CAUTIONARY STATEMENT REGARDING FORWARD- LOOKING STATEMENTS

This Proxy Statement contains forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. Forward-looking statements provide current expectations or forecasts of future results or events and include, among others:

These forward-looking statements are based on management’s current expectations and beliefs and are not guarantees of future results, nor should they be relied upon as representing management’s views as of any subsequent date. Forward-looking statements involve significant risks and uncertainties and actual results may differ materially from those presented, either expressed or implied, in this Proxy Statement. For a discussion of some of the risks and important factors that could cause actual results to differ from such forward-looking statements, please see the risks and other factors detailed from time to time in the Company’s most recent periodic reports on Form 10-K and Form 10-Q and other filings with the Securities and Exchange Commission (“SEC”).

We caution readers not to place undue reliance on any forward-looking statements, which speak only as of the date made. Except as required by law, we do not undertake, and specifically disclaim any obligation to publicly release any revisions to any forward-looking statements to reflect the occurrence of anticipated or unanticipated events or circumstances after the date of such statements.

NOTICE OF THE ANNUAL MEETING OF SHAREHOLDERS

2025 ANNUAL MEETING INFORMATION

To attend, vote and submit questions during the Annual Meeting, visit www.virtualshareholdermeeting.com/FISI2025 and enter the control number included in your Notice of Internet Availability of Proxy Materials, voting instruction form or proxy card. Online access to the webcast will open approximately 15 minutes prior to the start of the Annual Meeting.

For additional information about our Annual Meeting, see “Information About the Meeting” on page 81.

ANNUAL MEETING BUSINESS

The Annual Meeting of Shareholders of Financial Institutions, Inc. will be held for the following purposes:

Owners of Financial Institutions, Inc. common stock at the close of business on the meeting record date of April 2, 2025, or their legal proxy holders, are entitled to vote at our Annual Meeting.

YOUR VOTE IS IMPORTANT – HOW TO VOTE:

For more information on how to vote your shares, please refer to “Voting Matters” on page 81.

Please note that we are furnishing proxy materials and access to our Proxy Statement to our shareholders via the Internet instead of mailing printed copies to each of our shareholders. By doing so, we save costs and reduce our impact on the environment.

Beginning on April 14, 2025, we will mail or otherwise make available to each of our shareholders a Notice of Internet Availability of Proxy Materials, which contains instructions on how to access our proxy materials and vote online. If you attend the Annual Meeting virtually, you may withdraw your proxy and vote online during the Annual Meeting if you so choose.

Your vote is important, and we encourage you to vote promptly, whether or not you plan to attend the Annual Meeting.

Important Notice Regarding the Availability of Proxy Materials for the Annual Meeting to be Held on Wednesday, May 28, 2025: this proxy statement and the 2024 Annual Report, which includes our Annual Report on Form 10-K for the year ended December 31, 2024, are available at www.proxydocs.com/FISI and on our website www.FISI-Investors.com.

CORPORATE GOVERNANCE AND BOARD MATTERS

FII is the parent company for Five Star Bank and Courier Capital, LLC, which we collectively refer to in the proxy statement as the “Company,” “we,” “our” or “us.” Throughout the proxy statement, we refer to Five Star Bank as the “Bank.” We refer to our combined workforce as “Five Star.”

Our Corporate Governance Guidelines and other key governance policies and documents, including the charters for each of our standing Board committees, stock ownership requirements, and our codes of conduct and ethics are available on our website at www.FISI-Investors.com by clicking on “Governance,” then on “Governance Documents.” Information available on our website is not a part of, and is not incorporated into, this proxy statement.

SEPARATE CHAIR AND CHIEF EXECUTIVE OFFICER

The Board believes that effective corporate governance is best accomplished if the roles of Chair of the Board and Chief Executive Officer (“CEO”) are separated. The Board believes that separating these two positions allows each person to focus on their individual responsibilities, which is essential in the current business and economic environment. Under this structure, our CEO can focus attention on the day-to-day operations and performance of the Company and work to implement our long-term, Board-approved strategic plan. At the same time, our non-executive Chair of the Board can focus attention on long-term strategic issues, setting the agenda for and presiding at Board meetings, working collaboratively with other Board members and providing insight and guidance to our CEO through regular interaction.

BOARD OF DIRECTORS ROLE IN RISK OVERSIGHT

The Board is actively engaged in the oversight of the prudent management of risk and ensures strategic objectives are aligned with our risk appetite. The Board approves our Risk Appetite Statement, Enterprise Risk Management (“ERM”) Program, Compliance Management Program and Policy, Fair Lending Policy and Program, Community Reinvestment Act (“CRA”) Policy and Program, Bank Secrecy Act and Anti-Money Laundering (“BSA/AML”) Policy and Program, Codes of Conduct and Ethics, Information Security Program and Framework, and Risk Management Policy and approves updates to each annually to ensure that our risk framework remains relevant and current to address evolving external and internal risks. Our Board committees have subject matter expertise and conduct primary oversight of certain risks that may affect us. The Board’s Risk Oversight Committee has oversight of our credit, capital, liquidity and funding, market, strategic, operational, compliance (including Fair and Responsible Banking and CRA), legal, physical security, cybersecurity and electronic data processing risks, among others. The Board’s Audit Committee oversees disclosure of financial risks, including those that could arise from our accounting and financial reporting processes and from financial disclosure relative to cybersecurity and other matters, in addition to complaints that may raise material financial or ethical concerns. The Board’s Management Development and Compensation (“MD&C”) Committee oversees risks arising from our compensation policies and programs.

