Evans Bancorp - 10-K annual report 2024

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

[X]ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended: December 31, 2024

[ ]TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from __________ to __________

Commission file number: 001-35021

EVANS BANCORP, INC.

(Exact name of registrant as specified in its charter)

Securities registered pursuant to Section 12(g) of the Act:

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.

Indicate by checkmark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files).

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act [ ]

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. [ X ]

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. [ ]

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). [ ]

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act).

On June 30, 2024, the aggregate market value of the registrant’s common stock held by non-affiliates was approximately $149 million, based upon the closing sale price of a share of the registrant’s common stock on NYSE American, LLC.

As of March 3, 2025, 5,567,382 shares of the registrant’s common stock were outstanding.

Page 1 of 110

Exhibit Index on Page 106

DOCUMENTS INCORPORATED BY REFERENCE

None.

‎

TABLE OF CONTENTS

INDEX

‎

PART I

FORWARD LOOKING STATEMENTS

This Annual Report on Form 10-K may contain certain forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended (the “Securities Act”), and Section 21E of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), that involve substantial risks and uncertainties. When used in this report, or in the documents incorporated by reference herein, the words “will,” “anticipate,” “believe,” “estimate,” “expect,” “intend,” “may,” “plan,” “seek,” “look to,” “goal,” “target” and similar expressions identify such forward-looking statements. These forward-looking statements include statements regarding the business plans, prospects, growth and operating strategies of Evans Bancorp, Inc. (the “Company"), statements regarding the asset quality of the Company’s loan and investment portfolios, and estimates of the Company’s risks and future costs and benefits.

These forward-looking statements are based largely on the expectations of the Company’s management and are subject to a number of risks and uncertainties, including but not limited to: the successful completion and timing of the Company’s proposed merger with NBT Bancorp, Inc. (“NBT”), general economic conditions, either nationally or in the Company’s market areas, that are worse than expected; increased competition among depository or other financial institutions; our ability to maintain liquidity, including the percentage of uninsured deposits in our portfolio; inflation and changes in the interest rate environment that reduce the Company’s margins or reduce the fair value of financial instruments; changes in laws or government regulations affecting financial institutions, including changes in regulatory fees and capital requirements; changes in government fiscal or monetary policy; the Company’s ability to enter new markets successfully and capitalize on growth opportunities; the Company’s ability to successfully integrate acquired entities; loan losses in excess of the Company’s allowance for credit losses; changes in accounting pronouncements and practices, as adopted by financial institution regulatory agencies, the Financial Accounting Standards Board (“FASB”) and the Public Company Accounting Oversight Board; the impact of such changes in accounting pronouncements and practices being greater than anticipated; the ability to realize the benefit of deferred tax assets; changes in the financial performance and/or condition of the Company’s borrowers; changes in consumer spending, borrowing and saving habits; changes in the Company’s organization, compensation and benefit plans; changes in consumer behavior and other factors discussed elsewhere in this Annual Report on Form 10-K including the risk factors described in Item 1A, as well as in the Company’s periodic reports filed with the Securities and Exchange Commission (the “SEC”). Many of these factors are beyond the Company’s control and are difficult to predict.

Because of these and other uncertainties, the Company’s actual results, performance or achievements could differ materially from those contemplated, expressed or implied by the forward-looking statements contained herein. Forward-looking statements speak only as of the date they are made. The Company undertakes no obligation to publicly update or revise forward-looking information, whether as a result of new, updated information, future events or otherwise, except to the extent required by law.

Item 1.BUSINESS

EVANS BANCORP, INC.

Evans Bancorp, Inc. (the “Company”) is a New York business corporation which is registered as a financial holding company under the Bank Holding Company Act of 1956, as amended (the “BHCA”). The principal office of the Company is located at 6460 Main Street, Williamsville, NY 14221 and its telephone number is (716) 926-2000. The Company was incorporated on October 28, 1988, but the continuity of its banking business is traced to the organization of the Evans National Bank of Angola on January 20, 1920. Except as the context otherwise requires, the Company and its direct and indirect subsidiaries are collectively referred to in this report as the “Company.” The Company’s common stock is traded on the NYSE American, LLC under the symbol “EVBN.”

At December 31, 2024, the Company had consolidated total assets of $2.2 billion, deposits of $1.9 billion and stockholders’ equity of $183 million.

The Company’s primary business is the operation of its subsidiaries. It does not engage in any other substantial business activities. The Company operates two direct wholly-owned subsidiaries: (1) Evans Bank, N.A. (the “Bank”), which provides a full range of banking services to consumer and commercial customers in Western New York (“WNY”) and the Finger Lakes Region; and (2) Evans National Financial Services, LLC (“ENFS”), which owns 100% of the membership interests in The Evans Agency, LLC (“TEA”), which sold various premium-based insurance policies on a commission basis until its sale in 2023.

On September 9, 2024, Evans Bancorp, Inc. and NBT Bancorp Inc. (“NBT”) announced that they had entered into a definitive agreement pursuant to which Evans will merge with and into NBT. In accordance with the merger agreement, NBT will acquire 100% of the outstanding shares of Evans Bancorp, Inc. in exchange for common shares of NBT. The exchange ratio will be fixed at 0.91 NBT shares for each share of Evans, resulting in an aggregate transaction value of approximately $236 million based on NBT’s closing stock price of $46.28 on September 6, 2024. On December 20, 2024, the shareholders of Evans Bancorp, Inc. voted to approve the merger. In addition, the Company received regulatory approvals and waivers from the Office of the Comptroller of the Currency (the “OCC”) and the Federal

Reserve Bank of New York necessary for NBT to complete its acquisition of Evans Bancorp, Inc. The merger is expected to close in the second quarter of 2025.

On November 30, 2023, the Company completed the sale of its insurance subsidiary, The Evans Agency, LLC, to Arthur J. Gallagher & Co. and Arthur J. Gallagher Risk Management Services, LLC (collectively, “Gallagher”). As defined in the asset purchase agreement, TEA sold substantially all of its assets to Gallagher for a purchase price of $40.0 million in cash. For more information on the divestiture of TEA see Note 2 to the Company’s Consolidated Financial Statements included under Item 8 of this Annual Report on Form 10-K.

At December 31, 2024, the Bank represented 99% and ENFS represented 1% of the consolidated assets of the Company. Further discussion of our segments is included in Note 19 to the Company’s Consolidated Financial Statements included under Item 8 of this Annual Report on Form 10-K.

EVANS BANK, N.A.

The Bank is a nationally chartered bank that has its headquarters at 6460 Main Street, Williamsville, NY, and a total of 18 full-service banking offices in Erie County, Niagara County, Monroe County and Chautauqua County, NY.

At December 31, 2024, the Bank had total assets of $2.2 billion, investment securities of $263 million, net loans of $1.8 billion and deposits of $1.9 billion. The Bank offers deposit products, which include checking and negotiable order of withdrawal (“NOW”) accounts, savings accounts, and certificates of deposit, as its principal source of funding. The Bank’s deposits are insured up to the maximum permitted by the Deposit Insurance Fund of the Federal Deposit Insurance Corporation (“FDIC”). The Bank offers a variety of loan products to its customers, including commercial and consumer loans and commercial and residential mortgage loans.

As is the case with banking institutions generally, the Bank’s operations are significantly influenced by general economic conditions and by related monetary and fiscal policies of banking regulatory agencies, including the Federal Reserve Board (“FRB”) and FDIC. The Bank is also subject to the supervision, regulation and examination of the OCC.

The Evans Agency, LLC

TEA was a full-service insurance agency that offered personal, commercial and financial services products. TEA’s insurance revenue and expenses are consolidated into the Company’s financials through November 30, 2023. For the eleven months ended November 30, 2023, TEA had total revenue of $10 million.

TEA’s primary market area was Erie, Chautauqua, Cattaraugus and Niagara Counties, NY. Most lines of personal insurance were provided, including automobile, homeowners, boat, recreational vehicle, landlord, and umbrella coverage. Commercial insurance products were also provided, consisting of property, liability, automobile, inland marine, workers compensation, bonds, crop and umbrella insurance. TEA also provided the following financial services products: employee benefits, life and disability insurance, Medicare supplements, long term care, annuities, mutual funds, retirement programs and New York State Disability. See Note 2 to the Company’s Consolidated Financial Statements included under Item 8 of this Annual Report on Form 10-K for more information on the sale of TEA.

Other Subsidiaries

In addition to the Bank, the Company has the following direct and indirect wholly-owned subsidiaries:

Evans National Holding Corp. (“ENHC”). ENHC, a wholly-owned subsidiary of the Bank, operates as a real estate investment trust that holds commercial real estate loans and residential mortgages, providing additional flexibility and planning opportunities for the business of the Bank.

Evans National Financial Services, LLC (“ENFS”). ENFS is a wholly-owned subsidiary of the Company. ENFS's primary business is to own the business and assets of the Company’s non-banking financial services subsidiaries.

The Company also has two special purpose entities: Evans Capital Trust I, a statutory trust formed in September 2004 under the Delaware Statutory Trust Act, solely for the purpose of issuing and selling certain securities representing undivided beneficial interests in the assets of the trust, investing the proceeds thereof in certain debentures of the Company and engaging in those activities necessary, advisable or incidental thereto; and ENB Employers Insurance Trust, a Delaware trust company formed in February 2003 for the sole purpose of holding life insurance policies under the Bank’s bank-owned life insurance (“BOLI”) program.

The Company’s main operating segment as of December 31, 2024 are banking activities. Through November 30, 2023 the Company had two operating segments – banking activities and insurance agency activities. See Note 19 to the Company’s Consolidated Financial Statements included under Item 8 of this Annual Report on Form 10-K for more information on the Company’s operating segments.

MARKET AREA

The Company’s footprint is in Western New York and the Finger Lakes Region, primarily Erie County, Monroe County, Niagara County, northern Chautauqua County and northwestern Cattaraugus County, NY. This primary market area is the area where the Bank principally receives deposits and makes loans.

MARKET RISK

For information about, and a discussion of, the Company's "Market Risk," see Part II, Item 7 "Management's Discussion and Analysis of Financial Condition and Results of Operations - Market Risk" of this Annual Report on Form 10-K.

COMPETITION

All phases of the Company’s business are highly competitive. The Company competes actively with local, regional and national financial institutions, as well as with bank branches in the Company’s primary market area. The Company’s market area has a high density of financial institutions, many of which are significantly larger and have greater financial resources than the Company. The Company faces competition for loans and deposits from other commercial banks, savings banks, internet banks, savings and loan associations, mortgage banking companies, credit unions, and other financial services companies. The Company faces additional competition from non-depository competitors such as the mutual fund industry, and securities and brokerage firms.

As an approximate indication of the Company’s competitive position, the Bank had the seventh most deposits in the Buffalo, NY metropolitan statistical area according to the FDIC’s annual deposit market share report as of June 30, 2024 with 3% of the total market’s deposits of $62 billion. By comparison, the market leaders, M&T Bank and KeyBank, had 78% of the Buffalo, NY metropolitan statistical area deposits combined. The Company attempts to be generally competitive with all financial institutions in its service area with respect to interest rates paid on time and savings deposits, service charges on deposit accounts, and interest rates charged on loans.

HUMAN CAPITAL

At December 31, 2024, we employed 266 full-time equivalent employees. At that date, the average tenure of all of our full-time employees was approximately 6.9 years while the average tenure of our executive officers was approximately 13.2 years. None of our associates are represented by collective bargaining agreements. We believe our employee relations to be good.

Oversight of our corporate culture is an important element of our Board of Directors’ oversight of risk because our people are critical to the success of our corporate strategy. Our Board sets the “tone at the top,” and holds senior management accountable for embodying, maintaining, and communicating our culture to employees. In that regard, our culture is designed to embrace associates and create opportunities. We uphold that principle in everything we do. That commitment has been a central pillar in our approach to our employees and the communities we have proudly served for over 100 years. Our culture is designed to adhere to the timeless values of integrity, valuing others, talent, passion, ownership and alignment, and customer focus. In keeping with those values, we expect our people to treat each other and our customers with the highest level of honesty and respect and go out of their way to do the right thing. We dedicate resources to promote a safe and inclusive workplace; attract, develop and retain talented, diverse employees; promote a culture of integrity, caring and excellence; and reward and recognize employees for both the results they deliver and, importantly, how they deliver them. We seek to design careers that are fulfilling, with competitive compensation and benefits alongside a positive work-life balance. We also dedicate resources to fostering professional and personal growth with continuing education, on-the-job training and development programs.

Our associates are key to our success as an organization. We are committed to attracting, retaining and promoting top quality talent regardless of race, color, creed, religion, sex, national origin, age, disability, marital status, citizenship status, military status, sexual orientation, victims of domestic violence, protected veterans status, gender identity, genetic information, genetic predisposition or carrier status and any other category protected by law. We are dedicated to providing a workplace for our employees that is inclusive, supportive, and free of any form of discrimination or harassment; rewarding and recognizing our employees based on their individual results and performance as well as that of their department and the company overall; and recognizing and respecting all of the characteristics and differences that make each of our employees unique.

SUPERVISION AND REGULATION

Bank holding companies and banks are extensively regulated under both federal and state laws and regulations that are intended to protect depositors and customers. Additionally, because the Company is a public company with shares traded on the NYSE American, it is subject to regulation by the SEC, as well as the listing standards required by NYSE American. To the extent that the following summary describes statutory and regulatory provisions, it is qualified in its entirety by reference to the particular statutory and regulatory provisions. Any change in applicable laws or regulations, or a change in the way such laws or regulations are interpreted by regulatory agencies or courts, may have a material adverse effect on the Company's business, financial condition and results of operations.

Bank Holding Company Regulation

As a bank holding company registered under the BHCA, the Company and its non-banking subsidiaries are subject to regulation and supervision under the BHCA by the FRB. The FRB requires periodic reports from the Company, and is authorized by the BHCA to make regular examinations of the Company and its non-bank subsidiaries.

The Company is required to obtain the prior approval of the FRB before merging with or acquiring all or substantially all of the assets of, or direct or indirect ownership or control of more than 5% of the voting shares of, a bank or bank holding company. The FRB regulations set out thresholds involving various relations and factors that may establish presumptions of control or a “controlling influence” for BHCA purposes. The FRB will not approve any acquisition, merger or consolidation that would have a substantial anti-competitive result, unless the anti-competitive effects of the proposed transaction are outweighed by a greater public interest in meeting the needs and convenience of the public. The FRB also considers managerial, capital and other financial factors in acting on acquisition or merger applications.

Subject to various exceptions, the Change in Bank Control Act of 1978 (the “CIBCA”), and its implementing regulations, require FRB approval before any person or company acquires “control” of a bank holding company. Control is deemed to exist under the CIBCA if an individual or company acquires 25% or more of any class of voting securities of the bank holding company. There is a rebuttable presumption of control under the CIBCA’s regulations if a person or company acquires 10% or more, but less than 25%, of any class of the bank holding company’s voting securities under certain circumstances including where, as is the case with the Company, the bank holding company has its shares registered under the Exchange Act.

A bank holding company may not engage in, or acquire direct or indirect control of more than 5% of the voting shares of any company engaged in any non-banking activity, unless such activity has been determined by the FRB to be closely related to banking or managing banks. The FRB has identified by regulation various non-banking activities in which a bank holding company may engage with notice to, or prior approval by, the FRB. A bank holding company that meets specified criteria may elect to be regulated as a “financial holding company” and thereby engage in a broader range of non-banking financial activities. The Company has made such an election.

The FRB has enforcement powers over financial holding companies and their non-bank subsidiaries, among other things, to enjoin activities that represent unsafe or unsound practices or constitute violations of law, regulation, administrative orders, or certain written agreements. These powers may be exercised through the issuance of cease and desist orders, civil monetary penalties or other actions.

Under federal law, a bank holding company must serve as a source of financial and managerial strength for its subsidiary banks and must not conduct its operations in an unsafe or unsound manner. The expectation is that a holding company will use available resources to provide capital and other support to its subsidiary institutions in times of financial stress.

A bank holding company is generally required to give the FRB prior written notice of any purchase or redemption of its outstanding equity securities if the gross consideration for the purchase or redemption, when combined with the net consideration paid for all such purchases or redemptions during the preceding 12 months, is equal to 10% or more of the company’s consolidated net worth. The FRB may disapprove such a purchase or redemption if it determines that the proposal would constitute an unsafe and unsound practice, or would violate any law, regulation, FRB order or directive, or any condition imposed by, or written agreement with, the FRB. There is an exception to this approval requirement for well-capitalized bank holding companies that meet certain other conditions. As of December 31, 2024, the Company has qualified for this exception.

Notwithstanding the above requirements, the FRB has issued a supervisory bulletin which indicates that a holding company should notify and consult with the FRB under certain circumstances prior to redeeming or repurchasing common stock or perpetual preferred stock. The supervisory bulletin indicates that such notification is for purposes of allowing FRB supervisory review of, and possible objection to, the proposed repurchase or redemption.

The FRB’s supervisory bulletin also covers the payment of dividends. In general, the FRB’s policy is that dividends should be paid only out of current earnings and only if the prospective rate of earnings retention by the holding company is consistent with the organization’s capital needs, asset quality and overall financial condition. The supervisory bulletin provides for prior consultation with, and supervisory review of, proposed dividends by the FRB in certain situations, such as where a proposed dividend exceeds earnings

for the period for which the dividend would be paid (e.g., calendar quarter) or where the company’s net income for the past four quarters, net of dividends previously paid over that period, is insufficient to fully fund a proposed dividend. The guidance also provides for FRB consultation for material increases in the amount of a bank holding company’s common stock dividend.

Under the prompt corrective action laws, discussed later, the ability of a bank holding company to pay dividends may be restricted if a subsidiary bank becomes undercapitalized.

These laws, regulations and policies may inhibit the Company’s ability to pay dividends, engage in stock repurchases or otherwise make capital distributions.

Supervision and Regulation of the Bank

The Bank is a nationally chartered banking corporation, primarily subject to supervision, examination and regulation by the OCC. The FDIC has certain backup regulatory authority as the deposit insurer.  The operations of the Bank are subject to numerous statutes and regulations. Such statutes and regulations relate to investments, loans, mergers and consolidations, issuance of securities, payment of dividends, establishment of branches and other aspects of the Bank’s operations.

Federal statutes and OCC regulations govern the Bank’s investment authority. A national bank has authority to originate and purchase all types of loans, including commercial, commercial real estate, consumer and residential mortgage loans. Federal law generally limits a national bank’s extensions of credit to a single borrower (or related borrowers) to 15% of the bank’s capital and surplus. An additional 10% may be lent if secured by specified readily marketable collateral.

Generally, a national bank is prohibited from investing in corporate equity securities for its own account. Under OCC regulations, a national bank may invest in investment securities, which are generally defined as marketable securities in the form of a note, bond or debenture. The OCC classifies investment securities into five different types and, depending on its type, a national bank may have the authority to purchase, and possibly deal in and underwrite the security, pursuant to specified limits. The OCC has also permitted national banks to purchase certain noninvestment grade securities that can be reclassified and underwritten as loans.

The federal banking agencies have adopted uniform regulations prescribing standards for extensions of credit that are secured by liens on interests in real estate or made for the purpose of financing the construction of a building or other improvements to real estate. Under these regulations, all insured depository institutions, such as the Bank, are required to adopt written policies that establish appropriate limits and standards for extensions of credit that are secured by liens or interests in real estate or are made for the purpose of financing permanent improvements to real estate. The policies must establish loan portfolio diversification standards, prudent underwriting standards (including loan-to-value limits) that are clear and measurable, loan administration procedures, and documentation, approval and reporting requirements. The real estate lending policies must reflect consideration of the Interagency Guidelines for Real Estate Lending Policies that have been adopted by the federal bank regulators.

The Bank is subject to Sections 23A and 23B of the Federal Reserve Act and Regulation W thereunder, which govern certain “covered transactions”, by a bank with its affiliates, including its parent holding company. Covered transactions include a bank’s loans and extensions of credit to an affiliate, purchases of assets from an affiliate, and similar transactions. Covered transactions by the Bank with any affiliate (including the Company) are limited in amount to 10% of the Bank’s capital stock and surplus, and covered transactions with all affiliates are limited in the aggregate to 20% of the Bank’s capital stock and surplus. Furthermore, covered transactions, such as loans and extensions of credit to affiliates are subject to various collateral requirements. In general, the Bank’s transactions with an affiliate (including the Company) must be on terms and under circumstances that are substantially the same, or at least as favorable to, the Bank as comparable transactions between the Bank and nonaffiliates. These laws and regulations may limit the Company’s ability to obtain funds from the Bank for its cash needs, including funds for acquisitions, and the payment of dividends, interest and operating expenses.

