TRUSTCO BANK CORP N Y (TRST) Risk Factors

Item 1A. Risk Factors

In addition to the other information set forth in this 2025 Form 10-K, you should carefully consider the following factors, which could materially affect our business, financial condition or
results of operations. The risks described below are not the only risks that we face. Additional risks and uncertainties not currently known to us or that we currently deem to be immaterial also may negatively affect our business, financial
condition or results of operations.

Risks Related to Our Lending Activities

Changes in interest rates may significantly impact our financial condition and results of operations

Like other financial institutions, we are subject to interest rate risk. Our primary source of income is net interest income, which is the difference between interest earned on loans and investments, and interest paid on deposits and
borrowings. The level of net interest income is primarily a function of the average balance of our interest-earning assets, the average balance of our interest-bearing liabilities, and the spread between the
yield on such assets and the cost of such liabilities. These factors are influenced by both the pricing and mix of our interest-earning assets and our interest-bearing liabilities which, in turn, are impacted by such external factors as
the local economy, competition for loans and deposits, the monetary policy of the Federal Open Market Committee of the FRB (the “FOMC”), and market interest rates.

Over any specific period of time, our interest-earning assets may be more sensitive to changes in market interest rates than our interest-bearing liabilities, or vice-versa. In addition, the individual market
interest rates underlying our loan and deposit products may not change to the same degree over a given time period. In any event, if market interest rates should move contrary to our position, earnings may be negatively affected. After the
benchmark federal funds interest rate reached a peak range between 5.25 percent and 5.50 percent in 2023 into 2024, the FOMC reduced the federal funds rate by a total of 100 basis points in three rate cuts in 2024 and by a total of an
additional 75 basis points in three rate cuts in 2025, to a range of 3.50 percent to 3.75 percent at the end of 2025. The range of potential rate paths over the coming year is wide and will ultimately be driven by the path of inflation,
labor market performance and economic growth.

There can be no assurances as to any future FOMC conduct. If the FOMC increases the targeted federal funds rates, overall interest rates likely will rise, which will positively impact our interest income but may
further negatively impact the entire national economy, including the housing industry in the markets we serve, by reducing refinancing activity and new home purchases. A significant portion of our loans have fixed interest rates (or, if
adjustable, are initially fixed for periods of five to 10 years) and longer terms than our deposits and borrowings. Our net interest income could be adversely affected if the rates we pay on deposits and borrowings increase more rapidly
than the rates we earn on loans. In addition, deflationary pressures, while possibly lowering our operational costs, could have a significant negative effect on our borrowers and the values of collateral securing loans, which could
negatively affect our financial performance.

24

Index

We also are subject to reinvestment risk associated with changes in interest rates. Changes in interest rates may affect the average life of loans and mortgage-related securities. Increases in interest rates may decrease loan demand
and/or may make it more difficult for borrowers to repay adjustable rate loans. Decreases in interest rates often result in increased prepayments of loans and mortgage-related securities, as borrowers refinance their loans to reduce
borrowing costs. Under these circumstances, we are subject to reinvestment risk to the extent that we are unable to reinvest the cash received from such prepayments in loans or other investments that have interest rates that are comparable
to the interest rates on existing loans and securities. Conversely, increases in interest rates often result in slowed prepayments of loans and mortgage-related securities, reducing cash flows and reinvestment opportunities.

Changes in interest rates also affect the value of the Bank’s interest-earning assets, and in particular the Bank’s securities
portfolio. Generally, the value of fixed-rate securities fluctuates inversely with changes in interest rates. Unrealized gains and losses on securities available for sale are reported as a separate component of equity, net of tax. Decreases
in the fair value of securities available for sale resulting from increases in interest rates could have an adverse effect on shareholders’ equity.

External economic factors, such as changes in monetary policy and inflation and deflation, may have an adverse effect on our business, financial condition and results of operations.

Inflation rose sharply at the end of 2021 and remained elevated throughout 2022 at levels not seen for over 40 years. Inflationary pressures dissipated from 2023 through 2025, with the annual inflation rate in the
United States decreasing to 2.7% during December 2025 from its high of 9.1% in June 2022, as reported by the U.S. Bureau of Labor Statistics. Virtually all our assets and liabilities are monetary in nature. As a result, interest rates tend
to have a more significant impact on our performance than general levels of inflation or deflation. Interest rates do not necessarily move in the same direction or by the same magnitude as the prices of goods and services. Nevertheless,
small to medium-sized businesses may be impacted more during periods of high inflation as they are not able to leverage economics of scale to mitigate cost pressures compared to larger businesses. Consequently, the ability of our business
customers to repay their loans has deteriorated and may continue to deteriorate, and in some cases this deterioration has occurred and may in the future occur quickly, which can adversely impact our results of operations and financial
condition. Furthermore, a prolonged period of inflation has caused and may continue to cause wages and other costs to the Company to increase, which could adversely affect our results of operations and financial condition.

We are exposed to credit risk in our lending activities.

There are inherent risks associated with our lending and trading activities. Loans to individuals and business entities, our single largest asset group, depend for repayment on the willingness and ability of
borrowers to perform as contracted. A material adverse change in the ability of a significant portion of our borrowers to meet their obligation to us, due to changes in economic conditions, interest rates, natural disaster, acts of war, or
other causes over which we have no control, could adversely impact the ability of borrowers to repay outstanding loans or the value of the collateral securing these loans, and could have a material adverse impact on our earnings and
financial condition.

Our emphasis on residential mortgage loans exposes us to lending risks, and any weakness in the residential real estate markets could adversely affect our performance.

As of December 31, 2025, consumer residential real estate loans represented approximately 93.8% of our total loan portfolio. Residential mortgage lending is generally sensitive
to regional and local economic conditions that significantly impact the ability of borrowers to meet their loan payment obligations, making loss levels difficult to predict. A general decline in home values would adversely affect
the value of collateral securing the residential real estate that we hold, as well as the volume of loan originations and the amount we realize on the sale of real estate loans. Additionally, if insurance obtained by our borrowers is
insufficient to cover any losses sustained to the collateral, the decreases in the value of collateral securing our loans as a result of natural disasters or other related events could adversely impact our financial condition and results of
operations. If insurance coverage is unavailable to our borrowers due to the reluctance of insurance companies to renew policies covering the collateral or due to other factors, the resulting increase in cost of home ownership could affect
the ability of borrowers to repay loans.

25

Index

These factors could result in higher delinquencies and greater charge-offs in future periods, which could materially adversely affect our business, financial condition or results of operations.

Our commercial loan portfolio is increasing and the inherently higher risk of loss may lead to additional provisions for credit losses or charge-offs, which would negatively impact earnings
and capital.

