What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2025-03-03 compared with 2024-02-27 · 64 added, 81 removed, 269 unchanged (35% of the section changed)

16 unchanged sentences

Human Capital Management

Our commitment to every customer starts with a talented team.

To attract and retain our talented team, we strive to make S&T an inclusive, safe and healthy workplace that provides our employees with opportunities to grow and develop.

Our commitment to our customers starts with a talented team.

To attract and retain our talented team, we strive to make S&T an inclusive workplace that provides our employees with opportunities to develop and grow.

The S&T mindset is to encourage, develop and inspire all employees to achieve their best, motivated by their own personal progress and development.

Our commitment is to foster an inclusive workplace where everyone utilizes their knowledge, skills, abilities and unique interests to help each other find success and drive positive results.

S&T fosters an inclusive work culture where employees work together to better our company, products and services and community.

We are committed to promoting a workplace that develops all people through ensuring fairness in all aspects of employment, educating our employees and fostering a culture to address employees’ and customers’ needs.

As of December 31, 2024, we had approximately 1,206 full time equivalent employees.

5 unchanged sentences

Our team strives to embody values to encourage a culture that has enabled us to be named a top workplace.

The following are our five core values that support our Purpose:

The following five core values support our purpose:

Make People our Purpose

7 unchanged sentences

In every case, we seek the right solutions based on a holistic understanding of the opportunities ahead of us.

S&T BANCORP, INC.

AND SUBSIDIARIES

Value Every Voice

2 unchanged sentences

And we always welcome an honest and open dialogue with our colleagues, customers and the community at large.

S&T BANCORP, INC.

AND SUBSIDIARIES

Win as One Team

1 unchanged sentence

We communicate, collaborate and care enough to go the extra mile for the colleagues we work alongside, the customers we serve and the communities where we live.

Diversity and Inclusion

S&T fosters a diverse work culture where employees work together to better our company, services and community.

We are committed to promoting a diverse workforce and developing all people through:

• Equal Opportunity Employment

• Educating our employees and board of directors

• Fostering a culture to address employees’ and customers’ needs

• Partnering with diverse vendors

The S&T mindset is to encourage, develop and inspire all employees to achieve their best, motivated by their own personal development.

Our commitment is to a diverse, equitable and inclusive workplace where everyone utilizes their knowledge, skills, abilities and unique interests to help each other find success and drive positive results.

Our Compensation and Benefits Committee of the Board of Directors oversees our diversity and inclusion strategy, and at least annually, measures the success of diversity and inclusion initiatives by reviewing S&T’s strategies and statistics from S&T’s Human Capital Management System.

Diversity, equity and inclusion, or DEI, is a commitment that we are focused on through various avenues to create awareness, provide education, support our colleagues and communities, develop and improve products and services, partner with diverse vendors and drive results tied to our overall organizational strategy.

As part of our DEI strategy, we launched our DEI Advisory Council during 2022.

The DEI Advisory Council is co-chaired by our Chief Executive Officer and Chief Human Resources Officer and is made up of colleagues from departments across our organization.

We conduct an ongoing S&T Commemorates webinar series that is designed to explore a wide scope of DEI topics.

Talent Development and Training

Our training plan strives to provide all departments with access to comprehensive training to enhance all job positions.

Our Corporate Training Department maintains oversight of all training to ensure that it is implemented and monitored properly and encourages career development for our employees.

Our training program offers a blended learning approach comprised of classroom and online course delivery.

We have many training sessions that are a virtual format through webinars and learning management system delivery for regulatory, compliance, skill-based, technology, leadership and career development.

Certain trainings are conducted live based on the needs of the program.

In 2023, our employees logged approximately 78,532 training hours, on average 63 hours per employee, which is an increase of approximately 7 percent compared to 2022.

S&T strives to provide our employees access to comprehensive training to enhance all job positions.

Our corporate training department maintains oversight of trainings to ensure it is implemented and monitored properly and encourages career development for our employees.

