TrustCo Bank Corp NY (“TrustCo” or the “Company”) is a savings and loan holding company having its principal place of business at 5 Sarnowski Drive, Glenville, New York 12302. TrustCo was incorporated under the laws of New York in 1981 to be the parent holding company of The Schenectady Trust Company, which subsequently was renamed Trustco Bank New York and, later, Trustco Bank, National Association. The Company’s principal subsidiary, Trustco Bank (also referred to as the “Bank”), is the successor by merger to Trustco Bank, National Association.

 

As of December 31, 2025, TrustCo had $6.4 billion in total assets and $5.6 billion in deposits. Furthermore, TrustCo had 6,582 shareholders of record as of December 31, 2025 and the closing price of the TrustCo common stock on December 31 (the last trading day of 2025) was $41.33.

 

Trustco Bank

 

Trustco Bank is a federal savings bank engaged in providing general banking services to individuals and businesses.

 

The Bank provides a wide range of both personal and business banking services, including a full array of deposit products for both individuals and businesses.  Trustco Bank also offers trust and investment services through its Financial Services Department.  The Bank is supervised and regulated by the federal Office of the Comptroller of the Currency (“OCC”). Its deposits are insured by the Federal Deposit Insurance Corporation (“FDIC”) to the extent permitted by law. The Bank’s subsidiary, Trustco Realty Corp., is a real estate investment trust (or “REIT”) that was formed to acquire, hold and manage real estate mortgage assets, including residential mortgage loans and mortgage backed securities. The income earned on these assets, net of expenses, is distributed in the form of dividends.  Under current New York State tax law, 60% of the dividends received by the Bank from Trustco Realty Corp. are excluded from total taxable income for New York State income tax purposes. The Bank accounted for substantially all of TrustCo’s 2025 consolidated net income and average assets.  The Bank’s other active subsidiaries, Trustco Insurance Agency, Inc. and ORE Property, Inc., did not engage in any significant business activities during 2025 and 2024.

 

Trustco Financial Services, the name under which Trustco Bank’s trust department operates, serves as executor of estates and trustee of personal trusts, provides asset and wealth management services, provides estate planning and related advice, provides custodial services, and acts as trustee for various types of employee benefit plans and corporate pension and profit sharing trusts. The aggregate market value of the assets under trust, custody, or management of the trust department of the Bank was approximately $1.27 billion as of December 31, 2025.

The daily operations of the Bank remain the responsibility of its officers, subject to the oversight of its Board of Directors and overall supervision by TrustCo. The activities of the Bank are included in TrustCo’s consolidated financial statements.

 

ORE Subsidiary Corp.

 

In 1993, TrustCo created ORE Subsidiary Corp., a New York corporation, to hold and manage certain foreclosed properties acquired by the Bank. The accounts of this subsidiary are included in TrustCo’s consolidated financial statements.

 

 

At year-end 2025, the Bank operated 154 automatic teller machines and 134 banking offices in Albany, Columbia, Dutchess, Greene, Montgomery, Orange, Putnam, Rensselaer, Rockland, Saratoga, Schenectady, Schoharie, Ulster, Warren, Washington, and Westchester counties of New York; Brevard, Charlotte, Flagler, Hillsborough, Indian River, Lake, Manatee, Martin, Orange, Osceola, Palm Beach, Polk, Sarasota, Seminole, and Volusia counties in Florida; Bennington County in Vermont; Berkshire County in Massachusetts; and Bergen County in New Jersey.  The largest part of such business consists of accepting deposits and making loans and investments.  Trustco Bank also lends in Fulton county of New York, and Collier, Lee, Marion, Pasco, Pinellas, St. Johns, and St. Lucie counties of Florida, where it has no branch locations.  The Bank’s locations are selected to be easily accessible and provide convenient services to businesses and individuals throughout our market area.

 

Our market area has a high level of retail and commercial business activity. Businesses are concentrated in the service sector and retail trade areas. Major employers in our market area include certain medical centers, municipalities, and school districts.

 

TrustCo faces strong competition in its market areas, both in attracting deposits and making loans. The Company’s most direct competition for deposits, historically, has come from commercial banks, savings associations, and credit unions that are located or have branches in the Bank’s market areas. The competition ranges from other locally based commercial banks, savings banks, and credit unions to branch offices of the largest financial institutions in the United States. In its principal market areas, the Capital District area of New York State and central Florida, TrustCo’s principal competitors are local branch operations of super-regional banks, branch offices of money center banks, and locally based commercial banks and savings institutions. The Bank is the largest for profit depository institution headquartered in the Capital District area of New York State. The Company also faces competition for deposits from national brokerage houses, short-term money market funds, and other corporate and government securities mutual funds.

 

Factors affecting the acquisition of deposits include pricing, office locations and hours of operation, the variety of deposit accounts offered, and the quality of customer service provided. Competition for loans has increased as interest rates have remained elevated and housing inventory has tightened in many of the Bank’s market areas. Commercial banks, savings institutions, traditional mortgage brokers affiliated with local offices, and nationally franchised real estate brokers are all active and aggressive competitors. The Company competes in this environment by providing a full range of financial services based on a tradition of financial strength and integrity dating from its inception. The Company also expects competition to increase in the future as a result of legislative, regulatory and technological changes and the continuing trend of consolidation in the financial services industry. Technological advances, for example, have lowered barriers to entry, allowed banks and other financial services companies to expand their geographic reach by providing services over the internet, and made it possible for non-depository institutions to offer products and services that traditionally have been provided by banks. The Company competes for loans principally through the interest rates and loan fees it charges and the efficiency and quality of services it provides to borrowers.  Furthermore, management believes that a community-based financial organization is better positioned to establish personalized financial relationships with both commercial customers and individual households. The Company’s community commitment and involvement in its primary market areas, as well as its commitment to quality and personalized financial services, are factors that contribute to the Company’s competitiveness.

 

Lending Activities

One of our core goals is to support the communities in which we operate. We seek loans from within our primary market area, which generally is defined as the counties in which our banking offices are located. Approval of all loans is subject to our policies and standards described in more detail below.  We have adopted comprehensive lending policies, underwriting standards and loan review procedures. Management and our Board of Directors reviews and approves these policies and procedures on a regular basis.  Management has also implemented reporting systems designed to monitor loan originations, loan quality, concentrations of credit, loan delinquencies, nonperforming loans, and potential problem loans. Our management and various committees periodically review our lines of business to monitor asset quality trends and the appropriateness of credit policies. In addition, we establish total borrower exposure limits and monitor concentration risk. As part of this process, the overall composition of the portfolio is reviewed to gauge diversification of risk, client concentrations, industry group, loan type, geographic area, or other relevant classifications of loans. Specific segments of the portfolio are monitored and reported to our Board on a quarterly basis. We recognize that exceptions to the below-listed policy guidelines may occur and have established procedures for approving exceptions to these policy guidelines.