Commercial loans generally expose a lender to greater risk of non-payment and loss than one- to four-family residential mortgage loans because repayment of the loans often depends on the successful operation
of the business and the income stream of the borrowers. Such loans typically involve larger loan balances to single borrowers or groups of related borrowers compared to one- to four-family residential mortgage loans. Also, some of our
commercial borrowers have more than one loan outstanding with us. Consequently, an adverse development with respect to one loan or one credit relationship can expose us to a significantly greater risk of loss compared to an adverse
development with respect to a one- to four-family residential mortgage loan. Commercial business loans expose us to additional risk since they typically are dependent on the borrower’s ability to make repayments from the cash flows of the
business and are secured by non-real estate collateral that may depreciate over time. Further, our commercial business loans may be secured by collateral other than real estate, such as inventory and accounts receivable, the value of which
may be more difficult to appraise, control or collect and may be more susceptible to fluctuation in value at the time of default. In addition, if we foreclose on these loans, our holding period for the collateral may be longer than for a
single or multi-family residential property if there are fewer potential purchasers of the collateral.

Banking regulatory authorities may require banks with higher levels of investor real estate loans to implement enhanced risk management practices – including stricter underwriting, additional internal controls
and risk management policies, more detailed reporting, and portfolio stress testing – as well as potential higher allowances for credit losses and capital levels as a result of investor real estate lending growth and exposure. Our failure
to adequately implement enhanced risk management policies, procedures and controls could adversely affect our ability to manage the investor real estate segment of our loan portfolio and could result in an increased rate of delinquencies
in, and increased losses from, our loan portfolio, which could have a material adverse effect on our business, financial condition and results of operations.

Furthermore, a downturn in the real estate market in our primary market areas could result in an increase in the number of borrowers who default on their loans and a reduction in the value of the collateral
securing their loans, which in turn could have an adverse effect on our profitability and asset quality. If we are required to liquidate the collateral securing a loan to satisfy the debt during a period of reduced real estate values, our
earnings and shareholders’ equity could be adversely affected. Unexpected decreases in investor real estate prices coupled with slow economic growth and elevated levels of unemployment could drive losses beyond those which are provided for
in our allowance for loan losses. We also may incur losses on investor real estate loans due to declines in occupancy rates and rental rates, which may decrease property values and may decrease the likelihood that a borrower may find
permanent financing alternatives. Any of these events could increase our costs, require management’s time and attention, and materially and adversely affect our business, financial condition and results of operations.

Additionally, if insurance obtained by our borrowers is insufficient to cover any losses sustained to the collateral, the decreases in the value of collateral securing our loans as a result of natural
disasters or other related events could adversely impact our financial condition and results of operations. If insurance coverage is unavailable to our borrowers due to the reluctance of insurance companies to renew policies covering the
collateral or due to other factors, the resulting increase in cost of investor real estate ownership could affect the ability of borrowers to repay loans.

The combination of these factors could result in deterioration in the fundamentals underlying the commercial real estate market and the deterioration in value of some of our loans, as well as the ability of
our borrowers to repay the amounts due under their loans. As a result, our business, results of operations or financial condition may also be adversely affected. Specifically, the office property segment, which represents 9.6% percent of
our total loan portfolio, is undergoing a structural shift given the rise of a remote work environment resulting in heightened vacancies and potentially reduced leasing needs. It is anticipated that this heightened risk environment for the
office segment may take several years to resolve.

26

Index

If our allowance for credit losses on loans (“ACLL”) is not sufficient to cover expected loan losses, our earnings could decrease.

When determining the amount of the ACLL, we make various assumptions and judgments about the collectability of our loan portfolio, including the creditworthiness of our borrowers and the value of the real
estate and other assets serving as collateral for the repayment of many of our loans, as well as about the current and expected future economic environment. In deciding on the adequacy of the allowance for credit losses, management reviews
past due information, historical charge-off and recovery data, nonperforming loan activity and reasonable and supportable forecasts. Also, there are a number of other factors that are taken into consideration, including: the magnitude,
nature and trends of recent loan charge-offs and recoveries, the growth in the loan portfolio and the implication that it has in relation to the economic climate in the Bank’s market territories, and the
economic environment in the Upstate New York territory (the Company’s largest geographical area) primarily over the last several years, as well as in the Company’s
other market areas. A significant portion of the ACLL is determined using qualitative factors. The determination of qualitative factors involves subjective judgement and subjective measurement. We cannot predict loan losses with certainty
that charge-offs in future periods will not exceed our estimate of expected losses as determined through our ACLL. If our assumptions and analysis prove to be incorrect, including with respect to the economic environment, our ACLL may not
be sufficient to cover expected losses in our loan portfolio, resulting in additions to our ACLL which is maintained through provisions for credit losses. In addition, regulatory agencies, as an integral part of their examination process,
may require additions to the allowance based on their judgment about information available to them at the time of their examination. Material additions to our ACLL would materially decrease our net income.

We may not be able to meet the cash flow requirements of our depositors or borrowers or meet our operating cash needs to fund corporate expansion and other activities.

Liquidity is the ability to meet cash flow needs on a timely basis at a reasonable cost. The liquidity of Trustco Bank is used to make loans and to repay deposit liabilities as they become due or are demanded by customers. Liquidity
policies and limits have been established by our Board, and our management monitors the overall liquidity position of Trustco Bank to ensure that various alternative strategies exist to cover unanticipated events that could affect
liquidity. Trustco Bank is also a member of the Federal Home Loan Bank which provides funding to members through advances and other extensions of credit that are typically collateralized with securities or mortgage-related assets. Our
securities portfolio can be used as a secondary source of liquidity, and additional liquidity could be obtained from securities sold under repurchase agreements, non-core deposits, and debt or equity securities issuances in public or
private transactions. If we were unable to access any of these funding sources when needed, we might not be able to meet the needs of our customers, which could adversely affect our financial condition, our results of operations, cash flows
and our level of regulatory capital.

We are subject to claims and litigation pertaining to fiduciary responsibility and lender liability.

Some of the services we provide, such as trust and investment services, require us to act as fiduciaries for our customers and others. In addition, loan workout and other activities may expose us or Trustco Bank to legal actions,
including lender liability or environmental claims. From time to time, third parties make claims and take legal action against us pertaining to the performance of our fiduciary responsibilities or loan-related activities. If these claims
and legal actions are not resolved in a manner favorable to us, we may be exposed to significant financial liability and/or our reputation could be damaged. Either of these results may adversely impact demand for our products and services
or otherwise have a harmful effect on our business and, in turn, on our financial condition, results of operations and prospects.

The strict enforcement of federal laws and regulations regarding cannabis could result in our inability to continue to provide financial products and services to our customers that do business
in the cannabis industry. We could have legal action taken against us by the federal government and exposure to additional liabilities and regulatory compliance costs.