Our training programs offer a blended learning approach comprised of classroom, asynchronous online learning and synchronous online sessions.

Our learning management systems and vendor relationships provide employees regulatory, compliance, skill-based, technology, leadership and career development trainings.

We encourage all employees to develop their skill sets and careers through a variety of internal and external training opportunities to align our organization for long-term success.

We are dedicated to investing in and developing our managers, supervisors and future leaders of S&T.

Our multi-tier succession plan includes replacement planning of vacancies, ongoing talent development and career path design of current employees.

Additional resources that support these initiatives include S&T's annual training and recruitment plans that identify specific actionable programs and efforts.

In 2024, our employees logged approximately 77,290 training hours, on average 64 hours per employee.

Safety, Health and Wellness

7 unchanged sentences

The charters of the Audit Committee, the Compensation and Benefits Committee, the Credit Risk Committee, the Executive Committee, the Nominating and Corporate Governance Committee and the Risk Committee as well as the Complaints Regarding Accounting, Internal Accounting Controls or Auditing Matters ("Whistleblower Policy"), the Code of Conduct for the CEO and CFO, the General Code of Conduct, the Shareholder Communications Policy and the Corporate Governance Guidelines are also available at www.stbancorp.com under Governance.

S&T BANCORP, INC.

AND SUBSIDIARIES

Supervision and Regulation

5 unchanged sentences

If S&T’s assets cross the $10 billion threshold, we will be subject to different and additional regulations than those described below.

S&T BANCORP, INC.

AND SUBSIDIARIES

The Dodd-Frank Wall Street Reform and Consumer Protection Act, or Dodd-Frank Act, enacted in July 2010, has had and will continue to have a broad impact on the financial services industry, including significant regulatory and compliance changes addressing, among other things:

5 unchanged sentences

and (vi) numerous other provisions designed to improve supervision and oversight of, and strengthen safety and soundness for, the financial services sector.

Additionally, the Dodd-Frank Act established a new framework for systemic risk oversight within the financial system to be distributed among new and existing federal regulatory agencies, including the Financial Stability Oversight Council, the Federal Reserve Board, the Office of the Comptroller of the Currency and the FDIC.

Additionally, the Dodd-Frank Act established a new framework for systemic risk oversight within the financial system to be distributed among new and existing federal regulatory agencies, including the Financial Stability Oversight Council, the Federal Reserve Board, or FRB, the Office of the Comptroller of the Currency, or OCC, and the FDIC.

While many requirements called for in the Dodd-Frank Act have been implemented, these regulations are subject to continuing interpretation and potential amendment.

Given the continued uncertainty associated with the ongoing implementation of the requirements of the Dodd-Frank Act by the various regulatory agencies, including the manner in which the remaining provisions will be implemented and the interpretation of and potential amendments to existing regulations, the full extent of the impact of such requirements on financial institutions’ operations remains unclear, but management expects will continue to affect us in some way.

The continuing changes resulting from the Dodd-Frank Act may impact the profitability of our business activities, require changes to certain of our business practices, increase our operating and compliance costs, or otherwise adversely affect our business.

The continuing changes resulting from the Dodd-Frank Act may impact the profitability of our business activities, require changes to business practices, increase our operating and compliance costs, or otherwise adversely affect our business.

These changes may also require us to invest significant management attention and resources to evaluate and make necessary changes in order to comply with new statutory and regulatory requirements.

4 unchanged sentences

The likelihood and timing of any changes and the impact such changes might have on S&T is impossible to determine with any certainty.

We are a bank holding company subject to regulation under the BHCA and the examination and reporting requirements of the Federal Reserve Board.

Under the BHCA, a bank holding company may not directly or indirectly acquire ownership or control of more than five percent of the voting shares or substantially all of the assets of any additional bank, or merge or consolidate with another bank holding company, without the prior approval of the Federal Reserve Board.

We are a bank holding company subject to regulation under the BHCA and the examination and reporting requirements of the FRB.

As a bank holding company, we are expected under statutory and regulatory provisions to serve as a source of financial and managerial strength to our subsidiary bank.

A bank holding company is also expected to commit resources, including capital and other funds, to support its subsidiary bank.

S&T BANCORP, INC.

AND SUBSIDIARIES

We elected to become a financial holding company under the BHCA in 2001 and thereby may engage in a broader range of financial activities than are permissible for traditional bank holding companies.

In order to maintain our status as a financial holding company, we must remain “well-capitalized” and “well-managed” and the depository institutions controlled by us must remain “well-capitalized,” “well-managed” (as defined in federal law) and have at least a “satisfactory” Community Reinvestment Act, or CRA, rating.

Refer to Note 23 Regulatory Matters to the consolidated financial statements contained in Part II, Item 8 of this Report for information concerning the current capital ratios of S&T and S&T Bank.

No prior regulatory approval is required for a financial holding company with total consolidated assets less than $50 billion to acquire a company, other than a bank or savings association, engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the Federal Reserve Board, unless the total consolidated assets to be acquired exceed $10 billion.

Refer to Note 23.

Regulatory Matters to the consolidated financial statements contained in Part II, Item 8 of this Report for information concerning the current capital ratios of S&T and S&T Bank.

No prior regulatory approval is required for a financial holding company with total consolidated assets less than $50 billion to acquire a company, other than a bank or savings association, engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the FRB, unless the total consolidated assets to be acquired exceed $10 billion.

The BHCA identifies several activities as “financial in nature” including, among others, securities underwriting;

3 unchanged sentences

investment advisory activities;

merchant banking activities and activities that the Federal Reserve Board has determined to be closely related to banking.

merchant banking activities and activities that the FRB has determined to be closely related to banking.

Banks may also engage in, subject to limitations on investment, activities that are financial in nature, other than insurance underwriting, insurance company portfolio investment, real estate development and real estate investment, through a financial subsidiary of the bank, if the bank is “well-capitalized,” “well-managed” and has at least a “satisfactory” CRA rating.

If S&T or S&T Bank ceases to be “well-capitalized” or “well-managed,” we will not be in compliance with the requirements of the BHCA regarding financial holding companies or requirements regarding the operation of financial subsidiaries by insured banks.

If a financial holding company is notified by the Federal Reserve Board of such a change in the ratings of any of its subsidiary banks, it must take certain corrective actions within specified time frames.

S&T BANCORP, INC.

AND SUBSIDIARIES

If a financial holding company is notified by the FRB of such a change in the ratings of any of its subsidiary banks, it must take certain corrective actions within specified time frames.

Furthermore, if S&T Bank was to receive a CRA rating of less than “satisfactory,” then we would be prohibited from engaging in certain new activities or acquiring companies engaged in certain financial activities until the rating is raised to “satisfactory” or better.

19 unchanged sentences

In addition, pursuant to the Federal Bank Merger Act, S&T Bank must obtain the prior approval of the FDIC before it can merge or consolidate with or acquire the assets or assume the deposit liabilities of another bank.

S&T BANCORP, INC.

AND SUBSIDIARIES

S&T Bank is subject to affiliate transaction rules in Sections 23A and 23B of the Federal Reserve Act as implemented by the Federal Reserve Board's Regulation W, that limit the amount of transactions between itself and S&T or any other company or entity that controls or is under common control with any company or entity that controls S&T Bank, including for most purposes any financial or depository institution subsidiary of S&T Bank.

S&T Bank is subject to affiliate transaction rules in Sections 23A and 23B of the Federal Reserve Act as implemented by the FRB's Regulation W, that limit the amount of transactions between itself and S&T or any other company or entity that controls or is under common control with any company or entity that controls S&T Bank, including for most purposes any financial or depository institution subsidiary of S&T Bank.