SUCCESSION PLANNING

The Board’s MD&C Committee has active oversight of our management succession and development plan, including discussion regarding performance of the Company’s leadership team with a focus on key positions at the senior and executive officer levels. This planning and recurring oversight reflects our strong commitment to recruiting, developing and retaining highly qualified senior and executive leaders, and our support for employee development and internal succession opportunities. Succession planning provides our organization alternatives in the event of both planned and unplanned succession needs.

Our Board believes that director refreshment is an important component of good corporate governance. More than half of the Board’s 11 independent directors joined since 2016. Three directors have joined since 2021 and a new director nominee is up for election this year. Board of Director succession planning is overseen by the Board’s Nominating and Governance (“Governance”) Committee and is further described on page 26.

SHAREHOLDER ENGAGEMENT

We believe that strong corporate governance includes consistent engagement with our shareholders. We engage with shareholders on a variety of topics and in a variety of ways throughout the year to ensure that we are addressing questions and concerns and to seek input on policies and practices. Members of our executive team, including our CEO and Chief Financial Officer (“CFO”), regularly engage in meaningful dialogue with our shareholders through quarterly earnings calls, industry conferences and other channels of communication. When shareholders are likely to have questions relevant to their areas of focus, other members of our executive management team, which may include our Chief Legal Officer and Corporate Secretary and Chief Human Resources Officer, participate in these communications. Topics discussed at these meetings are shared with our Board and our Board Chair is made available for meetings when requested by shareholders, reflecting the Board’s commitment to shareholder engagement.

In addition, we conduct an annual outreach to our largest shareholders and have conversations with corporate governance teams regarding corporate governance, financial performance, executive compensation and other topics of interest to our shareholders. Our most recent outreach effort, initiated in late 2024, included more than two dozen of our largest shareholders representing more than 50% of our outstanding shares. Shareholder feedback is regularly reviewed and considered by the Board and its committees and is reflected in adjustments to our policies and practices.

DIRECTOR RESIGNATION POLICY

Our Board has adopted a director resignation policy for director nominees who receive a majority of WITHHELD votes. The policy is incorporated into our Corporate Governance Guidelines. If the election is uncontested (the number of director nominees does not exceed the number of Board seats up for election and proxies are not being solicited by anyone other than us), once the vote has been tabulated and certified and it is established that a director nominee received more WITHHELD votes than FOR votes (with abstentions and broker non-votes not counted as either), the director must immediately submit his or her resignation to the Board.

On receipt of the resignation, the Board’s Governance Committee will evaluate what is in the best interests of the Company and its shareholders and will make a recommendation to the independent directors of the Board. The recommendation may include accepting or rejecting the resignation or taking other appropriate action, which may include addressing the perceived cause of the WITHHELD votes or determining that the director should not stand for re-nomination in the future. Within 90 days of the Annual Meeting, the independent directors will determine the action to be taken and a public announcement will be promptly made. Directors do not participate in deliberations or determinations relating to matters in which they have an interest.

DIRECTOR AND EXECUTIVE STOCK OWNERSHIP POLICIES

Stock Ownership Requirements

To demonstrate strong commitment to our Company and sound corporate governance, members of our Board and Executive Management Committee (“EMC”) (members identified by footnote 1 to Executive Officers listed on page 76) must comply with the Director and Executive Stock Ownership Requirements (“Stock Requirements”) approved by our Board. Annually, the Governance and MD&C Committees review the Stock Requirements for participant compliance of Directors and EMC members, respectively, and make recommended changes to the Board to ensure they remain current and reflective of industry practices and investor expectations. Current Stock Requirements are set forth below:

Pursuant to the Stock Requirements, directors and EMC members are deemed the owner of shares they own outright, shares owned indirectly (e.g. by a spouse or a trust) if the Participant has a pecuniary interest in such shares, vested restricted stock or other vested stock-based awards (excluding options) granted under FII or Five Star Bank’s incentive plans or other equity compensation arrangements, unvested restricted stock/units subject only to time-based vesting requirements and shares of our stock held by the individual in the Company stock fund of our 401(k) plan. Unexercised options and unvested performance-contingent shares/units are not counted towards meeting the requirements. No directors or officers held any stock options as of December 31, 2024.

In 2024, all directors and EMC members met the Stock Requirements.

