Community Bank System (CBU) Risk Factors

The Company and its subsidiaries are subject to extensive state and federal regulation, supervision and legislation that govern nearly every aspect of its operations. The Company, as a financial holding company, is subject to regulation by the FRB and its banking subsidiary is subject to regulation by the OCC. These regulations affect deposit and lending practices, capital levels and structure, investment practices, dividend policy, and growth. These regulatory authorities have extensive discretion in connection with their supervisory and enforcement activities, including the imposition of restrictions on the operation of a bank, the classification of assets by a bank, and the adequacy of a bank's allowance for credit losses. In addition, the non-bank subsidiaries are engaged in providing services including, but not limited to, retirement plan administration, fiduciary services to collective investment funds, investment management and insurance brokerage services, which industries are also heavily regulated at both a state and federal level, including by state banking and insurance agencies, the U.S. Department of Labor and the SEC. Such regulators govern the activities in which the Company and its subsidiaries may engage. Any change in such regulation and oversight, whether in the form of regulatory policy, regulations, legislation, interpretation or application, could have a material impact on the Company and its operations. Changes to the regulatory laws governing these businesses could affect the Company's ability to deliver or expand its services and adversely impact its operating and financial condition. The Dodd-Frank Act, as amended by the Economic Growth Act, instituted major changes to the banking and financial institutions regulatory regimes in the financial services sector. The ongoing effects of the Dodd-Frank Act, as well as continued rule-making and possible future changes to the regulatory requirements, may substantially impact the Company's and the Bank's operations. The implications of the Dodd-Frank Act depend to a large extent on the implementation of the legislation by the FRB, the CFPB, and other agencies as well as how market practices and structures change in response to the requirements of such rule making. Changes in regulations could subject the Company, among other things, to additional costs for compliance, reduced revenues and limit the types of financial services and products it can offer and/or increase the ability of non-banks to offer competing financial services and products. In addition, under the current administration, regulatory agencies, including the CPFB, have introduced new regulatory initiatives and pursued more aggressive enforcement policies with respect to a range of regulatory compliance matters. New initiatives and proposed rulemaking by such regulatory agencies may significantly limit the types of products the Company may offer and the fees it may charge for its services which may have a material impact on the Company's fee income. The Company may also be required to add additional compliance personnel or incur other significant compliance-related expenses. The Company's business, results of operations or competitive position may be adversely affected as a result. The Company is also directly subject to the requirements of entities that set and interpret the accounting standards such as the Financial Accounting Standards Board, and indirectly subject to the actions and interpretations of the Public Company Accounting Oversight Board, which establishes auditing and related professional practice standards for registered public accounting firms and inspects registered firms to assess their compliance with certain laws, rules, and professional standards in public company audits. These regulations, along with the currently existing tax, accounting, securities, insurance, and monetary laws, regulations, rules, standards, policies and interpretations, control the methods by which financial institutions and their holding companies conduct business, engage in strategic and tax planning, implement strategic initiatives, and govern financial reporting. The Company's failure to comply with laws, regulations or policies could result in civil or criminal sanctions, restrictions to its business model, and money penalties by state and federal agencies, and/or reputation damage, which could have a material adverse effect on the Company's business, financial condition and results of operations. See "Supervision and Regulation" for more information about the regulations to which the Company is subject.

The recent high-profile collapse of certain U.S. banks has generated significant market volatility among publicly traded bank holding companies and, in particular, community and regional banks. These market developments have negatively impacted customer confidence in the safety and soundness of community and regional banks. As a result, customers may choose to move or maintain deposits with larger financial institutions or outside of the banking industry, which could materially adversely impact the Company's liquidity, loan funding capacity, net interest margin, capital and results of operations. While the federal regulators have made statements ensuring that depositors of these recently failed banks would have access to their deposits, including uninsured deposit accounts, there is no guarantee that such actions will be successful in restoring customer confidence in community and regional banks and the banking system more broadly or that any future bank failures will receive the same treatment. Adverse regulatory findings or new regulatory requirements arising from the recent bank failures could increase the Company's expenses, reduce the Company's revenues and affect the Company's operations. The Company anticipates increased regulatory scrutiny, within the course of routine examinations and new regulations designed to address the recent negative developments in the banking industry, all of which may increase the Company's costs of doing business and reduce its profitability.

