NYSE: STT-PG

State Street Corporation | 6

strength to our subsidiaries. We conduct our business primarily through State Street Bank, which traces its beginnings to 1792, with the founding of our oldest ancestor bank, Union Bank. State Street Bank’s current charter was authorized by a special Act of the Massachusetts Legislature in 1891, and its present name was adopted in 1960. State Street Bank operates as a specialized bank, referred to as a trust or custody bank, that services and manages assets on behalf of its institutional clients.

Our corporate headquarters is located at One Congress Street, Boston, Massachusetts 02114 (telephone (617) 786-3000). For purposes of this Form 10-K, unless the context requires otherwise, references to “State Street,” “we,” “us,” “our” or similar terms mean State Street Corporation and its subsidiaries on a consolidated basis.

ADDITIONAL INFORMATION

On the “Filings & reports” tab of our website at investors.statestreet.com, we make available, free of charge, all reports we electronically file with, or furnish to, the SEC including our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q and Current Reports on Form 8-K, as well as any amendments to those reports, as soon as reasonably practicable after those documents have been filed with, or furnished to, the SEC. These documents are also accessible on the SEC’s website at www.sec.gov. We have included the website addresses of State Street (including references to investors.statestreet.com) and the SEC in this report as inactive textual references only. Information on those websites (or any other) is not incorporated by reference in this Form 10-K.

We have Corporate Governance Guidelines, as well as written charters for the Examining and Audit Committee, the Executive Committee, the Human Resources Committee, the Nominating and Corporate Governance Committee, the Risk Committee and the Technology and Operations Committee of our Board of Directors, or Board, and a Code of Ethics for Senior Financial Officers, a Standard of Conduct for Directors and a Standard of Conduct for our employees. Each of these documents is accessible on the “Corporate governance” tab of our website at investors.statestreet.com.

We provide additional disclosures required by applicable bank regulatory standards, including supplemental qualitative and quantitative information with respect to regulatory capital (including market risk associated with our trading activities), the LCR and the NSFR, summary results of annual State Street-run stress tests that we conduct under the Dodd-Frank Act, and recovery and resolution disclosures. These additional disclosures are accessible on the “Filings & reports” and “Fixed

Income” tabs of our website at investors.statestreet.com.

We use acronyms and other defined terms for certain business terms and abbreviations, as defined on the acronyms list and glossary under Item 8 in this Form 10-K.

LINES OF BUSINESS

Our operations are organized into two lines of business: Investment Servicing and Investment Management, which are defined based on products and services provided.

Investment Servicing

Our Investment Servicing line of business provides a broad range of investment servicing and market and financing solutions to institutional clients, including mutual funds, collective investment funds and other investment pools, corporate and public retirement plans, insurance companies, wealth managers, investment managers, foundations and endowments worldwide.

Through State Street Investment Services and State Street Markets, we offer a full range of back-, middle- and front-office solutions, including custody, accounting and fund administration services for traditional and alternative assets, as well as multi-asset class investments; recordkeeping, client reporting and investment book of record, transaction management, loans, cash, derivatives and collateral services; investor services operations outsourcing; performance, risk and compliance analytics; financial data management to support institutional investors; foreign exchange, brokerage and other trading services; securities finance, including prime services products; and deposit and short-term investment facilities.

Together with our back- and middle-office services, CRD’s front- and middle-office technology offerings form the foundation of State Street Alpha. Our State Street Alpha platform combines portfolio management, trading and execution, analytics and compliance tools, along with advanced data aggregation and integration with other industry platforms and providers. Included in CRD’s technology offerings are Charles River Investment Management Solution, a front-office technology offering that automates and simplifies the institutional investment process across asset classes, from portfolio management and risk analytics through trading and post-trade settlement, with integrated compliance and managed data throughout; Charles River for Private Markets, an investment management solution for institutions investing in Private Credit, Private Equity, Real Estate, Infrastructure, and Funds; and Charles River Wealth Management Solution, which provides portfolio management, trading compliance and manager/

State Street Corporation | 7

sponsor communication capabilities to wealth managers, private banks and financial advisors.

As the digital asset space continues to mature, we continue to build solutions to tokenize assets. Our vision is to deliver digital asset solutions to our clients as a trusted provider of end-to-end capabilities across the asset servicing lifecycle on a secure, interoperable platform with multiple blockchain connectivity.

We provide some or all of our Investment Servicing products and services to clients in the United States and in many other key markets around the world. As of December 31, 2025, we serviced AUC/A of approximately $53.80 trillion, comprising approximately $37.42 trillion in the Americas, approximately $12.92 trillion in Europe and the Middle East and approximately $3.46 trillion in the Asia-Pacific region.

Investment Management

Our Investment Management line of business provides a comprehensive range of investment management solutions and products for our clients through State Street Investment Management (previously State Street Global Advisors). Our investment management solutions span across equity, fixed income, liquidity and cash, multi-asset and alternatives strategies, delivered through products such as ETFs, custom indexed, and actively managed funds and mandates. As of December 31, 2025, State Street Investment Management had approximately $5.67 trillion in AUM.

Additional information about our lines of business is provided under “Line of Business Information” included in our Management’s Discussion and Analysis, and in Note 24 to the consolidated financial statements in this Form 10-K. Additional information about our non-U.S. activities is included in Note 26 to the consolidated financial statements in this Form 10-K.

COMPETITION

We operate in a highly competitive environment in all areas of our business globally. Our competitors include a broad range of financial institutions and servicing companies, including other custodial banks, deposit-taking institutions, investment management firms, insurance companies, mutual funds, broker/dealers, investment banks, benefits consultants, investment analytics businesses, business service and software companies, technology companies, data providers and information services firms. As our businesses grow and markets and new technologies, including artificial intelligence, evolve, we may encounter increasing and new forms of competition around the world.

We believe that many key factors drive competition in the markets for our business.

Technological advances, economies of scale, required levels of capital, pricing, quality and scope of services, and sales and marketing are critical to our Investment Servicing line of business. For our Investment Management line of business, key competitive factors include expertise, experience, availability of related service offerings, quality of service, price, efficiency of our products and services, and performance.

Our success and competitive position may depend on our ability to develop and market new and innovative services, to adopt or develop new technologies, including those incorporating artificial intelligence, to implement efficiencies into our operational processes, to bring new services to market in a timely fashion at competitive prices, to integrate existing and future products and services effectively into State Street Alpha and State Street Wealth Services, to continue to expand our relationships with existing clients and to attract new clients, to maintain and enhance our reputation, to manage risk and to effectively and efficiently operate in a highly regulated environment.

As a G-SIB, we are subject to extensive regulation and supervision with respect to our operations and activities. Not all of our competitors have similarly been designated as systemically important nor are all of them subject to the same degree of regulation as a bank or financial holding company; therefore some of our competitors may not be subject to the same limitations, requirements and standards with respect to their operations and activities. Most other financial institutions designated as systemically important have substantially greater financial resources and a broader base of operations than we do and are, consequently, in a better competitive position to manage and bear the costs of this enhanced regulatory requirement. See “Supervision and Regulation” in this Item for more information.

HUMAN CAPITAL

Our human capital strategy is a meaningful driver of our overall enterprise strategy and our long-term performance. Our employees drive the company’s value proposition, innovate better ways to serve our clients and act as custodians of our reputation. We seek to empower our employees by providing development and learning opportunities to help each person reach their full potential. The Board of Directors’ Human Resources Committee oversees our human capital management strategy and receives regular updates on matters such as engagement, culture, talent management, retention and productivity.

