What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-03-10 compared with 2025-03-10 · 38 added, 35 removed, 69 unchanged (51% of the section changed)

7 unchanged sentences

maintain the integrity of Bank data and systems, prevent unauthorized access to confidential data and Bank systems, and achieve

the Company’s operational, financial, reputational, legal and regulatory compliance requirements or objectives.

Risk Factors – Risks Related to Cybersecurity and Data Privacy – “ We Face Cybersecurity Risks and

Risks Associated With Security Breaches Which Have the Potential to Disrupt Our Operations, Cause Material Harm to Our Financial

Condition, Result in Misappropriation of Assets, Compromise Confidential Information and/or Damage Our Business Relationships

and Can Provide No Assurance That the Steps We and Our Service Providers Take in Response to These Risks Will Be Effective ”

for our disclosures regarding the most pertinent risks we may experience from cybersecurity threats.

the Company’s operational, financial, legal and regulatory compliance requirements or objectives.

Please see Item 1A.

Factors – Risks Related to Cybersecurity and Data Privacy – “ We Face Cybersecurity Risks and Risks Associated

With Security Breaches Which Have the Potential to Disrupt Our Operations, Cause Material Harm to Our Financial Condition, Result

in Misappropriation of Assets, Compromise Confidential Information and/or Damage Our Business Relationships and Can Provide No

Assurance That the Steps We and Our Service Providers Take in Response to These Risks Will Be Effective ” for our disclosures

regarding the most pertinent risks we may experience from cybersecurity threats.

Bank has a management-level Strategic Technology Oversight Committee (the “TOC”).

Members of the TOC include the Bank’s

Information Security Officer (the “ISO”), the Chief Information Officer as well as representatives of each department,

including Senior Officers and/or their designees.

The TOC reviews the status of various tactical and strategic projects;

technologies;

Chief Operating Officer, Chief Risk Officer, Chief Information Officer, and the Information Security Officer (the “ISO”),

as well as representatives of each department, including Senior Officers and/or their designees.

The TOC reviews the status of

various tactical and strategic projects;

emerging technologies;

cybersecurity, availability and performance metrics;

audit results;

IT and Business Continuity policies;

Business Continuity test

results and IT & Cybersecurity Risk Assessment results to monitor the extent of risk, evaluate the effectiveness of mitigating

controls in place and ensure the level of risk remains within tolerance through acceptance, or further mitigation, transfer or

elimination of the risk.

Business Continuity test results and IT & Cybersecurity Risk Assessment results to monitor

the extent of risk, evaluate the effectiveness of mitigating controls in place and ensure the level of risk remains within tolerance

through acceptance, or further mitigation, transfer or elimination of the risk.

Additionally,

the Bank has an ISO Metrics Oversight Committee (the “ISO Metrics Committee”) which meets on a monthly basis with

a focus on cybersecurity.

Members of the ISO Metrics Committee include the ISO, the Chief Information Officer, the Chief Risk

Officer, as well as members of the information technology team involved with cybersecurity and infrastructure.

The function of

the ISO Metrics Committee is to review monthly cybersecurity metrics to support discussion of cyber threats, cyber risk trends,

and risk mitigation as well as to participate in an annual tabletop business disruption exercise to assess the Bank’s resilience

and readiness should such an event occur.

the Bank has an Information Security Oversight and Metrics Committee (the “ISO Metrics Committee”) which meets on

a monthly basis with a focus on cybersecurity.

Members of the ISO Metrics Committee include the ISO, the Chief Information Officer,

the Chief Risk Officer, as well as members of the information technology team involved with cybersecurity and infrastructure.

The function of the ISO Metrics Committee is to review monthly cybersecurity metrics to support discussion of cyber threats, cyber

risk trends, and risk mitigation as well as to participate in an annual tabletop business disruption exercise to assess the Bank’s

resilience and readiness should such an event occur.

employees participate in cybersecurity and social engineering training.

The Board also receives formal training annually.

Bank conducts social engineering tests for employees, such as phishing tests, throughout the year.

We consider employee awareness

and training to be a critical component of the Bank’s cybersecurity program.

Bank conducts social engineering tests for employees, including Senior Management, on relevant topics, such as phishing, smishing

and deepfakes, throughout the year.

We consider employee awareness and training to be a critical component of the Bank’s

cybersecurity program and celebrate employees who exemplify strong situational awareness and defense against cyber threats.

relationships, including vendor relationships, can offer the Bank a variety of opportunities to enhance its product and servicing

5 unchanged sentences

with the Bank’s management and the Board.

Bank maintains a third-party risk management oversight program to effectively assess, measure, monitor and control the risks associated

Bank maintains a third-party risk management oversight program to effectively assess, measure, monitor and manage the risks associated

with vendor relationships.

37 unchanged sentences

In addition, reports on the monitoring of third-party relationships, particularly critical relationships, are presented

to the Finance and Risk Management Committee and to the Bank’s Board.

to the Finance and Risk Management Committee.

Bank’s Board, through the Finance and Risk Management Committee, has oversight of cybersecurity incident disclosures, if

6 unchanged sentences

from regulators with respect thereto, and the root cause and remediation and enhancement efforts with respect thereto.

Bank’s information technology team maintains and develops their knowledge through various business, technical and cybersecurity-related

programs, certificates and degrees, including a senior member of the team who holds a Master of Business Administration and another

team member holding a Master’s Degree in Cybersecurity Management.

Collectively, the senior members of the information technology

team have approximately 75 years of experience in technology and cybersecurity, and the information technology team collectively

holds and maintains continuing education in various technology and cybersecurity certification areas.

The Bank’s ISO holds

the designation of Certified Cyber Crimes Investigator from the IAFCI and also maintains continuing education related to cybersecurity.

Bank’s Information Technology team (the “IT Team”) is comprised of professionals with technology certifications,

or Associate, Bachelor’s or Master’s degrees across business, technology and cybersecurity disciplines.

maintains and enhances its technical expertise through ongoing participation in business, technology, and cybersecurity training

programs, including certifications focused on emerging technologies and evolving cyber-risk practices.

IT leadership team, consisting of Assistant Vice Presidents and above, bring extensive technical experience primarily aligned

with the financial services industry.

The Bank’s ISO holds the Certified Cyber Crimes Investigator designation from the

International Association of Financial Crimes Investigators and completes ongoing cybersecurity-related continuing education to

support improving the Bank’s information security posture.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments