Tompkins Financial Corporation (TMP) Risk Factors

The Company's primary business of financial services involves substantial risk of legal liability. The Company and its subsidiaries are, from time to time, named or threatened to be named as defendants in various lawsuits arising from their respective business activities, including activities of companies they have acquired. In addition, from time to time, the Company is, or may become, the subject of governmental and self-regulatory agency information-gathering requests, reviews, investigations and proceedings and other forms of regulatory inquiry, including by bank regulatory agencies, the SEC and law enforcement authorities. The results of such proceedings could lead to delays in or prohibition to acquire other companies, significant penalties, including monetary penalties, damages, adverse judgments, settlements, fines, injunctions, restrictions on the way in which the Company conducts its business, or reputational harm. Although the Company establishes accruals for legal proceedings when information related to the loss contingencies represented by those matters indicates both that a loss is probable and that the amount of loss can be reasonably estimated, the Company does not have accruals for all legal proceedings where it faces a risk of loss. In addition, due to the inherent subjectivity of the assessments and unpredictability of the outcome of legal proceedings, amounts accrued may not represent the ultimate loss to the Company from the legal proceedings in question. Thus, the Company's ultimate losses may be higher than the amounts accrued for legal loss contingencies, which could adversely affect the Company's financial condition and results of operations.

In the Company's ordinary course of business, it collects and retains large volumes of customer data, including personally identifiable information in various information systems that we maintain and in those maintained by third parties with whom we contract to provide data services. The Company also maintains important internal Company data such as personally identifiable information about its employees and information relating to operations. Customers and employees have been, and will continue to be, targeted by cybersecurity threats attempting to misappropriate confidential information such as passwords, bank account information or other personal or business information. The Company's attempts to mitigate these threats may not be successful as cybercrimes are complex and continue to evolve. A security breach or other significant disruption of our information systems or those related to our customers, merchants and our third-party vendors, including as a result of cyber-attacks and/or human error could result in the unauthorized access to, and destruction, loss, theft, misappropriation or release of confidential, sensitive or otherwise valuable information of ours or our customers. Unauthorized access and/or disclosure of the confidential information of ours or our customers could (i) result in a violation of applicable privacy, data breach and other laws, subjecting us to additional regulatory scrutiny and exposing us to civil litigation, governmental action and possible financial liability; (ii) require significant management attention and resources to remedy the damages that result; and/or (iii) harm our reputation or and/or cause a decrease in the number of customers that choose to do business with us. The occurrence of any of the foregoing could have a material adverse effect on our business, financial condition and results of operations.

We continually monitor our suite of products and services, and prioritize new offerings based on our determination of customer demand, within regulatory parameters for financial products. We may invest significant time and resources in new products which become obsolete, or do not generate the revenues we had anticipated, or which are ultimately deemed unacceptable by regulatory authorities. As we expand the range and complexity of our products and services, we are exposed to increasingly complex risks, including potential fraud, and our employees and risk management systems may not be adequate to mitigate such risks effectively. Our failure to effectively identify and manage these risks and uncertainties could have a material adverse effect on our business.

The Company relies on certain external vendors to provide products and services necessary to maintain the day-to-day operations of the Company. Some of the products and services provided by vendors include key components of our business infrastructure including data processing and storage and internet connections and network access, among other products and services. Accordingly, the Company's operations are exposed to the risk that these vendors will not perform in accordance with the contracted arrangements or under service level agreements. The failure of an external vendor to perform in accordance with the contracted arrangements or under service level agreements, because of changes in the vendor's organizational structure, financial condition, support for existing products and services or strategic focus or for any other reason, could disrupt the Company's operations. If we are unable to find alternative sources for our vendors' services and products quickly and cost-effectively, the failures of our vendors could have a material adverse impact on the Company's business and, in turn, the Company's financial condition and results of operations. Additionally, our information technology and telecommunications systems interface with and depend on third-party systems, and we could experience service denials if demand for such services exceeds capacity or such third-party systems fail or experience interruptions. If sustained or repeated, a system failure or service denial could result in a deterioration of our ability to process new and renewal loans, gather deposits and provide customer service, compromise our ability to operate effectively, damage our reputation, result in a loss of customer business and subject us to additional regulatory scrutiny and possible financial liability, any of which could have a material adverse effect on our financial condition and results of operations.