27

Index

Offering financial products and services to the cannabis industry presents a unique set of regulatory risks due to the conflict between state and federal laws. While the possession and sale of recreational
marijuana is legal for adults aged 21 and older in New York State, cannabis currently remains classified as a Schedule I controlled substance under the federal Controlled Substances Act. Enforcement policies and practices may be highly
variable between political administrations. For instance, in December 2025, President Trump signed Executive Order 14370, instructing the Attorney General to take all necessary steps to expedite the rescheduling of marijuana from Schedule I
to Schedule III under the Controlled Substances Act. Moreover, federal prosecutors have significant discretion and there can be no assurance that the federal prosecutor for any district in which we or our customers operate will not choose
to strictly enforce the federal laws governing cannabis.

Any enforcement action against a cannabis-related business customer of ours could affect our results of operation and financial condition. Additionally, as the possession and use of cannabis remains illegal under the Controlled
Substances Act, we may be deemed to be aiding and abetting illegal activities through the services that we provide to such customers and could have legal action taken against us by the federal government, including imprisonment and fines.
FinCEN published guidelines in 2014 for financial institutions servicing state-legal cannabis businesses. These guidelines clarify how financial institutions can provide services to marijuana-related businesses in a “manner consistent with
their obligations to know their customers and to report possible criminal activity.” The Bank has and will continue to follow this and other FinCEN guidance in the areas of cannabis banking. However, there can be no assurance that
compliance with FinCEN’s guidelines will protect us from federal prosecution or other regulatory sanctions. Any change in position or potential action taken against us could result in significant financial damage to us and our stockholders.

Additionally, while we believe our Bank Secrecy Act/Anti-Money Laundering (“BSA/AML”) policies and practices for our cannabis banking program are sufficient, the recreational cannabis business is considered high-risk, and our BSA/AML
program will be subject to increased regulatory scrutiny. Any real or perceived shortcomings in our BSA/AML program may result in regulatory action against us and may prevent us from undertaking mergers and acquisitions or other expansion
activities.

Risks Related to Our Operations

We are dependent upon the services of our management team.

We are dependent upon the ability and experience of a number of our key management personnel who have substantial experience with our operations, the financial services industry and the markets in which we
offer our services. It is possible that the loss of the services of one or more of our senior executives or key managers would have an adverse effect on our operations. Our success also depends on our ability to continue to attract, manage
and retain other qualified middle management personnel as we grow. We cannot assure you that we will continue to attract or retain such personnel.

Our disclosure controls and procedures may not prevent or detect all errors or acts of fraud.

Our disclosure controls and procedures are designed to reasonably assure that information required to be disclosed by TrustCo in reports we file or submit under the Exchange Act is accumulated and communicated
to management, and recorded, processed, summarized, and reported within the time periods specified in the SEC’s rules and forms. We believe that any disclosure controls and procedures or internal
controls and procedures, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met.

These inherent limitations include the realities that judgments in decision-making can be faulty and that breakdowns can occur because of simple error or mistakes. Additionally, controls can be circumvented by
the individual acts of some persons, by collusion of two or more people, or by an unauthorized override of the controls. Accordingly, because of the inherent limitations in our control system, misstatements due to error or fraud may occur
and not be detected.

If the business continuity and disaster recovery plans that we have in place are not adequate to continue our operations in the event of a disaster, the business disruption can adversely impact
our operations.

External events, including terrorist or military actions, or an outbreak of disease, and resulting political and social turmoil could cause unforeseen damage to our physical facilities or could cause delays or
disruptions to operational functions, including information processing and financial market settlement functions. Additionally, our customers, vendors and counterparties could suffer from such events. Should these events affect us, or our
customers, or vendors or counterparties with which we conduct business, our results of operations could be adversely affected.

28

Index

The Company’s risk management framework may not be effective in mitigating risk and loss.

The Company maintains an enterprise risk management program that is designed to identify, quantify, monitor, report, and control the risks that it faces. These risks include interest rate, credit, liquidity, operations, reputation,
compliance, and litigation. While the Company assesses and improves this program on an ongoing basis, there can be no assurance that its approach and framework for risk management and related controls will effectively mitigate all risk and
limit losses in its business. If conditions or circumstances arise that expose flaws or gaps in the Company’s risk management program, or if its controls break down, the performance and value of its
business could be adversely affected.

New lines of business or new products and services may subject us to additional risks.

From time to time, we may develop and grow new lines of business or offer new products and services within our existing lines of business. There are substantial risks and uncertainties associated with these
efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and/or new products and services, we may invest significant time and resources. Initial timetables for the
introduction and development of new lines of business and/or new products or services may not be achieved and price and profitability targets may not prove feasible. External factors, such as compliance with regulations, competitive
alternatives, and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service. Furthermore, any new line of business and/or new product or service could have a significant
impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business or new products or services could have a material adverse effect on
our business, results of operations and financial condition. All service offerings, including current offerings and those which may be provided in the future, may become more risky due to changes in economic, competitive and market
conditions beyond our control.

Digital banking trends may create deposit volatility, which could adversely affect our operations, profitability and competitive position.

Our traditional banking model depends heavily on stable customer deposits as a primary source of funding. The rising popularity of alternative financial products, including fintech platforms, cryptocurrencies,
money market funds, and digital wallets, may lead to increased volatility in our deposit base. Significant fluctuations in deposits could adversely affect our liquidity position, funding costs, and overall financial stability. Although we
actively manage our liquidity and funding sources, a substantial shift of customer deposits to these alternative products could negatively impact our operations, profitability, and competitive position.

Our business may be adversely affected by the prevalence of fraud and other financial crimes.

As a bank, we are susceptible to fraudulent activity that may be committed against us or our customers which may result in financial losses or increased costs to us or our customers,
disclosure or misuse of our information or our customers’ information, misappropriation of assets, privacy breaches against our customers, litigation or damage to our reputation. Such fraudulent activity may take many forms, including
check fraud, electronic fraud, wire fraud, phishing, social engineering and other dishonest acts. Consistent with industry trends, we have also experienced attempted electronic fraudulent activity in recent periods. Given such electronic
fraudulent activity and the growing level of use of electronic, internet-based and networked systems to conduct business directly or indirectly with our clients, certain fraud losses may not be avoidable regardless of the preventative and
detection systems in place. Nationally, reported incidents of fraud and other financial crimes have increased. While we have policies and procedures designed to prevent such losses, there can be no assurance that such losses will not
occur.

29

Index

We are exposed to climate risk.

Climate change may be associated with rising sea levels as well as extreme weather conditions such as more intense hurricanes, thunderstorms, tornadoes, drought and snow or ice storms. Extreme weather
conditions may increase our costs or cause damage to our facilities, and any damage resulting from extreme weather may not be fully insured. Many of our facilities are located near coastal areas or waterways where rising sea levels or
flooding could disrupt our operations or adversely impact our facilities. Furthermore, periods of extended inclement weather or associated flooding may inhibit construction activity adversely affecting the use of some of our lending
products. Any such events could have a material adverse effect on our costs or results of operations. These same issues also could impact the value of mortgage collateral and the security for residential and commercial loans.

