NBT BANCORP INC 10-K

ITEM 1. BUSINESS NBT Bancorp Inc. is a registered financial holding company incorporated in the state of Delaware in 1986, with its principal headquarters located in Norwich, New York. The principal assets of NBT Bancorp Inc. consist of all of the outstanding shares of common stock of its subsidiaries, including: NBT Bank, National Association (the “Bank”), NBT Financial Services, Inc. (“NBT Financial”), NBT Holdings, Inc. (“NBT Holdings”), CNBF Capital Trust I, NBT Statutory Trust I, NBT Statutory Trust II, Alliance Financial Capital Trust I, Alliance Financial Capital Trust II and Evans Capital Trust I (collectively, the “Trusts”). The principal sources of revenue for NBT Bancorp Inc. are the management fees and dividends it receives from the Bank, NBT Financial and NBT Holdings. Collectively, NBT Bancorp Inc. and its subsidiaries are referred to herein as (the “Company”). As of December 31, 2025, the Company had assets of $16.00 billion and stockholders’ equity of $1.90 billion on a consolidated basis. The Company’s business, primarily conducted through the Bank, consists of providing commercial banking, retail banking and wealth management services primarily to customers in its market area, which includes upstate New York, northeastern Pennsylvania, southern New Hampshire, western Massachusetts, Vermont, southern Maine and central and northwestern Connecticut. The Company has been, and intends to remain, a community-oriented financial institution offering a variety of financial services. The Company’s business philosophy is to operate as a community bank with local decision-making, providing a broad array of banking and financial services to retail, commercial and municipal customers. The financial condition and operating results of the Company are dependent on its net interest income, which is the difference between the interest and dividend income earned on its earning assets, primarily loans and securities and the interest expense paid on its interest-bearing liabilities, primarily deposits and borrowings. Among other factors, net income is also affected by provision for loan losses and noninterest income, such as service charges on deposit accounts, card services income, retirement plan administration fees, wealth management revenue including financial services and trust revenue, insurance services, bank owned life insurance income and gains/losses on securities sales, as well as noninterest expenses, such as salaries and employee benefits, technology and data services, occupancy, professional fees and outside services, office supplies and postage, amortization of intangible assets, loan collection and OREO expenses, marketing, FDIC assessment expenses and other expenses. NBT Bank, National Association The Bank, a full-service commercial bank formed in 1856, provides a broad range of financial products to individuals, corporations and municipalities through its network of branch locations throughout upstate New York, northeastern Pennsylvania, southern New Hampshire, western Massachusetts, Vermont, southern Maine and central and northwestern Connecticut. Deposit products offered by the Bank include demand deposit accounts, savings accounts, interest-bearing checking accounts, MMDA and CD accounts. The Bank offers various types of each deposit account to accommodate the needs of its customers with varying rates, terms and features. Loan products offered by the Bank include indirect and direct consumer loans, home equity loans, mortgages, business banking loans and commercial loans, with varying rates, terms and features to accommodate the needs of its customers. The Bank also offers various other products and services through its branch network such as trust and investment services and financial planning and life insurance services. In addition to its branch network, the Bank also offers access to certain products and services electronically through 24-hour online, mobile and telephone channels as well as to a network of ATM locations that enable customers to check balances, make deposits, transfer funds, pay bills, access statements, apply for loans and access various other products and services. NBT Financial Services, Inc. Through NBT Financial, the Company operates EPIC Advisors, Inc. (“EPIC”), a national benefits administration firm which was acquired by the Company on January 21, 2005. Among other services, EPIC provides retirement plan administration. EPIC’s headquarters are located in Rochester, New York. NBT Holdings, Inc. Through NBT Holdings, the Company operates NBT Insurance Agency, LLC (“NBT Insurance”), a full-service regional insurance agency acquired by the Company on September 1, 2008. NBT Insurance is headquartered in Norwich, New York. NBT Insurance offers a full array of insurance products, including personal property and casualty, business liability and commercial insurance, tailored to serve the specific insurance needs of individuals as well as businesses in a range of industries operating in the markets served by the Company. 4 Table of Contents The Trusts The Trusts were established to raise additional regulatory capital and to provide funding for certain acquisitions. CNBF Capital Trust I and NBT Statutory Trust I are Delaware statutory business trusts formed in 1999 and 2005, respectively, for the purpose of issuing trust preferred securities and lending the proceeds to the Company. In connection with the acquisition of CNB Bancorp, Inc., the Company formed NBT Statutory Trust II in February 2006 to fund the cash portion of the acquisition as well as to provide regulatory capital. In connection with the acquisition of Alliance Financial Corporation (“Alliance”), the Company acquired two statutory trusts, Alliance Financial Capital Trust I and Alliance Financial Capital Trust II, which were formed in 2003 and 2006, respectively. In connection with the acquisition of Evans Bancorp, Inc. (“Evans”), the Company acquired one statutory trust, Evans Capital Trust I, which was formed in 2004. The Company guarantees, on a limited basis, payments of distributions on the trust preferred securities and payments on redemption of the trust preferred securities. The Trusts are VIEs for which the Company is not the primary beneficiary, as defined by FASB ASC. In accordance with ASC, the accounts of the Trusts are not included in the Company’s consolidated financial statements. Operating Subsidiaries of the Bank The Bank has four operating subsidiaries, NBT Capital Corp., Broad Street Property Associates, Inc., NBT Capital Management, Inc. and SBT Mortgage Service Corporation. NBT Capital Corp., formed in 1998, is a venture capital corporation. Broad Street Property Associates, Inc., formed in 2004, is a property management company. NBT Capital Management, Inc., formerly Columbia Ridge Capital Management, Inc., was acquired in 2016 and is a registered investment advisor that provides investment management and financial consulting services. SBT Mortgage Service Corporation, acquired in 2023 in connection with the Salisbury acquisition, is a passive investment company (“PIC”). The PIC holds loans collateralized by real estate originated or purchased by the Bank. Income of the PIC is exempt from the Connecticut Corporate Business Tax. Evans National Holding Corp., acquired in 2025 in connection with the Evans acquisition, is a real estate investment trust. Segment Reporting The Company has identified two reportable segments: Banking and Retirement Plan Administration. See Note 1 and Note 22 to the consolidated financial statements included in Item 8. Financial Statements and Supplementary Data, which are included elsewhere in this report. Evans Bancorp, Inc. Merger On May 2, 2025, the Company completed the acquisition of Evans, through the merger of Evans with and into the Company, with the Company surviving the merger, and the merger of Evans Bank with and into the Bank, with the Bank as the surviving bank. Total consideration for the acquisition was $221.8 million in common stock. Evans, with assets of $2.19 billion at December 31, 2024, was headquartered in Williamsville, New York. Its primary subsidiary, Evans Bank, was a federally-chartered national banking association operating 18 banking locations in Western New York. The acquisition enhances the Company’s presence in Western New York, including the Buffalo and Rochester communities. In connection with the acquisition, the Company issued 5.1 million shares of common stock and acquired approximately $131.2 million of identifiable net assets, including $1.67 billion of loans, $255.5 million in AFS investment securities, which were sold during the second quarter of 2025, $33.2 million of core deposit intangibles and $1.86 billion in deposits. As of the acquisition date, the fair value discount was $95.2 million for loans, net of the reclassification of the PCD allowance and $0.6 million net discount related to long-term debt. The Company incurred acquisition expenses related to the merger of $19.5 million and $1.5 million for the years ended December 31, 2025 and 2024, respectively. 5 Table of Contents Competition The financial services industry, including commercial banking, is highly competitive, and we encounter strong competition for deposits, loans and other financial products and services in our market area. The increasingly competitive environment is the result of the rate environment, changes in regulation, changes in technology and product delivery systems, additional financial service providers and the accelerating pace of consolidation among financial services providers. The Company competes for loans, deposits and customers with other commercial banks, savings and loan associations, securities and brokerage companies, mortgage companies, insurance companies, finance companies, money market funds, credit unions and other nonbank financial service providers. The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. Banks, securities firms and insurance companies can merge under the umbrella of a financial holding company, which can offer virtually any type of financial service, including banking, securities underwriting, insurance (both agency and underwriting) and merchant banking. In addition, technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. Some of the Company’s nonbanking competitors have fewer regulatory constraints and may have lower cost structures. In addition, some of the Company’s competitors have assets, capital and lending limits greater than those of the Company, have greater access to capital markets and offer a broader range of products and services than the Company. These institutions may have the ability to finance wide-ranging marketing campaigns and may be able to offer lower rates on loans and higher rates on deposits than the Company can offer. Some of these institutions offer services, such as credit cards and international banking, which the Company does not directly offer. Various in-state market competitors and out-of-state banks continue to enter or have announced plans to enter or expand their presence in the market areas where the Company currently operates. With the addition of new financial services providers within our market, the Company expects increased competition for loans, deposits and other financial products and services. In order to compete with other financial services providers, the Company stresses the community nature of its banking operations and principally relies upon local promotional activities, personal relationships established by officers, directors and employees with the Company’s customers and specialized services tailored to meet the needs of the communities served. We also offer certain customer services, such as agricultural lending, that many of our larger competitors do not offer. While the Company’s position varies by market, the Company’s management believes that it can compete effectively as a result of local market knowledge, local decision making and awareness of customer needs. The Company has banking locations in forty-seven counties in the states of New York, Pennsylvania, New Hampshire, Massachusetts, Vermont, Maine and Connecticut. Data Privacy and Security Practices The Company employs a defense-in-depth strategy, which involves a layered approach combining physical and logical controls to ensure comprehensive protection of Company and client information. The high-level objective of the information security program is to protect the confidentiality, integrity and availability of all information assets in our environment. We accomplish this by building our program around six foundational control areas: program oversight and governance, safeguards and controls, security awareness training, service provider oversight, incident response and business continuity. The Company’s data security and privacy practices follow all applicable laws and regulations including the Gramm-Leach Bliley Act of 2001 (“GLBA”) and applicable privacy laws described under the heading “Supervision and Regulation” in this Item 1. Business section. The controls identified in our enterprise security program are managed by various stakeholders throughout the Company and monitored by the information security team. All employees complete security and privacy training upon hire and annually thereafter, supplemented by ad hoc sessions. We engage external consultants for periodic audits, including penetration testing, using simulated cyberattacks to identify vulnerabilities-on public-facing websites and corporate networks. The Board receives regular reports from the Information Security Officer on program status. Additional resources are available at www.nbtbank.com/Personal/Customer-Support/Fraud-Information-Center. For more information regarding the Company’s cybersecurity policies and practices, see Item 1C. Cybersecurity below. 6 Table of Contents Human Capital Resources At December 31, 2025, the Company had 2,303 full-time equivalent employees. The Company’s employees are not presently represented by any collective bargaining group. Our employees are the foundation of our success. We are committed to attracting, developing and retaining exceptional talent while fostering a culture of inclusion and belonging grounded in our values. We strive to create an environment where every individual feels respected, supported and empowered to contribute fully. A workforce enriched by diverse perspectives is a competitive advantage which strengthens our ability to understand markets, serve customers and deliver results. Our talent strategy goes beyond hiring to include continuous development, performance recognition and career growth. We invest in our people and celebrate achievements to ensure every employee has the opportunity to thrive and make a meaningful impact. Investment in Our People We believe that investing in our people is essential to sustaining a high-performing culture. We prioritize attracting, developing and retaining top talent, recognizing that a positive employee experience is essential, especially in today’s competitive labor market. We offer a comprehensive Total Rewards Program that supports the health, well-being and financial security of our employees while maintaining responsible cost management. This commitment is central to our Human Resource strategic pillars of positioning the Company as an employer of choice, aligning people strategies with business goals, and enhancing engagement and retention. This strategy includes enhanced benefits such as paid parental leave, flexible work arrangements, paid time off, retirement transition options and a robust Employee Assistance Program with expanded coverage and health resources. Our incentive programs are designed to recognize contributions at all levels and motivate employees to achieve shared success, while incorporating strong risk management practices. By supporting overall well-being and rewarding performance, we create an environment where employees can thrive personally and professionally. Engaging Employees We recognize that employee engagement is essential to sustaining strong company performance. While our retention rate remains consistently strong, we continue to invest in strategies to motivate, connect and engage our employees. These include career planning conversations, ongoing coaching, goal setting, individualized development plans and enhanced communication, all of which contribute to long-term satisfaction and growth. Our 2025 Employee Engagement Survey highlighted key themes such as culture, leadership, growth and development and communication. Building on these insights, in 2026, we will conduct pulse surveys to target specific areas we want to learn more about, assess progress and identify new opportunities. The results will guide pointed initiatives to strengthen engagement across the organization and provide clarity for business strategies, decision-making and corporate-led development programs. By listening to our employees and acting on their feedback, we ensure that engagement remains a cornerstone of our success. Learning and Career Development Our top priority is to attract and retain exceptional talent by fostering continuous learning and internal career growth. Every employee has access to the LinkedIn Learning Library, offering thousands of courses in a concise, easily consumable format to help individuals build skills and achieve their career aspirations. Today, 90% of our employees actively use this resource, demonstrating a strong commitment to personal development. For those new to the banking industry, our Personal Advancement Through Honing Self-Awareness program provides guidance in defining career goals through assessments, training and facilitated discussions with Talent Development Business Partners. Employees pursuing undergraduate or graduate degrees benefit from our Tuition Reimbursement Program, supporting their academic and professional ambitions. Beyond employee-driven development, we offer strategic programs designed to attract and grow top talent early in their careers and to accelerate the advancement of high potential and emerging leaders. These initiatives align with our succession planning objectives. The Management Development Program targets college seniors by offering accelerated career paths and executive mentoring. Our high potential leadership programs are tailored for professionals with prior experience and seasoned leaders with direct management responsibilities. These programs feature mentorship, coaching, 360-degree feedback, individual development plans, presentation skills training and increased visibility to senior leadership. All programs are delivered through a blend of virtual and in-person learning environments, ensuring flexibility and accessibility. Our robust annual talent review and succession planning process, involving senior management and the Board, reinforces our commitment to leadership continuity and organizational strength. We feel that development is not just an initiative, it is a cornerstone of our culture, empowering employees to grow, lead and succeed. 7 Table of Contents Conduct and Ethics We uphold the highest standards of ethical conduct and workplace respect. The Board, senior management and our Ethics Committee strongly endorse a zero-tolerance policy toward harassment, bias and unethical behavior. Our values-based Code of Business Conduct and Ethics is prominently communicated through our website and internal platforms, ensuring clarity and accessibility for all employees. To reinforce these principles, we provide frequent, role-specific training for managers and employees, along with regular updates on our Whistleblower Policy and reporting mechanisms. These measures reflect our guiding motto: “The right people. Doing the right things. In the right way.” Community Engagement The Company is engaged in the communities where we do business and where our employees and directors live and work. We live out our core value of community involvement through investments of both money and the time of our employees. Through our active contribution program, administered by market-based committees with representation from all lines of business, the Company contributed over $3 million in 2025. Our teams’ efforts to distribute philanthropic resources across our footprint ensure alignment with local needs and support for hundreds of organizations that provide health and human services and promote education, affordable housing, economic development, the arts and agriculture. A consistent way the Company and our employees support our communities across our markets is through giving to United Way chapters in the form of corporate pledges and employee campaign contributions. In 2025, these commitments resulted in over $375,000 in funding for United Way chapters that provide resources to local organizations offering critical education, financial, food security and health services. In addition to corporate financial support of community organizations and causes, employees are encouraged and empowered to volunteer and be a resource in their communities. They invest their financial and other expertise as board members and serve in roles where they offer direct support to those in need by engaging in all kinds of volunteer activities. In 2025, the Company’s employees reported 12,500 hours of volunteer service. The NBT CEI-Boulos Impact Fund is a $10 million real estate equity investment fund with the Bank as the sole investor. The fund, launched in 2022, is designed to support individuals and communities with low- and moderate income through investments in high-impact, community supported, CRE projects located within the Bank’s Community Reinvestment Act assessment areas in New York. A Social Impact Advisory Board was also appointed to review proposed investments based on each project’s social and environmental impact, alignment with community needs and community support. Areas of the fund’s targeted impact include: projects that support job creation; affordable and workforce housing; Main Street revitalization/historic preservation developments that do not contribute to displacement; developments that serve nonprofit organizations; and environmentally sustainable real estate developments. In 2023, the NBT CEI-Boulos Impact Fund announced its first equity investment in The Flanigan Square Transformation Project that now provides affordable workforce housing and a grocery store in a historically underinvested North Central neighborhood in Troy as part of an approximately $75 million socially impactful, environmentally conscious, transit-oriented and community informed master plan. The NBT CEI-Boulos Impact Fund made a $3.84 million equity investment for a majority ownership stake in two of the three components of the project. The Bargain Grocery opened in 2024, and 72 units of affordable and workforce housing are available with the opening of the Flanigan Square Lofts in 2025. Flexible Banking Products The Company offers a comprehensive array of financial products and services for consumers and businesses with options that are beneficial to unbanked and underbanked individuals. Deposit accounts include low balance savings and checking options that feature minimal or no monthly service fees, provide assistance rebuilding positive deposit relationships, and assistance for those just starting a new banking relationship. The NBT iSelect Account was introduced in 2021 and has received certification for meeting the Bank On National Account Standards every year since its inception. Over 26,000 NBT iSelect Accounts have been opened since 2021. These accounts feature no monthly charges for maintenance, inactivity or dormancy, no overdraft fees and no minimum balance requirement. The Company’s modern digital banking platform incorporates ready access through online and mobile services to current credit score information and a personal financial management tool for budget and expense tracking. The Company is committed to making homeownership accessible to individuals and families across the communities we serve. Our suite of home lending products includes innovative and flexible options, such as government guaranteed programs through the Federal Housing Administration (“FHA”), the USDA Rural Housing Program and the U.S. Department of Veterans Affairs (“VA”). We also offer a variety of in-house programs, including Habitat for Humanity, Home in the City, Portfolio Housing Agency and Portfolio 97. Our home lending team includes specialists dedicated to affordable housing initiatives, and we maintain longstanding partnerships with housing agencies across our footprint. These partners provide first-time homebuyer education as well as assistance with down payments and closing costs, helping to ensure that more borrowers can achieve sustainable homeownership. 8 Table of Contents Environmental The Company is focused on the environment and committed to business practices and activities that encourage sustainability and minimize our environmental impact. In larger facilities, the Company conserves energy through the use of building energy management systems and motion sensor lighting controls. In new construction and renovations, the Company incorporates high-efficiency mechanical equipment, LED lighting, and modern building techniques to reduce our carbon footprint wherever possible. The Company has an ongoing initiative to replace existing lighting with LED lighting to reduce energy consumption. Services like mobile and online banking, remote deposit capture, electronic loan payments, eStatements and combined statements enable us to support all customers in their efforts to consume less fuel and paper. Across our footprint, we host community shred days with multiple confidential document destruction companies to promote safe document disposal and recycling. Supervision and Regulation The Company, the Bank and certain of its non-banking subsidiaries are subject to extensive regulation under federal and state laws. The regulatory framework applicable to bank holding companies and their subsidiary banks is intended to protect depositors, federal deposit insurance funds and the stability of the U.S. banking system. This system is not designed to protect equity investors in bank holding companies, such as the Company. Set forth below is a summary of the significant laws and regulations applicable to the Company and its subsidiaries. The description that follows is qualified in its entirety by reference to the full text of the statutes, regulations and policies that are described. Such statutes, regulations and policies are subject to ongoing review by Congress and state legislatures and federal and state regulatory agencies. A change in any of the statutes, regulations or regulatory policies applicable to the Company and its subsidiaries could have a material effect on the results of the Company. Overview The Company is a registered bank holding company and financial holding company under the Bank Holding Company Act of 1956, as amended (the “BHC Act”), and is subject to the supervision of, and regular examination by, the FRB as its primary federal regulator. The Company is also subject to the jurisdiction of the SEC, and is subject to the disclosure and other regulatory requirements of the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended (the “Exchange Act”), as administered by the SEC. The Company’s common stock is listed on the NASDAQ Global Select market under the ticker symbol, “NBTB,” and the Company is subject to the NASDAQ rules. The Bank is chartered as a national banking association under the National Bank Act. The Bank is subject to the supervision of, and to regular examination by, the OCC as its chartering authority and primary federal regulator. The Bank is also subject to the supervision and regulation, to a limited extent, of the FDIC as its deposit insurer. Financial products and services offered by the Company and the Bank are subject to federal consumer protection laws and implementing regulations promulgated by the Consumer Financial Protection Bureau (“CFPB”). The Company and the Bank are also subject to oversight by state attorneys general for compliance with state consumer protection laws. The Bank’s deposits are insured by the FDIC up to the applicable deposit insurance limits in accordance with FDIC laws and regulations. The non-bank subsidiaries of the Company and the Bank are subject to federal and state laws and regulations, including regulations of the FRB and the OCC, respectively. Since the enactment of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”), U.S. banks and financial services firms have been subject to enhanced regulation and oversight. It is not clear at this time what the effects on the Company and the Bank will be of any legislation or regulatory changes that may be enacted or implemented by the current administration or otherwise in the future. 