NBT Bancorp (NBTB) Risk Analysis

The Company is involved in judicial, regulatory, and arbitration proceedings concerning matters arising from our business activities and fiduciary responsibilities. The Company establishes reserves for legal claims when payments associated with the claims become probable and the costs can be reasonably estimated. We may still incur legal costs for a matter even if a reserve is not established. In addition, the actual cost of resolving a legal claim may be substantially higher than any amounts reserved for that matter. The ultimate resolution of a pending or future legal proceeding, depending on the remedy sought and granted, could materially adversely affect our results of operations and financial condition.

A significant portion of our loan portfolio at December 31, 2023 was secured by real estate. In the course of our business, we may foreclose and take title to real estate and could be subject to environmental liabilities with respect to these properties. We may be held liable to a government entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination or may be required to clean up hazardous or toxic substances, or chemical releases at a property. The costs associated with investigation and remediation activities could be substantial. In addition, if we are the owner or former owner of a contaminated site, we may be subject to common law claims by third parties based on damages and costs resulting from environmental contamination emanating from the property. These costs and claims could adversely affect our business, results of operations, financial condition and liquidity.

From time to time, the Company may implement new lines of business or offer new products and services within existing lines of business. There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and/or new products and services, the Company may invest significant time and resources. Initial timetables for the introduction and development of new lines of business and/or new products or services may not be achieved and price and profitability targets may not prove attainable. External factors, such as compliance with regulations, competitive alternatives and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service. Furthermore, any new line of business and/or new product or service could have a significant impact on the effectiveness of the Company's system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business or new products or services could have a material adverse effect on the Company's business, results of operations and financial condition.

We depend upon data processing, communication systems, and information exchange on a variety of platforms and networks and over the internet to conduct business operations. In addition, we rely on the services of a variety of vendors to meet our data processing and communication needs. Although we require third party providers to maintain certain levels of security, such providers remain vulnerable to breaches, security incidents, system unavailability or other malicious attacks that could compromise sensitive information. The risk of experiencing security incidents and disruptions, particularly through cyber-attacks or cyber intrusions has generally increased as the number, intensity and sophistication of attempted attacks and intrusions by organized crime, hackers, terrorists, nation-states, activists and other external parties has increased. These security incidents may result in disruption of our operations; material harm to our financial condition, cash flows and the market price of our common stock; misappropriation of assets; compromise or corruption of confidential information; liability for information or assets stolen during the incident; remediation costs; increased cybersecurity and insurance costs; regulatory enforcement; litigation; and damage to our stakeholder and customer relationships. Moreover, in the normal course of business, we and our service providers collect and retain certain personal information provided by our customers, employees and vendors. If this information gets mishandled, misused, improperly accessed, lost or stolen, we could suffer significant financial, business, reputational, regulatory or other harm. These risks may increase as we continue to increase and expand our usage of web-based products and applications. These risks require continuous and likely increasing attention and resources from us to, among other actions, identify and quantify potential cybersecurity risks, and upgrade and expand our technologies, systems and processes to adequately address the risk. We provide on-going training for our employees to assist them in detecting phishing, malware and other malicious schemes. Such attention diverts time and resources from other activities and, while we have implemented policies and procedures designed to maintain the security and integrity of the information we and our service providers collect on our and their computer systems, there can be no assurance that our efforts will be effective. Likewise, while we have implemented security measures to prevent unauthorized access to personal information and prevent or limit the effect of possible incidents, we can provide no assurance that a security breach or disruption will not be successful or damaging, or, if any such breach or disruption does occur, that it can be sufficiently or timely remediated. Even the most well protected information, networks, systems and facilities remain potentially vulnerable because the techniques used in such attempted security breaches evolve and generally are not recognized until launched against a target, and in some cases are designed not to be detected and, in fact, may not be detected. Accordingly, we may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures, and thus it is impossible for us to entirely mitigate this risk.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions to serve customers better and to reduce costs. The Company's future success depends, in part, upon its ability to address the needs of its customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in the Company's operations. Many of the Company's competitors have substantially greater resources to invest in technological improvements. The Company may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to its customers. Failure to successfully keep pace with technological changes affecting the financial services industry could have a material adverse impact on the Company's business and, in turn, the Company's financial condition and results of operations.