Under these provisions, “covered” transactions, including making loans, purchasing assets, issuing guarantees and other similar transactions, between a bank and its parent company or any other affiliate, generally are limited to 10 percent of the bank subsidiary’s capital and surplus, and with respect to all transactions with affiliates, are limited to 20 percent of the bank subsidiary’s capital and surplus.

6 unchanged sentences

The Dodd-Frank Act also placed restrictions on certain asset sales to and from an insider to an institution, including requirements that such sales be on market terms and, in certain circumstances, approved by the institution’s board of directors.

S&T BANCORP, INC.

AND SUBSIDIARIES

Insurance of Accounts;

17 unchanged sentences

The special assessment will be collected at an annual rate of approximately 13.4 basis points for an anticipated total of eight quarterly assessment periods, beginning in the first quarterly assessment period of 2024 (January 1 through March 31, 2024).

Because the Bank's uninsured deposits were below $5 billion at December.

31, 2022, this special assessment is not applicable to S&T.

The FDIC may terminate the deposit insurance of any insured depository institution if it determines, after hearing that the institution has engaged in unsafe or unsound practices, that the institution is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC or the Federal Reserve Board.

Because the Bank's uninsured deposits were below $5 billion at December 31, 2022, this special assessment is not applicable to S&T.

It also may suspend deposit insurance temporarily during the hearing process if the institution has no tangible capital.

If insurance of accounts is terminated, the accounts at the institution at the time of termination, less subsequent withdrawals, will continue to be insured for a period of six months to two years, as determined by the FDIC.

S&T BANCORP, INC.

AND SUBSIDIARIES

Under federal law, deposits and certain claims for administrative expenses and employee compensation against insured depository institutions are afforded a priority over other general unsecured claims against such an institution, including federal funds and letters of credit, in the liquidation or other resolution of such an institution by a receiver.

Such priority creditors would include the FDIC.

The Federal Reserve Board and the FDIC have issued substantially similar minimum risk-based and leverage capital rules applicable to the banking organizations they supervise.

S&T BANCORP, INC.

AND SUBSIDIARIES

The FRB and the FDIC have issued substantially similar minimum risk-based and leverage capital rules applicable to the banking organizations they supervise.

On December 31, 2024, both S&T and S&T Bank met the applicable minimum regulatory capital requirements.

23 unchanged sentences

The leverage ratio represents capital as a percentage of total average assets adjusted as specified in the guidelines.

In July 2013, the federal banking agencies issued final regulatory capital rules that replaced the then existing general risk-based capital and related rules, broadly revising the basic definitions and elements of regulatory capital and making substantial changes to the risk weightings for banking and trading book assets.

These regulatory capital rules are designed to implement Basel III (which were agreements reached in July 2010 by the international oversight body of the Basel Committee on Banking Supervision to require more and higher-quality capital) as well as the minimum leverage and risk-based capital requirements of the Dodd-Frank Act.

These capital standards apply to all banks, regardless of size, and to all bank holding companies with consolidated assets greater than $500 million and became effective on January 1, 2015.

For smaller banking organizations such as S&T and S&T Bank, the rules were subject to a transition period providing for full implementation as of January 1, 2019.

Generally, under the guidelines, common equity Tier 1 capital consists of common stock instruments that meet the eligibility criteria in the rule, retained earnings, accumulated other comprehensive income and common equity Tier 1 minority interest, less applicable regulatory adjustments and deductions including goodwill, intangible assets subject to limitation and certain deferred tax assets subject to limitation.

Tier 1 capital is comprised of common equity Tier 1 capital plus generally non-cumulative perpetual preferred stock, Tier 1 minority interests and, for bank holding companies with less than $15 billion in consolidated assets at December 31, 2009, certain restricted capital instruments including qualifying cumulative perpetual preferred stock and grandfathered trust preferred securities, up to a limit of 25 percent of Tier 1 capital, less applicable regulatory adjustments and deductions.

Tier 2, or supplementary, capital generally includes portions of trust preferred securities and cumulative perpetual preferred stock not otherwise counted in Tier 1 capital, as well as preferred stock, subordinated debt, total capital minority interests not included in Tier 1, and the allowance for credit losses, or ACL, in an amount not exceeding

S&T BANCORP, INC.

