TRST US Equity☆

Item 1A. Risk Factors

The following are general risk factors affecting the Company. Additional risks and uncertainties not currently known to us or that we currently deem to be immaterial also may materially and

adversely affect our business operations. Any of these risks could materially and adversely affect our business, financial condition or results of operations. In such cases, you may lose all or part of your investment.

22

Index

Risks Related to Our Lending Activities

Changes in interest rates may significantly impact our financial condition and results of operations

Like other financial institutions, we are subject to interest rate risk. Our primary source of income is net interest income, which is the difference between interest earned on loans and investments, and interest paid on deposits and

borrowings. The level of net interest income is primarily a function of the average balance of our interest-earning assets, the average balance of our interest-bearing liabilities, and the spread between the

yield on such assets and the cost of such liabilities. These factors are influenced by both the pricing and mix of our interest-earning assets and our interest-bearing liabilities which, in turn, are impacted by such external factors as the

local economy, competition for loans and deposits, the monetary policy of the Federal Open Market Committee of the FRB (the “FOMC”), and market interest rates.

Over any specific period of time, our interest-earning assets may be more sensitive to changes in market interest rates than our interest-bearing liabilities, or vice-versa. In addition, the individual market interest rates underlying our

loan and deposit products may not change to the same degree over a given time period. In any event, if market interest rates should move contrary to our position, earnings may be negatively affected. After the benchmark federal funds

interest rate reached a peak range between 5.25 percent and 5.50 percent in 2023 into 2024, the FOMC reduced the federal funds rate by 50 basis points in September 2024 and by an additional 25 basis points in November 2024, to a range of 4.50

percent to 4.75 percent. While the FOMC has initiated a rate easing cycle, the range of potential rate paths over the coming year is wide and will ultimately be driven by the path of inflation, labor market performance and economic growth.

There can be no assurances as to any future FOMC conduct. If the FOMC increases the targeted federal funds rates, overall interest rates likely will rise, which will positively impact our interest income but may

further negatively impact the entire national economy, including the housing industry in the markets we serve, by reducing refinancing activity and new home purchases. In addition, deflationary pressures, while possibly lowering our

operational costs, could have a significant negative effect on our borrowers and the values of collateral securing loans, which could negatively affect our financial performance. A significant portion of our loans have fixed interest rates

(or, if adjustable, are initially fixed for periods of five to 10 years) and longer terms than our deposits and borrowings. Our net interest income could be adversely affected if the rates we pay on deposits and borrowings increase more

rapidly than the rates we earn on loans.

We also are subject to reinvestment risk associated with changes in interest rates. Changes in interest rates may affect the average life of loans and mortgage-related securities. Increases

in interest rates may decrease loan demand and/or may make it more difficult for borrowers to repay adjustable rate loans. Decreases in interest rates often result in increased prepayments of loans and mortgage-related securities, as

borrowers refinance their loans to reduce borrowing costs. Under these circumstances, we are subject to reinvestment risk to the extent that we are unable to reinvest the cash received from such prepayments in loans or other investments that

have interest rates that are comparable to the interest rates on existing loans and securities. Conversely, increases in interest rates often result in slowed prepayments of loans and mortgage-related securities, reducing cash flows and

reinvestment opportunities.

Changes in interest rates also affect the value of the Bank’s interest-earning assets, and in particular the Bank’s

securities portfolio. Generally, the value of fixed-rate securities fluctuates inversely with changes in interest rates. Unrealized gains and losses on securities available for sale are reported as a separate component of equity, net of tax.

Decreases in the fair value of securities available for sale resulting from increases in interest rates could have an adverse effect on shareholders’ equity.

External economic factors, such as changes in monetary policy and inflation and deflation, may have an adverse effect on our business, financial condition and results of operations.

Inflation rose sharply at the end of 2021 and remained elevated throughout 2022 at levels not seen for over 40 years. Inflationary pressures dissipated over the course of 2023 and 2024, with the annual inflation

rate in the United States decreasing to 2.9% during December 2024 from its high of 9.1% in June 2022, as reported by the U.S. Bureau of Labor Statistics. Virtually all our assets and liabilities are monetary in nature. As a result, interest

rates tend to have a more significant impact on our performance than general levels of inflation or deflation. Interest rates do not necessarily move in the same direction or by the same magnitude as the prices of goods and services.

Nevertheless, small to medium-sized businesses may be impacted more during periods of high inflation as they are not able to leverage economics of scale to mitigate cost pressures compared to larger businesses. Consequently, the ability of

our business customers to repay their loans has deteriorated and may continue to deteriorate, and in some cases this deterioration has occurred and may in the future occur quickly, which can adversely impact our results of operations and

financial condition. Furthermore, a prolonged period of inflation has caused and may continue to cause wages and other costs to the Company to increase, which could adversely affect our results of operations and financial condition.

23

Index

We are exposed to credit risk in our lending activities.

There are inherent risks associated with our lending and trading activities. Loans to individuals and business entities, our single largest asset group, depend for repayment on the

willingness and ability of borrowers to perform as contracted. A material adverse change in the ability of a significant portion of our borrowers to meet their obligation to us, due to changes in economic conditions, interest rates, natural

disaster, acts of war, or other causes over which we have no control, could adversely impact the ability of borrowers to repay outstanding loans or the value of the collateral securing these loans, and could have a material adverse impact on

our earnings and financial condition.

Weakness in the residential real estate markets could adversely affect our performance.

As of December 31, 2024, consumer residential real estate loans represented approximately 94.1% of our total loan portfolio. A general decline in home values would adversely affect the value

of collateral securing the residential real estate that we hold, as well as the volume of loan originations and the amount we realize on the sale of real estate loans. Additionally, if insurance obtained by our borrowers is insufficient to

cover any losses sustained to the collateral, the decreases in the value of collateral securing our loans as a result of natural disasters or other related events could adversely impact our financial condition and results of operations. If

insurance coverage is unavailable to our borrowers due to the reluctance of insurance companies to renew policies covering the collateral or due to other factors, the resulting increase in cost of home ownership could affect the ability of

borrowers to repay loans. These factors could result in higher delinquencies and greater charge-offs in future periods, which could materially adversely affect our business, financial condition or results of operations.

Our commercial loan portfolio is increasing and the inherently higher risk of loss may lead to additional provisions for credit losses or charge-offs, which would

negatively impact earnings and capital.

Commercial loans generally expose a lender to greater risk of non-payment and loss than one- to four-family residential mortgage loans because repayment of the loans often depends on the

successful operation of the business and the income stream of the borrowers. Such loans typically involve larger loan balances to single borrowers or groups of related borrowers compared to one- to four-family residential mortgage loans.

Also, some of our commercial borrowers have more than one loan outstanding with us. Consequently, an adverse development with respect to one loan or one credit relationship can expose us to a significantly greater risk of loss compared to an

adverse development with respect to a one- to four-family residential mortgage loan. Commercial business loans expose us to additional risk since they typically are dependent on the borrower’s ability to make repayments from the cash flows of

the business and are secured by non-real estate collateral that may depreciate over time. Further, our commercial business loans may be secured by collateral other than real estate, such as inventory and accounts receivable, the value of

which may be more difficult to appraise, control or collect and may be more susceptible to fluctuation in value at the time of default. In addition, if we foreclose on these loans, our holding period for the collateral may be longer than for

a single or multi-family residential property if there are fewer potential purchasers of the collateral.

Banking regulatory authorities may require banks with higher levels of investor real estate loans to implement enhanced risk management practices – including stricter underwriting,

additional internal controls and risk management policies, more detailed reporting, and portfolio stress testing – as well as potential higher allowances for credit losses and capital levels as a result of investor real estate lending growth

and exposure. Our failure to adequately implement enhanced risk management policies, procedures and controls could adversely affect our ability to manage the investor real estate segment of our loan portfolio and could result in an increased

rate of delinquencies in, and increased losses from, our loan portfolio, which could have a material adverse effect on our business, financial condition and results of operations.

24

Index

Furthermore, a downturn in the real estate market in our primary market areas could result in an increase in the number of borrowers who default on their loans and a reduction in the value

of the collateral securing their loans, which in turn could have an adverse effect on our profitability and asset quality. If we are required to liquidate the collateral securing a loan to satisfy the debt during a period of reduced real

estate values, our earnings and shareholders’ equity could be adversely affected. Unexpected decreases in investor real estate prices coupled with slow economic growth and elevated levels of unemployment could drive losses beyond those which

are provided for in our allowance for loan losses. We also may incur losses on investor real estate loans due to declines in occupancy rates and rental rates, which may decrease property values and may decrease the likelihood that a borrower

may find permanent financing alternatives. Any of these events could increase our costs, require management's time and attention, and materially and adversely affect our business, financial condition and results of operations.