Residential Real Estate Loans

We originate 1-4 family, owner-occupied residential real estate loans. Historically, the vast majority of our residential loan originations are fixed-rate loans which are held in portfolio. Residential real estate loans also include home equity lines of credit, or HELOCs, and home equity loans. Our home equity portfolio includes revolving open-ended equity loans with interest-only or minimal monthly principal payments and closed-end amortizing loans. Open-ended equity loans typically have an interest-only draw period followed by a repayment period.

Commercial Loans

Commercial loans are primarily made based on identified cash flows of the borrower with consideration given to underlying collateral and personal or other guarantees. Our policy sets forth guidelines for debt service coverage ratios, loan-to-value (“LTV”) ratios and documentation standards. Specifically, we have established debt service coverage ratio limits that require a borrower’s cash flow to be sufficient to cover principal and interest payments on all new and existing debt. The majority of our commercial loans are secured by the assets being financed or other business assets such as accounts receivable or inventory.

Commercial Real Estate Loans

Commercial real estate loans are primarily made based on identified cash flows of the borrower with consideration given to underlying real estate collateral and personal guarantees. We have adopted guidelines for debt service coverage ratios, LTV ratios and documentation standards for commercial real estate loans. Specifically, our policy establishes a maximum LTV specific to property type and minimum debt service coverage ratio limits that require a borrower’s cash flow to be sufficient to cover principal and interest payments on all new and existing debt. Commercial real estate loans may be fixed or variable-rate loans with interest rates tied to indexes. Generally, we require appraisals for loans that are secured by real property.

Consumer Loans

Our consumer loan portfolio includes personal installment loans, automobile financing, and overdraft lines of credit. The majority of our consumer loans are short-term and have fixed rates of interest that are priced based on current market interest rates and the financial strength of the borrower.

Investment Activities

Sources of Funds

General.  Deposits, borrowings and loan repayments are the major sources of our funds for lending and other investment purposes. Scheduled loan repayments are a relatively stable source of funds, while deposit inflows and outflows and loan prepayments are significantly influenced by general interest rates and money market conditions.

Deposit Accounts.  Deposits are attracted from within our market area by the sales efforts of our branch network, commercial loan officers, advertising and through our website. We offer a broad selection of deposit instruments, including noninterest-bearing demand deposits (such as checking accounts), interest-bearing demand accounts (such as NOW and money market accounts), savings accounts and term certificates of deposit. We also offer a variety of deposit accounts designed for businesses operating in our market area. Our business banking deposit products include a commercial checking account, sweep accounts, money market accounts and checking accounts specifically designed for businesses. We also offer remote deposit capture products for customers to meet their online banking needs.

Deposit account terms vary according to the minimum balance required, the time periods the funds must remain on deposit, and the interest rate, among other factors. In determining the terms of our deposit accounts, we consider the rates offered by our competition, our liquidity needs, profitability to us, and customer preferences and concerns. We generally review our deposit mix and pricing on a weekly basis. Our deposit pricing strategy has generally been to offer competitive rates and to periodically offer special rates in order to attract deposits of a specific type or term.

 

Banking is a highly regulated industry, with numerous federal and state laws and regulations governing the organization and operation of banks and their affiliates. As a savings and loan holding company, TrustCo and its non-bank subsidiaries are supervised and regulated by the Board of Governors of the Federal Reserve System (“Federal Reserve Board” or the “FRB”). The OCC is the Bank’s primary federal regulator and supervises and examines the Bank. Under the Home Owners’ Loan Act of 1934 and OCC regulations, Trustco Bank must obtain prior OCC approval for acquisitions, and its business operations and activities are restricted. Because the FDIC provides deposit insurance to the Bank, the Bank also is subject to its supervision and regulation even though the FDIC is not the Bank’s primary federal regulator.

 

The following summary of laws and regulations applicable to the Company and those applicable to the Bank is not intended to be a complete description of those laws and regulations or their effects on the Company and the Bank. The summary is qualified in its entirety by reference to the particular statutory and regulatory provisions described.  Changes in applicable law or regulation, and in their interpretation and application by regulatory agencies and other governmental authorities, cannot be predicted, but may have a material effect on our business, financial condition or results of operations.

 

Dividends

 

Most of TrustCo’s revenues consist of cash dividends paid to TrustCo by the Bank, payment of which is subject to various regulatory limitations, including continued compliance with minimum regulatory capital requirements, and the receipt of regulatory approval (or non-objection) from the Bank’s and the Company’s regulators.

 

OCC regulations impose limitations upon all capital distributions by the Bank, including cash dividends. Under the regulations, an application to and the approval of the OCC is required prior to any capital distribution if the institution does not meet the criteria for “expedited treatment” of applications under OCC regulations (generally, examination ratings in the two top categories), the total capital distributions for the calendar year exceed net income for that year plus the amount of retained net income for the preceding two years, the institution would be undercapitalized following the distribution, or the distribution would otherwise be contrary to a statute, regulation, or agreement with the OCC. If an application is not required, the institution must still provide prior notice of the capital distribution to the OCC and the Federal Reserve Board if, like the Bank, the institution is a subsidiary of a savings and loan holding company. The OCC may not approve a dividend if the institution would be undercapitalized following the distribution, the proposed capital distribution raises safety and soundness concerns, or the capital distribution would violate a prohibition contained in any statute, regulation, or agreement between the bank and a regulator or a condition imposed in a previously approved application or notice.

 

As noted above, a savings institution, such as the Bank, that is a subsidiary of a savings and loan holding company and that proposes to make a capital distribution must also submit written notice to the Federal Reserve Board prior to such distribution, and Federal Reserve Board may object to the distribution based on safety and soundness or other concerns. The Federal Reserve Board may deny a dividend notice if following the dividend, the savings  association will be less than adequately capitalized, the proposed dividend raises safety and soundness concerns, or the proposed dividend violates a prohibition contained in any statute, regulation, enforcement action, or agreement between the association or holding company and an appropriate federal banking agency, a condition imposed on the association or holding company in an application or notice approved by an appropriate federal banking agency, or any formal or informal enforcement action involving the association or holding company.

 

Compliance with regulatory standards regarding capital distributions could also limit the amount of dividends that TrustCo may pay to its shareholders.

 

 

Regulatory Capital Requirements and Prompt Corrective Action.

 

Regulatory Capital Rules. The Company and the Bank are subject to regulatory capital requirements contained in rules published by the Federal Reserve Board, OCC, and FDIC that establish a comprehensive capital framework for all U.S. banking organizations, including the Company and the Bank.

