Arrow Financial (AROW) Risk Analysis

Technological advances and changes in the financial services industry are pervasive and constant. The retail financial services sector, like many other retail goods and services sectors, is constantly evolving, involving new delivery and communications systems and technologies that are extraordinarily far-reaching and impactful. For Arrow to remain competitive, Arrow must adapt to these systems and technologies. Proper implementation of new technologies can increase efficiency, decrease costs and help to meet customer demand. However, many competitors have greater resources to invest in technological advances and changes. Arrow may not always be successful in utilizing the latest technological advances in offering its products and services or in otherwise conducting its business. Failure to identify, consider, adapt to and implement technological advances and changes could have a material adverse effect on business. In particular the use or implementation of AI and generative AI technologies can have a significant impact. Arrow is still evaluating the potential threats and uses of this technology.

In the ordinary course of business, Arrow relies on electronic communications and information systems to conduct its operations and to store sensitive data. Arrow employs an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. Arrow employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Arrow has implemented and regularly reviews and updates extensive systems of internal controls and procedures as well as corporate governance policies and procedures intended to protect its business operations, including the security and privacy of all confidential customer information. In addition, Arrow relies on the services of a variety of vendors to meet data processing and communication needs. No matter how well designed or implemented its controls are, Arrow cannot provide an absolute guarantee to protect its business operations from every type of cybersecurity or other security problem in every situation, whether as a result of systems failures, human error or negligence, cyberattacks, security breaches, fraud or misappropriation. Any failure or circumvention of these controls could have a material adverse effect on Arrow's business operations and financial condition. Notwithstanding the strength of defensive measures, the threat from cyberattacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date, Arrow has not experienced a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks or other security problems, Arrow's systems and those of its customers and third-party service providers are under constant threat. Risks and exposures related to cybersecurity attacks or other security problems are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats and issues, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by Arrow and customers. The computer systems and network infrastructure that Arrow uses are always vulnerable to unforeseen disruptions, including theft of confidential customer information ("identity theft") and interruption of service as a result of fire, natural disasters, explosion, general infrastructure failure, cyberattacks or other security problems. These disruptions may arise in Arrow's internally developed systems, or the systems of our third-party service providers or may originate from the actions of our consumer and business customers who access our systems from their own networks or digital devices to process transactions. Information security and cybersecurity risks have increased significantly in recent years because of consumer demand to use the Internet and other electronic delivery channels to conduct financial transactions. Cybersecurity risk and other security problems are a major concern to financial services regulators and all financial service providers, including Arrow. These risks are further exacerbated due to the increased sophistication and activities of organized crime, hackers, terrorists and other disreputable parties. Arrow regularly assesses and tests security systems and disaster preparedness, including back-up systems, but the risks are substantially escalating. As a result, cybersecurity and the continued enhancement of Arrow's controls and processes to protect its systems, data and networks from attacks or unauthorized access remain a priority. Accordingly, Arrow may be required to expend additional resources to enhance its protective measures or to investigate and remediate any information security vulnerabilities or exposures. Any breach of Arrow's system security could result in disruption of its operations, unauthorized access to confidential customer information, significant regulatory costs, litigation exposure and other possible damages, loss or liability. Such costs or losses could exceed the amount of available insurance coverage, if any, and would adversely affect Arrow's earnings. Also, any failure to prevent a security breach or to quickly and effectively deal with such a breach could negatively impact customer confidence, damaging Arrow's reputation and undermining its ability to attract and keep customers. In addition, if Arrow fails to observe any of the cybersecurity requirements in federal or state laws, regulations or regulatory guidance, Arrow could be subject to various sanctions, including financial penalties. For additional information on Arrow's cybersecurity protocols and the management and oversight thereof, please see Item 1C. Cybersecurity, below.

Arrow's success depends, in large part, on Arrow's ability to retain key personnel for the duration of their expected terms of service. On an ongoing basis, Arrow prepares and reviews back-up plans, in the event key personnel are unexpectedly rendered incapable of performing or depart or resign from their positions. However, any sudden unexpected change at the senior management level may adversely affect business.

Competition for commercial banking and other financial services is fierce in Arrow's market areas. In one or more aspects of business, Arrow Bank competes with other commercial banks, savings and loan associations, credit unions, finance companies, Internet-based financial services companies, mutual funds, insurance companies, brokerage and investment banking companies, and other financial intermediaries. Additionally, due to their size and other factors, many competitors may be able to achieve economies of scale and, as a result, may offer a broader range of products and services, as well as better pricing for those products and services, than Arrow and its subsidiaries can. Technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. In addition, many of Arrow's competitors are not subject to the same extensive federal regulations that govern bank holding companies and federally insured banks. Failure by Arrow to offer competitive services in Arrow's market areas could significantly weaken Arrow's market position, adversely affecting growth, which, in turn, could have a material adverse effect on Arrow's financial condition and results of operations.