Additionally, if insurance obtained by our borrowers is insufficient to cover any losses sustained to the collateral, the decreases in the value of collateral securing our loans as a result

of natural disasters or other related events could adversely impact our financial condition and results of operations. If insurance coverage is unavailable to our borrowers due to the reluctance of insurance companies to renew policies

covering the collateral or due to other factors, the resulting increase in cost of investor real estate ownership could affect the ability of borrowers to repay loans.

The combination of these factors could result in deterioration in the fundamentals underlying the commercial real estate market and the deterioration in value of some of our loans, as well

as the ability of our borrowers to repay the amounts due under their loans. As a result, our business, results of operations or financial condition may also be adversely affected. Specifically, the office property segment, which represents

9.6% percent of our total loan portfolio, is undergoing a structural shift given the rise of a remote work environment resulting in heightened vacancies and potentially reduced leasing needs. It is anticipated that this heightened risk

environment for the office segment may take several years to resolve.

If our allowance for credit losses on loans (“ACLL”) is not sufficient to cover expected loan losses, our earnings could decrease.

Our borrowers may not repay their loans according to the terms of the loans, and, as a result of potential declines in home prices, the collateral securing the payment of these loans may be

insufficient to pay any remaining loan balance. We may experience significant loan losses, which could have a material adverse effect on our operating results. TrustCo adopted ASU No. 2016-13, Financial

Instruments – Credit Losses (Topic 326): Measurement of Credit Losses on Financial Instruments (“CECL”) effective January 1, 2022. This standard requires financial institutions to determine periodic estimates of lifetime expected

credit losses on financial instruments and other commitments to extend credit. When determining the amount of the ACLL, we make various assumptions and judgments about the collectability of our loan portfolio, including the creditworthiness

of our borrowers and the value of the real estate and other assets serving as collateral for the repayment of many of our loans, as well as about the current and expected future economic environment. In deciding on the adequacy of the

allowance for credit losses, management reviews past due information, historical charge-off and recovery data, nonperforming loan activity and reasonable and supportable forecasts. Also, there are a number of other factors that are taken into

consideration, including: the magnitude, nature and trends of recent loan charge-offs and recoveries, the growth in the loan portfolio and the implication that it has in relation to the economic climate in the Bank’s market territories, and the economic environment in the Upstate New York territory (the Company’s largest geographical area) primarily over the last several years, as well as in the

Company’s other market areas. A significant portion of the ACLL is determined using qualitative factors. The determination of qualitative factors involves subjective judgement and subjective measurement.

We cannot predict loan losses with certainty that charge-offs in future periods will not exceed our estimate of expected losses as determined through our ACLL. If our assumptions and analysis prove to be incorrect, including with respect to

the economic environment, our ACLL may not be sufficient to cover expected losses in our loan portfolio, resulting in additions to our ACLL which is maintained through provisions for credit losses. In addition, regulatory agencies, as an

integral part of their examination process, may require additions to the allowance based on their judgment about information available to them at the time of their examination. Material additions to our ACLL would materially decrease our net

income.

25

Index

We may not be able to meet the cash flow requirements of our depositors or borrowers or meet our operating cash needs to fund corporate expansion and other activities.

Liquidity is the ability to meet cash flow needs on a timely basis at a reasonable cost. The liquidity of Trustco Bank is used to make loans and to repay deposit liabilities as they become due or are demanded by customers. Liquidity

policies and limits have been established by our Board, and our management monitors the overall liquidity position of Trustco Bank to ensure that various alternative strategies exist to cover unanticipated events that could affect liquidity.

Trustco Bank is also a member of the Federal Home Loan Bank which provides funding to members through advances and other extensions of credit that are typically collateralized with securities or mortgage-related assets. Our securities

portfolio can be used as a secondary source of liquidity, and additional liquidity could be obtained from securities sold under repurchase agreements, non-core deposits, and debt or equity securities issuances in public or private

transactions. If we were unable to access any of these funding sources when needed, we might not be able to meet the needs of our customers, which could adversely affect our financial condition, our results of operations, cash flows and our

level of regulatory capital.

We are subject to claims and litigation pertaining to fiduciary responsibility and lender liability.

Some of the services we provide, such as trust and investment services, require us to act as fiduciaries for our customers and others. In addition, loan workout and other activities may expose us or Trustco Bank to legal actions, including

lender liability or environmental claims. From time to time, third parties make claims and take legal action against us pertaining to the performance of our fiduciary responsibilities or loan-related activities. If these claims and legal

actions are not resolved in a manner favorable to us, we may be exposed to significant financial liability and/or our reputation could be damaged. Either of these results may adversely impact demand for our products and services or otherwise

have a harmful effect on our business and, in turn, on our financial condition, results of operations and prospects.

We have implemented a program to provide financial products and services to customers that do business in the cannabis industry and the strict enforcement of federal laws and regulations regarding cannabis could

result in our inability to continue to provide financial products and services to these customers. We could have legal action taken against us by the federal government and exposure to additional liabilities and regulatory compliance costs.

Offering financial products and services to the cannabis industry presents a unique set of regulatory risks due to the conflict between state and federal laws. While the possession and sale of recreational marijuana is legal for adults

aged 21 and older in New York State, cannabis remains classified as a Schedule I controlled substance under the federal Controlled Substances Act. Enforcement policies and practices may be highly variable between political administrations. In

addition, federal prosecutors have significant discretion and there can be no assurance that the federal prosecutor for any district in which we or our customers operate will not choose to strictly enforce the federal laws governing cannabis.

Any enforcement action against a cannabis-related business customer of ours could affect our results of operation and financial condition. Additionally, as the possession and use of cannabis remains illegal under the Controlled Substances

Act, we may be deemed to be aiding and abetting illegal activities through the services that we provide to such customers and could have legal action taken against us by the federal government, including imprisonment and fines. FinCEN

published guidelines in 2014 for financial institutions servicing state-legal cannabis businesses. These guidelines clarify how financial institutions can provide services to marijuana-related businesses in a “manner consistent with their

obligations to know their customers and to report possible criminal activity.” The Bank has and will continue to follow this and other FinCEN guidance in the areas of cannabis banking. However, there can be no assurance that compliance with

FinCEN’s guidelines will protect us from federal prosecution or other regulatory sanctions. Any change in position or potential action taken against us could result in significant financial damage to us and our stockholders.

Additionally, while we believe our Bank Secrecy Act/Anti-Money Laundering (“BSA/AML”) policies and practices for our cannabis banking program are sufficient, the recreational cannabis business is considered high-risk, and our BSA/AML

program will be subject to increased regulatory scrutiny. Any real or perceived shortcomings in our BSA/AML program may result in regulatory action against us and may prevent us from undertaking mergers and acquisitions or other expansion

activities.

26

Index

Risks Related to Our Operations

We are dependent upon the services of our management team.

We are dependent upon the ability and experience of a number of our key management personnel who have substantial experience with our operations, the financial services industry and the

markets in which we offer our services. It is possible that the loss of the services of one or more of our senior executives or key managers would have an adverse effect on our operations. Our success also depends on our ability to continue

to attract, manage and retain other qualified middle management personnel as we grow. We cannot assure you that we will continue to attract or retain such personnel.

Our disclosure controls and procedures may not prevent or detect all errors or acts of fraud.

Our disclosure controls and procedures are designed to reasonably assure that information required to be disclosed by TrustCo in reports we file or submit under the Exchange Act is

accumulated and communicated to management, and recorded, processed, summarized, and reported within the time periods specified in the SEC’s rules and forms. We believe that any disclosure controls and

procedures or internal controls and procedures, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met.

These inherent limitations include the realities that judgments in decision-making can be faulty and that breakdowns can occur because of simple error or mistakes. Additionally, controls can

be circumvented by the individual acts of some persons, by collusion of two or more people, or by an unauthorized override of the controls. Accordingly, because of the inherent limitations in our control system, misstatements due to error or

fraud may occur and not be detected.

If the business continuity and disaster recovery plans that we have in place are not adequate to continue our operations in the event of a disaster, the business disruption can adversely impact

our operations.

External events, including terrorist or military actions, or an outbreak of disease, and resulting political and social turmoil could cause unforeseen damage to our physical facilities or

could cause delays or disruptions to operational functions, including information processing and financial market settlement functions. Additionally, our customers, vendors and counterparties could suffer from such events. Should these events

affect us, or our customers, or vendors or counterparties with which we conduct business, our results of operations could be adversely affected.