As a mortgage lender, Trustco Bank has identified credit, market, liquidity, and operational factors as climate-related risks. Adverse climate factors could impact the ability of loan customers to timely
repay their loans. Adverse climate impacts also could adversely impact the stock and bond markets which could adversely affect TrustCo’s non-interest income earning potential. Severe physical impacts from climate change, such as rising sea
levels, could reduce the value of residential and/or commercial portfolio. These two factors, given sufficiently severe impacts, could affect liquidity.

Additionally, severe weather and other climate events could impact hiring and retention of employees, facilities management, retail services, and technology infrastructure, thus creating operational risk.

Societal responses to climate change could adversely affect our business and performance, including indirectly through impacts on our customers.

Concerns over the long-term impacts of climate change have led and will continue to lead to governmental efforts around the world to mitigate those impacts. Consumers and businesses also may change their behavior on their own as a result
of these concerns. We and our customers will need to respond to new laws and regulations as well as consumer and business preferences resulting from climate change concerns. We and our customers may face cost increases, asset value
reductions, operating process changes, and the like. The impact on our customers will likely vary depending on their specific attributes, including reliance on or role in carbon intensive activities. Among the impacts to us could be a drop
in demand for our products and services, particularly in certain sectors. In addition, we could face reductions in creditworthiness on the part of some customers or in the value of assets securing loans. Our efforts to take these risks into
account in making lending and other decisions, including increasing our business with climate-friendly companies, may not be effective in protecting us from the negative impact of new laws and regulations or changes in consumer or business
behavior.

Environmental, social and governance (“ESG”) risks could adversely affect our reputation and shareholder, employee, client and third party relationships and may negatively affect our stock price.

Our business faces increasing public investor, activist, legislative and regulatory scrutiny related to ESG and anti-ESG. We risk damage to our brand and reputation if we fail to act responsibly in a number of areas, such as
environmental stewardship, human capital management, support for our local communities, corporate governance and transparency, or fail to consider ESG factors in our business operations.

Furthermore, as a result of our diverse base of clients and business partners, we may face potential negative publicity based on the identity of our clients or business partners and the public’s (or certain segments of the public’s) view
of those entities. Such publicity may arise from traditional media sources or from social media and may increase rapidly in size and scope. If our client or business partner relationships were to become intertwined in such negative
publicity, our ability to attract and retain clients, business partners, and employees may be negatively impacted, and our stock price may also be negatively impacted. Additionally, we may face pressure to not do business in certain
industries that are viewed as harmful to the environment or are otherwise negatively perceived, which could impact our growth.

Additionally, investors and shareholder advocates are placing ever increasing emphasis on how corporations address ESG issues in their business strategy when making investment decisions and when developing their investment theses and
proxy recommendations. We may incur meaningful costs with respect to our ESG efforts and if such efforts are negatively perceived, our reputation and stock price may suffer.

30

Index

In response to ESG developments there are increasing instances of anti-ESG legislation, adverse media coverage, regulation, and litigation that could have unintended impacts on ordinary banking operations and increase litigation or
reputational risk related to actions we choose to take and impact the results of our operations. If legislatures in the states in which we operate adopt legislation intended to protect certain industries by limiting or prohibiting
consideration of business and industry factors in lending activities, certain portions of our lending operations may be impacted.

Risks Related to Market Conditions

A prolonged economic downturn, especially one affecting our geographic market area, will adversely affect our operations and financial results.

Our primary lending emphasis is the origination of one-to-four family first mortgage loans on residential properties; therefore, we are particularly exposed to downturns in the U.S. housing market. The primary
risks inherent in our one- to four-family loan portfolio are declines in economic conditions, elevated levels of unemployment or underemployment, and declines in residential real estate values. Any one or a combination of these events may
have an adverse impact on borrowers’ ability to repay their loans, which could result in increased delinquencies, non-performing assets, loan losses, and future loan loss provisions.

Additionally, we have a concentration of loans secured in New York and Florida. Approximately 64.3% of our loan portfolio is comprised of loans secured by property located in our markets in and around New
York, and approximately 35.7% is comprised of loans secured by property located in Florida. This makes us vulnerable to a downturn in the local economy and real estate markets. Adverse conditions in the local economy such as inflation,
unemployment, recession, natural disasters, or other factors beyond our control could impact the ability of our borrowers to repay their loans. Decreases in local real estate values could adversely affect the value of the property used as
collateral for our loans, which could cause us to realize a loss in the event of a foreclosure. Currently, there is not a single employer or industry in the area on which the majority of our customers are dependent.

Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have a material adverse effect on our results of
operations and financial condition.

Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have a material adverse effect on our results of
operations and financial condition. The macroeconomic environment in the United States is susceptible to global events and volatility in financial markets. Unfavorable or uncertain economic and market conditions could lead to
credit quality concerns related to borrower repayment ability and collateral protection as well as reduced demand for the products and services we offer. In addition, economic conditions in foreign countries, including global political
hostilities (including China-Taiwan and U.S.-China relations), global military conflicts (including the conflicts in the Ukraine, Iran, and the Middle East), and U.S. and foreign tariff policies, could affect the stability of global
financial markets, which could hinder domestic economic growth. If the national, regional and local economies experience worsening economic conditions, including high levels of unemployment, our growth and profitability could be
constrained. Weak economic conditions are characterized by, among other indicators, deflation, elevated levels of unemployment, fluctuations in debt and equity capital markets, increased delinquencies on commercial, mortgage and consumer
loans, residential and commercial real estate, price declines and lower home sales and commercial activity. Furthermore, trade negotiations between the U.S. and other nations remain uncertain and could
adversely impact economic and market conditions for the Company, our customers, and counterparties.

In addition, the inflationary outlook in the United States remains uncertain. While inflation has eased from its recent peak of 9.1% in June 2022, further inflationary pressures could result in the Federal Reserve
Board discontinuing its lowering of interest rates or increasing interest rates for a prolonged period of time, which may expose the Company to interest rate risk. In addition, higher interest rates could slow economic growth and lead to a
recessionary environment, which could negatively impact the Company’s growth, credit quality, net interest margin and its financial results. The risks to our business from inflation depends on the durability of the current inflationary
pressures in our markets. Transitory increases in inflation are unlikely to have a material impact on our business or earnings. However, more persistent inflation could lead to tighter-than-expected monetary policy which could, in turn,
increase the borrowings costs of our customers, making it more difficult for them to repay their loans or other obligations. Actions taken by the Federal Reserve Board, including changes in its target funds rate, balance sheet management
and lending facilities are beyond our control and difficult to predict. These actions can affect interest rates and the value of financial instruments and other assets and liabilities and can impact our borrowers. Sudden changes in monetary
policy, for example, in response to high inflation, have led and may in the future lead to financial market volatility, increases in market interest rates and a continued flattening or inversion of the yield curve. This has resulted in and
may continue to result in volatility of equity and other markets, further volatility of the U.S. dollar, a widening in credit spreads and higher interest rates and recessionary concerns, and could result in elevated unemployment, which
could impact investor risk appetite and our borrowers, potentially increasing delinquency rates. Financial market volatility could also result from uncertainty about the timing and extent of rate cuts by the Federal Reserve Board in
response to moderating inflation and/or weakening economic conditions. Higher inflation, or volatility and uncertainty related to inflation, could also reduce demand for our products, adversely affect the creditworthiness of our borrowers
or result in lower values for our investment securities and other interest-earning assets.

