Item 1. Business
ITEM 1. BUSINESS
General
The Corporation was incorporated on January 2, 1985 under the laws of the State of New York and is headquartered in Elmira, NY. The Corporation was organized for the purpose of acquiring the Bank. The Bank was established in 1833 under the name Chemung Canal Bank, and was subsequently granted a New York State bank charter in 1895. In 1902, the Bank was reorganized as a New York State trust company under the name Elmira Trust Company, and its name was changed to Chemung Canal Trust Company in 1903.
The Corporation became a financial holding company in June 2000. Financial holding company status provided the Corporation with the flexibility to offer an array of financial services, such as insurance products, mutual funds, and brokerage services, which provide additional sources of fee-based income and allow the Corporation to better serve its customers. The Corporation established a financial services subsidiary, CFS, in September 2001 which offers non-banking financial services such as mutual funds, annuities, brokerage services, insurance and tax preparation services. The Corporation established a captive insurance subsidiary, CRM, based in the State of Nevada in May 2016, which insures gaps in commercial coverage and uninsured exposures in the Corporation's current insurance coverages and allows the Corporation to strengthen its overall risk management program.
The Corporation’s Board of Directors has concluded that the expansion of the franchise’s geographic footprint, an increase in the Bank’s interest earning assets, and the generation of new sources of non-interest income are important components of its strategic plan. Over the last 14 years, the Corporation and the Bank have completed the following transactions to grow the franchise:
• On March 14, 2008, the Bank acquired three branches from Manufacturers and Traders Trust Company in Broome and Tioga counties in New York. At the time of the acquisition, the Bank assumed $64.4 million in deposits and acquired $12.6 million in loans.
• On May 29, 2009, the Corporation acquired Canton Bancorp, Inc., the holding company of Bank of Canton based in Canton, Pennsylvania. At the time of the merger, Canton Bancorp, Inc. had $81.1 million in assets, $58.8 million in loans and $72.9 million in deposits.
• On April 8, 2011, the Corporation acquired FOFC, the holding company of Capital Bank & Trust Company based in Albany, New York. At the time of the merger, Capital Bank had $254.4 million in assets, $170.7 million in loans and $199.2 million in deposits.
• On November 23, 2013, the Bank completed the acquisition of six branch offices from Bank of America located in Cayuga, Cortland, Seneca, and Tompkins counties in New York. As part of the transaction, the Corporation acquired $177.7 million in deposits and $1.2 million in loans.
• As of April 2, 2021, the Corporation received all regulatory approvals to operate a branch office in a new market in the Buffalo Metropolitan Area.
As a result of these transactions and organic growth, the Corporation had $2.646 billion in consolidated assets, $1.829 billion in loans, $2.327 billion in deposits, and $166.4 million in shareholders’ equity at December 31, 2022.
Growth Strate g y
The Corporation’s growth strategy is to leverage its branch and digital network in current or new markets to build client relationships and grow loans and deposits. Consistent with the Corporation’s community-banking model, emphasis is placed on acquiring stable, low-cost deposits, such as checking account deposits and other low interest-bearing deposits to fund high-quality loans. The Corporation evaluates potential acquisition targets based on the economic viability of their markets, the degree to which they can be effectively integrated into the Corporation’s current operations, and the degree to which they are accretive to capital and earnings.
6
Description of Business
The Corporation, through the Bank and CFS, provides a wide range of financial services, including demand, savings and time deposits, commercial, residential and consumer loans, interest rate swaps, letters of credit, wealth management services, employee benefit plans, insurance products, mutual funds and brokerage services. The Bank derives its income primarily from interest and fees on loans, interest on investment securities, WMG fee income, and fees received in connection with deposit and other services. The Bank’s operating expenses are interest expense paid on deposits and borrowings, salaries and employee benefit plans, and general operating expenses.
CRM, a wholly-owned subsidiary of the Corporation which was formed and began operations on May 31, 2016, is a Nevada-based captive insurance company which insures against certain risks unique to the operations of the Corporation and its subsidiaries and for which insurance may not be currently available or economically feasible in today's insurance marketplace. CRM pools resources with several other similar insurance company subsidiaries of financial institutions to spread a limited amount of risk among themselves. CRM is subject to regulations of the State of Nevada and undergoes periodic examinations by the Nevada Division of Insurance.
In order to compete with other financial services companies, the Corporation relies upon personal relationships established with clients by its officers, employees, and directors. The Corporation has maintained a strong community orientation by supporting the active participation of officers and employees in local charitable, civic, school, religious, and community development activities. The Corporation believes that its emphasis on local relationship banking together with a prudent approach to lending are important factors in its success and growth.
For additional information, including information concerning the results of operations of the Corporation and its subsidiaries, see Management's Discussion and Analysis of Financial Condition and Results of Operations in Part II, Item 7. There were no material changes in the manner of doing business by the Corporation or its subsidiaries during the fiscal year ended December 31, 2022.
Lending Activities
Lending Strategy
The Corporation’s objective is to channel deposits gathered locally into high-quality, market-yielding loans without taking unacceptable credit and/or interest rate risk. The Corporation seeks to have a diversified loan portfolio consisting of commercial and agricultural loans, commercial mortgages, residential mortgages, home equity lines of credit and home equity term loans, direct consumer loans, and indirect automobile loans. The Bank operates with a traditional community bank model where the relationship manager possesses credit skills and has significant influence over credit decisions. This creates value since clients and prospects know they are dealing with a decision maker.
Lending Authority
The Board of Directors establishes the lending policies, underwriting standards, and loan approval limits of the Bank. In accordance with those policies, the Board of Directors has designated certain officers to consider and approve loans within their designated authority. These officers exercise substantial authority over credit and pricing decisions, subject to loan committee approval for larger credits. The Bank recognizes that exceptions to the lending policies may occasionally occur and has established procedures for approving exceptions to these policies.
In underwriting loans, primary emphasis is placed on the borrower’s financial condition, including ability to generate cash flow to support the debt and other cash expenses. In addition, substantial consideration is given to collateral value and marketability as well as the borrower’s character, reputation and other relevant factors. Interest rates charged by the Bank vary with degree of risk, type, size, complexity, repricing frequency, and other relevant factors associated with the loans. Competition from other financial services companies also impacts interest rates charged on loans.
The Corporation has also implemented reporting systems to monitor loan originations, loan quality, concentration of credit, loan delinquencies, non-performing loans, and potential problem loans.
7
Lending Segments
The Bank segments its loan portfolio into the following major lending categories: (i) commercial and agricultural, (ii) commercial mortgages, (iii) residential mortgages, and (iv) consumer loans.
