NYSE: TMP

Tompkins was organized in 1995, under the laws of the State of New York, as a bank holding company for Tompkins Trust Company (the "Trust Company"), a commercial bank that has operated in Ithaca, New York and surrounding communities since 1836. In January 2021, Tompkins combined its four wholly-owned banking subsidiaries into one bank, with the Bank of Castile, Mahopac Bank, and VIST Bank merging with and into the Trust Company. Immediately following the merger, the Trust Company changed its name to Tompkins Community Bank.

The Tompkins strategy centers around its core values and a commitment to delivering long-term value to our clients, communities, and shareholders. A key strategic initiative for the Company is a focus on responsible and sustainable growth, including initiatives to grow organically through our current businesses, as well as through possible acquisitions of financial institutions, branches, and financial services businesses. As such, the Company has acquired, and from time to time considers acquiring, banks, thrift institutions, branch offices of banks or thrift institutions, or other businesses that would complement the Company’s business or its geographic reach. The Company generally targets merger or acquisition partners that are culturally similar and have experienced management and possess either significant market presence or have potential for improved profitability through financial management, economies of scale and expanded services. The Company has pursued acquisition opportunities in the past, and continues to review new opportunities.

The Company also has defined strategic initiatives around digital delivery of services to meet the changing needs of client expectations, while maintaining our commitment to excellence in the delivery of personal service when self-serve options are unable to meet the needs of our clients. Our strategy includes a focus on building a scalable foundation based on a continuous improvement approach necessary for our long-term success. This foundation includes investments in automation, analytics and security to drive ongoing consistency, efficiency, and security in our operations. We also recognize the need to develop and acquire talent that is well prepared to succeed in our changing industry. Initiatives in this area include a focus on characteristics such as collaboration, innovation and agility.

Narrative Description of Business

The Company has identified two business segments, consisting of banking and wealth management. Prior to its sale of TIA on October 31, 2025, the Company also had an insurance segment.

Banking services consist primarily of attracting deposits from the areas served by the Company’s banking subsidiary and using those deposits to originate a variety of commercial loans, agricultural loans, consumer loans, real estate loans, and leases in those same market areas. The Company’s lending function is managed within the guidelines of a comprehensive Board of Directors-approved lending policy. Policies and procedures are reviewed on a regular basis. Reporting systems are in place to provide management with ongoing information related to loan production, loan quality, concentrations of credit, loan

1

Table of Contents

delinquencies and nonperforming and potential problem loans. The Company has an independent third party loan review process that samples, reviews, and validates the risk identification and assessment made by the lenders and credit personnel. The results of these reviews are presented to the Board of Directors of the Company’s banking subsidiary, and the bank's Credit Oversight Committee.

The Company’s principal expenses are interest on deposits, interest on borrowings, and operating and general administrative expenses, as well as provisions for credit loss expenses. Funding sources other than deposits, include borrowings, securities sold under agreements to repurchase, and cash flow from lending and investing activities. The Company’s principal source of revenue is interest income on loans and securities.

The Company maintains a portfolio of securities such as U.S. Treasury securities, obligations of U.S. government agencies and U.S. government sponsored entities, obligations of states and political subdivisions thereof, and equity securities. Management typically invests in securities with short to intermediate average lives in order to better match the interest rate sensitivities of its assets and liabilities. Investment decisions are made within policy guidelines established by the Company’s Board of Directors. The investment policy is based on the asset/liability management goals of the Company, and is monitored by the Company’s Asset/Liability Management Committee. The intent of the policy is to establish a portfolio of high quality diversified securities, which optimizes net interest income within safety and liquidity limits deemed acceptable by the Asset/Liability Management Committee.

Wealth management services consist of investment management, trust and estate, financial and tax planning as well as life, disability and long-term care insurance services. Wealth management services are provided under the trade name Tompkins Financial Advisors.

The Company operated its wholly-owned insurance subsidiary, TIA, from 2001 until its sale to Gallagher on October 31, 2025. TIA was a full-service insurance agency that offered services such as property and casualty insurance, employee benefit consulting, and life, long-term care and disability insurance. TIA's revenue and expenses are consolidated into the Company's financials through October 31, 2025.