31

Index

Any downgrade in the credit rating of the U.S. government or default by the U.S. government as a result of political conflicts over legislation to raise the U.S. government’s debt limit may have a material
adverse effect on us.

Recent federal budget deficit concerns and political conflict over legislation to raise the U.S. government’s debt limit have increased the possibility of a default by the U.S. government on its debt obligations,
related credit-rating downgrades, or an economic recession in the United States. Many of our investment securities are issued by the U.S. government, including certain government agencies and sponsored entities. As a result of uncertain
domestic political conditions, including the possibility of the federal government defaulting on its obligations for a period of time due to debt ceiling limitations or other unresolved political issues, investments in financial instruments
issued or guaranteed by the federal government may pose liquidity risks. In 2011, Standard & Poor’s lowered its long-term sovereign credit rating on the U.S. from AAA to AA+. On August 1, 2023, Fitch Ratings also downgraded its U.S.
long-term sovereign credit rating from AAA to AA+. On May 16, 2025, Moody’s Ratings downgraded the U.S. long-term issuer and senior unsecured ratings to Aa1 from Aaa and changed its outlook to stable from negative. Further downgrades could
generally have a material adverse impact on financial markets and economic conditions in the U.S. and worldwide and, therefore, materially adversely affect our business, financial condition and results of operations.

The soundness of other financial institutions could adversely affect us.

Our ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services institutions are interrelated as a result of trading, clearing,
counterparty, or other relationships. We have exposure to many different counterparties, and we routinely execute transactions with counterparties in the financial services industry, including brokers and dealers, banks, investment banks,
mutual funds, and other institutional entities. As a result, defaults by, or even rumors or questions about, one or more financial services institutions, or the financial services industry generally, have led to market-wide liquidity
problems and could lead to losses or defaults by us or by other institutions. Many of these transactions expose us to credit risk in the event of default of our counterparty or client. Any such losses could be material and could materially
and adversely affect our business, financial condition and results of operations. On November 16, 2023, the FDIC approved a final rule to implement a special assessment on certain banking organizations
with financial institution subsidiaries with more than $5 billion in assets, in order to recover the costs associated with protecting uninsured depositors following the closures of Silicon Valley Bank and Signature Bank in March 2023. In
the event that there are similar negative developments in the banking industry in the future, there may be increased regulatory scrutiny and new regulations directed towards regional banks similar in size to us, which may increase our costs
of doing business and reduce our profitability.

Any government shutdown could adversely affect the U.S. and global economy and our liquidity, financial condition and earnings.

32

Index

Recent U.S. government shutdowns have negatively impacted U.S. economic growth, and the suspension of government data collection and publication left policymakers without access to the latest data on employment, inflation, and economic
growth, increasing the risk that a wrong decision will be made. Moreover, an extended period of shutdown of portions of the U.S. federal government could negatively impact the financial performance of certain
customers and could negatively impact customers’ future access to certain loan and guaranty programs. Continued adverse political and economic conditions could have a material adverse effect on our business, financial condition and
results of operations. During any protracted federal government shutdown, we may not be able to close certain loans and we may not be able to recognize non-interest income on the sale of loans. In addition, we believe that some borrowers
may decide not to proceed with their home purchase and not close on their loans, which would result in a permanent loss of the related non-interest income. A federal government shutdown could also result in reduced income for government
employees or employees of companies that engage in business with the federal government, which could result in greater loan delinquencies, increased in our non-performing, criticized, and classified assets, and a decline in demand for our
products and services.

The trust wealth management fees we receive may decrease as a result of poor investment performance, in either relative or absolute terms, which could decrease our revenues and net earnings.

Our Trustco Financial Services department derives its revenues primarily from investment management fees based on assets under management. Our ability to maintain or increase assets under management is subject to a number of factors,
including investors’ perception of our past performance, in either relative or absolute terms, market and economic conditions, and competition from investment management companies. Financial markets are affected by many factors, all of
which are beyond our control, including general economic conditions, securities market conditions, the level and volatility of interest rates and equity prices, competitive conditions, monetary and fiscal policy and investor sentiment. A
decline in the value of the assets under management would decrease our income. Further certain of our investment advisory and wealth management clients can terminate, with little or no notice, their relationships with us, reduce their
aggregate assets under management, or shift their funds to other types of accounts with different rate structures.

Risks Related to Compliance and Regulation

The regulatory capital rules could slow our growth, cause us to seek to raise additional capital, or both.

As discussed under “Regulation and Supervision - Regulatory Capital Requirements and Prompt Corrective Action,” the Company and the Bank are subject to regulatory
capital requirements. The capital rules impose stringent capital requirements on the Company and the Bank and generally require banking organizations to hold high-quality capital to act as a financial cushion to absorb losses and help
banking organizations better withstand periods of financial stress.

The application of these stringent capital requirements for us could, among other things, result in lower returns on equity, require us to limit the growth we may otherwise seek, require the raising of additional capital, and result in
regulatory actions such as prohibitions on the payment of dividends, the payment of bonuses to employees or the repurchase of shares if we were unable to comply with such requirements. If Trustco Bank fails to comply with its capital
requirements, the OCC will have the authority to take “prompt corrective action,” depending on the Bank’s capital level. Currently, the Bank is considered “well-capitalized” for prompt corrective action purposes. If it were to be designated
by the OCC in one of the lower capital levels - “undercapitalized,” “significantly undercapitalized” or “critically undercapitalized” - the Bank would be required to raise additional capital and also would be subject to progressively more
severe restrictions on operations, management, and capital distributions; replacement of senior executive officers and directors; and, if it became “critically undercapitalized,” to the appointment of a conservator or receiver.

Changes in laws and regulations and the cost of regulatory compliance with new laws and regulations may adversely affect our operations and our income.

We are subject to extensive regulation, supervision, and examination by the OCC, Federal Reserve Board, and FDIC. These regulatory authorities have extensive discretion in connection with their supervisory and enforcement activities,
including the ability to impose restrictions on a bank’s operations, reclassify assets, determine the adequacy of a bank’s loss allowances, and determine the level of deposit insurance premiums assessed. The Dodd-Frank Act significantly
affected the lending, deposit, investment, trading, and operating activities of financial institutions and their holding companies and will continue to do so. Changes in banking regulations and oversight, and the regulation of other
agencies, such as the CFPB and the U.S. Department of Housing and Urban Development, whether in the form of regulatory policy, new regulations or legislation, or additional deposit insurance premiums, have impacted our operations and may
continue to have a material impact on our operations in the future. New or revised rules have increased and may in the future increase our regulatory compliance burden and costs and restrict the financial products and services we offer to
our customers.

