

10

Index

Prompt Corrective Action. Federal banking regulations also establish a “prompt corrective action” capital framework for the classification of insured depository institutions, such as Trustco Bank, into five categories: well capitalized, adequately capitalized, undercapitalized, significantly
undercapitalized, and critically undercapitalized. Under the prompt corrective action rules currently in effect, an institution is deemed to be (a) ”well-capitalized”
if it has total risk-based capital of 10.0% or more, has a Tier 1 risk-based capital ratio of 8.0% or more, has a CET1 risk based capital ratio of 6.5% or more, and has leverage capital ratio of 5.0% or more and is not subject to any order or
final capital directive to meet and maintain a specific capital level for any capital measure; (b) ”adequately capitalized” if it has a total risk-based
capital ratio of 8.0% or more, a Tier 1 risk-based capital ratio of 6.0% or more, a CET1 risk based capital ratio of 4.5% or more and has a leverage capital ratio of 4.0% or more (3.0% under certain circumstances) and does not meet the
definition of well-capitalized; (c) ”undercapitalized” if it has a total risk-based capital ratio that is less than 8.0%, a Tier 1 risk-based capital ratio
that is less than 6.0%, a CET1 capital ratio less than 4.5% or a Tier 1 leverage capital ratio that is less than 4.0%; (d) ”significantly undercapitalized” if
it has a total risk-based capital ratio that is less than 6.0%, a Tier 1 risk-based capital ratio that is less than 4.0%, a CET1 capital ratio less than 3% or a Tier 1 leverage capital ratio that is less than 3.0%; and (e) ”critically undercapitalized” if it has a ratio of tangible equity to total assets that is equal to or less than 2.0%. The federal banking agencies are required to take certain
supervisory actions (and may take additional discretionary actions) with respect to an undercapitalized institution or its holding company. Such actions could have a direct material effect on an institution’s
or its holding company’s financial condition and activities. In certain situations, a federal banking agency may reclassify a well-capitalized institution as adequately capitalized and may require an
adequately capitalized or undercapitalized institution to comply with supervisory actions as if the institution were in the next lower category.

A depository institution is generally prohibited from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the
depository institution would thereafter be undercapitalized. Undercapitalized institutions also are subject to growth limitations and are required to submit a capital restoration plan to the regulatory agencies. The agencies may not accept such
a plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the depository institution’s capital. In addition, for a capital
restoration plan to be acceptable, the depository institution’s parent holding company must guarantee that the institution will comply with such capital restoration plan. The aggregate liability of the
parent holding company is limited to the lesser of (i) an amount equal to 5.0% of the depository institution’s total assets at the time it became undercapitalized and (ii) the amount which is necessary
(or would have been necessary) to bring the institution into compliance with all capital standards applicable with respect to such institution as of the time it fails to comply with the plan. If a depository institution fails to submit an
acceptable plan, it is treated as if it is “significantly undercapitalized.”

“Significantly undercapitalized” depository institutions may be subject to a number of requirements and
restrictions, including orders to sell sufficient voting stock to become “adequately capitalized,” requirements to reduce total assets, and cessation of
receipt of deposits from correspondent banks. “Critically undercapitalized” institutions are subject to the appointment of a receiver or conservator.

At December 31, 2025 and 2024, each of TrustCo and Trustco Bank met all capital adequacy requirements to which it was subject under the OCC and Federal Reserve Board regulations.  As of
December 31, 2025, the bank meets the requirements of a well-capitalized depository institution under the OCC’s framework for prompt corrective action.

Regulation Relating to Community Banks. During 2025, the OCC announced a number of initiatives intended to tailor regulatory and supervisory expectations for community banks, including
the release of a notice of proposed rulemaking to expand the definition of community banks to include institutions with less than $30 billion in total assets. These initiatives are focused on reducing the regulatory burden on smaller, lower
risk national banks and include refinements to examination processes, supervisory practices, and certain data collection requirements. The OCC has indicated that these changes are designed to improve examination efficiency, enhance supervisory
clarity, and focus regulatory attention on areas of heightened or material risk. While these initiatives may reduce certain compliance and operational burdens, TrustCo remains subject to comprehensive prudential regulation and supervisory
oversight, and changes in regulatory priorities or expectations could continue to affect TrustCo’s operations, compliance costs, and strategic planning.

11

Index

Economic Growth, Regulatory Relief and Consumer Protection Act. In May 2018, the Economic Growth, Regulatory Relief and Consumer Protection Act (the “Regulatory Relief Act”), was enacted to modify or remove
certain financial reform rules and regulations.  The Regulatory Relief Act amends certain aspects of the regulatory framework for small depository institutions with assets of less than $10 billion and for large banks with assets of more than
$50 billion. Many of these changes resulted in meaningful regulatory changes for community banks such as the Bank, and their holding companies.

The Regulatory Relief Act also expanded the definition of qualified mortgages that may be held by a financial institution and simplified the regulatory capital rules for financial institutions and their holding
companies with total consolidated assets of less than $10 billion by instructing the federal banking regulators to establish a single “Community Bank Leverage Ratio” (“CBLR”) of 9%. In November 2025, the federal banking agencies published a
rule proposal which would reduce the 9% requirement for the framework to 8%. Furthermore, the federal banking agencies proposed to extend the grace period for a bank that elects to use the CBLR framework but temporarily fails to meet all of the
qualifying criteria, including the leverage ratio requirement, to provide that (i) the bank will have four quarters to return to compliance, provided the community bank maintains a leverage ratio greater than 7 percent and (ii) if the bank that
has a leverage ratio equal to or less than the grace period minimum of 7 percent, it would be required to comply with the generally applicable risk-based capital standards.

Any qualifying depository institution or its holding company that exceeds the CBLR will be considered to have met generally applicable leverage and risk-based regulatory capital requirements and any qualifying
depository institution that exceeds the ratio will be considered to be “well capitalized” under the prompt corrective action rules. In addition, the Regulatory Relief Act included regulatory relief for community banks regarding regulatory
examination cycles, call reports, the Volcker Rule (proprietary trading prohibitions), mortgage disclosures and risk weights for certain high-risk commercial real estate loans. Many of the Regulatory Relief Act’s changes are implemented through
rules promulgated by the federal banking agencies. These rules and their enforcement are subject to the substantial regulatory discretion of the federal banking agencies. Although TrustCo would qualify to take advantage of the community bank
leverage ratio framework, it has decided that it would not opt-in to the framework.