The Bank is prohibited from engaging in certain tying arrangements in connection with any extension of credit, lease or sale of property or furnishing of services. For example, subject to certain exceptions, the Bank generally may not require a customer to obtain other services from the Bank or the Company, and may not require the customer to promise not to obtain other services from a competitor as a condition to an extension of credit.

The Bank is also subject to certain restrictions imposed by the Federal Reserve Act and its implementing regulation, Regulation O, on extensions of credit to the Bank’s and its affiliates’ executive officers, directors, principal stockholders, and/or any related interest of such persons (“Insiders”). Under these restrictions, the aggregate amount of loans to any Insiders and his or her related interests may not exceed the loans-to-one-borrower limit discussed above. Aggregate loans by a bank to its Insiders and their related interests may not exceed the bank’s unimpaired capital and unimpaired surplus. Loans to an executive officer, other than loans for the education of the officer’s children and certain loans secured by the officer’s residence, may generally not exceed the lesser of (1) $100,000 or (2) the greater of $25,000 or 2.5% of the bank’s unimpaired capital and surplus. The Federal Reserve Act and Regulation O require that any

proposed loan to an Insider, or a related interest of that Insider, be approved in advance by a majority of the board of directors of the bank, if that loan, combined with previous loans by the bank to the Insiders and his or her related interests, exceeds specified amounts.

Generally, loans to Insiders and their related interests must be made on substantially the same terms as, and follow credit underwriting procedures that are not less stringent than, those that are prevailing at the time for comparable transactions with persons not affiliated with the institution. Regulation O contains a general exception for extensions of credit made pursuant to a benefit or compensation plan of a bank that is widely available to employees of the bank or affiliate and that does not give any preference to Insiders of the bank or affiliate over other employees.

As insurer, the FDIC imposes deposit insurance premiums and is authorized to conduct special examinations of and to require reporting by, national banks. It may also prohibit an insured institution from engaging in any activity the FDIC determines by regulation or order to pose a serious risk to the Deposit Insurance Fund. The FDIC has the authority to initiate enforcement actions against insured institutions under certain circumstances. The FDIC may terminate the deposit insurance of any insured depository institution, including the Bank, if it determines after a hearing that the institution has engaged or is engaging in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, order or any condition imposed by an agreement with the FDIC. Bank management does not know of any practice, condition or violation that might lead to termination of FDIC deposit insurance.

Deposit insurance premiums are based on an institution’s quarterly average total assets minus average tangible equity. For institutions of the Bank’s asset size, the FDIC operates a risk-based premium system that determines assessment rates from financial modelling designed to estimate the probability of the bank’s failure over a three year period. The FDIC has authority to increase insurance. As of January 1, 2023, total assessment rates for institutions of the Bank’s size ranged from 2.5 to 32 basis points.

In addition to the foregoing, federal law required the federal regulators to adopt regulations establishing “safety and soundness” standards to promote the safe operation of insured institutions. Such standards specifically address, among other things: (i) internal controls, information systems and internal audit systems; (ii) loan documentation; (iii) credit underwriting; (iv) interest rate exposure; (v) asset growth; (vi) ratio of classified assets to capital; (vii) minimum earnings; (viii) compensation and benefits standards for management officials; (ix) information security and (x) residential mortgage lending practices. An institution found to be noncompliant with any such standard may be required to submit a compliance plan and may be subject to enforcement action if an acceptable plan is not submitted and complied with.

Dividends paid by the Bank have been the Company’s primary source of operating funds and are expected to be for the foreseeable future. Capital adequacy requirements serve to limit the amount of dividends that may be paid by the Bank. Under OCC regulations, the Bank may not pay a dividend, without prior OCC approval, if the total amount of all dividends declared during the calendar year, including the proposed dividend, exceed the sum of its retained net income to date during the calendar year combined with its retained net income over the preceding two years (less dividends paid over the period). As of December 31, 2024, approximately $33 million was available for the payment of dividends without prior OCC approval. The Bank’s ability to pay dividends is also subject to the Bank being in compliance with regulatory capital requirements. At December 31, 2024, the Bank was in compliance with these requirements.

Because the Company is a legal entity separate and distinct from the Bank, the Company’s right to participate in the distribution of assets of the Bank in the event of the Bank’s liquidation or reorganization would be subject to the prior claims of the Bank’s creditors. In the event of a liquidation or other resolution of an insured depository institution, the claims of depositors and other general or subordinated creditors are entitled to a priority of payment over the claims of unsecured, non-deposit creditors, including a parent bank holding company (such as the Company) or any shareholder or creditor thereof.

The OCC has broad enforcement powers over national banks, including the power to issue cease and desist orders, impose substantial civil money penalties, remove directors and officers, and appoint a conservator or receiver for the institution. Failure to comply with applicable laws, regulations, conditions, and supervisory agreements could subject the Bank, as well as officers, directors and other institution-affiliated parties of the Bank, to potential enforcement actions and civil money penalties.

Under the Community Reinvestment Act, or “CRA,” as implemented by OCC, a national bank has a continuing and affirmative obligation, consistent with its safe and sound operation, to help meet the credit needs of the communities served by the bank, including low- and moderate-income neighborhoods. The CRA requires the OCC to assess an institution’s record of meeting the credit needs of its communities and to take such record into account in its evaluation of certain applications by that institution, including applications to establish branches and acquire other financial institutions. The FRB also must consider the subsidiary bank’s CRA rating in connection with bank holding company applications to acquire additional institutions. The CRA currently requires the OCC to provide a written evaluation of an institution’s CRA performance utilizing a four-tiered descriptive rating system. The Bank’s most recent OCC CRA rating was “Satisfactory.”

On October 24, 2023, the Federal Deposit Insurance Corporation, the Federal Reserve Board, and the Office of the Comptroller of the Currency (“OCC”) issued a final rule to strengthen and modernize the CRA regulations. Under the final rule, banks with assets of at

least $2 billion as of December 31 in both of the prior two calendar years will be a “large bank.” The agencies will evaluate large banks under four performance tests: the Retail Lending Test, the Retail Services and Products Test, the Community Development Financing Test, and the Community Development Services Test. The applicability date for the majority of the provisions in the CRA regulations was set as January 1, 2026, with additional requirements to become applicable on January 1, 2027. However, the final rule was challenged in litigation and a federal district court issued a preliminary injunction of the new CRA regulations, enjoining federal banking agencies from enforcing the regulations against the plaintiff bank industry trade groups, and extending the regulations’ implementation dates day-for-day for each day the injunction is in place. Accordingly, the legacy CRA regulations remain in effect.

Capital Adequacy

The Company and its subsidiary bank are required to comply with applicable capital adequacy standards established by the federal banking agencies. In July 2013, the FRB, the OCC, and the FDIC approved final rules (the “Capital Rules”) establishing a new comprehensive capital framework for U.S. banking organizations. These rules went into effect as to the Company and the Bank on January 1, 2015, subject to phase-in periods. Effective August 2018, holding companies with less than $3 billion of consolidated assets, including the Company, are generally not subject to the Capital Rules unless otherwise directed by the FRB. The Bank remains subject to the Capital Rules.

Basel III and the Capital Rules. The Capital Rules generally implemented the Basel Committee’s December 2010 final capital framework referred to as “Basel III” for strengthening international capital standards. The Capital Rules substantially revised the risk-based capital requirements applicable to bank holding companies and their depository institution subsidiaries. The Capital Rules revised the definitions and the components of regulatory capital, and addressed other issues affecting the numerator in banking institutions’ regulatory capital ratios. The Capital Rules also addressed asset risk weights and other matters affecting the denominator in banking institutions’ regulatory capital ratios.

Among other matters, the Capital Rules: (i) introduced a “Common Equity Tier 1” (“CET1”) capital measure and related regulatory capital ratio of CET1 to risk-weighted assets; (ii) specified that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting certain revised requirements; (iii) mandated that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital; and (iv) expanded the scope of the deductions from and adjustments to capital as compared to the previous regulations.

Pursuant to the Capital Rules, the minimum capital ratios are as follows:

The Capital Rules also introduced a new “capital conservation buffer,” composed entirely of CET1, on top of the minimum risk-weighted asset ratios described above, which was designed to absorb losses during periods of economic stress. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer face constraints on dividends, equity and other capital instrument repurchases and executive compensation based on the amount of the shortfall. The additional capital conservation buffer of 2.5% of CET1 on top of the minimum risk-weighted asset ratios, effectively results in minimum ratios of (i) CET1 to risk-weighted assets of at least 7%, (ii) Tier 1 capital to risk-weighted assets of at least 8.5% and (iii) Total capital to risk-weighted assets of at least 10.5%.

The Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, deferred tax assets arising from temporary differences that could not be realized through net operating loss carrybacks and significant investments in non-consolidated financial entities be deducted from CET1, subject to specified limits. In addition, the Capital Rules include certain exemptions to address concerns about the regulatory burden on community banks. For example, banking organizations with less than $15 billion in consolidated assets as of December 31, 2009 are permitted to include in Tier 1 capital trust preferred securities and cumulative perpetual preferred stock issued and included in Tier 1 capital prior to May 19, 2010 on a permanent basis, without any phase out (subject to a limit of 25% of Tier 1 capital). Also, community banks were able to elect, in their March 31, 2015 quarterly filings, to permanently opt-out of the requirement to include most accumulated other comprehensive income (“AOCI”) components in the calculation of common equity Tier 1 capital. Such an election, in effect, continued the AOCI treatment under the previous capital regulations. Under the Capital Rules, the Bank made the one-time, permanent election to continue to exclude AOCI from capital.

The Federal Deposit Insurance Act (the “FDIA”) establishes a system of regulatory remedies to resolve the problems of undercapitalized institutions, referred to as “prompt corrective action.” The federal banking regulators have established five capital categories (“well-capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” and “critically undercapitalized”) and must take certain mandatory supervisory actions, and are authorized to take other discretionary actions, with respect to institutions which are undercapitalized, significantly undercapitalized or critically undercapitalized. The severity of these mandatory and discretionary supervisory actions depends upon the capital category in which the institution is placed. The federal regulators have specified by regulation the relevant capital levels for each category, which are set forth below.