33

Index

Further, there may be additional laws and regulations, or changes in policy, affecting lending and funding practices, regulatory capital limits, interest rate risk management, and liquidity standards, and future responses may result in
significant changes. The federal bank regulatory agencies may require us to maintain capital ratios in excess of regulatory requirements, and new laws and regulations may increase our costs of regulatory compliance and of doing business,
and otherwise affect our operations. New laws and regulations may significantly affect the markets in which we do business, the markets for and value of our loans and investments, the products we offer, the fees we can charge and our
ongoing operations, costs, and profitability.

We are subject to numerous laws designed to protect consumers, including the CRA and fair lending laws, and a failure to comply with these laws could lead to a wide variety of sanctions.

The CRA, the Equal Credit Opportunity Act, the Fair Housing Act, and other fair lending laws and regulations (collectively, fair lending laws) impose community investment and nondiscriminatory lending requirements on financial
institutions. The CFPB, the Department of Justice and other federal and state agencies are responsible for enforcing these federal laws and regulations and comparable state provisions. Federal, state or local consumer lending laws may
restrict our ability to originate certain mortgage loans or increase our risk of liability with respect to such loans. A successful regulatory challenge to an institution’s performance under the fair lending laws could result in a wide
variety of sanctions, including damages and civil money penalties, injunctive relief, restrictions on mergers and acquisitions, restrictions on expansion and restrictions on entering new business lines. Private parties may also have the
ability to challenge an institution’s performance under fair lending laws in private class action litigation. Such actions could have a material adverse effect on our business, financial condition and results of operations.

Changes in cybersecurity or privacy regulations may increase our compliance costs, limit our ability to gain insight from data and lead to increased scrutiny.

We collect, process, store, share, disclose and use information from and about our customers, plan participants and website and application users, including personal information and other data. Any actual or
perceived failure by us to comply with our privacy policies, privacy-related obligations to customers or third parties, data disclosure and consent obligations or data security legal obligations may result in governmental enforcement
actions, litigation or public statements critical of us. Such actual or perceived failures could also cause our customers to lose trust in us, which could have an adverse effect on our business.

Restrictions on data collection and use may limit opportunities to gain business insights useful to running our business and offering innovative products and services.

We are subject to numerous federal, state, and international regulations regarding the privacy and security of personal information. These laws vary widely by jurisdiction and are constantly evolving. Privacy
regulations with a significant impact on our operations include the NYDFS 23 NYCRR Part 500 Cybersecurity Requirements for Financial Services Companies, Gramm-Leach-Bliley Title V Subtitle A- Safeguards Rule, and FDIC Part 364 Appendix B-
Interagency Guidelines Establishing Information Security Standards. Similar legislation is being enacted around the world with requirements and protections specific to data security requirements, notification requirements for data breaches,
the right to access personal data and the right to be forgotten. These and other changes in cybersecurity and privacy regulations or the enactment of new regulations may increase our compliance costs and failure to comply with these
regulations may lead to reputational damage, fines or civil damages and increased regulatory scrutiny. with these regulations may lead to reputational damage, fines or civil damages and increased
regulatory scrutiny. Moreover, the failure to meet reasonable cybersecurity control requirements could risk our ability to obtain cyber liability insurance or influence significantly higher rates.

34

Index

Non-compliance with the Bank Secrecy Act, or other laws and regulations could result in fines or sanctions.

The Bank Secrecy Act and other applicable requirements require financial institutions to develop programs to prevent financial institutions from being used for money laundering and terrorist activities. If
such activities are detected, financial institutions are obligated to file suspicious activity reports with the U.S. Treasury’s Office of Financial Crimes Enforcement Network. These rules require financial institutions to establish
procedures for identifying and verifying the identity of customers seeking to open new financial accounts. Failure to comply with these regulations could result in fines or sanctions. Recently, several banking institutions have received
large fines for non-compliance with these laws and regulations. While we have developed policies and procedures designed to assist in compliance with these laws and regulations, these policies and procedures may not be effective in
preventing violations of these laws and regulations.

Changes in tax laws may adversely affect us, and the Internal Revenue Service or a court may disagree with our tax positions, which may result in adverse effects on our business, financial condition, and
results of operations or cash flows.

The Company operates in an environment in which income taxes are imposed at both the federal and state levels. Strategies and operating routines have been implemented to minimize the impact of these taxes. Any change in tax legislation,
regulations, or administrative interpretations could significantly alter the effectiveness of these strategies.

The One Big Beautiful Bill Act (the “OBBBA”), enacted in July 2025, amended the Internal Revenue Code of 1986, as amended (the “Code”) to extend and modify certain provisions from the Tax Cuts and Jobs Act of 2017, making many of them
permanent. Among these, the OBBBA permanently preserves the lower individual tax rates and the $750,000 cap on mortgage interest deduction for acquisition debt. Interest on home equity loans or HELOCs remains deductible only if used to buy,
build, or substantially improve the home. The OBBBA also makes changes to the state and local tax deduction, adjusting limits and rules for eligible taxpayers through 2029. Certain technical modifications to business interest expense
deductions were also enacted. Other recent legislation, including the Inflation Reduction Act of 2022, introduced a 1% excise tax on certain corporate stock buybacks and a 15% corporate alternative minimum tax on large corporations based on
adjusted financial statement income.

There can be no assurance that future changes to the Code, applicable regulations, or administrative interpretations will not increase the rate of the corporate income tax, impose new limitations on deductions, credits, or other tax
benefits, or otherwise adversely affect the performance of an investment in our stock.

In addition, we have taken and may in the future take positions with respect to a number of unsettled issues under the Code for which Internal Revenue Service (“IRS”) guidance is unavailable. There is no assurance that the IRS or a court
will agree with the positions taken by us. If the IRS or a court were to successfully challenge any such position, we could be subject to additional taxes, penalties, and interest, which could adversely affect our business, financial
condition, results of operations, and cash flows.

Changes in federal tax laws may have an adverse effect on the market for, and the valuation of, residential properties, and on the demand for such loans in the future, and could make it harder for borrowers to make their loan payments.
In addition, these changes may also have a disproportionate effect on taxpayers in states with high residential home prices and high state and local taxes, such as New York. If home ownership becomes less attractive, demand for mortgage
loans could decrease. The value of the properties securing loans in our loan portfolio may be adversely affected as a result of the changing economics of home ownership, which could require an increase in our provision for loan losses,
which would reduce our profitability and could materially adversely affect our business, financial condition, and results of operations.

We are subject to regulatory limitations and other limitations that may affect our ability to pay dividends to our stockholders or to repurchase our common stock.

