What the changes say
- AML/OFAC compliance is newly emphasized, including transaction screening, blocked transactions, reporting, and limits on acquisitions or branches.
- Fraud disclosure removes the specific 2024 business-customer deposit charge-off and ATM/ITM references.
- Technology risk now focuses more specifically on cloud-service-provider reliability and security dependence.
- International-conflict language is broader, removing specific references to the Ukraine war, Russia, and sanctions.
What changed since the prior 10-K
New
- NewLegal and Regulatory Risks
Non-compliance with the USA PATRIOT Act, the BSA, OFAC sanction regulations, or other applicable state and federal laws could subject us to fines, penalties, or other regulatory actions
Failure to maintain effective BSA/AML and OFAC programs could cause fines, enforcement, blocked transactions, acquisition or branch restrictions, and reputational harm.
Dropped
- DroppedLegal and Regulatory Risks
Non-compliance with the USA PATRIOT Act and the Bank Secrecy Act could subject us to fines, sanctions or other negative actions
Reworded
- 72% rewritten
We are subject to risks and losses resulting from fraudulent activities that could adversely impact our financial performance and results of operations
Removes ITM transactions and the specific first-quarter 2024 business-customer deposit-fraud charge-offs, while adding that controls may still fail.
- 31% rewrittenTechnology and Cybersecurity Risks
We, or our service providers, may experience a cyber-attack, system failure, natural disaster, or other uncontrollable events that may disrupt business operations
Expands protected information risks to include retention and disposal, in addition to processing, storage, and transmission.
- 28% rewrittenLegal and Regulatory Risks
The policies of the Federal Reserve have a significant impact on our earnings
No substantive change to the Federal Reserve’s effects on funding costs, net interest income, financial instruments, and borrowers.
- 28% rewrittenTechnology and Cybersecurity Risks
Emerging technology, including cloud computing and artificial intelligence (“AI”), introduces new risks while possibly being essential to support business strategy
Changes the cloud-provider concern from implementing effective controls generally to dependency on providers’ cloud reliability and security controls.
- 27% rewrittenMarket Risks
We are subject to interest rate risk, and fluctuations in market interest rates may affect our interest margins and income, demand for our products, defaults on loans, loan prepayments and the fair value of our financial instruments
The heading now expressly mentions effects on product demand, loan defaults, prepayments, and financial-instrument fair values; the discussion is otherwise substantially unchanged.
- 24% rewrittenTechnology and Cybersecurity Risks
We are subject to evolving laws and regulations relating to cybersecurity protection and data privacy, and failure to comply could expose the Company to regulatory liability, reputational risk and financial risk
Corrects the wording around increased compromise risk; the cybersecurity regulations, GLBA, sanctions, and insurance requirements remain substantively unchanged.
- 23% rewrittenRisks Related to our Common Stock
Our business may be adversely affected by conditions in the financial markets and economic conditions generally, including macroeconomic pressures such as inflation, supply chain issues, geopolitical risks associated with international conflict
Removes specific references to the Ukraine war and Russia sanctions, replacing them with broader international-conflict language and macroeconomic pressures.
Was: Our business may be adversely affected by conditions in the financial markets and economic conditions generally, including macroeconomic pressures such as inflation, supply chain issues, and geopolitical risks associated with international conflict
All 49 risk factors
Headings as the filing states them, in filing order.