9 Table of Contents Federal Bank Holding Company Regulation The Company is a bank holding company as defined by the BHC Act. The BHC Act generally limits the business of the Company to banking, managing or controlling banks and other activities that the FRB has determined to be so closely related to banking “as to be a proper incident thereto.” The Company has also qualified for and elected to be a financial holding company. Financial holding companies may engage in any activity, or acquire and retain the shares of a company engaged in any activity, that is either (1) financial in nature or incidental to such financial activity (as determined by the FRB in consultation with the Secretary of the Treasury), or (2) complementary to a financial activity and that does not pose a substantial risk to the safety and soundness of depository institutions or the financial system (as solely determined by the FRB). If a bank holding company seeks to engage in the broader range of activities permitted under the BHC Act for financial holding companies, (1) the bank holding company and all of its depository institution subsidiaries must be “well capitalized” and “well managed,” as defined in the FRB’s Regulation Y and (2) it must file a declaration with the FRB that it elects to be a “financial holding company.” In order for a financial holding company to commence any activity that is financial in nature, incidental thereto, or complementary to a financial activity, or to acquire a company engaged in any such activity permitted by the BHC Act, each insured depository institution subsidiary of the financial holding company must have received a rating of at least “satisfactory” in its most recent examination under the Community Reinvestment Act of 1977 (the “CRA”). See the section captioned “Community Reinvestment Act of 1977” for further information relating to the CRA. The FRB has the power to order any bank holding company or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the FRB has reasonable grounds to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company. Regulation of Mergers and Acquisitions The BHC Act, the Bank Merger Act and other federal and state statutes regulate acquisitions of depository institutions and their holding companies. The BHC Act requires prior FRB approval for a bank holding company to acquire, directly or indirectly, 5% or more of any class of voting securities of a commercial bank or its parent holding company and for a company, other than a bank holding company, to acquire 25% or more of any class of voting securities of a bank or bank holding company (and sometimes a lower percentage if there are other indications of control). Under the Change in Bank Control Act, any person, including a company, may not acquire, directly or indirectly, control of a bank without providing 60 days’ prior notice and receiving a non-objection from the appropriate federal banking agency. Under the Bank Merger Act, prior approval of the OCC is required for a national bank to merge with another bank where the national bank is the surviving bank or to purchase the assets or assume the deposits of another bank. In reviewing applications seeking approval of merger and acquisition transactions, the federal banking agencies will consider, among other criteria, the competitive effect and public benefits of the transactions, the capital position of the combined banking organization, the applicant’s performance record under the CRA and the effectiveness of the subject organizations in combating money laundering activities. As a financial holding company, the Company is permitted to acquire control of non-depository institutions engaged in activities that are financial in nature and in activities that are incidental to financial activities without prior FRB approval. However, the BHC Act, as amended by the Dodd-Frank Act, requires prior written approval from the FRB or prior written notice to the FRB before a financial holding company may acquire control of a company with consolidated assets of $10 billion or more. Capital Distributions The principal source of the Company’s liquidity is dividends from the Bank. The OCC oversees the ability of the Bank to make capital distributions, including dividends. The OCC generally prohibits a depository institution from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the bank would thereafter be undercapitalized. The OCC’s prior approval is required if the total of all dividends declared by a national bank in any calendar year would exceed the sum of the bank’s net income for that year and its undistributed net income for the preceding two calendar years, less any required transfers to surplus. The National Bank Act also prohibits national banks from paying dividends that would be greater than the bank’s undivided profits after deducting statutory bad debt in excess of the bank’s allowance for loan losses. The federal banking agencies have indicated that paying dividends that deplete a bank’s capital base to an inadequate level would be an unsafe and unsound banking practice and that banking organizations should generally pay dividends only out of current operating earnings. The appropriate federal regulatory authority is authorized to determine, based on the financial condition of a bank holding company or a bank, that the payment of dividends would be an unsafe or unsound practice and to prohibit such payment. 10 Table of Contents Affiliate and Insider Transactions Transactions between the Bank and its affiliates, including the Company, are governed by Sections 23A and 23B of the Federal Reserve Act (the “FRA”) and the FRB’s implementation of Regulation W. An “affiliate” of a bank includes any company or entity that controls, is controlled by or is under common control with such bank. In a bank holding company context, at a minimum, the parent holding company of a bank and companies that are controlled by such parent holding company, are affiliates of the bank. Generally, Sections 23A and 23B of the FRA are intended to protect insured depository institutions from losses in transactions with affiliates. These sections place quantitative and qualitative limitations on covered transactions between the Bank and its affiliates and require that all transactions between a bank and its affiliates occur on market terms that are consistent with safe and sound banking practices. Section 22(h) of the FRA and its implementation of Regulation O restricts loans to the Bank’s and its affiliates’ directors, executive officers and principal stockholders (“Insiders”). Under Section 22(h), loans to Insiders and their related interests may not exceed, together with all other outstanding loans to such persons and affiliated entities, the Bank’s loan-to-one borrower limit. Loans to Insiders above specified amounts must receive the prior approval of the Bank’s Board of Directors. Further, under Section 22(h) of the FRA, loans to directors, executive officers and principal stockholders must be made on terms substantially the same as offered in comparable transactions to other persons, except that such Insiders may receive preferential loans made under a benefit or compensation program that is widely available to the Bank’s employees and does not give preference to the Insider over the employees. Section 22(g) of the FRA places additional limitations on loans to the Bank’s and its affiliates’ executive officers. Federal Deposit Insurance and Brokered Deposits The FDIC’s deposit insurance limit is $250,000 per depositor, per insured bank, for each account ownership category, in accordance with applicable FDIC regulations. The Bank’s deposit accounts are fully insured by the FDIC Deposit Insurance Fund (the “DIF”) up to the deposit insurance limits in accordance with applicable laws and regulations. The FDIC uses a risk-based assessment system that imposes insurance premiums based upon a risk matrix that takes into account a bank’s capital level and supervisory rating (“CAMELS rating”). The risk matrix uses different risk categories distinguished by capital levels and supervisory ratings. As a result of the Dodd-Frank Act, the base for deposit insurance assessments is the consolidated average assets less average tangible equity. Assessment rates are calculated using formulas that take into account the risk of the institution being assessed. Under FDIC laws and regulations, no FDIC-insured depository institution can accept brokered deposits unless it is well capitalized or unless it is adequately capitalized and receives a waiver from the FDIC. Applicable laws and regulations also limit the interest rate that any depository institution that is not well capitalized may pay on brokered deposits. Under the Federal Deposit Insurance Act (“FDIA”), the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC. The Bank’s management is not aware of any practice, condition or violation that might lead to the termination of its deposit insurance. Federal Home Loan Bank System The Bank is also a member of the FHLB of New York, which provides a central credit facility primarily for member institutions for home mortgage and neighborhood lending. The Bank is subject to the rules and requirements of the FHLB, including the requirement to acquire and hold shares of capital stock in the FHLB in an amount at least equal to the sum of 0.125% of mortgage related assets at the beginning of each year. The Bank was in compliance with FHLB rules and requirements as of December 31, 2025. 