Commercial and agricultural loans primarily consist of loans to small to mid-sized businesses in the Bank's market area in a diverse range of industries. These loans are of higher risk and typically are made on the basis of the borrower’s ability to make repayment from the cash flow of the borrower’s business. Further, the collateral securing the loans may depreciate over time, may be difficult to appraise, and may fluctuate in value. The credit risk related to commercial loans is largely influenced by general economic conditions and the resulting impact on a borrower’s operations or on the value of underlying collateral, if any.
Commercial mortgage loans generally have larger balances and involve a greater degree of risk than residential mortgage loans, and they, therefore, pose higher potential losses on an individual customer basis. Loan repayment is often dependent on the successful operation and management of the properties and/or the businesses occupying the properties, as well as on the collateral securing the loan. Economic events or conditions in the real estate market could have an adverse impact on the cash flows generated by properties securing the Bank’s commercial real estate loans and on the value of such properties.
The Bank offers interest rate swaps to certain larger commercial mortgage borrowers. These swaps allow the Bank to originate a mortgage based on short-term LIBOR rates and allow the borrower to swap into a longer term fixed rate. The Bank simultaneously sells an offsetting back-to-back swap to an investment grade national bank so that it does not retain this fixed-rate risk. The swap agreements are free-standing derivatives and are recorded at fair value in the Bank's consolidated balance sheets. In December 2020, the administrator of LIBOR announced its intention to (i) cease the publication of the one-week and two-month U.S. dollar LIBOR after December 31, 2021, and (ii) cease the publication of all other tenors of U.S. dollar LIBOR (one, three, six and 12 month LIBOR) after June 30, 2023. Guidance from the FRB and other regulatory agencies indicated that no new contracts should be entered into after December 31, 2021 that reference LIBOR. The Corporation has transitioned to the use of SOFR or other acceptable reference rates for new loans originated. Additionally, existing contracts that reference LIBOR are being systematically transitioned to SOFR or other acceptable reference rates in advance of the June 30, 2023 end date.
The Bank offers fixed-rate and adjustable-rate residential mortgage loans to individuals with maturities of up to 30 years that are fully amortizing with monthly loan payments. Mortgages are generally underwritten according to U.S. government sponsored enterprise guidelines designated as "A" or "A-" and referred to as "conforming loans". The Bank also originates jumbo loans above conforming loan amounts which generally are consistent with secondary market guidelines for these loans; however, these are typically held for investment. The Bank does not offer a subprime mortgage lending program. The Bank's secondary market lending is sold on a servicing-retained basis. Residential mortgage loans are generally made on the basis of the borrower’s ability to make repayment from his or her employment and other income, and are secured by real property whose value tends to be more easily ascertainable. Credit risk for these types of loans is generally influenced by general economic conditions, the characteristics of individual borrowers, and the nature of the loan collateral.
The consumer loan segment includes home equity lines of credit and home equity loans, which exhibit many of the same risk characteristics as residential mortgages. Indirect and other consumer loans may entail greater credit risk than residential mortgage and home equity loans, particularly in the case of other consumer loans which are unsecured or, in the case of indirect consumer loans, secured by depreciable assets, such as automobiles, recreational vehicles, or boats. In such cases, any repossessed collateral for a defaulted consumer loan may not provide an adequate source of repayment of the outstanding loan balance. In addition, consumer loan collections are dependent on the borrower’s continuing financial stability, thus are more likely to be affected by adverse personal circumstances such as job loss, illness, or personal bankruptcy. Furthermore, the application of various federal and state laws, including bankruptcy and insolvency laws, may limit the amount which can be recovered on such loans.
Funding Activities
Funding Strategy
The Corporation’s deposit strategy is to fund the Bank with stable, low-cost deposits, primarily checking account deposits and low interest-bearing deposit accounts. A checking account is the driver of a banking relationship and consumers consider the bank where they have their checking account as their primary bank. These customers will typically turn to their primary bank first when in need of other financial services. The Corporation also considers brokered deposits to be an element of its deposit strategy and anticipates that it will continue using brokered deposits as a secondary source of funding to support growth. Borrowings may be used on a short-term basis for liquidity purposes or on a long-term basis to fund asset growth.
8
Funding Sources
The Corporation’s primary sources of funds are deposits, principal and interest payments on loans and securities, borrowings and funds generated from operations of the Bank. The Bank also has access to advances from the FHLBNY, other financial institutions, and the FRBNY. Contractual loan payments are a relatively stable source of funds, while deposit inflows and outflows and loan prepayments are significantly influenced by general market interest rates and economic conditions.
The Corporation considers core deposits, consisting of non-interest-bearing and interest-bearing checking accounts, savings accounts, and insured money market accounts, to be a significant component of its deposits. The Corporation monitors the activity on these core deposits and, based on historical experience and pricing strategy, believes it will continue to retain a large portion of such accounts. The Bank is currently not limited with respect to the rates that it may offer on deposit products. The Bank believes it is competitive in the types of accounts and interest rates it has offered on its deposit products. The Bank regularly evaluates the internal cost of funds, surveys rates offered by competitors, reviews cash flow requirements for lending and liquidity, and executes rate changes when necessary as part of its asset/liability management, profitability and growth strategies.
The flow of deposits is influenced significantly by general economic conditions, changes in prevailing interest rates and competition. The Bank’s deposits are obtained predominantly from the areas in which its retail offices are located. The Bank relies primarily on customer service, long-standing relationships and other banking services, including loans and wealth management services, to attract and retain these deposits. However, market interest rates and rates offered by competing financial institutions affect the Bank’s ability to attract and retain deposits. The Bank utilizes a combination of traditional media, including print, television, and radio, as well as digital advertising, such as social media, display, OTT (over-the-top) streaming and eBlasts, when advertising its deposit products.
Investment Activities
The general objective of the Bank's investment portfolio is to provide liquidity when loan demand is high, and to absorb excess funds when demand is low. The securities portfolio also provides a medium for certain interest risk measures intended to maintain an appropriate balance between interest income from loans and total interest income. The Bank only invests in high-quality investment-grade securities such as mortgage-backed securities and obligations of states and political subdivisions. Investment decisions are made in accordance with the Bank's investment policy and include consideration of risk, return, duration, and portfolio concentrations.