AND SUBSIDIARIES

1.25 percent of standardized risk-weighted assets, less applicable regulatory adjustments and deductions.

Total capital is the sum of Tier 1 and Tier 2 capital.

After a phase in period beginning in 2016, these regulatory capital rules also require a banking organization to maintain a capital conservation buffer composed of common equity Tier 1 capital in an amount greater than 2.50 percent of total risk-weighted assets beginning in 2019.

The regulatory capital rules also require a banking organization to maintain a capital conservation buffer composed of common equity Tier 1 capital in an amount greater than 2.50 percent of total risk-weighted assets beginning in 2019.

As a result, since 2019, a banking organization has been required to maintain a common equity Tier 1 risk-based capital ratio greater than 7.00 percent, a Tier 1 risk-based capital ratio greater than 8.50 percent and a Total risk-based capital ratio greater than 10.50 percent;

1 unchanged sentence

Since 2019, the minimum capital requirements plus the capital conservation buffer exceed the regulatory capital ratios required for an insured depository institution to be well-capitalized under prompt corrective action law, described in "Other Safety and Soundness Regulations."

These regulatory capital rules also revise the calculation of risk-weighted assets, including a new framework under which the risk weight will increase for most credit exposures that are 90 days or more past due or on nonaccrual, high-volatility commercial real estate loans, mortgage servicing and deferred tax assets that are not deducted from capital and certain equity exposures.

The rules include changes to the credit conversion factors of off-balance sheet items, such as the unused portion of a loan commitment.

Federal regulators periodically propose amendments to the regulatory capital rules and the related regulatory framework and consider changes to the capital standards that could significantly increase the amount of capital needed to meet applicable standards.

The timing of adoption, ultimate form and effect of any such proposed amendments cannot be predicted.

S&T BANCORP, INC.

AND SUBSIDIARIES

Payment of Dividends

4 unchanged sentences

In addition, both S&T and S&T Bank are subject to various general regulatory policies relating to the payment of dividends, including requirements to maintain adequate capital above regulatory minimums.

The Federal Reserve Board has indicated that banking organizations should generally pay dividends only if (i) the organization’s net income available to common shareholders over the past year has been sufficient to fully fund the dividends and (ii) the prospective rate of earnings retention appears consistent with the organization’s capital needs, asset quality and overall financial condition.

Thus, under certain circumstances based upon our financial condition, our ability to declare and pay quarterly dividends may require consultation with the Federal Reserve Board and may be prohibited by applicable Federal Reserve Board guidance.

The FRB has indicated that banking organizations should generally pay dividends only if (i) the organization’s net income available to common shareholders over the past year has been sufficient to fully fund the dividends and (ii) the prospective rate of earnings retention appears consistent with the organization’s capital needs, asset quality and overall financial condition.

Thus, under certain circumstances based upon our financial condition, our ability to declare and pay quarterly dividends may require consultation with the FRB and may be prohibited by applicable FRB guidance.

Other Safety and Soundness Regulations

3 unchanged sentences

The extent of these powers depends upon whether the institution in question is “well-capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” or “critically undercapitalized,” as defined by the law.

As of December 31, 2023, S&T Bank was classified as “well-capitalized.” New definitions of these categories, as set forth in the federal banking agencies’ final rule to implement Basel III and the minimum leverage and risk-based capital requirements of the Dodd-Frank Act, became effective as of January 1, 2015.

Refer to the above section titled Capital within this Item 1.

As of December 31, 2024, S&T Bank was classified as “well-capitalized.” Refer to the above section titled Capital within this Item 1.

Business section for capital requirements.

7 unchanged sentences

and, ultimately, appointing a receiver for the institution.

S&T BANCORP, INC.

AND SUBSIDIARIES

The federal banking agencies have also adopted guidelines prescribing safety and soundness standards relating to internal controls and information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, fees and compensation and benefits.

8 unchanged sentences

At the state level, the PADBS also has broad enforcement powers over S&T Bank, including the power to impose fines and other penalties and to appoint a conservator or receiver.

S&T BANCORP, INC.

AND SUBSIDIARIES

Interstate Banking and Branching

10 unchanged sentences

Furthermore, such assessment is required of any bank that has applied, among other things, to merge or consolidate with or acquire the assets or assume the liabilities of an insured depository institution, or to open or relocate a branch office.

In the case of a bank holding company, including a financial holding company, applying for approval to acquire a bank or bank holding company, the Federal Reserve Board will assess the record of each subsidiary bank of the applicant bank holding company in considering the application.

In the case of a bank holding company, including a financial holding company, applying for approval to acquire a bank or bank holding company, the FRB will assess the record of each subsidiary bank of the applicant bank holding company in considering the application.

Under the CRA, institutions are assigned a rating of “outstanding,” “satisfactory,” “needs to improve” or “unsatisfactory.” S&T Bank was rated “satisfactory” in its most recent CRA performance evaluation.

2 unchanged sentences

Most of the final rule’s requirements will be applicable beginning in January 2026, while the remaining requirements, including data reporting requirements, will be applicable in January 2027.

S&T BANCORP, INC.

AND SUBSIDIARIES

With respect to consumer protection, the Dodd-Frank Act created the Consumer Financial Protection Bureau, or the CFPB, which took over rulemaking responsibility on July 21, 2011 for the principal federal consumer financial protection laws, such as those identified above.

6 unchanged sentences

S&T Bank is required to have a fair lending program that is of sufficient scope to monitor the inherent fair lending risk of the institution and that appropriately remediates issues which are identified.

S&T BANCORP, INC.

AND SUBSIDIARIES

During 2013, the CFPB issued a series of final rules related to mortgage loan origination and mortgage loan servicing, which became effective in 2014.

2 unchanged sentences

The presumption is a conclusive presumption/safe harbor for prime loans meeting the QM requirements, and a rebuttable presumption for higher-priced/subprime loans meeting the QM requirements.

The QM Rule also adds an explicit maximum

43 percent debt-to-income ratio (DTI) for borrowers if the loan is to meet the QM definition, though some mortgages that meet government-sponsored enterprise, or GSE, Federal Housing Administration, or FHA, and Veterans Affairs, or VA, underwriting guidelines may, for a period not to exceed seven years, meet the QM definition without being subject to the

43 percent DTI limits (GSE Patch).

The QM Rule also adds an explicit maximum 43 percent debt-to-income ratio (DTI) for borrowers if the loan is to meet the QM definition, though some mortgages that meet government-sponsored enterprise, or GSE, Federal Housing Administration, or FHA, and Veterans Affairs, or VA, underwriting guidelines may, for a period not to exceed seven years, meet the QM definition without being subject to the 43 percent DTI limits (GSE Patch).

In December 2020, the CFPB published a final rule that replaced the 43 percent DTI ratio limit in the general QM definition (the “General QM Rule”) with a limit based on the loan’s pricing.

The final rule also created a new category of qualified mortgage, called a seasoned qualified mortgage, for first lien, fixed rate covered loans that meet certain performance requirements, are held in portfolio by the originating creditor or first purchaser for a 36-month period, comply with general restrictions on product features and points and fees, and meet certain underwriting requirements.

The final rule also created a new category of qualified mortgage, called a seasoned qualified mortgage, for first lien, fixed rate covered loans that meet certain performance requirements, are held in the portfolio of the originating creditor or first purchaser for a 36-month period, comply with general restrictions on product features and points and fees, and meet certain underwriting requirements.

The compliance date of the final rules was October 1, 2022.

12 unchanged sentences

Since S&T generally does not engage in the activities prohibited by the Volcker Rule, the effectiveness of the rule has not had a material effect on S&T Bank or its affiliates.