We aim to promote strong levels of employee commitment and connection to the company by providing an environment that supports our diverse

State Street Corporation | 8

employee population in amplifying behaviors that drive our business strategy. We believe that an inclusive culture where employees feel valued, engaged and empowered makes State Street a more desirable place to work, helps us attract and retain employees as they grow in their careers, and fosters an environment that enhances each individual’s sense of belonging, productivity and professional satisfaction. The integrity and ethical decision-making of our employees is paramount for our culture. We want our employees to know their opinions matter and are respected, to feel comfortable asking questions and raising concerns, and to have no fear of retaliation.

Our talent management efforts are focused on recruiting, developing and retaining top talent and industry leaders in markets that align with current and future demands and the evolution of our business. Our objective is to seek a wide pool of talent globally, so we are well positioned to be an essential partner to our clients. To support the retention and ongoing development of our employees, we offer competitive compensation and benefits, a wide range of learning and development offerings, and strong support by involved and well-trained leaders. We carefully monitor our hiring, promotion and turnover rates and implement programs to help retain, develop and enhance the skills of our employees, including through a focus on internal mobility.

Our approach is centered on skills that are aligned with our corporate strategy and designed to address the rapidly changing, technology-centric demands of the financial services industry. We also regularly monitor our compensation program to maintain competitiveness and to reward high performance.

Driving improvements in both individual and organizational productivity is a key enabler of our overall human capital management strategy, and we are focused on strategic workforce planning, building upon current headcount budgeting and forecasting activities. Our productivity efforts aim to promote the optimal effectiveness and efficiency of our human capital through clear alignment between our business strategy and our organizational structure, geographic footprint, performance management, people development and reward systems. We focus on cultivating a high performing workforce that drives innovation and profitable growth, is responsive to changing client and business needs and is structured and resourced to deliver desired outcomes.

Our employee population at December 31, 2025 decreased approximately 2% to approximately 52,000 employees, compared to December 31, 2024, primarily driven by our continued efforts to simplify our operations through organization design and technology and automation efforts. Approximately 77% of our employees are located outside the United States.

SUPERVISION AND REGULATION

We are registered with the Federal Reserve as a bank holding company pursuant to the Bank Holding Company Act of 1956. The Bank Holding Company Act generally limits the activities in which bank holding companies and their non-banking subsidiaries may engage to managing or controlling banks and to a range of activities that are considered to be closely related to banking. Bank holding companies that have elected to be treated as financial holding companies, such as the Parent Company, may engage in a broader range of activities considered to be “financial in nature.” The regulatory limits on our activities also apply to non-banking entities that we are deemed to “control” for purposes of the Bank Holding Company Act, which may include companies of which we own or control 5% or more of a class of voting shares. The Federal Reserve may order a bank holding company to terminate any activity, or its ownership or control of a non-banking subsidiary, if the Federal Reserve finds that the activity, ownership or control constitutes a serious risk to the financial safety, soundness or stability of a banking subsidiary or is inconsistent with sound banking principles or statutory purposes. The Bank Holding Company Act also requires a bank holding company to obtain prior approval of the Federal Reserve before it acquires substantially all the assets of any bank, or ownership or control of more than 5% of the voting shares of any bank.

The Parent Company has elected to be treated as a financial holding company and, as such, may engage in a broader range of non-banking activities than permitted for bank holding companies that have not elected to become financial holding companies and their subsidiaries. Financial holding companies may engage directly or indirectly, either de novo or by acquisition, in activities that are defined by the Federal Reserve to be financial in nature, provided that the financial holding company gives the Federal Reserve after-the-fact notice of the new activities. Activities defined to be financial in nature include, but are not limited to: providing financial or investment advice; dealing in or making markets in securities; making merchant banking investments, subject to significant limitations; underwriting; and any activities previously found by the Federal Reserve to be closely related to banking. In order to maintain our status as a financial holding company, we and each of our U.S. depository institution subsidiaries are expected to be well capitalized and well managed, as defined in applicable regulations and determined in part by the results of regulatory examinations, and must comply with Community Reinvestment Act obligations. Failure to maintain these standards may result in restrictions on our activities and may ultimately permit the Federal Reserve to take enforcement actions against us and restrict our ability to engage in activities defined to be financial in nature.

State Street Corporation | 9

The scope of the laws and regulations and the intensity of the supervision to which our business is subject has increased since the 2008 financial crisis. Regulatory enforcement and fines have also increased across the banking and financial services sector. Many of these changes have occurred as a result of the Dodd-Frank Act and its implementing regulations, most of which are now in place, and subsequently the enhancement of the Economic Growth, Regulatory Relief, and Consumer Protection Act. Developments at the federal banking agencies that regulate banking organizations, including the Federal Reserve, the FDIC and the OCC (the U.S. Agencies), or in the financial system more generally, may result in increased prudential and conduct oversight, more extensive regulatory requirements, changing interpretations of existing rules and guidelines, and potentially more stringent enforcement and more severe penalties. Irrespective of any specific regulatory change, we expect that our business will remain subject to extensive regulation and supervision.

Many aspects of our business are subject to regulation by other U.S. federal and state governmental and regulatory agencies and self-regulatory organizations (including securities exchanges), and by non-U.S. governmental and regulatory agencies and self-regulatory organizations. Some aspects of our public disclosure, corporate governance principles and internal control systems are subject to the Sarbanes-Oxley Act of 2002 (SOX), the Dodd-Frank Act and regulations and rules of the SEC and the New York Stock Exchange.

Regulatory Capital Adequacy and Liquidity Standards

Basel III Rule

We are subject to the Basel III framework (Basel III rule) in the United States. The provisions of the Basel III rule related to minimum capital requirements, capital buffers and methodologies for calculating regulatory capital were fully implemented as of 2019. We are also subject to the market risk capital rule as implemented by the U.S. Agencies.

As required by the Dodd-Frank Act, we are subject to a standardized “capital floor,” also referred to as the Collins Amendment, in the assessment of our regulatory capital adequacy. Thus, our risk-based capital ratios for regulatory assessment purposes are the lower of each ratio calculated under the standardized approach and the advanced approaches. We are also subject to various capital buffer requirements described below in this “Supervision and Regulation” section.

In July 2023, the U.S. Agencies issued a proposed rule to implement the Basel III endgame agreement (2023 Basel III Endgame Proposal) for large banks, and separately proposed revisions to the

U.S. G-SIB capital surcharge framework (2023 G-SIB Surcharge Proposal). The 2023 Basel III Endgame Proposal would, among other things, eliminate the advanced approaches for monitoring risk-based capital adequacy in favor of a new standardized expanded risk-based approach that includes new standardized methodologies for credit risk, operational risk and CVA risk components, and would also replace the existing market risk rule with the new fundamental review of the trading book (FRTB) framework. The 2023 G-SIB Surcharge Proposal would, among other things, measure the G-SIB surcharge in 0.1% increments as opposed to the 0.5% increments that currently apply.

Public statements by U.S. banking agency officials indicate that the 2023 Basel III Endgame Proposal and 2023 G-SIB Surcharge Proposal are under reconsideration. While a re‑proposal is currently expected in March 2026, the timing and content of any potential re-proposal, and the effects on us, remain uncertain at this stage.

Risk-Weighted Assets

The existing Basel III rule provides two frameworks for the calculation of RWA for purposes of bank regulatory capital: the “standardized” approach and the “advanced” approaches, which are applicable to advanced approaches banking organizations, like us.

The standardized approach prescribes standardized risk weights for certain on- and off-balance sheet exposures in the calculation of RWA. The advanced approaches consist of the Advanced Internal Ratings-Based Approach (AIRB) used for the calculation of RWA related to credit risk and the Advanced Measurement Approach (AMA) used for the calculation of RWA related to operational risk.

Minimum Risk-Based Capital Requirements

Among other things, the Basel III rule (as amended) requires:

•a minimum CET1 risk-based capital ratio of 4.5% and a minimum SLR of 3% for advanced approaches banking organizations;

•a minimum Tier 1 risk-based capital ratio of 6%;

•a minimum total capital ratio of 8%; and

•the stress capital and countercyclical capital buffers, referenced below, as well as a G-SIB surcharge and the enhanced SLR (which acts as an SLR buffer) described in “Capital” in “Financial Condition” in our Management’s Discussion and Analysis in this Form 10-K.

Under the Basel III rule, our total regulatory capital is composed of three tiers: CET1 capital, Tier 1 capital (which includes CET1 capital), and Tier 2 capital. The total of Tier 1 and Tier 2 capital, adjusted as applicable, is referred to as total regulatory capital.

State Street Corporation | 10

CET1 capital is composed of core capital elements, such as qualifying common shareholders' equity and related surplus plus retained earnings and the cumulative effect of foreign currency translation plus net unrealized gains (losses) on debt and equity securities classified as AFS, less treasury stock and less goodwill and other intangible assets, net of related deferred tax liabilities. Tier 1 capital is composed of CET1 capital plus additional Tier 1 capital instruments which, for us, includes three series of preferred equity outstanding as of December 31, 2025. Tier 2 capital includes certain eligible subordinated long-term debt instruments. Total regulatory capital consists of Tier 1 capital and Tier 2 capital.

Certain other items, if applicable, must be deducted from Tier 1 and Tier 2 capital, including certain investments in the capital of unconsolidated banking, financial and insurance entities and the amount of expected credit losses that exceeds recorded allowances for loan and other credit losses. Expected credit losses are calculated for wholesale credit exposures by formula in conformity with the Basel III rule.

G-SIB Surcharge

The eight U.S. bank holding companies deemed to be G-SIBs, including us, are required to calculate their G-SIB surcharge annually according to two methods, and be bound by the higher of the two:

•Method 1: Assesses systemic importance based upon five equally-weighted components: size, interconnectedness, complexity, cross-jurisdictional activity and substitutability; or

•Method 2: Alters the calculation from Method 1 by factoring in a short-term wholesale funding score in place of substitutability and applying a fixed coefficient to each of the five components.

Method 2 is the binding methodology for us as of December 31, 2025. Our current G-SIB surcharge, through December 31, 2026, is 1.0%. The finalization of the data as of December 31, 2025, which will be used to calculate our G-SIB surcharge through December 31, 2027, is currently pending. If our Method 1 or Method 2 score changes year-over-year such that we would become subject to a higher surcharge, the higher surcharge would not become effective for two years from the “as of” date (e.g., a higher surcharge calculated as of December 31, 2025 would not become effective until January 1, 2028). If, however, our Method 1 or Method 2 score changes year-over-year such that we would become subject to a lower surcharge, we would be subject to the lower surcharge beginning one full year from the “as of” date (e.g., a lower surcharge calculated as of

December 31, 2025 would become effective January 1, 2027).

Stress Capital Buffer

In March 2020, the U.S. Agencies issued the SCB final rule that replaced, under the standardized approach, the fixed capital conservation buffer (2.5%) with an SCB calculated as the difference between the institution’s starting and lowest projected CET1 ratio under the severely adverse scenario of the Federal Reserve’s supervisory stress test plus planned common stock dividend payments (as a percentage of RWA) from the fourth through seventh quarter of the supervisory stress testing planning horizon. Based on our results from the 2025 supervisory stress test, our SCB for the period of October 1, 2025 through September 30, 2026 is set at the prescribed minimum floor of 2.5% of RWA. For additional information about the SCB rule, refer to “Capital Planning, Stress Tests and Dividends” in this “Supervision and Regulation” section.

Under the SCB rule, a banking organization would be able to make capital distributions and discretionary bonus payments without specified quantitative limitations (although subject to other potential regulatory constraints, such as supervisory limitations), as long as it maintains its required SCB plus the applicable G-SIB surcharge (plus any potentially applicable countercyclical capital buffer) over the minimum required risk-based capital ratios and as long as it satisfies all leverage based capital requirements and buffers. From time to time, under certain economic conditions, banking regulators may establish a minimum countercyclical capital buffer up to a maximum of 2.5% of total RWA. The countercyclical capital buffer was initially set by banking regulators at zero, and has not been increased since its inception.

Assuming a countercyclical buffer of 0%, the minimum capital ratios as of January 1, 2026, including a capital conservation buffer and an SCB of 2.5% for advanced and standardized approaches, respectively, and a G-SIB surcharge of 1.0%, are 8.0% for CET1 capital, 9.5% for Tier 1 risk-based capital and 11.5% for total risk-based capital, in order for us to make capital distributions and discretionary bonus payments without limitation.

In April 2025, the Federal Reserve issued a proposed rule to reduce volatility in the SCB requirement, primarily through the averaging of the decline in a firm’s CET1 capital over a two-year horizon (current and prior year). The proposal would also extend the annual effective date of each firm’s SCB requirement by one quarter, from October 1 to January 1. The proposal was intended to be effective as of the 2025 stress testing cycle, but has yet to be finalized. We do not expect the proposal to materially

State Street Corporation | 11

impact our SCB requirement, which is currently at the 2.5% floor.

Leverage Ratios

We are subject to a minimum Tier 1 leverage ratio and a SLR. The Tier 1 leverage ratio is based on Tier 1 capital and adjusted quarterly average on-balance sheet assets. The SLR is based on total leverage exposure and, includes certain off-balance sheet exposures not used in the calculation of the minimum Tier 1 leverage ratio. We must maintain a minimum Tier 1 leverage ratio of 4%.

As a U.S. G-SIB, we are subject to a minimum SLR of 3%, and are also subject to eSLR standards, comprising a 2% SLR buffer at the holding company (in order to avoid limitations on distributions to shareholders and discretionary bonus payments to certain executives) and a 3% SLR buffer at State Street Bank (in order to be considered “well capitalized” under the Federal Reserve’s prompt corrective action framework). If we do not maintain the 2% buffer at the holding company, limitations on these distributions and discretionary bonus payments would be increasingly stringent based upon the extent of the shortfall.

On November 25, 2025, the U.S. Agencies jointly adopted a final rule (eSLR Final Rule) amending the calibration of the eSLR for U.S. G-SIBs and their IDI subsidiaries. The final rule is effective April 1, 2026, with the option for firms to adopt the modified standards early, effective January 1, 2026. The final rule replaces the current eSLR buffer of 2% at the holding company and 3% at State Street Bank (for State Street Bank to be considered "well capitalized"), with an eSLR buffer for both bank holding companies and IDI subsidiaries calibrated at 50% of a G-SIB’s Method 1 capital surcharge, with the buffer for IDI subsidiaries capped at 1%. Conforming changes were also made to the TLAC and LTD requirements. We adopted the modified standards effective January 1, 2026.

The eSLR Final Rule is not expected to materially impact our total leverage-based capital, which already benefits from the custody bank exemption for central bank placements in the SLR denominator from Section 402 of the EGRRCPA. Changes to the TLAC and LTD requirements may have limited implications for us, but, are not expected to change our management of TLAC or LTD.

Under a final rule adopted by the U.S. Agencies pursuant to the EGRRCPA, central bank deposits are excluded from a custodial banking organization’s total leverage exposure for purposes of calculating the SLR. This exclusion is not applicable to total leverage exposure under the calculation of Tier 1 leverage. The rule became effective on April 1, 2020. For the quarter ended December 31, 2025, we excluded $91.5 billion of average balances held on deposit at

central banks from the denominator used in the calculation of our SLR based on this custodial banking exclusion. The TLAC and LTD that State Street is required to hold under SLR-based requirements reflect the exclusion of certain central bank balances as a consequence of the rule.

The SA-CCR final rule that went into effect for us on January 1, 2022, also requires us to incorporate the SA-CCR into the calculation of our total leverage exposure for the purpose of calculating SLR.

Total Loss-Absorbing Capacity

The Federal Reserve has implemented rules on TLAC, LTD and clean holding company requirements for U.S. domiciled G-SIBs, such as us. The TLAC rule imposes: (1) external TLAC requirements (i.e., combined eligible Tier 1 regulatory capital and LTD); (2) separate external LTD requirements; and (3) clean holding company requirements that impose restrictions on certain types of liabilities and limit non-TLAC related third party liabilities to 5% of external TLAC.

Among other things, the TLAC rule requires us to comply with minimum requirements for external TLAC and external LTD. Specifically, since January 2023, we must hold:

(1) combined eligible Tier 1 regulatory capital and LTD in the amount equal to the greater of 21.5% of total RWA (18.0% minimum plus a 2.5% capital conservation buffer plus a G-SIB surcharge calculated for these purposes under Method 1 of 1.0% plus any applicable counter-cyclical buffer, which is currently 0%) and 9.5% of total leverage exposure (7.5% minimum plus the enhanced SLR buffer of 2.0%), as defined by the SLR rule; and

(2) qualifying external LTD equal to the greater of 7.0% of RWA (6.0% minimum plus a G-SIB surcharge calculated for these purposes under Method 2 of 1.0%) and 4.5% of total leverage exposure, as defined by the SLR rule.

Additionally, certain large banking organizations, such as us and State Street Bank, are required to make deductions from regulatory capital for investments in certain unsecured debt instruments issued by bank holding companies and U.S. intermediate holding companies of foreign banks that are subject to the Federal Reserve’s TLAC and LTD requirements, as well as foreign G-SIBs.

Liquidity Coverage Ratio and Net Stable Funding Ratio

In addition to capital standards, the Basel III framework introduced two quantitative liquidity standards: the LCR and the NSFR.

We are subject to the rule issued by the U.S. Agencies implementing the LCR in the United States.

State Street Corporation | 12

The LCR is intended to promote the short-term resilience of internationally active banking organizations, like us, to improve the banking industry’s ability to absorb shocks arising from market stress over a 30 calendar day period and improve the measurement and management of liquidity risk.

The LCR is calculated by dividing an institution’s available HQLA by its projected net cash outflows during a 30 day period under a prescribed stress environment. We report LCR to the Federal Reserve daily and are required to calculate and maintain an LCR that is equal to or greater than 100%. In addition, we publicly disclose certain qualitative and quantitative information about our LCR consistent with the quarterly disclosure requirements of the Federal Reserve’s final rule.

Compliance with the LCR has required that we maintain an investment portfolio that contains an adequate amount of HQLA. The level of HQLA we are required to maintain under the LCR is dependent upon our client relationships and the nature of services we provide, which may change over time. Deposits resulting from certain services provided (operational deposits) are treated as more resilient than other deposits. As a result, if balances of operational deposits increased relative to our total client deposit base, we would expect to require less HQLA in order to maintain our LCR. Conversely, if balances of operational deposits decreased relative to our total client deposit base, we would expect to require more HQLA.

In addition, we are subject to the final rule issued by the U.S. banking agencies implementing the NSFR in the United States, which became effective on July 1, 2021. The NSFR, a quantitative liquidity metric and requirement, measures the stability of a firm’s funding profile over a one-year time horizon. The final rule requires large banking organizations to maintain a minimum amount of available stable funding, which is a weighted measure of a company’s funding sources, calculated by applying standardized weightings to the company’s equity and liabilities based on their expected stability. The amount of stable funding can be no less than the amount of required stable funding, which is calculated by applying standardized weightings to assets, derivatives exposures and certain other items based on their liquidity characteristics. As a U.S. G-SIB, we are required to maintain an NSFR that is equal to or greater than 100%. We publicly disclose certain qualitative and quantitative information about our NSFR consistent with the semi-annual disclosure requirements of the Federal Reserve’s final rule.

Capital Planning, Stress Tests and Dividends

Pursuant to the Dodd-Frank Act, in March 2020, the Federal Reserve adopted capital planning and stress test requirements for large bank holding

companies, including us, which form part of the Federal Reserve’s annual stress testing and capital planning framework. The Federal Reserve conducts its own stress tests of our business operations using supervisory models, referred to as supervisory stress tests, the results of which it uses to calibrate our annual SCB, subject to a minimum of 2.5%. In addition, under the Federal Reserve’s capital plan rule, we must conduct periodic stress testing of our business operations and submit an annual capital plan to the Federal Reserve, taking into account the results of separate stress tests designed by us and by the Federal Reserve. The Federal Reserve conducts a qualitative assessment of our capital plan as part of the annual supervisory process, to evaluate the strength of our capital planning practices, including our ability to identify, measure, and determine the appropriate amount of capital for our risks, and controls and governance supporting capital planning.

In October 2025, the Federal Reserve proposed revisions to its supervisory stress testing framework through two related proposals designed to enhance the transparency and public accountability of its annual stress test. The first proposal solicits comments on the Federal Reserve’s stress test models, scenario design framework and an enhanced disclosure process under which the Federal Reserve would annually publish and invite public comment on stress test scenarios, models and material changes to those models. The second proposal solicits comments on the scenarios for the 2026 supervisory stress test. In February 2026, the Federal Reserve adopted the proposed 2026 scenarios largely as proposed, including the models used to generate the final 2026 scenarios.

The Federal Reserve’s SCB rule integrates its annual capital planning and stress testing requirements with certain ongoing regulatory capital requirements and applies to certain bank holding companies, including us. The standardized approach SCB equals the greater of (i) 2.5%; and (ii) the maximum decline in our CET1 capital ratio under the severely adverse scenario over the supervisory stress test measurement period, plus the ratio of (a) the sum of the dollar amount of our planned common stock dividends for the fourth through seventh quarters of the supervisory stress test projection period to (b) our projected RWA for the quarter in which our projected CET1 capital ratio reaches its minimum in the supervisory stress test.

The SCB rule assumes that bank holding companies maintain a constant level of assets and RWA throughout the supervisory stress test projection period. In addition, under the final rule the SCB incorporates the dollar amount of four quarters of planned common stock dividends, as described above.

State Street Corporation | 13

Our SCB requirement remains at 2.5% for the period from October 1, 2025 through September 30, 2026, based on the results of the 2025 supervisory stress test. Additionally, in February 2026 the Federal Reserve Board voted to maintain the current SCB requirements until 2027.

In addition to the SCB requirement, we continue to be subject to capital plan requirements and the supervisory assessment of our capital planning activities. Under the capital planning requirements, our annual capital plan must include a description of all of our planned capital actions over a nine-quarter planning horizon, including any capital qualifying instruments, any capital distributions, such as payments of dividends on, or repurchases of, our stock, and any similar action that the Federal Reserve determines could affect our consolidated capital. The capital plan must include a discussion of how we will maintain capital above the minimum regulatory capital ratios, including the minimum ratios under the Basel III rule, and serve as a source of strength to State Street Bank under supervisory stress scenarios. Changes in our strategy, merger or acquisition activity or unanticipated uses of capital could result in a change in our capital plan and its associated capital actions, including capital raises or modifications to planned capital actions, such as repurchases of our stock, and may require resubmission of the capital plan to the Federal Reserve if, among other reasons, we would not meet our regulatory capital requirements after making the proposed capital distribution.

In addition to its stress testing and capital planning requirements, the Federal Reserve has the authority to prohibit or to limit the payment of dividends, the repurchase of common stock, or other capital actions that reduce capital by the banking organizations it supervises, including the Parent Company and State Street Bank, if, in the Federal Reserve’s opinion, the capital action would constitute an unsafe or unsound practice in light of the financial condition of the banking organization. All of these policies and other requirements could affect our ability to pay dividends and repurchase our stock or require us to provide capital assistance to State Street Bank and any other banking subsidiary. Our common stock and other stock dividends, including the declaration, timing and amount thereof, remain subject to consideration and approval by our Board of Directors at the relevant times.

The EGRRCPA modified certain aspects of the Federal Reserve’s stress-testing requirements, reducing the number of scenarios in the supervisory stress test from three to two and modifying our obligation to perform company-run stress-tests from semi-annually to annually. The Federal Reserve adopted a final rule in October 2019 that, among other things, implemented this modification.

Enhanced Prudential Standards

The Dodd-Frank Act, as amended by the EGRRCPA, establishes a systemic risk regime to which large bank holding companies with $100 billion or more in consolidated assets, such as us, are subject. U.S. G-SIBs, such as us, are subject to the most stringent requirements, including heightened capital, leverage, liquidity and risk management requirements and single-counterparty credit limits (SCCL).

Under the Federal Reserve’s regulation, we are required to comply with various liquidity-related risk management standards and maintain a liquidity buffer of unencumbered HQLA based on the results of internal liquidity stress testing. This liquidity buffer is in addition to other liquidity requirements, such as the LCR and the NSFR. The regulations also establish requirements and responsibilities for our risk committee and mandate risk management standards.

The Federal Reserve has established a rule that imposes contractual requirements on certain “qualified financial contracts” to which U.S. G-SIBs, including us, and their subsidiaries are parties. Under the rule, certain qualified financial contracts generally must expressly provide that transfer restrictions and default rights against a U.S. G-SIB, or a subsidiary of a U.S. G-SIB, are limited to the same extent as they would be under the Federal Deposit Insurance Act and Title II of the Dodd-Frank Act and their implementing regulations. In addition, certain qualified financial contracts may not, among other things, permit the exercise of any cross-default right against a U.S. G-SIB or a subsidiary of a U.S. G-SIB based on an affiliate’s entry into insolvency, resolution or similar proceedings, subject to certain creditor protections.

The systemic-risk regime also provides that for U.S. G-SIBs deemed to pose a grave threat to U.S. financial stability, the Federal Reserve, upon an FSOC vote, must limit that institution’s ability to merge, restrict its ability to offer financial products, require it to terminate activities, impose conditions on activities or, as a last resort, require it to dispose of assets. Upon a grave threat determination by the FSOC, the Federal Reserve must issue rules that require financial institutions subject to the systemic-risk regime to maintain a debt-to-equity ratio of no more than 15 to 1 if the FSOC considers it necessary to mitigate the risk of the grave threat. The Federal Reserve also has the ability to establish further standards, including those regarding contingent capital, enhanced public disclosures and limits on short-term debt, including off-balance sheet exposures.

As a G-SIB, we are subject to enhanced supervision and prudential standards. Our status as a G-SIB has also resulted in heightened expectations of

State Street Corporation | 14

our U.S. and international regulators with respect to our capital and liquidity management and our compliance and risk oversight programs. These heightened expectations have increased our regulatory compliance costs, including personnel, technology and systems, as well as significant additional implementation and related costs to enhance our regulatory compliance programs. Regulatory compliance requirements are anticipated to remain at least at the elevated levels we have experienced over the past several years.

Failure to meet current and future regulatory capital requirements could subject us to a variety of enforcement actions, including the termination of State Street Bank’s deposit insurance by the FDIC, and to certain restrictions on our business, including those that are described above in this “Supervision and Regulation” section.

Not all of our competitors have similarly been designated as systemically important nor are all of them subject to the same degree of regulation as a bank or financial holding company, and therefore some of our competitors may not be subject to the same additional capital requirements.

For additional information about our regulatory capital position and our regulatory capital adequacy, as well as current and future regulatory capital requirements, refer to “Capital” in “Financial Condition” in our Management’s Discussion and Analysis, and Note 16 to the consolidated financial statements in this Form 10-K.

The Volcker Rule

We are subject to the Volcker Rule and implementing regulations. The Volcker Rule prohibits banking entities, including us and our affiliates, from engaging in certain prohibited proprietary trading activities, as defined in the Volcker Rule regulations, subject to exemptions for market-making related activities, risk-mitigating hedging, underwriting and certain other activities. The Volcker Rule also requires banking entities to either restructure or divest certain ownership interests in, and relationships with, covered funds (as such terms are defined in the Volcker Rule regulations).

The Volcker Rule regulations require banking entities to establish extensive programs designed to promote compliance with the restrictions of the Volcker Rule. Consequently, Volcker Rule compliance entails both the cost of implementing a compliance program and loss of certain revenue and future opportunities.

Recovery and Resolution Planning

Under Section 165(d) of the Dodd-Frank Act, we are required to submit a resolution plan on a biennial basis jointly to the Federal Reserve and the FDIC (the Agencies). The purpose of our resolution plan is to

describe our preferred resolution strategy and to demonstrate that we have the resources and capabilities to execute on that strategy in the event of major financial distress. Through resolution planning, we seek to maintain our role as a key service provider within the financial system, while minimizing risk to the financial system.

The Agencies’ final rule from 2019 requires U.S. G-SIBs to file a full resolution plan and a targeted resolution plan on an alternating basis in the relevant submission years. We submitted our targeted 165(d) resolution plan by July 1, 2025. Our next 165(d) resolution plan submission to the Agencies is a full resolution plan due by July 1, 2027.

In the event of material financial distress, our preferred resolution strategy is the single point of entry strategy (the SPOE Strategy). The SPOE Strategy provides that prior to the bankruptcy of the Parent Company and pursuant to a support agreement among the Parent Company, SSIF (a direct subsidiary of the Parent Company), our Beneficiary Entities (as defined below) and certain of our other entities, SSIF is obligated, up to its available resources, to recapitalize and/or provide liquidity to State Street Bank and the other entities benefiting from such capital and/or liquidity support (collectively with State Street Bank, Beneficiary Entities), in amounts designed to prevent the Beneficiary Entities from themselves entering into resolution proceedings. Following the recapitalization of, or provision of liquidity to the Beneficiary Entities, the Parent Company would enter into a bankruptcy proceeding under the U.S. Bankruptcy Code. The Beneficiary Entities and our other subsidiaries would be transferred to a newly organized holding company held by a reorganization trust for the benefit of the Parent Company’s claimants.

Under and as required by the support agreement, the Parent Company has pre-funded SSIF through its contribution of most of its non-subsidiary assets (primarily its liquid assets, cash deposits, investments in intercompany debt, investments in marketable securities, and other cash and non-cash equivalent investments) to SSIF at the time it entered into the support agreement and continues to contribute such assets, to the extent available, on an ongoing basis. Under the support agreement, the Parent Company retains liquid assets needed to meet its upcoming obligations and to fund expected expenses during a potential bankruptcy proceeding. In consideration for the Parent Company’s contributions, SSIF has agreed in the support agreement to provide capital and liquidity support to the Parent Company and all of the Beneficiary Entities in accordance with the Parent Company’s capital and liquidity policies.

SSIF has provided the Parent Company with a committed credit line and issued (and may issue) one

State Street Corporation | 15

or more promissory notes to the Parent Company (the Parent Company Funding Notes) that together are intended to allow the Parent Company to continue to meet its obligations throughout the period prior to the occurrence of a Recapitalization Event, which is defined under the support agreement as the earlier occurrence of: (1) one or more capital and liquidity thresholds being breached or (2) the authorization by the Parent Company’s Board of Directors for the Parent Company to commence bankruptcy proceedings. The support agreement does not obligate SSIF to maintain any specific level of resources and SSIF may not have sufficient resources to implement the SPOE Strategy.

In the event a Recapitalization Event occurs, the obligations outstanding under the Parent Company Funding Notes would automatically convert into or be exchanged for capital contributed to SSIF. The obligations of the Parent Company and SSIF under the support agreement are secured through a security agreement that grants a lien on the assets that the Parent Company and SSIF would use to fulfill their obligations under the support agreement to the Beneficiary Entities. SSIF is a distinct legal entity separate from the Parent Company and the Parent Company’s other affiliates.

Upon the occurrence of a Recapitalization Event: (1) SSIF would not be authorized to provide any further liquidity to the Parent Company; (2) the Parent Company would be required to contribute to SSIF any remaining assets it is required to contribute to SSIF under the support agreement (which specifically exclude amounts designated to fund expected expenses during a potential bankruptcy proceeding); (3) SSIF would be required to provide capital and liquidity support to the Beneficiary Entities to support such entities’ continued operation to the extent of its available resources and consistent with the support agreement; and (4) the Parent Company would be expected to commence Chapter 11 proceedings under the U.S. Bankruptcy Code. No person or entity, other than a party to the support agreement, should rely on any of our affiliates being or remaining a Beneficiary Entity or receiving capital or liquidity support pursuant to the support agreement, including in evaluating any of our entities from a creditor’s perspective or determining whether to enter into a contractual relationship with any of our entities.

State Street Bank is also required to submit to the FDIC a plan for resolution in the event of its failure, referred to as an IDI plan. We submitted our last IDI plan, under the prior version of the rule, by December 1, 2023. The FDIC’s final rule on IDI plans that became effective on October 1, 2024 requires IDI subsidiaries of U.S. G-SIBs, such as State Street Bank, to file their IDI plans on a biennial basis, with

the first IDI plan submission under the final rule due by July 1, 2026.

Additionally, we are required to submit a recovery plan periodically to the Federal Reserve. This plan includes strategies designed to respond to stress factors at an early stage and stabilize and maintain operational continuity and market confidence. Our recovery strategies are intended to be implemented before our resolution plan is triggered. We are also engaged in recovery planning requirements in certain international jurisdictions where we operate.

Orderly Liquidation Authority

Under Title II of the Dodd-Frank Act, certain financial companies, including bank holding companies such as the Parent Company, and certain covered subsidiaries, can be subjected to the orderly liquidation authority. For the FDIC to be appointed as our receiver, two-thirds of the FDIC Board and two-thirds of the Federal Reserve Board must recommend appointment, and the U.S. Treasury Secretary, in consultation with the U.S. President, must then make certain extraordinary financial distress and systemic risk determinations. Absent such actions, we, as a bank holding company, would remain subject to the U.S. Bankruptcy Code.

If the FDIC were appointed as the receiver of the Parent Company pursuant to the orderly liquidation authority, the FDIC would have considerable powers to resolve the Parent Company, including: (1) the power to remove officers and directors responsible for the Parent Company’s failure and to appoint new directors and officers; (2) the power to assign assets and liabilities to a third party or bridge financial company without the need for creditor consent or prior court review; (3) the ability to differentiate among similarly situated creditors, subject to a minimum recovery right to receive at least what they would have received in bankruptcy liquidation; and (4) broad powers to administer the claims process to determine distributions from the assets of the receivership to creditors not transferred to a third party or bridge financial institution.

The FDIC’s releases have indicated that it would likely use its powers under the orderly liquidation authority to resolve a SIFI pursuant to an SPOE Strategy, but not all aspects of how the FDIC might exercise this authority are known and additional rulemaking is possible.

The execution of an SPOE Strategy, whether applied pursuant to our preferred resolution strategy under the U.S. Bankruptcy Code or in a proceeding pursuant to the FDIC’s “orderly liquidation authority” under Title II of the Dodd-Frank Act, will likely result in the holders of unsecured debt of the Parent Company absorbing State Street Corporation’s losses in a resolution scenario, including in the event of the

State Street Corporation | 16

failure of State Street Bank as contemplated by the IDI plan.

Derivatives

Title VII of the Dodd-Frank Act imposed a comprehensive regulatory structure on the OTC derivatives market, including requirements for clearing, exchange trading, capital, margin, reporting and record-keeping. Title VII also requires certain persons to register as a major swap participant, a swap dealer or a securities-based swap dealer. The CFTC, the SEC, and other U.S. regulators have largely completed the implementation of the provisions of Title VII.

State Street Bank has registered with the CFTC as a swap dealer. As a registered swap dealer, State Street Bank is subject to significant regulatory obligations regarding its swap activity and the supervision, examination and enforcement powers of the CFTC and other regulators. The CFTC has granted State Street Bank a limited-purpose swap dealer designation. Under this limited-purpose designation, interest rate swap activity conducted by State Street Bank’s Global Treasury group is not subject to certain of the swap regulatory requirements otherwise applicable to swaps entered into by a registered swap dealer, subject to a number of conditions. For all other swap transactions, our swap activities remain subject to all applicable swap dealer regulations.

Subsidiaries

The Federal Reserve is the primary federal banking agency responsible for regulating us and our subsidiaries, including State Street Bank, with respect to both our U.S. and non-U.S. operations. Our banking subsidiaries are subject to supervision and examination by various regulatory authorities and have regulatory requirements that may differ from the Parent Company.

State Street Bank

State Street Bank is a member of the Federal Reserve System, its deposits are insured by the FDIC and it is subject to applicable federal and state banking laws and to supervision and examination by the Federal Reserve, the Massachusetts Commissioner of Banks, as well as the FDIC and the regulatory authorities of those states and countries in which State Street Bank operates a branch.

As with the Parent Company, State Street Bank is subject to the Basel III framework and the market risk capital rule in the United States. As required by the Dodd-Frank Act, State Street Bank, as an advanced approaches banking organization, is subject to a “capital floor,” also referred to as the Collins Amendment, in the assessment of its regulatory capital adequacy described above in this “Supervision and Regulation” section.

Under the Basel III framework, State Street Bank’s regulatory capital calculations, including any additions or deductions from capital for regulatory purposes, are consistent with the calculations of the Parent Company. For additional information about the 2023 Basel III Endgame Proposal, refer to “Basel III Rule” above in this “Supervision and Regulation” section.

Similar to our Parent Company, State Street Bank is subject to the Tier 1 leverage ratio and the SLR. However, as State Street Bank is an IDI subsidiary of a U.S. G-SIB, it is required to maintain a minimum Tier 1 leverage ratio of 5% and a minimum SLR of 6% to be considered well capitalized.

The eSLR Final Rule adopted by the U.S. Agencies on November 25, 2025 would modify the eSLR for depository institution subsidiaries of G-SIBs from the current 6% “well capitalized” threshold under the prompt corrective action framework to an eSLR buffer standard equal to 50% of the parent G-SIB's Method 1 surcharge calculation floored at 1%. The final rule is effective April 1, 2026, with the possibility for firms to early adopt effective January 1, 2026. State Street Bank, as a subsidiary of a U.S. G-SIB, would therefore be subject under the final rule to an eSLR buffer equal to 50% of our Method 1 surcharge floored at 1%.

For the purposes of calculating the SLR, State Street Bank is subject to the U.S. Agencies’ final rule that excludes qualifying central bank deposits from a custodial banking organization’s total leverage exposure. For the quarter ended December 31, 2025, State Street Bank excluded $91.5 billion of average balances held on deposit at central banks from the denominator used in the calculation of our SLR based on this custodial banking exclusion.

Pursuant to the U.S. Agencies’ LCR and NSFR final rules, as a subsidiary of a U.S. G-SIB, State Street Bank is similarly required to maintain an LCR and NSFR, respectively, equal to or greater than 100%.

We and our subsidiaries that are not subsidiaries of State Street Bank are affiliates of State Street Bank under federal banking laws, which impose restrictions on various types of transactions, including loans, extensions of credit, investments or asset purchases by or from State Street Bank, on the one hand, to us and those of our subsidiaries, on the other. Transactions of this kind between State Street Bank and its affiliates generally are limited with respect to each affiliate to 10% of State Street Bank’s capital and surplus, as defined by the aforementioned banking laws, are limited in the aggregate for all affiliates to 20% of State Street Bank’s capital and surplus, and in some cases are also subject to strict collateral requirements. Derivatives, securities borrowing and securities lending transactions

State Street Corporation | 17

between State Street Bank and its affiliates became subject to these restrictions pursuant to the Dodd-Frank Act. The Dodd-Frank Act also expanded the scope of transactions required to be collateralized. In addition, the Volcker Rule generally prohibits similar transactions between the Parent Company or any of its affiliates and covered funds for which we or any of our affiliates serve as the investment manager, investment adviser, commodity trading advisor or sponsor and other covered funds organized and offered pursuant to specific exemptions in the Volcker Rule regulations.

Federal law also requires that certain transactions by a bank with affiliates be on terms and under circumstances, including credit standards, that are substantially the same, or at least as favorable to the bank, as those prevailing at the time for comparable transactions involving other non-affiliated companies. Alternatively, in the absence of comparable transactions, the transactions must be on terms and under circumstances, including credit standards, that in good faith would be offered to, or would apply to, non-affiliated companies.

State Street Bank is also prohibited from engaging in certain tie-in arrangements in connection with any extension of credit or lease or sale of property or furnishing of services. Federal law provides for a depositor preference on amounts realized from the liquidation or other resolution of any depository institution insured by the FDIC.

Other Subsidiaries

Our other subsidiary trust companies are subject to supervision and examination by the OCC, the Federal Reserve or by the appropriate state banking regulatory authorities of the states in which they are organized and operate. Our continental European banking subsidiary, State Street Bank International GmbH is a significant entity in accordance with European banking regulations and accordingly is supervised directly by the ECB. State Street Bank International GmbH operates in several countries including Germany, Luxembourg, Italy, France and Switzerland. In Ireland our depositary and fund administration companies are regulated by the Central Bank of Ireland and in Canada our trust company is regulated by the Office of the Superintendent of Financial Institutions. Our other subsidiaries internationally engaged in our investment servicing activities are regulated by applicable authorities in the jurisdictions of their activities. Our subsidiaries involved in our investment management and securities and markets businesses are regulated by governments, securities exchanges, self-regulatory organizations, central banks and regulatory bodies in U.S. federal and state and non-U.S. jurisdictions, especially in those jurisdictions in which we maintain an office.

Many aspects of our investment management activities are subject to U.S. federal and state, as well as non-U.S., laws and regulations primarily intended to benefit the investment holder, rather than our shareholders. These laws and regulations generally grant supervisory agencies and bodies broad administrative powers, including the power to limit or restrict us from conducting our investment management activities in the event that we fail to comply with such laws and regulations, and examination authority. Our business related to investment management and trusteeship of collective trust funds and separate accounts offered to employee benefit plans is subject to the Employee Retirement Income Security Act (ERISA), and is regulated by the U.S. Department of Labor (DOL).

The majority of our non-U.S. investment servicing operations are conducted pursuant to the Federal Reserve’s Regulation K through State Street Bank’s Edge Act subsidiary or through international branches of State Street Bank. An Edge Act corporation is a corporation organized under federal law that conducts foreign business activities. In general, banks may not make investments in their Edge Act corporations (and similar state law corporations) that exceed 20% of their capital and surplus, as defined in the relevant banking regulations, and the investment of any amount in excess of 10% of capital and surplus requires the prior approval of the Federal Reserve.

In addition to our non-U.S. operations conducted pursuant to Regulation K, we also make new investments abroad directly (through us or through our non-banking subsidiaries) pursuant to the Federal Reserve’s Regulation Y, or through international bank branch expansion, neither of which is subject to the investment limitations applicable to Edge Act subsidiaries.

Additionally, Massachusetts has its own bank holding company statute, under which we, among other things, may be required to obtain prior approval by the Massachusetts Board of Bank Incorporation for an acquisition of more than 5% of any additional bank's voting shares, or for other forms of bank acquisitions.

Anti-Money Laundering and Financial Transparency

Certain of our subsidiaries are subject to the Bank Secrecy Act of 1970, as amended by the USA PATRIOT Act of 2001, and related regulations, which contain AML and financial transparency provisions and which require implementation of an AML compliance program, including processes for verifying client identification and monitoring client transactions and detecting and reporting suspicious activities. AML laws outside the United States contain similar requirements. State Street Corporation and its

State Street Corporation | 18

subsidiaries are also required to comply with sanctions laws and regulations administered and imposed by the U.S. government, including the U.S. Treasury Department’s OFAC and the Department of State, as well as comparable sanctions programs imposed by foreign governments and multilateral bodies. We have implemented an enterprise-wide AML and sanctions compliance program, including policies, procedures and internal controls that are designed to promote compliance with applicable AML laws and regulations and sanctions. AML laws and regulations applicable to our operations may be more stringent than similar requirements applicable to our non-regulated competitors or financial institutions principally operating in other jurisdictions.

Compliance with applicable AML and related requirements is a common area of review for financial regulators, and any failure by us to comply with these requirements could result in fines, penalties, lawsuits, regulatory sanctions, difficulties in obtaining governmental approvals, restrictions on our business activities or harm to our reputation. There have been numerous enforcement actions by regulators, as well as state attorneys general and the U.S. Department of Justice, against financial institutions with respect to AML and sanctions laws and some have resulted in penalties, including criminal penalties.