11 Table of Contents Debit Card Interchange Fees The Dodd-Frank Act requires that any interchange transaction fee charged for a debit transaction be reasonable and proportional to the cost incurred by the issuer for the transaction. FRB regulations mandated by the Dodd-Frank Act limit interchange fees on debit cards to a maximum of 21 cents per transaction plus 5 bps of the transaction amount. The rule also permits a fraud-prevention adjustment of 1 cent per transaction conditioned upon an issuer developing, implementing and updating reasonably designed fraud-prevention policies and procedures. Issuers that, together with their affiliates, have less than $10 billion of assets, are exempt from the debit card interchange fee standards. In addition, FRB regulations prohibit all issuers, including the Company and the Bank, from restricting the number of networks over which electronic debit transactions may be processed to less than two unaffiliated networks. In October 2023, the FRB issued a proposal under which the maximum permissible interchange fee for an electronic debit transaction would be the sum of 14.4 cents per transaction and 4 bps multiplied by the value of the transaction. Furthermore, the fraud-prevention adjustment would increase from a maximum of 1 cent to 1.3 cents per debit card transaction. The proposal would adopt an approach for future adjustments to the interchange fee cap, which would occur every other year based on issuer cost data gathered by the FRB from large debit card issuers. The comment period for this proposal ended in May 2024 but no final rule has been published to date. In December 2025, nine major financial trade organizations urged the Fed to withdraw this proposal given the passage of time, arguing that the 2021 data upon which the 2023 proposed rule was based does not support informed decision-making, and there is still uncertainty with respect to the outcome of litigation challenging these FRB regulations. The extent to which any such proposed changes in permissible interchange fees will impact our future revenues is currently uncertain. Source of Strength Doctrine FRB policy requires bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. Section 616 of the Dodd-Frank Act codifies the requirement that bank holding companies serve as a source of financial strength to their subsidiary depository institutions. A bank holding company’s failure to meet its obligations to serve as a source of strength to its subsidiary banks will generally be considered by the FRB to be an unsafe and unsound banking practice or a violation of FRB regulations or both. As a result, the Company is expected to commit resources to support the Bank, including at times when the Company may not be in a financial position to provide such resources. Any capital loan by the Company to the Bank is subordinate in right of payment to deposits and to certain other indebtedness of such subsidiary banks. The U.S. Bankruptcy Code provides that, in the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment. In addition, under the National Bank Act, if the Bank’s capital stock is impaired by losses or otherwise, the OCC is authorized to require payment of the deficiency by assessment upon the Company. If the assessment is not paid within three months, the OCC could order a sale of Bank stock held by the Company to cover any deficiency. Capital Adequacy In July 2013, the FRB, the OCC and the FDIC approved final rules (the “Capital Rules”) that established a new capital framework for U.S. banking organizations. The Capital Rules generally implement the Basel Committee on Banking Supervision’s (the “Basel Committee”) December 2010 final capital framework referred to as “Basel III” for strengthening international capital standards. The Capital Rules revised the definitions and the components of regulatory capital, as well as addressed other issues affecting the numerator in banking institutions’ regulatory capital ratios. The Capital Rules also addressed asset risk weights and other matters affecting the denominator in banking institutions’ regulatory capital ratios and replace the existing general risk-weighting approach with a more risk-sensitive approach. 12 Table of Contents The Capital Rules: (1) require a capital measure called “Common Equity Tier 1” (“CET1”) and related regulatory capital ratio of CET1 to risk-weighted assets; (2) specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting certain revised requirements; (3) mandate that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital; and (4) expand the scope of the deductions from and adjustments to capital as compared to existing regulations. Under the Capital Rules, for most banking organizations, including the Company, the most common form of Additional Tier 1 capital is non-cumulative perpetual preferred stock and the most common forms of Tier 2 capital are subordinated notes and a portion of the allocation for loan losses, in each case, subject to the Capital Rules’ specific requirements. Pursuant to the Capital Rules, the minimum capital ratios are: ● 4.5% CET1 to risk-weighted assets; ● 6.0% Tier 1 capital (CET1 plus Additional Tier 1 capital) to risk-weighted assets; ● 8.0% Total capital (Tier 1 capital plus Tier 2 capital) to risk-weighted assets; and ● 4.0% Tier 1 capital to average consolidated assets as reported on consolidated financial statements (known as the “leverage ratio”). The Capital Rules also require a “capital conservation buffer,” composed entirely of CET1, on top of these minimum risk-weighted asset ratios. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer will face constraints on dividends, equity and other capital instrument repurchases and compensation based on the amount of the shortfall. The additional capital conservation buffer applicable to the Company and the Bank is 2.5% of CET1, and effectively results in minimum ratios inclusive of the capital conservation buffer of (1) CET1 to risk-weighted assets of at least 7%, (2) Tier 1 capital to risk-weighted assets of at least 8.5% and (3) Total capital to risk-weighted assets of at least 10.5%. The risk-weighting categories in the Capital Rules are standardized and include a risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. government and agency securities, to 600% for certain equity exposures and resulting in higher risk weights for a variety of asset classes. The Capital Rules provide for a number of deductions from and adjustments to CET1. In addition, under the prior general risk-based capital rules, the effects of AOCI items included in stockholders’ equity (for example, marks-to-market of securities held in the AFS portfolio) under GAAP were excluded for the purposes of determining regulatory capital ratios. Under the Capital Rules, the effects of certain AOCI items are not excluded; however, banking organizations not using the advanced approaches, including the Company and the Bank, were permitted to make a one-time permanent election to continue to exclude these items in January 2015. The Capital Rules also preclude certain hybrid securities, such as trust preferred securities issued after May 19, 2010, from inclusion in bank holding companies’ Tier 1 capital. Management believes that the Company is in compliance with the targeted capital ratios. Prompt Corrective Action and Safety and Soundness Pursuant to Section 38 of the FDIA, federal banking agencies are required to take “prompt corrective action” (“PCA”) should an insured depository institution fail to meet certain capital adequacy standards. At each successive lower capital category, an insured depository institution is subject to more restrictions and prohibitions, including restrictions on growth, restrictions on interest rates paid on deposits, restrictions or prohibitions on payment of dividends and restrictions on the acceptance of brokered deposits. Furthermore, if an insured depository institution is classified in one of the undercapitalized categories, it is required to submit a capital restoration plan to the appropriate federal banking agency and the holding company must guarantee the performance of that plan. Based upon its capital levels, a bank that is classified as well capitalized, adequately capitalized or undercapitalized, may be treated as though it were in the next lower capital category if the appropriate federal banking agency, after notice and opportunity for hearing, determines that an unsafe or unsound condition or an unsafe or unsound practice, warrants such treatment. For purposes of PCA, to be: (1) well capitalized, an insured depository institution must have a total risk based capital ratio of at least 10%, a Tier 1 risk based capital ratio of at least 8%, a CET1 risk based capital ratio of at least 6.5%, and a Tier 1 leverage ratio of at least 5%; (2) adequately capitalized, an insured depository institution must have a total risk based capital ratio of at least 8%, a Tier 1 risk based capital ratio of at least 6%, a CET1 risk based capital ratio of at least 4.5%, and a Tier 1 leverage ratio of at least 4%; (3) undercapitalized, an insured depository institution would have a total risk based capital ratio of less than 8%, a Tier 1 risk based capital ratio of less than 6%, a CET1 risk based capital ratio of less than 4.5%, and a Tier 1 leverage ratio of less than 4%; (4) significantly undercapitalized, an insured depository institution would have a total risk based capital ratio of less than 6%, a Tier 1 risk based capital ratio of less than 4%, a CET1 risk based capital ratio of less than 3%, and a Tier 1 leverage ratio of less than 3%; (5) critically undercapitalized, an insured depository institution would have a ratio of tangible equity to total assets that is less than or equal to 2%. At December 31, 2025, the Bank qualified as “well capitalized” under applicable regulatory capital standards. Bank holding companies and insured depository institutions may also be subject to potential enforcement actions of varying levels of severity by the federal banking agencies for unsafe or unsound practices in conducting their business or for violation of any law, rule, regulation, condition imposed in writing by the agency or term of a written agreement with the agency. In more serious cases, enforcement actions may include the issuance of directives to increase capital; the issuance of formal and informal agreements; the imposition of civil monetary penalties; the issuance of a cease and desist order that can be judicially enforced; the issuance of removal and prohibition orders against officers, directors and other institution-affiliated parties; the termination of the insured depository institution’s deposit insurance; the appointment of a conservator or receiver for the insured depository institution; and the enforcement of such actions through injunctions or restraining orders based upon a judicial determination that the FDIC, as receiver, would be harmed if such equitable relief was not granted. 13 Table of Contents Volcker Rule Section 619 of the Dodd-Frank Act, commonly known as the Volcker Rule, restricts the ability of banking entities from: (1) engaging in “proprietary trading” and (2) investing in or sponsoring certain covered funds, subject to certain limited exceptions. Depositor Preference The FDIA provides that, in the event of the “liquidation or other resolution” of an insured depository institution, the claims of depositors of the institution, including the claims of the FDIC as subrogee of insured depositors and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution. If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors, including the parent bank holding company, with respect to any extensions of credit they have made to such insured depository institution. Consumer Protection and CFPB Supervision The Dodd-Frank Act centralized responsibility for consumer financial protection by creating the CFPB, an independent agency charged with responsibility for implementing, enforcing and examining compliance with federal consumer financial laws. The Company grew its asset base in excess of $10 billion in 2020. The Company is now subject to the CFPB’s examination authority with regard to compliance with federal consumer financial laws and regulations, in addition to the OCC as the primary regulatory of the Bank. Under the Dodd-Frank Act, state attorneys general are also empowered to enforce rules issued by the CFPB. The Company is subject to federal consumer financial statutes and the regulations promulgated thereunder including, but not limited to: ● the Truth-In-Lending Act, governing disclosures of credit terms to consumer borrowers; ● the Equal Credit Opportunity Act (“ECOA”), prohibiting discrimination in connection with the extension of credit; ● the Home Mortgage Disclosure Act (“HMDA”), requiring home mortgage lenders, including the Bank, to make available to the public expanded information regarding the pricing of home mortgage loans, including the “rate spread” between the annual percentage rate and the average prime offer rate for mortgage loans of a comparable type; ● the Fair Credit Reporting Act (“FCRA”), governing the provision of consumer information to credit reporting agencies and the use of consumer information; and ● the Fair Debt Collection Practices Act, governing the manner in which consumer debts may be collected by collection agencies. The Bank’s failure to comply with any of the consumer financial laws can result in civil actions, regulatory enforcement action by the federal banking agencies and the U.S. Department of Justice. 