Citizens & Northern Corp

● fraud and cyber malfunction risks as usage of artificial intelligence continues to expand

● fraud and cyber malfunction risks as usage of artificial intelligence continues to expand

Competition - All phases of the Corporation’s business are competitive. Some competitors are much larger in total assets and capitalization than the Corporation, have greater access to capital markets and can offer a broader array of financial services. There can be no assurance that the Corporation will be able to compete effectively in its markets. Additionally, the financial services industry is undergoing rapid technological change with frequent introductions of new technology-driven products and services, including those related to artificial intelligence, to technologies that automate functions previously performed manually, facilitate the ability of customers to engage in financial transactions and otherwise enhance the customer experience. Many of these initiatives take a significant amount of time to develop and implement, are tied to critical systems, and require substantial financial, human, and other resources. The investments by larger competitors in these initiatives may be more substantial than those of the Corporation, which may cause the Corporation to lose market share. Although the Corporation, in making such investments, takes steps to mitigate the risks and uncertainties associated with these initiatives, they are not always implemented on time, within budget, or without negative financial, operational, or customer impact and do not always perform as the Corporation or its customers expect. Moreover, costs associated with implementing technology-driven products or other services, or technology-related or other developments increasing the nature or level of competition, could have a material adverse effect on the Corporation’s business, financial condition, results of operations or liquidity.

Despite these security measures, the Corporation’s computer systems and infrastructure or those of third parties used by us to compile, process or store such information may be vulnerable to attacks by hackers or breached due to employee error, malfeasance, or other disruptions. Financial services institutions and companies engaged in data processing have reported breaches in the security of their websites or other systems, some of which have involved sophisticated and targeted attacks intended to obtain unauthorized access to sensitive information, destroy data, steal financial assets, disable or degrade service, or sabotage systems, often through the introduction of computer viruses or malware, cyber-attacks and other means. Denial of service attacks have been launched against a number of large financial services institutions. The Corporation may be subject to similar attacks in the future. Hacking and identity theft risks could cause serious reputational harm and financial loss to the Corporation. Cyber threats are rapidly evolving and the Corporation may not be able to anticipate or prevent all such attacks. Advancements in the use of artificial intelligence could lead to attacks by exploiting vulnerabilities to manipulate model outputs or bypass security controls. A breach of any kind could compromise systems and the information stored there could be accessed, damaged, locked up, or disclosed. A breach in security could result in legal claims, regulatory penalties, disruption in operations, and damage to the Corporation’s reputation, which could have a material adverse effect on the Corporation’s business, financial condition, results of operations or liquidity.

Artificial Intelligence Risks and Challenges - The Corporation or its third-party vendors, clients or counterparties may develop or incorporate artificial intelligence ("AI") technology in certain business processes, services, or products. The development and use of AI presents a number of risks and challenges to the Corporation's business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the U.S. and internationally, and includes regulatory schemes targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment, and other laws applicable to the use of AI. These evolving laws and regulations could require changes in the Corporation's implementation of AI technology and increase its compliance costs and the risk of non-compliance. AI models, particularly generative AI models, may produce output or take action that is incorrect, that reflects biases included in the data on which they are trained, that results in the release of private, confidential, or proprietary information, that infringes on the intellectual property rights of others, or that is otherwise harmful. In addition, the complexity of many AI models makes it difficult to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias, and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, the Corporation may rely on AI models developed by third parties, and, to that extent, would be dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which the Corporation may have limited visibility. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures.

Similar wording appears in 29 other banks' reports.