The Company’s risk management framework may not be effective in mitigating risk and loss.

The Company maintains an enterprise risk management program that is designed to identify, quantify, monitor, report, and control the risks that it faces. These risks include interest rate, credit, liquidity, operations, reputation,

compliance, and litigation. While the Company assesses and improves this program on an ongoing basis, there can be no assurance that its approach and framework for risk management and related controls will effectively mitigate all risk and

limit losses in its business. If conditions or circumstances arise that expose flaws or gaps in the Company’s risk management program, or if its controls break down, the performance and value of its

business could be adversely affected.

New lines of business or new products and services may subject us to additional risks.

From time to time, we may develop and grow new lines of business or offer new products and services within our existing lines of business. There are substantial risks and uncertainties

associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and/or new products and services, we may invest significant time and resources. Initial

timetables for the introduction and development of new lines of business and/or new products or services may not be achieved and price and profitability targets may not prove feasible. External factors, such as compliance with regulations,

competitive alternatives, and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service. Furthermore, any new line of business and/or new product or service could have a

significant impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business or new products or services could have a material adverse

effect on our business, results of operations and financial condition. All service offerings, including current offerings and those which may be provided in the future, may become more risky due to changes in economic, competitive and market

conditions beyond our control.

27

Index

We are exposed to climate risk.

Climate change may be associated with rising sea levels as well as extreme weather conditions such as more intense hurricanes, thunderstorms, tornadoes, drought and snow or ice storms. Extreme weather

conditions may increase our costs or cause damage to our facilities, and any damage resulting from extreme weather may not be fully insured. Many of our facilities are located near coastal areas or waterways where rising sea levels or

flooding could disrupt our operations or adversely impact our facilities. Furthermore, periods of extended inclement weather or associated flooding may inhibit construction activity adversely affecting the use of some of our lending products.

Any such events could have a material adverse effect on our costs or results of operations. These same issues also could impact the value of mortgage collateral and the security for residential and commercial loans.

As a mortgage lender, Trustco Bank has identified credit, market, liquidity, and operational factors as climate-related risks. Adverse climate factors could impact the ability of loan customers to timely repay

their loans. Adverse climate impacts also could adversely impact the stock and bond markets which could adversely affect TrustCo’s non-interest income earning potential. Severe physical impacts from climate change, such as rising sea levels,

could reduce the value of residential and/or commercial portfolio. These two factors, given sufficiently severe impacts, could affect liquidity.

Additionally, severe weather and other climate events could impact hiring and retention of employees, facilities management, retail services, and technology infrastructure, thus creating operational risk.

Societal responses to climate change could adversely affect our business and performance, including indirectly through impacts on our customers.

Concerns over the long-term impacts of climate change have led and will continue to lead to governmental efforts around the world to mitigate those impacts. Consumers and businesses also may change their behavior on their own as a result

of these concerns. We and our customers will need to respond to new laws and regulations as well as consumer and business preferences resulting from climate change concerns. We and our customers may face cost increases, asset value

reductions, operating process changes, and the like. The impact on our customers will likely vary depending on their specific attributes, including reliance on or role in carbon intensive activities. Among the impacts to us could be a drop in

demand for our products and services, particularly in certain sectors. In addition, we could face reductions in creditworthiness on the part of some customers or in the value of assets securing loans. Our efforts to take these risks into

account in making lending and other decisions, including increasing our business with climate-friendly companies, may not be effective in protecting us from the negative impact of new laws and regulations or changes in consumer or business

behavior.

Environmental, social and governance (“ESG”) and diversity, equity and inclusion (“DEI”) risks could adversely affect our reputation and shareholder, employee, client and third party relationships and may

negatively affect our stock price.

Our business faces increasing public investor, activist, legislative and regulatory scrutiny related to ESG, anti-ESG, DEI and anti-DEI activities and developments. We risk damage to our brand and reputation if we fail to act responsibly

in a number of areas, such as diversity, equity, inclusion, environmental stewardship, human capital management, support for our local communities, corporate governance and transparency, or fail to consider ESG factors in our business

operations.

Furthermore, as a result of our diverse base of clients and business partners, we may face potential negative publicity based on the identity of our clients or business partners and the public’s (or certain segments of the public’s) view

of those entities. Such publicity may arise from traditional media sources or from social media and may increase rapidly in size and scope. If our client or business partner relationships were to become intertwined in such negative publicity,

our ability to attract and retain clients, business partners, and employees may be negatively impacted, and our stock price may also be negatively impacted. Additionally, we may face pressure to not do business in certain industries that are

viewed as harmful to the environment or are otherwise negatively perceived, which could impact our growth.

28

Index

Additionally, investors and shareholder advocates are placing ever increasing emphasis on how corporations address ESG issues in their business strategy when making investment decisions and when developing their investment theses and proxy

recommendations. We may incur meaningful costs with respect to our ESG efforts and if such efforts are negatively perceived, our reputation and stock price may suffer.

In response to ESG developments (including, in particular DEI initiatives), there are increasing instances of anti-ESG legislation and anti-DEI executive orders, adverse media coverage, regulation, and litigation that could have unintended

impacts on ordinary banking operations and increase litigation or reputational risk related to actions we choose to take and impact the results of our operations. If legislatures in the states in which we operate adopt legislation intended to

protect certain industries by limiting or prohibiting consideration of business and industry factors in lending activities, certain portions of our lending operations may be impacted.

Risks Related to Market Conditions

A prolonged economic downturn, especially one affecting our geographic market area, will adversely affect our operations and financial results.

Our primary lending emphasis is the origination of one-to-four family first mortgage loans on residential properties; therefore, we are particularly exposed to downturns in the U.S. housing

market. The primary risks inherent in our one- to four-family loan portfolio are declines in economic conditions, elevated levels of unemployment or underemployment, and declines in residential real estate values. Any one or a combination of

these events may have an adverse impact on borrowers’ ability to repay their loans, which could result in increased delinquencies, non-performing assets, loan losses, and future loan loss provisions.

Additionally, we have a concentration of loans secured in New York and Florida. Approximately 62.3% of our loan portfolio is comprised of loans secured by property located in our markets in

and around New York, and approximately 34.8% is comprised of loans secured by property located in Florida. This makes us vulnerable to a downturn in the local economy and real estate markets. Adverse conditions in the local economy such as

inflation, unemployment, recession, natural disasters, or other factors beyond our control could impact the ability of our borrowers to repay their loans. Decreases in local real estate values could adversely affect the value of the property

used as collateral for our loans, which could cause us to realize a loss in the event of a foreclosure. Currently, there is not a single employer or industry in the area on which the majority of our customers are dependent.

Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have a material adverse effect on our results of

operations and financial condition.

Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have a material adverse effect on our results of operations

and financial condition. The macroeconomic environment in the United States is susceptible to global events and volatility in financial markets. Unfavorable or uncertain economic and market conditions could lead to credit quality

concerns related to borrower repayment ability and collateral protection as well as reduced demand for the products and services we offer. In addition, economic conditions in foreign countries, including global political hostilities

(including China-Taiwan and U.S.-China relations), global military conflicts (including the conflicts in the Ukraine and the Middle East), and U.S. and foreign tariff policies, could affect the stability of global financial markets, which

could hinder domestic economic growth. If the national, regional and local economies experience worsening economic conditions, including high levels of unemployment, our growth and profitability could be constrained. Weak economic

conditions are characterized by, among other indicators, deflation, elevated levels of unemployment, fluctuations in debt and equity capital markets, increased delinquencies on commercial, mortgage and consumer loans, residential and

commercial real estate, price declines and lower home sales and commercial activity. Furthermore, trade negotiations between the U.S. and other nations remain uncertain and could adversely impact economic and

market conditions for the Company, our customers, and counterparties.

