NASDAQ: WTFCN

Our Business and Reporting Segments

As set forth in Note (24) “Segment Information”, our operations consist of three primary segments: community banking, specialty finance and wealth management. The three reportable segments are strategic business units that are separately managed as they offer different products and services and have different marketing strategies. In addition, each segment’s customer base has varying characteristics and each segment has a different regulatory environment. While the Company’s management monitors each of the sixteen bank subsidiaries’ operations and profitability separately, these subsidiaries have been aggregated into one reportable operating segment due to the similarities in products and services, customer base, operations, profitability measures and economic characteristics. All segment measurements discussed below are based on the reportable segments and do not reflect intersegment eliminations.

Community Banking

Through our community banking segment, our banks provide community-oriented, personal and commercial banking services to customers located in our market area. Our customers include individuals, small to mid-sized businesses, local governmental units and institutional clients residing primarily in the banks’ local service areas. The banks have a strategy to provide comprehensive community-focused banking services. In keeping with this strategy, the banks provide highly personalized and responsive services, a characteristic of locally-owned and managed institutions. As such, the banks compete for deposits principally by offering depositors a variety of deposit programs, convenient office locations, hours and other services, and for loan originations primarily through the interest rates and loan fees they charge, the efficiency and quality of services they provide to borrowers and the variety of their loan and treasury management products. Using our multiple bank charter corporate structure to our advantage, we offer our MaxSafe® deposit accounts, which provide customers with expanded Federal Deposit Insurance Corporation (“FDIC”) insurance coverage by spreading a customer’s deposit across our sixteen banks. This product differentiates our banks from many of our competitors that have consolidated their bank charters into branches. We also have downtown Chicago and Milwaukee offices that work with each of our banks to capture commercial and industrial business. Our commercial and industrial lenders in our downtown offices operate in close partnership with lenders at our community banks. By combining our expertise in the commercial and industrial sector with our high level of personal service and a full suite of banking products, we believe we create another point of differentiation from both our larger and smaller competitors. Our banks also offer home equity, consumer, and real estate loans, safe deposit facilities, ATMs, online and mobile banking and other innovative and traditional services specially tailored to meet the needs of customers in their market areas.

We developed our banking franchise through a combination of de novo organizations and the purchase of existing bank franchises. The organizational efforts began in 1991, when a group of experienced bankers and local business people identified an unfilled niche in the Chicago metropolitan area retail banking market. As large banks acquired smaller ones and personal

3

service was subjected to consolidation strategies, the opportunity increased for locally owned and operated, highly personal service-oriented banks. As a result, Lake Forest Bank was founded in December 1991 to service the Lake Forest and Lake Bluff communities within the Chicago metropolitan area.

As of December 31, 2025, we owned sixteen nationally chartered banks: Barrington Bank, Beverly Bank & Trust Company, N.A. (“Beverly Bank”), Crystal Lake Bank & Trust Company, N.A. (“Crystal Lake Bank”), Hinsdale Bank & Trust Company, N.A. (“Hinsdale Bank”), Lake Forest Bank, Libertyville Bank & Trust Company, N.A. (“Libertyville Bank”), Macatawa Bank, N.A. (“Macatawa Bank”), Northbrook Bank & Trust Company, N.A. (“Northbrook Bank”), Old Plank Trail Community Bank, N.A. (“Old Plank Trail Bank”), Schaumburg Bank & Trust Company, N.A. (“Schaumburg Bank”), St. Charles Bank & Trust Company, N.A. (“St. Charles Bank”), State Bank of the Lakes, N.A. (“State Bank of the Lakes”), Town Bank, N.A. (“Town Bank”), Village Bank & Trust, N.A. (“Village Bank”), Wheaton Bank & Trust Company, N.A. (“Wheaton Bank”), and Wintrust Bank, N.A. (“Wintrust Bank”). As of December 31, 2025, we had 209 banking locations. Each nationally-chartered bank is subject to regulation, supervision and regular examination by the Office of the Comptroller of the Currency (“OCC”).

We also engage in the retail origination of residential mortgages through Wintrust Mortgage as well as consumer direct lending primarily to veterans through our Veterans First brand. Certain originated residential mortgage loans are sold to unaffiliated companies or the Company’s banks; and, Wintrust Mortgage balances selling loans with servicing retained versus servicing released to maximize current gain on sale revenue combined with potentially deepening customer relationships. Wintrust Mortgage maintains retail mortgage offices in a number of states, with the largest concentration located in the Chicago, Minneapolis, Salt Lake City and Los Angeles metropolitan areas.

We also offer several niche lending products through several of the banks. These include Barrington Bank’s Community Advantage program, which provides lending, deposit and treasury management services to condominium, homeowner and community associations; Hinsdale Bank’s mortgage warehouse lending program, which provides loan and deposit services to mortgage brokerage companies; and Lake Forest Bank’s franchise lending program, which provides lending to restaurant franchisees. Other niches offered throughout our banking franchise include, but are not limited to, Wintrust Commercial Finance, which offers direct leasing opportunities; Wintrust Business Credit, which specializes in asset-based lending for middle-market companies; Wintrust SBA Lending, which is dedicated to offering expertise in Small Business Administration (“SBA”) loans; Wintrust Commercial Real Estate, which concentrates on real estate lending solutions including commercial mortgages and construction loans; and Wintrust Government, Non-Profit & Healthcare, which focuses on financial solutions for mission-based organizations such as healthcare facilities, non-profits, educational institutions and local government operations. In addition, we offer a niche deposit service through Northbrook Bank’s Funds Group and Financial Markets Group, as well as Wintrust Bank's Wintrust Workplace Solutions, which offers Health Savings Accounts and other notional banking products for employers.

For the years ended December 31, 2025, 2024 and 2023, the community banking segment had net revenues of $2.1 billion, $1.8 billion and $1.7 billion, respectively, and net income of $576.7 million, $458.7 million and $414.1 million, respectively. The community banking segment had total assets of $57.3 billion, $52.5 billion and $44.4 billion as of December 31, 2025, 2024 and 2023, respectively. The community banking segment accounted for approximately 74.7% of our consolidated net revenues, excluding intersegment eliminations, for the year ended December 31, 2025.

Specialty Finance

Through our specialty finance segment, we offer financing of insurance premiums for businesses and individuals; insurance banking services, which provides financing to insurance agents, brokers, insurance carriers and other insurance businesses; and accounts receivable financing, value-added, out-sourced administrative services; and other specialty finance businesses. FIRST Insurance Funding and Wintrust Life Finance engage in the premium finance receivables business, our most significant specialized lending niche, including property and casualty insurance premium finance and life insurance premium finance. We also engage in property and casualty insurance premium finance in Canada through our wholly-owned subsidiary FIFC Canada.