For purposes of these regulations, the term “tangible equity” includes capital elements counted as Tier 1 Capital for purposes of the risk-based capital standards plus the amount of outstanding cumulative perpetual preferred stock (including related surplus) not included in Tier 1 capital.

An institution that is classified as well-capitalized based on its capital levels may be reclassified as adequately capitalized, and an institution that is adequately capitalized or undercapitalized based upon its capital levels may be treated as though it were undercapitalized or significantly undercapitalized, respectively. Such reclassification can occur if the appropriate federal banking agency, after notice and opportunity for hearing, determines that an unsafe or unsound condition or an unsafe or unsound practice warrants such treatment.

An institution that is categorized as undercapitalized, significantly undercapitalized or critically undercapitalized is required to submit an acceptable capital restoration plan to its appropriate federal banking regulator. In order for the capital restoration plan to be accepted by the appropriate federal banking agency, the law requires that any parent holding company guarantee that its subsidiary depository institution will comply with its capital restoration plan, subject to certain limitations. The obligation of a controlling bank holding company under the FDIA to fund a capital restoration plan is limited to the lesser of 5.0% of an undercapitalized subsidiary institution’s assets or the amount required to meet regulatory capital requirements. An undercapitalized institution is also generally prohibited from increasing its average total assets, making acquisitions, establishing any branches or engaging in any new line of business, except in accordance with an accepted capital restoration plan or with regulatory approval. Institutions that are significantly undercapitalized or undercapitalized and either fail to submit an acceptable capital restoration plan or fail to implement an approved capital restoration plan may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets and cessation of receipt of deposits from correspondent banks. Critically undercapitalized depository institutions are subject to appointment of a receiver or conservator.

The Bank’s regulatory capital ratios under risk-based capital rules in effect through December 31, 2024 are presented in Note 21 to the Consolidated Financial Statements included in Item 8 of this Annual Report on Form 10-K.

In an effort to reduce regulatory burden, legislation enacted in May 2018 required the federal banking agencies to establish an optional “community bank leverage ratio” of between 8% to 10% tangible equity to average total consolidated assets for qualifying institutions with assets of less than $10 billion. Pursuant to federal legislation enacted in 2020, the community bank leverage ratio was set at 9% for 2022 and thereafter. Institutions with capital meeting the specified requirements and electing to follow the alternative framework are deemed to comply with the applicable regulatory capital requirements, including the risk-based requirements, and are considered well-capitalized under the prompt corrective action framework. Eligible institutions may opt into and out of the community bank ratio

framework on their quarterly call report. The Bank has not exercised its option to use the community bank leverage ratio alternative as of December 31, 2024.

Other Laws and Regulations

In addition to the laws and regulations discussed above, the Bank is also subject to certain fair lending and consumer laws that are designed to protect consumers in transactions with banks. Many of these laws are implemented through regulations issued by the Consumer Financial Protection Bureau (the “CFPB”) though, for institutions of the Bank’s asset size, compliance is subject to examination by the federal banking regulator, i.e., the OCC in the Bank’s case. These laws include, but are not limited to, the Truth in Lending Act, the Truth in Savings Act, the Electronic Funds Transfer Act, the Expedited Funds Availability Act, the Equal Credit Opportunity Act, the Fair Housing Act, the Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, the Right to Financial Privacy Act, the Fair and Accurate Credit Transactions Reporting Act, and federal financial privacy laws. These laws, and their implementing regulations, generally regulate the manner in which financial institutions must deal with customers when taking deposits or making loans to such customers.

The USA PATRIOT Act of 2001 gave the federal government new additional powers to address terrorist threats through enhanced domestic security measures, expanded surveillance powers, and increased information sharing and broadened anti-money laundering requirements for financial institutions. The USA Patriot Act placed additional responsibilities upon financial institutions in terms of broadened anti-money laundering compliance programs and due diligence policies and controls to facilitate detection and prevention of money laundering and terrorist financing and the reporting of suspicious activity. Such requirements build on previously existing requirements, also applicable to financial institutions, under the Bank Secrecy Act. The Bank has established policies, procedures and systems designed to comply with these laws. The USA PATRIOT Act also requires the federal banking agencies to take into consideration the effectiveness of such controls in determining whether to approve a merger or other acquisition application. Accordingly, if the Bank seeks to engage in a merger or other acquisition, the Bank’s controls designed to combat money laundering are considered as part of the application process.

Monetary Policy and Economic Control

The commercial banking business is affected not only by general economic conditions, but also by the monetary policies of the FRB. Changes in the discount rate on member bank borrowing, availability of borrowing at the “discount window,” open market operations and the imposition of, and changes in, reserve requirements are some of the instruments of monetary policy available to the FRB. These monetary policies are used in varying combinations to influence overall growth and distributions of bank loans, investments and deposits, and this use may affect interest rates charged on loans or paid on deposits. The monetary policies of the FRB have had a significant effect on the operating results of commercial banks and are expected to continue to do so in the future. These monetary policies are influenced by various factors, including inflation, unemployment, and short-term and long-term changes in the international trade balance and in the fiscal policies of the United States Government. Future monetary policies and the effect of such policies on the future business and earnings of the Company cannot be predicted.

AVAILABLE INFORMATION

The Company's Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to those reports filed or furnished by the Company pursuant to Section 13(a) or 15(d) of the Exchange Act are available without charge on the “SEC Filings” section of the Company's website, www.evansbancorp.com, as soon as reasonably practicable after they are electronically filed with or furnished to the SEC. The Company is providing the address to its Internet site solely for the information of investors. The Company does not intend its Internet address to be an active link or to otherwise incorporate the contents of the website into this Annual Report on Form 10-K or into any other report filed with or furnished to the SEC. In addition, the SEC maintains an internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC on its website, www.sec.gov.

‎

Item 1A.RISK FACTORS

The following factors identified by the Company's management represent significant potential risks that the Company faces in its operations.

Risks Related to our Pending Merger with NBT

The Number of Shares of NBT Common Stock to be Exchanged per Share of Company Common Stock is Fixed and Will Not Be Adjusted if NBT’s Share Price Changes

Upon the consummation of the merger, each share of Company common stock will be converted into 0.91 shares of NBT common stock. The exchange ratio is fixed in the merger agreement and will not be adjusted for changes in the market price of NBT common stock between the execution of the merger agreement and the completion of the merger. Changes in the market price of shares of NBT common stock prior to the merger will affect the market value of the consideration that the Company’s shareholders will receive on the closing date of the merger. Stock price changes may result from a variety of factors, many of which are beyond NBT’s control, including market sentiment regarding the merger, changes in NBT’s business and operations, and general market and economic conditions. Therefore, while the number of shares of NBT common stock to be issued per share of Company common stock is fixed, the Company’s shareholders cannot be sure of the market value of the consideration they will receive upon completion of the merger.

The Company Will Be Subject to Business Uncertainties and Contractual Restrictions While the Merger is Pending.

Uncertainty about the effect of the merger on the Company’s employees, suppliers and customers may have an adverse effect on the Company. These uncertainties may impair our ability to attract, retain and motivate key personnel until the merger is completed, and could cause customers, suppliers and others who deal with the Company to seek to change existing business relationships. Employee retention and recruitment may be particularly challenging prior to the effective time of the merger, as employees and prospective employees may experience uncertainty about their future roles with NBT.

The pursuit of the merger and the preparation for the integration may place a significant burden on management and internal resources. Any significant diversion of management attention away from ongoing business and any difficulties encountered in the transition and integration process could affect the financial results of the Company. In addition, the merger agreement requires that the Company operate in the ordinary course of business consistent with past practice and restricts the Company from taking certain actions prior to the effective time of the merger or termination of the merger agreement without NBT’s written consent. These restrictions may prevent the Company from retaining existing customers or pursuing attractive business opportunities that may arise prior to the completion of the merger.

NBT and the Company cannot provide any assurances with respect to the timing of the closing of the merger.

The Merger Agreement Contains Provisions that Limit the Company’s Ability to Pursue Alternatives to the Merger and May Discourage Other Companies From Trying to Acquire the Company.

The merger agreement contains covenants that restrict the Company’s ability to, directly or indirectly, initiate, solicit, induce, knowingly encourage, or knowingly facilitate inquiries, offers or proposals with respect to, or, subject to certain exceptions generally related to the exercise of fiduciary duties by the Company’s Board of Directors, engage in any negotiations concerning, or provide any confidential or non-public information or data relating to, any alternative acquisition proposals.

The Merger Agreement May Be Terminated in Accordance With Its Terms and the Merger May Not Be Completed.

NBT and the Company can mutually agree to terminate the merger agreement at any time before the merger has been completed, and either company can terminate the merger agreement if:

the other party materially breaches any of its representations, warranties, covenants or other agreements set forth in the merger agreement (provided that the terminating party is not then in material breach of any representation, warranty, covenant or other agreement contained in the merger agreement), which breach is not cured within 30 days of written notice of the breach, or by its nature cannot be cured prior to the closing of the merger, and such breach would entitle the non-breaching party not to consummate the merger; or

merger is not consummated by September 15, 2025, unless the failure to consummate the merger by such date is due to a material breach of the merger agreement by the terminating party.

Failure to Complete the Merger Could Negatively Impact the Stock Prices and Future Business and Financial Results of the Company.

The consummation of the merger may be delayed, the merger may be consummated on terms different than those contemplated by the merger agreement, or the merger may not be consummated at all. If the merger is not completed, the ongoing businesses of the Company may be adversely affected, and the Company will be subject to several risks, including the following:

the Company could incur substantial costs relating to the proposed merger, such as legal, accounting, financial advisor, filing, printing and mailing fees;

the Company is subject to certain restrictions on the conduct of its business prior to completing the merger, which may adversely affect its ability to execute certain of its business strategies; and

the Company’s management’s and employees’ attention may be diverted from our day-to-day business and operational matters as a result of efforts relating to the attempt to consummate the merger.

In addition, if the merger is not completed, the Company may experience negative reactions from the financial markets and from their respective customers and employees. The Company also could be subject to litigation related to any failure to complete the merger or to enforcement proceedings commenced against the Company to perform their respective obligations under the merger agreement. Such events could materially affect the Company’s stock prices and business and financial results.

Shareholder Litigation Could Prevent or Delay the Closing of the Merger or Otherwise Negatively Affect the Business and Operations of the Company.