Clawback Provisions

In connection with the SEC’s and Nasdaq’s rules requiring adoption of a clawback policy applicable to incentive-based compensation for Section 16 officers of listed companies, the Company has adopted the Financial Institutions, Inc. Clawback Policy. If the Company is required to restate its financial results due to material noncompliance with financial reporting requirements under the securities laws, the Company will recoup any erroneously awarded incentive-based compensation paid during the three completed fiscal years immediately preceding such restatement from the Company’s current and former Section 16 officers as set forth in this policy, provided that such individuals served as Section 16 officers at any time during the applicable performance period. Pursuant to the policy, the MD&C Committee shall determine the terms of any required repayment and its determination shall be final, conclusive, and binding. To date, no clawback action has been required.

Derivatives, Pledging and Hedging Policy

Our Insider Trading Policy prohibits all employees and members of our Board of Directors from pledging shares on margin, trading in derivative securities of our common stock or engaging in the purchase or sale of any other financial instruments (including forward contracts, equity swaps, collars and exchange funds) that are designed to hedge or offset any decrease in the market value of our common stock.

POLICY PROHIBITING INSIDER TRADING AND RELATED PROCEDURES

Our Insider Trading Policy governs the purchase, sale, and other dispositions of the registrant's securities by directors, senior management, and employees and we believe that it is reasonably designed to promote compliance with insider trading laws, rules and regulations, and the Nasdaq exchange listing standards. A copy of our Insider Trading Policy is filed as Exhibit 19 to our Annual Report on Form 10-K for the year ended December 31, 2024.

CODE OF ETHICS

Expectations for our directors, officers and employees are memorialized in our Code of Business Conduct and Ethics Policy (“Code of Ethics”) that is annually approved by our Board of Directors. The Code of Ethics is applicable to all employees and covers professional conduct, including, but not limited to, conflicts of interest, safeguarding of confidential information, protecting company assets, anti-trust compliance, fair and responsible banking, and financial responsibility. New and existing employees and directors (on an annual basis) are required to acknowledge receipt of and compliance with the Code of Ethics.

Additionally, we have a code of ethics for the CEO, CFO and senior financial officers that sets additional and heightened expectations for honest and ethical conduct and compliance with applicable laws, rules and regulations applicable to financial related matters (this code of ethics and the Code of Ethics collectively are referred to as “Ethics Codes”). Each applicable employee and director must annually review and affirm their intent to comply with the Ethics Codes.

Current versions of these codes may be viewed on our website at www.FISI-Investors.com by clicking on “Governance,” then on “Governance Documents.” Exceptions or an amendment to any provision of the Ethics Codes must be approved by the Chief Compliance Officer (“CCO”) and are reported to and ratified or approved by the Board. We intend to notify shareholders of any exceptions or amendments granted on our website at www.FISI-Investors.com. We did not grant any exceptions or approve any amendments during 2024 and our investor website includes the current versions of the Ethics Codes.

CERTAIN RELATIONSHIPS AND RELATED PARTY TRANSACTIONS

Our Related Party Transactions Policy is similarly reviewed and updated annually and provides for the handling and oversight of related party transactions, as defined under Item 404(a) of SEC Regulation S-K. Our CCO is notified when a potential related party transaction is being contemplated. Potential transactions are referred to the Board’s Audit Committee to determine whether the transaction is a related party transaction. If the Audit Committee determines that the potential transaction is a related party transaction, the Committee decides whether to approve or decline the proposed transaction. In determining whether to approve a potential related party transaction, the Audit Committee considers regulatory requirements, whether the transaction is consistent with the Ethics Codes, and all other factors it deems appropriate using its business judgment.

During 2024, we were not a party to any transaction or series of transactions, and there is not any currently proposed transaction, in which the amount involved exceeded $120,000 and which any director, executive officer or related party had or will have a direct or indirect material interest other than:

Before approving an extension of credit to an insider, the Bank’s Compliance team reviews the proposed extension of credit to ensure the Bank does not offer extensions of credit to insiders on a basis that gives preferential treatment, presents a conflict of interest, or involves more than normal risk of repayment. During 2024, certain of our directors and executive officers and their respective affiliates were customers of and had loans and/or other transactions with us. All such loans and other transactions were made in the ordinary course of business on substantially the same terms, including interest rates and collateral, as those prevailing at the time they were made for comparable loans and other transactions with persons not related to us. These loans and other transactions did not involve more than the normal risk of collectability or present other unfavorable features to the Company.

All loans to our directors and executive officers are subject to limitations contained in and made in compliance with the Federal Reserve Act and applicable regulations. Presently, we have such loans and expect to have similar loans with our directors, executive officers, 5% or greater shareholders and their affiliates in the future.

CORPORATE STRATEGY AND ENTERPRISE RISK MANAGEMENT

Our Board of Directors regularly reviews our strategy, the environment in which we operate, the Company’s risk profile and regulatory expectations, and the progress we are making toward the goals we set. Our Board has established a three-year strategic plan that clearly defines strategic priorities and underlying business unit objectives, which are set against a Board-approved Risk Appetite Statement. The Company’s Risk Appetite Statement summarizes the risk appetite for each Line of Business and the level and types of risk that the Company is willing to accept in executing its strategy. The Board reviews and approves updates to the three-year strategic plan annually to ensure that it remains current and relevant. The annual review process is robust with Directors assessing the strategic plan during a two-day offsite retreat, and Directors, the Board and its Executive Committee providing feedback through the fall of each year until the updated plan is approved by the Board at the beginning of each year, with appropriate key performance indicators that are reviewed throughout the year.