Holding Company Activities

The activities of savings and loan holding companies are governed, and limited, by the Home Owners’ Loan Act and the Federal Reserve Board’s regulations. In general, TrustCo’s activities are limited to those permissible for “multiple” savings and loan holding companies (that is, savings and loan holding companies owning more than one savings association subsidiary) as of March 5, 1987, activities permitted for bank holding companies as of November 12,
1999, and activities permissible for “financial holding companies” (which are described below). Activities permitted to multiple savings and loan holding
companies include certain real estate investment activities, and other activities permitted to bank holding companies under the Bank Holding Company Act. Activities permissible for a financial holding company are those considered financial in
nature (including securities and insurance activities) or those incidental or complementary to financial activities.

A savings and loan holding company is prohibited from, directly or indirectly, acquiring more than 5% of the voting stock of another financial institution or savings and loan holding company
without the prior written approval of the Federal Reserve Board. In evaluating applications by holding companies to acquire savings institutions, the Federal Reserve Board considers the financial and managerial resources and future prospects of
the company and institution involved, the effect of the acquisition on the risk to the deposit insurance fund, the convenience and needs of the community and competitive factors.

The financial impact of a holding company on its subsidiary institution is a matter that is evaluated by the Federal Reserve Board, and the Federal Reserve Board has authority to order
cessation of activities or divestiture of subsidiaries deemed to pose a threat to the safety and soundness of the institution. The Federal Reserve’s long-standing “source

of strength” doctrine requires that bank or thrift holding companies serve as a source of financial strength for their depository institution subsidiaries. The phrase “source

of financial strength” is defined as “the ability of a company that directly or indirectly owns or controls an insured depository institution to provide
financial assistance to such insured depository institution in the event of the financial distress of the insured depository institution.” The federal banking agencies are authorized to adopt
regulations with respect to this requirement.

12

Index

Securities Regulation and Corporate Governance

The Company’s common stock is registered with the SEC under Section 12(b) of the Exchange Act, and the Company is subject to restrictions, reporting
requirements and review procedures under federal securities laws and regulations. The Company is also subject to the rules and reporting requirements of the Nasdaq Global Select Market, on which its common stock is traded.

The Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) significantly changed the regulation of financial institutions, such as
community banks, thrifts, and small bank and thrift holding companies, and the financial services industry. Among other things, the Dodd-Frank Act abolished the Office of Thrift Supervision and transferred its functions to the other federal
banking agencies, relaxed rules regarding interstate branching, allowed financial institutions to pay interest on business checking accounts, and imposed new capital requirements on bank and thrift holding companies. The
Sarbanes-Oxley Act of 2002 is intended to improve corporate responsibility, to provide for enhanced penalties for accounting and auditing improprieties at publicly traded companies and to protect investors by improving the accuracy and
reliability of corporate disclosures pursuant to the securities laws. The Company has policies, procedures and systems designed to comply with these regulations, and it reviews and documents such policies, procedures and systems to ensure
continued compliance with these regulations.

Although the Company has incurred, and expects to continue to incur, additional expense in complying with the corporate governance provisions of federal law and the resulting regulations, management does not expect
such compliance to have a material impact on the Company’s financial condition or results of operations.

Federal Savings Institution Regulation

Business Activities. Federal law and regulations govern the activities of federal savings banks such as the Bank. These laws and regulations
delineate the nature and extent of the activities in which federal savings banks may engage. In particular, certain lending authority for federal savings banks, e.g., commercial,
non-residential real property loans and consumer loans, is limited to a specified percentage of the institution’s capital or assets.

Insurance of Deposit Accounts. Deposits of Trustco Bank are insured by the Deposit Insurance Fund (“DIF”) of the FDIC, and the Bank is subject to deposit insurance assessments to maintain the DIF. The FDIC determines insurance premiums based on a number of factors, primarily the risk of loss that insured
institutions pose to the DIF. Deposit insurance assessments are based on average consolidated total assets minus average tangible equity. Under the FDIC’s risk-based assessment system, insured
institutions with less than $10 billion in assets, such as the Bank, are assigned to one of three categories based on their composite examination ratings, with higher-rated, less risky institutions paying lower assessments. A range of initial
base assessment rates applies to each category, adjusted downward based on unsecured debt issued by the institution to produce total base assessment rates. Total base assessment rates currently range from 2.5 to 18 basis points for banks in the
least risky category to 13 to 32 basis points for banks in the most risky category, all subject to further adjustment upward if the institution holds more than a limited amount of unsecured debt issued by another FDIC-insured institution.

The FDIC has the authority to raise or lower assessment rates, subject to limits, and to impose special additional assessments. The Dodd-Frank Act set the minimum reserve ratio to not less than 1.35% of estimated insured deposits or the
comparable percentage of the FDIC’s assessment base. The act also required the FDIC to take the steps necessary to attain the 1.35 percent ratio by September 30, 2020, subject to an offsetting
requirement for certain institutions. In September 2020, the FDIC announced that the ratio declined to 1.30% due largely

to consequences of the COVID-19 pandemic and adopted a plan to restore the fund to the 1.35% ratio (the “Restoration Plan”) within eight years but did not change its assessment rate schedule.  The Restoration Plan requires the FDIC to update
its analysis and projections for the fund balance and reserve ratio at least semiannually and, if necessary, recommend any modifications, such as increasing assessment rates. In the semiannual update for the Restoration Plan in June 2022, the
FDIC projected that the reserve ratio was at risk of not reaching the statutory minimum of 1.35 percent by September 30, 2028, the statutory deadline to restore the reserve ratio. Based on this update, the FDIC Board approved an amended
Restoration Plan, and concurrently proposed an increase in initial base deposit insurance assessment rate schedules uniformly by 2 basis points, applicable to all insured depository institutions. In October 2022, the FDIC Board finalized the
increase with an effective date of January 1, 2023, applicable to the first quarterly assessment period of 2023 (i.e., January 1 through March 31, 2023).  The FDIC continues to publish periodic updates
regarding the DIF balance and reserve ratio, which were $153.9 billion and 1.42%, respectively, as of December 31, 2025, and it may consider additional actions to support the DIF and meet applicable statutory requirements.