 

The capital rules, among other things, provide a “Common Equity Tier 1” (“CET1”) capital measure, Tier 1 capital and total capital to risk-weighted assets ratios and a Tier 1 capital to average consolidated assets (or “leverage”) ratio. CET1 capital is generally defined as common stock instruments that meet eligibility criteria in the final capital rule (principally, instruments representing the most subordinated claim upon liquidation, having no maturity date and being redeemable via discretionary purchases only with regulatory approval, not being subject to any expectations that the stock will be repurchased, redeemed, or cancelled, and not being secured by the banking organization or any related entity), retained earnings, accumulated other comprehensive income, and common equity Tier 1 minority interests, subject to certain limitations. Tier 1 capital for the Company and the Bank consists of CET1 capital plus “additional Tier 1 capital,” which generally includes certain noncumulative perpetual preferred stock and related surplus and minority interests in equity accounts of consolidated subsidiaries. Total capital includes Tier 1 capital and Tier 2 capital. Tier 2 capital is comprised of capital instruments and related surplus meeting specified requirements, and may include cumulative preferred stock and long-term perpetual preferred stock, mandatory convertible securities, intermediate preferred stock, and subordinated debt. Also included in Tier 2 capital is the allowance for loan and lease losses limited to a maximum of 1.25% of risk-weighted assets and, for institutions that have exercised an opt-out election regarding the treatment of accumulated other comprehensive income (“AOCI”), up to 45% of net unrealized gains on available-for-sale equity securities with readily determinable fair market values. Institutions that have not exercised the AOCI opt-out have AOCI incorporated into common equity Tier 1 capital (including unrealized gains and losses on available-for-sale-securities). The Company has made this opt-out election. Calculation of all types of regulatory capital is subject to deductions and adjustments specified in the regulations.

 

Under the capital rules, the minimum capital ratios are:

 

 

 

•

8.0% Total capital to risk-weighted assets; and

•

4.0% Tier 1 capital to average consolidated assets as reported on consolidated financial statements (the “leverage ratio”).

 

At December 31, 2025, the Bank had a Tier 1 leverage ratio (Tier 1 capital to total average consolidated assets) of 8.06%, CET1 capital ratio (CET1 capital to risk-weighted assets) of a 13.98%, Tier 1 capital ratio (Tier 1 capital to risk-weighted assets) of 13.98%, and a total capital ratio (total capital to risk-weighted assets) of 15.23%.  Also at December 31, 2025, the Company had a Tier 1 leverage ratio (Tier 1 capital to total average consolidated assets) of 10.62%, CET1 capital ratio (CET1 capital to risk-weighted assets) of 18.54%, a Tier 1 capital ratio (Tier 1 capital to risk-weighted assets) of 18.540% and a total capital ratio (total capital to risk-weighted assets) of 19.80%.

 

In order to avoid constraints on dividends, equity repurchases and certain compensation, the capital rules require the Company’s and the Bank’s capital to exceed the regulatory standards plus a capital conservation buffer. To meet the requirement, the organization must maintain an amount of CET1 capital that exceeds the buffer level of 2.5% above each of the minimum risk-weighted asset ratios, (i) CET1 to risk-weighted assets of more than 7.0%, (ii) Tier 1 capital to risk-weighted assets of more than 8.5%, and (iii) total capital (Tier 1 plus Tier 2) to risk-weighted assets of more than 10.5%.

 

The OCC has the ability to establish an individual minimum capital requirement for a particular institution, which would vary from the capital levels that would otherwise be required under the capital regulations, based on such factors as concentrations of credit risk, levels of interest rate risk, and the risks of non-traditional activities, as well as others. The OCC has not imposed any such requirement on the Bank.

 

The capital rules contain standards for the calculation of risk-weighted assets.  The exposure amount for on-balance sheet assets is generally the carrying value of the exposure as determined under GAAP.  A bank may assign a 50% risk weight to a first-lien residential mortgage exposure that:

 

•

is secured by property that is owner-occupied or rented,

 

•

is made in accordance with “prudent underwriting standards,” including loan-to-value ratios,

 

•

is not 90 days or more past due or in nonaccrual status, and

 

•

is not restructured or modified.

 

Other first-lien residential exposures, as well as junior-lien exposures if the bank does not hold the first lien, are assigned a 100% risk weight.

 

If a banking organization has elected to opt out of the AOCI provisions discussed above, the exposure amount for available for sale or held-to-maturity debt securities is the carrying value (including accrued but unpaid interest and fees) of the exposure, less any net unrealized gains plus any unrealized losses. Exposures to debt directly and unconditionally guaranteed by the U.S. federal government and its agencies receive a 0% risk weight. Exposures conditionally guaranteed by the federal government, Federal Reserve Board, or a federal government agency would receive a 20% risk weight. Further, the capital rules assign a 20% risk weight to non-equity exposures to government-sponsored entities (“GSEs”) and a 100% risk weight to preferred stock issued by a GSE. A GSE is defined as an entity established or chartered by the federal government to serve public purposes but whose debt obligations are not “explicitly guaranteed” by the full faith and credit of the federal government. Banking organizations must assign a 20% risk weight to general obligations of a public sector entity (for example, a state, local authority or other governmental subdivision below the sovereign level) that is organized under U.S. law and a 50% risk weight for a revenue obligation of such an entity.

 

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms, referred to as “Basel III Endgame” or “Basel IV”. Among other things, these standards revise the Basel Committee’s standardized approach for credit risk (including recalibrating risk weights and introducing new capital requirements for certain “unconditionally cancellable commitments,” such as unused credit card and home equity lines of credit) and provide a new standardized approach for operational risk capital. Although the Basel III Endgame framework contemplated implementation beginning January 1, 2023, with an aggregate output floor phasing in through January 1, 2028, implementation is jurisdiction-specific. In July 2023, the U.S. federal banking agencies proposed to revise the capital requirements, and the proposed rule contemplated a transition period beginning July 1, 2025 and full compliance beginning July 1, 2028; however, the rule has not yet been finalized as of the date of this filing. The proposed rule is primarily applicable to large institutions exceeding specified asset and foreign-exposure thresholds, and it consequently is not expected to apply to institutions of the Company’s size. The Company continues to monitor the rulemaking process.

