Financial Institutions Inc's Suppliers Performance

Third party vendors provide key components of our business infrastructure such as internet connections, network access and core application processing. While we have selected these third party vendors carefully, we do not control their actions. Any problems caused by these third parties, including as a result of them not providing us their services for any reason or them performing their services poorly, could adversely affect our ability to deliver products and services to our customers or otherwise conduct our business efficiently and effectively. Replacing these third party vendors could also entail significant delay and expense.

Third parties perform significant operational services on our behalf. These third-party vendors are subject to similar risks as us relating to cybersecurity, breakdowns or failures of their own systems or employees. One or more of our vendors may experience a cybersecurity event or operational disruption and, if any such event does occur, it may not be adequately addressed, either operationally or financially, by the third-party vendor. Certain of our vendors may have limited indemnification obligations or may not have the financial capacity to satisfy their indemnification obligations. Financial or operational difficulties of a vendor could also impair our operations if those difficulties interfere with the vendor’s ability to serve us. If a critical vendor is unable to meet our needs in a timely manner or if the services or products provided by such a vendor are terminated or otherwise delayed and if we are not able to develop alternative sources for these services and products quickly and cost-effectively, it could have a material adverse effect on our business. Federal banking regulators recently issued regulatory guidance on how banks select, engage and manage their outside vendors. These regulations may affect the circumstances and conditions under which we work with third parties and the cost of managing such relationships.

Third party vendors provide key components of our business infrastructure such as internet connections, network access and core application processing. While we have selected these third party vendors carefully, we do not control their actions. Any problems caused by these third parties, including as a result of them not providing us their services for any reason or them performing their services poorly, could adversely affect our ability to deliver products and services to our customers or otherwise conduct our business efficiently and effectively. Replacing these third party vendors could also entail significant delay and expense.

Third parties perform significant operational services on our behalf. These third-party vendors are subject to similar risks as us relating to cybersecurity, breakdowns or failures of their own systems or employees. One or more of our vendors may experience a cybersecurity event or operational disruption and, if any such event does occur, it may not be adequately addressed, either operationally or financially, by the third-party vendor. Certain of our vendors may have limited indemnification obligations or may not have the financial capacity to satisfy their indemnification obligations. Financial or operational difficulties of a vendor could also impair our operations if those difficulties interfere with the vendor’s ability to serve us. If a critical vendor is unable to meet our needs in a timely manner or if the services or products provided by such a vendor are terminated or otherwise delayed and if we are not able to develop alternative sources for these services and products quickly and cost-effectively, it could have a material adverse effect on our business. Federal banking regulators recently issued regulatory guidance on how banks select, engage and manage their outside vendors. These regulations may affect the circumstances and conditions under which we work with third parties and the cost of managing such relationships.