13

Index

Various proposals are under active consideration by policymakers that could affect the scope of deposit insurance coverage. For example, bipartisan legislation has been introduced in the U.S. Senate that would significantly raise the deposit
insurance limit for certain noninterest-bearing transaction accounts, subject to legislative approval and funding determinations. In addition, Congress and the FDIC have conducted oversight hearings and agency analyses exploring broader deposit
insurance reform alternatives, including adjusting coverage limits and targeted insurance frameworks for specific account types. The ultimate outcome, timing, and scope of any changes remain uncertain and could materially affect deposit flows,
competitive dynamics, and regulatory costs.

FDIC deposit insurance expense totaled $2.9 million in 2025, $2.6 million in 2024 and $2.9 million in 2023. Future changes in insurance premiums could have an adverse effect on the operating
expenses and results of operations of Trustco Bank, and the Bank cannot predict what insurance assessment rates will be in the future.

Insurance of deposits may be terminated by the FDIC upon a finding that the institution has engaged in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation,
rule, order or condition imposed by the FDIC or the OCC. The Bank does not know of any practice, condition or violation that might lead to termination of its deposit insurance.

Other Regulation

Assessments. The Bank is required to pay assessments to the OCC to fund the agency’s operations. The
general assessments, paid on a semi-annual basis, is computed upon the Bank’s total assets, including consolidated subsidiaries, as reported in the Bank’s
latest quarterly financial report. The OCC’s assessment schedule includes a surcharge for institutions that require increased supervisory resources. The assessments paid by the Bank for the year ended
December 31, 2025 totaled approximately $576 thousand.

Community Reinvestment Act. The Community Reinvestment Act (“CRA”) requires each savings institution, as well as commercial banks and certain other lenders, to identify the communities served by the institution’s offices and to
identify the types of credit the institution is prepared to extend within those communities. The CRA also requires the OCC to assess an institution’s performance in meeting the credit needs of its identified communities as part of its
examination of the institution, and to take such assessments into consideration in reviewing applications with respect to branches, mergers and other business combinations, including acquisitions by savings and loan holding companies. An
unsatisfactory CRA rating may be the basis for denying such an application and community groups have successfully protested applications on CRA grounds. In connection with its assessment of CRA performance, the OCC assigns CRA ratings of
“outstanding,” “satisfactory,” “needs to improve” or “substantial noncompliance.” The Bank was rated “satisfactory” in its last CRA examination. Institutions are evaluated based on (i) its record of helping to meet the credit needs of its
assessment area through lending activities; (ii) its qualified investments; and (iii) the availability and effectiveness of the institution’s system for delivering retail banking services. An institution that is found to be deficient in its
performance in meeting its community’s credit needs may be subject to enforcement actions, including cease and desist orders and civil money penalties. In December 2021, the OCC issued a final rule rescinding its June 2020 Community
Reinvestment Act Rule and replacing it with the rules that were jointly adopted by the federal bank regulatory agencies, which became effective on January 1, 2022. On October 24, 2023, the OCC, FRB, and FDIC issued a final rule to modernize
their respective CRA regulations, which would have substantially altered the methodology for assessing compliance with the CRA. The rule introduced metrics-based benchmarking, expanded evaluation of lending outside traditional branch-based
assessment areas (such as online and mobile banking), and clarified eligible CRA activities, with major provisions originally scheduled to take effect January 1, 2026 and revised data reporting requirements January 1, 2027. However,
implementation was enjoined by a federal court in March 2024, and the agencies have since proposed rescinding the 2023 rule and reverting to the prior CRA framework (from 1995, as updated in 2021). As of now, banks continue to be examined under
the existing 1995/2021 regulations, and the 2023 modernization rule is unlikely to be reinstated in its original form.

14

Index

Commercial Real Estate Lending Concentrations. The federal banking agencies have issued guidance on sound risk management practices for concentrations in commercial real estate lending.
The particular focus is on exposure to commercial real estate loans that are dependent on the cash flow from the real estate held as collateral and that are likely to be sensitive to conditions in the commercial real estate market (as opposed
to real estate collateral held as a secondary source of repayment or as an abundance of caution). The purpose of the guidance is not to limit a bank’s commercial real estate lending but to guide banks in developing risk management practices and
capital levels commensurate with the level and nature of real estate concentrations. The guidance directs the FDIC and other federal bank regulatory agencies to focus their supervisory resources on institutions that may have significant
commercial real estate loan concentration risk. A bank that has experienced rapid growth in commercial real estate lending, has notable exposure to a specific type of commercial real estate loan, or is approaching or exceeding the following
supervisory criteria may be identified for further supervisory analysis with respect to real estate concentration risk:

In addition, on June 29, 2023, in response to the increased risk relating to commercial real estate loans, the federal banking agencies issued a final Interagency Policy Statement on prudent Commercial Real Estate
Loan Accommodations and Workouts. The policy statement updated, expanded on and superseded existing guidance from 2009. Most notably, it (i) added a discussion of short-term loan accommodations, (ii) expanded guidance regarding the evaluation
and assessment of guarantors to also encompass loan sponsors, (iii) incorporated information about changes to accounting principles since 2009, and (iv) updated and expanded the illustrative examples of commercial real estate loan workouts.
Furthermore, on December 18, 2023, the FDIC issued an advisory on Managing Commercial Real Estate Concentrations in a Challenging Economic Environment, which conveyed certain key risk management practices for FDIC-supervised institutions to
consider in managing commercial real estate loan concentrations in a challenging economic environment.

Although the Bank has a material amount of commercial real estate loans, it remains significantly below these thresholds.  The guidance provides that the strength of an institution’s lending and risk management practices with respect to such
concentrations will be taken into account in supervisory guidance on evaluation of capital adequacy.