Derivative Financial Instruments
The Bank offers interest rate swaps to commercial loan customers who wish to fix the interest rates on their loans, and the Bank matches these swaps using offsetting swaps with national bank counterparties. These swaps are considered free standing derivatives and are carried at fair value on the consolidated balance sheet, with gains and losses recorded through other non-interest income. The swaps are not designated as hedging derivatives. Additionally, the Bank participates in risk participation agreements with dealer banks on commercial loans in which it participates. The Bank may receive an upfront fee for participating in the credit exposure of the interest rate swap associated with the commercial loan in which it is a participant and the fee received is recognized immediately in other non-interest income. The Bank is exposed to its share of the credit loss equal to the fair value of the interest rate swap in the event of nonperformance by the counterparty of the interest rate swap.
The Bank has a policy for managing its derivative financial instruments, and the policy and program activity are overseen by the ALCO. Under the policy, derivative financial instruments with counterparties, who are not customers, are limited to a national financial institution. Cash and/or certain qualified securities are required to serve as collateral when exposures exceed $100 thousand, with a minimum collateral coverage of $150 thousand. The credit worthiness of the customer is reviewed internally by the Bank's credit department.
Wealth Management Strategy
With $2.053 billion of assets under management or administration at December 31, 2022, including $346.5 million of assets held under management or administration for the Corporation, WMG is responsible for the largest component of the Corporation's non-interest income. Wealth management services provided by the Bank include services as executor and trustee under wills and agreements, and guardian, custodian, trustee, and agent for pension, profit-sharing and other employee benefit trusts, as well as various investment, pension, estate planning, and employee benefit administrative services. The Corporation’s growth strategy also includes the acquisition of trust businesses to generate new sources of fee income.
9
Market Area and Competition
The Bank operates 31 branch offices located in 13 counties in New York and Bradford County in Pennsylvania. Bank branch offices are located in the following New York counties: Chemung, where the Bank is headquartered, Broome, Cayuga, Cortland, Erie, Schuyler, Seneca, Steuben, Tioga and Tompkins. The Bank also operates under the name “Capital Bank, a division of Chemung Canal Trust Company,” with branch offices located in Albany, Saratoga, and Schenectady counties in New York.
Albany, Saratoga, and Schenectady counties rely heavily on business related to New York State government activities, the nanotechnology industry, and colleges located within these counties. Tompkins County is dominated by the presence of Cornell University and Ithaca College. The world headquarters of Corning Incorporated, the region’s largest employer, is located in Steuben County. The remaining New York counties have a combination of service, small manufacturing and tourism-related businesses, with colleges located in Broome, Chemung, and Cortland counties. Bradford County's largest employers are a combination of service and small manufacturing businesses, along with the natural gas industry.
During 2021, the Corporation entered a new market in the Buffalo Metropolitan Area. After New York City, this region is the second largest population center in New York State. Erie County has a diverse mix of industrial, light manufacturing, high technology and service-oriented private sector companies. The region also has reliance on higher education with the University of Buffalo, Buffalo State College as well as several private colleges. The region's largest employers are affiliated with the healthcare industry, primarily located in the medical corridor.
Within all these market areas, the Bank encounters intense competition in the lending and deposit gathering aspects of its business from local, regional and national commercial banks and thrift institutions, credit unions, and other providers of financial services such as brokerage firms, investment companies, insurance companies, and Fintech, and internet banking entities. The Bank also competes with non-financial institutions, including retail stores and certain utilities that maintain their own credit programs, as well as governmental agencies that make loans to certain borrowers. Many of these competitors are not subject to regulation as extensive as that affecting the Bank and, as a result, may have a competitive advantage over the Bank in certain respects. This is particularly true of credit unions because their pricing structure is not encumbered by the payment of income taxes.
Similarly, the competition for the Bank's wealth management services is primarily from local offices of national brokerage firms, independent investment advisors, national and regional banks, as well as internet based brokerage and advisory firms. The Bank operates full-service wealth management centers in Chemung, Broome, and Albany counties in New York.
Human Capital Resources
In order to accomplish our mission to remain a strong financial-services organization and create value for shareholders, clients, employees and the communities we serve, we must attract and retain the highest quality talent in each of our markets. We offer an inclusive, safe and healthy work environment, maintain the highest standards of business ethics and provide opportunities for career development and advancement, along with a competitive benefits package.
Employee Profile
As of December 31, 2022 we employed 340 full time equivalent employees in 31 locations in New York and Pennsylvania. None of our employees are represented by any collective bargaining unit or is a party to a collective bargaining agreement. We believe our relationship with our employees to be good. As of December 31, 2022 our workforce was 72% female and 28% male, and our average tenure was 8.1 years. Our Executive Management Team has an average tenure of 13.5 years. We continue to focus on diversity and inclusion among our workforce.
Total Rewards
We offer a competitive total rewards package for all employees, including competitive base pay, incentive plans for all employees, a 401(k) match, a non-discretionary company 401(k) contribution, health, dental, and vision insurance, life insurance, company contributions to a health savings account, paid time off, family leave, flexible work schedules, tuition reimbursement, and the opportunity to volunteer in the community during work hours.
10
Health and Safety
The health, safety and well-being of our employees is paramount to the success of our business. In addition to our insurance offerings and leave programs, we offer an employee assistance program, along with welfare programs, fitness reimbursement, and an on-site flu-shot clinic. In response to the COVID-19 pandemic the Corporation made arrangements for many employees to work remotely, installed safety shields, provided on-going safety messaging, posted COVID-19 awareness literature in common areas, enhanced our cleaning protocol, set up screening stations in all locations, worked closely with the Department of Health, and followed all state, local and CDC guidelines. At this time of this filing, some pandemic-related modified business practices remain in place, such as remote work and flexible work schedules.
Talent
We believe investing in our employees not only helps with retention, but also keeps employees engaged and focused. We encourage all employees to join career circles, find a mentor, apply for our leadership program, job shadow, attend diversity, equity and inclusion, and supervisor discussions, and other trainings offered. The success of our company depends on the success of our employees.
Available Information
The SEC maintains a website at www.sec.gov that contains reports, proxy and information statements, and other information regarding the Corporation. In addition, the Corporation maintains a corporate website at www.chemungcanal.com. The Corporation makes available free of charge through the Bank's website its annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and any amendments to those reports filed with the SEC pursuant to Section 13(a) or 15(d) of the Exchange Act. These items are available as soon as reasonably practicable after we electronically file or furnish such material with the SEC. The contents of the Bank's website are not a part of this report. These materials are also available free of charge by written request to: Kathleen S. McKillip, Corporate Secretary, Chemung Financial Corporation, One Chemung Canal Plaza, Elmira, NY 14901.
