Community Bank System (CBU) Risk Analysis

The Company and its subsidiaries are subject to extensive state and federal regulation, supervision and legislation that govern nearly every aspect of its operations. The Company, as a financial holding company, is subject to regulation by the FRB and its banking subsidiary is subject to regulation by the OCC as well as the FDIC, CFPB, and other federal and state agencies. These regulations affect deposit and lending practices, capital levels and structure, investment practices, dividend policy, and growth. These regulatory authorities have extensive discretion in connection with their supervisory and enforcement activities, including the imposition of restrictions on the operation of a bank, the risk ratings or classifications of loans and investments by a bank, and the adequacy of a bank's allowance for credit losses. In addition, the non-bank subsidiaries are engaged in providing services including, but not limited to, retirement plan administration, fiduciary services to collective investment funds, investment management and insurance brokerage services, which industries are also heavily regulated at both a state and federal level, including by state banking and insurance agencies, the U.S. Department of Labor and the SEC. Such regulators govern the activities in which the Company and its subsidiaries may engage. Any change in such regulation and oversight, whether in the form of regulatory policy, regulations, legislation, interpretation or application, could have a material impact on the Company and its operations. Changes to the regulatory laws governing these businesses, or changes in regulatory policy or a regulator's interpretation of a law or regulation, could affect the Company's ability to deliver or expand its services and adversely impact its operating and financial condition. The Dodd-Frank Act, as amended by the Economic Growth Act, instituted major changes to the banking and financial institutions regulatory regimes in the financial services sector. The ongoing effects of the Dodd-Frank Act, as well as continued rule-making and possible future changes to the regulatory requirements, may substantially impact the Company's and the Bank's operations. The implications of the Dodd-Frank Act depend to a large extent on the implementation of the legislation by the FRB, the CFPB, and other agencies as well as how market practices and structures change in response to the requirements of such rule making. Changes in regulations could subject the Company, among other things, to additional costs for compliance, reduced revenues and limit the types of financial services and products it can offer and/or increase the ability of non-banks to offer competing financial services and products. Regulatory agencies, including the CPFB, may introduce new regulatory initiatives or pursue more aggressive enforcement policies with respect to a range of regulatory compliance matters. Regulators continue to focus on consumer protection, including product design and pricing constructs, account management and security, credit bureau reporting, disclosure rules, marketing and debt collection practices. New initiatives by applicable regulatory agencies may significantly limit the types and the terms of the products the Company may offer and the fees it may charge for its services which may have a material impact on the Company's fee income. Any new requirements or increased enforcement of existing requirements could materially and adversely impact the Company's revenue growth and profitability, including, as a result of increased scrutiny of pricing, underwriting and account management practices; the imposition of fines and customer remediation; higher compliance costs; reputational harm; restrictions on the Company's ability to offer certain products or services, appropriately price for the value of products or work with certain business partners; and changes to business practices generally. The Company may also be required to add additional compliance personnel or incur other significant compliance-related expenses. The Company's business, results of operations or competitive position may be adversely affected as a result. The Company is also directly subject to the requirements of entities that set and interpret the accounting standards such as the Financial Accounting Standards Board, and indirectly subject to the actions and interpretations of the Public Company Accounting Oversight Board, which establishes auditing and related professional practice standards for registered public accounting firms and inspects registered firms to assess their compliance with certain laws, rules, and professional standards in public company audits. These regulations, along with the currently existing tax, accounting, securities, insurance, and monetary laws, regulations, rules, standards, policies and interpretations, control the methods by which financial institutions and their holding companies conduct business, engage in strategic and tax planning, implement strategic initiatives, and govern financial reporting. While the Company has developed policies and procedures designed to assist in compliance with these laws and regulations, no assurance is given that compliance policies and procedures will be effective. The Company's failure to comply (or to ensure that agents and third-party service providers comply) with laws, regulations or policies could result in civil or criminal sanctions, restrictions to its business model, and money penalties by state and federal agencies, and/or reputation damage, which could have a material adverse effect on the Company's business, financial condition and results of operations. See "Supervision and Regulation" for more information about the regulations to which the Company is subject.

The Company offers a wide variety of products and services many of which could be vulnerable to fraud. The sophistication and skills of bad actors are increasing in scope and capabilities. Although the Company has various processes and controls in place to mitigate fraud, the risk cannot be eliminated and certain exposures are outside the Company's control. For example, when account credentials and other access tools are not adequately protected by its customers, risks and potential costs may increase. Fraud or fraudulent attempts may also increase as (a) volumes of services and products expand, (b) those who are committing fraud adapt their methods to circumvent existing controls, become more sophisticated and more determined, and (c) services and product offerings expand. The foregoing and other factors may cause the Company's operational losses to increase as a result.