In their property and casualty insurance premium finance operations, FIRST Insurance Funding and FIFC Canada make loans primarily to businesses to finance the insurance premiums the business pay on their property and casualty insurance policies. Approved insurance agents and brokers located throughout the United States and Canada assist FIRST Insurance Funding and FIFC Canada, respectively, in arranging each commercial premium finance loan between the borrower and FIRST Insurance Funding or FIFC Canada, as the case may be. FIRST Insurance Funding or FIFC Canada establishes its own underwriting criteria focused on the amount of the down payment on the insurance policy, the term of the loan, the credit quality of the insurance company providing the financed insurance policy, the interest rate, the borrower's previous payment history, if any, and other factors deemed appropriate. Upon acceptance of the loan by FIRST Insurance Funding or FIFC Canada, as the case may be, the borrower makes a down payment on the financed insurance policy, which is generally done by providing payment

4

to the agent or broker, who then forwards it to the insurance company. FIRST Insurance Funding or FIFC Canada may either forward the financed amount of the remaining policy premiums directly to the insurance carrier or to the agent or broker for remittance to the insurance carrier on FIRST Insurance Funding’s or FIFC Canada’s behalf. In some cases, the agent or broker may hold our collateral, in the form of the proceeds of the unearned insurance premium from the insurance company, and forward it to FIRST Insurance Funding or FIFC Canada in the event of a default by the borrower. This lending involves relatively rapid turnover of the loan portfolio and high volume of loan originations. Because the agent or broker is the primary contact to the ultimate borrowers who are located nationwide and because proceeds and our collateral may be handled by the agent or brokers during the term of the loan, FIRST Insurance Funding and FIFC Canada may be more susceptible to third party (i.e., agent or broker) fraud. The Company performs various controls and procedures including ongoing credit and other reviews of the agents and brokers as well as performs various internal audit steps to mitigate against the risk of material fraud.

The commercial and property premium finance business is subject to regulation in the majority of states. Regulation typically governs notices to borrowers prior to cancellation of a policy and required communication to insurance agents and insurance companies. FIRST Insurance Funding offers financing of property and casualty insurance policies in all 50 states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands. FIRST Insurance Funding’s legal department regularly monitors changes to regulations and updates policies and programs accordingly. FIFC Canada is subject to federal regulation in Canada which governs notices to borrowers prior to cancellation of a policy and required communication to insurance agents and insurance companies.

Wintrust Life Finance finances life insurance policy premiums for estate planning purposes of high net-worth borrowers and for multi-life trust strategies with goals of providing insureds various benefits in addition to estate planning. These loans are originated via referrals from life insurance carriers, independent insurance agents, financial advisors and legal counsel. The cash surrender value of the life insurance policy is the primary form of collateral. In addition, these loans often are secured with a letter of credit, marketable securities or certificates of deposit. In very rare cases, Wintrust Life Finance may make a loan that has a partially unsecured position.

The life insurance premium finance business is subject to banking regulations but is not subject to additional regulatory regimes (e.g. additional state regulation). Wintrust Life Finance’s compliance department regularly monitors the regulatory environment and compliance with existing regulations. Wintrust Life Finance maintains a policy prohibiting the known financing of stranger-originated life insurance and has established procedures to identify and prevent financing such policies. While a carrier could potentially put at risk the cash surrender value of a policy, which serves as Wintrust Life Finance’s primary collateral, by challenging the validity of the insurance contract for lack of an insurable interest, Wintrust Life Finance believes it has strong counterclaims against any such claims by carriers, in addition to recourse to borrowers and guarantors as well as to additional collateral in certain cases.

Premium finance loans made by FIRST Insurance Funding, Wintrust Life Finance and FIFC Canada are primarily secured by the insurance policies financed by the loans. These insurance policies are written by a large number of insurance companies geographically dispersed throughout the United States, the United Kingdom and Canada. Our premium finance receivables balances finance insurance policies that are spread among a large number of insurers; however, one of the insurers represents approximately 9% of such balances and two additional insurers represent approximately 8% each of such balances. FIRST Insurance Funding, Wintrust Life Finance and FIFC Canada consistently monitor carrier ratings and financial performance of our carriers. In the event carrier ratings fall below certain levels, most of Wintrust Life Finance’s life insurance premium finance policies provide for an event of default and allow Wintrust Life Finance to have recourse to borrowers and guarantors as well as to additional collateral in certain cases. For the commercial premium finance business, the term of the loans is sufficiently short such that in the event of a decline in carrier ratings, FIRST Insurance Funding or FIFC Canada, as the case may be, can restrict or eliminate additional loans to finance premiums to such carriers. The majority of premium finance receivables are purchased by the banks in order to more fully utilize their lending capacity as these loans generally provide attractive yields and have historically provided predictably good credit performance through various credit cycles.

Through our wholly-owned subsidiary Wintrust Asset Finance, we provide equipment financing through structured loan and lease products to customers in a variety of industries throughout the United States. Wintrust Asset Finance provides financing of fixed assets consisting of property, plant and equipment, transportation (trucks, trailers, rail, marine, buses), construction, manufacturing equipment, technology, oil and gas, restaurant equipment, medical and healthcare. As of December 31, 2025, the Company’s leasing portfolio, including direct financing leases, loans and equipment on operating leases, totaled $4.5 billion compared to $3.9 billion as of December 31, 2024. During 2025, Wintrust Asset Finance contributed approximately $112.9 million to our revenue, which does not reflect intersegment eliminations.

Through our wholly-owned subsidiary Tricom, we provide high-yielding, short-term accounts receivable financing and value-added, outsourced administrative services, such as data processing of payrolls, billing and cash management services to the temporary staffing industry. Tricom’s clients, located throughout the United States, provide staffing services to businesses in

5

diversified industries. During 2025, Tricom processed payrolls with associated client billings of approximately $593.3 million and contributed approximately $10.1 million to our revenue, net of interest expense, which does not reflect intersegment eliminations.

In 2025, our commercial premium finance operations, life insurance premium finance operations, leasing operations and accounts receivable finance operations accounted for 48%, 28%, 2% and 22%, respectively, of the total revenues of our specialty finance business. For the years ended December 31, 2025, 2024 and 2023 the specialty finance segment had net revenues of $509.1 million, $475.6 million and $435.0 million, respectively, and net income of $205.3 million, $186.3 million and $175.5 million, respectively. The specialty finance segment had total assets of $12.5 billion, $11.2 billion and $10.7 billion as of December 31, 2025, 2024 and 2023, respectively. The specialty finance segment accounted for 18.4% of our consolidated net revenues, excluding intersegment eliminations, for the year ended December 31, 2025.

Wealth Management

Through our wealth management segment, we offer a full range of wealth management services through four separate subsidiaries (WPT, Wintrust Investments, GLA and CDEC): trust and investment services, tax-deferred like-kind exchange services, asset management solutions, and securities brokerage services.

