The disclosures set forth in this item are qualified by Item 1A. Risk Factors and the section captioned “Forward-Looking Statements” in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations of this report and other cautionary statements set forth elsewhere in this report.

Sterling Bancorp

Sterling Bancorp (“we,” “our,” “ours,” or “us”) is a Delaware corporation, bank holding company and financial holding company that owns all of the outstanding shares of common stock of its principal subsidiary, Sterling National Bank (the “Bank”). At December 31, 2016 , we had, on a consolidated basis, $14.2 billion in assets, $10.1 billion in deposits, stockholders’ equity of $1.9 billion and 135,257,570 shares of common stock outstanding. Our financial condition and results of operations are discussed herein on a consolidated basis with the Bank.

As you review the following disclosures about our business you should be aware of the following recent significant transactions and events, which are discussed below:

November 2016 Common Equity Capital Raise

On November 22, 2016 , we issued 4,370,000 shares of our common stock in a public offering at $ 20.95 per share. We received proceeds net of underwriting discounts, commissions and expenses of $91.0 million. The net proceeds were used for general corporate purposes and to support growth in earning assets, including loan originations and purchases of investment securities.

Subordinated Notes Issuance

On March 29, 2016 , the Bank issued $110.0 million aggregate principal amount of 5.25% fixed-to-floating rate subordinated notes due 2026 (the “Subordinated Notes”) through a private placement at a discount of 1.25% . On September 2, 2016 , the Bank reopened the Subordinated Notes offering and issued an additional $65.0 million principal amount of Subordinated Notes. The Subordinated Notes issued September 2, 2016 are fully fungible with, rank equally in right of payment with, and form a single series with the Subordinated Notes issued on March 29, 2016. The Subordinated Notes are unsecured, subordinated obligations of the Bank and are subordinated in right of payment to all of the Bank’s existing and future senior indebtedness, including claims of depositors and general creditors. The Subordinated Notes qualify as Tier 2 capital for regulatory purposes.

Acquisition of Restaurant Franchise Financing Loan Portfolio

On September 9, 2016 , the Bank acquired a restaurant franchise financing loan portfolio from GE Capital with an unpaid principal balance of approximately $169.8 million . Total cash paid for the portfolio was  $163.3 million , which included a discount to the balance of gross loans receivable of  4.00% , or  $6.8 million , plus accrued interest receivable. As the acquired assets did not constitute a business, the transaction was accounted for as an asset purchase. These loans are included in traditional commercial and industrial loans. See Note 4. “Portfolio Loans” in the notes to consolidated financial statements for additional information.

Acquisition of NewStar Business Credit LLC

On March 31, 2016 , we acquired 100% of the outstanding equity interests of NewStar Business Credit LLC (“NSBC” and the “NSBC Acquisition”). NSBC’s loans had a fair value of $320.4 million on the acquisition date. We paid a premium on the balance of gross loans receivable acquired of 5.90%, or $18.9 million . The NSBC Acquisition was an all cash transaction with a value of $346.7 million ; the transaction doubled the size of our asset-based lending portfolio and expanded the geographic footprint of our asset-based lending business.

Acquisition of Hudson Valley Holding Corp.

On June 30, 2015 , we completed the acquisition of Hudson Valley Holding Corp. (“HVHC”), which we refer to as the “HVB Merger.” The HVB Merger was a stock-for-stock transaction valued at $566.3 million based on the closing price of our common stock on June 29, 2015 , $14.63 per share. Under the terms of the HVB Merger, HVHC shareholders received 1.92 shares of our common stock for each share of HVHC common stock. The HVB Merger has furthered our strategy of expanding in the greater New York metropolitan region by providing us with a significant presence and deposit market share in Westchester County, New York, and created an opportunity to realize significant operating expense savings. See additional disclosure regarding the HVB Merger in Note 2. “Acquisitions” in the notes to consolidated financial statements.

February 2015 Common Equity Capital Raise

On February 11, 2015 , we issued 6,900,000 shares of our common stock to institutional investors at $13.00 per share. We received proceeds net of underwriting discounts, commissions and expenses of $85.1 million . The net proceeds were used for general corporate purposes and the funding of acquisitions of specialty commercial lending businesses, such as the acquisition of Damian Services Corporation, a payroll finance services provider (the “Damian Acquisition”), which closed on February 27, 2015 and the acquisition of a factoring portfolio (the “FCC Acquisition”) from FCC, LLC, a subsidiary of First Capital Holdings, Inc. which closed on May 7, 2015 . See additional disclosure regarding these acquisitions in Note 2. “Acquisitions” included in the notes to consolidated financial statements.