29

Index

In addition, the inflationary outlook in the United States remains uncertain. While inflation has eased from its recent peak of 9.1% in June 2022, further inflationary pressures could result in the Federal Reserve

Board discontinuing its lowering of interest rates or increasing interest rates for a prolonged period of time, which may expose the Company to interest rate risk. In addition, higher interest rates could slow economic growth and lead to a

recessionary environment, which could negatively impact the Company’s growth, credit quality, net interest margin and its financial results. The risks to our business from inflation depends on the durability of the current inflationary

pressures in our markets. Transitory increases in inflation are unlikely to have a material impact on our business or earnings. However, more persistent inflation could lead to tighter-than-expected monetary policy which could, in turn,

increase the borrowings costs of our customers, making it more difficult for them to repay their loans or other obligations. Actions taken by the Federal Reserve Board, including changes in its target funds rate, balance sheet management and

lending facilities are beyond our control and difficult to predict. These actions can affect interest rates and the value of financial instruments and other assets and liabilities and can impact our borrowers. Sudden changes in monetary

policy, for example, in response to high inflation, have led and may in the future lead to financial market volatility, increases in market interest rates and a continued flattening or inversion of the yield curve. This has resulted in and

may continue to result in volatility of equity and other markets, further volatility of the U.S. dollar, a widening in credit spreads and higher interest rates and recessionary concerns, and could result in elevated unemployment, which could

impact investor risk appetite and our borrowers, potentially increasing delinquency rates. Financial market volatility could also result from uncertainty about the timing and extent of rate cuts by the Federal Reserve Board in response to

moderating inflation and/or weakening economic conditions. Higher inflation, or volatility and uncertainty related to inflation, could also reduce demand for our products, adversely affect the creditworthiness of our borrowers or result in

lower values for our investment securities and other interest-earning assets.

Any downgrade in the credit rating of the U.S. government or default by the U.S. government as a result of political conflicts over legislation to raise the U.S. government’s debt limit may have a material

adverse effect on us.

Recent federal budget deficit concerns and political conflict over legislation to raise the U.S. government’s debt limit have increased the possibility of a default by the U.S. government on its debt obligations, related credit-rating

downgrades, or an economic recession in the United States. On January 21, 2025, the U.S. Treasury began taking extraordinary measures to prevent a default on U.S. government debt, which measures are expected to continue until such time as the

U.S. Congress increases the debt ceiling. However, it is unclear how long such extraordinary measures will forestall a default in the event of extended Congressional negotiations or inaction. Many of our investment securities are issued by

the U.S. government, including certain government agencies and sponsored entities. As a result of uncertain domestic political conditions, including the possibility of the federal government defaulting on its obligations for a period of time

due to debt ceiling limitations or other unresolved political issues, investments in financial instruments issued or guaranteed by the federal government may pose liquidity risks. In 2011, Standard & Poor’s lowered its long-term sovereign

credit rating on the U.S. from AAA to AA+. On August 1, 2023, Fitch Ratings also downgraded its U.S. long-term sovereign credit rating from AAA to AA+. A downgrade, or a similar action by other rating agencies, in response to current

political dynamics, as well as sovereign debt issues facing the governments of other countries, could generally have a material adverse impact on financial markets and economic conditions in the U.S. and worldwide and, therefore, materially

adversely affect our business, financial condition and results of operations.

The soundness of other financial institutions could adversely affect us.

Our ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services institutions are interrelated as a result of trading, clearing,

counterparty, or other relationships. We have exposure to many different counterparties, and we routinely execute transactions with counterparties in the financial services industry, including brokers and dealers, banks, investment banks,

mutual funds, and other institutional entities. As a result, defaults by, or even rumors or questions about, one or more financial services institutions, or the financial services industry generally, have led to market-wide liquidity problems

and could lead to losses or defaults by us or by other institutions. Many of these transactions expose us to credit risk in the event of default of our counterparty or client. Any such losses could be material and could materially and

adversely affect our business, financial condition and results of operations. On November 16, 2023, the FDIC approved a final rule to implement a special assessment on certain banking organizations with

financial institution subsidiaries with more than $5 billion in assets, in order to recover the costs associated with protecting uninsured depositors following the closures of Silicon Valley Bank and Signature Bank in March 2023. In the event

that there are similar negative developments in the banking industry in the future, there may be increased regulatory scrutiny and new regulations directed towards regional banks similar in size to us, which may increase our costs of doing

business and reduce our profitability.

30

Index

Any government shutdown could adversely affect the U.S. and global economy and our liquidity, financial condition and earnings.

Disagreement over the federal budget has previously caused the U.S. federal government to shut down for periods of time. On December 21, 2024, President Biden signed a bipartisan continuing resolution to extend federal spending and avert a

government shutdown through March 14, 2025. Accordingly, without a final agreement regarding the federal budget in place prior to the expiration of the continuing resolution, or another continuing resolution, it is still possible that a

partial shutdown of the U.S. government may occur. An extended period of shutdown of portions of the U.S. federal government could negatively impact the financial performance of certain customers and could negatively impact customers’ future

access to certain loan and guaranty programs. Continued adverse political and economic conditions could have a material adverse effect on our business, financial condition and results of operations. During any protracted federal government

shutdown, we may not be able to close certain loans and we may not be able to recognize non-interest income on the sale of loans. Some of the loans we originate are sold directly to government agencies, and some of these sales may be unable

to be consummated during a shutdown. In addition, we believe that some borrowers may decide not to proceed with their home purchase and not close on their loans, which would result in a permanent loss of the related non-interest income. A

federal government shutdown could also result in reduced income for government employees or employees of companies that engage in business with the federal government, which could result in greater loan delinquencies, increased in our

non-performing, criticized, and classified assets, and a decline in demand for our products and services.

The trust wealth management fees we receive may decrease as a result of poor investment performance, in either relative or absolute terms, which could decrease our revenues and net earnings.

Our Trustco Financial Services department derives its revenues primarily from investment management fees based on assets under management. Our ability to maintain or increase assets under management is subject to a number of factors,

including investors’ perception of our past performance, in either relative or absolute terms, market and economic conditions, and competition from investment management companies. Financial markets are affected by many factors, all of which

are beyond our control, including general economic conditions, securities market conditions, the level and volatility of interest rates and equity prices, competitive conditions, monetary and fiscal policy and investor sentiment. A decline in

the value of the assets under management would decrease our income. Further certain of our investment advisory and wealth management clients can terminate, with little or no notice, their relationships with us, reduce their aggregate assets

under management, or shift their funds to other types of accounts with different rate structures.

Risks Related to Compliance and Regulation

The regulatory capital rules could slow our growth, cause us to seek to raise additional capital, or both.

As discussed under “Regulation and Supervision - Regulatory Capital Requirements and Prompt Corrective Action,” the Company and the Bank are subject to regulatory

capital requirements. The capital rules impose stringent capital requirements on the Company and the Bank and generally require banking organizations to hold high-quality capital to act as a financial cushion to absorb losses and help banking

organizations better withstand periods of financial stress.

The application of these stringent capital requirements for us could, among other things, result in lower returns on equity, require us to limit the growth we may otherwise seek, require the raising of additional capital, and result in

regulatory actions such as prohibitions on the payment of dividends, the payment of bonuses to employees or the repurchase of shares if we were unable to comply with such requirements. If Trustco Bank fails to comply with its capital

requirements, the OCC will have the authority to take “prompt corrective action,” depending on the Bank’s capital level. Currently, the Bank is considered “well-capitalized” for prompt corrective action purposes. If it were to be designated

by the OCC in one of the lower capital levels - “undercapitalized,” “significantly undercapitalized” or “critically undercapitalized” - the Bank would be required to raise additional capital and also would be subject to progressively more

severe restrictions on operations, management, and capital distributions; replacement of senior executive officers and directors; and, if it became “critically undercapitalized,” to the appointment of a conservator or receiver.

We currently anticipate that we will continue to be well-capitalized in accordance with the regulatory standards.

31

Index

Changes in laws and regulations and the cost of regulatory compliance with new laws and regulations may adversely affect our operations and our income.

We are subject to extensive regulation, supervision, and examination by the OCC, Federal Reserve Board, and FDIC. These regulatory authorities have extensive discretion in connection with their supervisory and enforcement activities,

including the ability to impose restrictions on a bank’s operations, reclassify assets, determine the adequacy of a bank’s loss allowances, and determine the level of deposit insurance premiums assessed. The Dodd-Frank Act significantly

affected the lending, deposit, investment, trading, and operating activities of financial institutions and their holding companies and will continue to do so. Changes in banking regulations and oversight, and the regulation of other agencies,

such as the CFPB and the U.S. Department of Housing and Urban Development, whether in the form of regulatory policy, new regulations or legislation, or additional deposit insurance premiums, have impacted our operations and may continue to

have a material impact on our operations in the future. New or revised rules may increase our regulatory compliance burden and costs and restrict the financial products and services we offer to our customers.

Further, there may be additional laws and regulations, or changes in policy, affecting lending and funding practices, regulatory capital limits, interest rate risk management, and liquidity standards, and future responses may result in

significant changes. The federal bank regulatory agencies may require us to maintain capital ratios in excess of regulatory requirements, and new laws and regulations may increase our costs of regulatory compliance and of doing business, and

otherwise affect our operations. New laws and regulations may significantly affect the markets in which we do business, the markets for and value of our loans and investments, the products we offer, the fees we can charge and our ongoing

operations, costs, and profitability.