Wintrust Investments, our investment subsidiary which has operated since 1931, provides a full range of private client and securities brokerage services to clients located primarily in the Midwest. Wintrust Investments is headquartered in downtown Chicago, operates an office in Appleton, Wisconsin, and has established locations in offices at a majority of our banks. In late January of 2025, following receipt of regulatory approvals and satisfaction of certain other conditions, Wintrust Investments transitioned support of the wealth management business of Wintrust Investments and certain private client business at GLA to a platform operated by LPL Financial Holdings, Inc. (“LPL”). This transition allows Wintrust Investments and GLA to focus on the growth of their wealth management business, while outsourcing most of their operational and compliance support to LPL. As a result of this outsourcing, Wintrust Investments deregistered as a broker-dealer and investment advisor in August of 2025.

WPT, our trust subsidiary, offers trust and investment management services to clients through offices located in downtown Chicago and at various banking offices of our sixteen banks. WPT is subject to regulation, supervision and regular examination by the OCC.

GLA, our registered investment adviser with locations in downtown Chicago, Tampa, Florida, and Stamford, Connecticut, as well as in various banking offices of our sixteen banks, provides money management services and advisory services to individuals, institutions, and municipal and tax-exempt organizations. GLA also provides portfolio management and financial advisory services for a wide range of pension and profit-sharing plans as well as money management and advisory services to WPT. GLA is regulated by the SEC as a registered investment adviser.

CDEC, our provider of tax-deferred like-kind exchange services, provides Qualified Intermediary services (as defined by U.S. Treasury regulations) for taxpayers seeking to structure tax-deferred like-kind exchanges under Internal Revenue Code (“IRC”) Section 1031. Under IRC Section 1031, a taxpayer may defer the gain on the sale of certain investment property if the taxpayer utilizes the services of a Qualified Intermediary. These transactions typically generate customer deposits during the period following the sale of the property until such proceeds are used to purchase a replacement property. These deposits may flow into our banks as a source of low-cost deposits. CDEC is the subsidiary of Elektra Holding Company, LLC (“Elektra”), which was acquired by the Company in December of 2018.

As of December 31, 2025, the Company’s wealth management subsidiaries had approximately $46.5 billion of assets under administration, which excludes $9.6 billion of assets owned by the Company and its subsidiary banks. For the years ended December 31, 2025, 2024 and 2023, the wealth management segment had net revenues of $191.9 million, $198.1 million and $169.3 million, respectively, and net income of $41.9 million, $50.0 million and $33.0 million, respectively. The wealth management segment had total assets of $1.3 billion, $1.1 billion and $1.2 billion as of December 31, 2025, 2024 and 2023, respectively. The wealth management segment accounted for 6.9% of our consolidated net revenues, excluding intersegment eliminations, for the year ended December 31, 2025.

Strategy and Competition

The Company has employed certain strategies to achieve strong net income amid increased competition and changing interest rate environments. In general, the Company has taken a steady and measured approach to grow strategically and manage expenses. Specifically, the Company has:

6

•Leveraged its internal loan pipeline and external growth opportunities to grow earnings assets to increase net interest income;

•Continued to diversify our loan portfolio by adding product and geographic diversification;

•Continued efforts to grow our deposit franchise in a diversified manner to be the Company’s primary funding source;

•Completed strategic acquisitions to expand our presence in existing and complimentary markets;

•Invested in our technology infrastructure to allow for growth and to enhance digital and other product offerings to better serve our existing customers and to attract new customers; and

•Focused on cost control and leveraging our infrastructure to create operating leverage.

Our strategy and competitive position for each of our business segments is summarized in further detail, below.

Community Banking

We compete in the commercial banking industry through our banks in the communities they serve. The commercial banking industry is highly competitive and the banks face strong direct competition for deposits, loans and other financial related services. The banks compete with other commercial banks, thrifts, credit unions, stockbrokers, government-sponsored entities, mutual fund companies, insurance companies, factoring companies and other commercial entities offering financial services products, including non-bank financial companies and entities commonly known as financial technology companies. Some of these competitors are local, while others are statewide or nationwide.

As a $71.1 billion asset financial services company, we expect to benefit from greater access to financial and managerial resources than our smaller local competitors while maintaining our commitment to local decision-making and to our community banking philosophy. In particular, we are able to provide a wider product selection and larger credit facilities than many of our smaller competitors, and we believe our service offerings help us in recruiting talented staff. We continue to add lenders throughout the community banking organization, many of whom have joined us because of our ability to offer a range of products and level of services which compete effectively with both larger and smaller market participants. We have continued to expand our product delivery systems, including a wide variety of electronic banking options for our retail and commercial customers which allow us to provide a level of service typically associated with much larger banking institutions. Additionally, we have access to public capital markets whereas many of our local competitors are privately held and may have limited capital-raising capabilities.

Management views service as a great equalizer to offset some of the inherent advantages of its significantly larger competitors. We also believe we are positioned to compete effectively with other larger and more diversified banks, bank holding companies and other financial services companies due to our multi-chartered approach that pushes accountability for building a franchise and a high level of customer service down to each of our banking franchises. Additionally, we believe that we provide a relatively complete portfolio of products that is responsive to the majority of our customers’ needs through the retail and commercial operations supplied by our banks, and through our mortgage and wealth management operations. The breadth of our product mix allows us to compete effectively with our larger competitors, while our multi-chartered approach with local and accountable management provides for what we believe is superior customer service relative to our larger and more centralized competitors. We continue to grow and enhance our digital service offerings while maintaining our expectations of high quality, more traditional banking services.

Wintrust Mortgage competes with large mortgage brokers as well as other banking organizations. Consolidation, margin compression, enhanced regulatory guidance and the promise of equal oversight for both banks and independent mortgage lenders have created challenges for small and medium-sized independent mortgage lenders. Wintrust Mortgage’s size, bank affiliation, regulatory competency, branding, technology, business development tools and reputation make us well positioned to compete in this environment. Wintrust Mortgage balances selling loans with servicing retained versus servicing released to maximize current gain on sale revenue combined with potentially deepening customer relationships. While earnings will fluctuate with the rise and fall of long-term interest rates, we expect that mortgage banking revenue will be a continuous source of revenue for us and our mortgage lending relationships will continue to provide franchise value to our other financial service businesses.

We continue to review our branch footprint and in 2025, the Company opened two new branch locations in the Chicago metropolitan area, and three new branch locations in southern Wisconsin. The Company closed only one branch location in west Michigan, previously acquired through the Macatawa acquisition. There was no material attrition or customer disruption in connection with these footprint changes. It is important to note that while we see increased use of electronic services and are investing heavily in digital capabilities to allow clients to choose how they want to be served, Wintrust expects that our strategy will continue to include selectively opening branches in areas where we are not represented.

7

Specialty Finance

FIRST Insurance Funding and Wintrust Life Finance encounter intense competition from numerous other firms, including several national commercial premium finance companies, companies affiliated with insurance carriers, independent insurance brokers who offer premium finance services, and other lending institutions. Some of our competitors are larger and have greater financial and other resources. FIRST Insurance Funding and Wintrust Life Finance compete with these entities by emphasizing a high level of knowledge of the insurance industry, flexibility in structuring financing transactions, consistency in the market, and the timely funding of qualifying contracts. We believe that our commitment to service also distinguishes us from our competitors. FIFC Canada competes with a few national commercial premium finance companies, a few regional providers and insurance broker owned premium finance companies where brokers finance their own customers policies.