We remain committed to an effective and efficient risk and control environment. Our three-year strategic plan is firmly linked to our Risk Appetite Statement and Enterprise Risk Management (“ERM”) Program which are similarly approved by the Board each year.

Consistent with our commitment to ownership, accountability and transparency, our strategic plan and ERM Program each have metrics (key performance indicators/key risk indicators). The Board and its Executive Committee regularly track the status and progress of meeting strategic objectives, and the Board’s Risk Oversight Committee regularly oversees administration of the ERM Program and the level of the risk metrics set forth in it. The Board’s MD&C Committee tracks and evaluates executive performance against achievement of strategic initiatives while prudently managing associated risks.

Risk is an inherent part of our daily business and activities as a financial services institution. The Company’s success and reputation depend on effectively managing all risks it faces to the benefit of the Company’s shareholders, customers, and other stakeholders. We do this through robust and comprehensive risk management programs, underlying policies and controls, and the governance framework discussed earlier in which Management and Board Committees provide focused oversight over risk management. Our documented risk programs are updated at least annually and include the conduct of risk assessments and testing, complaint management with root cause analysis, the administration of appropriate training and Board oversight. The Company’s risk management philosophy focuses on achieving risk-adjusted returns through prudent risk-taking that is intended to protect shareholder value, manage unpredictability of risks, and minimize potential adverse impact on operating performance and financial condition.

An effective ERM program helps to holistically manage the various risks that the Company is exposed to in pursuit of its strategic objectives, including but not limited to strategic, credit, market, liquidity, operational, compliance, legal, and reputational risks through early identification of emerging internal and external issues or events which have the potential to impact our strategic objectives. The ERM program, coupled with an effective policy framework, allows us to establish appropriate risk mandates and limits, which enables and controls specific risk-taking activities. Management of risk is embedded into each level of the Company, with all associates responsible for the awareness and management of risks. This is done by specifying responsibilities through a “Three Lines of Defense” model where each line is overseen by the next, resulting in a strong risk management framework with independence and robust governance.

In 2024, we further strengthened our comprehensive risk governance framework by establishing two new management-level governance committees: the BSA/AML and OFAC Committee (“BAOC”) and the Fraud Prevention Committee (“FPC”). The BAOC is responsible for the effective administration of the BSA/AML and OFAC Program, while the FPC is responsible for the effective administration of fraud-related programs, controls, systems, policies, and procedures relative to the Anti-Fraud Program. Both of these committees provide comprehensive reporting to the management-level Company Risk Committee and the Risk Oversight Committee of the Board of Directors, and is chaired by our Chief Risk Officer (“CRO”).

Based on the complex and continuously evolving cybersecurity threat landscape, we established, manage and continually enhance an enterprise-wide Information Security Program (“ISP”). The ISP is based on the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”). The CSF provides guidance for organizations to better manage and reduce cybersecurity risk while helping organizations understand, assess, prioritize and communicate cybersecurity risks and mitigation. The ISP encompasses critical management components such as risk management, asset management, access controls, cyber awareness training, data security, detection and response, incident response and business continuity. The ISP is designed and implemented to comply with or exceed regulatory control requirements. Multiple internal and independent third-party assessments and audits are conducted annually to ensure our compliance with ISP policies, controls and regulatory requirements. The execution of the ISP relies on our committed investment in people, processes and technology. We have invested in market-leading technology and award-winning security partners to execute key processes that minimize risk and ensure the confidentiality, integrity and availability of Company assets.

The Board is actively engaged in the oversight and prudent management of risk, including those relating to cybersecurity and regulatory compliance. A comprehensive program update is delivered to the Board annually by the Chief Information Security Officer (“CISO”). The Board annually reviews and approves the ISP and related Information Security policies to ensure alignment with the Company’s risk appetite and strategic defense amidst the evolving cybersecurity risk landscape.

Effective risk management, which is further supported by our Company-wide, Board-approved ERM framework, is a priority for the Company’s leadership. This framework facilitates thorough and frequent communication and the appropriate escalation of risk matters, integrating risk management into a comprehensive Company-wide structure that facilitates the incorporation of risk assessments into strategic planning and decision-making processes across the Company.

Following a three lines of defense model, the Company’s risk management and compliance functions, respectively, operate independently from the lines of business, enabling second line of defense risk leaders to effectively challenge business leaders. The Company’s risk management and compliance functions are responsible for defining policies and frameworks for the management of risk across the Company. We also deploy a separate internal audit function that reports to the Board’s Audit Committee, and serves as the Company’s third line of defense to risk.

Given the complex and evolving nature of our lines of business, we invest time and resources in maintaining a risk management culture that is incisive and knowledgeable and subject to ongoing review and enhancement to align with our evolving risk profile.