Subsidiary Operations

Tompkins Community Bank

Tompkins Community Bank operates 54 branches, with 38 branches located in New York, and 16 located in Pennsylvania. Tompkins has operated in Ithaca, New York and surrounding communities since 1836. Tompkins Community Bank provides a full array of products and services, including commercial and consumer banking. Tompkins Community Bank also provides wealth management services, including investment management, trust and estate, financial and tax planning services, through the Tompkins Financial Advisors brand. As of December 31, 2025, Tompkins Community Bank had consolidated total assets of $8.7 billion, consolidated total loans of $6.4 billion, and consolidated total deposits of $7.1 billion. A description of the markets served by Tompkins Community Bank is included below:

Tompkins Central New York ("CNY")

We operate 12 branches in our CNY market, with the largest market area being Tompkins County, which has a population of approximately 104,000. Education plays a significant role in the Tompkins County economy with Cornell University and Ithaca College being two of the county’s major employers. Tompkins Community Bank has a full-service office in Cortland, New York and a full-service office in Auburn, New York. Both of these offices are located in counties contiguous to Tompkins County. Tompkins Community Bank also has two full-service branches in Fayetteville and Syracuse, New York, which are located in Onondaga County.

Tompkins Western New York ("WNY")

We operate 14 banking offices in our WNY market, in towns situated in and around the areas commonly known as the Genesee Valley region of New York State. The main business office for WNY is located in Batavia. Our WNY market is a six-county market, much of which is rural in nature, but which also includes Monroe County (population approximately 754,000), where the city of Rochester is located, and Erie County (population approximately 953,000), which includes the city of Buffalo. The population of the counties in our WNY market, excluding Monroe and Erie, is approximately 199,000.

Tompkins Hudson Valley New York ("HV")

We operate 12 banking offices in our HV market. The 12 banking offices include 4 full-service offices in Putnam County, 3 full-service offices in Dutchess County, and 5 full-service offices in Westchester County. Putnam County has a population of approximately 98,000 and is about 60 miles north of Manhattan. Dutchess County has a population of approximately 302,000, and Westchester County has a population of approximately 1.0 million.

2

Table of Contents

Tompkins Pennsylvania ("PA")

We operate 16 banking offices in Pennsylvania, including one limited-service office. The 16 banking offices include 10 offices in Berks County, 3 offices in Montgomery County, 1 office in Philadelphia County, 1 office in Delaware County and 1 office in Schuylkill County. The population of the counties served by PA is Philadelphia: 1.6 million, Montgomery: 879,000, Delaware: 589,000, Berks: 443,000 and Schuylkill: 144,000. The main office is located in Wyomissing, Pennsylvania.

Competition

Competition for commercial banking and other financial services is strong in the Company’s market areas. In one or more aspects of its business, Tompkins Community Bank competes with other commercial banks, savings and loan associations, credit unions, finance companies, internet-based financial services companies, mutual funds, brokerage and investment banking companies, and other financial intermediaries. Some of these competitors have substantially greater resources and lending capabilities and may offer services that the Company does not currently provide. The financial services industry continues to undergo rapid technological change with introductions of new technologies and services, including new ways that customers can make payments or manage their accounts, including through use of stablecoins and other forms of cryptocurrency, tokens, and other digital assets or alternative payment systems. The Company faces increasing competition from institutions not subject to the same the same extensive State and Federal regulations that govern financial holding companies and Federally-insured banks, including by financial technology companies, or ‘fintechs,’ which may offer bank-like products or services that compete directly with the Company’s products and services.

Competition among financial institutions is primarily based upon interest rates offered on deposit accounts, interest rates charged on loans and other credit and service charges, the quality and scope of the services rendered, the convenience of facilities and services, and, in the case of loans to commercial borrowers, relative lending limits. Management believes that a community-based financial organization is better positioned to establish personalized financial relationships with both commercial customers and individual households. The Company’s community commitment and involvement in its primary market areas, as well as its commitment to quality and personalized financial services, are factors that contribute to the Company’s competitiveness. Management believes that Tompkins Community Bank can compete successfully in its primary market areas by making prudent lending decisions quickly and more efficiently than its competitors, without compromising asset quality or profitability. In addition, the Company focuses on providing unparalleled customer service, which includes offering a strong suite of products and services, including products that are accessible to our customers through digital channels.