Wintrust Asset Finance competes with other bank-affiliated, independent, captive and vendor equipment leasing and finance companies. Wintrust Asset Finance believes a customer-focused origination philosophy, an experienced team, strong underwriting discipline and expert asset management enables them to compete effectively in a growing and dynamic market.

Tricom competes with numerous other firms, including a small number of similar niche finance companies and payroll processing firms, large national processing firms, as well as various finance companies, banks and other lending institutions. Tricom’s management believes that its commitment to service distinguishes it from competitors.

Wealth Management

Our wealth management companies (WPT, Wintrust Investments, GLA and CDEC) compete with larger wealth management subsidiaries of other larger bank holding companies as well as with other trust companies, brokerage and other financial service companies, stockbrokers and financial advisors. We believe we can successfully compete for trust, tax services, asset management and brokerage business by offering personalized attention and customer service to small to midsize businesses and affluent individuals. We continue to recruit and hire experienced wealth management professionals from within the larger Chicago metropolitan area as well as Wisconsin, west Michigan and southwest Florida, which is expected to help in attracting new customer relationships.

Supervision and Regulation

Regulatory Environment

Our business is heavily regulated and supervised by federal agencies, state agencies and the federal & provincial governments of Canada. The scope of the laws, regulations and supervision to which our business is subject have increased in response to factors such as the regional banking uncertainty in early 2023, technological updates, and market changes. We expect that our business will remain subject to extensive regulation and supervision.

The Company is a bank holding company under the Bank Holding Company Act of 1956, as amended (the “BHC Act”), subject to regulation, supervision, and examination by the Federal Reserve. The Company is also subject to the disclosure and regulatory requirements of the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended, both as administered by the SEC, as well as the rules of the Nasdaq Stock Market (“Nasdaq”) that apply to companies with securities listed on the Nasdaq Global Select Market. Each nationally-chartered bank is subject to regulation, supervision and regular examination by the OCC. The deposits of all of our subsidiary banks are insured by the Deposit Insurance Fund (“DIF”) and, as such, the FDIC has additional oversight authority over the banks. The supervision, regulation and examination of banks and bank holding companies by bank regulatory agencies are intended primarily for the protection of depositors, the DIF, and the banking system as a whole, rather than shareholders of banks and bank holding companies, and in some instances may be contrary to shareholders’ interests. First Insurance Funding of Canada Inc. as a foreign owned subsidiary through an Edge corporation is subject to examination by the Federal Reserve.

The Consumer Financial Protection Bureau (“CFPB”) has broad rulemaking authority over a wide range of federal consumer protection laws applicable to the business of our subsidiary banks and some other operating subsidiaries. Because each of our subsidiary banks has less than $10 billion in total consolidated assets, our subsidiary banks’ federal banking agency, not the CFPB, is responsible for examining and supervising the subsidiary banks’ compliance with federal consumer protection laws and regulations. Our non-bank subsidiaries are subject to regulation by their functional regulators, including applicable state finance and insurance agencies, the applicable exchanges, the SEC, FINRA, and the OCC, as well as by the Federal Reserve.

8

Federal and state laws, and the regulations of the bank regulatory agencies issued under them, affect the scope of business, the kinds and amounts of investments banks may make, reserve requirements, capital levels, the nature and amount of collateral for loans, the establishment of branches, the ability to merge, consolidate and acquire, dealings with insiders and affiliates and the payment of dividends. The regulatory agencies have broad discretion to impose restrictions and limitations on the operations of a regulated entity where the agencies determine, among other things, that such operations are unsafe or unsound, fail to comply with applicable law or are otherwise inconsistent with laws and regulations or with the supervisory policies of these agencies.

The current Presidential administration has proposed new regulations and rescissions or withdrawals of previous guidance, implemented new policies, and sharply reduced the workforce at the federal banking agencies. The cumulative impact of these changes, and whether they will last over time, is unclear. The following is a description of some of the laws and regulations that affect our business. By necessity, the descriptions below are summaries that do not purport to be complete, and that are qualified in their entirety by reference to those statutes and regulations discussed, and all regulatory interpretations thereof. Any changes in applicable laws, regulations, or the interpretations thereof could have a material adverse effect on our business or the business of our subsidiaries.

Bank Holding Company Regulation

The Company is a bank holding company that has elected to be treated as a financial holding company. The activities of bank holding companies generally are limited to the business of banking, managing or controlling banks, and certain other activities determined by the Federal Reserve to be closely related to banking. As a financial holding company, we may engage in an expanded range of activities, including activities that are considered to be financial in nature. Financial holding companies may also engage in activities incidental or complementary to financial activities, if the Federal Reserve determines that such activities pose no substantial risk to the safety or soundness of depository institutions or the financial system in general. Impermissible activities for financial holding companies and their subsidiaries include activities that are related to commerce, such as sales of nonfinancial products or manufacturing. As a result, subject to certain exceptions, the BHC Act generally prohibits us from acquiring direct or indirect ownership or control of voting shares of any company engaged in activities that are not permissible for us to engage in.

Maintaining our financial holding company status requires that the Company and each of our subsidiary banks remain “well-capitalized” and “well-managed” as defined by regulation and that each of our subsidiary banks maintain at least a “satisfactory” rating under the Community Reinvestment Act (“CRA”). If we or our subsidiary banks fail to continue to meet these requirements, we could be subject to restrictions on new activities and acquisitions, and/or be required to cease and possibly divest operations that conduct existing activities that are not permissible for a bank holding company that is not a financial holding company.

The BHC Act generally requires us to obtain prior approval from the Federal Reserve before acquiring direct or indirect ownership or control of more than 5% of the voting shares of an additional bank or bank holding company, or to merge or consolidate with another bank holding company. The Bank Merger Act generally requires our subsidiary banks to obtain prior regulatory approval to merge or consolidate with, or acquire substantially all of the assets of or assume deposits of, another bank. We must also be well-capitalized and well-managed, in order to acquire a bank located outside of our home state.

The standards by which bank and financial institution acquisitions are evaluated may be subject to change by the federal agencies. In September 2024, the OCC adopted a final rule and policy statement regarding its review of Bank Merger Act (“BMA”) applications for OCC-supervised institutions. In May 2025, the OCC adopted a final rule that restored the ability for BMA applicants to file a streamlined application form for certain types of acquisitions and the expedited review process for BMA applications, which had been removed by the 2024 final rule, and rescinded the 2024 policy statement.

In September 2024, the Department of Justice (the “DOJ”) withdrew its 1995 Bank Merger Guidelines and issued the 2024 Banking Addendum to the 2023 Merger Guidelines (the “2024 Banking Addendum”). The DOJ clarified that it will assess competition considerations in connection with bank and bank holding company mergers using its 2023 Merger Guidelines, which is the general merger review framework the DOJ now uses to evaluate transactions in all segments of the economy, and 2024 Banking Addendum. The 2024 Banking Addendum provides guidance on how the DOJ will assess competition in the context of bank and bank holding company mergers. An analysis under the 2023 Merger Guidelines and 2024 Banking Addendum may include consideration of theories of harm and relevant markets not considered under the 1995 Bank Merger Guidelines, which focused primarily on concentrations of deposits and branches.

The Federal Deposit Insurance Act (“FDIA”) and Federal Reserve regulations and policy require us to serve as a source of financial and managerial strength for our subsidiary banks, and to commit resources to support the banks. This support may be required even if doing so may adversely affect our ability to meet other obligations.

9

Acquisitions of Ownership of the Company

Acquisitions of the Company’s voting stock above certain thresholds may be subject to prior regulatory notice or approval under applicable federal banking laws. Investors are responsible for ensuring that they do not, directly or indirectly, acquire shares of our stock in excess of the amount that can be acquired without regulatory approval or notice under the BHC Act and the Change in Bank Control Act.

Volcker Rule

We are prohibited under the Volcker Rule from (1) engaging in short-term proprietary trading for our own account, and (2) having certain ownership interests in and relationships with hedge funds or private equity funds. The fundamental prohibitions of the Volcker Rule apply to banking entities of any size, including the Company and its bank subsidiaries. The Volcker Rule regulations contain exemptions for market-making, hedging, underwriting, trading in U.S. government and agency obligations and also permit certain ownership interests in certain types of funds to be retained. They also permit the offering and sponsoring of funds under certain conditions. The Volcker Rule regulations impose significant compliance and reporting obligations on banking entities. The Company has put in place the compliance programs required by the Volcker Rule. The Company will continue to monitor Volcker Rule-related developments and assess their impact on its operations as necessary.

Capital Requirements of the Company and Subsidiary Banks

We and our subsidiary banks are required to maintain minimum risk-based and leverage capital ratios, as well as a capital conservation buffer (“Capital Conservation Buffer”), pursuant to regulations adopted by the Federal Reserve and the OCC to implement the Basel III capital framework (“U.S. Basel III Rule”).

Regulatory Capital and Risk-weighted Assets

Regulatory capital requirements apply to Common Equity Tier 1 capital, Tier 1 capital and total capital.

•Common Equity Tier 1 capital consists primarily of common stock and related surplus (net of treasury stock), retained earnings, and certain minority interests, subject to certain regulatory adjustments. For us and our subsidiary banks, Common Equity Tier 1 capital does not include most elements of accumulated other comprehensive income (“AOCI”) because we exercised an opt-out election that was available to us with respect to certain changes in the capital treatment of AOCI. We made this election to avoid variations in the level of our capital depending on fluctuations in the fair value of our securities and derivatives portfolio.

•Tier 1 capital is composed of Common Equity Tier 1 capital and Additional Tier 1 capital. Additional Tier 1 capital consists primarily of non-cumulative perpetual preferred stock and related surplus, certain minority interests and, subject to certain regulatory limits, certain grandfathered cumulative perpetual preferred stock and certain grandfathered trust preferred securities.

•Total capital is composed of Tier 1 capital and Tier 2 capital. Tier 2 capital consists primarily of capital instruments and related surplus meeting specified requirements, and may include cumulative preferred stock and long-term perpetual preferred stock, mandatory convertible securities, intermediate preferred stock, certain trust preferred securities and subordinated debt. Also included in Tier 2 capital is the allowance for credit losses limited to a maximum of 1.25% of risk-weighted assets (“RWAs”) and, for institutions that have exercised the opt-out election regarding the treatment of AOCI, up to 45% of net unrealized gains on available-for-sale equity securities with readily determinable fair market values.

Certain adjustments to and deductions from capital are required for purposes of calculating these regulatory capital measures, including with respect to goodwill, intangible assets, certain deferred tax assets, AOCI and investments in the capital instruments of unconsolidated financial institutions. Under the capital rules, for certain bank holding companies and banks, including us and our subsidiary banks, the framework for capital deductions for mortgage servicing assets, certain deferred tax assets and investments in the capital instruments of unconsolidated financial institutions, and the recognition of minority interests in regulatory capital.

Pursuant to rules adopted by the U.S. federal banking agencies, the Company elected to delay, for regulatory capital purposes, the day-one impact of Accounting Standards Update (“ASU”) 2016-13 Financial Instruments - Credit Losses (Topic 326) (“CECL”) on retained earnings over a period of five years. The Company deferred for two years 100% of the day-one impact of adopting CECL and 25% of the cumulative increase or decrease in the allowance for credit losses since the adoption of CECL. The deferral impacts were fully phased-in as of January 1, 2025. For further discussion of the CECL accounting standard,

10

including the Company’s implementation of such guidance, see “Summary of Critical Accounting Estimates” under Management’s Discussion and Analysis of Financial Condition and Results of Operations in Item 7 of this Annual Report on Form 10-K.

Capital Ratio Requirements

Under the U.S. Basel III Rule, we and our subsidiary banks are required to maintain the following minimum capital ratios:

•Tier 1 capital to quarterly average assets (net of goodwill, certain other intangible assets and certain other deductions) ratio (“Tier 1 Leverage Ratio”) of 4.0%;

•Tier 1 capital to RWAs ratio (“Tier 1 Capital Ratio”) of 6.0%;

•Common Equity Tier 1 capital to RWAs ratio (“Common Equity Tier 1 Capital Ratio”) of 4.5%; and

•Total capital to RWAs ratio (“Total Capital Ratio”) of 8.0%.

To be well-capitalized, our subsidiary banks must maintain the following capital ratios:

•Tier 1 Leverage Ratio of 5.0% or greater.

•Tier 1 Capital Ratio of 8.0% or greater;

•Common Equity Tier 1 Capital Ratio of 6.5% or greater; and

•Total Capital Ratio of 10.0% or greater.

The Federal Reserve has not yet revised the well-capitalized standard for bank holding companies to reflect the higher capital requirements imposed under the U.S. Basel III Rule. For purposes of the Federal Reserve’s Regulation Y, including determining whether a bank holding company meets the requirements to be a financial holding company, bank holding companies, such as the Company, must maintain a Tier 1 Capital Ratio of 6.0% or greater and a Total Capital Ratio of 10.0% or greater to be well-capitalized. If the Federal Reserve were to apply the same or a very similar well-capitalized standard to bank holding companies as that applicable to our subsidiary banks, the Company’s capital ratios as of December 31, 2025 would exceed such revised well-capitalized standard. The Federal Reserve may require bank holding companies, including us, to maintain capital ratios substantially in excess of mandated minimum levels, depending upon general economic conditions and a bank holding company’s particular condition, risk profile and growth plans.

Failure to be well-capitalized or to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators, including restrictions on our or our subsidiary banks’ ability to pay dividends or otherwise distribute capital or to receive regulatory approval of applications, or other restrictions on growth. Such actions, if undertaken, could have an adverse material effect on our operations or financial condition.

In addition to meeting the minimum capital requirements, under the U.S. Basel III Rule, we and our banking subsidiaries must also maintain the required Capital Conservation Buffer to avoid becoming subject to restrictions on capital distributions and certain discretionary bonus payments to management. The Capital Conservation Buffer is 2.5% and is calculated as a ratio of Common Equity Tier 1 capital to RWAs and it effectively increases the required minimum risk-based capital ratios. The Tier 1 Leverage Ratio is not impacted by the Capital Conservation Buffer, and a banking institution may be considered well-capitalized while remaining out of compliance with the Capital Conservation Buffer.

The table below summarizes the capital requirements that we and our subsidiary banks must satisfy to avoid limitations on capital distributions and certain discretionary bonus payments (i.e., the required minimum capital ratios plus the Capital Conservation Buffer):

Minimum Regulatory Capital Ratio Plus Capital Conservation Buffer

Tier 1 Capital Ratio8.50 %

Common Equity Tier 1 Capital Ratio7.00

Total Capital Ratio10.50

11

As of December 31, 2025, our Company’s and our subsidiary banks’ regulatory capital ratios were above the well-capitalized standards and met the Capital Conservation Buffer. Based on current estimates, we believe that we and our subsidiary banks will continue to exceed all applicable well-capitalized regulatory capital requirements and the Capital Conservation Buffer. Please refer to the table below for a summary of our regulatory capital ratios as of December 31, 2025, calculated using the regulatory capital methodology applicable to us during 2025.

Company Regulatory Capital Ratios

Minimum Regulatory Capital Ratio for the Company
Minimum Ratio + Capital Conservation Buffer(1)

Well-Capitalized Minimum

for the Company(2)
The Company

Tier 1 Leverage Ratio4.00 %N/AN/A9.6 %

Risk-based capital ratios:

Tier 1 Capital Ratio6.00 8.50 6.00 11.0

Common Equity Tier 1 Capital Ratio4.50 7.00 N/A10.3

Total Capital Ratio8.00 10.50 10.00 12.4

(1)Reflects the Capital Conservation Buffer of 2.50%.

(2)Reflects the well-capitalized standard applicable to the Company for purposes of the Federal Reserve’s Regulation Y. The Federal Reserve has not yet revised the well-capitalized standard for bank holding companies to reflect the higher capital requirements imposed under the U.S. Basel III Rule or to add Common Equity Tier 1 Capital Ratio and Tier 1 Leverage Ratio requirements to this standard. As a result, the Common Equity Tier 1 Capital Ratio and Tier 1 Leverage Ratio are denoted as “N/A” in this column. If the Federal Reserve were to apply the same or a very similar well-capitalized standard to bank holding companies as the standard applicable to our subsidiary banks, the Company’s capital ratios as of December 31, 2025 would exceed such revised well-capitalized standard.

In addition to the above, as a result of participation in mortgage programs with certain government-sponsored entities as well as other investors, the Company has specific net worth requirements for continued participation. As of December 31, 2025, the Company remained in compliance with such requirements.

Payment of Dividends and Share Repurchases

We are a legal entity separate and distinct from our banking and non-banking subsidiaries. Since our consolidated net income consists largely of net income of our bank and non-bank subsidiaries, our ability to pay dividends and repurchase shares depends upon our receipt of dividends from our subsidiaries. There are various federal and state law limitations on the extent to which our banking subsidiaries can declare and pay dividends to us, including regulatory capital requirements, general regulatory oversight to prevent unsafe or unsound practices and federal and state banking law requirements concerning the payment of dividends out of net profits or surplus. Applicable banking laws also prohibit, without prior regulatory approval, insured depository institutions, such as our bank subsidiaries, from making dividend distributions if such distributions are not paid out of available earnings. In addition, our right, and the right of our shareholders and creditors, to participate in any distribution of the assets or earnings of our bank and non-bank subsidiaries is further subject to the prior claims of creditors of our subsidiaries. No assurances can be given that the banks will, in any circumstances, pay dividends to the Company.

We and our bank subsidiaries must maintain the applicable Common Equity Tier 1 Capital Conservation Buffer to avoid becoming subject to restrictions on capital distributions, including dividends. The Capital Conservation Buffer is currently at its fully phased-in level of 2.5%. For more information on the Capital Conservation Buffer, see Capital Ratio Requirements above.

Our ability to declare and pay dividends to our shareholders is similarly limited by federal banking law and Federal Reserve regulations and policy. Federal Reserve policy provides that a bank holding company should not pay dividends unless (1) the bank holding company’s net income over the last four quarters (net of dividends paid) is sufficient to fully fund the dividends, (2) the prospective rate of earnings retention appears consistent with the capital needs, asset quality and overall financial condition of the bank holding company and its subsidiaries, and (3) the bank holding company will continue to meet minimum required capital adequacy ratios. The policy also provides that a bank holding company should inform the Federal Reserve reasonably in advance of declaring or paying a dividend that exceeds earnings for the period for which the dividend is being paid or that could result in a material adverse change to the bank holding company’s capital structure. Bank holding companies also are required to consult with the Federal Reserve before materially increasing dividends. The Federal Reserve could prohibit or limit the payment of dividends by a bank holding company if it determines that payment of the dividend would constitute an unsafe or unsound practice.

12

FDICIA and Prompt Corrective Action

The Federal Deposit Insurance Corporation Improvement Act of 1991 (“FDICIA”) requires the federal bank regulatory agencies to take “prompt corrective action” regarding FDIC-insured depository institutions that do not meet certain capital adequacy standards. A depository institution’s treatment for purposes of the prompt corrective action provisions depends upon its level of capitalization and certain other factors. An institution that fails to remain well-capitalized becomes subject to a series of restrictions that increase in severity as its capital condition weakens. Such restrictions may include a prohibition on capital distributions, restrictions on asset growth or restrictions on the ability to receive regulatory approval of applications. The FDICIA also provides for enhanced supervisory authority over under capitalized institutions, including authority for the appointment of a conservator or receiver for the institution. In certain instances, a bank holding company may be required to guarantee the performance of an under capitalized subsidiary bank’s capital restoration plan.

As of December 31, 2025, each of the Company’s banks was categorized as “well-capitalized” and, in addition, met additional requirements under the Capital Conservation Buffer.

Enforcement Authority

The federal bank regulatory agencies have broad authority to issue orders to depository institutions and their holding companies prohibiting activities that constitute violations of law, rule, regulation, or administrative order, or that represent unsafe or unsound banking practices, as determined by the federal banking agencies. The federal banking agencies also are empowered to require affirmative actions to correct any violation or practice; issue administrative orders that can be judicially enforced; direct increases in capital; limit dividends and distributions; restrict growth; assess civil money penalties against institutions or individuals who violate any laws, regulations, orders, or written agreements with the agencies; order termination of certain activities of holding companies or their non-bank subsidiaries; remove officers and directors; order divestiture of ownership or control of a non-banking subsidiary by a holding company; or terminate deposit insurance and appoint a conservator or receiver.

Safety and Soundness

The federal bank regulatory agencies have adopted a set of guidelines prescribing safety and soundness standards relating to internal controls and information systems, informational security, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, and compensation, fees and benefits. The guidelines prohibit excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director, or principal shareholder.

Properly managing risks has been identified by regulators as critical to the conduct of safe and sound banking activities and has become even more important as new technologies, product innovation, and the size and speed of financial transactions have changed the nature of banking markets. The agencies have identified a spectrum of risks facing banking institutions including, but not limited to, credit, market, liquidity, operational and legal risk. Some of the regulatory pronouncements have focused on operational risk, which arises from the potential that inadequate information systems, operational problems, breaches in internal controls, fraud, or unforeseen catastrophes will result in unexpected losses. New products and services, third-party risk management and cybersecurity are critical sources of operational risk that financial institutions are expected to address in the current environment. Our subsidiary banks are expected to have active board and senior management oversight; adequate policies, procedures, and limits; adequate risk measurement, monitoring, and management information systems; and comprehensive and effective internal controls.

Cross-Guarantee

Under the cross-guarantee provision of the FDIA, insured depository institutions such as our subsidiary banks may be liable to the FDIC for any losses incurred, or reasonably expected to be incurred, by the FDIC resulting from the default of, or FDIC assistance to, any other commonly controlled insured depository institution. An FDIC cross-guarantee claim against a depository institution is superior in right of payment to claims of the holding company and its affiliates against such depository institution. All of our subsidiary banks are commonly controlled within the meaning of the cross-guarantee provision.

13

Insurance of Deposit Accounts

The deposits of each of our subsidiary banks are insured by the DIF up to the standard maximum deposit insurance amount of $250,000 per depositor. Each of our subsidiary banks is subject to deposit insurance assessments based on the risk it poses to the DIF, as determined by the capital category and supervisory category to which it is assigned. The FDIC has authority to raise or lower assessment rates on insured deposits in order to achieve statutorily required reserve ratios in the DIF and to impose special additional assessments. There is a risk that our subsidiary banks’ deposit insurance premiums will increase if failures of insured depository institutions deplete the DIF or if the FDIC were to change its view of the risk that they pose to the DIF.

The FDIC has adopted a final rule, applicable to all insured depository institutions, to increase initial base deposit insurance assessment rate schedules uniformly by 2 basis points, beginning in the first quarterly assessment period of 2023. The FDIC has maintained the Designated Reserve Ratio (“DRR”) for the DIF at 2% for 2024 and 2025. The increase in assessment rate schedules is intended to increase the likelihood that the reserve ratio of the DIF reaches the statutory minimum of 1.35% by the statutory deadline of September 30, 2028. The new assessment rate schedules will remain in effect unless and until the reserve ratio meets or exceed 2% in order to support growth in the DIF in progressing toward the FDIC’s long-term goal of 2% DRR. Progressively lower assessment rate schedules will take effect when the reserve ratio reaches 2%, and again when it reaches 2.5%.

In November 2023, the FDIC issued a final rule to implement a special assessment to recoup losses to the DIF associated with bank failures in the first half of 2023. Under the rule, the assessment base for the special assessment is equal to an insured depository institution’s estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion of uninsured deposits. $5.2 million of the special assessment was recorded in the first quarter of 2024. Special assessment payments began in June of 2024 and will continue for a total of eight quarterly installments in the initial collection period, with the eighth collection quarter at a reduced rate as a result an interim final rule on December 16, 2025. Under the interim final rule, upon termination of the FDIC’s receiverships of Silicon Valley Bank (“SVB”) and Signature Bank, the FDIC will either provide an offset to insured depository institutions, if the special assessment amount then-collected exceeds losses, or collect from insured depository institutions a one-time final shortfall special assessment, if losses exceed the special assessment amount then-collected. In addition, the FDIC will provide an offset to regular quarterly deposit insurance assessments for banks subject to the special assessment if, following the final resolution of litigation between the FDIC and SVB Financial Trust, the total amount collected through the special assessment exceeds the loss estimate at that time.

Limits on Loans to One Borrower and Loans to Insiders

Federal banking laws impose limits on the amount of credit a bank can extend to any one person (or group of related persons). For national banks, this limit includes credit exposures arising from derivative transactions, repurchase agreements, and securities lending and borrowing transactions.

Applicable banking laws and regulations also place restrictions on loans by FDIC-insured banks and their affiliates to their directors, executive officers and principal shareholders.

Lending Standards and Guidance

The federal banking agencies have adopted uniform regulations prescribing standards for extensions of credit that are secured by liens or interests in real estate or made for the purpose of financing permanent improvements to real estate. Under these regulations, all insured depository institutions, such as our subsidiary banks, must adopt and maintain written policies establishing appropriate limits and standards for extensions of credit that are secured by liens or interests in real estate or are made for the purpose of financing permanent improvements to real estate. These policies must establish loan portfolio diversification standards, prudent underwriting standards (including debt service coverage and loan-to-value limits) that are clear and measurable, loan administration procedures, and documentation, approval and reporting requirements. The real estate lending policies must reflect consideration of the federal bank regulators’ Interagency Guidelines for Real Estate Lending Policies.

14

Anti-Money Laundering Programs

The Bank Secrecy Act (the “BSA”), as amended by the USA PATRIOT Act of 2001 (the “USA PATRIOT Act”), and its implementing regulations contain anti-money laundering (“AML”) and financial transparency provisions intended to detect and prevent the U.S. financial system from being exploited for money laundering and terrorist financing activities. The BSA, as amended, and its implementing regulations impose compliance obligations on financial institutions, including banks, which include maintaining an AML compliance program, verifying the identity of customers, monitoring for and reporting suspicious transactions, reporting on cash transactions exceeding specified thresholds, and responding to requests for information by regulatory authorities and law enforcement agencies. Each of our subsidiary banks is subject to the BSA and, therefore, is required to, among other things, provide its employees with AML training, designate an AML compliance officer and undergo periodic, independent audits to assess the effectiveness of its AML program. We have implemented policies, procedures and internal controls that are designed to comply with the BSA and its implementing regulations. Bank regulators are focusing their examinations on compliance with the BSA and its implementing regulations, and we will continue to monitor and augment, where necessary, our AML compliance programs. The federal banking agencies are required, when reviewing bank and bank holding company acquisition or merger applications, to take into account the effectiveness of the applicant’s compliance with the BSA and its implementing regulations.