Annually, our Board of Directors approves the ERM Program, and throughout the year, the Board’s Risk Oversight Committee oversees the performance and administration of it. Our incentive plans are reviewed by our CCO and CRO, as our second line of defense, before they are implemented. The CRO certifies that the incentive plans are in compliance with regulatory requirements and do not encourage inappropriate risk-taking. The MD&C Committee reviews the CRO’s annual incentive plan report and certification, providing requisite Board oversight.

BOARD COMPOSITION AND DIRECTOR NOMINEES

Director Independence and Qualifications

Our Corporate Governance Guidelines require that a majority of our directors be independent under the listing standards of the Nasdaq Stock Market (“Nasdaq”). Only one management director, generally the CEO, will be permitted to serve on our Board at any given time. A director will not be considered “independent” unless our Board affirmatively determines that the director meets the applicable requirements of the SEC and Nasdaq and has no relationship with the Company that would interfere with the exercise of his or her independent judgment. The Board and its Governance Committee have determined that each of our directors, except for President and CEO Martin K. Birmingham, is independent in accordance with the standards set forth by the SEC and Nasdaq.

One of the Board’s most important responsibilities is identifying, evaluating and selecting Board candidates. The Board’s Governance Committee is responsible for making recommendations to the Board relative to director succession and refresh, reviewing the qualifications of potential candidates and making recommendations to the Board regarding candidates for election and to fill vacancies that may occur between annual meetings of shareholders. The Board’s Governance Committee is also responsible for reviewing with the Board, on an annual basis, the appropriate skills and characteristics required of directors.

Consistent with the Corporate Governance Guidelines, the Board’s Governance Committee selects nominees for director based on character, expertise, sound judgment, ability to make independent analytical inquiries, business experiences, understanding of the Company’s business environment, ability to make time commitments to the Company, demonstrated teamwork and ability to bring unique and diverse perspectives and understandings to the Board.

The Board values variety of experiences, perspectives and skill sets among its individual directors. When identifying Board candidates, consistent with our Corporate Governance Guidelines, the pool of candidates from which the Board’s Governance Committee recommends nominees will include diverse candidates, considering the diversity of Board members’ skills, experiences, age, race, ethnicity, gender and sexual orientation, in addition to the qualities highlighted above. The Board seeks to balance the value that longevity of director service can bring to the Company with the value of new ideas, perspectives and insights that come with the addition of new members to the Board.

Composition of Our Directors

The Board believes that the composition of the board in terms of experience, perspectives, skill sets and background that our directors bring add value to its decision-making and oversight of the Company, and this is reflected in the make-up of the Board and in its ongoing commitment to director refreshment.

Of the Board’s current independent directors, three have joined in the last four years. Four of the six current directors who have joined our Board since 2016 are women or a racial or ethnic minority. Five of the seven Board leadership positions, or 71%, are chaired by women or a minority, including our Board Chair, Executive Committee Chair, and the Chairs of the Board’s Technology & Data, Risk Oversight and Governance Committees.

Tenure and Board Refreshment

Our Board believes that director refreshment is an important component of good corporate governance. More than half of the Board’s 11 independent directors joined since 2016. Three directors have joined since 2021 and a new director nominee is up for election this year. In 2021, the Board also elected a new Board chair. As outlined on page 21, the Board utilizes a skills matrix developed and approved by its Governance Committee to facilitate the comparison of its directors’ skills versus those deemed necessary to provide appropriate oversight over the Company’s operations and current strategy. The matrix serves as an important director succession planning tool the Board’s Governance Committee utilizes to recommend candidates to be nominated for election to the Board as it considers opportunities for director refreshment. The Board’s Governance Committee continued to discuss implementing age and term limits for members of our Board of Directors in 2024 and decided against recommending any changes observing the level of director refresh that has occurred, deep experience and significant contributions being made by directors, past shareholder voting history, the Company’s Director Resignation Policy and other factors bearing on director succession.

Board Self-Assessment

The Board is committed to regularly assessing its own performance to identify its strengths as well as areas in which it may improve performance. The annual self-evaluation process, which is established by the Board’s Governance Committee, involves each independent Director completing annual written evaluations of the performance of the Board Chair, each Board Committee, and the full Board, review and discussion of the results of the evaluations by both the Board’s Governance Committee and full Board and the consideration of actions to improve Board performance. In addition, to supplement the annual evaluation process of Board and Board Committee performance, the Chair of the Board meets with each director individually and shares constructive feedback received with the Board’s Governance Committee and the Board.

Shareholder Nominees

The Board’s Governance Committee will consider nominees for the Board recommended by shareholders. Information regarding this process is provided in our Corporate Governance Guidelines and in our Amended and Restated Bylaws (our “Bylaws”) and is further discussed in “Committees of the Board—Nominating & Governance Committee” on page 26.

COMMUNICATION WITH OUR BOARD

Shareholders may communicate with the Board of Directors or any individual director by sending the communication to the attention of our Corporate Secretary at our corporate headquarters at 220 Liberty Street, Warsaw, NY 14569. Any communication received will be forwarded to the Board or individual directors, as appropriate.