Supervision and Regulation

Regulatory Agencies

As a registered financial holding company, the Company is regulated under the Bank Holding Company Act of 1956 as amended ("BHC Act"), and is subject to examination and comprehensive regulation by the Federal Reserve Board ("FRB"). The Company is also subject to the jurisdiction of the Securities and Exchange Commission ("SEC") and is subject to disclosure and regulatory requirements under the Securities Act of 1933, as amended (the "Securities Act"), and the Securities Exchange Act of 1934, as amended (the "Exchange Act"). The Company's activities, or those of its subsidiary bank, Tompkins Community Bank, are also subject to regulation under the Federal Reserve Act, the Federal Deposit Insurance Act, the Dodd-Frank Act, the Truth-in-Lending Act (which governs disclosures of credit terms to consumer borrowers), the Truth-in-Savings Act, the Equal Credit Opportunity Act, the Fair Credit Reporting Act (which governs the manner in which consumer debts may be collected by collection agencies), the Home Mortgage Disclosure Act (which requires financial institutions to provide certain information about home mortgage and refinanced loans), the Servicemembers Civil Relief Act, Section 5 of the Federal Trade Commission Act (which prohibits unfair or deceptive acts and practices in or affecting commerce), the Real Estate Settlement Procedures Act, and the Electronic Funds Transfer Act, as well as other federal, state and local laws. The Company’s common stock is traded on the NYSE American under the Symbol "TMP" and as a result the Company is subject to the rules of the NYSE American for listed companies.

Tompkins Community Bank is a state chartered bank and a non-member of the Federal Reserve System and is subject to examination and comprehensive regulation by various regulatory authorities, including the Federal Deposit Insurance Corporation ("FDIC"), and the New York State Department of Financial Services ("NYSDFS"). Each of these agencies issues regulations and requires the filing of reports describing the activities and financial condition of the entities under its jurisdiction. Likewise, such agencies conduct examinations on a recurring basis to evaluate the safety and soundness of the institutions, and to test compliance with various regulatory requirements, including: consumer protection, privacy, fair lending, the Community Reinvestment Act, the Bank Secrecy Act, sales of non-deposit investments, electronic data processing, and trust department activities.

3

Table of Contents

Federal Home Loan Bank ("FHLB") System

The Federal Home Loan Banks (the "FHLBs") are a group of cooperatives that lending institutions use to finance housing and economic development in local communities. We are a member of the FHLB of New York ("FHLBNY"). FHLB members are required to maintain a minimum investment in capital stock of the applicable FHLB. The board of directors of the FHLBNY may increase the minimum investment requirements in the event it has concluded that additional capital is required to allow it to meet its own regulatory capital requirements. Any increase in the minimum investment requirements outside of specified ranges requires the approval of the Federal Housing Finance Agency. Because the extent of any obligation to increase our investment in the FHLBNY depends entirely upon the occurrence of a future event, the amount of any future investment in the capital stock of the FHLBNY is not determinable.

Regulatory Reform

Legislation, some of which may be extensive and comprehensive in nature, is introduced in Congress and New York's legislature from time to time. Such legislation may change applicable statutes and the operating environment in substantial and unpredictable ways. We cannot determine the ultimate effect that future legislation or implementing regulations would have upon our financial condition or upon our results of operations or the results of operations of any of our subsidiaries.

The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the "Dodd-Frank Act") by way of example, contains a comprehensive set of provisions designed to govern the practices and oversight of financial institutions and other participants in the financial markets. Although some provisions were modified by the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018, the Dodd-Frank Act made extensive changes in the regulation of financial institutions and their holding companies.