● fraud and cyber malfunction risks as usage of artificial intelligence continues to expand

7 Current Strategic Focus •Target business segments we know and understand •Integrate C&N relationship model for the benefit of established Susquehanna market team •Blending digital with personal/physical access Relationship Banking Model •Delivering results from cloud migration and API integrations across systems. •Expanded Salesforce ecosystem to CRM, case management, project management and digital account opening. •Deploying AI-powered tools to improve operational efficiency. Technology-Driven Business Transformation •Ongoing Board refreshment, including addition of Christian Trate from Susquehanna and Susan Hartley’s recent retirement due to health issues •Recent additions from Susquehanna of EVP and Strategic Advisor and Region President Leadership, Management and Board Development •Further deployment of strong capital base •Organic growth •Multiple business lines •Opportunistic M&A – Banks and Wealth Growth Strategy •Strategic investing in people, new markets and technology •Expansion of scale with Susquehanna acquisition provides opportunity for potentially significant earnings growth while sustaining solid risk profile •Position the stock to be fairly valued through growth in EPS, dividends and share repurchases Shareholder Value

● fraud and cyber malfunction risks as usage of artificial intelligence continues to expand

● fraud and cyber malfunction risks as usage of artificial intelligence continues to expand

● fraud and cyber malfunction risks as usage of artificial intelligence continues to expand

Competition - All phases of the Corporation’s business are competitive. Some competitors are much larger in total assets and capitalization than the Corporation, have greater access to capital markets and can offer a broader array of financial services. There can be no assurance that the Corporation will be able to compete effectively in its markets. Additionally, the financial services industry is undergoing rapid technological change with frequent introductions of new technology-driven products and services, including those related to artificial intelligence, to technologies that automate functions previously performed manually, facilitate the ability of customers to engage in financial transactions and otherwise enhance the customer experience. Many of these initiatives take a significant amount of time to develop and implement, are tied to critical systems, and require substantial financial, human, and other resources. The investments by larger competitors in these initiatives may be more substantial than those of the Corporation, which may cause the Corporation to lose market share. Although the Corporation, in making such investments, takes steps to mitigate the risks and uncertainties associated with these initiatives, they are not always implemented on time, within budget, or without negative financial, operational, or customer impact and do not always perform as the Corporation or its customers expect. Moreover, costs associated with implementing technology-driven products or other services, or technology-related or other developments increasing the nature or level of competition, could have a material adverse effect on the Corporation’s financial condition, results of operations or liquidity.

Despite these security measures, the Corporation’s computer systems and infrastructure or those of third parties used by us to compile, process or store such information may be vulnerable to attacks by hackers or breached due to employee error, malfeasance, or other disruptions. Financial services institutions and companies engaged in data processing have reported breaches in the security of their websites or other systems, some of which have involved sophisticated and targeted attacks intended to obtain unauthorized access to sensitive information, destroy data, steal financial assets, disable or degrade service, or sabotage systems, often through the introduction of computer viruses or malware, cyber-attacks and other means. Denial of service attacks have been launched against a number of large financial services institutions. The Corporation may be subject to similar attacks in the future. Hacking and identity theft risks could cause serious reputational harm and financial loss to the Corporation. Cyber threats are rapidly evolving and the Corporation may not be able to anticipate or prevent all such attacks. Advancements in the use of artificial intelligence could lead to attacks by exploiting vulnerabilities to manipulate model outputs or bypass security controls. A breach of any kind could compromise systems and the information stored there could be accessed, damaged, locked up, or disclosed. A breach in security could result in legal claims, regulatory penalties, disruption in operations, and damage to the Corporation’s reputation, which could have a material adverse effect on the Corporation’s financial condition, results of operations or liquidity.

Artificial Intelligence Risks and Challenges - The Corporation or its third-party vendors, clients or counterparties may develop or incorporate artificial intelligence ("AI") technology in certain business processes, services, or products. The development and use of AI presents a number of risks and challenges to the Corporation's business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the U.S. and internationally, and includes regulatory schemes targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment, and other laws applicable to the use of AI. These evolving laws and regulations could require changes in the Corporation's implementation of AI technology and increase its compliance costs and

the risk of non-compliance. AI models, particularly generative AI models, may produce output or take action that is incorrect, that reflects biases included in the data on which they are trained, that results in the release of private, confidential, or proprietary information, that infringes on the intellectual property rights of others, or that is otherwise harmful. In addition, the complexity of many AI models makes it difficult to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias, and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, the Corporation may rely on AI models developed by third parties, and, to that extent, would be dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which the Corporation may have limited visibility. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures.