Supervision and Regulation
The Corporation and the Bank are subject to comprehensive regulation, supervision and examination by regulatory authorities. Numerous statutes and regulations apply to the Corporation’s and, to a greater extent, the Bank’s operations, including required reserves, investments, loans, deposits, issuances of securities, payments of dividends, and establishment of branches. Set forth below is a brief description of some of these laws and regulations. The description does not purport to be complete, and is qualified in its entirety by reference to the text of the applicable laws and regulations.
The Corporation
Bank Holding Company Act
The Corporation is a bank holding company registered with, and subject to regulation and examination by, the FRB pursuant to the BHCA, as amended. The FRB regulates and requires the filing of reports describing the activities of bank holding companies, and conducts periodic examinations to test compliance with applicable regulatory requirements. The FRB has enforcement authority over bank holding companies, including, among other things, the ability to assess civil money penalties, to issue cease and desist or removal orders, and to require a bank holding company to divest subsidiaries.
The Corporation generally may engage in the activities permissible for a bank holding company, which includes banking, managing or controlling banks, performing certain servicing activities for subsidiaries, and engaging in other activities that the FRB has determined to be so closely related to banking as to be a proper incident thereto, as set forth in the FRB's Regulation Y. As the Corporation has elected financial holding company status, it may also engage in a broader range of activities that are determined by the FRB and the Secretary of the Treasury to be financial in nature or incidental to financial activities or, with the prior approval of the FRB, activities that are determined by the FRB to be complementary to a financial activity and that do not pose a substantial risk to the safety and soundness of depository institutions or the financial system generally.
The BHCA prohibits a bank holding company from acquiring direct or indirect ownership or control of more than 5% of the voting shares of any bank, or increasing such ownership or control of any bank, without the prior approval of the FRB.
11
Interstate Banking and Branching
Under the Riegle-Neal Act, subject to certain concentration limits and other requirements, adequately capitalized bank holding companies, such as the Corporation, are permitted to acquire banks and bank holding companies located in any state. Any bank that is a subsidiary of a bank holding company is permitted to receive deposits, renew time deposits, close loans, service loans, and receive loan payments as an agent for any other bank subsidiary of that bank holding company. Subject to certain conditions, banks are permitted to acquire branch offices outside of their home states by merging with out-of-state banks, purchasing branches in other states, and establishing de novo branch offices in other states.
In April 2008, banking regulators in the states of New Jersey, New York, and Pennsylvania entered into a Memorandum of Understanding (the "Interstate MOU") to clarify their respective roles, as home and host state regulators, regarding interstate branching activity on a regional basis pursuant to the Riegle-Neal Amendments Act of 1997. The Interstate MOU established the regulatory responsibilities of the respective state banking regulators regarding bank regulatory examinations and is intended to reduce the regulatory burden on state-chartered banks branching within the region by elimination duplicative host state compliance exams.
Under the Interstate MOU, the activities of branches the Bank established in Pennsylvania would be governed by New York state law to the same extent that the Federal law governs the activities of the branch of an out-of-state national bank in such host states. Issues regarding whether a particular host state law is preempted are to be determined in the first instance by the NYSDFS. In the event that the NYSDFS and the applicable host state regulator disagree regarding whether a particular host state law is pre-empted, the NYSDFS and the applicable host state regulator would use their reasonable best efforts to consider all points of view to resolve the disagreement.
New York Law
The Corporation is organized under New York law and is subject to the New York Business Corporation Law, which governs the rights and obligations of directors and shareholders and other corporate matters.
The Corporation is also a bank holding company as defined in the New York Banking Law by virtue of its ownership and control of the Bank. Generally, this means that the NYSDFS must approve the Corporation’s acquisition of control of other banking institutions and similar transactions.
Federal Securities Law
The Corporation is subject to the information, reporting, proxy solicitation, insider trading, and other rules contained in the Exchange Act, the disclosure requirements of the Securities Act and the regulations of the SEC thereunder. In addition, the Corporation must comply with the corporate governance and listing standards of the Nasdaq Stock Market to maintain the listing of its common stock on the exchange. These standards include rules relating to a listed company's board of directors, audit committees and independent director oversight of executive compensation, the director nomination process, a code of conduct and shareholder meetings.
The SEC has adopted certain proxy disclosure rules regarding executive compensation and corporate governance, with which the Corporation must comply. They include: (i) disclosure of total compensation of key officers of the Corporation, including disclosure of restricted and unrestricted stock awards compensation; (ii) disclosure regarding any potential conflict of interest of any compensation consultants of the Corporation; (iii) disclosure regarding audit and compensation committee independence and experience, qualifications, skills and diversity of its directors and any director nominees; (iv) “say-on-pay” disclosure; (v) pay vs. performance disclosure; and (vi) information relating to the leadership structure of the Corporation’s Board of Directors and the Board of Directors' role in the risk management process.
Sarbanes-Oxley
The Corporation is also subject to Sarbanes-Oxley. Sarbanes-Oxley established laws affecting public companies’ corporate governance, accounting obligations, and corporate reporting by: (i) creating a federal accounting oversight body; (ii) revamping auditor independence rules; (iii) enacting corporate responsibility and governance measures; (iv) enhancing disclosures by public companies, their directors, and their executive officers; (v) strengthening the powers and resources of the SEC; and (vi) imposing criminal and civil penalties for securities fraud and related wrongful conduct.
12
The SEC has adopted regulations under Sarbanes-Oxley, including: (i) executive compensation disclosure rules; (ii) standards of independence for directors who serve on the Corporation’s audit committee; (iii) disclosure requirements as to whether at least one member of the Corporation’s audit committee qualifies as a “financial expert” as defined in SEC regulations; (iv) whether the Corporation has adopted a code of ethics applicable to its chief executive officer, chief financial officer, or those persons performing similar functions; (v) and disclosure requirements regarding the operations of Board of Directors' nominating committees and the means, if any, by which security holders may communicate with directors.
Support of Subsidiary Banks
The Dodd-Frank Act, discussed in the section of this document entitled “Additional Important Legislation and Regulation,” codifies the FRB’s long-standing policy of requiring bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. Accordingly, the Corporation is expected to commit resources to support its banking subsidiaries, including at times when it may not be advantageous for the Corporation to do so.
Capital Distributions
A bank holding company is generally required to give the FRB prior written notice of any purchase or redemption of then outstanding equity securities if the gross consideration for the purchase or redemption, when combined with the net consideration paid for all such purchases or redemptions during the preceding 12 months, is equal to 10% or more of the company’s consolidated net worth. The FRB may disapprove such a purchase or redemption if it determines that the proposal would constitute an unsafe and unsound practice, or would violate any law, regulation, FRB order or directive, or any condition imposed by, or written agreement with, the FRB. There is an exception to this approval requirement for well-capitalized bank holding companies that meet certain other conditions.
The FRB has issued a policy statement regarding capital distributions, including dividends, by bank holding companies. In general, the FRB’s policies provide that dividends should be paid only out of current earnings and only if the prospective rate of earnings retention by the bank holding company appears consistent with the organization’s capital needs, asset quality and overall financial condition. Under applicable laws, the ability of a bank holding company to pay dividends may be restricted if a subsidiary bank becomes undercapitalized. In addition, the FRB has issued guidance which requires consultation with the agency prior to a bank holding company’s payment of dividends or repurchase or redemption of its stock under certain circumstances. These regulatory policies could affect the ability of the Corporation to pay dividends, repurchase its stock or otherwise engage in capital distributions.
The Bank
General
The Bank is a commercial bank chartered under the laws of New York State and is supervised by the NYSDFS. The Bank also is a member bank of the FRB and, therefore, the FRB serves as its primary federal regulator. The FDIC insures the Bank’s deposit accounts up to applicable limits. The Bank must file reports with the FFIEC, the FRB and the FDIC concerning its activities and financial condition and must obtain regulatory approval before commencing certain activities or engaging in transactions such as mergers and other business combinations or the establishment, closing, purchase or sale of branch offices. This regulatory structure gives the regulatory authorities extensive discretion in the enforcement of laws and regulations and the supervision of the Bank.
Loans to One Borrower
The Bank generally may not make a loan or extend credit to a single or related group of borrowers in excess of 15% of its unimpaired capital and surplus. Up to an additional 10% of unimpaired capital and surplus can be lent if the additional amount is fully secured by certain readily marketable collateral. At December 31, 2022, the Bank’s legal lending limit on loans to one borrower was $34.9 million for loans not fully secured by readily marketable collateral and $38.4 million for loans secured by readily marketable collateral. The Bank’s internal limit on loans is set at $15.0 million. At December 31, 2022, the Bank did not have any loans or agreements to extend credit to a single or related group of borrowers in excess of its legal lending limit.
13
Branching
Subject to the approval of the NYSDFS and FRB, New York-chartered member commercial banks may establish branch offices anywhere within New York State, except in communities having populations of less than 50,000 inhabitants in which another New York-chartered commercial bank or a national bank has its principal office. Additionally, under the Dodd-Frank Act, state-chartered banks may generally branch into other states to the same extent as commercial banks chartered under the laws of that state may branch.
Payment of Dividends
The Bank is subject to substantial regulatory restrictions affecting its ability to pay dividends to the Corporation. Under FRB and NYSDFS regulations, the Bank may not pay a dividend without prior approval of the FRB and the NYSDFS if the total amount of all dividends declared during such calendar year, including the proposed dividend, exceeds the sum of its retained net income to date during the calendar year and its retained net income over the preceding two calendar years. As of December 31, 2022, approximately $49.3 million was available for the payment of dividends by the Bank to the Corporation without prior approval. The Bank's ability to pay dividends also is subject to the Bank being in compliance with regulatory capital requirements. At December 31, 2022, the Bank was in compliance with these requirements.
Standards for Safety and Soundness
The FRB has adopted guidelines prescribing safety and soundness standards. These guidelines establish general standards relating to capital adequacy, asset quality, management, earnings performance, liquidity and sensitivity to market risk. In evaluating these safety and soundness standards, the FRB considers internal controls and information systems, internal audit systems, loan documentation, credit underwriting, exposure to changes in interest rates, asset growth, compensation, fees, and benefits. In general, the guidelines require appropriate systems and practices to identify and manage the risks and exposures specified in the guidelines. The FRB may order an institution that has been given notice that it is not satisfying these safety and soundness standards to submit a compliance plan, and if an institution fails to do so, the FRB must issue an order directing action to correct the deficiency and may issue an order directing other action. If an institution fails to comply with such an order, the FRB may seek to enforce such order in judicial proceedings and to impose civil money penalties.
Real Estate Lending Standards
The FRB has adopted guidelines that generally require each FRB state member bank to establish and maintain written internal real estate lending standards that are consistent with safe and sound banking practices and appropriate to the size of the bank and the nature and scope of its real estate lending activities. The standards also must be consistent with accompanying FRB guidelines, which include loan-to-value ratios for the different types of real estate loans.
Transactions with Related Parties
The Federal Reserve Act governs transactions between the Bank and its affiliates, specifically the Corporation, CFS, and CRM. In general, an affiliate of the Bank is any company that controls, is controlled by, or is under common control with the Bank. Generally, the Federal Reserve Act limits the extent to which the Bank or its subsidiaries may engage in “covered transactions” with any one affiliate to 10% of the Bank’s capital stock and surplus, and contains an aggregate limit of 20% of capital stock and surplus for covered transactions with all affiliates. Covered transactions include loans, asset purchases, the issuance of guarantees, and similar transactions. Certain transactions must be collateralized according to the requirements of the statute. In addition, all covered transactions and other transactions between the Bank and its affiliates must be on terms and conditions that are substantially the same as, or at least as favorable to, the Bank.
Section 22(h) of the Federal Reserve Act and its implementing Regulation O restricts a bank's loans to its directors, executive officers, and principal stockholders ("Insiders"). Loans to Insiders (and their related entities) may not exceed, together with all other outstanding loans to such persons and affiliated entities, the Bank's total capital and surplus. Loans to Insiders above specified amounts must receive the prior approval of the Bank's Board of Directors. The loans must be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with unaffiliated persons and that do not involve more than the normal risk of repayment or present other unfavorable features, except that such Insiders may receive preferential loans made under a benefit or compensation program that is widely available to the Bank's employees and does not give preference to the Insider over the employees. Loans to executive officers are subject to additional restrictions on the types and amounts of permissible loans.
14
Deposit Insurance
The FDIC insures the deposits of the Bank up to regulatory limits and the deposits are subject to the deposit insurance premium assessments of the DIF. The FDIC currently maintains a risk-based assessment system under which assessment rates vary based on the level of risk posed by the institution to the DIF. Therefore, the assessment rate may change if any of these measurements change.
For institutions of the Bank’s asset size, the FDIC operates a risk-based premium system that determines assessment rates from financial modeling designed to estimate the probability of the bank’s failure over a three-year period. Assessment rates for institutions of the Bank’s size ranged from 1.5 to 30 basis points effective through December 31, 2022. The FDIC has authority to increase insurance assessments and adopted a final rule in October 2022 to increase initial base deposit insurance assessment rates by 2 basis points beginning in the first quarterly assessment period of 2023. As a result, effective January 1, 2023, assessment rates for institutions of the Bank’s size will range from 3.5 to 32 basis points.
Insurance of deposits may be terminated by the FDIC upon a finding that an institution has engaged in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed in writing. Management of the Bank does not know of any practice, condition, or violation that may lead to termination of the Bank’s deposit insurance.
Regulatory Capital Requirements
Federal regulations require banks to meet certain minimum capital standards. The minimum capital standards consist of a common equity Tier 1 (“CET1”) capital ratio of 4.5% of risk-weighted assets, a uniform leverage ratio of 4%, a Tier 1 capital to risk-weighted assets ratio of 6% of risk-weighted assets and a total capital ratio of at least 8% of risk-weighted assets. In order to be considered well-capitalized, the Bank must have a CET1 ratio of 6.5%, a Tier 1 ratio of 8%, a total risk-based capital ratio of 10% and a leverage ratio of 5%. The regulatory standards require unrealized gains and losses on certain “available for sale” securities holdings to be included for purposes of calculating regulatory capital unless a one-time opt-out is exercised. The Bank has exercised this one-time opt-out and therefore excluded unrealized gains and losses on certain “available-for-sale” securities holdings for purposes of calculating regulatory capital. Additional restraints are also imposed on the inclusion in regulatory capital of mortgage-servicing assets, deferred tax assets and minority interests.
Common equity Tier 1 capital is generally defined as common stockholders’ equity, including retained earnings but excluding accumulated other comprehensive income. Tier 1 capital is generally defined as Common equity Tier 1 capital and Additional Tier 1 capital. Additional Tier 1 capital generally includes certain noncumulative perpetual preferred stock and related surplus and minority interests in equity accounts of consolidated subsidiaries. Total capital includes Tier 1 capital and Tier 2 capital. Tier 2 capital is comprised of capital instruments and related surplus meeting specific requirements, and may include cumulative preferred stock, long-term perpetual preferred stock, mandatory convertible securities, subordinated debt and intermediate preferred stock. Also included in Tier 2 capital is the allowance for loan and lease losses limited to a maximum of 1.25% of risk-weighted assets and, for institutions like the Bank that have exercised an opt-out election regarding the treatment of Accumulated Other Comprehensive Income (“AOCI”), up to 45% of net unrealized gains on available-for-sale equity securities with readily determinable fair market values. Additionally, a bank that retains credit risk in connection with an asset sale may be required to maintain additional regulatory capital because of the recourse back to the bank. In assessing an institution’s capital adequacy, the federal regulators take into consideration not only these numeric factors but also qualitative factors as well and has the authority to establish higher capital requirements for individual associations where necessary.
In determining the amount of risk-weighted assets, all assets, including certain off-balance sheet assets, are multiplied by a risk-weight factor assigned by federal regulations based on the risks believed inherent in the type of asset. The capital requirements assign a higher risk weight to asset categories believe to present a great risk. For example, a risk weight of 0% is assigned to cash and U.S. government securities, a risk weight of 50% is generally assigned to prudently underwritten first lien one to four family residential mortgages, a risk weight of 100% is assigned to commercial and consumer loans, a risk weight of 150% is assigned to certain past due loans and a risk weight of between 0% and 600% is assigned to permissible equity interests, depending on certain specified factors.
The regulations limit a banking organization’s capital distributions and certain discretionary bonus payments to executives if the banking organization does not hold a “capital conservation buffer” consisting of 2.5% of common equity Tier 1 capital to risk-weighted assets in addition to the amount necessary to meet its minimum risk-based capital requirements.
15
The Corporation is not subject to FRB consolidated capital requirements applicable to bank holding companies, which are similar to those applicable to the Bank, until it reaches $3.0 billion in assets.
In assessing a state member bank’s capital adequacy, the FRB takes into consideration not only these numeric factors but also qualitative factors, and has the authority to establish higher capital requirements for individual banks where necessary. Prompt corrective action regulations provide five classifications: well capitalized, adequately capitalized, undercapitalized, significantly undercapitalized, and critically undercapitalized, although these terms are not used to represent overall financial condition. The Bank, in accordance with its internal prudential standards, targets as its goal the maintenance of capital ratios which exceed these minimum requirements and that are consistent with its risk profile. As of December 31, 2022, the Bank exceeded all regulatory capital ratios necessary to be considered well capitalized.
On October 29, 2019, the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporations (collectively, the "Federal Agencies") adopted a final rule (the "Final Rule") to simplify the regulatory capital requirements for eligible community banks and holding companies that opt into the Community Bank Leverage Ratio ("CBLR") framework, as required by Section 201 of the Economic Growth, Relief and Consumer Protection Act of 2018.
Under the Final Rule, a depository institution or holding company that satisfies certain qualifying criteria, including having less than $10 billion in average total consolidated assets and a leverage ratio of greater than 9%, would be considered a "qualifying community banking organization" and may elect (but is not required) to use the CBLR framework. If this election is made, the qualifying community banking organization would be considered to have satisfied the Federal Agencies' generally applicable risk-weighted and leverage capital requirements (the "Basel III capital framework") and would be considered to be well-capitalized under the Federal Agencies' prompt corrective action ("PCA") rules. Under the CBLR framework, a qualifying community banking organization would satisfy the regulatory capital requirements by calculating and reporting a single leverage ratio, i.e., the CBLR, which would require significantly less data than needed to calculate the capital ratios, under the Basel III capital framework and eliminate the time consuming need to risk-weight assets. The Final Rule took effect on January 1, 2020. Pursuant to the CARES Act, the federal banking regulators issued final rules to set the community bank leverage ratio at 8% beginning in the second quarter of 2020 through the end of 2020. Beginning in 2021, the community bank leverage ratio increased to 8.5% for the calendar year. Community banks had until January 1, 2022, before the community bank leverage ratio requirement returned to 9%. The Bank has not elected to use the community bank leverage ratio.
Prompt Corrective Action
The FDIA requires the federal banking agencies to resolve the problems of insured banks at the least possible loss to the DIF. The FRB has adopted prompt corrective action regulations to carry out this statutory mandate. The FRB’s regulations authorize, and in some situations, require, the FRB to take certain supervisory actions against undercapitalized state member banks, including the imposition of restrictions on asset growth and other forms of expansion. The prompt corrective action regulations place state member banks in one of the following five categories based on the bank’s capital:
• well-capitalized (at least 5% leverage capital, 6.5% common equity Tier 1 risk-based capital, 8% Tier 1 risk-based capital and 10% total risk-based capital);
• adequately capitalized (at least 4% leverage capital, 4.5% common equity Tier 1 risk-based capital, 6% Tier 1 risk-based capital and 8% total risk-based capital);
• undercapitalized (less than 4% leverage capital, 4.5% common equity Tier 1 risk-based capital, 6% Tier 1 risk-based capital or 8% total risk-based capital);
• significantly undercapitalized (less than 3% leverage capital, 3% common equity Tier 1 risk-based capital, 4% Tier 1 risk-based capital or 6% total risk-based capital); and
• critically undercapitalized (less than 2% tangible capital).
As an institution’s capital decreases within the three undercapitalized categories listed above, the severity of the action that is authorized or required to be taken by the FRB for state member banks under the prompt corrective action regulations increases. All banks are prohibited from paying dividends or other capital distributions or paying management fees to any controlling person if, following such distribution, the bank would be undercapitalized. The FRB is required to monitor closely the condition of an undercapitalized institution and to restrict the growth of its assets.
16
An undercapitalized state member bank is required to file a capital restoration plan with the FRB within 45 days (or other timeframe prescribed by the FRB) of the date the bank receives notice that it is within any of the three undercapitalized categories, and the plan must be guaranteed by its parent holding company, subject to a cap on the guarantee that is the lesser of: (i) an amount equal to 5.0% of the bank’s total assets at the time it was notified that it became undercapitalized; and (ii) the amount that is necessary to restore the bank’s capital ratios to the levels required to be classified as “adequately classified,” as those ratios and levels are defined as of the time the bank failed to comply with the plan. If the bank fails to submit an acceptable plan, it is treated as if it were “significantly undercapitalized.” Banks that are significantly or critically undercapitalized are subject to a wider range of regulatory requirements and restrictions including, with respect to critically undercapitalized status, the appointment of a receiver or conservator within specified periods of time.
The NYSDFS possesses enforcement power over New York State-chartered banks pursuant to New York law. This includes authority to order a New York State bank to, among other things, cease an apparent violation of law, discontinue unauthorized or unsafe banking practices or maintain prescribed books and accounts. Such orders are enforceable by financial penalties. Upon a finding by the NYSDFS that a bank director or officer has violated any law or regulation or continued unauthorized or unsafe practices in conducting its business after having been notified by the NYSDFS to discontinue such violation or practices, such director or officer may be removed from office after notice and an opportunity to be heard. The NYSDFS also has authority to appoint a conservator or receiver (which may be the FDIC) for a bank under certain circumstances.
On June 24, 2021, the Bank and the NYSDFS agreed to the settlement provisions set forth in a Consent Order pertaining to alleged violations of New York’s Fair Lending Law and the federal Equal Credit Opportunity Act relating to the Bank’s indirect automobile lending program. The Bank agreed to pay restitution to impacted borrowers of $53,000 and a civil monetary penalty of $350,000 to NYSDFS. The Bank has been informed by the NYSDFS that the Bank has satisfied all of its obligations under the 2021 Consent Order with the NYSDFS related to the Bank’s indirect automobile lending program.
Under federal law, the FRB possesses authority to bring enforcement actions against member banks and their ‘‘institution-affiliated parties,’’ including directors, officers, employees and, under certain circumstances, a stockholder, attorney, appraiser or accountant. Such enforcement action can occur for matters such as failure to comply with applicable law or regulations or engaging in unsafe or unsound banking practices. Possible enforcement actions range from an informal measure, such as a memorandum of understanding, to formal actions, such as a written agreement, cease and desist order, civil money penalty, capital directive, removal of directors or officers or the appointment of a conservator or receiver. The FRB also possesses authority to bring enforcement actions against bank holding companies, their nonbanking subsidiaries and their “institution-affiliated parties.”
Federal Home Loan Bank
The Bank is also a member of the FHLBNY, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to the rules and requirements of the FHLBNY, including the requirement to acquire and hold shares of capital stock in the FHLBNY. The Bank was in compliance with the rules and requirements of the FHLBNY at December 31, 2022.
Community Reinvestment Act
Under the federal CRA, the Bank, consistent with its safe and sound operation, must help meet the credit needs of its entire community, including low and moderate income neighborhoods. The FRB periodically assesses the Bank's compliance with CRA requirements. The Bank received a “satisfactory” rating for CRA on its last performance evaluation conducted by the FRB as of October 7, 2019.
Fair Lending and Consumer Protection Laws
The Bank must also comply with the federal Equal Credit Opportunity Act and the New York Executive Law, which prohibit creditors from discrimination in their lending practices on bases specified in these statutes. In addition, the Bank is subject to a number of federal statutes and regulations implementing them, which are designed to protect the general public, borrowers, depositors, and other customers of depository institutions. These include the Bank Secrecy Act, the Truth in Lending Act, the Home Ownership and Equity Protection Act, the Truth in Savings Act, the Home Mortgage Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Electronic Funds Transfers Act, the FCRA, the Right to Financial Privacy Act, the Expedited Funds Availability Act, the Flood Disaster Protection Act, the Fair Debt Collection Practices Act, Helping Families Save Their Homes Act, and the Consumer Protection for Depository Institutions Sales of Insurance regulation. The FRB and, in some instances, other regulators, including the U.S. Department of Justice, the FTC, the CFPB and state Attorneys General, may take enforcement action against institutions that fail to comply with these laws.
17
Prohibitions against Tying Arrangements
Subject to some exceptions, regulations under the BHCA and the Federal Reserve Act prohibits banks from extending credit to or offering any other service, or fixing or varying the consideration for such extension of credit or service, on the condition that the customer obtain some additional service from the bank or its affiliates or not obtain services of a competitor of the bank.
Privacy Regulations
Regulations under the Federal Reserve Act generally require the Bank to disclose its privacy policy. The policy must identify with whom the Bank shares its customers’ “nonpublic personal information,” at the time of establishing the customer relationship and annually thereafter. In addition, the Bank must provide its customers with the ability to “opt out” of having their personal information shared with unaffiliated third parties and not to disclose account numbers or access codes to non-affiliated third parties for marketing purposes. The Bank’s privacy policy complies with Federal Reserve Act regulations.
The USA PATRIOT Act
The Bank is subject to the USA PATRIOT Act, which gives the federal government powers to address terrorist threats through enhanced domestic security measures, expanded surveillance powers, increased information sharing, and broadened anti-money laundering requirements. The USA PATRIOT Act imposes affirmative obligations on financial institutions, including the Bank, to establish anti-money laundering programs which require: (i) the establishment of internal policies, procedures, and controls; (ii) the designation of an anti-money laundering compliance officer; (iii) ongoing employee training programs; (iv) an independent audit function to test the anti-money laundering program; and (v) due diligence of customers using a risk-based approach. The FRB must consider the Bank’s effectiveness in combating money laundering when ruling on merger and other applications.