We are subject to numerous laws designed to protect consumers, including the CRA and fair lending laws, and a failure to comply with these laws could lead to a wide variety of sanctions.

The CRA, the Equal Credit Opportunity Act, the Fair Housing Act, and other fair lending laws and regulations (collectively, fair lending laws) impose community investment and nondiscriminatory lending requirements on financial

institutions. The CFPB, the Department of Justice and other federal and state agencies are responsible for enforcing these federal laws and regulations and comparable state provisions. Various federal banking agencies have recently completed

significant changes to their respective CRA regulations. Federal, state or local consumer lending laws may restrict our ability to originate certain mortgage loans or increase our risk of liability with respect to such loans. A successful

regulatory challenge to an institution's performance under the fair lending laws could result in a wide variety of sanctions, including damages and civil money penalties, injunctive relief, restrictions on mergers and acquisitions,

restrictions on expansion and restrictions on entering new business lines. Private parties may also have the ability to challenge an institution's performance under fair lending laws in private class action litigation. Such actions could have

a material adverse effect on our business, financial condition and results of operations.

Changes in cybersecurity or privacy regulations may increase our compliance costs, limit our ability to gain insight from data and lead to increased scrutiny.

We collect, process, store, share, disclose and use information from and about our customers, plan participants and website and application users, including personal information and other data. Any actual or

perceived failure by us to comply with our privacy policies, privacy-related obligations to customers or third parties, data disclosure and consent obligations or data security legal obligations may result in governmental enforcement

actions, litigation or public statements critical of us. Such actual or perceived failures could also cause our customers to lose trust in us, which could have an adverse effect on our business.

Restrictions on data collection and use may limit opportunities to gain business insights useful to running our business and offering innovative products and services.

32

Index

We are subject to numerous federal, state, and international regulations regarding the privacy and security of personal information. These laws vary widely by jurisdiction

and are constantly evolving. Privacy regulations with a significant impact on our operations include the NYDFS 23 NYCRR Part 500 Cybersecurity Requirements for Financial Services Companies, Gramm-Leach-Bliley Title V Subtitle A- Safeguards

Rule, and FDIC Part 364 Appendix B- Interagency Guidelines Establishing Information Security Standards. Similar legislation is being enacted around the world with requirements and protections specific to data security requirements,

notification requirements for data breaches, the right to access personal data and the right to be forgotten. These and other changes in cybersecurity and privacy regulations or the enactment of new regulations may increase our compliance

costs and failure to comply with these regulations may lead to reputational damage, fines or civil damages and increased regulatory scrutiny.

Non-compliance with the Bank Secrecy Act, or other laws and regulations could result in fines or sanctions.

The Bank Secrecy Act and other applicable requirements require financial institutions to develop programs to prevent financial institutions from being used for money laundering and terrorist

activities. If such activities are detected, financial institutions are obligated to file suspicious activity reports with the U.S. Treasury’s Office of Financial Crimes Enforcement Network. These rules require financial institutions to

establish procedures for identifying and verifying the identity of customers seeking to open new financial accounts. Failure to comply with these regulations could result in fines or sanctions. Recently, several banking institutions have

received large fines for non-compliance with these laws and regulations. While we have developed policies and procedures designed to assist in compliance with these laws and regulations, these policies and procedures may not be effective in

preventing violations of these laws and regulations.

Changes in tax laws may adversely affect us, and the Internal Revenue Service or a court may disagree with our tax positions, which may result in adverse effects on our

business, financial condition, and results of operations or cash flows.

The Company operates in an environment that imposes income taxes on its operations at both the federal and state levels to varying degrees. Strategies and operating routines have been implemented to minimize the impact of these taxes.

Consequently, any change in tax legislation could significantly alter the effectiveness of these strategies. The Tax Cuts and Jobs Act (which we refer to as the “Tax Act”), enacted in December 2017, significantly affected United States tax

law, including by changing how the United States imposes tax on certain types of income of corporations and by reducing the United States federal corporate income tax rate to 21%. It also imposed new limitations on a number of tax benefits,

including certain executive compensation deductions, deductions for certain transportation fringe benefits provided to employees and entertainment expenses, among others. There can be no assurance that future tax law changes will not increase

the rate of the corporate income tax significantly; impose new limitations on deductions, credits or other tax benefits; or make other changes that may adversely affect the performance of an investment in our stock. In addition, we have taken

and may in the future take positions with respect to a number of unsettled issues for which Internal Revenue Services (“IRS”) guidance is unavailable. There is no assurance that the IRS or a court will agree with the positions taken by us, in

which case tax penalties and interest may be imposed that could adversely affect our business, financial condition, results of operations and cash flows.

Furthermore, on August 16, 2022, the U.S. government enacted the Inflation Reduction Act of 2022, which imposed a one percent excise tax on the value of corporate share repurchases (net of issuance). On December 27, 2022, the Internal

Revenue Services issued Notice 2023-2 which provides interim guidance on the implementation of the excise tax on stock repurchases. The excise tax is a non-deductible tax of one percent of the fair market value of the Corporation’s stock

repurchases, net of the fair market value of stock issued by the corporation, including restricted stock issuances and stock option exercises, and further excluding certain statutory exceptions, such as ESOP repurchases and contributions,

repurchases made as part of a tax-free reorganization where no gain or loss is recognize and certain other qualified activities, occurring after December 31, 2022 in excess of $1.0 million. Although we did not have any excise tax on stock

repurchases in fiscal 2024, the tax may impact our future financial results.

33

Index

The changes in the federal tax laws may have an adverse effect on the market for, and the valuation of, residential properties, and on the demand for such loans in the future, and could make it

harder for borrowers to make their loan payments. In addition, these changes may also have a disproportionate effect on taxpayers in states with high residential home prices and high state and local taxes, like New York. If home ownership

becomes less attractive, demand for mortgage loans could decrease. The value of the properties securing loans in our loan portfolio may be adversely impacted as a result of the changing economics of home ownership, which could require an

increase in our provision for loan losses, which would reduce our profitability and could materially adversely affect our business, financial condition and results of operations.

Our ability to pay dividends is subject to regulatory limitations and other limitations that may affect our ability to pay dividends to our stockholders or to repurchase our common stock.

TrustCo is a separate legal entity from its subsidiary Trustco Bank, and does not have significant operations of its own. The availability of dividends from Trustco Bank is limited by

various statutes and regulations. It is possible, depending upon the financial condition of the Bank and other factors that the OCC or the Federal Reserve Board could assert that payment of dividends or other payments may result in an unsafe

or unsound practice. In addition, TrustCo is subject to consolidated capital requirements and is required to serve as a source of strength to Trustco Bank. If the Bank is unable to pay dividends to TrustCo, or if TrustCo is required to retain

capital or contribute capital to the Bank, we may not be able to pay dividends on our common stock or to repurchase shares of common stock.

We may be subject to a higher effective tax rate if Trustco Realty Corp. (“Trustco Realty”) fails to qualify as a real estate investment trust (“REIT”).

Trustco Realty, a subsidiary of Trustco Bank, operates as a REIT for tax purposes. Trustco Realty was established to acquire, hold and manage mortgage assets and other authorized investments to generate net income for distribution to its

shareholders. Qualification as a REIT involves application of specific provisions of the Internal Revenue Code relating to various asset tests and gross income tests. If Trustco Realty fails to meet any of the required provisions for REITs,

it could no longer qualify as a REIT and the resulting tax consequences would increase our effective tax rate or cause us to have a tax liability for prior years.

Changes in accounting standards could impact reported earnings.

The accounting standard setting bodies, including the Financial Accounting Standards Board, the SEC and other regulatory bodies, periodically change financial accounting and reporting standards that govern the preparation of our

consolidated statements. These changes can be hard to predict and can materially impact how the Company records and reports its financial condition and results of operations. In some cases, we could be required to apply a new or revised

accounting standard retroactively, which could affect beginning of period financial statement amounts.

Risks Related to Competition

Strong competition within the Bank’s market areas could hurt profits and slow growth.

The Bank faces intense competition both in making loans and attracting deposits. This competition comes principally from other banks, savings and loan associations, credit unions, mortgage companies, other lenders, and institutions

offering uninsured investment alternatives. Many of our competitors have competitive advantages, including greater financial resources and higher lending limits, a wider geographic presence, more accessible branch office locations, more

aggressive marketing campaigns and better brand recognition, and the ability to offer a wider array of services or more favorable pricing alternatives, as well as lower origination and operating costs.