Similar wording appears in 28 other banks' reports.

Safe Harbor Statement: Except for historical information contained herein, the matters discussed in this release are forward-looking statements. Investors are cautioned that all forward-looking statements involve risks and uncertainty, including without limitation, the following: changes in monetary and fiscal policies of the Federal Reserve Board and the U.S. Government, particularly related to changes in interest rates; changes in general economic conditions; the potential for adverse developments in the banking industry that could have a negative impact on customer confidence, sources of liquidity and capital funding, and regulatory responses to such developments; C&N’s credit standards and its on-going credit assessment processes might not protect it from significant credit losses; legislative or regulatory changes; downturn in demand for loan, deposit and other financial services in C&N’s market area; increased competition from other banks and non-bank providers of financial services; technological changes and increased technology-related costs; information security breach or other technology difficulties or failures; changes in accounting principles, or the application of generally accepted accounting principles; and fraud and cyber malfunction risks as usage of artificial intelligence continues to expand. Citizens & Northern disclaims any intention or obligation to publicly update or revise any forward-looking statements, whether as a result of events or circumstances after the date hereof or to reflect the occurrence of unanticipated events.

Safe Harbor Statement: Except for historical information contained herein, the matters discussed in this release are forward-looking statements. Investors are cautioned that all forward-looking statements involve risks and uncertainty, including without limitation, the following: changes in monetary and fiscal policies of the Federal Reserve Board and the U.S. Government, particularly related to changes in interest rates; changes in general economic conditions; recent adverse developments in the banking industry highlighted by high-profile bank failures and the potential impact of such developments on customer confidence, sources of liquidity and capital funding, and regulatory responses to these developments; C&N’s credit standards and its on-going credit assessment processes might not protect it from significant credit losses; legislative or regulatory changes; downturn in demand for loan, deposit and other financial services in C&N’s market area; increased competition from other banks and non-bank providers of financial services; technological changes and increased technology-related costs; information security breach or other technology difficulties or failures; changes in accounting principles, or the application of generally accepted accounting principles; failure to achieve merger-related synergies and difficulties in integrating the business and operations of acquired institutions; and fraud and cyber malfunction risks as usage of artificial intelligence continues to expand. Citizens & Northern disclaims any intention or obligation to publicly update or revise any forward-looking statements, whether as a result of events or circumstances after the date hereof or to reflect the occurrence of unanticipated events.

Safe Harbor Statement: Except for historical information contained herein, the matters discussed in this release are forward-looking statements. Investors are cautioned that all forward-looking statements involve risks and uncertainty, including without limitation, the following: changes in monetary and fiscal policies of the Federal Reserve Board and the U.S. Government, particularly related to changes in interest rates; changes in general economic conditions; recent adverse developments in the banking industry highlighted by high-profile bank failures and the potential impact of such developments on customer confidence, sources of liquidity and capital funding, and regulatory responses to these developments; C&N’s credit standards and its on-going credit assessment processes might not protect it from significant credit losses; legislative or regulatory changes; downturn in demand for loan, deposit and other financial services in C&N’s market area; increased competition from other banks and non-bank providers of financial services; technological changes and increased technology-related costs; information security breach or other technology difficulties or failures; changes in accounting principles, or the application of generally accepted accounting principles; failure to achieve merger-related synergies and difficulties in integrating the business and operations of acquired institutions; and fraud and cyber malfunction risks as usage of artificial intelligence continues to expand. Citizens & Northern disclaims any intention or obligation to publicly update or revise any forward-looking statements, whether as a result of events or circumstances after the date hereof or to reflect the occurrence of unanticipated events.