The Company's operations are heavily concentrated in the New York State and, to a lesser extent, Pennsylvania and, as a result, the Company's financial condition, results of operations and cash flows are significantly impacted by changes in the economic conditions in those areas. Therefore, the Company's financial performance generally, and in particular, the ability of borrowers to pay interest on and repay the principal of outstanding loans and the value of collateral securing these loans, is highly dependent upon the business environment in the markets where the Company operates, particularly New York State and Pennsylvania. The Company's success depends to a significant extent upon the business activity, population, income levels, deposits and real estate activity in these markets. Although the Company's clients' business and financial interests may extend well beyond these markets, adverse economic conditions that affect these markets could disproportionately reduce the Company's growth rate, affect the ability of the Company's clients to repay their loans to the Company, affect the value of collateral underlying loans and generally affect the Company's financial condition and results of operations. Because of the Company's geographic concentration, we are less able than other regional or national financial institutions to diversify our credit risks across multiple markets. For additional information on the Company's market area, see Part I, Item 1, "Business" of this Report on Form 10-K.

As a financial institution, the Company is inherently exposed to operational risk in the form of theft and other fraudulent activity by employees, customers and other third parties targeting the Company and/or the Company's customers or data. Such activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering and other dishonest acts. Although the Company devotes substantial resources to maintaining effective policies and internal controls to identify and prevent such incidents, given the increasing sophistication of possible perpetrators, the Company may experience financial losses or reputational harm as a result of fraud. Fraudulent activity could have a material adverse effect on the Company's business, financial condition and results of operations.

General economic conditions impact the banking and financial services industry. The U.S. and global economies have experienced volatility in recent years and may continue to do so for the foreseeable future. There can be no assurance that economic conditions will not deteriorate. Unfavorable or uncertain economic conditions can be caused by many macro and micro factors, including declines in economic growth, business activity or investor or business confidence, limitations on the availability or increases in the cost of credit and capital, increases in inflation or interest rates, the timing and impact of changing governmental policies, and the impact of widespread protests, civil unrest, wars, pandemics and other public health crises. The Company is particularly affected by U.S. domestic economic conditions, including U.S. interest rates, the unemployment rate, housing prices, the level of consumer confidence, changes in consumer spending, the number of personal bankruptcies and other factors. A decline in U.S. domestic business and economic conditions, without rapid recovery, could have adverse effects on our business, including the following: - consumer and business confidence levels could be lowered and cause declines in credit usage, adverse changes in payment patterns, decreases in demand for loans or other financial products and services and decreases in deposits or investments in accounts with Company;- the Company's ability to assess the creditworthiness of its customers may be impaired if the models and approaches the Company uses to select, manage and underwrite its customers become less predictive of future behaviors;- demand for and income received from the Company's fee-based services, including investment services and insurance commissions and fees, could decline, the cost to the Company to provide any or all products and services could increase, and the levels of assets under management could materially impact revenues from our trust and wealth management businesses; and - the credit quality or value of loans and other assets or collateral securing loans may decrease.

The Company's business, as well as the operations and activities of our clients, could be negatively impacted by climate change. Climate change presents both immediate and long-term risks to the Company and its clients, and these risks are expected to increase over time. Climate change presents multi-faceted risks, including: operational risk from the physical effects of climate events on the Company and its clients' facilities and other assets; credit risk from borrowers with significant exposure to climate risk; transition risks associated with the transition to a less carbon- dependent economy; and reputational risk from stakeholder concerns about our practices related to climate change, the Company's carbon footprint, and the Company's business relationships with clients who operate in carbon-intensive industries. Federal and state banking regulators and supervisory authorities, investors, and other stakeholders have increasingly viewed financial institutions as important in helping to address the risks related to climate change both directly and with respect to their clients, which may result in financial institutions coming under increased pressure regarding the disclosure and management of their climate risks and related lending and investment activities. Given that climate change could impose systemic risks upon the financial sector, either via disruptions in economic activity resulting from the physical impacts of climate change or changes in policies as the economy transitions to a less carbon-intensive environment, the Company may face regulatory risk of increasing focus on the Company's resilience to climate-related risks, including in the context of stress testing for various climate stress scenarios. Ongoing legislative or regulatory uncertainties and changes regarding climate risk management and practices have and may continue to result in higher regulatory, compliance, credit, and reputational risks and costs. With the increased importance and focus on climate change, we are making efforts to enhance our governance of climate change-related risks and integrate climate considerations into our risk governance framework. Nonetheless, the risks associated with climate change are rapidly changing and evolving in an escalating fashion, making them difficult to assess due to limited data and other uncertainties. We could experience increased expenses resulting from strategic planning, litigation, and technology and market changes, and reputational harm as a result of negative public sentiment, regulatory scrutiny, and reduced investor and stakeholder confidence due to our response to climate change and our climate change strategy, which, in turn, could have a material negative impact on our business, results of operations, and financial condition.