Other
- 01If we experience greater credit losses than anticipated, earnings may be adversely impacted
- 02We are subject to risks and losses resulting from fraudulent activities that could adversely impact our financial performance and results of operations72% rewritten
- 03Geographic concentration may unfavorably impact our operations
- 04decrease the value of collateral for loans, especially real estate, reducing customers’ borrowing power, the value of assets associated with non-performing loans and collateral coverage
- 05Our commercial business and commercial mortgage loans increase our exposure to credit risks
- 06If our non-performing assets increase, our earnings will be adversely affected
- 07the resolution of non-performing assets requires the active involvement of management, which can distract them from more profitable activity
- 08If our regulators impose limitations on our commercial real estate lending activities, earnings could be adversely affected
- 09Our indirect and consumer lending involves risk elements in addition to normal credit risk
- 10Lack of seasoning in portions of our loan portfolio could increase risk of credit defaults in the future
- 11At December 31, 2025, we had $3.52 billion of deposit liabilities, or 68% of our total deposits, that have no maturity and, therefore, may be withdrawn by the depositor at any time. These deposit liabilities include our checking, savings, and money market deposit accounts
- 12Municipal deposits are price sensitive and could result in an increase in interest expense or funding fluctuations
- 13We are subject to environmental liability risk associated with our lending activities
- 14We operate in a highly competitive industry and market area
- 15industry and general economic trends
Legal and Regulatory Risks
- 16Legal and regulatory proceedings and related matters could adversely affect us and the banking industry in general
- 17Any future FDIC insurance premium increases may adversely affect our earnings
- 18We are highly regulated, and any adverse regulatory action may result in additional costs, loss of business opportunities, and reputational damage
- 19Non-compliance with the USA PATRIOT Act, the BSA, OFAC sanction regulations, or other applicable state and federal laws could subject us to fines, penalties, or other regulatory actionsnew
- 20We are subject to the CRA and fair lending laws, and failure to comply with these laws could lead to material penalties
- 21The policies of the Federal Reserve have a significant impact on our earnings28% rewritten
Risks Related to Non-Banking Activities
- 22Our investment advisory and wealth management operations are subject to risk related to the regulation of the financial services industry and market volatility
- 23Our investment advisory revenue may decrease as a result of poor investment performance, in either relative or absolute terms, which could decrease our revenues and net income
Strategic and Operational Risks
- 24The value of our goodwill and other intangible assets may decline in the future
- 25We may be unable to successfully implement our growth strategies, including the integration and successful management of newly acquired businesses
- 26Acquisitions may disrupt our business and dilute shareholder value
- 27Our tax strategies and the value of our deferred tax assets and liabilities could adversely affect our operating results and regulatory capital ratios
- 28Liquidity is essential to our business
- 29We rely on dividends from our subsidiaries for most of our revenue
- 30If our risk management framework does not effectively identify or mitigate our risks, we could suffer losses
Market Risks
- 31We are subject to interest rate risk, and fluctuations in market interest rates may affect our interest margins and income, demand for our products, defaults on loans, loan prepayments and the fair value of our financial instruments27% rewritten
- 32The soundness of other financial institutions could adversely affect us
- 33We may need to raise additional capital in the future to provide sufficient capital resources and liquidity to meet our commitments and business needs
Technology and Cybersecurity Risks
- 34Emerging technology, including cloud computing and artificial intelligence (“AI”), introduces new risks while possibly being essential to support business strategy28% rewritten
- 35We rely on third parties to provide critical business services and protect the confidentiality, integrity, and availability of confidential data
- 36We, or our service providers, may experience a cyber-attack, system failure, natural disaster, or other uncontrollable events that may disrupt business operations31% rewritten
- 37We are subject to evolving laws and regulations relating to cybersecurity protection and data privacy, and failure to comply could expose the Company to regulatory liability, reputational risk and financial risk24% rewritten
Risks Related to our Common Stock
- 38We may not pay or may reduce the dividends on our common stock, and our ability to pay dividends is subject to certain restrictions
- 39We may issue debt and equity securities or securities convertible into equity securities, any of which may be senior to our common stock as to distributions and in liquidation, which could dilute our current shareholders or negatively affect the value of our common stock
- 40Our certificate of incorporation, our bylaws, and certain banking laws may have an anti-takeover effect
- 41The market price of our common stock may fluctuate significantly in response to a number of factors
- 42We may not be able to attract and retain skilled people
- 43Loss of key employees may disrupt relationships with certain customers
- 44We use financial models for business planning purposes that may not adequately predict future results
- 45We depend on the accuracy and completeness of information about or from customers and counterparties
- 46Our business may be adversely affected by conditions in the financial markets and economic conditions generally, including macroeconomic pressures such as inflation, supply chain issues, geopolitical risks associated with international conflict23% rewritten
- 47Severe weather, natural disasters, public health emergencies and pandemics, acts of war or terrorism, and other external events could significantly impact our business
- 48Negative public opinion could damage our reputation and impact business operations and revenues
- 49Environmental, social and governance matters, and any related reporting obligations may impact our business
Other Financial Institutions 10-Ks
- 2025 10-K risk factors
49 risks. Credit exposure centers on Western and Central New York, small and midsized businesses, commercial loans, and commercial real estate oversight.
Filed Mar 12, 2025
About this page
Item 1A of the 10-K on EDGAR was split into its risk factors and, where the company's previous 10-K is on file, each heading was matched to last year's and the text compared word for word. The headings are the filing's own. The one-line readings and the overview were written by a language model from the text of the new, dropped, and rewritten risks; they refer to risks by position and cannot misquote a heading.