Our branch locations and our customers' properties may be adversely impacted by flooding, wildfires, high winds and other effects of severe weather conditions that may be caused or exacerbated by climate change. These events can force property closures, result in property damage and/or result in delays in expansion, development or renovation of our properties and those of our customers. Even if these events do not directly impact our properties or our customers' properties, they may impact us and our customers through increased insurance, energy or other costs. In addition, changes in laws or regulations, including federal, state or city laws, relating to climate change could result in increased capital expenditures to improve the energy efficiency of our branch locations and/or our customers' properties. Given that climate change could impose systemic risks upon the financial sector, either via disruptions in economic activity resulting from the physical impacts of climate change or changes in policies as the economy transitions to a less carbon-intensive environment, the Company may face regulatory risk of increasing focus on the Company's resilience to climate-related risks, including in the context of stress testing for various climate stress scenarios. Ongoing legislative or regulatory uncertainties and changes regarding climate risk management and practices may result in higher regulatory, compliance, credit and reputational risks and costs.

The Company faces substantial competition in all areas of its operations from a variety of different competitors, many of which are larger and may have more financial resources. Such competitors primarily include national, regional and community banks within the various markets in which the Company operates. Additionally, various banks continue to enter or have announced plans to enter the market areas in which the Company currently operates. The Company also faces competition from many other types of financial institutions, including, without limitation, savings and loans, credit unions, finance companies, brokerage firms, insurance companies and other financial intermediaries. The financial services industry could continue to become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. Technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. Many of the Company's competitors have fewer regulatory constraints and may have lower cost structures. Additionally, due to their size, many competitors may be able to achieve economies of scale and, as a result, may offer a broader range of products and services as well as better pricing for those products and services than the Company can. The Company's ability to compete successfully depends on a number of factors, including, among other things: - the ability to develop, maintain and build upon long-term customer relationships based on top-quality service, high ethical standards and safe, sound assets;- the ability to expand the Company's market position;- the scope, relevance and pricing of products and services offered to meet customer needs and demands;- the rate at which the Company introduces new products, services and technologies relative to its competitors;- customer satisfaction with the Company's level of service;- industry and general economic trends; and - the ability to attract and retain talented employees. Failure to perform in any of these areas could significantly weaken the Company's competitive position, which could adversely affect the Company's growth and profitability, which, in turn, could have a material adverse effect on the Company's financial condition and results of operations.

As a financial institution, the Company is inherently exposed to operational risk in the form of theft and other fraudulent activity by employees, customers and other third parties targeting the Company and/or the Company's customers or data. Such activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering and other dishonest acts. Although the Company devotes substantial resources to maintaining effective policies and internal controls to identify and prevent such incidents, given the increasing sophistication of possible perpetrators, the Company may experience financial losses or reputational harm as a result of fraud.

The Company relies on third parties to provide key components for its business operations, such as data processing and storage, recording and monitoring transactions, online banking interfaces and services, internet connections and network access. While the Company selects these third party vendors carefully, it does not control their actions. Any problems caused by these third parties, including those resulting from breakdowns or other disruptions in communication services provided by a vendor, failure of a vendor to handle current or higher volumes, cyber-attacks and security breaches at a vendor, failure of a vendor to provide services for any reason or poor performance of services by a vendor, could adversely affect the Company's ability to deliver products and services to its customers and otherwise conduct its business. Financial or operational difficulties of a third party vendor could also hurt the Company's operations if those difficulties interfere with the vendor's ability to serve the Company. Replacing these third party vendors also could create significant delays and expense that adversely affect the Company's business and performance.