Competition has made it more difficult for the Bank to make new loans and at times has forced the Bank to offer higher deposit rates. Price competition for loans and deposits might result in the Bank earning less on loans and paying more

on deposits, which would reduce net interest income. Competition also makes it more difficult to grow loans and deposits and to hire and retain experienced employees. Management expects competition to increase in the future as a result of

legislative, regulatory and technological changes and the continuing trend of consolidation in the financial services industry. The Bank’s profitability depends upon its continued ability to compete

successfully in its market areas.

34

Index

Consumers and businesses are increasingly using non-banks to complete their financial transactions, which could adversely affect our business and results

of operations.

Technology and other changes are allowing consumers and businesses to complete financial transactions that historically have involved banks through alternative methods. For example, the wide

acceptance of Internet-based commerce has resulted in a number of alternative payment processing systems and lending platforms in which banks play only minor roles. Customers can now maintain funds in prepaid debit cards or digital

currencies, and pay bills and transfer funds directly without the direct assistance of banks. The diminishing role of banks as financial intermediaries has resulted and could continue to result in the loss of fee income, as well as the loss

of customer deposits and the related income generated from those deposits. The loss of these revenue streams and the potential loss of lower cost deposits as a source of funds could have a material adverse effect on our business, financial

condition and results of operations.

Risks Related to Cybersecurity, Third Parties, and Technology

Our business could be adversely affected by third-party service providers, data breaches, and cyber-attacks.

We rely heavily on third-party service providers for much of our communications, information, operating and financial controls systems, and technology. We face the risk of operational disruption, failure, or capacity constraints due to our

dependency on third-party service providers for components of our business infrastructure. While we have selected these third-party service providers through our third party risk management program, we do not control their operations. As

such, any failure on the part of these business partners to perform their various responsibilities could also adversely affect our business and operations. Any failure or interruption or breach in security of these systems could result in

failures or interruptions in our customer relationships management, general ledger, deposit, servicing, and/or loan origination systems. Third (and fourth) party security incidents and supply-chain attacks have become increasingly common. We

cannot assure you that such incidents, failures or interruptions will not occur again in the future or, if they do occur, that they will be adequately addressed by us or the third parties on which we rely. The occurrence of any failure or

interruption could have a material adverse effect on our business, financial condition, results of operations, and cash flows. If any of our third-party service providers experience financial, operational, or technological difficulties, or if

there is any other disruption in our relationships with them, we may be required to locate alternative sources of such services, We cannot assure you that we could negotiate terms that are as favorable to us, or could obtain services with

similar functionality as found in our existing systems, without the need to expend substantial resources, if at all.

Furthermore, our assets that are at risk for cyber-attacks include financial assets and non-public information belonging to customers. We use several third-party service providers who have access to our assets

via electronic media. Certain cyber security risks arise due to this access, including cyber espionage, blackmail, ransom, and theft. We employ preventive and detective controls to protect our assets and provide recurring information security

training to all employees. Although to date we have not experienced any material losses or other material consequences to date relating to technology failure, cyberattacks or other information or security breaches, whether directed at us or

at third parties, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be

sufficient and/or timely as to prevent material losses or consequences in the future, particularly in light of the increased sophistication and evolving nature of cyber criminals’ activity. Our risk and exposure to these cybersecurity

incidents remains heightened because of, among other things, our implementation of Internet and mobile banking to meet customer demand, our expanded internal usage of web-based products and applications, the current economic and political

environment, and our regulatory obligations and the regulatory scrutiny within our industry. As cyber and other data security threats continue to evolve, we may be required to expend significant additional resources to continue to modify and

enhance our protective measures or to investigate and remediate any security vulnerabilities.

35

Index

The development and use of artificial intelligence (“AI”) presents risks and challenges that may adversely impact our business.

We or our third-party vendors, clients or counterparties may develop or incorporate AI technology in certain business processes, services or products. The development and use of AI presents a number of risks

and challenges to our business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the United States and internationally, and includes regulatory schemes targeted specifically at AI as well as

provisions in intellectual property, privacy, consumer protection, employment and other laws applicable to the use of AI. These evolving laws and regulations could require changes in our implementation of AI technology and increase our

compliance costs and the risk of non-compliance. AI models, particularly generative AI models, may produce output or take action that is incorrect, that result in the release of private, confidential or proprietary information, that reflect

biases included in the data on which they are trained, infringe on the intellectual property rights of others or that is otherwise harmful. In addition, the complexity of many AI models makes it challenging to understand why they are

generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output,

eliminating bias and complying with regulations that require documentation or explanation of the basis on which decisions are made.

Further, we may rely on AI models developed by third parties, and would be dependent in part on the manner in which those third parties develop, train and deploy their models, including risks arising from the

inclusion of any unauthorized material in the training data for their models, the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models and other matters over which we may have

limited visibility. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures.

We are also exposed to risks arising from the use of AI technologies by bad actors to commit fraud and misappropriate funds and to facilitate cyberattacks. Generative AI, if used to perpetrate fraud or launch

cyberattacks, could create panic at a particular financial institution or securities exchange, which could pose a threat to financial stability.

A failure in or breach of our operational or security systems or infrastructure, or those of third parties, could disrupt our businesses, and adversely impact our results of operations,

liquidity and financial condition, as well as cause reputational harm.

The potential for operational risk exposure exists throughout our organization and, as a result of our interactions with, and reliance on, third parties, is not limited to our own internal

operational functions. Our operational and security systems, infrastructure, including our computer systems, data management, and internal processes, as well as those of third parties, are integral to our performance. We rely on our employees

and third parties in our day-to-day and ongoing operations, who may, as a result of human error, misconduct, malfeasance or failure, or breach of third-party systems or infrastructure, expose us to risk. We have taken measures to implement

backup systems and other safeguards to support our operations, but our ability to conduct business may be adversely affected by any significant disruptions to us or to third parties with whom we interact and rely. For example, strategic

technology project implementation challenges have caused immaterial business interruptions in the past and may cause more interruptions in the future. In addition, our ability to implement backup systems and other safeguards with respect to

third-party systems is more limited than with respect to our own systems. Our financial, accounting, data processing, backup or other operating or security systems and infrastructure may fail to operate properly or become disabled or damaged

as a result of a number of factors including events that are wholly or partially beyond our control which could adversely affect our ability to process these transactions or provide these services. There have been and there could be in the

future sudden increases in customer transaction volume; electrical, telecommunications, or other major physical infrastructure outages; natural disasters such as earthquakes, tornadoes, hurricanes, and floods; disease pandemics; and events

arising from local or larger scale political or social matters, including terrorist acts. We continuously update these systems to support our operations and growth and to remain compliant with all applicable laws, rules and regulations

globally. This updating entails significant costs and creates risks associated with implementing new systems and integrating them with existing ones, including business interruptions. Operational risk exposures could adversely impact our

results of operations, liquidity and financial condition, as well as cause reputational harm.

Unauthorized disclosure of sensitive or confidential client or customer information, whether through a breach of our computer systems or otherwise, could

severely harm our business.

As part of our financial institution business, we collect, process, and retain sensitive and confidential customer information. Despite the security measures we have in place, our facilities

and systems, and those of our third-party service providers, have been and may be vulnerable to security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming and/or human errors, or other similar events in the

future. If information security is breached, information can be lost or misappropriated, resulting in financial loss or costs to us. Any security breach involving confidential customer information, whether by us or by our vendors, could

severely damage our reputation, expose us to the risks of litigation and regulatory liability or disrupt our operations and have a material adverse effect on our business operations.

36

Index

We could suffer a material adverse impact from interruptions in the effective operation of, or security breaches affecting, our computer systems.

We rely heavily on information systems to conduct our business and to process, record, and monitor our transactions. Risks to the systems result from a variety of factors, including the

potential for bad acts on the part of hackers, criminals, employees and others. As one example, some banks in recent years have experienced denial of service attacks in which individuals or organizations flood the bank’s website with extraordinarily high volumes of traffic, with the goal and intended effect of disrupting the ability of the bank to process transactions. We are also at risk for the impact of natural disasters, terrorism,

and international hostilities on our systems or for the effects of outages or other failures involving power or communications systems operated by others. These risks also arise from the same types of threats to businesses with which we deal.

Potential adverse consequences of attacks on our computer systems or other threats include damage to our reputation, loss of customer business, litigation, and increased regulatory scrutiny,

which might also result in financial loss and require additional efforts and expense to attempt to prevent such adverse consequences in the future.

Risk Related to Ownership of Our Securities

Provisions in our articles of incorporation and bylaws and New York law may discourage or prevent takeover attempts, and these provisions may have the

effect of reducing the market price of our stock.

Our articles of incorporation and bylaws include several provisions that may have the effect of discouraging or preventing hostile takeover attempts, and therefore, making the removal of

incumbent management difficult. The provisions include requirements of supermajority votes to approve certain business transactions. In addition, New York law contains several provisions that may make it more difficult for a third party to

acquire control of us without the approval of the Board, and may make it more difficult or expensive for a third party to acquire a majority of our outstanding stock. To the extent that these provisions are effective in discouraging or

preventing takeover attempts, they may tend to reduce the market price for our stock.

We cannot guarantee that our allocation of capital to various alternatives, including stock repurchase plans, will enhance long-term stockholder value.

Our business plan calls for us to execute a variety of strategies to allocate and deploy any excess capital including, but not limited to, continued organic balance sheet growth and

diversification, implementation of stock repurchase plans and payment of regular cash dividends. Additionally, we will carefully consider acquisition opportunities to further deploy capital when we expect such opportunities to significantly

enhance long-term shareholder value. If we are unable to effectively and timely deploy capital through these strategies, it may constrain growth in earnings and return on equity and thereby diminish potential growth in stockholder value.

On March 29, 2024, we announced that our Board authorized a new stock repurchase plan to acquire up to 200,000 shares of the Company’s outstanding common stock. Repurchases are made at

management’s discretion at prices management considers to be attractive and in the best interests of both the Company and its stockholders, subject to the availability of stock, general market conditions, the trading price of the stock,

alternative uses for capital, and the Company’s financial performance.

The Inflation Reduction Act of 2022, which was signed into law on August 16, 2022, contains a number of changes to U.S. federal tax laws. One such change is a 1% excise tax on stock

repurchases, which will increase the cost of stock repurchases and may impact our future decisions on how to return value to stockholders in the most efficient manner.

Item 1B Unresolved Staff Comments

None.

37

Index

Item 1C Cybersecurity

Cybersecurity Risk Management and Strategy

At TrustCo, we recognize the importance of information security practices designed to protect the confidentiality, integrity, and availability

of company information and the personal information that our customers share with us. TrustCo Bank maintains a formal enterprise wide risk management (“ERM”) program which identifies, measures, monitors, and controls risk. The ERM Program and

framework is designed to ensure that all elements of the risk management process are in place and operating effectively across all risk categories. Risk categories include credit, interest rate risk, liquidity, price, operational, compliance,

reputation, and strategic risks. Cybersecurity risk is a critical component of our technology risk management program, specifically our information security program given the increasing reliance on technology and potential of cyber risk threats.

Using guidance set forth in our ERM program, we have implemented an Information Security Program to lead and support the management of information security risks in accordance with our risk profile and business strategy. We utilize the Federal Financial Institutions Examination Council (“FFIEC”) Cybersecurity Assessment Tool to benchmark these controls and procedures.

Our Information Security Program includes a number of components designed to identify, analyze, and respond to cybersecurity risks, including

reliance on a layered system of preventative and detective technologies, controls, and policies designed to detect, mitigate, and contain cybersecurity threats. As part of our Information Security Program, we maintain an Information Security

Policy that outlines internal controls and procedures designed to protect information systems. Information security program risk assessments and third-party attestations and assessments are conducted periodically by both internal and external

resources. We leverage qualified third-party security assessors to identify vulnerabilities through both internal and external penetration tests and perform internal cybersecurity maturity assessments. In addition, our internal audit team conducts an information security and information technology audit on an annual basis. We are also subject to examinations by applicable

regulators. We conduct annual cybersecurity awareness training for employees to enhance awareness of how to detect and respond to cybersecurity threats, as well as periodic phishing training campaigns. We also provide quarterly cybersecurity

updates for our employees, and table-top exercises are conducted annually to simulate a response to a cybersecurity incident.

As part of our Information Security Program, TrustCo maintains a formal Third-Party Risk Management program that provides oversight of cybersecurity risks related to supplier relationships. During supplier onboarding, we perform risk-based due diligence for suppliers

with access to confidential TrustCo information or that require technical integration with TrustCo systems. This program includes encryption and password requirements for our suppliers, as well as ongoing monitoring and assessment, and contract

review.

Furthermore, we recognize the growing risk associated with highly sophisticated actors targeting corporations and maintain an Incident Response

Plan, which is part of our broader business continuity planning. We have access through our insurer to computer forensics firms and specialized legal counsel in case of a cybersecurity incident. While we maintain cybersecurity insurance to assist

in the cost of recovery from a cybersecurity incident, such coverage may not be sufficient to cover all costs resulting from such incidents.

We did not experience any material losses relating to cybersecurity threats or incidents for the year ended December 31, 2024. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the

sophistication of and risks from cybersecurity threats and incidents continue to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents and protect our systems and

information may not successfully protect against all cybersecurity threats and incidents. For more information on the risks that we face from cybersecurity threats, see

“Risk Factors - Risks Related to Cybersecurity, Third Parties, and Technology.” in Part I, Item 1A of this report.

38

Index

Cybersecurity Governance

The Board has overall responsibility for risk oversight and has delegated oversight of our cybersecurity program to both our Risk Committee and

our Audit Committee.The Risk Committee directly oversees information technology

and information security risks through regular reports from management on information technology, cyber security, and related risk assessments. The Risk Committee also receives annual reports on the Information Security Program and approves the

Information Security Policy. In addition, the Audit Committee of the Board monitors internal audit’s coverage of cybersecurity governance, risks, and related controls, including any identified deficiencies, from cybersecurity or other risks, that

could adversely affect the ability to record, process, summarize, and report financial data. The Risk Committee coordinates with the Audit Committee for review of information security matters, as needed. The Board also receives an annual update

on the Company’s enterprise services, which includes both information technology and information security.

Our Information Security Program is run by our Senior Vice President, Chief Risk Officer, Chief Compliance Officer and Information Security Officer (“ISO”), who reports to our Executive Vice President, Chief Operating Officer (“EVP”). Our ISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through

regular communication and reporting from professionals in the information security team, and through the use of technological tools and software and results from third party audits. Our management-level IT Steering Committee meets on a monthly

basis to discuss cybersecurity and related topics. Our ISO and EVP have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our

ISO has served in that position since 2013, is a Certified Information Security Manager, and has over 20 years of experience working at TrustCo. Our EVP, who has been an employee of TrustCo since 1986, has served in his role as Executive Vice

President of TrustCo since 2013.Our ISO and EVP report directly to the Risk Committee on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues.

Item 2. Properties

TrustCo’s executive offices are located at 5 Sarnowski Drive, Glenville, New York, 12302, in a facility owned by the Company. The Company operates 136 banking offices

located in New York, New Jersey, Vermont, Massachusetts and Florida. As of December 31, 2024, 23 of such properties are owned and 113 are leased from others on market terms. The lease terms for our banking offices are not individually material.

Lease expirations range from 1 month to 19.8 years. In the opinion of management, the physical properties of TrustCo and the Bank are suitable and adequate to meet our requirements and are being fully utilized.

Item 3. Legal Proceedings

The nature of TrustCo’s business generates a certain amount of litigation against TrustCo and its subsidiaries involving matters arising in the ordinary course of business. In the opinion of management of

TrustCo, there are no proceedings pending to which TrustCo or any of its subsidiaries is a party, or of which its property is the subject which, if determined adversely to TrustCo or such subsidiaries, would be material in relation to TrustCo’s consolidated shareholders’ equity and financial condition.

Item 4. Mine Safety Disclosures

Not applicable.

39

Index

Information about our Executive Officers

Our executive officers as of March 14, 2025, are listed below, along with their ages on that date, positions and offices held with the company, and principal occupations and employment, focused primarily on the past five years.

40

Index

PART II

TrustCo’s common stock is traded on The Nasdaq Stock Market, LLC under the symbol “TRST.” TrustCo had approximately 6,866

shareholders of record as of March 7, 2025.

The Company’s ability to pay dividends depends on the receipt of dividends from the Bank, which is subject to a variety of limitations under federal banking regulations regarding the payment of dividends. The

Board presently intends to continue the policy of paying quarterly cash dividends. The amount of any future dividends will depend on economic and market conditions, our financial condition and operating results, and other factors, including

contractual restrictions and applicable government regulations and policies (such as those relating to the ability of bank and non-bank subsidiaries to pay dividends to the parent company and regulatory capital limitations). For

discussion of corporate and regulatory limitations applicable to the payment of dividends, see “Item 1. Business-Supervision and Regulation-Dividends.”

Recent Sales of Unregistered Securities.