Debit-Card Interchange Fees

FRB regulations mandated by the Dodd-Frank Act limit interchange fees on debit cards to a maximum of 21 cents per transaction plus 5 basis points of the transaction amount. Issuers that, together with their affiliates, have less than $10 billion in assets, such as the Company, are exempt from the debit card interchange fee standards. However, FRB regulations prohibit all card issuers, including Tompkins Community Bank, from restricting the number of networks over which electronic debit transactions may be processed to fewer than two unaffiliated networks, or inhibiting a merchant's ability to direct the routing of the electronic debit transaction over any network that the card issuer has enabled to process them.

Volcker Rule

The Dodd-Frank Act required the federal financial regulatory agencies to adopt rules that prohibit banks and their affiliates from engaging in proprietary trading and investing in certain covered funds. The statutory provision is commonly called the "Volcker Rule," and is not applicable to depository institutions and their holding companies whose total assets do not exceed $10 billion. As of December 31, 2025, the Company's total assets on a consolidated basis were $8.7 billion.

Federal Bank Holding Company ("BHC") Regulation

We are a bank holding company subject to regulation under the BHC Act and the examination and reporting requirements of the FRB. In general, the BHC Act limits the business of bank holding companies to banking, managing or controlling banks, and other activities that the FRB has determined to be closely related to banking. In addition, we have elected to be treated as a financial holding company under the BHC Act and therefore may engage in any activity, or acquire and retain the shares of a company engaged in any activity, that is either (i) financial in nature or incidental to such financial activity (as determined by the FRB in consultation with the Secretary of the Treasury) or (ii) complementary to a financial activity and does not pose a substantial risk to the safety and soundness of depository institutions or the financial system generally (as solely determined by the FRB), without prior approval of the FRB.

If a bank holding company elects to be treated as a financial holding company, as we have, (i) the bank holding company and all of its depository institution subsidiaries must be "well-capitalized" and "well-managed," as defined in the FRB's Regulation Y and (ii) the bank holding company must file a declaration with the FRB that it elects to be a "financial holding company," which we have done. A depository institution subsidiary is considered to be "well-capitalized" if it satisfies the requirements for this status discussed in the section captioned "Capital Adequacy and Prompt Corrective Action," below. A depository institution subsidiary is considered "well-managed" if it received a composite rating and management rating of at least "satisfactory" in its most recent examination. A financial holding company’s status will also depend upon it maintaining its status as "well-capitalized" and "well-managed" under applicable FRB regulations. If a financial holding company ceases to meet these capital and management requirements, the FRB’s regulations provide that the financial holding company must enter into an agreement with the FRB to comply with all applicable capital and management requirements. Until the financial holding company returns to compliance, the FRB may impose limitations or conditions on the conduct of its activities, and the company may not commence any of the broader financial activities permissible for financial holding companies or acquire a company engaged in such financial activities without prior approval of the FRB. If the company does not return to compliance within 180 days, the

4

Table of Contents

FRB may require divestiture of the holding company’s depository institutions. Bank holding companies and banks must also be "well-capitalized" and "well-managed" in order to acquire banks located outside their home state.

In order for a financial holding company to commence any new activity permitted by the BHC Act or to acquire a company engaged in any new activity permitted by the BHC Act, each insured depository institution subsidiary of the financial holding company must have received a rating of at least "satisfactory" in its most recent examination under the Community Reinvestment Act ("CRA"). See the section captioned "Community Reinvestment Act", below.

The FRB has the power to order any bank holding company or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the FRB has reasonable grounds to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company.

Share Repurchases and Dividends

The ability of the Company to pay dividends on or to repurchase its common stock, and the ability of Tompkins Community Bank to pay dividends to the Company, may be restricted due to several factors including: (a) applicable federal and state banking codes, (b) covenants contained in our borrowing agreements (as applicable), and (c) the regulatory authority of the FRB, the FDIC, and the NYSDFS. Our ability to pay dividends to our stockholders or to repurchase shares of our common stock is also subject to restrictions set forth in the New York Business Corporation Law.

Notification to the FRB is required prior to our declaring and paying a cash dividend to our stockholders during any period in which our quarterly and/or cumulative twelve month net earnings are insufficient to fund the dividend amount, among other requirements. Under such circumstances, we may not pay a dividend should the FRB object until such time as we receive approval from the FRB or no longer need to provide notice under applicable regulations. In addition, prior approval of the FRB may be required in certain circumstances prior to our repurchasing shares of our common stock.