Change in Fiscal Year End

On January 27, 2015, the Board of Directors (the “Board”) amended our bylaws to change our fiscal year end from September 30 to December 31. Accordingly, this annual report on Form 10-K includes financial statements as of and for (i) the calendar years ended December 31, 2016 and 2015 ; (ii) the three month period October 1, 2014 through December 31, 2014; (iii) the three month period October 1, 2013 through December 31, 2013; (iv) and the fiscal year ended September 30, 2014.

Acquisition of Sterling Bancorp (“Provident Merger”)

We were formerly known as Provident New York Bancorp (“Legacy Provident”), a Delaware Corporation founded in 1888, and the parent company of the Bank, formerly called Provident Bank. On October 31, 2013, we acquired Sterling Bancorp (“Legacy Sterling”) through a merger with Legacy Provident as the accounting acquirer and surviving entity. At that time, we became a bank holding company and a financial holding company as defined by the Bank Holding Company Act of 1956, as amended, or the BHC Act. In addition, Legacy Sterling’s principal subsidiary, Sterling National Bank, merged into our principal subsidiary, the Bank, which was then called Provident Bank. We changed our name to “Sterling Bancorp” and the Bank changed its legal entity name to “Sterling National Bank.” We refer to the transactions detailed above collectively as the “Provident Merger.”

The Provident Merger was a stock-for-stock transaction valued at $457.8 million based on the closing price of our common stock on October 31, 2013 . Under the terms of the Provident Merger, each share of Legacy Sterling was converted into the right to receive 1.2625 shares of our common stock. Consistent with our strategy of expanding in the greater New York metropolitan region, the Provident Merger created a larger, more diversified company and accelerated the build-out of our differentiated strategy targeting small-to-middle market commercial clients and consumers. See additional disclosure regarding the Provident Merger in Note 2. “Acquisitions” in the notes to consolidated financial statements.

Sterling National Bank

The Bank is a full-service regional bank founded in 1888. Headquartered in Montebello, New York, the Bank specializes in the delivery of services and solutions to business owners, their families and consumers within the communities we serve through teams of dedicated and experienced relationship managers. The Bank offers a complete line of commercial, business, and consumer banking products and services. As of December 31, 2016 , the Bank had $14.1 billion in assets, $10.1 billion in deposits and 970 full-time equivalent employees.

Subsidiaries

We conduct substantially all of our operations through the Bank. The Bank maintains a number of wholly-owned subsidiaries, including a company that originates loans to municipalities and governmental entities and acquires securities issued by state and local governments, a real estate investment trust that holds real estate mortgage loans, several subsidiaries that hold foreclosed properties acquired by the Bank, and other subsidiaries that have an immaterial impact on our financial condition or results of operations.

Additional Information

Our website (www.sterlingbancorp.com) contains a direct link to our filings with the Securities and Exchange Commission (the “SEC”), including copies of annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and amendments to these filings, registration statements on Form S-3 and Form S-4, as well as ownership reports on Forms 3, 4 and 5 filed by our directors and executive officers. Copies may also be obtained, without charge, by written request to Sterling Bancorp, 400 Rella Boulevard, Montebello, New York 10901, Attention: Investor Relations. Our website is not part of this Annual Report on Form 10-K.

Strategy

Through the Bank, we operate as a regional bank providing a broad offering of deposit, lending and wealth management products to commercial, consumer and municipal clients in our market area. We focus mainly on delivering products and services to small and

middle market commercial businesses and affluent consumers.  We believe that this is a client segment that is underserved by larger bank competitors in our market area.

Our primary strategic objective is to generate sustainable growth in revenues and earnings. To achieve this goal, we focus on the following initiatives:

The Bank targets the following geographic markets: (i) the New York Metro Market, which includes Manhattan and Long Island; and (ii) the New York Suburban Market, which includes Rockland, Orange, Sullivan, Ulster, Putnam and Westchester counties in New York and Bergen County in New Jersey. The Bank also originates loans and deposits in select markets nationally through our asset-based lending, payroll finance, factored receivables, equipment finance, public sector finance and warehouse lending businesses. We believe the Bank operates in an attractive footprint that presents us with significant opportunities to execute our strategy of targeting small and middle market commercial clients and affluent consumers.

We deploy a team-based distribution strategy in which clients are served by a focused and experienced group of relationship managers that are responsible for all aspects of the client relationship and delivery of our products and services. The Bank’s growth in 2016 was mainly through organic originations of loans and deposits through our commercial banking teams and was supplemented with the two commercial finance acquisitions described above. As of December 31, 2016 , the Bank had 30 commercial banking teams and we expect to continue to grow deposits and loan balances through the growth of existing teams and the addition of new teams.

Since 2012, we have deemphasized our retail banking operations, which has included the consolidation of under productive financial centers and other consumer businesses, such as wealth management and title insurance, in which we did not have economies of scale or competitive advantages. For the year ended December 31, 2016 , we consolidated 12 financial center locations and reduced our total number of financial centers to 42 . In addition, we divested our residential mortgage originations business and our trust division, which were not part of our core business plan and strategy. We anticipate we will continue to consolidate additional under productive financial centers in 2017 and focus on maintaining a network of financial centers in which all locations meet our productivity and profitability goals and which we can use to generate meaningful deposit growth. We will reallocate a portion of the operating expense savings from these divestitures into the recruitment of new commercial teams and into growing our commercial finance businesses.

We focus on building client relationships that allow us to gather low cost, core deposits and originate high quality loans. We maintain a disciplined pricing strategy on deposits that allows us to compete for loans while maintaining an appropriate spread over funding costs. We offer diverse loan products to commercial businesses, real estate owners, real estate developers and consumers. We have continued to emphasize growth in our commercial loan balances and, as a result, we believe that we have a high quality, diversified loan portfolio with a favorable mix of loan types, maturities and yields. 

 

We augment organic growth with opportunistic acquisitions of banks and other financial services businesses. For the periods presented, we completed the following acquisitions: the Provident Merger on October 31, 2013 ; the Damian Acquisition on February 27, 2015 ; the FCC Acquisition on May 7, 2015 ; the HVB Merger on June 30, 2015 ; the NSBC Acquisition on March 31, 2016; and the restaurant franchise financing loan portfolio from GE Capital on September 9, 2016. These acquisitions have supported our expansion into attractive markets and have diversified our business lines. See additional disclosure of our acquisitions in Note 2. “Acquisitions” in the notes to consolidated financial statements.

Competition

The greater New York metropolitan region is a highly competitive market area with a concentration of financial institutions, many of which are significantly larger institutions with greater financial resources than us, and many of which are our competitors to varying degrees. Our competition for loans comes principally from commercial banks, savings banks, mortgage banking companies, credit unions, insurance companies and other financial services companies. Our most direct competition for deposits has historically come from commercial banks, savings banks and credit unions. We face additional competition for deposits from non-depository

competitors such as mutual funds, securities and brokerage firms and insurance companies. We have emphasized relationship banking and the advantage of local decision-making in our banking business. We do not rely on any individual, group, or entity for a material portion of our deposits. Net interest income could be adversely affected should competitive pressures cause us to increase the interest rates paid on deposits in order to maintain our market share.

Employees

As of December 31, 2016 , we had 970 full-time equivalent employees. The employees are not represented by a collective bargaining unit and we consider our relationship with our employees to be good.

Supervision and Regulation

General

We and the Bank are subject to extensive regulation under federal and state laws, significant elements of which are described below. This description is qualified in its entirety by reference to the full text of the statutes, regulations and policies that are described. Also, such statutes, regulations and policies are continually under review by Congress and state legislatures and federal and state regulatory agencies. A change in statutes, regulations or regulatory policies applicable to us and our subsidiaries could have a material effect on the business, financial condition and results of operations. As the Bank’s total assets exceed $10 billion, it is subject to additional supervision and regulation, including by the Consumer Financial Protection Bureau (“CFPB”), with such additional supervision and regulation discussed throughout this section.

Regulatory Agencies

We are a legal entity separate and distinct from the Bank and its other subsidiaries. As a bank and a financial holding company, we are regulated under the Bank Holding Company Act of 1956, as amended (“BHC Act”), and our subsidiaries are subject to inspection, examination and supervision by the Federal Reserve Board (“FRB”) as our primary federal regulator.

As a national bank, the Bank is principally subject to the supervision, examination and reporting requirements of the Office of the Comptroller of the Currency (the “OCC”), as its primary federal regulator, as well as the Federal Deposit Insurance Corporation (the “FDIC”). Further, because the Bank’s total assets exceed $10 billion, it is also subject to the CFPB’s supervision. Insured banks, including the Bank, are subject to extensive regulations that relate to, among other things: (a) the nature and amount of loans that may be made by the Bank and the rates of interest that may be charged; (b) types and amounts of other investments; (c) branching; (d) permissible activities; (e) reserve requirements; and (f) dealings with officers, directors and affiliates.

Bank Holding Company Activities

In general, the BHC Act limits the business of bank holding companies to banking, managing or controlling banks and other activities that the FRB has determined to be so closely related to banking as to be a proper incident thereto. In addition, bank holding companies that qualify and elect to be financial holding companies such as us, may engage in any activity, or acquire and retain the shares of a company engaged in any activity, that is either (i) financial in nature or incidental to such financial activity (as determined by the FRB in consultation with the Secretary of the Treasury) or (ii) complementary to a financial activity and does not pose a substantial risk to the safety and soundness of depository institutions or the financial system generally (as solely determined by the FRB), without prior approval of the FRB.

To maintain financial holding company status, a financial holding company and all of its depository institution subsidiaries must be “well capitalized” and “well managed.” A depository institution subsidiary is considered to be “well capitalized” if it satisfies the requirements for this status discussed in the section captioned “Prompt Corrective Action.” A depository institution subsidiary is considered “well managed” if it received a composite rating and management rating of at least “satisfactory” in its most recent examination. A financial holding company’s status will also depend upon it maintaining its status as “well capitalized” and “well managed” under applicable FRB regulations. If a financial holding company ceases to meet these capital and management requirements, the FRB’s regulations provide that the financial holding company must enter into an agreement with the FRB to comply with all applicable capital and management requirements. Until the financial holding company returns to compliance, the FRB may impose limitations or conditions on the conduct of its activities, and the company may not commence any of the broader financial activities permissible for financial holding companies or acquire a company engaged in such financial activities without prior approval of the FRB. If the company does not return to compliance within 180 days, the FRB may require divestiture of the holding company’s depository institutions.

The FRB has the power to order any bank holding company or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the FRB has reasonable grounds to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company.

The BHC Act, the Bank Merger Act, and other federal and state statutes regulate acquisitions of banks and banking companies. The BHC Act requires the prior approval of the FRB for the direct or indirect acquisition by us of more than 5% of the voting shares or substantially all of the assets of a bank or bank holding company. Under the Bank Merger Act, the prior approval of the FRB or other appropriate bank regulatory authority is required for the Bank to merge with another bank or purchase the assets or assume the deposits of another bank. In reviewing applications seeking approval of merger and acquisition transactions, the bank regulatory authorities will consider, among other things, the competitive effect and public benefits of the transactions, the capital position of the combined organization, the risks to the stability of the U.S. banking or financial system, the applicant’s performance record under the Community Reinvestment Act and fair housing laws and the effectiveness of the subject organizations in combating money laundering activities.

Capital Requirements

We are required to comply with applicable capital adequacy standards established by the FRB, and the Bank is required to comply with applicable capital adequacy standards established by the OCC. The current risk-based capital standards applicable to us and the Bank, parts of which are in the process of being phased-in, are based on the December 2010 capital standards, known as Basel III, of the Basel Committee on Banking Supervision.

Under the Basel III Capital Rules, the minimum capital ratios effective as of January 1, 2015 are:

The Basel III Capital Rules also introduced a new “capital conservation buffer,” composed entirely of CET1, on top of these minimum risk-weighted asset ratios. The implementation of the capital conservation buffer began on January 1, 2016 at the 0.625% level and will increase by 0.625% on each subsequent January 1, until it reaches 2.5% on January 1, 2019. Banking institutions with a ratio of CET1 to risk-weighted assets below the effective minimum (4.5% plus the capital conservation buffer) will face constraints on dividends, equity repurchases and compensation based on the amount of the shortfall.

When fully phased in on January 1, 2019, the Basel III Capital Rules will require us and the Bank to maintain an additional capital conservation buffer of 2.5% of CET1, effectively resulting in minimum ratios of (i) CET1 to risk-weighted assets of at least 7%, (ii) Tier 1 capital to risk-weighted assets of at least 8.5%, (iii) a minimum ratio of Total capital to risk-weighted assets of at least 10.5%; and (iv) a minimum leverage ratio of 4%.

In addition, under the general risk-based capital rules, the effects of accumulated other comprehensive income items included in capital were excluded for the purposes of determining regulatory capital ratios. Under the Basel III Capital Rules, we and the Bank were able to make a one-time permanent election to continue to exclude these items and did so. Under the Basel III Capital Rules, trust preferred securities no longer included in our Tier 1 capital may nonetheless be included as a component of Tier 2 capital on a permanent basis without phase-out.

The Basel III Capital Rules prescribe a standardized approach for risk weightings that expanded the risk-weighting categories from the general risk-based capital rules to a much larger and more risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. government and agency securities, to 600% for certain equity exposures, and resulting in higher risk weights for a variety of asset categories.

With respect to the Bank, the Basel III Capital Rules also revise the “prompt corrective action” regulations pursuant to Section 38 of the Federal Deposit Insurance Act, as discussed below under “Prompt Corrective Action.”

Management believes that, as of December 31, 2016 , we and the Bank would meet all capital adequacy requirements under the Basel III Capital Rules on a fully phased-in basis as if such requirements had been in effect.

Prompt Corrective Action

The Federal Deposit Insurance Act, as amended (“FDIA”), requires among other things, the federal banking agencies to take “prompt corrective action” in respect of depository institutions that do not meet minimum capital requirements. The FDIA includes the following five capital tiers: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” and “critically undercapitalized.” A depository institution’s capital tier will depend upon how its capital levels compare with various relevant capital measures and certain other factors, as established by regulation. The relevant capital measures, which reflect changes under the Basel III Capital Rules that became effective on January 1, 2015, are the total capital ratio, the CET1 capital ratio, the Tier 1 capital ratio and the leverage ratio.

A bank will be (i) “well capitalized” if the institution has a total risk-based capital ratio of 10.0% or greater, a CET1 capital ratio of 6.5% or greater, a Tier 1 risk-based capital ratio of 8.0% or greater, and a leverage ratio of 5.0% or greater, and is not subject to any order or written directive by any such regulatory authority to meet and maintain a specific capital level for any capital measure; (ii) “adequately capitalized” if the institution has a total risk-based capital ratio of 8.0% or greater, a CET1 capital ratio of 4.5% or greater, a Tier 1 risk-based capital ratio of 6.0% or greater, and a leverage ratio of 4.0% or greater and is not “well capitalized;” (iii) “undercapitalized” if the institution has a total risk-based capital ratio that is less than 8.0%, a CET1 capital ratio less than 4.5%, a Tier 1 risk-based capital ratio of less than 6.0% or a leverage ratio of less than 4.0%; (iv) “significantly undercapitalized” if the institution has a total risk-based capital ratio of less than 6.0%, a CET1 capital ratio less than 3.0%, a Tier 1 risk-based capital ratio of less than 4.0% or a leverage ratio of less than 3.0%; and (v) “critically undercapitalized” if the institution’s tangible equity is equal to or less than 2.0% of average quarterly tangible assets. An institution may be downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios if it is determined to be in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters. A bank’s capital category is determined solely for the purpose of applying prompt corrective action regulations, and the capital category may not constitute an accurate representation of the bank’s overall financial condition or prospects for other purposes.

The FDIA generally prohibits a depository institution from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the depository institution would thereafter be “undercapitalized.” “Undercapitalized” institutions are subject to growth limitations and are required to submit a capital restoration plan. The aggregate liability of the parent holding company in such a situation is limited to the lesser of (i) an amount equal to 5.0% of the depository institution’s total assets at the time it became undercapitalized and (ii) the amount which is necessary (or would have been necessary) to bring the institution into compliance with all capital standards applicable with respect to such institution as of the time it fails to comply with the plan. If a depository institution fails to submit an acceptable plan, it is treated as if it is “significantly undercapitalized.” “Significantly undercapitalized” depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become “adequately capitalized,” requirements to reduce total assets, and cessation of receipt of deposits from correspondent banks. “Critically undercapitalized” institutions are subject to the appointment of a receiver or conservator.

We believe that as of December 31, 2016 , the Bank was “well capitalized” based on the aforementioned ratios. For further information regarding the capital ratios and leverage ratio of us and the Bank, please see the discussion under the section captioned “Liquidity and Capital Resources” included in Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and Note 16. “Stockholders’ Equity - Regulatory Capital Requirements” in the notes to consolidated financial statements.

Dividend Restrictions

We depend on funds maintained or generated by our subsidiaries, principally the Bank, for our cash requirements. Various legal restrictions limit the extent to which the Bank can pay dividends or make other distributions to us. All national banks are limited in the payment of dividends without the approval of the OCC to an amount not to exceed the net profits (as defined by OCC regulations) for that year-to-date combined with its retained net profits for the preceding two calendar years, less any required transfers to surplus. Federal law also prohibits national banks from paying dividends that would be greater than the bank’s undivided profits after deducting statutory bad debt in excess of the bank’s allowance for loan losses. Under the foregoing restrictions, and while maintaining its “well capitalized” status, as of December 31, 2016 , the Bank could pay dividends of approximately $155.7 million to us, without obtaining regulatory approval. This is not necessarily indicative of amounts that may be paid or are available to be paid in future periods.

Under the Federal Deposit Insurance Corporation Improvement Act of 1991 (“FDICIA”), a depository institution, such as the Bank, may not pay dividends if payment would cause it to become undercapitalized or if it is already undercapitalized. The payment of dividends by us and the Bank may also be affected or limited by other factors, such as the requirement to maintain adequate capital. The appropriate federal regulatory authorities have indicated that paying dividends that deplete a banking organization’s capital base

to an inadequate level would be an unsafe and unsound banking practice and that banking organizations should generally pay dividends only out of current operating earnings.

Source of Strength Doctrine

FRB policy and federal law require bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. Under this requirement, we are expected to commit resources to support the Bank, including at times when we may not be in a financial position to provide such resources. Any capital loans by a bank holding company to any of its subsidiary banks are subordinate in right of payment to depositors and to certain other indebtedness of such subsidiary banks.

Deposit Insurance

Substantially all of the deposits of the Bank are insured up to applicable limits by the Deposit Insurance Fund (“DIF”) of the FDIC, and the Bank is subject to deposit insurance assessments to maintain the DIF. The deposit insurance provided by the FDIC per account owner was permanently raised to $250,000 for all types of accounts by the Dodd-Frank Act.

As insurer, the FDIC is authorized to conduct examinations of, and to require reporting by, DIF-insured institutions. It also may prohibit any DIF-insured institution from engaging in any activity the FDIC determines by regulation or order to pose a serious threat to the DIF. The FDIC also has the authority to take enforcement actions against insured institutions. Under the FDIA, the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.

Under the FDIC’s risk-based assessment system, insured institutions are assigned to one of four risk categories based upon supervisory evaluations, regulatory capital level, and certain other factors, with less risky institutions paying lower assessments. The range of current assessment rates is now 1.5 to 40 basis points. As the DIF reserve ratio grows, the rate schedule will be adjusted downward. The FDIC has the authority to raise or lower assessment rates, subject to limits, and to impose special additional assessments. The Dodd-Frank Act increased the minimum target DIF ratio from 1.15% of estimated insured deposits to 1.35% of estimated insured deposits. The FDIC must seek to achieve the 1.35% DIF ratio by September 30, 2020. Insured institutions with assets of $10 billion or more, which includes the Bank, are required to fund the increase.

FDIC deposit insurance expense totaled $6.4 million for the year ended December 31, 2016 , $5.9 million for the year ended December 31, 2015, $1.2 million for the three months ended December 31, 2014 and $5.0 million for the fiscal year ended September 30, 2014. FDIC deposit insurance expense includes deposit insurance assessments and Financing Corporation (“FICO”) assessments related to outstanding bonds issued by FICO in the late 1980s to recapitalize the now defunct Federal Savings & Loan Insurance Corporation. The FICO assessments will continue until the bonds mature in 2017 to 2019.

Safety and Soundness Regulations

In accordance with the FDIA, the federal banking agencies adopted guidelines establishing general standards relating to internal controls, information systems, internal audit systems, loan documentation, credit underwriting, interest rate risk exposure, asset growth, asset quality, earnings, compensation, fees and benefits. In general, the guidelines require, among other things, appropriate systems and practices to identify and manage the risks and exposures specified in the guidelines. The guidelines prohibit excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal shareholder. In addition, regulations adopted by the federal banking agencies authorize the agencies to require that an institution that has been given notice that it is not satisfying any of such safety and soundness standards to submit a compliance plan. If, after being so notified, the institution fails to submit an acceptable compliance plan or fails in any material respect to implement an accepted compliance plan, the agency must issue an order directing corrective actions and may issue an order directing other actions of the types to which an undercapitalized institution is subject under the “prompt corrective action” provisions of the FDIA. If the institution fails to comply with such an order, the agency may seek to enforce such order in judicial proceedings and to impose civil monetary penalties.

Incentive Compensation

The Dodd-Frank Act requires the federal bank regulatory agencies and the SEC to establish joint regulations or guidelines prohibiting incentive-based payment arrangements at specified regulated entities, such as us and the Bank, having at least $1 billion in total assets, that encourage inappropriate risks by providing an executive officer, employee, director or principal shareholder with excessive compensation, fees, or benefits or that could lead to material financial loss to the entity. In addition, these regulators were required to establish regulations or guidelines requiring enhanced disclosure to regulators of incentive-based compensation arrangements. The agencies proposed an initial version of such regulations in April 2011 and a revised version in May 2016, which largely retained the

provisions from the April 2011 version, but the regulations have not been finalized. If the regulations are adopted in the revised form proposed in May 2016, they will impose limitations on the manner in which we may structure compensation for our executives.

In June 2010, the FRB, OCC and FDIC issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors. These three principles are incorporated into the proposed joint compensation regulations under the Dodd-Frank Act, discussed above.

The FRB will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as ours, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

Loans to One Borrower

The Bank generally may not make loans or extend credit to a single or related group of borrowers in excess of 15% of unimpaired capital and surplus. An additional amount may be loaned, up to 10% of unimpaired capital and surplus, if the loan is secured by readily marketable collateral, which generally does not include real estate. As of December 31, 2016 , the Bank was in compliance with the loans-to-one-borrower limitations.

Community Reinvestment Act

The Community Reinvestment Act of 1977 (“CRA”) requires depository institutions to assist in meeting the credit needs of their market areas consistent with safe and sound banking practice. Under the CRA, each depository institution is required to help meet the credit needs of its market areas by, among other things, providing credit to low- and moderate-income individuals and communities. Depository institutions are periodically examined for compliance with the CRA and are assigned ratings that must be publicly disclosed. In order for a financial holding company to commence any new activity permitted by the BHC Act, or to acquire any company engaged in any new activity permitted by the BHC Act, each insured depository institution subsidiary of the financial holding company must have received a rating of at least “satisfactory” in its most recent examination under the CRA. Furthermore, banking regulators take into account CRA ratings when considering approval of certain applications. The Bank received a rating of “satisfactory” in its most recent CRA exam.

Financial Privacy

The federal banking regulators adopted rules that limit the ability of banks and other financial institutions to disclose non-public information about consumers to nonaffiliated third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a nonaffiliated third party. These regulations affect how consumer information is transmitted through diversified financial companies and conveyed to outside vendors.

The Bank is also subject to regulatory guidelines establishing standards for safeguarding customer information. These guidelines describe the federal banking agencies’ expectations for the creation, implementation and maintenance of an information security program, which would include administrative, technical and physical safeguards appropriate to the size and complexity of the institution and the nature and scope of its activities.

Anti-Money Laundering and the USA Patriot Act

A major focus of governmental policy on financial institutions in recent years has been aimed at combating money laundering and terrorist financing. The USA PATRIOT Act of 2001 (the “USA Patriot Act”) substantially broadened the scope of United States anti-money laundering laws and regulations by imposing significant new compliance and due diligence obligations on financial institutions, creating new crimes and penalties, and expanding the extra-territorial jurisdiction of the United States. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal and reputational consequences for the institution, including

causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required.

Stress Testing

On October 9, 2012, the FDIC and the FRB issued final rules requiring certain large insured depository institutions and bank holding companies to conduct annual capital-adequacy stress tests. Recognizing that banks and their parent holding companies may have different primary federal regulators, the FDIC and FRB have attempted to ensure that the standards of the final rules are consistent and comparable in the areas of scope of application, scenarios, data collection, reporting, and disclosure. To implement section 165(i) of the Dodd-Frank Act, the rules apply to FDIC-insured state non-member banks and bank holding companies with total consolidated assets of more than $10 billion (“covered institutions”). Upon the filing of the June 30, 2016 Call Report, the Bank’s average assets for the prior four quarters were in excess of $10 billion, subjecting the Bank and us to stress testing beginning January 1, 2017. The final rules define a stress test as a process to assess the potential impact of economic and financial scenarios on the consolidated earnings, losses and capital of the covered institution over a set planning horizon, taking into account the current condition of the covered institution and its risks, exposures, strategies and activities.

Under the rules, each covered institution with between $10 billion and $50 billion in assets is required to conduct annual stress tests using the bank’s and the bank holding company’s financial data as of December 31 of that year to assess the potential impact of different scenarios on the consolidated earnings and capital of that bank and its holding company and certain related items over a nine-quarter forward-looking planning horizon, taking into account all relevant exposures and activities. As a result, the Bank and Company’s first required annual stress test will occur for 2017, using its financial data as of December 31, 2016. On or before July 31 of the year following the stress tests, each covered institution, including the Bank and us, are required to report to the FDIC and the FRB, respectively, in the manner and form prescribed in the rules, the results of the stress tests conducted by the covered institution during the immediately preceding year. Based on the information provided by a covered institution in the required reports to the FDIC and the FRB, as well as other relevant information, the FDIC and FRB conduct an analysis of the quality of the covered institution’s stress test processes and related results. Consistent with the requirements of the Dodd-Frank Act, the rule requires each covered institution to publish a summary of the results of its annual stress tests within 90 days of the required date for submitting its stress test report to the FDIC and the FRB.

Volcker Rule

The Dodd-Frank Act amended the BHC Act to require the federal bank regulatory agencies to adopt rules that prohibit banks and their affiliates from engaging in proprietary trading and investing in and sponsoring certain unregistered investment companies (defined as hedge funds and private equity funds), commonly referred to as the “Volcker Rule.” The Volcker Rule also requires covered banking entities, including us and the Bank, to implement certain compliance programs, and the complexity and rigor of such programs is determined based on the asset size and complexity of the business of the covered company. We are subject to heightened compliance requirements as a covered banking entity with over $10 billion in assets.

Durbin Amendment

The Dodd-Frank Act included provisions which restrict interchange fees to those which are “reasonable and proportionate” for certain debit card issuers and limits the ability of networks and issuers to restrict debit card transaction routing. This statutory provision is known as the “Durbin Amendment.” The Federal Reserve issued final rules implementing the Durbin Amendment on June 29, 2011. In the final rules, interchange fees for debit card transactions were capped at $0.21 plus five basis points in order to be eligible for a safe harbor such that the fee is conclusively determined to be reasonable and proportionate. The interchange fee restrictions contained in the Durbin Amendment, and the rules promulgated thereunder, only apply to debit card issuers with $10 billion or more in total consolidated assets, which includes the Bank. Accordingly, under the Durbin Amendment, since the Bank held more than $10 billion in assets as of December 31, 2015, the Bank began complying with such interchange fee restrictions effective July 1, 2016. The impact of the implementation on the Durbin Amendment on the Bank was to reduce deposit fees and service charges by over $1.0 million for the six months ended December 31, 2016. The Durbin Amendment will impact the Bank for the full year in 2017.

Transactions with Affiliates

Transactions between the Bank and its affiliates are regulated by the FRB under sections 23A and 23B of the Federal Reserve Act and related FRB regulations. These regulations limit the types and amounts of covered transactions engaged in by the Bank and generally require those transactions to be on an arm’s-length basis. The term “affiliate” is defined to mean any company that controls or is under common control with the Bank and includes us and our non-bank subsidiaries. “Covered transactions” include a loan or extension of credit, as well as a purchase of securities issued by an affiliate, a purchase of assets (unless otherwise exempted by the FRB) from the affiliate, certain derivative transactions that create a credit exposure to an affiliate, the acceptance of securities issued by the affiliate as collateral for a loan, and the issuance of a guarantee, acceptance or letter of credit on behalf of an affiliate. In general, these

regulations require that any such transaction by the Bank (or its subsidiaries) with an affiliate must be secured by designated amounts of specified collateral and must be limited to certain thresholds on an individual and aggregate basis.

Federal law also limits the Bank’s authority to extend credit to its directors, executive officers and 10% shareholders, as well as to entities controlled by such persons. Among other things, extensions of credit to insiders are required to be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with unaffiliated persons. Also, the terms of such extensions of credit may not involve more than the normal risk of repayment or present other unfavorable features and may not exceed certain limitations on the amount of credit extended to such persons, individually and in the aggregate, which limits are based, in part, on the amount of the Bank’s capital.

Federal Home Loan Bank System

The Bank is a member of the Federal Home Loan Bank System, which consists of 12 regional Federal Home Loan Banks. The Federal Home Loan Bank System provides a central credit facility primarily for member institutions. As a member of the Federal Home Loan Bank of New York (“FHLBNY”), the Bank is required to acquire and hold shares of capital stock of the FHLBNY in an amount at least equal to the sum of the membership stock purchase requirement, determined on an annual basis at the end of each calendar year, and the activity-based stock purchase requirement, determined on a daily basis. As of December 31, 2016 , the Bank was in compliance with the minimum stock ownership requirement.

Federal Reserve System

FRB regulations require depository institutions to maintain cash reserves against their transaction accounts (primarily interest-bearing demand deposit accounts and demand deposit accounts). A reserve of 3% is to be maintained against aggregate transaction accounts between $15.2 million and $110.2 million (subject to adjustment by the FRB) plus a reserve of 10% (subject to adjustment by the FRB between 8% and 14%) against that portion of total transaction accounts in excess of $110.2 million. The first $15.2 million of otherwise reservable balances (subject to adjustment by the FRB) is exempt from the reserve requirements. The Bank is in compliance with the foregoing requirements.

Consumer Protection Regulations

The Bank is subject to federal consumer protection statutes and regulations promulgated under those laws, including, but not limited to, the following:

Deposit operations are also subject to:

In addition, the Bank may be subject to certain state laws and regulations designed to protect consumers.

Consumer Financial Protection Bureau

Created under the Dodd-Frank Act, and given extensive implementation and enforcement powers over all banks with over $10 billion in assets, including the Bank, the CFPB has broad rulemaking authority for a wide range of consumer financial laws that apply to all banks including, among other things, the authority to prohibit “unfair, deceptive, or abusive” acts and practices. The CFPB has the authority to investigate possible violations of federal consumer financial law, hold hearings and commence civil litigation. The CFPB can issue cease-and-desist orders against banks and other entities that violate consumer financial laws. The CFPB may also institute a civil action against an entity in violation of federal consumer financial law in order to impose a civil penalty or an injunction.