Qualified Thrift Lender Test. As a savings institution regulated by the OCC, the Bank must be a “qualified thrift lender” under either the qualified thrift lender test under the Home Owners’ Loan Act or satisfy
the Internal Revenue Code’s domestic building and loan association test to avoid certain restrictions on its and the Company’s operations and activities. Under the qualified thrift lender test, an institution is generally required to maintain
at least 65% of its portfolio assets (total assets less: (i) specified liquid assets up to 20% of total assets; (ii) intangible assets, including goodwill; and (iii) the value of property used to conduct business) in certain qualified thrift
investments (primarily residential mortgages and related investments, including certain mortgage-backed and related securities) in at least nine months out of each 12 month period. A federal savings bank that fails the qualified thrift lender
test must operate under specified restrictions. Federal law also makes noncompliance with the qualified thrift lender test subject to agency enforcement action for a violation of law.  The Bank is currently, and expects to remain, in compliance
with the qualified thrift lender test.

Transactions with Affiliates and Other Related Parties. The Bank’s transactions with “affiliates” (generally, any company that controls, is controlled by, or is under common control with the Bank, including TrustCo) are limited by Sections 23A and 23B of the
Federal Reserve Act and the Federal Reserve Board’s implementing Regulation W. Under these laws, the aggregate amount of “covered transactions” between the Bank and any one affiliate is limited to 10% of the Bank’s capital stock and surplus, and the aggregate amount of covered transactions by the Bank
with all of its affiliates is limited to 20% of capital stock and surplus. Certain covered transactions (primarily credit-related transactions) are required to be secured by collateral in an amount and of a type described in Section 23A and
Regulation W. Transactions by the Bank with its affiliates must be on terms and under circumstances that are at least as favorable to the Bank as those prevailing at the time for comparable transactions with non-affiliates. In addition, savings
institutions are prohibited from lending to any affiliate that is engaged in activities that are not permissible for bank holding companies, and no savings institution may purchase the securities of any affiliate other than a subsidiary.

15

Index

The definition of “covered transactions” as used in Section 23A includes credit exposure on derivatives
transactions and securities lending and borrowing transactions, as well as the acceptance of affiliate-issued debt obligations as collateral for a loan or an extension of credit.

The Bank also is restricted in its ability to extend credit to its directors, executive officers and 10% shareholders, as well as to entities controlled by such persons. Extensions of credit
to those insiders must be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with unaffiliated persons; may not involve more
than the normal risk of repayment or present other unfavorable features and may not exceed certain limitations on the amount of credit extended to such persons, individually and in the aggregate. In addition, extensions of credit in excess of
certain limits must be approved by the Bank’s board of directors.

Certain non-credit transactions between an insured depository institution and its insiders, such as asset purchase and sales, are prohibited unless the transaction is on market terms and, if
the transaction represents more than 10% of the capital stock and surplus of the institution, has been approved in advance by a majority of the disinterested members of the board of directors of the institution.

Safety and Soundness Regulations. The federal banking agencies (including the OCC) have
adopted certain safety and soundness standards for all insured depository institutions. These standards relate to, among other things, internal controls, information systems and internal audit systems; loan documentation; credit underwriting;
interest rate risk exposure; asset growth; asset quality; earnings and compensation, fees, and benefits, as well as other operational and managerial standards as the agency deems appropriate. The Interagency Guidelines Establishing Standards
for Safety and Soundness set forth the safety and soundness standards that the federal banking agencies use to identify and address problems at insured depository institutions before capital becomes impaired. If the appropriate federal banking
agency (the OCC in the case of the Bank) determines that an institution fails to meet any standard prescribed by the guidelines, the agency may require the institution to submit to the agency an acceptable plan to achieve compliance with the
standard.  The Bank is subject to periodic examinations by the OCC regarding these and related matters. During these examinations, the examiners may require the Bank to increase its allowance for credit losses on loans, change the
classification of loans, and/or recognize additional charge-offs based on their judgments, which can impact our capital and earnings.

Moreover, in October 2025, the FDIC and the OCC issued a joint proposed rule that would define the phrase “unsafe or unsound practice” for purposes of section 8 of the Federal Deposit Insurance Act.  The proposed rule would establish
uniform standards for matters requiring attention and non-binding supervisory observations as part of the examination process.  In his February 26, 2026, testimony to the Senate Committee on Banking, Housing, and Urban Affairs, FDIC chairman
Travis Hill emphasized that the agency’s goal in defining the phrase “unsafe or unsound practices” in a rule is “to ensure that supervisory criticisms are focused on the issues most relevant to a bank’s safety and soundness.”  The proposed
rule’s comment period closed on December 29, 2025.

Enforcement. The Federal Reserve Board and the OCC have extensive enforcement authority over savings institutions and their holding companies,
including the Bank and TrustCo. This includes enforcement authority with respect to the actions of the Bank’s and TrustCo’s directors, officers and other “institution-affiliated parties,” including attorneys and auditors. This enforcement authority also includes, among other things, the ability to assess civil money
penalties, issue cease-and-desist or removal orders and initiate injunctive actions. In general, these enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices. Public disclosure of final
enforcement actions by the OCC and the Federal Reserve is required.

Executive Order on Fair Banking. An Executive Order issued in August 2025 prohibits denial of financial services based on constitutionally or statutorily protected beliefs, affiliations, or political views, and
prohibits politicized or unlawful “debanking.” Banking decisions must be based on individualized, objective, and risk-based analysis.

16

Index

Institutions in Troubled Condition. Certain events, including entering into a formal written agreement with a bank’s regulator or being
informed by the regulator that the bank is in troubled condition, will require that a bank give prior notice to their primary regulator before adding or replacing any member of the board of directors, employing any person as a senior executive
officer, or changing the responsibilities of any senior executive officer so that the person would assume a different senior executive position. Troubled condition banks are prohibited from making, or agreeing to make, certain “golden parachute payments” to institution-affiliated parties, subject to certain exceptions.

Consumer Laws and Regulations. In addition to the other laws and regulations discussed above, the Bank is subject to consumer laws and regulations
designed to protect consumers in transactions with financial institutions. These laws and regulations include, among others, the Truth in Lending Act, the Truth in Savings Act, the Electronic Funds Transfer Act, the Expedited Funds Availability
Act, the Equal Credit Opportunity Act, the Fair Housing Act, the Fair Credit Reporting Act and the Real Estate Settlement Procedures Act. These laws and regulations mandate certain disclosure requirements and regulate the manner in which
financial institutions must deal with customers when taking deposits from, making loans to, or engaging in other types of transactions with, such customers.