In connection with any decision regarding dividends and share repurchase programs, our Board will take into account general business conditions, our financial results, projected cash flows, capital requirements, contractual, legal and regulatory restrictions on the payment of dividends by Tompkins Community Bank to the Company, and such other factors as deemed relevant. We can provide no assurance that we will continue to declare dividends on a quarterly basis, or otherwise, or to repurchase shares of our common stock. The declaration of dividends by the Company is subject to the discretion of our Board.

The Company's primary source of liquidity is the receipt of cash dividends from Tompkins Community Bank. Various statutes and regulations limit the availability of cash dividends from Tompkins Community Bank and the dividends paid by Tompkins Community Bank are regulated by the NYSDFS and the FDIC under their general supervisory authority as it relates to a bank's capital requirements. Tompkins Community Bank may declare a dividend without the approval of the NYSDFS and FDIC as long as the total dividends declared in a calendar year do not exceed its net income for the current fiscal year, plus the retained net income for the prior two fiscal years.

Transactions with Affiliates and Other Related Parties

Transactions between Tompkins Community Bank and its affiliates are regulated under federal banking law. Subject to certain exceptions set forth in the Federal Reserve Act and its implementing regulations, found in FRB Regulation W, a bank may enter into "covered transactions" with its affiliates if the aggregate amount of the covered transactions with any single affiliate does not exceed 10 percent of the bank's capital stock and surplus or 20 percent of the bank's capital stock and surplus for covered transactions with all affiliates. Covered transactions include, among other things, extension of credit, the investment in securities, the purchase of assets, the acceptance of collateral or the issuance of a guaranty. The Dodd-Frank Act significantly expanded the coverage and scope of the limitations on affiliate transactions within a banking organization. Additionally, most transactions that a bank engages in with an affiliate, including where an affiliate performs a service for the bank, must be on similar terms and conditions as the bank would agree to with a non-affiliate.

Tompkins Community Bank's authority to extend credit to its directors, executive officers and 10% shareholders (collectively, "Reg O Insiders"), as well as to entities controlled by such persons, is governed by the requirements of Sections 22(g) and 22(h) of the Federal Reserve Act and Regulation O as promulgated by the FRB. Among other things, these provisions require that extensions of credit to Reg O Insiders (i) be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with persons or entities that are not Reg O Insiders (or their related parties), and that do not involve more than the normal risk of repayment or present other unfavorable features; and (ii) not exceed certain limitations on the amount of credit extended to such persons, individually and in the aggregate, which limits are based, in part, on the amount of the bank’s capital. In addition, extensions of credit in excess of certain limits must be approved by the bank’s board of directors. Additional restrictions apply to extensions of credit to

5

Table of Contents

executive officers of Tompkins Community Bank. A similar scope of restrictions on insider transactions is required by Title 3, Part 11 of NYSDFS Banking regulations.

Mergers and Acquisitions

The BHC Act, the Bank Merger Act, the Change in Bank Control Act and other federal and state statutes regulate acquisitions of interests in commercial banks. The BHC Act requires the prior approval of the FRB for the direct or indirect acquisition by a bank holding company of more than 5.0% of the voting shares of a commercial bank or its parent holding company and for a person, other than a bank holding company, to acquire 25% or more of any class of voting securities of a bank or bank holding company. Under the Bank Merger Act, the prior approval of the appropriate bank regulatory agencies is required for a member bank to merge with another bank or purchase the assets or assume the deposits of another bank. In reviewing applications seeking approval of merger and acquisition transactions, the bank regulatory authorities will consider, among other things, the competitive effect and public benefits of the transactions, the capital position of the combined organization, the risks to the stability of the U.S. banking or financial system, the applicant’s performance record under the CRA (see the section captioned "Community Reinvestment Act", below) and fair housing laws and the effectiveness of the subject organizations in combating money laundering activities.