The Company may incur costs in connection with the defense or settlement of any shareholder lawsuits filed in connection with the proposed merger. Such litigation could have an adverse effect on the financial condition and results of operations of the Company and could prevent or delay the consummation of the merger.

Credit Risks

Commercial Real Estate and Commercial Business Loans Expose the Company to Increased Credit Risks



At December 31, 2024, the Company's portfolio of commercial real estate loans totaled $1.0 billion, or 56% of total loans outstanding, and the Company's portfolio of commercial and industrial ("C&I") loans totaled $260 million, or 15% of total loans outstanding. The Company plans to continue to emphasize the origination of commercial loans as they generally earn a higher rate of interest than other loan products offered by the Bank. However, commercial loans generally expose a lender to greater risk of non-payment and loss than one-to-four family residential mortgage loans because repayment of commercial real estate and C&I loans often depends on the successful operations and the income stream of the borrowers. Commercial mortgages are collateralized by real property while C&I loans are typically secured by business assets such as equipment and accounts receivable. Commercial loans typically involve larger loan balances to single borrowers or groups of related borrowers compared to one-to-four-family residential mortgage loans. Also, many of the Company's commercial borrowers have more than one commercial real estate or C&I loan outstanding with the Company. Consequently, an adverse development with respect to one loan or one credit relationship can expose the Company to a significantly greater risk of loss compared to an adverse development with respect to a one-to-four-family residential mortgage loan. Commercial real estate loans in non-accrual status at December 31, 2024 were $12.4 million, compared with $20.2 million at December 31, 2023. C&I loans in non-accrual status were $1.5 million and $1.8 million at December 31, 2024 and December 31, 2023, respectively. Increases in the delinquency levels of commercial real estate and C&I loans could result in an increase in non-performing loans and the provision for credit losses, which could have a material adverse effect on the Company's results of operations and financial condition.



Continuing Concentration of Loans in the Company's Primary Market Area May Increase the Company's Risk



Unlike larger banks that are more geographically diversified, the Company provides banking and financial services to customers located primarily in Western New York and the Finger Lakes Region of New York State. Therefore, the Company's success depends primarily on the general economic conditions in those areas. The Company's business lending and marketing strategies focus on loans to small and medium-sized businesses in this geographic region. Moreover, the Company's assets are heavily concentrated in mortgages on properties located in Western New York and the Finger Lakes Region of New York State. Accordingly, the Company's business and operations are vulnerable to downturns in the economy of those areas. A downturn in the economy or recession in these regions could result in a decrease in loan originations and increases in delinquencies and foreclosures, which would more greatly affect the Company than if the Company's lending were more geographically diversified. In addition, the Company may suffer losses if there is a decline in the value of properties underlying the Company's mortgage loans which would have a material adverse impact on the Company's operations.

In the Event the Company's Allowance for Credit Losses is Not Sufficient to Cover Actual Loan Losses, the Company's Earnings Could Decrease



The Company maintains an allowance for credit losses which represents the amount of losses expected in the loan portfolio. There is a risk that the Company may experience significant loan losses which could exceed the recorded amount of the allowance for credit losses. The Company adopted Current Expected Credit Loss (CECL), effective January 1, 2023 which requires financial institutions to determine periodic estimates of lifetime expected credit losses on loans and recognize the expected credit losses as allowances for credit losses. When determining the allowance, expected credit losses over the contractual term of the loans (taking into account prepayments) will be estimated based on various assumptions and judgments about the collectability of its loan portfolio, considering relevant information about past events, current conditions, and reasonable and supportable forecasts that affect the collectibility of the reported amount. The emphasis on the origination of commercial real estate and C&I loans is a significant factor in evaluating the allowance for credit losses. As the Company continues to increase the amount of these loans in the portfolio, additional or increased provisions for credit losses may be necessary and would adversely affect the results of operations. In addition, bank regulators periodically review the Company's loan portfolio and credit underwriting procedures, as well as its allowance for credit losses, and may require the Company to increase its provision for credit losses or recognize further loan charge-offs. An increase in our allowance for credit losses may have a material adverse effect on our financial condition and results of operations.

At December 31, 2024, the Company had a gross loan portfolio of $1.8 billion and the allowance for credit losses was $24.2 million, which represented 1.36% of the total amount of gross loans. If the Company's assumptions and judgments prove to be incorrect or bank regulators require the Company to increase its provision for credit losses or recognize further loan charge-offs, the Company may have to increase its allowance for credit losses or loan charge-offs which could have an adverse effect on the Company's operating results and financial condition. Additionally, there can be no assurances that the Company's allowance for credit losses will be adequate to protect the Company against loan losses that it may incur.



Environmental Factors May Create Liability



In the course of its business, the Bank has acquired, and may acquire in the future, property securing loans that are in default. There is a risk that the Bank could be required to investigate and clean-up hazardous or toxic substances or chemical releases at such properties after acquisition by the Bank in a foreclosure action, and that the Bank may be held liable to a governmental entity or third parties for property damage, personal injury and investigation and clean-up costs incurred by such parties in connection with such contamination. The Bank may in the future be required to perform an investigation or clean-up activities in connection with environmental claims. Any such occurrence could have a material adverse effect on our business, financial condition, and results of operations.



Liquidity Risks

A Lack of Liquidity Could Adversely Affect the Company’s Financial Condition and Results of Operations and Result in Regulatory Restrictions.

The Company must maintain sufficient funds to respond to the needs of depositors and borrowers. Deposits have traditionally been the Company’s primary source of funds for use in lending and investment activities and are emphasized due to the relatively lower cost of these funds. The Company also receives funds from loan repayments, investment maturities and income on other interest-earning assets, as well as borrowings. If the Company is required to rely more heavily on more expensive funding sources to support liquidity and future growth, its revenues may not increase proportionately to cover its increased costs, which would adversely affect its operating margins, profitability and growth prospects. Alternatively, the Company may need to sell a portion of its investment securities portfolio to raise funds, which, as discussed below, could result in a loss.

Any decline in funding could adversely impact the Company’s ability to originate loans, invest in securities, pay expenses, or fulfill obligations such as repaying its borrowings or meeting deposit withdrawal demands, any of which could have a material adverse impact on its liquidity, business, financial condition and results of operations. A lack of liquidity could also attract increased regulatory scrutiny and potential restraints imposed by regulators. Depending on the capitalization status and regulatory treatment of depository institutions, including whether an institution is subject to a supervisory prompt corrective action directive, regulatory restrictions and prohibitions may include restrictions on growth, restrictions on interest rates paid on deposits, restrictions or prohibitions on payment of dividends and restrictions on the acceptance of brokered deposits.

Rising Interest Rates Have Decreased the Value of the Company’s Securities Portfolio, and the Company Would Realize Losses if it Were Required to Sell Such Securities to Meet Liquidity Needs

As a result of inflationary pressures and the resulting rapid increases in interest rates over the last year, the trading value of previously issued government and other fixed income securities has declined significantly. These securities make up a majority of the securities portfolio of most banks in the U.S., including the Company’s, resulting in unrealized losses embedded in the securities portfolios. While the Company does not currently intend to sell these securities, if the Company were required to sell such securities to meet liquidity needs, it may incur losses, which could impair the Company’s capital, financial condition, and results of operations and require the Company to raise additional capital on unfavorable terms, thereby negatively impacting its profitability. While the Company has taken

actions to maximize its funding sources, there is no guarantee that such actions will be successful or sufficient in the event of sudden liquidity needs.

Interest Rate Risks

Changes in Interest Rates Could Adversely Affect the Company's Business, Results of Operations and Financial Condition



The Company's results of operations and financial condition are significantly affected by changes in interest rates. The Company's results of operations depend substantially on its net interest income, which is the difference between the interest income earned on its interest-earning assets and the interest expense paid on its interest-bearing liabilities. Because the Company's interest-bearing liabilities generally re-price or mature more quickly than its interest-earning assets, changes in interest rates could result in a decrease in its net interest income. Management is unable to predict fluctuations in market interest rates, which are affected by many factors, including inflation, recession, unemployment, monetary policy, domestic and international disorder and instability in domestic and foreign financial markets, and investor and consumer demand. During 2022 and 2023, in response to accelerated inflation, the Federal Reserve implemented monetary tightening policies, resulting in significantly increased interest rates. In 2024, however, the Federal Reserve decreased the federal funds rate three times, resulting in an aggregate decrease of 100 basis points.



Changes in interest rates also affect the value of the Company's interest-earning assets, and in particular, the Company's securities portfolio. Generally, the value of securities fluctuates inversely with changes in interest rates. At December 31, 2024, the Company's securities available for sale totaled $259 million. Net unrealized losses on securities available for sale amounted to $42.5 million, net of tax, at December 31, 2024, compared to $40.7 million, net of tax, at December 31, 2023. Included in the net unrealized losses for 2023 was the impact of the $5 million loss on sale of securities as well as the changing interest rate environment in 2023. Decreases in the fair value of securities available for sale could have an adverse effect on stockholders' equity or earnings. For additional information on the loss on sale of securities see Note 3 to the Consolidated Financial Statements included in Item 8 of this Annual Report on Form 10-K.

The Company also is subject to reinvestment risk associated with changes in interest rates. Changes in interest rates may affect the average life of loans and mortgage-related securities. Decreases in interest rates can result in increased prepayments of loans and mortgage-related securities, as borrowers refinance to reduce borrowing costs. Under these circumstances, the Company is subject to reinvestment risk to the extent that it is unable to reinvest the cash received from such prepayments at rates that are comparable to the rates on existing loans and securities. Additionally, increases in interest rates may decrease loan demand and make it more difficult for borrowers to repay adjustable rate loans.



A significant portion of our loans have fixed interest rates and longer terms than our deposits and borrowings. As is the case with many banks and savings institutions, our emphasis on increasing the development of core deposits, those with no stated maturity date, has resulted in our interest-bearing liabilities having a shorter duration than our assets. Accordingly, in a rising interest rate environment, our net interest income could be adversely affected if the rates we pay on deposits and borrowings increase more rapidly than the rates we earn on loans. Rising interest rates may also result in increased loan delinquencies and loan losses and a decrease in demand for our products and services.