 

Prompt Corrective Action. Federal banking regulations also establish a “prompt corrective action” capital framework for the classification of insured depository institutions, such as Trustco Bank, into five categories: well capitalized, adequately capitalized, undercapitalized, significantly undercapitalized, and critically undercapitalized. Under the prompt corrective action rules currently in effect, an institution is deemed to be (a) ”well-capitalized” if it has total risk-based capital of 10.0% or more, has a Tier 1 risk-based capital ratio of 8.0% or more, has a CET1 risk based capital ratio of 6.5% or more, and has leverage capital ratio of 5.0% or more and is not subject to any order or final capital directive to meet and maintain a specific capital level for any capital measure; (b) ”adequately capitalized” if it has a total risk-based capital ratio of 8.0% or more, a Tier 1 risk-based capital ratio of 6.0% or more, a CET1 risk based capital ratio of 4.5% or more and has a leverage capital ratio of 4.0% or more (3.0% under certain circumstances) and does not meet the definition of well-capitalized; (c) ”undercapitalized” if it has a total risk-based capital ratio that is less than 8.0%, a Tier 1 risk-based capital ratio that is less than 6.0%, a CET1 capital ratio less than 4.5% or a Tier 1 leverage capital ratio that is less than 4.0%; (d) ”significantly undercapitalized” if it has a total risk-based capital ratio that is less than 6.0%, a Tier 1 risk-based capital ratio that is less than 4.0%, a CET1 capital ratio less than 3% or a Tier 1 leverage capital ratio that is less than 3.0%; and (e) ”critically undercapitalized” if it has a ratio of tangible equity to total assets that is equal to or less than 2.0%. The federal banking agencies are required to take certain supervisory actions (and may take additional discretionary actions) with respect to an undercapitalized institution or its holding company. Such actions could have a direct material effect on an institution’s or its holding company’s financial condition and activities. In certain situations, a federal banking agency may reclassify a well-capitalized institution as adequately capitalized and may require an adequately capitalized or undercapitalized institution to comply with supervisory actions as if the institution were in the next lower category.

 

A depository institution is generally prohibited from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the depository institution would thereafter be undercapitalized. Undercapitalized institutions also are subject to growth limitations and are required to submit a capital restoration plan to the regulatory agencies. The agencies may not accept such a plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the depository institution’s capital. In addition, for a capital restoration plan to be acceptable, the depository institution’s parent holding company must guarantee that the institution will comply with such capital restoration plan. The aggregate liability of the parent holding company is limited to the lesser of (i) an amount equal to 5.0% of the depository institution’s total assets at the time it became undercapitalized and (ii) the amount which is necessary (or would have been necessary) to bring the institution into compliance with all capital standards applicable with respect to such institution as of the time it fails to comply with the plan. If a depository institution fails to submit an acceptable plan, it is treated as if it is “significantly undercapitalized.”

 

“Significantly undercapitalized” depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become “adequately capitalized,” requirements to reduce total assets, and cessation of receipt of deposits from correspondent banks. “Critically undercapitalized” institutions are subject to the appointment of a receiver or conservator.

 

At December 31, 2025 and 2024, each of TrustCo and Trustco Bank met all capital adequacy requirements to which it was subject under the OCC and Federal Reserve Board regulations.  As of December 31, 2025, the bank meets the requirements of a well-capitalized depository institution under the OCC’s framework for prompt corrective action.

 

Regulation Relating to Community Banks. During 2025, the OCC announced a number of initiatives intended to tailor regulatory and supervisory expectations for community banks, including the release of a notice of proposed rulemaking to expand the definition of community banks to include institutions with less than $30 billion in total assets. These initiatives are focused on reducing the regulatory burden on smaller, lower risk national banks and include refinements to examination processes, supervisory practices, and certain data collection requirements. The OCC has indicated that these changes are designed to improve examination efficiency, enhance supervisory clarity, and focus regulatory attention on areas of heightened or material risk. While these initiatives may reduce certain compliance and operational burdens, TrustCo remains subject to comprehensive prudential regulation and supervisory oversight, and changes in regulatory priorities or expectations could continue to affect TrustCo’s operations, compliance costs, and strategic planning.

 

Economic Growth, Regulatory Relief and Consumer Protection Act. In May 2018, the Economic Growth, Regulatory Relief and Consumer Protection Act (the “Regulatory Relief Act”), was enacted to modify or remove certain financial reform rules and regulations.  The Regulatory Relief Act amends certain aspects of the regulatory framework for small depository institutions with assets of less than $10 billion and for large banks with assets of more than $50 billion. Many of these changes resulted in meaningful regulatory changes for community banks such as the Bank, and their holding companies.

 

The Regulatory Relief Act also expanded the definition of qualified mortgages that may be held by a financial institution and simplified the regulatory capital rules for financial institutions and their holding companies with total consolidated assets of less than $10 billion by instructing the federal banking regulators to establish a single “Community Bank Leverage Ratio” (“CBLR”) of 9%. In November 2025, the federal banking agencies published a rule proposal which would reduce the 9% requirement for the framework to 8%. Furthermore, the federal banking agencies proposed to extend the grace period for a bank that elects to use the CBLR framework but temporarily fails to meet all of the qualifying criteria, including the leverage ratio requirement, to provide that (i) the bank will have four quarters to return to compliance, provided the community bank maintains a leverage ratio greater than 7 percent and (ii) if the bank that has a leverage ratio equal to or less than the grace period minimum of 7 percent, it would be required to comply with the generally applicable risk-based capital standards.

Any qualifying depository institution or its holding company that exceeds the CBLR will be considered to have met generally applicable leverage and risk-based regulatory capital requirements and any qualifying depository institution that exceeds the ratio will be considered to be “well capitalized” under the prompt corrective action rules. In addition, the Regulatory Relief Act included regulatory relief for community banks regarding regulatory examination cycles, call reports, the Volcker Rule (proprietary trading prohibitions), mortgage disclosures and risk weights for certain high-risk commercial real estate loans. Many of the Regulatory Relief Act’s changes are implemented through rules promulgated by the federal banking agencies. These rules and their enforcement are subject to the substantial regulatory discretion of the federal banking agencies. Although TrustCo would qualify to take advantage of the community bank leverage ratio framework, it has decided that it would not opt-in to the framework.

Holding Company Activities

 

The activities of savings and loan holding companies are governed, and limited, by the Home Owners’ Loan Act and the Federal Reserve Board’s regulations. In general, TrustCo’s activities are limited to those permissible for “multiple” savings and loan holding companies (that is, savings and loan holding companies owning more than one savings association subsidiary) as of March 5, 1987, activities permitted for bank holding companies as of November 12, 1999, and activities permissible for “financial holding companies” (which are described below). Activities permitted to multiple savings and loan holding companies include certain real estate investment activities, and other activities permitted to bank holding companies under the Bank Holding Company Act. Activities permissible for a financial holding company are those considered financial in nature (including securities and insurance activities) or those incidental or complementary to financial activities.

 

A savings and loan holding company is prohibited from, directly or indirectly, acquiring more than 5% of the voting stock of another financial institution or savings and loan holding company without the prior written approval of the Federal Reserve Board. In evaluating applications by holding companies to acquire savings institutions, the Federal Reserve Board considers the financial and managerial resources and future prospects of the company and institution involved, the effect of the acquisition on the risk to the deposit insurance fund, the convenience and needs of the community and competitive factors.

 

The financial impact of a holding company on its subsidiary institution is a matter that is evaluated by the Federal Reserve Board, and the Federal Reserve Board has authority to order cessation of activities or divestiture of subsidiaries deemed to pose a threat to the safety and soundness of the institution. The Federal Reserve’s long-standing “source of strength” doctrine requires that bank or thrift holding companies serve as a source of financial strength for their depository institution subsidiaries. The phrase “source of financial strength” is defined as “the ability of a company that directly or indirectly owns or controls an insured depository institution to provide financial assistance to such insured depository institution in the event of the financial distress of the insured depository institution.” The federal banking agencies are authorized to adopt regulations with respect to this requirement.