S&T BANCORP, INC.

AND SUBSIDIARIES

In addition, the Dodd-Frank Act provides that the amount of any interchange fee charged for electronic debit transactions by debit card issuers having assets over $10 billion must be reasonable and proportional to the actual cost of a transaction to the issuer.

The Federal Reserve Board has adopted a rule which limits the maximum permissible interchange fees that such issuers can receive for an electronic debit transaction.

The FRB has adopted a rule which limits the maximum permissible interchange fees that such issuers can receive for an electronic debit transaction.

This rule, Regulation II, was effective October 1, 2011, and then amended on October 3, 2022 to require debit card issuers to provide at least two unaffiliated payment card networks to process card-not-present debit card transactions.

3 unchanged sentences

Federal regulators have issued statements regarding cybersecurity addressing the controls that financial institutions should design and business continuity planning and recovery processes that should be in place.

Additionally, the FDIC, OCC and Federal Reserve Board issued a final rule that became effective in May 2022, requiring banking organizations that experience a computer-security incident to notify certain entities and its federal regulator of the computer-security incident as soon as possible and no later than 36 hours after the bank determines a computer-security incident has occurred.

This rule also requires banking organizations to notify their customers of a computer-security incident that has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours.

Moreover, in March 2022, the Cyber Incident Reporting for Critical Infrastructure Act was enacted and once final rules are adopted, will require certain covered entities to report a covered cyber incident to the U.S.

Additionally, the FDIC, OCC and FRB issued a final rule that became effective in May 2022, requiring banking organizations that experience a computer-security incident to notify certain entities and its federal regulator of the computer-security incident as soon as possible and no later than 36 hours after the bank determines a computer-security incident has occurred.

This rule also requires banking organizations to notify

S&T BANCORP, INC.

AND SUBSIDIARIES

their customers of a computer-security incident that has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours.

Moreover, in March 2022, the Cyber Incident Reporting for Critical Infrastructure Act, or CIRCIA, was enacted and once final rules are adopted, will require certain covered entities to report a covered cyber incident to the U.S.

Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency, or CISA, within 72 hours after a covered entity reasonably believes an incident has occurred.

Separate reporting to CISA will also be required within 24 hours if a ransom payment is made as a result of a ransomware attack.

Furthermore, in September 2023, the SEC’s Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure rules went into effect now requiring, among other disclosure obligations, companies to publicly disclose the occurrence of a material cybersecurity incident, including the material aspects of the nature, scope and timing of the incident and the material impact on the company including financial condition and results of operation beginning with any material cybersecurity incidents occurring on or after December 18, 2023.

In April 2024, the CISA issued proposed rules under the CIRCIA that would clarify the scope of cyber incidents to be reported and would further define covered entities subject to the CIRCIA.

Public comments were due in July 2024 and the final rules are expected to be adopted later in 2025.

Furthermore, in September 2023, the SEC’s Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure rules went into effect requiring, among other disclosure obligations, companies to publicly disclose the occurrence of a material cybersecurity incident, including the material aspects of the nature, scope and timing of the incident and the material impact on the company including financial condition and results of operation beginning with any material cybersecurity incidents occurring on or after December 18, 2023.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations, including data breach notification requirements.

17 unchanged sentences

Technological innovations have lowered traditional barriers to entry and enabled many companies to compete in financial services markets.

Many customers now expect

S&T BANCORP, INC.

AND SUBSIDIARIES

a choice of banking options for the delivery of services, including traditional banking offices, telephone, internet, mobile, ATMs, self-service branches, in-store branches and/or digital and technology based solutions.

Many customers now expect a choice of banking options for the delivery of services, including traditional banking offices, telephone, internet, mobile, ATMs, self-service branches, in-store branches and/or digital and technology based solutions.

These delivery channels are offered by traditional banks and savings associations, credit unions, brokerage firms, asset management groups, financial technology companies, finance and insurance companies, internet-based companies and mortgage banking firms.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business