The federal Consumer Financial Protection Bureau (“CFPB”) has adopted rules related to mortgage loan origination and mortgage loan servicing. In particular, the CFPB has issued a rule
implementing the ability-to-repay and qualified mortgage (“QM”) provisions of the Truth in Lending Act, as amended by the Dodd-Frank Act (the “QM Rule”). The ability-to-repay provision requires creditors to make reasonable, good faith determinations that borrowers are able to repay their mortgages before
extending the credit based on a number of factors and consideration of financial information about the borrower from reasonably reliable third-party documents. Under the Dodd-Frank Act and the QM Rule, loans meeting the definition of “qualified mortgage” are entitled to a presumption that the lender satisfied the ability-to-repay requirements. The presumption is a conclusive presumption/safe
harbor for prime loans meeting the QM requirements, and a rebuttable presumption for higher-priced/subprime loans meeting the QM requirements.

Unclaimed Property Laws. Unclaimed property (escheatment) laws vary by state but generally require holders of customer property (including money) to turn over such property to the
applicable state after holding the property for the statutorily prescribed period of time. These laws are not uniform and impose varying requirements on entities, like the Bank, which may hold funds that are required to be escheated to the
applicable states.

Volcker Rule. The Dodd-Frank Act required the federal financial regulatory agencies to adopt rules that prohibit certain banks and their affiliates from engaging in
proprietary trading and investing in certain covered funds. The statutory provision is commonly called the “Volcker Rule,” and is not applicable to depository institutions and their holding companies whose total assets do not exceed $10
billion.  As of December 31, 2025, the Company’s total assets on a consolidated basis did not exceed $10 billion.

Office of Foreign Assets and Control Regulation. The U.S. Treasury Department’s Office of Foreign Assets Control, or OFAC, administers and enforces
economic and trade sanctions against targeted foreign countries and regimes, under authority of various laws, including designated foreign countries, nationals and others. OFAC publishes lists of specially designated targets and countries.
The Company is responsible for, among other things, blocking accounts of, and transactions with, such targets and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their
occurrence. Failure to comply with these sanctions could have serious legal and reputational consequences, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is
required or to prohibit such transactions even if approval is not required.

Bank Secrecy Act/Anti-Money Laundering and Customer Identification. Anti-money laundering (“AML”) and financial transparency laws and regulations, including the Bank Secrecy Act, impose
strict standards for gathering and verifying customer information in order to ensure funds or other assets are not being placed in U.S. financial institutions to facilitate terrorist financing and laundering of funds. Applicable laws require
financial institutions to have AML programs in place and require the federal banking agencies to consider a holding company’s effectiveness in combating money laundering when ruling on certain merger or acquisition applications. In addition,
failure to comply with these requirements could lead to significant fines and penalties or the imposition of corrective orders. In July 2024, the federal banking agencies, including the FRB and OCC, proposed amendments to update the
requirements for supervised institutions to establish, implement and maintain effective, risk-based and reasonably designed AML and countering the financing of terrorism (“CFT”) programs. The proposed amendments would require supervised
institutions to identify, evaluate and document the regulated institution’s money laundering, terrorist financing and other illicit finance activity risks, as well as consider, as appropriate, the U.S. Department of the Treasury’s Financial
Crimes Enforcement Network’s (“FinCEN”) published national AML/CFT priorities.  The Company continues to monitor the rulemaking process.

17

Index

Guidance for Third-Party Relationships. On June 9, 2023, the OCC, Federal Reserve, and FDIC issued final interagency guidance on risk management of third-party relationships, including third-party lending relationships. The
interagency guidance is based, in part, on the OCC’s previously existing third-party risk management guidance from 2013 and seeks to, among other things, promote consistency in third-party risk management and provide sound risk management
guidance for third-party relationships commensurate with a bank’s risk profile and complexity as well as the criticality of the activity. The final interagency guidance replaces each agency’s existing guidance on this topic (including the OCC’s
2020 Frequently Asked Questions on Third-Party Relationships) and is directed to all banking organizations supervised by the OCC, Federal Reserve, and FDIC. Additionally, third party relationship risk management and banking as a service
arrangements (including with respect to deposit products and services) have been topics of focus for federal bank regulators in recent years and further rulemaking activity or guidance may be forthcoming.

Consumer Privacy and Cybersecurity. Federal regulations generally require that the Company disclose its privacy policy and practices concerning its
sharing of “non-public personal information,” to individual customers at the time of establishing the customer relationship and, in certain circumstances, annually thereafter. In addition, the Company
is required to provide its customers with the ability to “opt-out” of having their personal information shared with unaffiliated third parties in certain circumstances.

A growing number of state privacy laws impose requirements and restrictions on the processing of personal information. These laws require substantial disclosures to consumers about personal information collection, use
and sharing practices, while also allowing consumers the right to access, delete, correct, or move their data.

In addition, federal banking agencies, through the Federal Financial Institutions Examination Council, have adopted guidelines to encourage financial institutions to address cybersecurity
risks and identify, assess and mitigate these risks, both internally and at critical third-party service providers. For example, federal banking regulators have highlighted that financial institutions should establish several lines of defense
and design their risk management processes to address the risk posed by compromised customer credentials. Further, financial institutions are expected to maintain sufficient business continuity planning processes designed to facilitate a
recovery, resumption and maintenance of the institution’s operations after a cyber-attack.

In November 2021, the federal banking agencies adopted rules requiring banking organizations to notify their primary regulator within 36 hours of becoming aware of a “computer-security incident” that rises to the level of a “notification
incident.” A notification incident is a “computer-security incident” that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material
portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. Bank service providers are also required to notify any affected bank to or on behalf of which
the service provider provides services “as soon as possible” after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such
bank for four or more hours.