Source of Strength Doctrine

The Dodd-Frank Act requires bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. Under this requirement, Tompkins is expected to commit resources to support Tompkins Community Bank, including at times when it may not be advantageous for Tompkins to do so. Any capital loans by a bank holding company to a subsidiary bank are subordinated in right of payment to deposits and to certain other indebtedness of such subsidiary bank. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Capital Adequacy and Prompt Corrective Action

Bank holding companies and banks are subject to various regulatory capital requirements administered by state and federal agencies. These agencies may establish higher minimum requirements if, for example, a banking organization previously has received special attention or has a high susceptibility to interest rate risk. Risk-based capital requirements determine the adequacy of capital based on the risk inherent in various classes of assets and off-balance sheet items. Under the Dodd-Frank Act, the Federal Reserve must apply consolidated capital requirements to depository institution holding companies that are no less stringent than those currently applied to depository institutions. The Dodd-Frank Act additionally requires capital requirements to be counter-cyclical so that the required amount of capital increases in times of economic expansion and decreases in times of economic contraction, consistent with safety and soundness.

Under federal regulations, bank holding companies and banks must meet certain risk-based capital requirements, commonly known as "Basel III". The Basel III capital framework, among other things, (i) includes the capital measure, "Common Equity Tier 1" ("CET1"), (ii) specifies that Tier 1 capital consists of CET1 and "Additional Tier 1 capital" instruments meeting specified requirements, (iii) defines CET1 narrowly by requiring that most adjustments to regulatory capital measures be made to CET1 and not to the other components of capital and (iv) expands the scope of the adjustments as compared to existing regulations. Financial institutions are also required to maintain a minimum "capital conservation buffer" to avoid restrictions on capital distributions such as dividends and equity repurchases and other payments such as discretionary bonuses to executive officers.

The Basel III capital rules require Tompkins to maintain minimum capital ratios, which include an additional capital conservation buffer of 2.5%, as follows: (i) a minimum ratio of CET1 to risk-weighted assets of 7.0%, (ii) a minimum ratio of Tier 1 capital to risk-weighted assets of 8.5%, (iii) a minimum ratio of Total capital (that is, Tier 1 plus Tier 2) to risk-weighted assets of 10.5%, and (iv) a minimum leverage ratio of 4.0%, calculated as the ratio of Tier 1 capital to average assets. Banking institutions that fail to meet the effective minimum ratios once the capital conservation buffer is taken into account, as detailed above, will be subject to constraints on capital distributions, including dividends and share repurchases, and certain discretionary executive compensation. The severity of the constraints depends on the amount of the shortfall and the institution’s "eligible retained income" (that is, the greater of (i) net income for the preceding four quarters, net of distributions and associated tax effects not reflected in net income and (ii) average net income over the preceding four quarters).

The Federal Deposit Insurance Act ("FDIA") requires federal banking agencies to take "prompt corrective action" ("PCA") should an insured depository institution fail to meet certain capital adequacy standards. If an insured depository institution is classified in one of the undercapitalized categories, it is required to submit a capital restoration plan to the appropriate federal banking agency and the holding company must guarantee the performance of that plan. Based upon its capital levels, a bank that is classified as well-capitalized, adequately capitalized or undercapitalized, may be treated as though it were in the next lower capital category if the appropriate federal banking agency, after notice and opportunity for hearing, determines that an

6

Table of Contents

unsafe or unsound condition or an unsafe or unsound practice, warrants such treatment. A depository institution is deemed to be “well-capitalized” if the institution has a total risk-based capital ratio of 10.0% or greater, a CET1 ratio of 6.5% or greater, a Tier 1 risk-based capital ratio of 8.0% or greater, and a leverage ratio of 5.0% or greater, and the institution is not subject to an order, written agreement, capital directive or prompt corrective action directive to meet and maintain a specific level for any capital measure.

For further information concerning the regulatory capital requirements, actual capital amounts and the ratios of Tompkins and Tompkins Community Bank, see the discussion in "Note 20 - Regulations and Supervision" in the Notes to Consolidated Financial Statements in Part II, "Item 8. Financial Statements and Supplementary Data" of this Report on Form 10-K.

Deposit Insurance

Substantially all of Tompkins Community Bank's deposits are insured up to applicable limits by the Deposit Insurance Fund ("DIF") of the FDIC and are subject to deposit insurance assessments to maintain the DIF. The maximum amount of deposit insurance is $250,000 per deposit category, per depositor, per institution.