TrustCo is a separate legal entity from its subsidiary Trustco Bank, and does not have significant operations of its own. The availability of dividends from Trustco Bank is limited by various statutes and
regulations. It is possible, depending upon the financial condition of the Bank and other factors that the OCC or the Federal Reserve Board could assert that payment of dividends or other payments may result in an unsafe or unsound
practice. In addition, TrustCo is subject to consolidated capital requirements and is required to serve as a source of strength to Trustco Bank. If the Bank is unable to pay dividends to TrustCo, or if TrustCo is required to retain
capital or contribute capital to the Bank, we may not be able to pay dividends on our common stock or to repurchase shares of common stock.

35

Index

We may be subject to a higher effective tax rate if Trustco Realty Corp. (“Trustco Realty”) fails to qualify as a real estate investment trust (“REIT”).

Trustco Realty, a subsidiary of Trustco Bank, operates as a REIT for tax purposes. Trustco Realty was established to acquire, hold and manage mortgage assets and other authorized investments to generate net income for distribution to its
shareholders. Qualification as a REIT involves application of specific provisions of the Internal Revenue Code relating to various asset tests and gross income tests. If Trustco Realty fails to meet any of the required provisions for REITs,
it could no longer qualify as a REIT and the resulting tax consequences would increase our effective tax rate or cause us to have a tax liability for prior years.

Changes in accounting standards could impact reported earnings.

The accounting standard setting bodies, including the Financial Accounting Standards Board, the SEC and other regulatory bodies, periodically change financial accounting and reporting standards that govern the preparation of our
consolidated statements. These changes can be hard to predict and can materially impact how the Company records and reports its financial condition and results of operations. In some cases, we could be required to apply a new or revised
accounting standard retroactively, which could affect beginning of period financial statement amounts.

Risks Related to Competition

Strong competition within the Bank’s market areas could hurt profits and slow growth.

The Bank faces intense competition both in making loans and attracting deposits. This competition comes principally from other banks, savings and loan associations, credit unions, mortgage companies, other lenders, and institutions
offering uninsured investment alternatives. Many of our competitors have competitive advantages, including greater financial resources and higher lending limits, a wider geographic presence, more accessible branch office locations, more
aggressive marketing campaigns and better brand recognition, and the ability to offer a wider array of services or more favorable pricing alternatives, as well as lower origination and operating costs.

Competition has made it more difficult for the Bank to make new loans and at times has forced the Bank to offer higher deposit rates. Price competition for loans and deposits might result in the Bank earning less on loans and paying more
on deposits, which would reduce net interest income. Competition also makes it more difficult to grow loans and deposits and to hire and retain experienced employees. Management expects competition to increase in the future as a result of
legislative, regulatory and technological changes and the continuing trend of consolidation in the financial services industry. The Bank’s profitability depends upon its continued ability to compete
successfully in its market areas.

Consumers and businesses are increasingly using non-banks to complete their financial transactions, which could adversely affect our business and results of operations.

Technology and other changes are allowing consumers and businesses to complete financial transactions that historically have involved banks through alternative methods. For example, the wide acceptance of
Internet-based commerce has resulted in a number of alternative payment processing systems and lending platforms in which banks play only minor roles. Customers can now maintain funds in prepaid debit cards or digital currencies, and pay
bills and transfer funds directly without the direct assistance of banks. The diminishing role of banks as financial intermediaries has resulted and could continue to result in the loss of fee income, as well as the loss of customer
deposits and the related income generated from those deposits. The loss of these revenue streams and the potential loss of lower cost deposits as a source of funds could have a material adverse effect on our business, financial condition
and results of operations.

36

Index

Risks Related to Cybersecurity, Third Parties, and Technology

Our business could be adversely affected by third-party service providers, data breaches, and cyber-attacks.

We rely heavily on third-party service providers for much of our communications, information, operating and financial controls systems, and technology. We face the risk of operational disruption, failure, or capacity constraints due to
our dependency on third-party service providers for components of our business infrastructure. While we have selected these third-party service providers through our third party risk management program, we do not control their operations.
As such, any failure on the part of these business partners to perform their various responsibilities could also adversely affect our business and operations. Any failure or interruption or breach in security of these systems could result
in failures or interruptions in our customer relationships management, general ledger, deposit, servicing, and/or loan origination systems. Third (and fourth) party security incidents and supply-chain attacks have become increasingly
common. We cannot assure you that such incidents, failures or interruptions will not occur again in the future or, if they do occur, that they will be adequately addressed by us or the third parties on which we rely. The occurrence of any
failure or interruption could have a material adverse effect on our business, financial condition, results of operations, and cash flows. If any of our third-party service providers experience financial, operational, or technological
difficulties, or if there is any other disruption in our relationships with them, we may be required to locate alternative sources of such services, We cannot assure you that we could negotiate terms that are as favorable to us, or could
obtain services with similar functionality as found in our existing systems, without the need to expend substantial resources, if at all.

Furthermore, our assets that are at risk for cyber-attacks include financial assets and non-public information belonging to customers. We use several third-party service providers who have access to our assets via electronic media.
Certain cyber security risks arise due to this access, including cyber espionage, blackmail, ransom, and theft. We employ preventive and detective controls to protect our assets and provide recurring information security training to all
employees. Although we have not experienced any material losses or other material consequences to date relating to technology failure, cyberattacks or other information or security breaches, whether directed at us or at third parties, there
can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely as
to prevent material losses or consequences in the future, particularly in light of the increased sophistication and evolving nature of cyber criminals’ activity. Our risk and exposure to these cybersecurity incidents remains heightened
because of, among other things, our implementation of Internet and mobile banking to meet customer demand, our expanded internal usage of web-based products and applications, the current economic and political environment, and our
regulatory obligations and the regulatory scrutiny within our industry. As cyber and other data security threats continue to evolve, we may be required to expend significant additional resources to continue to modify and enhance our
protective measures or to investigate and remediate any security vulnerabilities.

The development and use of artificial intelligence (“AI”) presents risks and challenges that may adversely impact our business.

We or our third-party vendors, clients or counterparties may develop or incorporate AI technology in certain business processes, services or products. The development and use of AI presents a number of risks
and challenges to our business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the United States and internationally, and includes regulatory schemes targeted specifically at AI as well as
provisions in intellectual property, privacy, consumer protection, employment and other laws applicable to the use of AI. These evolving laws and regulations could require changes in our implementation of AI technology and increase our
compliance costs and the risk of non-compliance. AI models, particularly generative AI models, may produce output or take action that is incorrect, that result in the release of private, confidential or proprietary information, that reflect
biases included in the data on which they are trained, infringe on the intellectual property rights of others or that is otherwise harmful. In addition, the complexity of many AI models makes it challenging to understand why they are
generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output,
eliminating bias and complying with regulations that require documentation or explanation of the basis on which decisions are made.