SUSTAINABILITY AND CORPORATE RESPONSIBILITY

At Five Star, we care deeply about promoting sustainable business practices that deliver long-term shareholder value and help to ensure that our associates and the customers and communities we serve thrive.

Grounded in the legacy of our community-oriented traditions representing rural Western New York State for more than 200 years, sustainability is embedded in our business practices.

Our commitment to corporate citizenship and sustainability starts at the top, with sustainable business practices serving as a core pillar of our Board-approved three-year strategic plan. Our strategic plan is directly linked to our Board-approved Risk Appetite Statement to ensure that execution of it is done prudently and mindful of evolving risks that impact our Company. These risks have been integrated into our Board-approved ERM Program, which facilitates direct periodic tracking and monitoring of a wide range of risks by our Board and Management team.

We believe that our steadfast commitment to environmentally conscious activity, socially responsible behavior and sound and transparent corporate governance is not only a prudent business practice but also our corporate responsibility, and in turn will support our long-term growth. Against this backdrop, our areas of sustainability and corporate responsibility focus include:

PROPOSAL 1. ELECTION OF DIRECTORS

Our Bylaws provide for a classified Board of Directors, with directors divided into three classes of approximately equal number. One class is typically elected at each annual meeting of shareholders for a term expiring at the third successive annual meeting and until their respective successors have been elected and qualified. The Board of Directors is authorized by our Bylaws to determine, from time to time, the number of directors that constitute our Board. The Board size is currently set at twelve members. The nominees for director at the 2025 Annual Meeting are:

Ms. VanGelder and Messrs. Birmingham, Harting and Schrader have been nominated by the Board of Directors, upon the recommendation of the Board’s Governance Committee, to stand for election for a term expiring at the Company’s annual meeting to be held in 2028 and until his or her respective successor is duly elected and qualified. Ms. Panzarella has been nominated to stand for election for a term expiring at the Company’s 2027 annual meeting and until her successor is duly elected and qualified.

The nominees recommended by the Board of Directors have consented to serve as nominees for election to the Board and to serve as members of the Board if elected by the Company’s shareholders. As of the date of this proxy statement, the Company has no reason to believe that any nominee will be unable or unwilling to serve if elected as a director. However, if for any reason a nominee becomes unable to serve or for good cause will not serve if elected, the Board, upon the recommendation of the Board’s Governance Committee, may designate substitute nominees, in which event the shares represented by proxies returned to us will be voted for such substitute nominees.

The following pages contain a biography of each director nominee and director continuing in office with information regarding the individual’s service as a director, business and other experiences, director positions and information regarding experiences, qualifications, attributes, and skills considered by the Board’s Governance Committee and the Board.

Ages shown are as April 2, 2025. No director, director nominee or executive officer has any family relationship with any director, executive officer or person nominated or chosen by the Company to become a director or executive officer.

BUSINESS EXPERIENCE AND QUALIFICATIONS OF DIRECTORS

DIRECTOR BIOGRAPHIES — NOMINEES

DIRECTOR BIOGRAPHIES — NOMINEES

DIRECTOR BIOGRAPHIES — NOMINEES

DIRECTOR BIOGRAPHIES — DIRECTORS CONTINUING IN OFFICE

DIRECTOR BIOGRAPHIES — DIRECTORS CONTINUING IN OFFICE

DIRECTOR BIOGRAPHIES — DIRECTORS CONTINUING IN OFFICE

DIRECTOR BIOGRAPHIES — DIRECTORS CONTINUING IN OFFICE

BOARD OF DIRECTORS SKILLS MATRIX

The Board utilizes a skills matrix developed and approved by its Governance Committee to facilitate the comparison of its directors’ skills versus those deemed necessary to provide appropriate oversight over the Company’s operations and current strategy. The matrix serves as an important director succession planning tool the Board’s Governance Committee utilizes to recommend candidates to be nominated for election to the Board.

Each year, the Board’s Governance Committee assesses the ongoing relevance of the skills set forth in the matrix and evaluates the skills included in the matrix against the Company’s strategy to ensure that director nominees have the complementary experience, qualifications, skills and attributes to provide requisite oversight over Company operations, including execution of the Company’s three-year strategic plan and delivering long-term shareholder value.

The Board’s Governance Committee ensures that the skills matrix directly aligns with the Company’s three-year strategic plan. Leadership and Strategic Development skills are not included in the matrix as these skills are a prerequisite to serving on the Board.

Financial Expert

Definition: Requires an understanding of generally accepted accounting principles and financial statements; experience applying such generally accepted accounting principles in connection with the accounting for estimates, accruals and reserves that are generally comparable to the estimates, accruals and reserves, if any, used in the Company’s financial statements; experience preparing or auditing financial statements that present accounting issues that are generally comparable to those raised by the Company’s financial statements; experience with internal controls and procedures for financial reporting; and an understanding of audit committee functions.

A person shall have acquired such attributes through:

Why we value this skill: We use this skill to identify Directors who not only meet the SEC definition of a financial expert but also have strong knowledge of or experience in accounting, financial reporting or auditing processes and standards. By using this elevated standard, we ensure that the Board has sufficient depth to effectively oversee the Company’s financial position and condition and the accurate reporting thereof, to assess the Company’s strategic objectives from a financial perspective and to ensure that we are well-positioned with successors to lead the Audit Committee if a change is needed.