The FDIA requires the FDIC's board of directors to manage the DIF and to designate a reserve ratio for the DIF. The Dodd-Frank Act established a minimum DIF reserve ratio of 1.35%. If the reserve ratio falls below 1.35% or is expected to within 6 months, the FDIC generally must adopt a restoration plan to restore the DIF reserve ratio to at least 1.35% within 8 years. Because the reserve ratio fell below 1.35% in 2020, the FDIC established a restoration plan to restore the reserve ratio to 1.35% by September 30, 2028. In October 2023, the FDIC amended the restoration plan to increase the initial base deposit insurance assessment rate schedules uniformly by 2 basis points, effective in the first quarterly assessment period of 2023, in order to increase the likelihood of meeting the statutory reserve ratio by the statutory deadline.

Tompkins Community Bank pays deposit insurance premiums to the FDIC based on risk-based assessment rates established by the FDIC. Deposit insurance premiums are based on assets. The FDIC calculates deposit insurance assessment rates for established small banks, generally those banks with less than $10 billion of assets that have been insured for at least five years, using the CAMELS rating system and other factors. The CAMELS rating system is a supervisory rating system designed to take into account and reflect all financial and operational risks that a bank may face, including capital adequacy, asset quality, management capability, earnings, liquidity and sensitivity to market risk. To determine a bank’s assessment rate, each of seven financial ratios and a weighted average of CAMELS component ratings are multiplied by a corresponding pricing multiplier. The sum of these products is added to a uniform amount, with the resulting sum being an institution’s initial base assessment rate (subject to minimum or maximum assessment rates based on a bank’s CAMELS composite rating). This method takes into account various measures, including an institution’s leverage ratio, brokered deposit ratio, one year asset growth, the ratio of net income before taxes to total assets, and considerations related to asset quality.

FDIC insurance expense totaled $5.8 million, $5.7 million, and $4.3 million in 2025, 2024 and 2023, respectively.

Under the FDIA, the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.

Depositor Preference

The FDIA provides that, in the event of the "liquidation or other resolution" of an insured depository institution, such as Tompkins Community Bank, the claims of depositors of the institution, including the claims of the FDIC, as subrogee of the insured depositors, and certain claims for administrative expenses of the FDIC as receiver, will have priority over other general unsecured claims against the institution. If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors, including the parent bank holding company, with respect to any extensions of credit they have made to such insured depository institutions, as well as the shareholders of the parent bank holding company, who are unlikely to recover in the event a bank holding company's sole bank subsidiary fails.

Community Reinvestment Act ("CRA")

The CRA and the regulations issued thereunder are intended to encourage banks to help meet the credit needs of their entire service area, including low- and moderate-income neighborhoods, consistent with the safe and sound operations of such banks. These regulations also provide for regulatory assessment of a bank’s record in meeting the needs of its service area when considering applications to establish branches, merger applications and applications to acquire the assets and assume the liabilities of another bank. As of December 31, 2025, the Company’s subsidiary bank had a CRA rating of satisfactory.

In 2023, the FRB, FDIC, and OCC jointly issued final rules revising their regulations implementing the CRA, but that final rule never took effect due to a preliminary injunction staying its implementation. In 2025, those agencies jointly issued a proposal to

7

Table of Contents

rescind the 2023 final rule and reinstate the prior CRA regulations that were originally adopted by the agencies in 1995, with certain technical amendments.

Federal Securities Laws

The common stock of the Company is registered with the SEC under the Exchange Act. Therefore, the Company is subject to the reporting, information disclosure, proxy solicitation and other requirements imposed on public companies by the SEC under the Exchange Act. Additionally, Company insiders are subject to securities trading limitations and are required to file insider ownership reports with the SEC. The SEC and NYSE American have adopted regulations under the Sarbanes-Oxley Act of 2002 ("Sarbanes-Oxley") and the Dodd-Frank Act that apply to the Company as an exchange-traded public company, which seek to improve corporate governance, accounting, and reporting requirements, provide enhanced penalties for financial reporting improprieties and improve the reliability of disclosures in SEC filings. For example, the Sarbanes-Oxley requirements include: (1) requirements for audit committees, including independence and financial expertise; (2) certification of financial statements by the chief executive officer and chief financial officer of reporting companies; (3) standards for auditors and regulation of audits; (4) disclosure and reporting requirements for reporting companies and their directors and executive officers; and (5) a range of civil and criminal penalties for fraud and other violations of securities laws.