14 Table of Contents USA PATRIOT Act The Bank Secrecy Act (“BSA”), as amended by the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA PATRIOT Act”), imposes obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. Financial institutions also are required to respond to requests for information from federal banking agencies and law enforcement agencies. Information sharing among financial institutions for the above purposes is encouraged by an exemption granted to complying financial institutions from the privacy provisions of the GLBA and other privacy laws. Financial institutions that hold correspondent accounts for foreign banks or provide private banking services to foreign individuals are required to take measures to avoid dealing with certain foreign individuals or entities, including foreign banks with profiles that raise money laundering concerns and are prohibited from dealing with foreign “shell banks” and persons from jurisdictions of particular concern. The primary federal banking agencies and the Secretary of the Treasury have adopted regulations to implement several of these provisions. Since May 11, 2018, the Bank has been required to comply with the Customer Due Diligence Rule, which clarified and strengthened the existing obligations for identifying new and existing customers and explicitly included risk-based procedures for conducting ongoing customer due diligence. All financial institutions also are required to establish internal anti-money laundering programs. The effectiveness of a financial institution in combating money laundering activities is a factor to be considered in any application submitted by the financial institution under the Bank Merger Act. The Company has a BSA and USA PATRIOT Act Board-approved compliance program commensurate with its risk profile. Identity Theft Prevention The FCRA’s Red Flags Rule requires financial institutions with covered accounts (e.g., consumer bank accounts and loans) to develop, implement and administer an identity theft prevention program. Our program includes policies and procedures to detect suspicious patterns or practices, such as inconsistencies in personal information or unusual account activity, that may indicate identity theft. Office of Foreign Assets Control Regulation The United States government has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others. These are typically known as the “OFAC” rules based on their administration by the U.S. Treasury Department Office of Foreign Assets Control (“OFAC”). The OFAC-administered sanctions targeting countries take many different forms. Generally, they contain one or more of the following elements: (1) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments in or providing investment-related advice or assistance to a sanctioned country; and (2) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal and reputational consequences. Financial Privacy and Data Security The Company and the Bank are subject to federal laws, including the GLBA and certain state laws containing consumer privacy protection provisions. These provisions limit the ability of banks and other financial institutions to disclose nonpublic information about consumers to affiliated and non-affiliated third parties and limit the reuse of certain consumer information received from nonaffiliated financial institutions. These provisions require notice of privacy policies to clients and, in some circumstances, allow consumers to prevent disclosure of certain nonpublic personal information to affiliates or non-affiliated third parties by means of “opt out” or “opt in” authorizations. The GLBA requires that financial institutions implement comprehensive written information security programs that include administrative, technical and physical safeguards to protect consumer information. Further, pursuant to interpretive guidance issued under the GLBA and certain state laws, financial institutions are required to notify clients of security breaches resulting in unauthorized access to their personal information. The Bank follows all GLBA obligations. The Bank is also subject to data security standards, privacy and data breach notice requirements, primarily those issued by the OCC. The federal banking agencies, through the Federal Financial Institutions Examination Council, have adopted guidelines to encourage financial institutions to address cybersecurity risks and identify, assess and mitigate these risks, both internally and at critical third party services providers. The Company continues to invest in advanced technologies and partnerships to strengthen its cybersecurity posture and mitigate emerging threats. 15 Table of Contents Community Reinvestment Act of 1977 The Bank has a responsibility under the CRA, as implemented by OCC regulations, to help meet the credit needs of the communities it serves, including low- and moderate-income neighborhoods. The CRA does not establish specific lending requirements or programs for financial institutions nor does it limit an institution’s discretion to develop the types of products and services that it believes are best suited to its particular community, consistent with the CRA. Regulators periodically assess the Bank’s record of compliance with the CRA. The Bank’s failure to comply with the CRA could, at a minimum, result in regulatory restrictions on its activities and the activities of the Company. The Bank’s most current CRA rating was “Satisfactory.” Future Legislative and Regulatory Initiatives Congress, state legislatures and financial regulatory agencies may introduce various legislative and regulatory initiatives that could affect the financial services industry, generally. Such initiatives may include proposals to expand or contract the powers of bank holding companies and/or depository institutions or proposals to substantially change the financial institution regulatory system. This includes changes in priorities and operations of regulatory agencies in connection with new leadership or otherwise. Such legislation or regulatory changes could change banking statutes and the regulatory and operating environment of the Company in substantial and unpredictable ways. If enacted or implemented, such legislation or regulatory changes could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among banks, savings associations, credit unions and other financial institutions. The Company cannot predict whether any such legislation will be enacted, and, if enacted, the effect that it or any implementing regulations would have on the financial condition or results of operations of the Company. A change in statutes, regulations or regulatory policies applicable to the Company or any of its subsidiaries could have a material effect on the business of the Company. Available Information The Company’s website is www.nbtbancorp.com. The Company makes available free of charge through its website its Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and any amendments to those reports as soon as reasonably practicable after such material is electronically filed with or furnished to the SEC pursuant to Section 13(a) or 15(d) of the Exchange Act. We also make available through our website other reports filed with or furnished to the SEC under the Exchange Act, including our proxy statements and reports filed by officers and directors under Section 16(a) of that Act, as well as our Code of Business Conduct and Ethics and other codes/committee charters. The references to our website do not constitute incorporation by reference of the information contained in the website and such information should not be considered part of this document. This Annual Report on Form 10-K and other reports filed with the SEC are available on the SEC’s website, which contains reports, proxy and information statements and other information regarding issuers that file electronically with the SEC. The SEC’s website address is www.sec.gov. 16 Table of Contents ITEM 1A. RISK FACTORS There are risks inherent to the Company’s business. The material risks and uncertainties that management believes affect the Company are described below. Any of the following risks could affect the Company’s financial condition and results of operations and could be material and/or adverse in nature. You should consider all of the following risks together with all of the other information in this Annual Report on Form 10-K. Risks Related to our Business and Industry The Company may be adversely affected by conditions in the financial markets and economic conditions generally. Key macroeconomic conditions historically have affected the Company’s business, results of operations and financial condition and are likely to affect them in the future. Consumer confidence, unemployment and other economic indicators are among the factors that often impact consumer spending and payment behavior and demand for credit. The Company relies primarily on interest and fees on our loan receivables to generate net earnings. The economy in the United States and globally has experienced volatility in recent years and may continue to do so for the foreseeable future. There can be no assurance that economic conditions will not worsen. Unfavorable or uncertain economic conditions can be caused by declines in economic growth, business activity or investor or business confidence, limitations on the availability or increases in the cost of credit and capital, trade wars or tariffs, inflation, changes in interest rates, the timing and impact of geopolitical uncertainties, natural disasters, epidemics and pandemics, terrorist attacks, acts of war or a combination of these or other factors. Federal budget deficit concerns and the potential for political conflict over legislation to fund U.S. government operations and raise the U.S. government’s debt limit may increase the possibility of a default by the U.S. government on its debt obligations, related credit-rating downgrades, or an economic recession in the United States. A worsening of business and economic conditions could have adverse effects on our business, including the following: ● investors may have less confidence in the equity markets in general and in financial services industry stocks in particular, which could place downward pressure on the Company’s stock price and resulting market valuation; ● consumer and business confidence levels could be lowered and cause declines in credit usage and adverse changes in payment patterns, causing increases in delinquencies and default rates; ● the Company’s ability to assess the creditworthiness of its customers may be impaired if the models and approaches the Company uses to select, manage and underwrite its customers become less predictive of future behaviors; ● the Company could suffer decreases in demand for loans or other financial products and services or decreased deposits or other investments in accounts with the Company; ● demand for and income received from the Company’s fee-based services could decline; ● customers of the Company’s trust and benefit plan administration business may liquidate investments, which together with lower asset values, may reduce the level of assets under management and administration and thereby decrease the Company’s investment management and administration revenues; ● competition in the financial services industry could intensify as a result of the increasing consolidation of financial services companies in connection with current market conditions or otherwise; and ● the value of loans and other assets or collateral securing loans may decrease. Deterioration in local economic conditions may negatively impact our financial performance. The Company’s success depends primarily on the general economic conditions in upstate New York, northeastern Pennsylvania, southern New Hampshire, western Massachusetts, Vermont, southern Maine, central and northwestern Connecticut and the specific local markets in which the Company operates. Unlike larger national or other regional banks that are more geographically diversified, the Company provides banking and financial services to customers primarily in the upstate New York areas of Norwich, Albany, Amsterdam-Gloversville, Binghamton, Buffalo, Glens Falls, Hudson Valley, Ogdensburg-Massena, Oneonta, Plattsburgh, Rochester, Syracuse and Utica-Rome, the northeastern Pennsylvania areas of Scranton and Wilkes-Barre, Berkshire County, Massachusetts, southern New Hampshire, Vermont, southern Maine and central and northwestern Connecticut. The local economic conditions in these areas have a significant impact on the demand for the Company’s products and services as well as the ability of the Company’s customers to repay loans, the value of the collateral securing loans and the stability of the Company’s deposit funding sources. 17 Table of Contents A downturn in our local economies could cause significant increases in nonperforming loans, which could negatively impact our earnings. Declines in real estate values in our market areas could cause any of our loans to become inadequately collateralized, which would expose us to greater risk of loss. Additionally, a decline in real estate values could result in the decline of originations of such loans, as most of our loans and the collateral securing our loans are located in those areas. Severe weather, flooding and other effects of climate change and other natural disasters could adversely affect our financial condition, results of operations or liquidity. Our branch locations and our customers’ properties may be adversely impacted by flooding, wildfires, high winds and other effects of severe weather conditions. These events can force property closures, result in property damage and/or result in delays in expansion, development or renovation of our properties and those of our customers. Even if these events do not directly impact our properties or our customers’ properties, they may impact us and our customers through increased insurance, energy or other costs. In addition, changes in laws or regulations, including federal, state or city laws, relating to climate change could result in increased capital expenditures to improve the energy efficiency of our branch locations and/or our customers’ properties. Ongoing legislative or regulatory uncertainties and changes regarding climate risk management and practices may result in higher regulatory, compliance, credit and reputational risks and costs. Variations in interest rates could adversely affect our results of operations and financial condition. The Company’s earnings and financial condition, like that of most financial institutions, are largely dependent upon net interest income, which is the difference between interest and dividend income earned from loans and securities and interest expense paid on deposits and borrowings. The narrowing of interest rate spreads could adversely affect the Company’s earnings and financial condition. Interest rates remain elevated compared to recent years and may increase. The Company cannot predict with certainty, or control, changes in interest rates. Regional and local economic conditions and the policies of regulatory authorities, including monetary policies of the FRB, affect rates and, therefore, interest income and interest expense. High interest rates could also affect the amount of loans that the Company can originate because higher rates