Further, on July 26, 2023, the SEC adopted final rules that require public companies to promptly disclose material cybersecurity incidents on Form 8-K and detailed information regarding their cybersecurity risk management and governance on
an annual basis on Form 10-K. Companies are required to report on Form 8-K any cybersecurity incident they determine to be material within four business days of making that determination.  In addition to incident reporting, the rules require
companies to describe their cybersecurity processes and governance on an annual basis.

18

Index

Personal Data Financial Rights. On October 22, 2024, the CFPB issued a final rule to implement Section 1033 of the Dodd-Frank Act, which gives individuals the right to obtain data regarding consumer financial products and services
they have obtained. The final rule requires certain entities, including TrustCo and Trustco Bank, to comply with an established framework to govern consumer access to electronic financial data. Following the issuance of this rule, two trade
associations and a national bank headquartered in Kentucky filed a lawsuit challenging the rule in the United States District Court for the Eastern District of Kentucky. In this lawsuit, the plaintiffs alleged that the CFPB exceeded its
statutory authority in adopting the rule. In February 2025, the court granted a joint motion to temporarily stay the litigation proceedings and tolled the compliance deadlines under Section 1033 of the Dodd-Frank Act by 30 days. Following the change in administration in 2025, the CFPB declined to defend the rule and opened a new rulemaking to revisit the rule. In October 2025, the court enjoined enforcement of the rule until the CFPB
completes the rulemaking process. TrustCo continues to monitor developments relating to the rulemaking process and the litigation.

Identity Theft Protection. The Fair Credit Reporting Act’s Red Flags Rule requires financial institutions with covered accounts (e.g., consumer bank accounts and loans) to develop,
implement and administer an identity theft prevention program. This program must include reasonable policies and procedures to detect suspicious patterns or practices that indicate the possibility of identity theft, such as inconsistencies in
personal information or changes in account activity.

Federal Home Loan Bank of New York. The Bank is a member of Federal Home Loan Bank (“FHLB”) of New York, which is one of 11 regional FHLBs that serve as reserve or central banks for their members. The FHLBs are funded primarily from proceeds derived from the sale of consolidated obligations of
the FHLB system and makes loans or advances to members. The FHLBs also provide access to a line of credit and letters of credit in accordance with policies and procedures established by the Board of Directors of FHLB. The loans, lines of credit
and letters of credit are subject to the oversight of the Federal Housing Finance Agency. At December 31, 2024, the Bank had no FHLB advances and an available borrowing capacity with the FHLB which
approximates the balance of securities and/or loans pledged against such borrowings.  The Bank is also required to purchase and maintain stock in the FHLB of New York at or above levels specified in the FHLB of New York capital plan. As of
December 31, 2025 and 2024, the Bank owned $6.6 million and $6.5 million, respectively, in FHLB of New York stock, which was in compliance with its obligations.

Mergers and Acquisitions. The Bank Holding Company Act of 1956, the Bank Merger Act, the Change in Bank Control Act and other federal and state statutes regulate
acquisitions of interests in commercial banks. The BHC Act requires the prior approval of the FRB for the direct or indirect acquisition by a bank holding company of more than 5.0% of the voting shares of a commercial bank or its parent holding
company and for a person, other than a bank holding company, to acquire 25% or more of any class of voting securities of a bank or bank holding company. Under the Bank Merger Act, the prior approval of the appropriate bank regulatory agencies
is required for a member bank to merge with another bank or purchase the assets or assume the deposits of another bank. In reviewing applications seeking approval of merger and acquisition transactions, the bank regulatory authorities will
consider, among other things, the competitive effect and public benefits of the transactions, the capital position of the combined organization, the risks to the stability of the U.S. banking or financial system, the applicant’s performance
record under the CRA and fair housing laws and the effectiveness of the subject organizations in combating money laundering activities.

In recent years, federal agencies have undertaken a review of the standards by which bank and financial institution acquisitions are evaluated. Regulatory priorities have varied over time, including in connection with
changes in presidential administrations and agency leadership, which has led to rapidly evolving regulatory review standards for bank merger transactions. In September 2024, the FDIC finalized changes to its Statement of Policy on Bank Merger
Transactions (the “2024 Policy Statement”), which outlined the factors that the FDIC would consider when evaluating a proposed bank merger transaction; however, in May 2025, the FDIC rescinded the 2024 Policy Statement and reinstated the
Statement of Policy on Bank Merger Transactions that was in effect prior to the 2024 Policy Statement. Similarly, the OCC finalized a new Policy Statement Regarding Statutory Factors Under the Bank Merger Act (the “OCC Policy Statement”) in
September 2024, which updated the factors that the OCC would apply in evaluating a proposed bank merger transaction. The OCC subsequently rescinded the OCC Policy Statement in May 2025.  In September 2024, the DOJ withdrew its 1995 Bank Merger
Guidelines and issued the 2024 Banking Addendum to its 2023 Merger Guidelines. The DOJ clarified that it will assess competition considerations in connection with bank and BHC mergers using its 2023 Merger Guidelines, which is the general
merger review framework the DOJ now uses to evaluate transactions in all segments of the economy, and the 2024 Banking Addendum. The 2024 Banking Addendum provides guidance on how the DOJ will assess competition in the context of bank and bank
holding company mergers. An analysis under the 2023 Merger Guidelines and 2024 Banking Addendum may include consideration of theories of harm and relevant markets not considered under the 1995 Bank Merger Guidelines, which focused primarily on
concentrations of deposits and branches. Whether and how the guidance might be further changed or interpreted is uncertain.

19

Index

Cannabis Banking. The Marijuana Regulation and Taxation Act was signed into law in New York on March 31, 2021, legalizing the possession and
sale of recreational marijuana in New York State for adults aged 21 or older and the state has issued adult-use cannabis cultivation, processing and retail dispensary licenses. We have implemented a program to provide financial products and
services to legal cannabis-related businesses and partner with other financial institutions who provide such services.