Anti-Money Laundering and the USA Patriot Act

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 ("USA PATRIOT Act"), the Bank Secrecy Act of 1970 ("BSA"), the Money Laundering Control Act of 1986, and other federal laws, collectively impose obligations on all financial institutions, including the Company, to implement policies, procedures and controls which are reasonably designed to detect and report instances of money laundering and the financing of terrorism. The bank regulatory agencies have increased the regulatory scrutiny of the BSA and anti-money laundering programs maintained by financial institutions. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal and reputational consequences for the institution, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required.

The Anti-Money Laundering Act of 2020 ("AMLA"), which amends the BSA, was enacted in January 2021. The AMLA is intended to be a comprehensive reform and modernization to U.S. bank secrecy and anti-money laundering laws. Among other things, it codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the development of standards for evaluating technology and internal processes for BSA compliance; and expands enforcement- and investigation-related authority, including increasing available sanctions for certain BSA violations and instituting BSA whistleblower incentives and protections.

Financial Privacy

The Gramm-Leach-Bliley Act of 1999 ("GLBA") requires that financial institutions implement comprehensive written information security programs that include administrative, technical and physical safeguards designed to protect consumer information. Under the GLBA, federal banking regulators adopted rules that limit the ability of banks and other financial institutions to disclose non-public information about consumers to non-affiliated third parties. These limitations require disclosure of privacy policies and certain security breaches to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a non-affiliated third party. These provisions affect, among other things, how consumer information is transmitted through diversified financial companies and conveyed to outside vendors.

Office of Foreign Assets Control Regulation

The United States has imposed economic sanctions that affect transactions with designated foreign countries, designated nationals and others. These are known as the "OFAC" rules based on their administration by the U.S. Treasury Department Office of Foreign Assets Control ("OFAC"). The OFAC-administered sanctions targeting designated countries take many different forms. Generally, however, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on "U.S. persons" engaging in financial transactions relating to making investments in, or providing investment-related advice or assistance to, a sanctioned country; and (ii) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to a U.S. jurisdiction (including property in the possession or control of U.S. persons). These sanctions that are applicable to countries and individuals also are imposed against some non-governmental organizations, associations, or other criminal networks. Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal, strategic and reputational consequences, and result in civil money penalties against the Company and Tompkins Community Bank.

8

Table of Contents

Consumer Protection Laws

In connection with its lending and leasing activities, Tompkins Community Bank is subject to a number of federal and state laws designed to protect borrowers and promote lending. These consumer financial laws include the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Fair and Accurate Credit Transaction Act, Electronic Funds Transfer Act, the Expedited Funds Availability Act, the Truth in Lending Act, the Truth in Savings Act, the Home Mortgage Disclosure Act, and the Real Estate Settlement Procedures Act, and similar laws at the state level. Tompkins Community Bank's failure to comply with any of the consumer protection laws could result in civil actions, regulatory enforcement action by the federal banking agencies and the U.S. Department of Justice.

The Dodd-Frank Act established the Consumer Financial Protection Bureau ("CFPB") to supervise and enforce consumer protection laws. The CFPB has rule-making authority for a wide range of consumer protection laws that apply to all banks and savings institutions, including the authority to prohibit "unfair, deceptive or abusive" acts and practices. The CFPB has examination and enforcement authority over all banks and savings institutions with more than $10 billion in assets. Tompkins Community Bank is required to comply with the rules of the CFPB; however, these rules are generally enforced by our primary regulator, the FDIC.

Cybersecurity

The Company is subject to data security standards and privacy and data breach notice requirements as established by federal and state regulators. See Item 1C. Cybersecurity for a discussion of the Company's cybersecurity risk assessment and management processes and strategies and related governance matters, and