Financial Services Industry Experience

Definition: Financial services industry experience outside of service on the FII and FSB Boards, such as serving on another board or working for a company that markets and sells banking, lending, investment or insurance products or services.

Why we value this skill: Experience in the financial services industry is vital in understanding, overseeing and reviewing our strategy, including opportunities and challenges facing our businesses. Directors with this skill have specific insight and expertise that will foster active participation in the development and implementation of our operating plan and business strategy.

Nonprofit Board Experience

Definition: A dedicated and significant commitment to community engagement through membership on a board or multiple boards of nonprofits or community organizations.

Why we value this skill: As a community bank, we are committed to creating a measurable impact in neighborhoods and communities across our geographic footprint and therefore value directors and nominees who seek out opportunities for community engagement and have experience working on nonprofit boards or civic and charitable entities.

Public Board Experience

Definition: Past or present board member of another publicly-traded company.

Why we value this skill: Service on the boards of other public companies provides directors with an understanding of corporate governance practices, trends and insights into board management, strong board and management accountability, protecting stakeholder interests, relations between the board and senior management, agenda setting, and succession planning.

Risk Oversight Experience

Definition: Experience assessing and mitigating significant competitive, regulatory, legal, cyber security, or technological risks across an enterprise. This experience should be employment-based and not based on board service. It could come from serving as a Chief Executive Officer, Chief Financial Officer, Chief Risk Officer, Chief Compliance Officer, General Counsel or similar senior executive role or through service as outside counsel or similar professional risk, compliance, or other advisor that focuses on these risks.

Why we value this skill: The Board plays a key role in risk oversight and closely monitors administration of the Company’s robust ERM Program. Therefore, we seek directors who can help identify, manage, and mitigate key risks, including cybersecurity, regulatory compliance, and human capital.

Technology & Digital Innovation Experience

Definition: Experience managing or developing core technology business functions, such as anticipating technological trends, and driving innovation and product development. The experience should be based on the director’s experience as an employee and not from service on a board.

Why we value this skill: Directors with an understanding of technology as both a challenge and an opportunity for growth can help address emerging needs and challenges for our business.

Mergers & Acquisitions Experience

Definition: Experience in evaluating, financing, executing, and implementing corporate development transactions involving publicly traded corporations.

Why we value this skill: A merger and acquisition strategy is an essential part of an overall growth strategy. We believe ongoing general dialogue around inorganic growth allows the Board to act decisively when a potential deal emerges. Directors with an understanding of mergers and acquisitions can assist the Board in evaluating potential deals and ensure that the transaction fits the Company’s strategy.

BOARD AND COMMITEE MEETINGS

The Board meets on a regularly scheduled basis throughout the year to review significant developments, act on matters that require Board approval and perform its oversight functions. The Board also conducts an annual two-day offsite retreat with meetings dedicated to strategic reflection and updating the Company’s three-year strategic plan. It also holds special meetings when an important matter requires Board action between regularly scheduled meetings. During 2024, our Board of Directors met 12 times. All directors attended more than 75% of the Board meetings and the meetings of Board committees on which they serve, during the periods in which they served.

COMMITTEES OF THE BOARD

The Board has six standing committees to assist in performing oversight functions: Audit, Executive, MD&C, Governance, Risk Oversight and Technology & Data. Board leadership and membership are established at least annually by the Board upon recommendations made by the Chair and the Board’s Governance Committee. All committees are comprised of independent directors, and accordingly, while Director Birmingham is an invited guest to attend Board Committee meetings, he is not included in the below table and the Committees meet outside his presence as appropriate. Committees function under written charters that outline their respective authority, membership, meetings, duties and responsibilities, along with the Company’s Corporate Governance Guidelines and Bylaws. Committee charters and the Corporate Governance Guidelines are reviewed and updated at least annually by the Board, on the review and recommendation of the Board’s Governance Committee, and are available on our website at www.FISI-Investors.com by clicking on “Governance,” then on “Governance Documents.”

The current composition of each committee of the Board and the number of meetings each committee held in 2024 are provided below. Our Directors may attend any Committee meeting, and it has been a practice for the Board Chair to attend, depending on her availability, all scheduled Board Committee meetings. Our CEO also attends all Board and Board Committee meetings and is excused as necessary to enable the Board and Board Committees to engage in independent discussion.

Audit Committee

The Audit Committee assists the Board in fulfilling its oversight and fiduciary responsibilities over the Company and its subsidiaries relative to financial controls and disclosures. The primary roles of the Audit Committee are to:

The Audit Committee is required to meet at least four times annually. In carrying out its responsibilities, the committee seeks, in its sole discretion and authority, appropriate third-party counsel and advisors and approves the associated fees and terms of engagement. The Board’s Governance Committee and the Board have affirmatively determined that all Audit Committee members are independent as defined by SEC rules and Nasdaq listing standards applicable to audit committees.