Deposit Insurance

The Dodd-Frank Act made permanent the general $250,000 deposit insurance limit for insured deposits. The FDIC’s Deposit Insurance Fund (DIF) is funded by assessments on FDIC IDIs. The FDIC assesses DIF premiums based on an IDI’s average consolidated total assets, less the average tangible equity of the IDI during the assessment period. For larger institutions, such as State Street Bank, assessments are determined based on regulatory ratings and forward-looking financial measures to calculate the assessment rate, which is subject to adjustments by the FDIC, and the assessment base.

The FDIC is required to determine whether and to what extent adjustments to the assessment base are appropriate for “custody banks” that satisfy specified institutional eligibility criteria. The FDIC has concluded that certain liquid assets could be excluded from the deposit insurance assessment base of custody banks. This, subject to change by the FDIC, has the effect of reducing the amount of DIF insurance premiums due from custody banks. State Street Bank qualifies as a custody bank for this purpose. The custody bank assessment adjustment may not exceed total transaction account deposits identified by the institution as being directly linked to a fiduciary or custody and safekeeping asset.

Following the failures of Silicon Valley Bank and Signature Bank and the resulting losses to the DIF in 2023, the FDIC adopted a final rule in November

2023 to implement a special assessment to recover the cost associated with protecting their uninsured depositors payable over an eight-quarter collection period starting with the first quarter of 2024. In December 2025, the FDIC adopted an interim final rule, reducing the assessment amount for the eighth and final collection period in the first quarter of 2026. We recognized a pre-tax expense of approximately $387 million and $99 million in 2023 and 2024, respectively, and a $60 million pre-tax reduction in expense in 2025, within other expenses, reflecting State Street Bank’s allocation of the special assessment and the FDIC’s subsequent updates to its estimate of losses to the DIF. The total expense for the special assessment remains subject to any actions by the FDIC, to cease collection early, extend the special assessment period, or impose a one-time final shortfall special assessment, including as a result of updates to the estimated losses.

Prompt Corrective Action

The FDIC Improvement Act of 1991 requires the appropriate federal banking regulator to take “prompt corrective action” with respect to a depository institution if that institution does not meet certain capital adequacy standards, including minimum capital ratios. While these regulations apply only to banks, such as State Street Bank, the Federal Reserve is authorized to take appropriate action against a parent bank holding company, such as our Parent Company, based on the under-capitalized status of any banking subsidiary. In certain instances, we would be required to guarantee the performance of a capital restoration plan if one of our banking subsidiaries were undercapitalized.

Support of Subsidiary Banks

Under Federal Reserve regulations, a bank holding company such as our Parent Company is required to act as a source of financial and managerial strength to its banking subsidiaries. This requirement was added to the Federal Deposit Insurance Act by the Dodd-Frank Act. This means that we have a statutory obligation to commit resources to State Street Bank and any other banking subsidiary in circumstances in which we otherwise might not do so absent such a requirement. In the event of bankruptcy, any commitment by us to a federal bank regulatory agency to maintain the capital of a banking subsidiary will be assumed by the bankruptcy trustee and will be entitled to a priority payment.

Insolvency of an Insured U.S. Subsidiary Depository Institution

If the FDIC is appointed the conservator or receiver of an FDIC-insured U.S. subsidiary depository institution, such as State Street Bank, upon its insolvency or certain other events, the FDIC has the ability to transfer any of the depository

State Street Corporation | 19

institution’s assets and liabilities to a new obligor without the approval of the depository institution’s creditors, enforce the terms of the depository institution’s contracts pursuant to their terms or repudiate or disaffirm contracts or leases to which the depository institution is a party. Additionally, the claims of holders of deposit liabilities and certain claims for administrative expenses against an IDI would be afforded priority over other general unsecured claims against such an institution, including claims of debt holders of the institution and, under current interpretation, depositors in non-U.S. branches and offices, in the liquidation or other resolution of such an institution by any receiver. As a result, such persons would be treated differently from and could receive, if anything, substantially less than the depositors in U.S. offices of the depository institution.

Cybersecurity and Data Privacy

The financial services industry faces increased global regulatory focus regarding cybersecurity and data privacy. Many aspects of our businesses are subject to cybersecurity and data privacy legal and regulatory requirements enacted by U.S. federal and state governments and other non-U.S. jurisdictions. These requirements impose, among other things, mandatory cybersecurity and data privacy obligations, including providing for resiliency, individual rights, enhanced governance and accountability requirements, and significant fines and litigation risk for noncompliance. In addition, several jurisdictions have enacted or proposed localization requirements and restrictions on cross-border transfers of personal information that may restrict our ability to conduct business in those jurisdictions or create additional financial, legal and regulatory burdens to do so. For example, in the European Union, we are subject to the GDPR, which requires, among other things, a comprehensive privacy, data protection and cybersecurity program to protect the personal and sensitive data of residents of the European Economic Area. Following the withdrawal of the United Kingdom from the European Union, we are also subject to the U.K. General Data Protection Regulation (a version of the GDPR as implemented into U.K. law), as amended by the Data Use and Access Act 2025, which received Royal Assent on June 19, 2025 with certain provisions taking immediate effect.

The U.S. Agencies finalized a rule in November 2021 requiring banking organizations to notify their primary federal regulators as soon as possible and no later than 36 hours after identifying a “computer-security incident” that has materially affected, or is reasonably likely to materially affect, the viability of their operations, their ability to deliver banking products and services or the stability of the financial sector. The final rule became effective April 1, 2022.

In March 2022, the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) was signed into law and requires, among other things, the Cybersecurity and Infrastructure Security Agency (CISA) to develop and implement regulations for covered entities to report certain covered cyber incidents within 72 hours from the time the company reasonably believes the incident occurred (and within 24 hours of making a ransom payment as a result of a ransomware attack). On April 4, 2024, the CISA proposed a rule under the CIRCIA that would clarify the scope of cyber incidents to be reported and would further define covered entities subject to the CIRCIA to expressly include companies in the financial services industry, such as the Parent Company and State Street Bank, that are required to report cyber incidents to their primary federal regulators. Although the CIRCIA originally required the CISA to finalize its regulations by October 4, 2025, the CISA has extended such deadline to May 2026. In addition, the SEC adopted new rules on July 26, 2023 that require registrants to publicly disclose on a Form 8-K material cybersecurity incidents within four business days of determining that such an incident is material.

In November 2022, the European Union adopted DORA, which requires, among other things, financial institutions to follow certain rules regarding protection, detection, containment, recovery and repair capabilities with respect to information and communication technology-related incidents.

In addition, numerous jurisdictions have passed laws, rules and regulations regarding cybersecurity and data privacy risk management, and many are considering new or updated requirements that could impact our businesses, particularly as the application, interpretation and enforcement of these laws, rules and regulations are often uncertain and evolving.

Further discussion of cybersecurity and data privacy risk management is provided in “Information Technology Risk Management” included in our Management’s Discussion and Analysis in this Form 10-K.

ECONOMIC CONDITIONS AND GOVERNMENT POLICIES

Economic policies of the U.S. government and its agencies influence our operating environment. Monetary policy conducted by the Federal Reserve directly affects the level of interest rates, which may affect overall credit conditions of the economy. Monetary policy is applied by the Federal Reserve through open market operations in U.S. government securities, changes in reserve requirements for depository institutions, and changes in the discount rate and availability of borrowing from the Federal Reserve. Government regulation of banks and bank holding companies is intended primarily for the protection of depositors of the banks, rather than for

State Street Corporation | 20

the shareholders of the institutions, and therefore may, in some cases, be adverse to the interests of those shareholders. We are similarly affected by the economic policies of non-U.S. government agencies, such as the Bank of England and the ECB.