General political, economic, and social conditions in the U.S. and in countries abroad affect markets in the U.S. and ultimately the Company's business. In particular, U.S. markets may be affected by the new government administration, including but not limited to government agency staff reductions and related operating issues, uncertainty related to policy changes that directly or indirectly impact consumer spending and business investment, the level and volatility of interest rates, availability and market conditions of financing, economic growth, historically high levels of inflation, supply chain disruptions, consumer spending, employment levels, labor shortages, wage escalation or stagnation, changes in home prices, commercial property values, the growth of global trade and commerce, the availability and cost of capital and credit, and investor sentiment and confidence. Additionally, U.S. energy and commodity markets may be adversely affected by the current or anticipated impact of climate change, extreme weather events or natural disasters, the emergence or continuation of widespread health emergencies or pandemics, cyberattacks or campaigns, military conflict, terrorism or other geopolitical events. The scarcity or unavailability of affordable casualty insurance on consumers' homes and autos, as well as businesses' property, plant, and equipment, would impair asset prices and have a negative impact on economic activity and growth. Also, any sudden or prolonged market downturn in the U.S., as a result of the above factors or otherwise, could result in a decline in net interest income and noninterest income and adversely affect the Company's results of operations and financial condition, including capital and liquidity levels. The economic developments in connection with the pandemic, including supply chain disruptions, increased inflation, changes to the Company's customers' industries, and the potential emergence of pandemics and other health crises in the U.S. and abroad have adversely impacted and may continue to adversely impact financial markets and macroeconomic conditions and could result in additional market volatility and disruptions globally. Actions taken by the Federal Reserve Board, including changes in its target funds rate, balance sheet management, and lending facilities are beyond the Company's control and difficult to predict. These actions can affect interest rates and the value of financial instruments and other assets and liabilities and can impact the Company's borrowers. Sudden changes in monetary policy, for example in response to high inflation, could lead to financial market volatility, increases in market interest rates, and a flattening or inversion of the yield curve. For example, higher inflation, or volatility and uncertainty related to inflation, could reduce demand for the Company's products, adversely affect the creditworthiness of the Company's borrowers, or result in lower values for the Company's investment securities and other interest-earning assets. Actions taken by the U.S. Federal government, including material changes in fiscal and foreign trade policy, could also reduce demand for the Company's products, adversely affect the creditworthiness of the Company's borrowers, or result in lower values for the Company's investment securities and other interest-earning assets. Examples of such policy changes are reduced or delayed U.S. Federal government spending, new or higher U.S. imposed tariffs on imports and retaliatory tariffs imposed by foreign governments on U.S. exports. Changes to existing U.S. laws and regulatory policies and evolving priorities, including those related to financial regulation, consumer compliance, taxation, fiscal policy, trade policy such as tariffs, climate change, and healthcare, may adversely impact U.S. or global economic activity and the Company's customers and its earnings and operations. For example, a slowdown in consumer demand due to increased inflation could limit the ability of firms to pass on fast-rising costs for labor, tariffs, transportation and other inputs, weighing on earnings and potentially leading to an equity market downturn. Significant fiscal policy changes and/or initiatives may also raise the federal debt, affect businesses and household after-tax incomes and increase uncertainty surrounding the formulation and direction of U.S. monetary policy and volatility of interest rates. Any of these developments could adversely affect the Company's consumer and commercial businesses, its customers, its securities portfolios, including the risk of lower re-investment rates within those portfolios, its level of loan net charge-offs and provision for credit losses, the carrying value of its deferred tax assets, its capital levels, its liquidity and its results of operations.

The Company's business requires the secure processing and storage of sensitive information relating to its customers, employees, business partners, and others. However, like any financial institution operating in today's digital business environment, the Company is subject to threats to the security of its networks and data, as described above. These threats continue to increase as the frequency, intensity and sophistication of attempted attacks and intrusions increase around the world. In response to these threats there has been heightened legislative and regulatory focus on data privacy and cybersecurity in the U.S. and internationally. As a result, the Company must comply with an evolving set of legal requirements in this area, including substantive cybersecurity standards as well as requirements for notifying regulators and affected individuals in the event of a data security incident, in particular the SEC cybersecurity disclosure requirements that may require the Company to expend additional costs in the event of a material cybersecurity breach. This regulatory environment is increasingly challenging and may present material obligations and risks to the Company's business, including significantly expanded compliance burdens, costs and enforcement risks.