 

Securities Regulation and Corporate Governance

 

The Company’s common stock is registered with the SEC under Section 12(b) of the Exchange Act, and the Company is subject to restrictions, reporting requirements and review procedures under federal securities laws and regulations. The Company is also subject to the rules and reporting requirements of the Nasdaq Global Select Market, on which its common stock is traded.

 

The Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) significantly changed the regulation of financial institutions, such as community banks, thrifts, and small bank and thrift holding companies, and the financial services industry. Among other things, the Dodd-Frank Act abolished the Office of Thrift Supervision and transferred its functions to the other federal banking agencies, relaxed rules regarding interstate branching, allowed financial institutions to pay interest on business checking accounts, and imposed new capital requirements on bank and thrift holding companies. The Sarbanes-Oxley Act of 2002 is intended to improve corporate responsibility, to provide for enhanced penalties for accounting and auditing improprieties at publicly traded companies and to protect investors by improving the accuracy and reliability of corporate disclosures pursuant to the securities laws. The Company has policies, procedures and systems designed to comply with these regulations, and it reviews and documents such policies, procedures and systems to ensure continued compliance with these regulations.

 

Although the Company has incurred, and expects to continue to incur, additional expense in complying with the corporate governance provisions of federal law and the resulting regulations, management does not expect such compliance to have a material impact on the Company’s financial condition or results of operations.

Federal Savings Institution Regulation

 

Business Activities. Federal law and regulations govern the activities of federal savings banks such as the Bank. These laws and regulations delineate the nature and extent of the activities in which federal savings banks may engage. In particular, certain lending authority for federal savings banks, e.g., commercial, non-residential real property loans and consumer loans, is limited to a specified percentage of the institution’s capital or assets.

 

Insurance of Deposit Accounts. Deposits of Trustco Bank are insured by the Deposit Insurance Fund (“DIF”) of the FDIC, and the Bank is subject to deposit insurance assessments to maintain the DIF. The FDIC determines insurance premiums based on a number of factors, primarily the risk of loss that insured institutions pose to the DIF. Deposit insurance assessments are based on average consolidated total assets minus average tangible equity. Under the FDIC’s risk-based assessment system, insured institutions with less than $10 billion in assets, such as the Bank, are assigned to one of three categories based on their composite examination ratings, with higher-rated, less risky institutions paying lower assessments. A range of initial base assessment rates applies to each category, adjusted downward based on unsecured debt issued by the institution to produce total base assessment rates. Total base assessment rates currently range from 2.5 to 18 basis points for banks in the least risky category to 13 to 32 basis points for banks in the most risky category, all subject to further adjustment upward if the institution holds more than a limited amount of unsecured debt issued by another FDIC-insured institution.

 

The FDIC has the authority to raise or lower assessment rates, subject to limits, and to impose special additional assessments. The Dodd-Frank Act set the minimum reserve ratio to not less than 1.35% of estimated insured deposits or the comparable percentage of the FDIC’s assessment base. The act also required the FDIC to take the steps necessary to attain the 1.35 percent ratio by September 30, 2020, subject to an offsetting requirement for certain institutions. In September 2020, the FDIC announced that the ratio declined to 1.30% due largely

to consequences of the COVID-19 pandemic and adopted a plan to restore the fund to the 1.35% ratio (the “Restoration Plan”) within eight years but did not change its assessment rate schedule.  The Restoration Plan requires the FDIC to update its analysis and projections for the fund balance and reserve ratio at least semiannually and, if necessary, recommend any modifications, such as increasing assessment rates. In the semiannual update for the Restoration Plan in June 2022, the FDIC projected that the reserve ratio was at risk of not reaching the statutory minimum of 1.35 percent by September 30, 2028, the statutory deadline to restore the reserve ratio. Based on this update, the FDIC Board approved an amended Restoration Plan, and concurrently proposed an increase in initial base deposit insurance assessment rate schedules uniformly by 2 basis points, applicable to all insured depository institutions. In October 2022, the FDIC Board finalized the increase with an effective date of January 1, 2023, applicable to the first quarterly assessment period of 2023 (i.e., January 1 through March 31, 2023).  The FDIC continues to publish periodic updates regarding the DIF balance and reserve ratio, which were $153.9 billion and 1.42%, respectively, as of December 31, 2025, and it may consider additional actions to support the DIF and meet applicable statutory requirements.

Various proposals are under active consideration by policymakers that could affect the scope of deposit insurance coverage. For example, bipartisan legislation has been introduced in the U.S. Senate that would significantly raise the deposit insurance limit for certain noninterest-bearing transaction accounts, subject to legislative approval and funding determinations. In addition, Congress and the FDIC have conducted oversight hearings and agency analyses exploring broader deposit insurance reform alternatives, including adjusting coverage limits and targeted insurance frameworks for specific account types. The ultimate outcome, timing, and scope of any changes remain uncertain and could materially affect deposit flows, competitive dynamics, and regulatory costs.

FDIC deposit insurance expense totaled $2.9 million in 2025, $2.6 million in 2024 and $2.9 million in 2023. Future changes in insurance premiums could have an adverse effect on the operating expenses and results of operations of Trustco Bank, and the Bank cannot predict what insurance assessment rates will be in the future.

 

Insurance of deposits may be terminated by the FDIC upon a finding that the institution has engaged in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC or the OCC. The Bank does not know of any practice, condition or violation that might lead to termination of its deposit insurance.

Other Regulation

 

Assessments. The Bank is required to pay assessments to the OCC to fund the agency’s operations. The general assessments, paid on a semi-annual basis, is computed upon the Bank’s total assets, including consolidated subsidiaries, as reported in the Bank’s latest quarterly financial report. The OCC’s assessment schedule includes a surcharge for institutions that require increased supervisory resources. The assessments paid by the Bank for the year ended December 31, 2025 totaled approximately $576 thousand.