Offering financial products and services to the cannabis industry presents a unique set of regulatory risks due to the conflict between state and
federal laws, as marijuana remains illegal at the federal level. In January 2018, the U.S. DOJ rescinded the “Cole Memo” and related memoranda which characterized the enforcement of the Controlled Substances Act against persons and entities
complying with state regulatory systems permitting the use, manufacture and sale of medical marijuana as an inefficient use of their prosecutorial resources and discretion. The impact of the DOJ’s rescission of the Cole Memo and related
memoranda is unclear, but in the future may result in increased enforcement actions against the regulated cannabis industry generally. The former United States Attorney General previously indicated that the DOJ, under his leadership, would
not pursue cases against parties who comply with the laws in states which have legalized and are effectively regulating marijuana. In addition, federal prosecutors have significant discretion and there can be no assurance that the federal
prosecutor for any district in which we operate will not choose to strictly enforce the federal laws governing cannabis. In the future, enforcement actions may be taken against cannabis-related businesses or financial services providers that
are viewed as aiding and abetting such activities.

In December 2025, President Trump signed Executive Order 14370, instructing the Attorney General to take all necessary steps to expedite the rescheduling of marijuana from Schedule I to
Schedule III under the Controlled Substances Act.  The Drug Enforcement Administration is expected to have substantial flexibility in how it chooses to implement and enforce rescheduling.

Finally, FinCEN published guidelines in 2014 for financial institutions servicing state-legal cannabis businesses. These guidelines clarify how
financial institutions can provide services to marijuana-related businesses “in a manner consistent with their obligations to know their customers and to report possible criminal activity.” The Bank has and will continue to follow this and
other FinCEN guidance in the areas of cannabis banking.

Compensation Practices. Our compensation practices are subject to oversight by the FRB and the OCC. Applicable regulatory guidance on incentive
compensation seek to ensure that the incentive compensation practices of banking organizations do not encourage excessive risk-taking and undermine the safety and soundness of those organizations. The guidance provides that supervisory
findings with respect to incentive compensation will be incorporated, as appropriate, into the organization’s supervisory ratings. To be consistent with safety and soundness, incentive compensation arrangements at a banking organization
should comply with the following principles:

The Board maintains a Compensation Committee made up of independent directors which exercises full oversight over the Company’s executive compensation program. The
Compensation Committee annually reviews a comprehensive risk assessment which addresses all aspects of the program and the controls that exist to mitigate any associated risk. Detailed disclosure of our compensation practices is set forth in
the annual Proxy Statement.

20

Index

In addition, on October 2022, the SEC adopted a final rule implementing the incentive-based compensation recovery (“clawback”) provisions of the Dodd-Frank Act. The final rule directed
national securities exchanges and associations, including Nasdaq, to require listed companies to develop and implement clawback policies to recover erroneously awarded incentive-based compensation from current or former executive officers in
the event of a required accounting restatement due to material noncompliance with any financial reporting requirement under the securities laws, and to disclose their clawback policies and any actions taken under these policies. On June 9,
2023, the SEC approved Nasdaq’s clawback listing standards. The Company has adopted a clawback policy that is intended to comply with the Nasdaq listing standards.

The U.S. financial regulators, including the FRB, the OCC, and the SEC, jointly proposed regulations in 2011 and again in 2016 to implement the
incentive compensation requirements of Section 956 of the Dodd-Frank Act. These regulations have not been finalized.

Climate-Related Risk Management and Regulation. Climate change may be associated
with rising sea levels as well as extreme weather conditions such as more intense hurricanes, thunderstorms, tornadoes, drought and snow or ice storms. Extreme weather conditions may increase our costs or cause damage to our facilities, and
any damage resulting from extreme weather may not be fully insured. Many of our facilities are located near coastal areas or waterways where rising sea levels or flooding could disrupt our operations or adversely impact our facilities.
Furthermore, periods of extended inclement weather or associated flooding may inhibit construction activity adversely affecting the use of some of our lending products.  Any such events could have a material adverse effect on our costs or
results of operations.  These same issues also could impact the value of mortgage collateral and the security for residential and commercial loans.

As a mortgage lender, Trustco Bank has identified credit, market, liquidity, and operational factors as climate-related risks.  Adverse climate factors could impact the ability of loan customers to timely repay
their loans.  Adverse climate impacts also could adversely impact the stock and bond markets which could adversely affect TrustCo’s non-interest income earning potential.  Severe physical impacts from climate change, such as rising sea
levels, could reduce the value of residential and/or commercial portfolio. These two factors, given sufficiently severe impacts, could affect liquidity.  Additionally, severe weather and other climate events could impact hiring and retention
of employees, facilities management, retail services, and technology infrastructure, thus creating operational risk.

Furthermore, climate change and the risks it may pose to financial institutions is an area of increased focus by the federal and state legislative bodies and regulators, including the federal banking agencies. In
the future, new regulations or guidance may be issued, or other regulatory or supervisory actions may be taken, in this area by the federal banking agencies or other regulatory agencies, or new statutory requirements may be adopted.  In March
2024, the SEC adopted final rules for “The Enhancement and Standardization of Climate-Related Disclosures for Investors,” which would have required issuers to provide climate-related disclosures. In April 2024, the SEC stayed the
effectiveness of the final rules pending the outcome of certain legal challenges. In March 2025, the SEC withdrew its defense of the final rules in the pending litigation. Finally, many states have
adopted, or are considering, laws that address climate and social issues. If the states in which we do business adopt such laws, it may increase our compliance costs. Such laws may also include provisions that conflict with other state and
federal regulations or limit our ability to conduct business in certain jurisdictions.

Other Governmental Initiatives. From time to time, various legislative and regulatory initiatives are introduced in Congress, as well as by regulatory authorities.  These initiatives
may include proposals to expand or contract the powers of bank holding companies and depository institutions, proposals to change the financial institution regulatory environment, or proposals that affect public companies generally. Such
legislation could change banking laws and the operating environment of the Company in substantial, but unpredictable ways. The Company cannot predict whether any such legislation will be enacted, and, if enacted, the effect that it, or any
implementing regulations would have on its financial condition or results of operations.

Human Capital Resources

Our Company maintains a Human Capital Strategic Plan that provide a framework for workforce development and team support.

21

Index

Headcount

As of December 31, 2025, we had 819 employees (which collectively amount to 743 full-time equivalents), all based in the United States, with 566 employees (69.1%) at bank branches, 234 (28.6%) located in corporate
offices and 19 (2.3%) in call centers.