None.

Issuer Purchases of Equity Securities

The following table provides information about the Company’s purchases of shares of common stock during the three months ended December 31, 2024.

Stock Performance Graph

The TrustCo Annual Report to Shareholders for the year ended December 31, 2024, which is filed as Exhibit 13 hereto, contains a stock performance graph comparing the yearly percentage change in the Company’s

cumulative total shareholder return on its common stock with the cumulative return of the Russell 2000 and S&P U.S. BMI Banks Index. Such graph is incorporated herein by reference.

Item 6. [Removed and reserved]

The information required by this this Item 7 is contained in TrustCo’s Annual Report to Shareholders for the year ended December 31, 2024, which is filed as Exhibit 13 hereto and incorporated herein

by reference.

41

Index

Item 7A. Quantitative and Qualitative Disclosures about Market Risk

The information required by this Item 7A is contained in TrustCo’s Annual Report to Shareholders for the year ended December 31, 2024, which is filed as Exhibit 13 hereto and incorporated herein by

reference.

Item 8. Financial Statements and Supplementary Data

The consolidated financial statements, together with the report thereon of Crowe LLP, and the required supplementary financial data are included in TrustCo’s Annual Report to Shareholders for the year

ended December 31, 2024, which is filed as Exhibit 13 hereto and incorporated herein by reference.

None.

Item 9A. Controls and Procedures

Evaluation of Disclosure Controls and Procedures

An evaluation was carried out under the supervision and with the participation of the Company’s management, including the Chief Executive Officer and Chief Financial Officer, of the effectiveness of the

Company’s disclosure controls and procedures as of the end of the period covered by this report. Disclosure controls and procedures, as defined in Rule 13a-15(e) and

15d-15(e) under the Exchange Act, are procedures that are designed with the objective of ensuring that information required to be disclosed in the Company’s reports filed under the Exchange Act,

such as this 2024 Form 10-K, is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms. Disclosure controls and

procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by the Company in the reports that the Company files or submits under the Exchange Act is accumulated and

communicated to the Company’s management, including our principal executive and principal financial officer, to allow timely decisions regarding required disclosure. Management recognizes that any controls and procedures, no matter how well

designed and operated, can provide only reasonable assurance of achieving their objectives, and management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures.

Our management, with the participation of the Chief Executive Officer and Chief Financial Officer, has evaluated the effectiveness of the Company’s disclosure controls and procedures as of the end of the period covered by this 2024 Form

10-K. Based on such evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that, as of December 31, 2024, the Company’s disclosure controls and procedures were effective to

satisfy the objectives for which they are designed.

Management’s Report on Internal Control Over Financial Reporting and Auditor Attestation Report on Internal Control over Financial Reporting

Management’s Report on Internal Control over Financial Reporting, together with the report thereon of Crowe LLP is included in TrustCo’s Annual Report to Shareholders for the year ended December 31, 2024, which is filed as Exhibit 13 hereto, are incorporated herein by reference.

Changes in Internal Control over Financial Reporting

There have been no changes in the Company’s internal control over financial reporting (as defined in Rule 13a-15(f) and 15d-15(f) under the Exchange Act) that occurred during the Company’s quarter ended December 31, 2024 that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.

42

Index

Item 9B. Other Information

(a) None.

(b) During the fiscal quarter ended December 31, 2024, none of the Company’s directors or executive officers adopted or terminated a Rule 10b5-1 trading arrangement or a non-Rule 10b5-1 trading arrangement (each as defined in Item 408 of Regulation S-K under the

Securities Exchange Act of 1934, as amended).

Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections

Not applicable.

PART III

Item 10. Directors, Executive Officers and Corporate Governance

The information required by this Item 10 is incorporated herein by reference to the disclosure under the headings “Information on TrustCo Directors and Nominees,” “Information

on TrustCo Executive Officers,”“Director Candidates Nominated by Shareholders,” “Audit Committee,” and “Section 16(a) Beneficial

Ownership Reporting Compliance” in the Company’s Proxy Statement (Schedule 14A) for its 2025 Annual Meeting of Shareholders to be filed with the SEC within 120 days of

the Company’s fiscal year-end. TrustCo has adopted a code of conduct that applies to all employees, including its principal executive, financial and accounting officers. A copy of this code of conduct will

be provided without charge upon written request. Requests and inquiries should be directed to: Michael Hall, General Counsel and Corporate Secretary, TrustCo Bank Corp NY, P.O. Box 1082, Schenectady, New York 12301-1082. The Code of Conduct

also is available on the Company’s website at www.trustcobank.com under the “Investor Relations” link. The required information regarding TrustCo’s executive officers is contained in PART I in the item

captioned “Information about our Executive Officers.”

Insider Trading Policy

The Company has adopted the TrustCo Bank Corp NY Insider

Trading Policy (the “Insider Trading Policy”) that applies to all directors, officers, employees and certain other persons. The Insider Trading Policy is designed to promote compliance with insider trading laws, rules and regulations with

respect to the purchase, sale and/or other dispositions of the Company’s securities, as well as the applicable rules and regulations of The Nasdaq Stock Market, LLC. The Insider Trading Policy addresses

the implementation of certain trading blackout periods in the Company’s securities (including common stock, restricted stock, restricted stock units, options, warrants and any other securities that the Company may issue) for covered

persons. A copy of the Insider Trading Policy is filed as Exhibit 19 to this 2024 Form 10-K.

Item 11. Executive Compensation

The information required by this Item 11 is incorporated herein by reference to the Company’s Proxy Statement (Schedule 14A) for its 2025 Annual Meeting of Shareholders to be filed with the SEC within

120 days of the Company’s fiscal year-end.

43

Index

The following table provides information, as of December 31, 2024, regarding securities authorized for issuance under TrustCo’s equity compensation plans.

Equity compensation plan not approved by security holders N/A N/A N/A

The additional information required by this Item 12 is incorporated herein by reference to the Company’s Proxy Statement (Schedule 14A) for its 2025 Annual Meeting of Shareholders to be filed with the

SEC within 120 days of the Company’s fiscal year-end. Additional information concerning the Company’s equity compensation plans is set forth in Part II, Item 5 hereof.

The information required by this Item 13 is incorporated herein by reference to the Company’s Proxy Statement (Schedule 14A) for its 2025 Annual Meeting of Shareholders to be filed with the SEC within

120 days of the Company’s fiscal year-end.

Item 14. Principal Accountant Fees and Services

The information required by this Item 14 is incorporated herein by reference to the Company’s Proxy Statement (Schedule 14A) for its 2025 Annual Meeting of Shareholders to be filed with the SEC within

120 days of the Company’s fiscal year-end.

Our independent registered public accounting firm is Crowe LLP, Boston, Massachusetts, PCAOB Firm ID: 173

PART IV

Item 15. Exhibits, and Financial Statement Schedules

The following financial statements of TrustCo and its consolidated subsidiaries, and the accountants’ report thereon are filed as a part of this report.

Consolidated Statements of Condition -- December 31, 2024 and 2023.

Consolidated Statements of Income -- Years Ended December 31, 2024, 2023 and 2022.

44

Index

Consolidated Statements of Comprehensive Income -- Years Ended December 31, 2024, 2023 and 2022.

Consolidated Statements of Changes in Shareholders’ Equity -- Years Ended December 31, 2024, 2023 and 2022.

Consolidated Statements of Cash Flows -- Years Ended December 31, 2024, 2023 and 2022.

Notes to Consolidated Financial Statements.

Financial Statement Schedules

Not Applicable. All required schedules for TrustCo and its subsidiaries have been included in the consolidated financial statements or related notes thereto.

Supplementary Financial Information

Summary of Unaudited Quarterly Financial Information for the years ended December 31, 2024 and 2023.

Exhibits

Exhibit No. Description

45

Index

46

Index

47

Index

19† TrustCo Bank Corp NY Insider Trading Policy

48

Index

21† List of Subsidiaries of TrustCo.

23† Consent of Independent Registered Public Accounting Firm.

24† Power of Attorney.

101.INS XBRL Instance Document.

101.SCH Inline XBRL Taxonomy Extension Schema Document.

101.CAL Inline XBRL Taxonomy Extension Calculation Linkbase Document.

101.DEF Inline XBRL Taxonomy Extension Definition Linkbase Document.

101.LAB Inline XBRL Taxonomy Extension Label Linkbase Document.

101.PRE Inline XBRL Taxonomy Extension Presentation Linkbase Document.

* Management contract or compensatory plan or arrangement.

† Filed herewith.

Item 16. Form 10-K Summary

Not applicable.

49