Safe Harbor Statement: Except for historical information contained herein, the matters discussed in this release are forward-looking statements. Investors are cautioned that all forward-looking statements involve risks and uncertainty, including without limitation, the following: changes in monetary and fiscal policies of the Federal Reserve Board and the U.S. Government, particularly related to changes in interest rates; changes in general economic conditions; recent adverse developments in the banking industry highlighted by high-profile bank failures and the potential impact of such developments on customer confidence, sources of liquidity and capital funding, and regulatory responses to these developments; C&N’s credit standards and its on-going credit assessment processes might not protect it from significant credit losses; legislative or regulatory changes; downturn in demand for loan, deposit and other financial services in C&N’s market area; increased competition from other banks and non-bank providers of financial services; technological changes and increased technology-related costs; information security breach or other technology difficulties or failures; changes in accounting principles, or the application of generally accepted accounting principles; failure to achieve merger-related synergies and difficulties in integrating the business and operations of acquired institutions; and fraud and cyber malfunction risks as usage of artificial intelligence continues to expand. Citizens & Northern disclaims any intention or obligation to publicly update or revise any forward-looking statements, whether as a result of events or circumstances after the date hereof or to reflect the occurrence of unanticipated events.

Competition - All phases of the Corporation’s business are competitive. Some competitors are much larger in total assets and capitalization than the Corporation, have greater access to capital markets and can offer a broader array of financial services. There can be no assurance that the Corporation will be able to compete effectively in its markets. Additionally, the financial services industry is undergoing rapid technological change with frequent introductions of new technology-driven products and services, including those related to artificial intelligence, to technologies that automate functions previously performed manually, facilitate the ability of customers to engage in financial transactions and otherwise enhance the customer experience. Many of these initiatives take a significant amount of time to develop and implement, are tied to critical systems, and require substantial financial, human, and other resources. The investments by larger competitors in these initiatives may be more substantial than those of the Corporation, which may cause the Corporation to lose market share. Although the Corporation, in making such investments, takes steps to mitigate the risks and uncertainties associated with these initiatives, they are not always implemented on time, within budget, or without negative financial, operational, or customer impact and do not always perform as the Corporation or its customers expect. Moreover, costs associated with implementing technology-driven products or other services, or technology-related or other developments increasing the nature or level of competition, could have a material adverse effect on the Corporation’s financial condition, results of operations or liquidity.

cause serious reputational harm and financial loss to the Corporation. Cyber threats are rapidly evolving and the Corporation may not be able to anticipate or prevent all such attacks. Advancements in the use of artificial intelligence could lead to attacks by exploiting vulnerabilities to manipulate model outputs or bypass security controls. A breach of any kind could compromise systems and the information stored there could be accessed, damaged, locked up, or disclosed. A breach in security could result in legal claims, regulatory penalties, disruption in operations, and damage to the Corporation’s reputation, which could have a material adverse effect on the Corporation’s financial condition, results of operations or liquidity.

• Business Applications & Integrations (via Application Programming Interfaces, or APIs) • Converted to a modern Credit Card platform, greatly improving customer experience, creating new revenue opportunities • Salesforce Financial Services Cloud (FSC) continues to drive workflow efficiency in bank operations; processing data analytics is used to prioritize process re-engineering and process automation efforts • In final testing phase of consolidation of Customer Sales (CRM) processes on Salesforce • Evaluating strategies for Call Center integration to the same Salesforce platform • Evaluating Microsoft Azure AI (ChatGPT) services • Data & Analytics • Central data warehouse, powered by Snowflake, supports business critical data processing and analytics applications; it also acts as a data hub to provide clean, governed data to business applications • Developed and currently piloting machine learning (ML) based models to predict deposit accounts churn • Cloud Migration • Advanced from “lift-and-shift” strategy to strategic use of AWS and other cloud services to control costs and better manage overall technology risk • Actively seeking best in class Software as a Service (SaaS) solutions like Salesforce to accelerate business process transformation and cloud technology adoption • Organizational Structure Evolving • Technology, Operations and Digital departments are transforming to support agility, customer focus and speed of execution by recruiting and re-training staff in key tech centric roles 26 Strategic Technology Initiatives & Digital Transformation