CFS
CFS is subject to supervision by other regulatory authorities as determined by the activities in which it is engaged. Insurance activities are supervised by the NYSDFS, and brokerage activities are subject to supervision by the SEC and FINRA.
CRM
CRM is subject to regulations of the State of Nevada and undergoes periodic examinations by the Nevada Division of Insurance.
Additional Important Le g islation and Re g ulation
The Regulatory Relief Act
On May 24, 2018, the Regulatory Relief Act was enacted, which repeals or modifies certain provisions of the Dodd-Frank Act and eases regulations on all but the largest banks. The Regulatory Relief Act’s provisions include, among other things: (i) exempting banks with less than $10 billion in assets from the ability-to-repay requirements for certain qualified residential mortgage loans held in portfolio; (ii) allows usage of Uniform Standards of Professional Appraisal Practice (USPAP) compliant evaluations for certain transactions valued at less than $400,000 in rural areas instead of appraisals, providing specific criteria are met; (iii) exempting banks that originate fewer than 500 open-end and 500 closed-end mortgages from HMDA’s expanded data disclosures; (iv) clarifying that, subject to various conditions, reciprocal deposits of another depository institution obtained using a deposit broker through a deposit placement network for purposes of obtaining maximum deposit insurance would not be considered brokered deposits subject to the FDIC’s brokered-deposit regulations; (v) raising eligibility for the 18-month exam cycle from $1 billion to banks with $3 billion in assets; (vi) allowing qualifying federal savings banks to elect to operate with National Bank powers; and (vii) simplifying capital calculations by requiring regulators to establish for institutions under $10 billion in assets a community bank leverage ratio at a percentage not less than 8% and not greater than 10% that such institutions may elect to replace the general applicable risk-based capital requirements for determining well-capitalized status.
18
The Dodd-Frank Act
The Dodd-Frank Act, enacted on July 21, 2010, significantly changed the bank regulatory landscape and has impacted and will continue to impact the lending, deposit, investment, trading and operating activities of financial institutions and their holding companies. Among other things, the Dodd-Frank Act (i) created the Consumer Financial Protection Bureau as an independent bureau to assume responsibility for the implementation of the federal financial consumer protection and fair lending laws and regulations, a function previously assigned to prudential regulators; (although institutions of less than $10 billion in assets, continue to be examined for compliance with consumer protection and fair lending laws and regulations by, and be subject to the primary enforcement authority of their primary federal bank regulator rather than the Consumer Financial Protection Bureau); (ii) directed changes in the way that institutions are assessed for deposit insurance; (iii) as discussed under “Regulatory Capital Requirements,” mandated the revision of regulatory capital requirements; (iv) codified the FRB’s long-standing policy that a bank holding company must serve as a source of financial and managerial strength for its subsidiary banks; (v) required regulations requiring originators of certain securitized loans to retain a percentage of the risk for the transferred loans; (vi) stipulated regulatory rate-setting for certain debit card interchange fees; (vii) repealed restrictions on the payment of interest on commercial demand deposits; (viii) enacted the so-called Volcker Rule, which generally prohibits banking organizations from engaging in proprietary trading and from investing in, sponsoring or having certain relationships with hedge funds; (ix) contained a number of reforms related to mortgage originations; and (x) as discussed under “Federal Securities Law,” enacted certain proxy disclosures regarding executive compensation and corporate governance.
NYSDFS Cybersecurity Rule
Effective March 1, 2017, the NYSDFS requires New York chartered banks to establish and maintain a cybersecurity program designed to protect consumers and ensure the safety and soundness of the bank. NYSDFS requires regulated financial institutions to establish a cybersecurity program; designed to protect the confidentiality, integrity and availability of its Information Systems; implement and maintain a written policy or policies setting forth its policies and procedures for the protection of its systems and Nonpublic Information stored on those systems; designate a Chief Information Security Officer responsible for implementing, overseeing and enforcing its program and policy; and have policies and procedures designed to ensure the security of information systems and nonpublic information accessible to, or held by Third Party Service Providers.
On November 9, 2022, the NYSDFS released proposed amendments to its cybersecurity regulations that represent a significant update to the regulation of cybersecurity practices. The amendments generally fall within the following five categories: (i) increased mandatory controls associated with common attack vectors, (ii) enhanced requirements for privileged accounts, (iii) enhanced notification obligations, (iv) expansion of cyber governance practices, and (v) additional cybersecurity requirements for larger companies. The proposed amended regulations were subject to a 60-day public comment period which expired on January 9, 2023. Once final regulations are adopted, financial institutions regulated by the NYSDFS, including the Bank, will have 180 days from the effective date, except as otherwise specified, to comply with the new requirements.
Gramm-Leach-Bliley Act
Under the privacy and data security provisions of the Financial Modernization Act of 1999, also known as the GLB Act, and rules promulgated thereunder, all financial institutions, including the Corporation, the Bank and CFS are required to establish policies and procedures to restrict the sharing of nonpublic customer data with nonaffiliated parties at the customer's request and to protect customer data from unauthorized access. In addition, the FCRA, as amended by the FACT Act, includes many provisions affecting the Corporation, Bank, and/or CFS including provisions concerning obtaining consumer reports, furnishing information to consumer reporting agencies, maintaining a program to prevent identity theft, sharing of certain information among affiliated companies, and other provisions. For instance, the FCRA requires persons subject to the FCRA to notify their customers if they report negative information about them to a credit bureau or if they are granted credit on terms less favorable than those generally available. The FRB and the FTC have extensive rulemaking authority under the FACT Act, and the Corporation and the Bank are subject to the rules that have been promulgated by the FRB and FTC thereunder, including recent rules regarding limitations on affiliate marketing and implementation of programs to identify, detect and mitigate the risk of identity theft through red flags. The GLB Act and the FCRA also impose requirements regarding data security and the safeguarding of customer information. The Bank is subject to the Security Guidelines, which implement section 501(b) of the GLB Act and section 216 of the FACT Act. The Security Guidelines establish standards relating to administrative, technical, and physical safeguards to ensure the security, confidentiality, integrity and the proper disposal of customer information.
The Corporation has developed policies and procedures for itself and its subsidiaries to maintain compliance with all privacy, information sharing and notification provisions of the GLB Act and the FCRA.
19
Text extracted from the filing as submitted to EDGAR. Formatting, tables and exhibits are simplified for reading; the original document is authoritative for anything you rely on.