could cause customers to apply for fewer mortgages or cause depositors to shift funds from accounts that have a comparatively lower cost to accounts with a higher cost. The Company may also experience customer attrition due to competitor pricing on both deposits and loans. If the cost of interest-bearing deposits increases at a rate greater than the yields on interest-earning assets increase, net interest income will be negatively affected. Changes in the asset and liability mix may also affect net interest income. Similarly, lower interest rates cause higher yielding assets to prepay and floating or adjustable rate assets to reset to lower rates. If the Company is not able to reduce its funding costs sufficiently, due to either competitive factors or the maturity schedule of existing liabilities, then the Company’s NIM will decline. Any substantial or unexpected change in, or prolonged change in market interest rates could have a material adverse effect on the Company’s financial condition and results of operations. See the section captioned “Net Interest Income” in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations and Item 7A. Quantitative and Qualitative Disclosure About Market Risk located elsewhere in this report for further discussion related to the Company’s management of interest rate risk. Our lending, and particularly our emphasis on commercial lending, exposes us to the risk of losses upon borrower default. As of December 31, 2025, approximately 56% of the Company’s loan portfolio consisted of commercial and industrial, agricultural, commercial construction and CRE loans. These types of loans generally expose a lender to greater risk of non-payment and loss than residential mortgage loans because repayment of the loans often depends on the successful operation of the property, the income stream of the borrowers and, for construction loans, the accuracy of the estimate of the property’s value at completion of construction and the estimated cost of construction. Such loans typically involve larger loan balances to single borrowers or groups of related borrowers compared to residential mortgage loans. Because the Company’s loan portfolio contains a significant number of commercial and industrial, agricultural, construction and CRE loans with relatively large balances, the deterioration of one or a few of these loans could cause a significant increase in nonperforming loans. An increase in nonperforming loans could result in a net loss of earnings from these loans, an increase in the provision for loan losses and/or an increase in loan charge-offs, all of which could have a material adverse effect on the Company’s financial condition and results of operations. See the section captioned “Loans” in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations located elsewhere in this report for further discussion related to our commercial and industrial, agricultural, construction and CRE loans. 18 Table of Contents Our allowance for credit losses may not be sufficient to cover actual loan losses, which could have a material adverse effect on our business, financial condition and results of operations. The Company maintains an allowance for credit losses, which is an allowance established through a provision for loan losses charged to expense, that represents management’s best estimate of expected credit losses within the existing portfolio of loans. The allowance, in the judgment of management, is necessary to reserve for estimated loan losses and risks inherent in the loan portfolio. The determination of the appropriate level of the allowance for credit losses inherently involves a high degree of subjectivity and requires the Company to make significant estimates of current credit risks, forecast economic conditions and future trends, all of which may undergo material changes. Changes in economic conditions affecting borrowers, new information regarding existing loans, identification of additional problem loans and other factors, both within and outside of the Company’s control, may require an increase in the allowance for credit losses. Bank regulatory agencies periodically review the Company’s allowance for credit losses and may require an increase in the provision for credit losses or the recognition of further loan charge-offs, based on judgments different from those of management. In addition, if charge-offs in future periods exceed the allowance for credit losses, the Company may need additional provisions to increase the allowance for credit losses. These potential increases in the allowance for credit losses would result in a decrease in net income and, possibly, capital and may have a material adverse effect on the Company’s financial condition and results of operations. See the section captioned “Risk Management – Credit Risk” in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations located elsewhere in this report for further discussion related to the Company’s process for determining the appropriate level of the allowance for loan losses. Management expects that the CECL model may create more volatility in the level of our allowance for credit losses from quarter to quarter as changes in the level of allowance for credit losses will be dependent upon, among other things, macroeconomic forecasts and conditions, loan portfolio volumes and credit quality. Strong competition within our industry and market area could adversely affect our performance and slow our growth. The Company faces substantial competition in all areas of its operations from a variety of different competitors, many of which are larger and may have more financial resources. Such competitors primarily include national, regional and community banks within the various markets in which the Company operates. Additionally, various banks continue to enter or have announced plans to enter the market areas in which the Company currently operates. The Company also faces competition from many other types of financial institutions, including, without limitation, savings and loans, credit unions, finance companies, brokerage firms, insurance companies and other financial intermediaries. The financial services industry could continue to become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. Technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. Many of the Company’s competitors have fewer regulatory constraints and may have lower cost structures. Additionally, due to their size, many competitors may be able to achieve economies of scale and, as a result, may offer a broader range of products and services as well as better pricing for those products and services than the Company can. The Company’s ability to compete successfully depends on a number of factors, including, among other things: ● the ability to develop, maintain and build upon long-term customer relationships based on top-quality service, high ethical standards and safe, sound assets; ● the ability to expand the Company’s market position; ● the scope, relevance and pricing of products and services offered to meet customer needs and demands; ● the rate at which the Company introduces new products, services and technologies relative to its competitors; ● customer satisfaction with the Company’s level of service; ● industry and general economic trends; and ● the ability to attract and retain talented employees. Failure to perform in any of these areas could significantly weaken the Company’s competitive position, which could adversely affect the Company’s growth and profitability, which, in turn, could have a material adverse effect on the Company’s financial condition and results of operations. 19 Table of Contents The Company is subject to liquidity risk, which could adversely affect net interest income and earnings. The purpose of the Company’s liquidity management is to meet the cash flow obligations of its customers for both deposits and loans. Regulators are increasingly focused on liquidity risk after the bank failures of 2023. The primary liquidity measurement the Company utilizes is called basic surplus, which captures the adequacy of the Company’s access to reliable sources of cash relative to the stability of its funding mix of average liabilities. This approach recognizes the importance of balancing levels of cash flow liquidity from short and long-term securities with the availability of dependable borrowing sources, which can be accessed when necessary. However, competitive pressure on deposit pricing could result in a decrease in the Company’s deposit base or an increase in funding costs. In addition, liquidity will come under additional pressure if loan growth exceeds deposit growth. These scenarios could lead to a decrease in the Company’s basic surplus measure to an amount below the minimum policy level of 5%. To manage this risk, the Company has the ability to purchase brokered time deposits, borrow against established borrowing facilities with other banks (federal funds) and enter into repurchase agreements with investment companies. Depending on the level of interest rates applicable to these alternatives, the Company’s net interest income, and therefore earnings, could be adversely affected. See the section captioned “Liquidity Risk” in Item 7. Our ability to service our debt, pay dividends and otherwise pay our obligations as they come due is substantially dependent on capital distributions from our subsidiaries. The Company is a separate and distinct legal entity from its subsidiaries. It receives substantially all of its revenue from dividends from its subsidiaries. These dividends are the principal source of funds to pay dividends on the Company’s common stock and interest and principal on the Company’s debt. Various federal and/or state laws and regulations limit the amount of dividends that the Bank may pay to the Company. In addition, the Company’s right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors. In the event the Bank is unable to pay dividends to the Company, the Company may not be able to service debt, pay obligations or pay dividends on the Company’s common stock. The inability to receive dividends from the Bank could have a material adverse effect on the Company’s business, financial condition and results of operations. A reduction in the Company’s credit rating could adversely affect our business and/or the holders of our securities. The credit rating agency rating our indebtedness regularly evaluates the Company and the Bank. Credit ratings are based on a number of factors, including our financial strength and ability to generate earnings, as well as factors not entirely within our control, including conditions affecting the financial services industry generally and the economy and changes in rating methodologies. There can be no assurance that the Company will maintain our current credit ratings. A downgrade of the credit ratings of the Company or the Bank could adversely affect our access to liquidity and capital, significantly increase our cost of funds, and decrease the number of investors and counterparties willing to lend to the Company or purchase our securities. This could affect our growth, profitability, and financial condition, including liquidity. The Company relies on third parties to provide key components of its business infrastructure. The Company relies on third parties to provide key components for its business operations, such as data processing and storage, recording and monitoring transactions, online banking interfaces and services, internet connections and network access. While the Company selects these third party vendors carefully, it does not control their actions. Any problems caused by these third parties, including those resulting from breakdowns or other disruptions in communication services provided by a vendor, failure of a vendor to handle current or higher volumes, cyber-attacks and security breaches at a vendor, failure of a vendor to provide services for any reason or poor performance of services by a vendor, could adversely affect the Company’s ability to deliver products and services to its customers and otherwise conduct its business. Financial or operational difficulties of a third party vendor could also hurt the Company’s operations if those difficulties interfere with the vendor’s ability to serve the Company. Replacing these third party vendors also could create significant delays and expense that adversely affect the Company’s business and performance. There are substantial risks and uncertainties associated with the introduction or expansion of lines of business or new products and services within existing lines of business. From time to time, the Company may implement new lines of business or offer new products and services within existing lines of business. There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and/or new products and services, the Company may invest significant time and resources. Initial timetables for the introduction and development of new lines of business and/or new products or services may not be achieved and price and profitability targets may not prove attainable. External factors, such as compliance with regulations, competitive alternatives and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service. Furthermore, any new line of business and/or new product or service could have a significant impact on the effectiveness of the Company’s system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business or new products or services could have a material adverse effect on the Company’s business, results of operations and financial condition. 