 

Community Reinvestment Act. The Community Reinvestment Act (“CRA”) requires each savings institution, as well as commercial banks and certain other lenders, to identify the communities served by the institution’s offices and to identify the types of credit the institution is prepared to extend within those communities. The CRA also requires the OCC to assess an institution’s performance in meeting the credit needs of its identified communities as part of its examination of the institution, and to take such assessments into consideration in reviewing applications with respect to branches, mergers and other business combinations, including acquisitions by savings and loan holding companies. An unsatisfactory CRA rating may be the basis for denying such an application and community groups have successfully protested applications on CRA grounds. In connection with its assessment of CRA performance, the OCC assigns CRA ratings of “outstanding,” “satisfactory,” “needs to improve” or “substantial noncompliance.” The Bank was rated “satisfactory” in its last CRA examination. Institutions are evaluated based on (i) its record of helping to meet the credit needs of its assessment area through lending activities; (ii) its qualified investments; and (iii) the availability and effectiveness of the institution’s system for delivering retail banking services. An institution that is found to be deficient in its performance in meeting its community’s credit needs may be subject to enforcement actions, including cease and desist orders and civil money penalties. In December 2021, the OCC issued a final rule rescinding its June 2020 Community Reinvestment Act Rule and replacing it with the rules that were jointly adopted by the federal bank regulatory agencies, which became effective on January 1, 2022. On October 24, 2023, the OCC, FRB, and FDIC issued a final rule to modernize their respective CRA regulations, which would have substantially altered the methodology for assessing compliance with the CRA. The rule introduced metrics-based benchmarking, expanded evaluation of lending outside traditional branch-based assessment areas (such as online and mobile banking), and clarified eligible CRA activities, with major provisions originally scheduled to take effect January 1, 2026 and revised data reporting requirements January 1, 2027. However, implementation was enjoined by a federal court in March 2024, and the agencies have since proposed rescinding the 2023 rule and reverting to the prior CRA framework (from 1995, as updated in 2021). As of now, banks continue to be examined under the existing 1995/2021 regulations, and the 2023 modernization rule is unlikely to be reinstated in its original form.

Commercial Real Estate Lending Concentrations. The federal banking agencies have issued guidance on sound risk management practices for concentrations in commercial real estate lending. The particular focus is on exposure to commercial real estate loans that are dependent on the cash flow from the real estate held as collateral and that are likely to be sensitive to conditions in the commercial real estate market (as opposed to real estate collateral held as a secondary source of repayment or as an abundance of caution). The purpose of the guidance is not to limit a bank’s commercial real estate lending but to guide banks in developing risk management practices and capital levels commensurate with the level and nature of real estate concentrations. The guidance directs the FDIC and other federal bank regulatory agencies to focus their supervisory resources on institutions that may have significant commercial real estate loan concentration risk. A bank that has experienced rapid growth in commercial real estate lending, has notable exposure to a specific type of commercial real estate loan, or is approaching or exceeding the following supervisory criteria may be identified for further supervisory analysis with respect to real estate concentration risk:

In addition, on June 29, 2023, in response to the increased risk relating to commercial real estate loans, the federal banking agencies issued a final Interagency Policy Statement on prudent Commercial Real Estate Loan Accommodations and Workouts. The policy statement updated, expanded on and superseded existing guidance from 2009. Most notably, it (i) added a discussion of short-term loan accommodations, (ii) expanded guidance regarding the evaluation and assessment of guarantors to also encompass loan sponsors, (iii) incorporated information about changes to accounting principles since 2009, and (iv) updated and expanded the illustrative examples of commercial real estate loan workouts. Furthermore, on December 18, 2023, the FDIC issued an advisory on Managing Commercial Real Estate Concentrations in a Challenging Economic Environment, which conveyed certain key risk management practices for FDIC-supervised institutions to consider in managing commercial real estate loan concentrations in a challenging economic environment.

Although the Bank has a material amount of commercial real estate loans, it remains significantly below these thresholds.  The guidance provides that the strength of an institution’s lending and risk management practices with respect to such concentrations will be taken into account in supervisory guidance on evaluation of capital adequacy.

Qualified Thrift Lender Test. As a savings institution regulated by the OCC, the Bank must be a “qualified thrift lender” under either the qualified thrift lender test under the Home Owners’ Loan Act or satisfy the Internal Revenue Code’s domestic building and loan association test to avoid certain restrictions on its and the Company’s operations and activities. Under the qualified thrift lender test, an institution is generally required to maintain at least 65% of its portfolio assets (total assets less: (i) specified liquid assets up to 20% of total assets; (ii) intangible assets, including goodwill; and (iii) the value of property used to conduct business) in certain qualified thrift investments (primarily residential mortgages and related investments, including certain mortgage-backed and related securities) in at least nine months out of each 12 month period. A federal savings bank that fails the qualified thrift lender test must operate under specified restrictions. Federal law also makes noncompliance with the qualified thrift lender test subject to agency enforcement action for a violation of law.  The Bank is currently, and expects to remain, in compliance with the qualified thrift lender test.

Transactions with Affiliates and Other Related Parties. The Bank’s transactions with “affiliates” (generally, any company that controls, is controlled by, or is under common control with the Bank, including TrustCo) are limited by Sections 23A and 23B of the Federal Reserve Act and the Federal Reserve Board’s implementing Regulation W. Under these laws, the aggregate amount of “covered transactions” between the Bank and any one affiliate is limited to 10% of the Bank’s capital stock and surplus, and the aggregate amount of covered transactions by the Bank with all of its affiliates is limited to 20% of capital stock and surplus. Certain covered transactions (primarily credit-related transactions) are required to be secured by collateral in an amount and of a type described in Section 23A and Regulation W. Transactions by the Bank with its affiliates must be on terms and under circumstances that are at least as favorable to the Bank as those prevailing at the time for comparable transactions with non-affiliates. In addition, savings institutions are prohibited from lending to any affiliate that is engaged in activities that are not permissible for bank holding companies, and no savings institution may purchase the securities of any affiliate other than a subsidiary.

The definition of “covered transactions” as used in Section 23A includes credit exposure on derivatives transactions and securities lending and borrowing transactions, as well as the acceptance of affiliate-issued debt obligations as collateral for a loan or an extension of credit.

The Bank also is restricted in its ability to extend credit to its directors, executive officers and 10% shareholders, as well as to entities controlled by such persons. Extensions of credit to those insiders must be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with unaffiliated persons; may not involve more than the normal risk of repayment or present other unfavorable features and may not exceed certain limitations on the amount of credit extended to such persons, individually and in the aggregate. In addition, extensions of credit in excess of certain limits must be approved by the Bank’s board of directors.

 

Certain non-credit transactions between an insured depository institution and its insiders, such as asset purchase and sales, are prohibited unless the transaction is on market terms and, if the transaction represents more than 10% of the capital stock and surplus of the institution, has been approved in advance by a majority of the disinterested members of the board of directors of the institution.

 

Safety and Soundness Regulations. The federal banking agencies (including the OCC) have adopted certain safety and soundness standards for all insured depository institutions. These standards relate to, among other things, internal controls, information systems and internal audit systems; loan documentation; credit underwriting; interest rate risk exposure; asset growth; asset quality; earnings and compensation, fees, and benefits, as well as other operational and managerial standards as the agency deems appropriate. The Interagency Guidelines Establishing Standards for Safety and Soundness set forth the safety and soundness standards that the federal banking agencies use to identify and address problems at insured depository institutions before capital becomes impaired. If the appropriate federal banking agency (the OCC in the case of the Bank) determines that an institution fails to meet any standard prescribed by the guidelines, the agency may require the institution to submit to the agency an acceptable plan to achieve compliance with the standard.  The Bank is subject to periodic examinations by the OCC regarding these and related matters. During these examinations, the examiners may require the Bank to increase its allowance for credit losses on loans, change the classification of loans, and/or recognize additional charge-offs based on their judgments, which can impact our capital and earnings.