The Anti-Money Laundering Act of 2020 (the “AMLA”), enacted on January 1, 2021 as part of the National Defense Authorization Act, does not directly impose new requirements on banks, but requires the U.S. Treasury Department to issue National Anti-Money Laundering and Countering the Financing of Terrorism Priorities, and conduct studies and issue regulations that may significantly alter some of the due diligence, recordkeeping and reporting requirements that the BSA and its implementing regulations impose on banks. The AMLA also contains provisions that promote increased information-sharing and use of technology, and increases penalties for violations of the BSA and includes whistleblower incentives, both of which could increase the prospect of regulatory enforcement.

Office of Foreign Assets Control Regulation

The U.S. Department of the Treasury’s Office of Foreign Assets Control, or “OFAC,” is responsible for administering U.S. economic sanctions that restrict transactions with designated foreign countries and territories, nationals and others. U.S. economic sanctions take many different forms. For example, sanctions may include: (1) restrictions on trade with or investment in a sanctioned country or territory, including prohibitions against direct or indirect imports from and exports to a sanctioned country or territory and prohibitions on U.S. persons engaging in financial transactions relating to, making investments in, or providing investment-related advice or assistance to, a sanctioned country or territory; and (2) a blocking of assets in which the government or “specially designated nationals” of the sanctioned country or territory have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). OFAC also publishes lists of persons and organizations that are subject to asset blocking sanctions, including the Specially Designated Nationals and Blocked Persons List. Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal consequences.

Protection of Client and Customer Information

Data privacy and cybersecurity laws, regulations, rules and standards concerning the collection, storage, handling, use, disclosure, transfer, protection and other processing of personal information, including those of our clients and customers, affect many aspects of the Company’s business, and are continuing to evolve. Data privacy and cybersecurity are currently areas of considerable legislative and regulatory attention, with new or modified laws, regulations, rules and standards frequently being adopted and potentially subject to divergent interpretation or application in a manner that may create inconsistent or conflicting requirements for businesses.

We are, or may in the future become, subject to a variety of complex federal, state and local laws, regulations, rules and standards regarding data privacy and cybersecurity, including the privacy and information safeguarding provisions of the Gramm-Leach-Bliley Act (“GLB Act”), the Fair Credit Reporting Act (“FCRA”) and the amendments adopted by the Fair and Accurate Credit Transactions Act of 2003, as well as various state laws and regulations. The GLB Act requires a financial institution to, among other things, disclose its privacy policy to certain customers and, in some circumstances, enables certain customers to opt-out of certain sharing of the customers’ nonpublic personal information with nonaffiliated third parties. The GLB Act also requires financial institutions to implement a comprehensive information security program that includes administrative, technical and physical safeguards designed to ensure the security and confidentiality of customer information. In accordance with these requirements, we and each of our banks and operating subsidiaries endeavor to provide a written privacy notice to each affected customer when the customer relationship begins and, to the extent required, on an annual basis. As described in the privacy notice, we endeavor to protect the security of personal information about our customers, educate our employees about the importance of protecting customer privacy, and allow affected customers to opt-out of certain types of

15

information sharing. We and our subsidiaries also generally require business partners with which we share confidential and personal information to have reasonable security safeguards and to follow the requirements of the GLB Act. The GLB Act, as interpreted by the federal banking regulators, and state laws and regulations require us to take certain actions, including providing notice under certain circumstances to affected customers, in the event that their sensitive or personal information is compromised. We and/or each of the banks and operating subsidiaries may need to amend our privacy policies and adapt our internal procedures in the event that these legal or regulatory requirements, or the regulators’ interpretation of them, change, or if new requirements are added. Additionally, the federal banking regulators, as well as the SEC and related self-regulatory organizations, regularly issue guidance regarding cybersecurity that is intended to enhance cyber risk management among financial institutions. We and our nonbanking subsidiaries are also subject to the rules and regulations promulgated under the authority of the Federal Trade Commission, which regulates unfair or deceptive acts or practices (including with respect to data privacy and cybersecurity). Moreover, the federal government has considered, and will likely in the future consider, various proposals for more comprehensive data privacy and cybersecurity legislation and regulations, to which we may be subject if passed.

Like other lenders, the banks and several of our operating subsidiaries use credit bureau data in their underwriting activities. Use of such data is regulated under the FCRA, and the FCRA also regulates, among other things, reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information (including personal information) between affiliates, and using affiliate data for marketing purposes. Similar state laws and regulations may impose additional requirements on us, the banks and our operating subsidiaries.

Further, in the spring of 2022, the Federal Reserve, OCC, and FDIC adopted a regulation that requires a banking organization to notify its primary federal regulators as soon as possible and within 36 hours after identifying a “computer-security incident” that the banking organization believes in good faith is reasonably likely to materially disrupt or degrade its business or operations in a manner that would, among other things, jeopardize the viability of its operations, result in customers being unable to access their deposit and other accounts, result in a material loss of revenue, profit or franchise value, or pose a threat to the financial stability of the United States. The rule also imposes requirements on bank service providers to notify their affected banking organization customers of certain computer-security incidents.

In addition, once implementing regulations are finalized, the Cyber Incident Reporting for Critical Infrastructure Act (“CIRCIA”) will require, among other things, covered entities to report significant cyber incidents, including ransomware attacks, to the Cybersecurity and Infrastructure Security Agency (“CISA”) within 72 hours from the time the covered entity reasonably believes the incident occurred (and within 24 hours of making a ransom payment as a result of a ransomware attack). The CISA proposed a rule under the CIRCIA in April 2024 that would clarify the scope of cyber incidents to be reported and would further define covered entities subject to the CIRCIA to include banking organizations. Although the CIRCIA originally required the CISA to finalize its regulations by October 4, 2025, the CISA has extended such deadline to May 2026.

Data privacy and cybersecurity are also areas of increasing state legislative and regulatory focus. For example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”) applies to covered businesses that conduct business in California and meet certain revenue or personal information collection thresholds. The CCPA contains several exemptions, such as exemptions for personal information that is collected, stored, handled, used, disclosed, transferred or otherwise processed pursuant to the GLB Act. The CCPA imposes obligations on covered companies, broadly defines personal information, expands California residents’ rights with respect to personal information, and provides for civil penalties for violations. The CCPA may be interpreted or applied in a manner inconsistent with our understanding, resulting in further uncertainty and potentially requiring us to incur additional costs and expenses in an effort to comply with these requirements. Similar laws and regulations have been adopted by other states where we do business, or may in the future do business, and we expect more states to adopt similar laws and regulations in the future. In addition, laws in all 50 U.S. states generally require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a data breach.

Violation of these laws, regulations, rules, and standards may expose us to regulatory action and private litigation, including claims for damages and penalties. For more information regarding the risks associated with data privacy and cybersecurity laws, regulations, rules and standards, see “We are subject to complex and evolving laws, regulations, rules, standards and contractual obligations regarding data privacy and cybersecurity, which could increase the cost of doing business, compliance risks and potential liability” and “We face risks from cyber-attacks, information security breaches and other similar incidents that could result in the disclosure of confidential and other information (including personal information), all of which could adversely affect our business or reputation, and create significant legal and financial exposure” under Risk Factors in