General political, economic, and social conditions in the U.S. and in countries abroad affect markets in the U.S. and ultimately the Company's business. In particular, U.S. markets may be affected by the level and volatility of interest rates, availability and market conditions of financing, economic growth, historically high levels of inflation, supply chain disruptions, consumer spending, employment levels, labor shortages, wage escalation or stagnation, changes in home prices, commercial property values, the growth of global trade and commerce, the availability and cost of capital and credit, and investor sentiment and confidence. Additionally, U.S. energy and commodity markets may be adversely affected by the current or anticipated impact of climate change, extreme weather events or natural disasters, the emergence or continuation of widespread health emergencies or pandemics, cyber attacks or campaigns, military conflict, terrorism or other geopolitical events. Also, any sudden or prolonged market downturn in the U.S., as a result of the above factors or otherwise, could result in a decline in net interest income and noninterest income and adversely affect the Company's results of operations and financial condition, including capital and liquidity levels. The economic developments in connection with the pandemic, including supply chain disruptions, increased inflation, changes to the Company's customers' industries, and the potential emergence of new pandemics in the U.S. and abroad have adversely impacted and may continue to adversely impact financial markets and macroeconomic conditions and could result in additional market volatility and disruptions globally. Actions taken by the Federal Reserve, including changes in its target funds rate, balance sheet management, and lending facilities are beyond the Company's control and difficult to predict. These actions can affect interest rates and the value of financial instruments and other assets and liabilities and can impact the Company's borrowers. Sudden changes in monetary policy, for example in response to high inflation, could lead to financial market volatility, increases in market interest rates, and a flattening or inversion of the yield curve. For example, higher inflation, or volatility and uncertainty related to inflation, could reduce demand for the Company's products, adversely affect the creditworthiness of the Company's borrowers, or result in lower values for the Company's investment securities and other interest-earning assets. Changes to existing U.S. laws and regulatory policies and evolving priorities, including those related to financial regulation, consumer compliance, taxation, fiscal policy, climate change, and healthcare, may adversely impact U.S. or global economic activity and the Company's customers and its earnings and operations. For example, a slowdown in consumer demand due to increased inflation could limit the ability of firms to pass on fast-rising costs for labor, transportation and other inputs, weighing on earnings and potentially leading to an equity market downturn. Significant fiscal policy changes and/or initiatives may also raise the federal debt, affect businesses and household after-tax incomes and increase uncertainty surrounding the formulation and direction of U.S. monetary policy and volatility of interest rates. Any of these developments could adversely affect the Company's consumer and commercial businesses, its customers, its securities portfolios, including the risk of lower re-investment rates within those portfolios, its level of loan net charge-offs and provision for credit losses, the carrying value of its deferred tax assets, its capital levels, its liquidity and its results of operations.

The Company relies heavily on existing and emerging communications and information systems to conduct its business. Despite the Company's security measures and business continuity plans, the Company and its third party service providers may be the subject of sophisticated and targeted attacks intended to obtain unauthorized access to assets or confidential information, destroy data, disable or degrade service, or sabotage systems, often through the introduction of computer viruses or malware, ransomware, phishing attacks, cyber-attacks, or breaches due to errors or malfeasance by employees, contractors and others who have access to or obtain unauthorized access to the Company's systems and networks. The methods used to obtain unauthorized access, disable or degrade service or sabotage systems are constantly evolving and may be difficult to anticipate or to detect for long periods of time. The constantly changing nature of the threats means that the Company may not be able to prevent all data security breaches or misuse of data. Any failure, interruption or breach in security of these systems could result in failures or disruptions in the Company's online banking system, its general ledger, and its deposit and loan servicing and origination systems or other systems. Furthermore, if personal, confidential or proprietary information of customers or clients in the Company's or third party service providers' possession were to be mishandled or misused, the Company could suffer significant regulatory consequences, reputational damage and financial loss. Such mishandling or misuse could include circumstances where, for example, such information was erroneously provided to parties who are not permitted to have the information, either by fault of the Company's systems, employees, or counterparties, or where such information was intercepted or otherwise inappropriately taken by third parties. The Company has policies and procedures designed to prevent or limit the effect of the possible failure, interruption or security breach of its information systems; however, any such failure, interruption or security breach could adversely affect the Company's business and results of operations through loss of assets or by requiring it to expend significant resources to correct the defect, as well as exposing the Company to customer dissatisfaction and civil litigation, regulatory fines or penalties or losses not covered by insurance.