20 Table of Contents Risks Related to Legal, Governmental and Regulatory Changes We are subject to extensive government regulation and supervision, which may interfere with our ability to conduct our business and may negatively impact our financial results. We are subject to extensive federal and state regulation and supervision. Banking regulations are primarily intended to protect depositors’ funds, the DIF and the safety and soundness of the banking system as a whole, not stockholders. These regulations affect the Company’s lending practices, capital structure, investment practices, dividend policy and growth, among other things. Congress and federal regulatory agencies continually review banking laws, regulations and policies for possible changes. Furthermore, political and policy goals of elected officials may change over time, which could impact the rulemaking, supervision, examination and enforcement priorities of federal banking agencies. Changes to statutes, regulations or regulatory policies, including changes in interpretation or implementation of statutes, regulations or policies, could affect the Company in substantial and unpredictable ways. Such changes could subject the Company to additional costs, limit the types of financial services and products the Company may offer and/or limit the pricing the Company may charge on certain banking services, among other things. Compliance personnel and resources may increase our costs of operations and adversely impact our earnings. Failure to comply with laws, regulations or policies could result in sanctions by regulatory agencies, civil money penalties and/or reputation damage, which could have a material adverse effect on our business, financial condition and results of operations. While the Company has policies and procedures designed to prevent any such violations, there can be no assurance that such violations will not occur. See the section captioned “Supervision and Regulation” in Item 1. Business of this report for further information. We are subject to heightened regulatory requirements because we exceed $10 billion in total consolidated assets. As of December 31, 2025, we had total assets of approximately $16.00 billion. The Dodd-Frank Act, including the Durbin Amendment, and its implementing regulations impose enhanced supervisory requirements on bank holding companies with more than $10 billion in total consolidated assets. For bank holding companies with more than $10 billion in total consolidated assets, such requirements include, among other things: ● applicability of Volcker Rule requirements and restrictions; ● increased capital, leverage, liquidity and risk management standards; ● examinations by the CFPB for compliance with federal consumer financial protection laws and regulations; and ● limits on interchange fees from debit card transactions. The Economic Growth, Regulatory Reform and Consumer Protection Act (“EGRRCPA”), which was enacted in 2018, amended the Dodd-Frank Act to raise the $10 billion stress testing threshold to $250 billion, among other things. The federal financial regulators issued final rules in 2019 to increase the threshold for these stress testing requirements from $10 billion to $250 billion, consistent with the EGRRCPA. Our regulators will consider our compliance with these regulatory requirements that apply to us (in addition to regulatory requirements that applied to us previously) when examining our operations or considering any request for regulatory approval. We may, therefore, incur associated compliance costs and may be required to maintain compliance procedures. Failure to comply with these requirements may negatively impact the results of our operations and financial condition. To ensure compliance, we will be required to invest significant resources, which may necessitate hiring additional personnel and implementing additional internal controls. These additional compliance costs may have a material adverse effect on our business, results of operations and financial condition. 21 Table of Contents Our controls and procedures may fail or be circumvented, which may result in a material adverse effect on our business. Management regularly reviews and updates our internal controls, disclosure controls and procedures and corporate governance policies and procedures. Any system of controls, however well designed and operated, is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met. Any failure or circumvention of the controls and procedures or failure to comply with regulations related to controls and procedures could have a material adverse effect on our business, results of operations and financial condition. We may be held responsible for environmental liabilities with respect to properties to which we obtain title, resulting in significant financial loss. A significant portion of our loan portfolio at December 31, 2025 was secured by real estate. In the course of our business, we may foreclose and take title to real estate and could be subject to environmental liabilities with respect to these properties. We may be held liable to a government entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination or may be required to clean up hazardous or toxic substances, or chemical releases at a property. The costs associated with investigation and remediation activities could be substantial. In addition, if we are the owner or former owner of a contaminated site, we may be subject to common law claims by third parties based on damages and costs resulting from environmental contamination emanating from the property. These costs and claims could adversely affect our business, results of operations, financial condition and liquidity. We may be adversely affected by the soundness of other financial institutions including the FHLB of New York. Our ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services companies are interrelated as a result of trading, clearing, counterparty or other relationships. We have exposure to many different industries and counterparties and we routinely execute transactions with counterparties in the financial services industry, including brokers and dealers, commercial banks, investment banks, mutual and hedge funds and other institutional clients. As a result, defaults by, or even rumors or questions about, one or more financial services companies, or the financial services industry generally, have led to market-wide liquidity problems and could lead to losses or defaults by us or by other institutions. Many of these transactions expose us to credit risk in the event of default of our counterparty or client. In addition, our credit risk may be exacerbated if the collateral held by us cannot be realized or is liquidated at prices not sufficient to recover the full amount of the loan or derivative exposure due us. There is no assurance that any such losses would not materially and adversely affect our business, financial condition or results of operations. The Company owns common stock of FHLB of New York in order to qualify for membership in the FHLB system, which enables it to borrow funds under the FHLB of New York’s advance program. The carrying value and fair value of our FHLB of New York common stock was $13.6 million as of December 31, 2025. There are 11 branches of the FHLB, including New York, which are jointly liable for the consolidated obligations of the FHLB system. To the extent that one FHLB branch cannot meet its obligations to pay its share of the system’s debt, other FHLB branches can be called upon to make the payment. Any adverse effects on the FHLB of New York could adversely affect the value of our investment in its common stock and negatively impact our results of operations. 22 Table of Contents Provisions of our certificate of incorporation and bylaws, as well as Delaware law and certain banking laws, could delay or prevent a takeover of us by a third party. Provisions of the Company’s certificate of incorporation and bylaws, the corporate law of the State of Delaware and state and federal banking laws, including regulatory approval requirements, could delay, defer or prevent a third party from acquiring the Company, despite the possible benefit to the Company’s stockholders, or otherwise adversely affect the market price of the Company’s common stock. These provisions include supermajority voting requirements for certain business combinations and advance notice requirements for nominations for election to the Board and for proposing matters that stockholders may act on at stockholder meetings. In addition, the Company is subject to Delaware law, which among other things prohibits the Company from engaging in a business combination with any interested stockholder for a period of three years from the date the person became an interested stockholder unless certain conditions are met. These provisions may discourage potential takeover attempts, discourage bids for the Company’s common stock at a premium over market price or adversely affect the market price of and the voting and other rights of the holders of the Company’s common stock. These provisions could also discourage proxy contests and make it more difficult for you and other stockholders to elect directors other than candidates nominated by the Board. The Company has risk related to legal proceedings. The Company is involved in judicial, regulatory, and arbitration proceedings concerning matters arising from our business activities and fiduciary responsibilities. The Company establishes reserves for legal claims when payments associated with the claims become probable and the costs can be reasonably estimated. We may still incur legal costs for a matter even if a reserve is not established. In addition, the actual cost of resolving a legal claim may be substantially higher than any amounts reserved for that matter. The ultimate resolution of a pending or future legal proceeding, depending on the remedy sought and granted, could materially adversely affect our results of operations and financial condition. Risks Related to Information Technology, Cybersecurity and Data Privacy The Company faces operational risks and cybersecurity risks associated with incidents which have the potential to disrupt our operations, cause material harm to our financial condition, result in misappropriation of assets, compromise confidential information and/or damage our business relationships and cannot guarantee that the steps we and our service providers take in response to these risks will be effective. We depend upon data processing, communication systems, and information exchange on a variety of platforms and networks and over the internet to conduct business operations. In addition, we rely on the services of a variety of vendors to meet our data processing and communication needs. Although we require third party providers to maintain certain levels of security, such providers remain vulnerable to breaches, security incidents, system unavailability or other malicious attacks that could compromise sensitive information. Further, new technologies such as AI may be more capable of evading safeguard measures. The risk of experiencing security incidents and disruptions, particularly through cyber-attacks or cyber intrusions, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions by organized crime, hackers, terrorists, nation-states, activists and other external parties has increased. These security incidents may result in disruption of our operations; material harm to our financial condition, cash flows and the market price of our common stock; misappropriation of assets; compromise or corruption of confidential information; liability for information or assets stolen during the incident; remediation costs; increased cybersecurity and insurance costs; regulatory enforcement; litigation; and damage to our stakeholder and customer relationships. Moreover, in the normal course of business, we and our service providers collect and retain certain personal information provided by our customers, employees and vendors. If this information gets mishandled, misused, improperly accessed, lost or stolen, we could suffer significant financial, business, reputational, regulatory or other harm. These risks may increase as we continue to increase and expand our usage of web-based products and applications. These risks require continuous and likely increasing attention and resources from us to, among other actions, identify and quantify potential cybersecurity risks, and upgrade and expand our technologies, systems and processes to adequately address the risk. We provide on-going training for our employees to assist them in detecting phishing, malware and other malicious schemes. Such attention diverts time and resources from other activities and, while we have implemented policies and procedures designed to maintain the security and integrity of the information we and our service providers collect on our and their computer systems, there can be no assurance that our efforts will be effective. Likewise, while we have implemented security measures to prevent unauthorized access to personal information and prevent or limit the effect of possible incidents, we can provide no assurance that a security breach or disruption will not be successful or damaging, or, if any such breach or disruption does occur, that it