Regulatory Risks

The Company Operates in a Highly Regulated Environment and May Be Adversely Affected By Changes in Laws and Regulations



The Company and its subsidiaries are subject to regulation, supervision and examination by the OCC, FRB, and by the FDIC, as insurer of its deposits. Such regulation and supervision govern the activities in which a bank and its holding company may engage and are intended primarily for the protection of the deposit insurance funds and depositors. Regulatory requirements affect the Bank's lending practices, capital structure, investment practices, dividend policy and growth. These regulatory authorities have extensive discretion in connection with their supervisory and enforcement activities, including the imposition of restrictions on the operation of a bank, the imposition of deposit insurance premiums and other assessments, the classification of assets by a bank and the adequacy of a bank's allowance for credit losses. Any change in such regulation and oversight could have a material adverse impact on the Bank, the Company and their business, financial condition and results of operations.



Additionally, the CFPB has the authority to issue consumer finance regulations and is authorized, individually or jointly with bank regulatory agencies, to conduct investigations to determine whether any person is, or has, engaged in conduct that violates new and existing consumer financial laws or regulations. Because we have less than $10 billion in total consolidated assets, the FRB and OCC, not the CFPB, are responsible for examining and supervising our compliance with these consumer protection laws and regulations.



Noncompliance with applicable regulations may lead to adverse consequences for the Company. A successful regulatory challenge to an institution's performance under the CRA or fair lending laws and regulations could result in a wide variety of sanctions, including

the required payment of damages and civil money penalties, injunctive relief, imposition of restrictions on mergers and acquisitions activity and restrictions on expansion. Private parties may also have the ability to challenge an institution's performance under fair lending laws in private class action litigation. Such actions could have a material adverse effect on our business, financial condition and results of operations.



The Company also faces a risk of noncompliance and subsequent enforcement action in connection with federal Bank Secrecy Act and other anti-money laundering and counter terrorist financing statutes and regulations. The federal banking agencies and the U.S. Treasury Department's Financial Crimes Enforcement Network are authorized to impose significant civil money penalties for violations of those requirements and have recently engaged in coordinated enforcement efforts against banks and other financial services providers with the U.S. Department of Justice, Drug Enforcement Administration and Internal Revenue Service. If the Company or the Bank violates these laws and regulations, or its policies, procedures and systems are deemed deficient, they would be subject to liability, including fines and regulatory actions, which may include restrictions on the Company’s ability to pay dividends and the necessity to obtain regulatory approvals to proceed with certain aspects of their business plans, including acquisition plans. Any of these results could have a material adverse effect on the Company's business, financial condition, results of operations and growth prospects.



Future FDIC Insurance Premium Increases May Adversely Affect the Company's Earnings



The Company is generally unable to control the amount of premiums that it is required to pay for FDIC insurance. The FDIC increased initial base insurance deposit assessment rates by 2 basis points effective January 1, 2023. If there are additional bank or financial institution failures or other similar occurrences, the FDIC may again increase the premiums assessed upon insured institutions. Such increases and any future increases or required prepayments of FDIC insurance premiums may adversely impact the Company's results of operations.

The Company is a Financial Holding Company and Depends on Its Subsidiaries for Dividends, Distributions and Other Payments



The Company is a legal entity separate and distinct from its banking and other subsidiaries. The Company's principal source of cash flow, including cash flow to pay dividends to the Company's stockholders and principal and interest on its outstanding debt, is dividends from the Bank. There are statutory and regulatory limitations on the payment of dividends by the Bank, as well as the payment of dividends by the Company to its stockholders. Regulations of the OCC affect the ability of the Bank to pay dividends and other distributions and to make loans to the Company. If the Bank is unable to make dividend payments and sufficient capital is not otherwise available, the Company may not be able to make dividend payments to its common stockholders or principal and interest payments on its outstanding debt.



If Regulators Impose Limitations on the Company's Commercial Real Estate Lending Activities, Earnings Could Be Adversely Affected



In 2006, the federal bank regulatory agencies issued joint guidance entitled "Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices" (the "CRE Guidance"). Although the CRE Guidance did not establish specific lending limits, it provides that a bank's commercial real estate lending exposure may receive increased supervisory scrutiny where total non-owner occupied commercial real estate loans, including loans secured by apartment buildings, investor commercial real estate and construction and land loans, represent 300% or more of an institution's total risk-based capital and the outstanding balance of the commercial real estate loan portfolio has increased by 50% or more during the preceding 36 months. The Bank's non-owner occupied commercial real estate level equaled 295% of total risk-based capital at December 31, 2024. Including owner-occupied commercial real estate, the ratio of commercial real estate loans to total risk-based capital ratio would be 371% at December 31, 2024. If the Bank’s regulators were to impose restrictions on the amount of commercial real estate loans it can hold in its portfolio, or require higher capital ratios as a result of the level of commercial real estate loans held, the Company's earnings would be adversely affected.



Operational Risks

The Company’s Internal Controls May Fail or Be Circumvented

Management regularly reviews and updates our internal controls and corporate governance policies and procedures. Any system of controls, however well-designed and operated, is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met. A failure to implement and maintain effective internal control over financial reporting could result in errors in our financial statements that may lead to a restatement of our financial statements or cause us to fail to meet our reporting obligations. Any failure or circumvention of our controls and procedures, or failure to comply with regulations related to controls and procedures, could have a material adverse effect on our operations, net income, financial condition, reputation, compliance with laws and regulations, or may result in untimely or inaccurate financial reporting.

The Potential for Business Interruption Exists Throughout the Company's Organization



Integral to the Company's performance is the continued efficacy of our technical systems, operational infrastructure, relationships with third parties and the vast array of associates and key executives in the Company's day-to-day and ongoing operations. Failure by any or all of these resources subjects the Company to risks that may vary in size, scale and scope. This includes, but is not limited to, operational or technical failures, pandemics, ineffectiveness or exposure due to interruption in third party support as expected, as well as the loss of key individuals or failure on the part of key individuals to perform properly. Such events could affect the stability of the Company's deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue, cause the Company to incur additional expenses, or disrupt our third party vendors' operations, any of which could result in a material adverse effect on the Company's financial condition and results of operations. Although the Company has established disaster recovery plans and procedures, the occurrence of any such events could have a material adverse effect on the Company.



Lack of System Integrity or Credit Quality Related to Funds Settlement Could Result in a Financial Loss



The Bank settles funds on behalf of financial institutions, other businesses and consumers and receives funds from clients, card issuers, payment networks and consumers on a daily basis for a variety of transaction types. Transactions facilitated by the Bank include debit card, credit card and electronic bill payment transactions, supporting consumers, financial institutions and other businesses. These payment activities rely upon the technology infrastructure that facilitates the verification of activity with counterparties and the facilitation of the payment. If the continuity of operations or integrity of processing were compromised this could result in a financial loss to the Bank, and therefore the Company, due to a failure in payment facilitation. In addition, the Bank may issue credit to consumers, financial institutions or other businesses as part of the funds settlement. A default on this credit by a counterparty could result in a financial loss to the Bank, and therefore to the Company.



Financial Services Companies Depend on the Accuracy and Completeness of Information about Customers and Counterparties



In deciding whether to extend credit or enter into other transactions, the Company may rely on information furnished by or on behalf of customers and counterparties, including financial statements, credit reports, and other financial information. The Company may also rely on representations of those customers, counterparties, or other third parties, such as independent auditors, as to the accuracy and completeness of that information. Reliance on inaccurate or misleading financial statements, credit reports, or other financial information could cause the Company to enter into unfavorable transactions, which could have a material adverse effect on the Company's financial condition and results of operations.



Because the Nature of the Financial Services Business Involves a High Volume of Transactions, the Company Faces Significant Operational Risks



The Company relies on the ability of its employees and systems to process a high number of transactions. Operational risk is the risk of loss resulting from the Company's operations, including but not limited to, the risk of fraud by employees or persons outside of the Company, the execution of unauthorized transactions by employees, errors relating to transaction processing and technology, breaches of the internal control system and compliance requirements, and business continuation and disaster recovery. This risk of loss also includes the potential legal actions that could arise as a result of an operational deficiency or as a result of noncompliance with applicable regulatory standards, adverse business decisions or their implementation, and customer attrition due to potential negative publicity. In the event of a breakdown in the internal control system, improper operation of systems or improper employee actions, the Company could suffer financial loss, face regulatory action and suffer damage to its reputation, any of which could have a material adverse effect on the Company's financial condition or results of operation.



The Company's Information Systems May Experience an Interruption or Breach in Security



The Company relies heavily on communications and information systems to conduct its business. As a financial institution, we process a significant number of customer transactions and possess a significant amount of sensitive customer information. As technology advances, the ability to initiate transactions and access data has become more widely distributed among mobile phones, personal computers, automated teller machines, remote deposit capture sites and similar access points. Any failure, interruption, or breach in security or operational integrity of our communications and information systems, or the systems of third parties on which we rely to process transactions, could result in failures or disruptions in the Company's customer relationship management, general ledger, deposit, loan, and other systems. There can be no assurance that failures, interruptions, or security breaches of the Company's information systems will not occur or, if they do occur, that they will be adequately addressed. Unauthorized third parties regularly seek to gain access to nonpublic, private and other information through computer systems. If customers' personal, nonpublic, confidential, or proprietary information in the Company's possession were to be mishandled or misused, we could suffer significant regulatory consequences, reputational damage, and financial loss. Such mishandling or misuse could include, for example, if such information were erroneously provided to parties who are not permitted to have the information, either by fault of the Company's systems, employees or counterparties, or where such information is intercepted or otherwise inappropriately taken by third parties. The occurrence of any failures, interruptions, or security breaches of the Company's information systems could, among other consequences, damage the

Company's reputation, result in a loss of customer business, subject the Company to additional regulatory scrutiny, result in increased insurance premiums, or expose the Company to civil litigation and possible financial liability, any of which could have a material adverse effect on the Company's financial condition and results of operations.



In addition, as cybersecurity and data privacy risks for banking organizations and the broader financial system have significantly increased in recent years, cybersecurity and data privacy issues have become the subject of increasing legislative and regulatory focus. The federal bank regulatory agencies have proposed enhanced cyber risk management standards, which would apply to a wide range of large financial institutions and their third-party service providers, and would focus on cyber risk governance and management, management of internal and external dependencies, and incident response, cyber resilience and situational awareness. We may become subject to new legislation or regulation concerning cybersecurity or the privacy of personally identifiable information and personal financial information or of any other information we may store or maintain. We could be adversely affected if new legislation or regulations are adopted or if existing legislation or regulations are modified such that we are required to alter our systems or require changes to our business practices or privacy policies. If cybersecurity, data privacy, data protection, data transfer or data retention laws are implemented, interpreted or applied in a manner inconsistent with our current practices, we may be subject to fines, litigation or regulatory enforcement actions or ordered to change our business practices, policies or systems in a manner that adversely impacts our operating results In addition, increased cost of compliance with cybersecurity regulations, at the federal and state level, could have a material adverse effect on the Company's financial condition and results of operations.