Hiring & Promotion Practices

At TrustCo and Trustco Bank (“Bank”) we are continuously educating our hiring managers about recruitment and selection processes, and we strive to build our workforce from within when possible. All employees are
eligible to apply for open department and branch positions following their introductory period, and during 2025, 117 (roughly 14%) of our employees were promoted within the Bank. If the best candidate for an available position is not
identified from within our existing talent pool, we will look externally for the best talent, and our recruitment strategy focuses on searching for candidates directly through our participation in job fairs and social media advertising, and
through our professional networks and other associations located in the communities that we serve. Additionally, we have an active recruitment incentive program that awards existing employees for referring new employees to the Bank, which in
turn helps us fully develop our workforce.

Talent Development

We believe in investing for the future which includes the future of our workforce, and we actively encourage and support the growth of our employees throughout their educational and career development, ensuring
employees are given opportunities to develop and refine their skills to be successful within the Bank’s competitive environment. We aim to accomplish this through a multitude of training and development programs, which include opportunities
to engage in interdepartmental experiential learning, voluntary training seminars, ongoing training through our Cornerstone platform (a learning management system), tuition reimbursement program, BSA-AML certificate program with SUNY
Schenectady County Community College, and certification reimbursement for certain levels of employment. The Bank conducts a comprehensive new employee orientation for all new hires. All employees are required to complete a minimum number of
hours of Compliance, BSA/Anti-Money Laundering, Enterprise Risk, Information Security/Cyber Security and other technical training, that taken as a whole makes up a comprehensive professional development program for our people.  Further
professional development is provided through an internal mentorship program through which employees with seniority regularly meet with and mentor newer employees.  Topics covered in mentoring sessions include sales, staff management, branch
management, and professional development.  Members of the Board of Directors receive regular training on an array of timely and relevant regulatory and governance topics.   Currently, we have 29 (3.5%) employees who hold professional
certificates and/or licenses. Additionally, our employees participated in over 30,000 hours of specialized training during 2025.

Employee Feedback

Through our training and mentoring programs, we actively encourage employee feedback. Following each training session, employees complete evaluations designed to provide constructive feedback on their trainer’s
knowledge, the overall training structure, and the employee’s confidence in their ability to be successful in their new role. We are also gathering data on an ongoing basis which focuses on the tenure of current staff. We’ve consistently
maintained or improved our average tenure over the past four years, with an average tenure of approximately 5 years currently.  Furthermore, the Human Resources Department conducts stay and exit interviews, which capture feedback from high
turnover positions. These interviews are used to improve processes and procedures and inform future policy.

Non-discrimination

We recognize that everyone deserves the protection of longstanding federal civil-rights laws that protect individuals from discrimination based on race, color, religion, sex, or national origin and our training, recruiting and
recognition practices support and advance these goals. Our Human Capital Strategic Plan focuses on identifying areas of opportunity to further enhance our workforce over time. As of December 2025, approximately 57% of our workforce identify
as female and 43% identify as male.  The workforce is 46% ethnically diverse, being made up of 18% Hispanic or Latino employees, 14% Asian employees, 7% Black or African American employees, 4% of employees from two or more races, 2%
American Indian or Alaska Native employees, and 0.50% Native Hawaiian or other Pacific Islander employees.  Additionally, 9.6% of our workforce identifies as disabled.  Furthermore, our inclusion efforts focus on age, where we seek to
recruit younger candidates to create long-term career potential, while seeking to retain our experienced team members for the many benefits their presence yields.

22

Index

Employee Compensation and Benefits

Our human capital strategy objectives include identifying, recruiting, retaining, incentivizing, and integrating our existing and future employees. We strive to attract and retain the most talented employees by offering compensation and
benefit structures that support their health, financial, and emotional well-being, which includes competitive base salaries, annual bonuses, generous paid time off balances, and Holiday Pay, an Employee Stock Purchase Club Program, life
insurance, a 401(k) plan, the Trustco Bank Scholarship Program, a Tuition Reimbursement Program, an Employee Assistance Program for mental and emotional support and various Company-organized wellness competitions.

Employee Recruitment and Retention

Payment of Equity Awards to More Employees:  Since 2019, TrustCo has granted equity awards deeper into the corporate organization
to recognize and provide additional incentive compensation to individuals who consistently made an exceptional contribution to the bank by originating more mortgage loans and greater deposits. Since then, that practice was expanded to include Assistant Vice Presidents and other departmental team members who play key roles in the day-to-day
activities that are essential to the bank’s overall success. These two actions have been highly successful.  In a time when employee attrition is prevalent and presents significant challenges for
companies throughout the country, Trustco Bank has retained 90% of the employees receiving officer equity awards.

Foreign Operations

Neither TrustCo nor the Bank engage in any operations in foreign countries or have outstanding loans to foreign debtors.

Disclosure Pursuant to Subpart 1400 of Regulation S-K

The financial disclosures related to the Company as required under Subpart 1400 of Regulation S-K are incorporated herein by reference from TrustCo’s
2025 Annual Report to Shareholders, which is attached as Exhibit 13 hereto. See the cross-references below to locate such disclosures in the 2025 Annual Report to Shareholders.

23

Index

This information should not be construed to imply any conclusion on the part of the management of TrustCo that the results, causes, or trends indicated therein will continue in the future. The nature and
effects of governmental monetary policy, supervision and regulation, future legislation, inflation and other economic conditions and many other factors which affect interest rates, investments, loans, deposits, and other aspects of TrustCo’s operations are extremely complex and could make historical operations, earnings, assets, and liabilities not indicative of what may occur in the future.

Availability of Reports

TrustCo’s annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and all amendments to those reports can be obtained free of charge from
its website, www.trustcobank.com under the “Investor Relations” tab. These reports are available on the website as soon
as reasonably practicable after they are electronically filed with or furnished to the SEC. These reports are also available on the SEC’s website at http://www.sec.gov.
Various other documents related to corporate operations, including the Company’s Corporate Governance Guidelines, the charters of its principal Board committees, and the Company’s Code of Conduct are available on the website. The
information found on the Company’s website is not incorporated by reference in this or any other report the Company files or furnishes to the SEC.