can be sufficiently or timely remediated. Even the most well protected information, networks, systems and facilities remain potentially vulnerable because the techniques used in such attempted security breaches evolve and generally are not recognized until launched against a target, and in some cases are designed not to be detected and, in fact, may not be detected. Accordingly, we may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures, and thus it is impossible for us to entirely mitigate this risk. 23 Table of Contents The Company may be adversely affected by fraud. As a financial institution, the Company is inherently exposed to operational risk in the form of theft and other fraudulent activity by employees, customers and other third parties targeting the Company and/or the Company’s customers or data. Such activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering and other dishonest acts. Although the Company devotes substantial resources to maintaining effective policies and internal controls to identify and prevent such incidents, given the increasing sophistication of possible perpetrators, the Company may experience financial losses or reputational harm as a result of fraud. We continually encounter technological change and the failure to understand and adapt to these changes could have a material adverse impact on our business. The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services (including those related to or involving AI, machine learning, blockchain and other technologies). The effective use of technology increases efficiency and enables financial institutions to serve customers better and to reduce costs. The Company’s future success depends, in part, upon its ability to address the needs of its customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in the Company’s operations. Many of the Company’s competitors have substantially greater resources to invest in technological improvements. The Company may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to its customers. Failure to successfully keep pace with technological changes affecting the financial services industry could have a material adverse impact on the Company’s business and, in turn, the Company’s financial condition and results of operations. The development and use of AI exposes us to risks that may adversely impact our business. We or our third-party providers may develop or incorporate AI technology in certain business processes, services, or products. The development and use of AI poses a number of risks and challenges to our business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, and we may be subject to increasing regulations related to our use of these technologies, including regulations related to privacy, data security, and intellectual property rights, which could expose us to legal risks. AI models, particularly generative AI models, may produce incorrect, biased, or misleading results, expose confidential information, or infringe on intellectual property rights. Further, we may rely on AI models developed by third parties, and, to that extent, would be subject to additional risks, including limited oversight of how these models are developed and trained and potential exposure to unauthorized data usage. If our AI models, or those developed by third parties, produce inaccurate or controversial results, we could face legal liability, regulatory scrutiny, reputational harm, or operational inefficiencies. These risks could negatively impact our business, financial results, and the perception of our security measures. The Company’s use of AI currently varies across platforms, with certain third party systems incorporating AI capabilities into routine business operations. As our adoption and internal development of AI enabled tools continues to evolve, we evaluate these technologies through our established Solutions Development Lifecycle (SDLC), which includes model validation and other risk management controls. Risks Related to an Investment in the Company’s Securities There may be future sales or other dilution of the Company’s equity, which may adversely affect the market price of the Company’s stock. The Company is not restricted from issuing additional common stock, including any securities that are convertible into or exchangeable for, or that represent the right to receive, common stock. The Company also grants shares of common stock to employees and directors under the Company’s incentive plan each year. The issuance of any additional shares of the Company’s common stock or preferred stock or securities convertible into, exchangeable for or that represent the right to receive common stock or the exercise of such securities could be substantially dilutive to stockholders of the Company’s common stock. Holders of the Company’s common stock have no preemptive rights that entitle such holders to purchase their pro rata share of any offering of shares of any class or series. Because the Company’s decision to issue securities in any future offering will depend on market conditions, its acquisition activity and other factors, the Company cannot predict or estimate the amount, timing or nature of its future offerings. Thus, the Company’s stockholders bear the risk of the Company’s future offerings reducing the market price of the Company’s common stock and diluting their stock holdings in the Company. 24 Table of Contents General Risks The risks presented by acquisitions could adversely affect our financial condition and results of operations. The business strategy of the Company has included and may continue to include growth through acquisition. Any acquisitions will be accompanied by the risks commonly encountered in acquisitions. These risks may include, among other things: ● exposure to potential asset quality issues of the acquired business; ● potential exposure to unknown or contingent liabilities of the acquired business; ● our ability to realize anticipated cost savings; ● the difficulty of integrating operations and personnel and the potential loss of key employees; ● the potential disruption of our or the acquired company’s ongoing business in such a way that could result in decreased revenues or the inability of our management to maximize our financial and strategic position; ● the inability to maintain uniform standards, controls, procedures and policies; and ● the impairment of relationships with the acquired company’s employees and customers as a result of changes in ownership and management. We cannot provide any assurance that we will be successful in overcoming these risks or any other problems encountered in connection with acquisitions. Our inability to overcome these risks could have an adverse effect on the achievement of our business strategy and results of operations. We rely on our management and other key personnel, and the loss of any of them may adversely affect our operations. We are and will continue to be dependent upon the services of our executive management team. In addition, we will continue to depend on our ability to retain and recruit key client relationship managers. The unexpected loss of services of any key management personnel, or the inability to recruit and retain qualified personnel in the future, could have an adverse effect on our business and financial condition. ITEM 1B. UNRESOLVED STAFF COMMENTS None. ITEM 1C. CYBERSECURITY Risk Management and Strategy In line with our commitment to strong corporate governance and operational resilience, we continuously assess and mitigate cybersecurity risks that could impact our business, stakeholders, and the integrity of our systems. Cybersecurity risk management is integrated into our broader enterprise risk management framework and supports the continuity of our operations. We assess cybersecurity risks across our information systems, including systems and data maintained by third-party service providers, using a risk-based approach that incorporates periodic risk assessments, vulnerability scanning, penetration testing, and monitoring of emerging threats. We also consider industry-specific risks and participate in industry information-sharing initiatives to enhance our awareness of evolving threat intelligence and best practices. Our cybersecurity program emphasizes prevention, detection, and response. We provide continuous training for our employees to promote awareness of cybersecurity risks and invest in appropriate technologies, personnel and processes to support our information security objectives. Additionally, we assess cybersecurity risks associated with third-party service providers using a risk-based approach that considers the nature and scope of their services. Our comprehensive policies and procedures are designed to safeguard the integrity and security of information collected by us and our service providers. We have also implemented security measures to prevent unauthorized access to personal data and mitigate potential incidents. Furthermore, we incorporate lessons learned from any past incidents and near misses to enhance the effectiveness of our controls. NBT collaborates with external experts to conduct audits, assessments, and validations of our cybersecurity controls, aligning them with established frameworks such as the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework. We adapt our cybersecurity policies, standards, processes, and practices based on insights from these reviews. 25 Table of Contents Governance The Board oversees cybersecurity risk as part of its broader oversight of business strategy and enterprise risk management. It is the responsibility of the Risk Management Committee (“RMC”), a committee of the Board, to oversee efforts to develop and formally approve the written Information Security Program (“ISP”), implement, maintain and monitor the program, and review management reports and policies related to cyber incidents. The RMC is led by our Chief Risk Officer and comprised of Board members as well as the Chief Executive Officer. Cybersecurity risks are reported to the RMC at least quarterly, and those reports include key performance indicators, test results, recent threats and how the Company is managing those threats, along with the effectiveness of the ISP. The RMC receives briefings from executive management on activities, including those related to cybersecurity risk oversight. The Board reviews the overall ISP at least annually. NBT has appointed the Senior Director of Information Security (“DISO”) to oversee the implementation, coordination, and maintenance of the ISP. The DISO’s responsibilities include: ● Leading the initial implementation of the ISP, including assessing internal and external risks to institutional data and documenting findings through risk assessment reports and remediation plans; ● Coordinating the development, distribution, and maintenance of information security policies and procedures; ● Designing and implementing administrative, technical, and physical safeguards to protect institutional data across the company. The DISO reports to the Chief Risk Officer and has over 17 years of experience in information security, including extensive responsibility for developing, implementing and overseeing the Company’s information security program . The DISO’s experience includes cybersecurity risk management, cybercrime prevention, incident response, social engineering, identity theft, and fraud prevention, gained through long-term leadership in information security roles within the organization. The DISO also supervises the Incident Response Team (“IRT”), which consists of senior executives, including the Chief Audit Officer, Chief Risk Officer, General Counsel, and representatives from Information Security, Enterprise Technology, Operations, Accounting, and Communications. Upon detecting an incident, the IRT promptly convenes to assess its severity, categorizing it as low, medium, or high. The response protocol follows the Cybersecurity and Infrastructure Security Agency (“CISA”) Cybersecurity Incident and Vulnerability Response Playbook (November 2021) and incorporates generally recognized cybersecurity incident response practices. The IRT has procedures and escalation protocols to escalate significant cybersecurity matters to the Executive Committee, the RMC and/or full Board, as deemed necessary. During the incident review process, senior management, in collaboration with relevant personnel from information technology, data security, and external cybersecurity firms specializing in forensic investigations, when necessary, assesses the materiality of the breach alongside the severity scale. This evaluation aims to accurately identify risks and potential operational and business impacts. Materiality determination involves an objective analysis of both quantitative and qualitative factors, including an evaluation of impact and reasonably likely impacts. We maintain cybersecurity insurance; however, such coverage may not be sufficient to cover all potential losses. As of December 31, 2025 we have not had any known instances of material cybersecurity incidents, including third-party incidents during any of the prior three fiscal years. However, cybersecurity threats continue to evolve, and there can be no assurance that future incidents will not occur. For further discussion of such risks, see the section captioned “Risks Related to Information Technology, Cybersecurity and Data Privacy” in Item 1A. Risk Factors of this Form 10-K.