 

Moreover, in October 2025, the FDIC and the OCC issued a joint proposed rule that would define the phrase “unsafe or unsound practice” for purposes of section 8 of the Federal Deposit Insurance Act.  The proposed rule would establish uniform standards for matters requiring attention and non-binding supervisory observations as part of the examination process.  In his February 26, 2026, testimony to the Senate Committee on Banking, Housing, and Urban Affairs, FDIC chairman Travis Hill emphasized that the agency’s goal in defining the phrase “unsafe or unsound practices” in a rule is “to ensure that supervisory criticisms are focused on the issues most relevant to a bank’s safety and soundness.”  The proposed rule’s comment period closed on December 29, 2025.

Enforcement. The Federal Reserve Board and the OCC have extensive enforcement authority over savings institutions and their holding companies, including the Bank and TrustCo. This includes enforcement authority with respect to the actions of the Bank’s and TrustCo’s directors, officers and other “institution-affiliated parties,” including attorneys and auditors. This enforcement authority also includes, among other things, the ability to assess civil money penalties, issue cease-and-desist or removal orders and initiate injunctive actions. In general, these enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices. Public disclosure of final enforcement actions by the OCC and the Federal Reserve is required.

 

Executive Order on Fair Banking. An Executive Order issued in August 2025 prohibits denial of financial services based on constitutionally or statutorily protected beliefs, affiliations, or political views, and prohibits politicized or unlawful “debanking.” Banking decisions must be based on individualized, objective, and risk-based analysis.

Institutions in Troubled Condition. Certain events, including entering into a formal written agreement with a bank’s regulator or being informed by the regulator that the bank is in troubled condition, will require that a bank give prior notice to their primary regulator before adding or replacing any member of the board of directors, employing any person as a senior executive officer, or changing the responsibilities of any senior executive officer so that the person would assume a different senior executive position. Troubled condition banks are prohibited from making, or agreeing to make, certain “golden parachute payments” to institution-affiliated parties, subject to certain exceptions.

Consumer Laws and Regulations. In addition to the other laws and regulations discussed above, the Bank is subject to consumer laws and regulations designed to protect consumers in transactions with financial institutions. These laws and regulations include, among others, the Truth in Lending Act, the Truth in Savings Act, the Electronic Funds Transfer Act, the Expedited Funds Availability Act, the Equal Credit Opportunity Act, the Fair Housing Act, the Fair Credit Reporting Act and the Real Estate Settlement Procedures Act. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must deal with customers when taking deposits from, making loans to, or engaging in other types of transactions with, such customers.

 

The federal Consumer Financial Protection Bureau (“CFPB”) has adopted rules related to mortgage loan origination and mortgage loan servicing. In particular, the CFPB has issued a rule implementing the ability-to-repay and qualified mortgage (“QM”) provisions of the Truth in Lending Act, as amended by the Dodd-Frank Act (the “QM Rule”). The ability-to-repay provision requires creditors to make reasonable, good faith determinations that borrowers are able to repay their mortgages before extending the credit based on a number of factors and consideration of financial information about the borrower from reasonably reliable third-party documents. Under the Dodd-Frank Act and the QM Rule, loans meeting the definition of “qualified mortgage” are entitled to a presumption that the lender satisfied the ability-to-repay requirements. The presumption is a conclusive presumption/safe harbor for prime loans meeting the QM requirements, and a rebuttable presumption for higher-priced/subprime loans meeting the QM requirements.

 

Unclaimed Property Laws. Unclaimed property (escheatment) laws vary by state but generally require holders of customer property (including money) to turn over such property to the applicable state after holding the property for the statutorily prescribed period of time. These laws are not uniform and impose varying requirements on entities, like the Bank, which may hold funds that are required to be escheated to the applicable states.

 

Volcker Rule. The Dodd-Frank Act required the federal financial regulatory agencies to adopt rules that prohibit certain banks and their affiliates from engaging in proprietary trading and investing in certain covered funds. The statutory provision is commonly called the “Volcker Rule,” and is not applicable to depository institutions and their holding companies whose total assets do not exceed $10 billion.  As of December 31, 2025, the Company’s total assets on a consolidated basis did not exceed $10 billion.

Office of Foreign Assets and Control Regulation. The U.S. Treasury Department’s Office of Foreign Assets Control, or OFAC, administers and enforces economic and trade sanctions against targeted foreign countries and regimes, under authority of various laws, including designated foreign countries, nationals and others. OFAC publishes lists of specially designated targets and countries. The Company is responsible for, among other things, blocking accounts of, and transactions with, such targets and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence. Failure to comply with these sanctions could have serious legal and reputational consequences, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required.

 

Bank Secrecy Act/Anti-Money Laundering and Customer Identification. Anti-money laundering (“AML”) and financial transparency laws and regulations, including the Bank Secrecy Act, impose strict standards for gathering and verifying customer information in order to ensure funds or other assets are not being placed in U.S. financial institutions to facilitate terrorist financing and laundering of funds. Applicable laws require financial institutions to have AML programs in place and require the federal banking agencies to consider a holding company’s effectiveness in combating money laundering when ruling on certain merger or acquisition applications. In addition, failure to comply with these requirements could lead to significant fines and penalties or the imposition of corrective orders. In July 2024, the federal banking agencies, including the FRB and OCC, proposed amendments to update the requirements for supervised institutions to establish, implement and maintain effective, risk-based and reasonably designed AML and countering the financing of terrorism (“CFT”) programs. The proposed amendments would require supervised institutions to identify, evaluate and document the regulated institution’s money laundering, terrorist financing and other illicit finance activity risks, as well as consider, as appropriate, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network’s (“FinCEN”) published national AML/CFT priorities.  The Company continues to monitor the rulemaking process.

Guidance for Third-Party Relationships. On June 9, 2023, the OCC, Federal Reserve, and FDIC issued final interagency guidance on risk management of third-party relationships, including third-party lending relationships. The interagency guidance is based, in part, on the OCC’s previously existing third-party risk management guidance from 2013 and seeks to, among other things, promote consistency in third-party risk management and provide sound risk management guidance for third-party relationships commensurate with a bank’s risk profile and complexity as well as the criticality of the activity. The final interagency guidance replaces each agency’s existing guidance on this topic (including the OCC’s 2020 Frequently Asked Questions on Third-Party Relationships) and is directed to all banking organizations supervised by the OCC, Federal Reserve, and FDIC. Additionally, third party relationship risk management and banking as a service arrangements (including with respect to deposit products and services) have been topics of focus for federal bank regulators in recent years and further rulemaking activity or guidance may be forthcoming.

Consumer Privacy and Cybersecurity. Federal regulations generally require that the Company disclose its privacy policy and practices concerning its sharing of “non-public personal information,” to individual customers at the time of establishing the customer relationship and, in certain circumstances, annually thereafter. In addition, the Company is required to provide its customers with the ability to “opt-out” of having their personal information shared with unaffiliated third parties in certain circumstances.

 

A growing number of state privacy laws impose requirements and restrictions on the processing of personal information. These laws require substantial disclosures to consumers about personal information collection, use and sharing practices, while also allowing consumers the right to access, delete, correct, or move their data.

In addition, federal banking agencies, through the Federal Financial Institutions Examination Council, have adopted guidelines to encourage financial institutions to address cybersecurity risks and identify, assess and mitigate these risks, both internally and at critical third-party service providers. For example, federal banking regulators have highlighted that financial institutions should establish several lines of defense and design their risk management processes to address the risk posed by compromised customer credentials. Further, financial institutions are expected to maintain sufficient business continuity planning processes designed to facilitate a recovery, resumption and maintenance of the institution’s operations after a cyber-attack.

 

In November 2021, the federal banking agencies adopted rules requiring banking organizations to notify their primary regulator within 36 hours of becoming aware of a “computer-security incident” that rises to the level of a “notification incident.” A notification incident is a “computer-security incident” that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. Bank service providers are also required to notify any affected bank to or on behalf of which the service provider provides services “as soon as possible” after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for four or more hours.

Further, on July 26, 2023, the SEC adopted final rules that require public companies to promptly disclose material cybersecurity incidents on Form 8-K and detailed information regarding their cybersecurity risk management and governance on an annual basis on Form 10-K. Companies are required to report on Form 8-K any cybersecurity incident they determine to be material within four business days of making that determination.  In addition to incident reporting, the rules require companies to describe their cybersecurity processes and governance on an annual basis.

Personal Data Financial Rights. On October 22, 2024, the CFPB issued a final rule to implement Section 1033 of the Dodd-Frank Act, which gives individuals the right to obtain data regarding consumer financial products and services they have obtained. The final rule requires certain entities, including TrustCo and Trustco Bank, to comply with an established framework to govern consumer access to electronic financial data. Following the issuance of this rule, two trade associations and a national bank headquartered in Kentucky filed a lawsuit challenging the rule in the United States District Court for the Eastern District of Kentucky. In this lawsuit, the plaintiffs alleged that the CFPB exceeded its statutory authority in adopting the rule. In February 2025, the court granted a joint motion to temporarily stay the litigation proceedings and tolled the compliance deadlines under Section 1033 of the Dodd-Frank Act by 30 days. Following the change in administration in 2025, the CFPB declined to defend the rule and opened a new rulemaking to revisit the rule. In October 2025, the court enjoined enforcement of the rule until the CFPB completes the rulemaking process. TrustCo continues to monitor developments relating to the rulemaking process and the litigation.

Federal Home Loan Bank of New York. The Bank is a member of Federal Home Loan Bank (“FHLB”) of New York, which is one of 11 regional FHLBs that serve as reserve or central banks for their members. The FHLBs are funded primarily from proceeds derived from the sale of consolidated obligations of the FHLB system and makes loans or advances to members. The FHLBs also provide access to a line of credit and letters of credit in accordance with policies and procedures established by the Board of Directors of FHLB. The loans, lines of credit and letters of credit are subject to the oversight of the Federal Housing Finance Agency. At December 31, 2024, the Bank had no FHLB advances and an available borrowing capacity with the FHLB which approximates the balance of securities and/or loans pledged against such borrowings.  The Bank is also required to purchase and maintain stock in the FHLB of New York at or above levels specified in the FHLB of New York capital plan. As of December 31, 2025 and 2024, the Bank owned $6.6 million and $6.5 million, respectively, in FHLB of New York stock, which was in compliance with its obligations.

 

Mergers and Acquisitions. The Bank Holding Company Act of 1956, the Bank Merger Act, the Change in Bank Control Act and other federal and state statutes regulate acquisitions of interests in commercial banks. The BHC Act requires the prior approval of the FRB for the direct or indirect acquisition by a bank holding company of more than 5.0% of the voting shares of a commercial bank or its parent holding company and for a person, other than a bank holding company, to acquire 25% or more of any class of voting securities of a bank or bank holding company. Under the Bank Merger Act, the prior approval of the appropriate bank regulatory agencies is required for a member bank to merge with another bank or purchase the assets or assume the deposits of another bank. In reviewing applications seeking approval of merger and acquisition transactions, the bank regulatory authorities will consider, among other things, the competitive effect and public benefits of the transactions, the capital position of the combined organization, the risks to the stability of the U.S. banking or financial system, the applicant’s performance record under the CRA and fair housing laws and the effectiveness of the subject organizations in combating money laundering activities.

 

In recent years, federal agencies have undertaken a review of the standards by which bank and financial institution acquisitions are evaluated. Regulatory priorities have varied over time, including in connection with changes in presidential administrations and agency leadership, which has led to rapidly evolving regulatory review standards for bank merger transactions. In September 2024, the FDIC finalized changes to its Statement of Policy on Bank Merger Transactions (the “2024 Policy Statement”), which outlined the factors that the FDIC would consider when evaluating a proposed bank merger transaction; however, in May 2025, the FDIC rescinded the 2024 Policy Statement and reinstated the Statement of Policy on Bank Merger Transactions that was in effect prior to the 2024 Policy Statement. Similarly, the OCC finalized a new Policy Statement Regarding Statutory Factors Under the Bank Merger Act (the “OCC Policy Statement”) in September 2024, which updated the factors that the OCC would apply in evaluating a proposed bank merger transaction. The OCC subsequently rescinded the OCC Policy Statement in May 2025.  In September 2024, the DOJ withdrew its 1995 Bank Merger Guidelines and issued the 2024 Banking Addendum to its 2023 Merger Guidelines. The DOJ clarified that it will assess competition considerations in connection with bank and BHC mergers using its 2023 Merger Guidelines, which is the general merger review framework the DOJ now uses to evaluate transactions in all segments of the economy, and the 2024 Banking Addendum. The 2024 Banking Addendum provides guidance on how the DOJ will assess competition in the context of bank and bank holding company mergers. An analysis under the 2023 Merger Guidelines and 2024 Banking Addendum may include consideration of theories of harm and relevant markets not considered under the 1995 Bank Merger Guidelines, which focused primarily on concentrations of deposits and branches. Whether and how the guidance might be further changed or interpreted is uncertain.

•

Provide employees incentives that appropriately balance risk and reward;

•

Be compatible with effective controls and risk management; and

•

Be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

---