The Company May Be Adversely Affected by the Soundness of Other Financial Institutions



Financial services institutions are interrelated as a result of counterparty relationships. The Company has exposure to many different industries and counterparties, and routinely executes transactions with counterparties in the financial services industry. As a result, defaults by, or even rumors or questions about, one or more financial services institutions, or the financial services industry generally, could lead to losses or defaults by us or by other institutions and impact our business. Many of these transactions expose us to credit risk in the event of default of our counterparty or customer. In addition, our credit risk may be further increased when the collateral held by us cannot be relied upon or is liquidated at prices not sufficient to recover the full amount of the financial instrument exposure due to us. Any such losses could materially and adversely affect our results of operations.

The most important counterparty for the Company, in terms of liquidity, is the Federal Home Loan Bank of New York ("FHLBNY"). The Company uses FHLBNY as its primary source of borrowed overnight funds and also has several long-term advances with FHLBNY. At December 31, 2024, the Company had a total of $80 million in borrowed funds with FHLBNY. The Company has placed sufficient collateral in the form of commercial and residential real estate loans at FHLBNY. As a member of the Federal Home Loan Bank System, the Bank is required to hold stock in FHLBNY. The Bank held FHLBNY stock with a carrying value of $6.2 million as of December 31, 2024.



There are 11 branches of the FHLB, including New York. If a branch were at risk of breaching risk-based capital requirements, it could suspend dividends, cut dividend payments, and/or not buy back excess FHLB stock that members hold. FHLBNY has stated that they expect to be able to continue to pay dividends, redeem excess capital stock, and provide competitively priced advances in the future. Nonetheless, the 11 FHLB branches are jointly liable for the consolidated obligations of the FHLB system. To the extent that one FHLB branch cannot meet its obligations to pay its share of the system's debt; other FHLB branches can be called upon to make the payment.

Systemic weakness in the FHLB could result in higher costs of FHLB borrowings, reduced value of FHLB stock, and increased demand for alternative sources of liquidity that are more expensive, such as brokered time deposits, the discount window at the Federal Reserve, or lines of credit with correspondent banks.



A Decline in the Value of the Company's Deferred Tax Assets Could Adversely Affect the Company's Operating Results and Regulatory Capital Ratios



The Company's tax strategies depend on the ability to generate taxable income in future periods. The Company's tax strategies will be less effective in the event the Company fails to generate anticipated amounts of taxable income. The value of the Company's deferred tax assets is subject to an evaluation of whether it is more likely than not that they will be realized for financial statement purposes. In making this determination, management considers all positive and negative evidence available, including the Company's historical levels of taxable income, the opportunity for net operating loss carrybacks, and projections for future taxable income over the statutory tax loss carryover period. If the Company were to conclude that a significant portion of deferred tax assets were not more likely than not to be realized, the required valuation allowance could adversely affect the Company's financial position, results of operations and regulatory capital ratios. In addition, the value of the Company's deferred tax assets could be adversely affected by a change in statutory tax rates.

Strategic Risks

Expansion or Contraction of the Company's Branch Network May Adversely Affect its Financial Results



The Company cannot assure that the opening of new branches will be accretive to earnings or that it will be accretive to earnings within a reasonable period of time. Numerous factors contribute to the performance of a new branch, such as suitable location, qualified personnel, and an effective marketing strategy. Additionally, it takes time for a new branch to gather sufficient loans and deposits to generate income sufficient to cover its operating expenses. Difficulties the Bank experiences in opening new branches may have a material adverse effect on the Company's financial condition and results of operations. The Company cannot assure that the closing of branches will not be dilutive to earnings.



Mergers and Acquisitions Involve Numerous Risks and Uncertainties



The Company may pursue mergers and acquisitions opportunities. Mergers and acquisitions involve a number of risks and challenges, including the expenses involved; diversion of management’s time and attention; integration of branches and operations acquired; potential exposure to unknown risks; increased regulatory scrutiny; the outflow of customers from the acquired branches; the successful retention of personnel from acquired companies or branches; competing effectively in geographic areas not previously served; managing growth resulting from the transaction; and dilution in the acquirer's book and tangible book value per share.



Anti-Takeover Laws and Certain Agreements and Charter Provisions May Adversely Affect Share Value



Certain provisions of the Company's certificate of incorporation and state and federal banking laws, including regulatory approval requirements, could make it more difficult for a third party to acquire control of the Company without approval of the Company's board of directors. Under federal law, subject to certain exemptions, a person, entity or group must notify the FRB before acquiring control of a bank holding company. Acquisition of 10% or more of any class of voting stock of a bank holding company, including shares of the Company's common stock, creates a rebuttable presumption that the acquiror "controls" the bank holding company if certain other conditions are met. Also, a bank holding company must obtain the prior approval of the FRB before, among other things, acquiring direct or indirect ownership or control of more than 5% of the voting shares of any bank, including the Bank. There also are provisions in the Company's certificate of incorporation that may be used to delay or block a takeover attempt. Taken as a whole, these statutory provisions and provisions in the Company's certificate of incorporation could result in the Company being less attractive to a potential acquiror and thus could adversely affect the market price of the Company's common stock.



General Risk Factors

The Company May Incur Impairment to its Goodwill

Goodwill arises when a business is purchased for an amount greater than the fair value of the net assets acquired. The Company has recognized $1.8 million of goodwill as an asset on our balance sheet in connection with the acquisition of Fairport Savings Bank on May 1, 2020. The Company evaluates goodwill for impairment at least annually. Although the Company determined that goodwill was not impaired during 2023, a significant and sustained decline in the Company’s stock price and market capitalization, a significant decline in our expected future cash flows, a significant adverse change in the business climate, slower growth rates or other factors could result in impairment of goodwill. If the Company were to conclude that a future write-down of the goodwill was necessary, it would record the appropriate charge to earnings, which could be materially adverse to its financial condition and results of operations.

The Company's Business May Be Adversely Affected by Conditions in the Financial Markets and Economic Conditions Generally

The Company's financial performance generally, and in particular the ability of borrowers to pay interest on and repay principal of outstanding loans and the value of collateral securing those loans, is highly dependent upon the business environment in the markets where the Company operates, in Western New York and the Finger Lakes Region of New York State, and in the United States as a whole.

A favorable business environment is generally characterized by, among other factors, economic growth, efficient capital markets, low inflation, high business and investor confidence, and strong business earnings. Unfavorable or uncertain economic and market conditions can be caused by: declines in economic growth, declines in housing and real estate valuations, business activity or investor or business confidence; changes in monetary or fiscal policy of the federal government; limitations on the availability or increases in the cost of credit and capital; increases in inflation or interest rates; public health emergencies; geopolitical conflicts; natural disasters; or a combination of these or other factors.

The Company's performance could be negatively affected to the extent there is deterioration in business and economic conditions, including persistent inflation, rising prices, and supply chain issues or labor shortages, which have direct or indirect material adverse impacts on us, our customers, and our counterparties. Recessionary conditions may significantly affect the markets in which we do business, the financial condition of our borrowers, the value of our loans and investments, and our ongoing operations, costs and profitability. Declines in real estate values and sales volumes and increased unemployment levels may result in higher than expected loan delinquencies, increases in our levels of nonperforming and classified assets and a decline in demand for our products and services. Such events may cause us to incur losses and may adversely affect our capital, liquidity, and financial condition.



Strong Competition Within the Company's Market Area May Limit the Company's Growth and Profitability



Competition in the banking and financial services industry is intense. The Company competes with commercial banks, savings institutions, mortgage brokerage firms, credit unions, finance companies, mutual funds, brokerage and investment banking firms, and financial technology companies operating locally within the Company's market area and elsewhere. Many of these competitors (whether regional or national institutions) have substantially greater resources and lending limits than the Company does, and may offer certain services that the Company does not or cannot provide. The Company's profitability depends upon its continued ability to successfully compete in this market area.



Loss of Key Employees May Disrupt Relationships with Certain Customers



The Company’s success depends, in large part, on its ability to attract and retain skilled people. The Company's business is primarily relationship-driven in that many of the key employees of the Bank have extensive customer relationships. Loss of a key employee with such customer relationships may lead to the loss of business if the customers were to follow that employee to a competitor. While management believes that the Company's relationships with its key business producers are good, the Company cannot guarantee that all of its key personnel will remain with the organization. Further, competition for highly talented people can be intense, and we may not be able to hire sufficiently skilled people or retain them. Loss of such key personnel, particularly if they enter into an employment relationship with one of the Company's competitors, could result in the loss of some of the Company's customers. Such losses could have a material adverse effect on the Company's business, financial condition and results of operations.



Damage to the Company's Reputation Could Adversely Impact Our Business



The Company's business reputation is important to its success. The ability to attract and retain customers, investors, employees and advisors may depend upon external perceptions of the Company. Damage to the Company's reputation could cause significant harm to its business and prospects and may arise from numerous sources, including litigation or regulatory actions, failing to deliver minimum standards of service and quality, compliance failures, unethical behavior and the misconduct of employees, advisors and counterparties. Negative perceptions or publicity regarding these matters could damage the Company's reputation among existing and potential customers, investors, employees and advisors. Adverse developments with respect to the financial services industry may also, by association, negatively impact the Company's reputation or result in greater regulatory or legislative scrutiny or litigation against the Company. Preserving and enhancing the Company's reputation also depends on maintaining systems and procedures that address known risks and regulatory requirements, as well as its ability to identify and mitigate additional risks that arise due to changes in businesses and the marketplaces in which the Company operates, the regulatory environment and client expectations. If any of these developments has a material effect on the Company's reputation, its business could suffer.

Furthermore, shareholders and other stakeholders have begun to consider how corporations are addressing environmental, social and governance (“ESG”) issues. Governments, investors, customers and the general public are increasingly focused on ESG practices and disclosures, and views about ESG are diverse and rapidly changing. These shifts in investing priorities may result in adverse effects on the trading price of the Company’s common stock if investors determine that the Company has not made sufficient progress on, or has overly focused, on ESG matters. The Company could also face potential negative publicity in traditional media or social media if shareholders or other stakeholders determine that we have not adequately considered or addressed, or has overly focused on, ESG matters. If the Company, or our relationships with certain customers, vendors or suppliers became the subject of negative publicity, our ability to attract and retain customers and employees, and our financial condition and results of operations, could be adversely impacted.

Changes in the Company’s Accounting Policies or in Accounting Standards Could Materially Affect How the Company Reports its Financial Results

Our accounting policies are fundamental to understanding our financial results and condition. Some of these policies require the use of estimates and assumptions that may affect the value of our assets or liabilities and financial results. Some of our accounting policies are critical because they require management to make difficult, subjective and complex judgments about matters that are inherently uncertain and because it is likely that materially different amounts would be reported under different conditions or using different assumptions. If such estimates or assumptions underlying our financial statements are incorrect, we may experience material losses.

Additionally, from time to time, the FASB and the SEC change the financial accounting and reporting standards or the interpretation of those standards that govern the preparation of our external financial statements. These changes are beyond our control, can be hard

to predict and could materially impact how we report our results of operations and financial condition. We could be required to apply a new or revised standard retroactively, resulting in our restating prior period financial statements in material amounts.

Item 1B.UNRESOLVED STAFF COMMENTS 

None.

Item 1C. CYBERSECURITY

Overall Risk Management and Strategy

The Company manages its cybersecurity risk in a manner consistent with its overall risk management process in which recognized and emerging risks are identified, assessed, controlled, and monitored on a continual basis. The Company’s cybersecurity risk management follows the “Three Lines of Defense” framework, which is as follows: (1) in the first line of defense, our Information Security function manages cybersecurity risks and controls; (2) in the second line of defense, independent internal risk management provides cybersecurity risk governance oversight; and (3) our Internal Audit function provides independent assurance over cybersecurity practices as the third line of defense.

The Company leverages third parties to support the development and independent validation of cybersecurity risk management practices. Third-party cybersecurity risk oversight includes engaging consultants in the development and deployment of cybersecurity control processes, and a managed security services provider to provide 24/7 alert monitoring and remediation services, semi-annual independent vulnerability and penetration tests from rotating providers, and an annual information security audit coordinated by the Company’s Internal Audit function.

All third-party service providers to the Company are subject to risk assessments to identify the risks, including cybersecurity-related risks, posed by that individual third-party. Changes in vendor services result in a reassessment of risk. Based on the results of the risk assessment, the Company requires each third-party service provider to meet certain due diligence requirements. These due diligence requirements require third-party service providers to provide the Company with evidence of appropriate policies, an independent examination of their control environment, financial results, and operational resilience, as appropriate.

To date, no prior internal cybersecurity incident has materially affected the Company, however, external incidents have increased attention to risk management processes which continually identify and assess threats to the Company’s operations with consideration to strategy, financial results, and business resilience.

Governance

The Enterprise Risk Committee of the Board of Directors is responsible for the oversight of cybersecurity risk at the Company. The Company has established a Cyber and Technology Risk Appetite Statement, which is approved annually by the Enterprise Risk Committee. Changes in cybersecurity risk are monitored throughout the year and are reported to the Enterprise Risk Committee.

The Enterprise Risk Committee is kept informed of these risks through reporting by the Chief Information Security Officer (“CISO”) and is also charged with reviewing cybersecurity policies, results of an annual information security risk assessment, NYS DFS Compliance Status, and other information security risk assessments or analysis of significant events that may occur throughout the year. The Enterprise Risk Committee additionally reviews the results of vulnerability and penetration testing, tabletop exercises, and other examinations performed, whether internal or external, with a focus on cybersecurity. The Enterprise Risk Committee is kept informed of cybersecurity risks through the Company’s first and second lines of defense, including the Company’s CISO, which provide the following to the Enterprise Risk Committee on a quarterly basis, or more frequently as needed: an analysis comparing actual results against the Company’s Cyber and Technology Risk Appetite Statement, an evaluation on current cybersecurity risks facing the company, and identification of any new or emerging risks associated with cybersecurity. The Audit Committee of the Board of Directors is also informed of any cybersecurity risk that is identified in annual information security specific internal audits or material cybersecurity risks that may have an impact on the financial statements and related disclosures of the Company.

The Company has established a clear chain of command in the management of cybersecurity risks by designating a CISO and Chief Information Officer (“CIO”), who jointly lead the Company’s incident response team, which also includes the company’s management team. The CISO has certifications in information security, and together, the CISO and CIO have over 25 years of cybersecurity experience combined. The CISO and CIO meet with Company senior leadership at least quarterly through an Information Technology Steering Committee in which management assess information security risk. The Company has subscribed to threat intelligence feeds that are reviewed throughout the day to ensure risks are identified and assessed in a timely manner.

The Company monitors industry events and leverages additional resources to monitor any new threats and vulnerability information. Systemic prevention controls are deployed to protect endpoints, as well as to prevent malicious code, emails, and websites from attempts to gain access to the network. Company personnel are trained on a recurring basis on best practices to protect the Company from cybersecurity risks. The Company’s assets are subject to recovery procedures to bring the asset back to its required state of operations, and these recovery procedures are tested internally by the Company to verify the capabilities of these procedures. The Company has developed an Incident Response Policy and Plan that assigns appropriate responsibilities in the event of an incident. This assignment of responsibilities allows the Company to assess and respond to any incident in a timely manner. This plan is tested on a recurring basis to maintain preparedness in the event of an actual incident.

Item 2.PROPERTIES

At December 31, 2024, the Bank conducted its business from its administrative office and 18 branch offices. The administrative offices of the Company and the Bank are located at 6460 Main Street in Williamsville, NY. The administrative office facility is 50,000 square feet and is owned by the Bank. This facility is occupied by the Office of the President and Chief Executive Officer of the Company, as well as the Administrative and Loan Divisions of the Bank. The Bank also owns a building in Derby, NY.

Item 3.LEGAL PROCEEDINGS

The nature of the Company’s business generates a certain amount of litigation involving matters arising in the ordinary course of business.

In addition, in connection with the Company’s proposed merger with NBT, following the announcement of the merger, between October 30, 2024 and December 9, 2024, the Company received a total of eight demand letters from counsel representing purported shareholders of the Company (collectively, the “Demand Letters”) and became aware of two complaints, James Jones v. Evans Bancorp, Inc. et al., Index No. 659506/2024, filed in the Supreme Court of New York, County of New York, on December 3, 2024, and Ryan Smith v. Evans Bancorp, Inc. et al., Index No. 659452/2024, filed in the Supreme Court of New York, County of New York, on December 5, 2024 (together, the “Complaints”). The Demand Letters and Complaints allege, among other things, that the Company and/or its directors caused a materially incomplete and misleading proxy statement relating to the merger to be filed with the SEC in violation of Section 14(a) and Section 20(b) of the Securities Exchange Act of 1934, as amended, and Rule 14a-9 promulgated thereunder. 

The Company believes that the allegations in the Demand Letters and the Complaints are without merit and that the disclosures in the proxy statement/prospectus complied fully with applicable laws. However, in order to avoid the risk that the Demand Letters and Complaints might delay or otherwise adversely affect the merger, and to avoid the cost and distraction of litigation, and without admitting any liability or wrongdoing, the Company and NBT determined to supplement the proxy statement/prospectus by means of additional disclosure provided via Current Report on Form 8-K filed with the SEC on December 13, 2024. The Company and its directors deny that they have violated any laws, negligently misrepresented or concealed any information, or breached any fiduciary duties. In addition to filing a Current Report on Form 8-K with the SEC, the Company provided copies of the disclosure to representatives of the purported shareholders identified in the Demand Letters and Complaints. The Company is unaware of any further activity with respect to the Demand Letters and Complaints.

Item 4.MINE SAFETY DISCLOSURES

Not applicable.

PART II

Item 5.MARKET FOR REGISTRANT’S COMMON EQUITY, RELATED

STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES

Market Information. The Company’s common stock is listed on the NYSE American under the symbol “EVBN.”

Holders. The approximate number of holders of record of the Company’s common stock as of February 19, 2025 was 1,148.

PERFORMANCE GRAPH

The following Performance Graph compares the Company's cumulative total stockholder return on its common stock for a five-year period (December 31, 2019 to December 31, 2024) with the cumulative total return of the NYSE American Composite Index and NASDAQ Bank Index. The comparison for each of the periods assumes that $100 was invested on December 31, 2019 in each of the Company's common stock and the stocks included in the NYSE American Composite Index and NASDAQ Bank Index and that all dividends were reinvested without commissions. This table does not forecast future performance of the Company's stock.

In accordance with and to the extent permitted by applicable law or regulation, the information set forth above under the heading "Performance Graph" shall not be deemed to be "soliciting material" or to be "filed" with the SEC under the Securities Act or the Exchange Act, or subject to the liabilities of Section 18 of the Exchange Act, except to the extent that we specifically request that such information be treated as soliciting material or specifically incorporate it by reference into such a filing.

Purchases of Equity Securities by the Issuer and Affiliated Purchasers.

Issuer Purchases of Equity Securities

(1)On February 25, 2021, the Board of Directors authorized the Company to repurchase up to 300,000 shares of the Company’s common stock (the “2021 Repurchase Program”). The 2021 Repurchase program does not expire and may be suspended or discontinued by the Board of Directors at any time. The remaining number of shares that may be purchased under the 2021 Repurchase Program as of December 31, 2024 was 180,932.

Item 6.[RESERVED]

Item 7.MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

OVERVIEW

This discussion is intended to compare the performance of the Company for the years ended December 31, 2024 and 2023. The review of the information presented should be read in conjunction with Part I, Item 1: “Business” and Part II, Item 8: “Financial Statements and Supplementary Data” of this Annual Report on Form 10-K.

The Company is a financial holding company registered under the BHCA. The Company currently conducts its business through its two direct wholly-owned subsidiaries: the Bank, and the Bank’s subsidiaries, ENL and ENHC; and ENFS. The Company does not engage in any other substantial business. Unless the context otherwise requires, the term “Company” refers collectively to Evans Bancorp, Inc. and its subsidiaries.

‎

Selected Financial Data