37

Index

Further, we may rely on AI models developed by third parties, and would be dependent in part on the manner in which those third parties develop, train and deploy their models, including risks arising from the
inclusion of any unauthorized material in the training data for their models, the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models and other matters over which we may
have limited visibility. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures.

We are also exposed to risks arising from the use of AI technologies by bad actors to commit fraud and misappropriate funds and to facilitate cyberattacks. Generative AI, if used to perpetrate fraud or launch
cyberattacks, could create panic at a particular financial institution or securities exchange, which could pose a threat to financial stability.

A failure in or breach of our operational or security systems or infrastructure, or those of third parties, could disrupt our businesses, and adversely impact our results of operations,
liquidity and financial condition, as well as cause reputational harm.

The potential for operational risk exposure exists throughout our organization and, as a result of our interactions with, and reliance on, third parties, is not limited to our own internal operational
functions. Our operational and security systems, infrastructure, including our computer systems, data management, and internal processes, as well as those of third parties, are integral to our performance. We rely on our employees and third
parties in our day-to-day and ongoing operations, who may, as a result of human error, misconduct, malfeasance or failure, or breach of third-party systems or infrastructure, expose us to risk. We have taken measures to implement backup
systems and other safeguards to support our operations, but our ability to conduct business may be adversely affected by any significant disruptions to us or to third parties with whom we interact and rely. For example, strategic technology
project implementation challenges have caused immaterial business interruptions in the past and may cause more interruptions in the future. In addition, our ability to implement backup systems and other safeguards with respect to
third-party systems is more limited than with respect to our own systems. Our financial, accounting, data processing, backup or other operating or security systems and infrastructure may fail to operate properly or become disabled or
damaged as a result of a number of factors including events that are wholly or partially beyond our control which could adversely affect our ability to process these transactions or provide these services. There have been and there could be
in the future sudden increases in customer transaction volume; electrical, telecommunications, or other major physical infrastructure outages; natural disasters such as earthquakes, tornadoes, hurricanes, and floods; disease pandemics; and
events arising from local or larger scale political or social matters, including terrorist acts. We continuously update these systems to support our operations and growth and to remain compliant with all applicable laws, rules and
regulations globally. This updating entails significant costs and creates risks associated with implementing new systems and integrating them with existing ones, including business interruptions. Operational risk exposures could adversely
impact our results of operations, liquidity and financial condition, as well as cause reputational harm.

Unauthorized disclosure of sensitive or confidential client or customer information, whether through a breach of our computer systems or otherwise, could severely harm our
business.

As part of our financial institution business, we collect, process, and retain sensitive and confidential customer information. Despite the security measures we have in place, our facilities and systems, and
those of our third-party service providers, have been and may be vulnerable to security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming and/or human errors, or other similar events in the future. If
information security is breached, information can be lost or misappropriated, resulting in financial loss or costs to us. Any security breach involving confidential customer information, whether by us or by our vendors, could severely
damage our reputation, expose us to the risks of litigation and regulatory liability or disrupt our operations and have a material adverse effect on our business operations.

We could suffer a material adverse impact from interruptions in the effective operation of, or security breaches affecting, our computer systems.

We rely heavily on information systems to conduct our business and to process, record, and monitor our transactions. Risks to the systems result from a variety of factors, including the potential for bad acts
on the part of hackers, criminals, employees and others. As one example, some banks in recent years have experienced denial of service attacks in which individuals or organizations flood the bank’s
website with extraordinarily high volumes of traffic, with the goal and intended effect of disrupting the ability of the bank to process transactions. We are also at risk for the impact of natural disasters, terrorism, and international
hostilities on our systems or for the effects of outages or other failures involving power or communications systems operated by others. These risks also arise from the same types of threats to businesses with which we deal.

38

Index

Potential adverse consequences of attacks on our computer systems or other threats include damage to our reputation, loss of customer business, litigation, and increased regulatory scrutiny, which might also
result in financial loss and require additional efforts and expense to attempt to prevent such adverse consequences in the future.

Risk Related to Ownership of Our Securities

Provisions in our articles of incorporation and bylaws and New York law may discourage or prevent takeover attempts, and these provisions may have the effect of reducing the
market price of our stock.

Our articles of incorporation and bylaws include several provisions that may have the effect of discouraging or preventing hostile takeover attempts, and therefore, making the removal of incumbent management
difficult. The provisions include requirements of supermajority votes to approve certain business transactions. In addition, New York law contains several provisions that may make it more difficult for a third party to acquire control of us
without the approval of the Board, and may make it more difficult or expensive for a third party to acquire a majority of our outstanding stock. To the extent that these provisions are effective in discouraging or preventing takeover
attempts, they may tend to reduce the market price for our stock.

We cannot guarantee that our allocation of capital to various alternatives, including stock repurchase plans, will enhance long-term stockholder value.

Our business plan calls for us to execute a variety of strategies to allocate and deploy any excess capital including, but not limited to, continued organic balance sheet growth and diversification,
implementation of stock repurchase plans and payment of regular cash dividends.

On December 19, 2025, we announced that our Board authorized a new stock repurchase plan to acquire up to 2,000,000 shares of the Company’s outstanding common stock. Repurchases are made at management’s
discretion at prices management considers to be attractive and in the best interests of both the Company and its stockholders, subject to the availability of stock, general market conditions, the trading price of the stock, alternative uses
for capital, and the Company’s financial performance.

Actions of activist shareholders could negatively affect our business and the value of our common stock and cause us to incur significant expenses.

Although the Company values constructive input from shareholders, including on strategic matters, and our Board of Directors and management team are committed to acting in the best interests
of all of the Company’s shareholders, activist shareholders who disagree with the Company’s strategic direction, the way the Company is managed or the composition of the Board of Directors may seek to effect change through various
strategies that range from private engagement to public filings, proxy contests, efforts to force specific agendas, and litigation. Responding to some of these actions can be costly and time-consuming, may disrupt the Company’s business
and operations and divert the attention of the Board of Directors, management and employees. Such activities could interfere with the Company’s ability to execute its strategic plan and to attract and retain qualified executive leadership
and business partners, and our business could be adversely affected as a result. Any perceived uncertainty as to the Company’s future direction resulting from activist strategies could also affect the market price and volatility of the
Company’s common stock. These perceived uncertainties may also be exploited by our competitors and/or other activist shareholders, which could result in lost business opportunities and make it more difficult to execute on our long-term
strategic plan. Even if we are successful in defending any such proxy contest, litigation or related actions by an activist shareholder, our business could be adversely affected by such proxy contest, litigation or related actions due to
perceived uncertainties as to the future direction of the business, which may result in the loss of strategic opportunities. If individuals are elected or appointed to our Board of Directors with a specific agenda or who do not agree with
our strategic plan, the ability of our Board of Directors to function effectively could be adversely affected, which could in turn adversely affect our ability to effectively and timely implement our strategic plan and create additional
value for our shareholders, and/or adversely affect our business, operating results and financial condition.

39

Index