Mr. Glaser, who chairs the Committee, has been designated as the Company’s “audit committee financial expert” within the meaning of SEC regulations.

Executive Committee

The Executive Committee is charged with assisting the Board of Directors in fulfilling its oversight and fiduciary responsibilities over the Company and its subsidiaries relative to strategic planning and execution and corporate development activities. The Executive Committee’s primary roles are to:

The Executive Committee is required to meet at least four times annually and meets during the months in which there is no regular meeting of the Board.

Management Development & Compensation Committee

The MD&C Committee assists the Board in fulfilling its oversight and fiduciary responsibilities over the Company and its subsidiaries relative to the attraction, development, recognition, and retention of the Company’s senior leadership and the Company’s management compensation policies and practices. The MD&C Committee’s primary roles are to:

The MD&C Committee also:

The MD&C Committee is required to meet at least four times annually. In carrying out its responsibilities, the Committee seeks, in its sole discretion and authority, appropriate third-party counsel and advisors, including from an independent compensation consultant, and approves the associated fees and terms of engagement. The Board’s Governance Committee and the Board have affirmatively determined that all MD&C Committee members are independent as defined by Nasdaq listing standards applicable to compensation committees.

Nominating & Governance Committee

The Board’s Governance Committee is similarly required to meet at least four times each year and assists the Board in fulfilling its oversight and fiduciary responsibilities over the Company and its subsidiaries relative to governance matters. The Board’s Governance Committee’s primary roles are to:

The Board’s Governance Committee considers recommendations for director candidates made by shareholders. Such recommendations should be sent to the attention of our Corporate Secretary at our corporate headquarters. The Board’s Governance Committee evaluates all director candidates on the same basis, provided that current directors may be evaluated primarily based on their record of performance as a director of the Company. Consistent with our Corporate Governance Guidelines, all nominees should possess personal and professional integrity, good business judgment, and experience and skills that will enable them, in conjunction with current Board members, to effectively serve the long-term interests of the Company and its shareholders.

The Board’s Governance Committee considers whether the candidate is “independent” under applicable SEC rules and Nasdaq listing standards and whether the candidate fits the Board’s current and ongoing needs for geographic connections to the Company’s market region and professional expertise in its process of evaluating director candidates. The Board’s Governance Committee investigates and interviews director candidates as it deems necessary to make a fair evaluation. If a majority of the Board’s Governance Committee determines a candidate is qualified, the committee may propose the candidate to the Board as a nominee for election, to fill a vacancy, or to be held in reserve in a prospective director pool.

Our Corporate Governance Guidelines also task the Board’s Governance Committee with composing a Board of Directors that as a whole reflects diversity with respect to experience, gender, race, personal qualities and accomplishments. The committee implements this requirement through discussions and deliberations among committee members and assesses its effectiveness annually as part of its self-evaluation process.

The Board’s Governance Committee believes that the years of service provided by our continuing directors have given them unique knowledge of our business and the banking industry. The committee engages in a thorough vetting process of director nominees and an annual evaluation of each of our directors. This process helps provide for a Board that is engaged and refreshed when appropriate. The Board’s Governance Committee has discussed implementing age and term limits for members of our Board of Directors and determined that such limits are not currently needed given the current composition and contributions being made by our directors and the level of refresh that has occurred with the nominations and elections of three new directors in the past two years and six new directors over the past seven years. There has also been a significant refresh in Board leadership positions.

In carrying out its responsibilities, the committee seeks, in its sole discretion and authority, appropriate third-party counsel and advisors and approves the associated fees and terms of engagement.

Risk Oversight Committee

Pursuant to its charter, the Risk Oversight Committee is required to meet at least four times each year and is charged with assisting the Board in fulfilling its oversight and fiduciary responsibilities over the Company and its subsidiaries relative to risk oversight. The CRO and senior leaders in the organization engage and present regularly at committee meetings. Additionally, the CRO has independent access to the Chair of the Risk Oversight Committee. The Committee’s primary roles are to provide oversight of:

The Risk Oversight Committee assists the Board in its oversight of our risk appetite statement, including risk tolerance levels and limits consistent with our strategic objectives. It also reviews our ERM framework and processes, including those policies, procedures and practices employed to identify, measure, monitor and control our risk profile.

In performance of its oversight functions, the committee meets at least quarterly with our risk management leaders. At these meetings, the committee receives quarterly updates from management on the nature and management of all material risks, our cybersecurity risk profile and cybersecurity program initiatives, and performance of our overarching ERM Program and underlying BSA/AML, Fraud, Compliance, Credit, Market, Liquidity, Fair Lending, CRA, and Information Security programs.

Technology & Data Committee

The Technology & Data Committee assists the Board in fulfilling its oversight and fiduciary responsibilities over the Company and its subsidiaries relative to technology and enterprise data management. The Technology & Data Committee’s primary role is to oversee major technology investment, strategy, operational performance and trends that might affect our operations. The Bank’s Chief Information Officer (“CIO”) and the Chief Information Security Officer (“CISO”) engage and present at Committee meetings on various topics covering technology, data, and information security matters. The Committee’s responsibilities include: