ASSOCIATED BANC-CORP

General

Associated Banc-Corp is a bank holding company registered pursuant to the BHC Act. Our bank subsidiary, Associated Bank, traces its history back to the founding of the Bank of Neenah in 1861. We were incorporated in Wisconsin in 1964 and were inactive until 1969 when permission was received from the Federal Reserve to acquire three banks. At December 31, 2024, we owned one nationally chartered commercial bank headquartered in Green Bay, Wisconsin, which serves local communities across the upper Midwest, one nationally chartered trust company headquartered in Milwaukee, Wisconsin, and 12 limited purpose banking and nonbanking subsidiaries either located in or conducting business primarily in our three-state branch footprint (Wisconsin, Illinois, and Minnesota) that are closely related or incidental to the business of banking or financial in nature. Measured by total assets reported at December 31, 2024, we are the largest bank holding company headquartered in Wisconsin.

Services

Through Associated Bank and various nonbanking subsidiaries, we provide a broad array of banking and nonbanking products and services to individuals and businesses through 188 banking branches as of December 31, 2024, serving more than 100 communities, primarily within our three-state branch footprint. Our business is primarily relationship-driven and is organized into three reportable segments: Corporate and Commercial Specialty; Community, Consumer, and Business; and Risk Management and Shared Services.

See Note 20 Segment Reporting of the notes to consolidated financial statements in Part II, Item 8, Financial Statements and Supplementary Data, for additional information concerning our reportable segments.

We are not dependent upon a single or a few customers, the loss of which would have a material adverse effect on us.

Human Capital Matters

We are very fortunate to have a team of approximately 4,000 colleagues at December 31, 2024 who are capable, determined and empowered to drive our company forward. None of our colleagues are represented by unions.

We believe attracting and retaining talent in a highly competitive candidate market fuels our ability to serve our customers and support our communities. We are focused on sourcing talent from all backgrounds through engagement with workforce development programs, partnerships with various organizations, and active campus recruitment. As a result, we were able to hire over 650 external candidates in 2024. At the same time, in 2024, we had low voluntary turnover of 12% while 21% of colleagues advanced their careers at the Corporation through nearly 850 internal promotions or lateral moves. At December 31, 2024, the average tenure of our workforce was 8.8 years while the average tenure of our executive leadership team was 11.0 years.

Through internal and external training and development programs, we aim to help our colleagues improve their skills so they can achieve their career goals and transition to more challenging roles.

•Beginning in 2024, the Corporation initiated quarterly progress reviews for all colleagues designed to enhance colleague development, growth, and performance through consistent coaching and feedback.

•In 2024, we introduced significant training and resources for development and career planning to include new leadership development programs and workshops for both leaders and colleagues.

•During 2024, we completed over 330 individual career coaching sessions and offered nearly 70 hours of training to assist colleagues in creating meaningful performance and development objectives.

By strengthening our workforce and providing opportunities for colleagues to apply their talent and grow as professionals, we strive to foster pride in working for Associated and to be recognized as the employer of choice among Midwestern financial services firms.

Colleague engagement is a focus for our company. During 2024, 91% of our colleagues provided feedback through an annual workplace survey conducted by a third-party on key topics related to the overall health and culture of the organization. The survey respondent percentage is well above the average response rate for commercial banks. For the eighth year in a row, we received more than 8,000 colleague comments, including more than 10,000 in 2024, which we believe demonstrates that colleagues are interested in, and comfortable with, sharing candid feedback.

We are pleased to support total health and well-being through a variety of benefits, programs, activities, and educational opportunities throughout the year. Our dedicated Total Well-being team provides free and confidential health coaching while a 24/7/365 Employee Assistance Program (EAP) provides access to complimentary counseling services, financial coaching, and a variety of additional resources to support the unique needs of our colleagues and their families (e.g. elder, adult, child, family support and legal services). Additionally, our comprehensive Total Well-being platform provides all colleagues with an opportunity to earn incentives throughout the year for participating in activities, challenges, and educational opportunities. As of December 31, 2024:

•Over 2,700 colleagues and spouses participated in an annual wellness visit with a primary care provider.

•Nearly 1,650 colleagues received a well-being reimbursement for the purchase of items such as gym memberships, home fitness equipment, and/or fitness tracking devices. The total value for well-being reimbursements was over $300,000.

•Over 1,300 colleagues earned incentives through our Total Well-being program totaling over $160,000.

We regularly review our pay and benefits programs so that we are offering a total rewards package (including salary, incentives, benefits, and well-being opportunities) that we believe is fair, equitable, and competitive in our marketplace.

We believe our success begins and ends with people. For this reason, fostering a culture where people feel valued, respected, and comfortable sharing ideas and perspectives is a core focus of the Corporation. Our culture is anchored in the belief that we are better together, and great ideas can come from anywhere in the Corporation.

We are committed to nurturing an inclusive culture that is centered around providing equal opportunity to our colleagues (regardless of background), responding to community and customer needs, and producing exceptional values for our shareholders. Business lines are focused on fostering a culture of belonging and inclusion among our colleagues in support of equal opportunity. Our efforts are supported by the work of our seven CRGs. These groups, which are open to all employees, are centered on development and colleague growth. Our CRG members contribute to discussions around workforce development, workplace culture, policies and programs, and marketplace practices.

•Since inception of the CRG mentorship program in 2022, the program has logged over 3,400 self-reported hours as of December 31, 2024.

•During 2024, CRGs hosted more than 100 events that focused on support of our business strategy, professional development, talent recruitment, and community involvement.

Our commitment to our communities goes beyond providing banking services. We use our expertise and financial resources to support communities in accordance with the CRA requirements.These initiatives and investments create opportunities for individuals, families, and businesses to fully participate in and share the rewards of building economic stability in our communities.

Competition

The financial services industry is highly competitive. We compete for loans, deposits, and financial services in all of our principal markets. We compete directly with other bank and nonbank institutions located within our markets, internet-based banks, out-of-market banks and bank holding companies that advertise or otherwise serve our markets, money market funds and other mutual funds, brokerage houses, and various other financial institutions. Additionally, we compete with insurance companies, leasing companies, regulated small loan companies, credit unions, governmental agencies, and commercial entities offering financial services products, including nonbank lenders and financial technology companies. Competition involves, among other things, efforts to retain current customers and to obtain new loans and deposits, the scope and types of services offered, interest rates paid on deposits and charged on loans, as well as other aspects of banking. We also face direct competition from subsidiaries of bank holding companies that have far greater assets and resources than ours.

Supervision and Regulation

Overview

The Corporation and its banking and nonbanking subsidiaries are subject to extensive regulation and oversight both at the federal and state levels. The following is an overview of the statutory and regulatory framework that affects the business of the Corporation and our subsidiaries.

BHC Act Requirements

As a registered bank holding company under the BHC Act, we are regulated, supervised, and examined by the Federal Reserve. In connection with applicable requirements, bank holding companies file periodic reports and other information with the Federal Reserve. The BHC Act also governs the activities that are permissible for bank holding companies and their affiliates and permits the Federal Reserve, in certain circumstances, to issue cease and desist orders and other enforcement actions against bank holding companies and their nonbanking affiliates to correct and curtail unsafe or unsound banking practices. Under the Dodd-Frank Act and longstanding Federal Reserve policy, bank holding companies are required to act as a source of financial strength to each of their banking subsidiaries pursuant to which such holding company may be required to commit financial resources to support such subsidiaries in circumstances when, absent such requirements, they might not otherwise do so. The BHC Act further regulates holding company activities, including requirements and limitations relating to capital, transactions with officers, directors and affiliates, securities issuances, dividend payments, inter-affiliate liabilities, extensions of credit, and expansion through mergers and acquisitions.

The BHC Act allows certain qualifying bank holding companies that elect treatment as “financial holding companies” to engage in activities that are financial in nature and that explicitly include the underwriting and sale of insurance. The Parent Company thus far has not elected to be treated as a financial holding company. Bank holding companies that have not elected such treatment generally must limit their activities to banking activities and activities that are closely related to banking.

Regulation of Associated Bank and Trust Company Subsidiaries

Associated Bank and our nationally-chartered trust company subsidiary are regulated, supervised and examined by the OCC. The OCC has primary supervisory and regulatory authority over the operations of Associated Bank and the Corporation's trust company subsidiary. As part of this authority, Associated Bank and our trust company subsidiary are required to file periodic reports with the OCC and are subject to regulation, supervision and examination by the OCC. To support its supervisory function, the OCC has the authority to assess and charge fees on all national banks according to a set fee schedule. On November 27, 2024, the OCC published its assessment rates for the 2025 calendar year. The OCC increased the marginal rates in the general assessment fee schedule for banks with assets above $40 billion, such as Associated Bank, by 16 percent and all other marginal rates in the general assessment fee schedule by 2.65 percent to account for inflation.

Associated Bank, our only subsidiary that accepts insured deposits, is also subject to examination by the FDIC. Additionally, under the Dodd-Frank Act, the FDIC has backup enforcement authority over a depository institution holding company, such as the Parent Company, if the conduct or threatened conduct of such holding company poses a risk to the DIF, although such authority may not be used if the holding company is generally in sound condition and does not pose a foreseeable and material risk to the DIF.

We are also subject to the enforcement and rule-making authority of the CFPB regarding consumer financial products. The CFPB has the authority to create and enforce consumer protection rules and regulations and has the power to examine us for compliance with such rules and regulations. The CFPB also has the authority to prohibit “unfair, deceptive or abusive” acts and practices. The CFPB has examination and enforcement authority over all banks with more than $10 billion in assets. For additional information, please refer to Item 1— Business — Supervision and Regulation — Consumer Financial Services Regulations.

Standards for Safety and Soundness

The federal banking agencies have adopted the Interagency Guidelines for Establishing Standards for Safety and Soundness (the “Guidelines”). The Guidelines establish certain safety and soundness standards for all depository institutions. The operational and managerial standards in the Guidelines relate to the following: (1) internal controls and information systems; (2) internal audit systems; (3) loan documentation; (4) credit underwriting; (5) interest rate exposure; (6) asset growth; (7) compensation, fees and benefits; (8) asset quality; and (9) earnings. Rather than providing specific rules, the Guidelines set forth basic compliance considerations and guidance with respect to a depository institution. Failure to meet the standards in the Guidelines, however, could result in a request by the OCC for a written compliance plan to demonstrate efforts to come into compliance with such Guidelines. Failure to provide and implement a plan requires the appropriate federal banking agency to issue an order to the institution requiring compliance.

Corporate and Risk Governance

We are required as a supervisory matter to implement an effective corporate and risk governance framework commensurate with our size, complexity and risk profile. Fundamental components of this framework include the authorities and responsibilities of directors and senior managers to govern the operations and structure of the Corporation and the Bank, as well as the implementation and management of systems and processes designed to identify, measure, monitor and control the risks to the organization, specifically including strategic, reputation, compliance and operational risks.

Corporate and risk governance oversight is a core supervisory function of the federal banking agencies, including the OCC. National banks with at least $50 billion in total assets are subject to prescribed standards for the implementation of risk governance frameworks addressing credit risk, interest rate risk, liquidity risk, price risk, operational risk, compliance risk, strategic risk, and reputation risks. Additionally, on October 11, 2023, the FDIC issued a proposed rule and guidelines that would require all FDIC-supervised IDIs with total assets of $10 billion or more to adopt heightened corporate governance and risk management standards pursuant to which covered institutions would be required to develop and implement a comprehensive and independent risk management function and effective programs for internal controls, risk management, and audits. As of December 31, 2024, the proposed rule has not been adopted. As a result of the change in the Administration and based on recent statements from Travis Hill, the new Acting Chairman of the FDIC, the proposed rule is unlikely to be adopted as proposed and the prospects and timing for a re-proposal by the FDIC are not certain at this time.

Although the Bank presently is not subject to the existing OCC risk governance standards for larger banks based on its current asset size, and the Bank, as a national bank supervised by the OCC, is not within the scope of the FDIC’s proposed rule, certain expectations set forth in existing and proposed regulatory guidelines may be imposed upon the Bank in the ordinary course of supervision and examination.

Further, the federal banking agencies have in recent years increased their focus on banks’ third-party risk management controls and practices. The federal banking agencies, including the OCC, adopted interagency guidance on risk management of third-party relationships. The guidance applies broadly to any business agreement between a banking organization and another entity, by contract or otherwise (including affiliated entities), and it requires banking organizations to analyze the risks associated with each third-party relationship and establish effective governance and risk management processes for all stages of a third-party relationship, including planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination.

On July 25, 2024, the federal banking agencies, including the OCC, issued a joint statement on banks’ arrangements with third parties to deliver bank deposit products and services. The joint statement identifies potential risks related to arrangements between banks and third parties to deliver bank deposit products and services to customers and provides examples of risk management practices to manage such risks.

Banking Acquisitions

We are required to obtain prior Federal Reserve approval before acquiring more than 5 percent of the voting shares, or substantially all of the assets, of a bank holding company, bank or savings association. In addition, the prior approval of the OCC is required for a national bank to merge with another bank or purchase the assets or assume the deposits of another bank. In determining whether to approve a proposed bank acquisition, federal bank regulators will consider, among other factors, the effect of the acquisition on competition, the public benefits expected to be received from the acquisition, the projected capital ratios and levels on a post-acquisition basis, and the acquiring institution’s record of addressing the credit needs of the communities it serves, including the needs of LMI neighborhoods, consistent with the safe and sound operation of the bank, under the CRA.

On September 17, 2024, the FDIC, the OCC and the DOJ, each announced new rules and policy statements impacting their bank merger review processes.

Among these actions, the FDIC approved a final statement of policy on bank merger transactions and the OCC approved a final rule updating the agency’s regulations for business combinations involving national banks and federal savings associations. The OCC’s final rule modifies its procedures for reviewing bank merger applications under the Bank Merger Act applications, including the elimination of the expedited bank merger review and the streamlined application procedures. The OCC’s final rule also includes a new policy statement that addresses the substantive standards that it will use to evaluate bank merger applications, including indicators that point in favor of likely approval or rejection. The FDIC's statement of policy adopts a principles-based approach and clarifies its policies and expectations in the evaluation of bank merger transactions subject to FDIC approval under the Bank Merger Act. However, Acting FDIC Chairman Travis Hill has indicated the possibility of withdrawing the new statement of policy, and it is unclear whether the OCC under anticipated new leadership will reconsider its new regulation and policy statement.

Concurrent with the FDIC and OCC announcements, the DOJ withdrew from its 1995 Bank Merger Guidelines and announced that it would consider bank mergers under its 2023 Merger Guidelines, which are not industry specific, as well as under a separate, recently adopted bank merger addendum.

Banking Subsidiary Dividends

The Parent Company is a legal entity separate and distinct from the Bank and other nonbanking subsidiaries. A substantial portion of our cash flow comes from dividends paid to us by Associated Bank. The OCC’s prior approval of the payment of dividends by Associated Bank to the Parent Company is required only if the total of all dividends declared by the Bank in any calendar year exceeds the sum of the Bank’s retained net income for that year and its retained net income for the preceding two calendar years, less any required transfers to surplus. Federal law also prohibits national banks from paying dividends that would be greater than the bank’s undivided profits after deducting statutory bad debt in excess of the bank’s allowance for loan losses. In addition, under the FDICIA, an IDI, such as the Bank, is prohibited from making capital distributions, including the payment of dividends, if, after making such distribution, the institution would become “undercapitalized” (as such term is used in the FDICIA).

Holding Company Dividends

In addition, the Corporation and the Bank are subject to various general regulatory policies and requirements relating to the payment of dividends, including requirements to maintain adequate capital above regulatory minimums. The appropriate federal regulatory authority is authorized to determine under certain circumstances relating to the financial condition of a bank or bank holding company that the payment of dividends would be an unsafe or unsound practice and to prohibit payment thereof. Under the Dodd-Frank Act and the requirements of the Federal Reserve, the Parent Company, as a bank holding company, is required to serve as a source of financial strength to the Bank and to commit resources to support the Bank. In addition, consistent with its “source of strength” policy, the Federal Reserve has stated that, as a matter of prudent banking, a bank holding company should not maintain a level of cash dividends to its shareholders that places undue pressure on the capital of its bank subsidiaries, or that can be funded only through additional borrowings or other arrangements that may undermine the bank holding company’s ability to serve as a source of strength. The appropriate federal regulatory authorities have indicated that paying dividends that deplete a bank’s capital base to an inadequate level would be an unsafe and unsound banking practice and that banking organizations should generally pay dividends only out of current operating earnings.

Capital Requirements

We are subject to various regulatory capital requirements both at the Parent Company and at the Bank level administered by the Federal Reserve and the OCC, respectively. Failure to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators that, if undertaken, could have an adverse material effect on our financial condition and results of operations. Under capital adequacy guidelines and the regulatory framework for prompt corrective action (described below), we must meet specific capital guidelines that involve quantitative measures of our assets, liabilities, and certain off-balance sheet items as calculated under regulatory accounting policies. Our capital amounts and classification are also subject to judgments by the regulators regarding qualitative components, risk weightings, and other factors.

The Federal Reserve, the OCC and the FDIC have adopted risk-based capital regulations implementing certain provisions of the Dodd-Frank Act and Basel III. The agencies’ previous capital regulations were amended in 2013 following the enactment of the Dodd-Frank Act to strengthen the components of regulatory capital, increase risk-based capital requirements, and make selected changes to the calculation of risk-weighted assets. In general, subject to certain exceptions as discussed further below, minimum capital standards established under the risk-based capital regulations include a CET1 capital to risk-weighted assets ratio of 4.5 percent, a Tier 1 capital to risk-weighted assets ratio of 6.0 percent, a total capital to risk-weighted assets ratio of 8.0 percent, and a Tier 1 capital to adjusted average total assets leverage ratio of 4.0 percent. In determining the amount of risk-weighted assets for purposes of calculating risk-based capital ratios, all assets, including certain off-balance sheet assets (for example, recourse obligations, direct credit substitutes and residual interests) are multiplied by a risk-weight factor assigned by the regulations based on the risks believed inherent in the type of asset. Higher levels of capital are required for asset categories believed to present greater risk. CET1 capital is generally defined as common shareholders’ equity and retained earnings. Tier 1 capital is generally defined as CET1 and additional Tier 1 capital. Additional Tier 1 capital includes certain noncumulative perpetual preferred stock and related surplus and minority interests in equity accounts of consolidated subsidiaries. Total capital includes Tier 1 capital (CET1 capital plus additional Tier 1 capital) and Tier 2 capital. Tier 2 capital is comprised of capital instruments and related surplus, meeting specified requirements, and may include cumulative preferred stock and long-term perpetual preferred stock, mandatory convertible securities, intermediate preferred stock and subordinated debt. Also included in Tier 2 capital is the ACL limited to a maximum of 1.25 percent of risk-weighted assets. Calculation of all types of regulatory capital is subject to deductions and adjustments specified in the regulations. In assessing an institution’s capital adequacy, the OCC takes into consideration not only these numeric factors, but qualitative factors as well, and has the authority to establish higher capital requirements for individual institutions where deemed necessary.

In addition to establishing the minimum regulatory capital requirements, the capital regulations limit capital distributions and certain discretionary bonus payments to management if the institution does not hold a capital conservation buffer consisting of 2.5 percent of CET1 capital to risk-weighted assets above the amount necessary to meet its minimum risk-based capital requirements.

Through subsequent rulemaking, the federal banking agencies provided certain forms of relief to banking organizations that are not subject to the capital regulation's advanced approaches, such as the Corporation. For instance, non-advanced approaches institutions are subject to simpler regulatory capital requirements for MSAs, certain DTAs arising from temporary differences, investments in the capital of unconsolidated financial institutions, and requirements for the amount of capital issued by a consolidated subsidiary of a banking organization and held by third parties (sometimes referred to as a minority interest) that is includable in regulatory capital.

Specifically, such institutions may deduct from CET1 capital any amount of MSAs, temporary difference DTAs, and investments in the capital of unconsolidated financial institutions that individually exceeds 25 percent of CET1 capital.

On July 27, 2023, the federal banking agencies issued a proposed rule to implement the final components of the Basel III standards set by the Basel Committee on Banking Supervision in 2017. The proposed rule, which would not apply to the Corporation and the Bank as proposed, would substantially revise the existing regulatory capital framework for institutions with $100 billion or more of assets. On September 10, 2024, Michael Barr, the Vice Chair for Supervision of the Federal Reserve, stated his intention to recommend to the Federal Reserve Board that the Federal Reserve re-propose a rule to implement the final components of the Basel III standards; however the federal banking agencies have not agreed on the issuance of a re-proposal and, in consideration of the new Administration and the expected changes in the leadership of the agencies, including a new Vice Chair for Supervision of the Federal Reserve, the prospects and timing for further rulemaking on these matters are uncertain at this time.

We continue to exceed all capital requirements necessary to be deemed “well-capitalized” for all regulatory purposes under the capital regulations. For further detail on capital and capital ratios, see discussion under the Liquidity and Capital sections under Part II, Item 7, Management's Discussion and Analysis of Financial Condition and Results of Operations, and under Part II, Item 8, Financial Statements and Supplementary Data, Note 18 Regulatory Matters of the notes to consolidated financial statements.

Current Expected Credit Loss Treatment

Under the current CECL model, we are required to present certain financial assets carried at amortized cost, such as loans held for investment and HTM securities, at the net amount expected to be collected. The measurement of expected credit losses is to be based on information about past events, including historical experience, current conditions, and reasonable and supportable forecasts that affect the collectability of the reported amount. The federal banking regulators have issued two final rules providing financial institutions with the option to delay the estimated impact on regulatory capital stemming from the CECL model. The two final rules, taken together, provided financial institutions with the option to mitigate the estimated capital effects of the CECL model for two years followed by a three-year phase-in period. The Corporation elected to utilize the Capital Transition Relief in 2020 as permitted under applicable regulations, and the three-year transition period described above commenced in 2022.

Capital Planning and Stress Testing Requirements

As part of the regulatory relief provided by the Economic Growth Act, the asset threshold requiring IDIs to conduct and report to their primary federal bank regulators annual company-run stress tests, as well as to comply with leverage limits, liquidity requirements, and resolution planning requirements, was raised from $10 billion to $250 billion in total consolidated assets and the stress testing requirement was made “periodic” rather than annual. As a result of the legislation and related OCC rulemaking thereunder, the Bank is no longer subject to Dodd-Frank Act stress testing requirements. The Economic Growth Act also provided that bank holding companies under $100 billion in assets were no longer subject to stress testing requirements. The amended regulations also provide the Federal Reserve with discretion to subject bank holding companies with more than $100 billion in total assets to enhanced supervision. In addition, Section 214 of the Economic Growth Act and its implementing regulation prohibit the federal banking agencies from requiring the Bank to assign a heightened risk weight to certain HVCRE ADC loans as previously required under the Basel III Capital Rules. Notwithstanding these regulatory amendments, the federal banking agencies indicated through interagency guidance that the capital planning and risk management practices of institutions with total assets less than $100 billion would continue to be reviewed through the regular supervisory process. Although the Corporation will continue to monitor and stress test its capital consistent with the safety and soundness expectations of the federal regulators, the Corporation no longer publishes stress testing results as a result of the legislative and regulatory amendments.

Enforcement Powers of the Federal Banking Agencies; Prompt Corrective Action

The Federal Reserve, the OCC, and the CFPB have extensive supervisory authority over their regulated institutions, including, among other things, the power to compel higher reserves, the ability to assess civil money penalties, the ability to issue cease-and-desist or removal orders and the ability to initiate injunctive actions. In general, these enforcement actions may be initiated for violations of laws and regulations or for unsafe or unsound banking practices. Other actions or inactions by the Parent Company may provide the basis for enforcement action, including misleading or untimely reports.

Federal banking regulators are authorized and, under certain circumstances, required to take certain actions against banks that fail to meet their capital requirements. The federal banking agencies have additional enforcement authority with respect to undercapitalized depository institutions.

“Well-capitalized” institutions may generally operate without supervisory restriction. “Adequately capitalized” institutions cannot normally pay dividends or make any capital contributions that would leave them undercapitalized; they cannot pay a management fee to a controlling person if, after paying the fee, they would be undercapitalized; and they cannot accept, renew or roll over any brokered deposit unless the bank has applied for and been granted a waiver by the FDIC.

The federal banking agencies are required to take action to restrict the activities of an “undercapitalized,” “significantly undercapitalized,” or “critically undercapitalized” IDI. Any such bank must submit a capital restoration plan that is guaranteed by the parent holding company. Until such plan is approved, it may not increase its assets, acquire another institution, establish a branch or engage in any new activities, and generally may not make capital distributions. In certain situations, a federal banking agency may reclassify a well-capitalized institution as adequately capitalized and may require an adequately capitalized or undercapitalized institution to comply with supervisory actions as if the institution were in the next lower category.

Institutions must file a capital restoration plan with the OCC within 45 days of the date it receives a notice from the OCC that it is “undercapitalized,” “significantly undercapitalized,” or “critically undercapitalized.” Compliance with a capital restoration plan must be guaranteed by a parent holding company. In addition, the OCC is permitted to take any one of a number of discretionary supervisory actions, including but not limited to the issuance of a capital directive and the replacement of senior executive officers and directors.

Finally, bank regulatory agencies have the ability to impose higher than normal capital requirements known as individual minimum capital requirements for institutions with a high-risk profile.

At December 31, 2024, the Bank satisfied the capital requirements necessary to be deemed “well-capitalized.” In the event of a change to this status, the imposition of any of the measures described above could have a material adverse effect on the Corporation and on its profitability and operations. The Corporation’s shareholders do not have preemptive rights and, therefore, if the Corporation is directed by the OCC or the FDIC to issue additional shares of common stock, such issuance may result in dilution in shareholders’ percentage of ownership of the Corporation.

Deposit Insurance Premiums

Associated Bank is a member of the FDIC and pays an insurance premium to the FDIC based upon its assessment rates on a quarterly basis. Deposits are insured up to applicable limits by the FDIC and such insurance is backed by the full faith and credit of the United States Government.

Under the Dodd-Frank Act, a permanent increase in deposit insurance was authorized to $250,000 per depositor, per IDI for each account ownership category.

The Dodd-Frank Act also set the minimum DIF reserve ratio at 1.35 percent of estimated insured deposits. The FDIC was required to attain this ratio by September 30, 2020. The Dodd-Frank Act also required the FDIC to define the deposit insurance assessment base for an IDI as an amount equal to the institution’s average consolidated total assets during the assessment period minus average tangible equity. The assessment rate schedule for larger institutions like Associated Bank (i.e., institutions with at least $10 billion in assets) differentiates between such large institutions by use of a “scorecard” that combines an institution’s CAMELS ratings with certain forward-looking financial information to measure the risk to the DIF. Pursuant to this “scorecard” method, two scores (a performance score and a loss severity score) will be combined and converted to an initial base assessment rate. The performance score measures an institution’s financial performance and ability to withstand stress. The loss severity score measures the relative magnitude of potential losses to the DIF in the event of the institution’s failure. Total scores are converted pursuant to a predetermined formula into an initial base assessment rate. Assessment rates range from 2.5 bp to 45 bp for large institutions.

The FDIC has the flexibility to adopt actual rates that are higher or lower than the total base assessment rates adopted without notice and comment, if certain conditions are met.

In 2022, the FDIC adopted a final rule, applicable to all IDIs, to increase base deposit insurance assessment rate schedules uniformly by 2 bp beginning in the first quarterly assessment period of 2023. The increase was instituted to account for extraordinary growth in insured deposits during the first and second quarters of 2020, which caused a substantial decrease in the DIF reserve ratio. The new assessment rate schedules are expected to remain in effect until the DIF reserve ratio meets or exceeds 2 percent. At December 31, 2024, our estimated level of uninsured deposits was $15.5 billion. The Corporation’s assessment rate for FDIC was approximately 10 bp for 2024.

Further, in 2023, the FDIC issued a final rule to implement a special assessment to recover the loss to the DIF associated with protecting uninsured depositors following the closure of SVB and SBNY. Under the final rule, the assessment base for an IDI is equal to the institution’s estimated uninsured deposits as of December 31, 2022, adjusted to exclude the first $5 billion in estimated uninsured deposits. The FDIC started collecting the special assessment at an annual rate of 13.4 bp beginning with the first quarterly assessment period of 2024. The FDIC is anticipated to collect special assessments for the total of eight quarterly assessment periods. Because the estimated loss is periodically adjusted, the FDIC may end the collection early, extend the special assessment period beyond the initial eight-quarter collection period or impose a one-time final shortfall special assessment.

The FDIC is authorized to conduct examinations of and require reporting by FDIC-insured institutions. It is also authorized to terminate a depository bank’s deposit insurance upon a finding by the FDIC that the bank’s financial condition is unsafe or unsound or that the institution has engaged in unsafe or unsound practices or has violated any applicable rule, regulation, order or condition enacted or imposed by the bank’s regulatory agency. The termination of deposit insurance for the Bank would have a material adverse effect on our earnings, operations and financial condition.

Historically, deposit insurance premiums we have paid to the FDIC have been deductible for federal income tax purposes; however, the Tax Act disallows the deduction of such premium payments for banking organizations with total consolidated assets of $50 billion or more. For banks with less than $50 billion in total consolidated assets, such as ours, the premium deduction is phased out based on the proportion of a bank’s assets exceeding $10 billion.

Brokered Deposits

Section 29 of the FDI Act and FDIC regulations thereunder limit the ability of an IDI, such as the Bank, to accept, renew or roll over brokered deposits unless the institution is well-capitalized under the prompt corrective action framework described above, or unless it is adequately capitalized and obtains a waiver from the FDIC. In addition, less than well-capitalized banks are subject to restrictions on the interest rates they may pay on deposits. The characterization of deposits as "brokered" may result in the imposition of higher deposit assessments on such deposits. As mandated by the Economic Growth Act, the FDIC adopted a final rule in February 2019 to include a limited exception for reciprocal deposits for FDIC-IDIs that are well-rated and well-capitalized (or adequately capitalized and have obtained a waiver from the FDIC as mentioned above). Under the limited exception, qualified FDIC-IDIs, like the Bank, are able to except from treatment as "brokered" deposits up to $5 billion or 20 percent of the institution's total liabilities in reciprocal deposits (which is defined as deposits received by a financial institution through a deposit placement network with the same maturity (if any) and in the same aggregate amount as deposits placed by the institution in other network member banks).

Associated Bank is currently subject to the FDIC's regulatory framework for brokered deposits. Notable aspects of that framework include the following: (1) standards for determining whether an entity meets the statutory definition of "deposit broker"; (2) the enumeration of several business relationships in which the agent of nominee is automatically not deemed to be a "deposit broker" because their primary purpose is not the placement of funds with depository institutions (the "primary purpose exception"); (3) an application process for entities that seek to rely upon the "primary purpose exception" to the "deposit broker" definition, but do not qualify as one of the identified business relationships to which the exception is automatically applicable; (4) notice requirements for certain designated business exceptions; (5) a waiver process applicable to “adequately capitalized” banks seeking to accept, renew or rollover brokered deposits; and (6) additional terms and standards further implementing the limited statutory exception for reciprocal deposits noted above.

On July 30, 2024, the FDIC issued a proposed rule that would significantly revise the existing brokered deposits regulation as outlined above. Among other things, the proposed rule would broaden the scope of deposits that IDIs would be required to classify as brokered and narrow the exception to the definition of the term “deposit broker,” which would result in more deposits being classified as brokered deposits. As a result of the new Administration based on recent statements from the new Acting Chairman of the FDIC, the proposed rule is unlikely to be adopted as proposed and the prospects and timing for any re-proposal or supervisory action in this area remain uncertain at this time.

Transactions with Affiliates and Insiders

Transactions between the Bank and its related parties or any affiliate are governed by Sections 23A and 23B of the Federal Reserve Act. An affiliate is any company or entity, which controls, is controlled by or is under common control with the bank. In a holding company context, at a minimum, the parent holding company of a national bank, and any companies that are controlled by such parent holding company, are affiliates of the bank. Generally, Sections 23A and 23B (i) limit the extent to which an institution or its subsidiaries may engage in “covered transactions” with any one affiliate to an amount equal to 10 percent of such institution’s capital stock and surplus, and contain an aggregate limit on all such transactions with all affiliates to an amount equal to 20 percent of such capital stock and surplus, and (ii) require that all such transactions be on terms substantially the same, or at least as favorable, to the institution or subsidiary as those provided to a nonaffiliate. The term “covered transaction” includes the making of loans, purchase of assets, issuance of a guarantee and similar types of transactions. Certain types of covered transactions must be collateralized according to a schedule set forth in the statute based on the type of collateral.

Certain transactions with our directors, officers or controlling persons are also subject to conflicts of interest regulations. Among other things, these regulations require that loans to such persons and their related interests be made on terms substantially the same as for loans to unaffiliated individuals and must not create an abnormal risk of repayment or other unfavorable features for the financial institution. See Note 3 Loans of the notes to consolidated financial statements in Part II, Item 8, Financial Statements and Supplementary Data, for additional information on loans to related parties.

Community Reinvestment Act Requirements

Associated Bank is subject to periodic CRA reviews by the OCC. The CRA does not establish specific lending requirements or programs for financial institutions and does not limit the ability of such institutions to develop products and services believed best-suited for a particular community. An institution’s CRA assessment may be used by its regulators in their evaluation of certain applications, including a merger, acquisition or the establishment of a branch office. An unsatisfactory rating may be used as the basis for denial of such an application. The Bank received a “Satisfactory” CRA rating in its most recent evaluation.

On October 24, 2023, the federal banking agencies jointly issued a final rule to strengthen and modernize the existing CRA regulations. Under the final rule, the agencies will evaluate a bank’s CRA performance based upon the varied activities that it conducts and the communities in which it operates. CRA evaluations and data collection requirements will be tailored based on bank size and type. The Bank would be considered a large bank with assets of greater than $10 billion under the final rule and therefore will be evaluated under retail lending, retail services and products, community development financing, and community development services tests. Under the final rule, the retail lending test would include an evaluation of a financial institution’s automobile loans if they represent a majority of the institution’s retail lending or at the institution’s option. The final rule significantly expands the assessment area that financial institutions must consider when evaluating their lending practices by including areas associated with mobile and online banking and includes new metrics and benchmarks to assess retail lending performance. In addition, the final rule emphasizes smaller loans and investments that can have a high impact and be more responsive to the needs of LMI communities.

On March 29, 2024, a federal district court in Texas granted a preliminary injunction barring implementation of the final rule. The injunction extends the effective date of April 1, 2024, and all other implementation dates, on a day-for-day basis until the injunction is lifted. While the federal banking agencies are appealing the district court’s decision, to date the injunction remains in effect and implementation of the final rule is delayed indefinitely. Compliance with the majority of the final rule's provisions otherwise would not have been required until January 1, 2026 and the data reporting requirements of the final rule would not have taken effect until January 1, 2027.

Privacy, Data Protection, and Cybersecurity

We receive, store, use and otherwise process information that relates to individuals and/or constitutes “personal data,” “personal information,” “nonpublic personal information,” or similar terms under applicable data privacy laws. We and our vendors are subject to a number of U.S. federal, state, local and foreign laws and regulations, industry standards and other requirements relating to consumer privacy and data protection, including those that apply generally to the handling of personal information. Under privacy protection provisions of the GLBA and its implementing regulations and guidance, we are limited in our ability to disclose certain non-public information about consumers to nonaffiliated third parties. Financial institutions, such as the Bank, are required by statute and regulation to notify consumers of their privacy policies and practices and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a nonaffiliated third party. In addition, such financial institutions must appropriately safeguard their customers’ nonpublic, personal information. Consumers and, in some instances, state and federal regulators, must be notified in the event of a data breach under applicable state laws and federal regulations. We had no material data breaches in 2024.

The changing privacy laws in the United States, Europe and elsewhere create new individual privacy rights and impose increased obligations on companies handling personal information, including the CCPA, as amended by the CPRA. While GLBA-regulated nonpublic, personal information generally is exempt under the CCPA, the CCPA and other state laws apply to other personal information processed by the Bank.

In addition, multiple states, Congress and regulators within and outside of the United States are considering similar laws or regulations which could create new individual privacy rights and impose additional obligations on the Bank.

The federal banking agencies, including the OCC, have issued a rule imposing cybersecurity notification requirements for banking organizations and their service providers. Specifically, the rule requires banking organizations to notify their primary federal regulator as soon as possible and no later than 36 hours after the discovery of a "computer-security incident" that rises to the level of a "notification incident," as those terms are defined under the final rule.

The federal banking agencies have also adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of the board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services. A financial institution also should have a business continuity program to recover from a cyberattack and procedures for monitoring the security of third-party service providers that may have access to nonpublic data at the institution.

Additionally, recent and ongoing developments may impact our data security- and privacy-related internal controls and risk profile. On October 22, 2024, the CFPB adopted a final rule regarding personal financial data rights that is designed to promote “open banking.” The final rule requires, among other things, that data providers, including any financial institution, make available to consumers and certain authorized third parties upon request certain covered transaction, account and payment information. IDIs with at least $10 billion but less than $250 billion in total assets, including Associated Bank, are required to comply with the final rule by April 1, 2027. On the same day the final rule was released, certain industry participants filed a complaint against the CFPB challenging the final rule. This legal challenge may delay or halt the final rule’s implementation.

Artificial Intelligence

CFPB and other federal regulatory guidance reiterates that creditors are not excused from the adverse action notice requirements under ECOA simply because they rely on complex algorithmic underwriting models. States have also started to regulate the use of AI technologies. Of note, the California Privacy Protection Agency is currently in the process of finalizing regulations under the CCPA regarding the use of automated decision making. California also enacted new laws that further regulate use of AI technologies and provide consumers with additional protections around companies’ use of AI technologies, such as requiring companies to disclose certain uses of generative AI, and other states have also passed AI-focused legislation. In addition, the New York State Department of Financial Services issued an industry letter on combating cybersecurity risks associated with AI.

Additionally, on January 23, 2025, President Trump issued an Executive Order aimed at reducing barriers to AI innovation in the U.S. economy. The Order requires relevant persons and bodies within the federal government to develop an AI action plan to carry out this objective, and revokes an AI-related Executive Order issued in 2023 by President Biden, as well as all corresponding policies, regulations, orders, directives and other actions taken in response to such Order.

Bank Secrecy Act / Anti-Money Laundering

The BSA, which is intended to require financial institutions to develop policies, procedures, and practices to prevent and deter money laundering, mandates that every national bank have a written, board-approved program that is reasonably designed to assure and monitor compliance with the BSA. The program must, at a minimum: (1) provide for a system of internal controls to assure ongoing compliance; (2) provide for independent testing for compliance; (3) designate an individual responsible for coordinating and monitoring day-to-day compliance; and (4) provide training for appropriate personnel. In addition, national banks are required to adopt a customer identification program as part of their BSA compliance program. National banks are also required to file SARs when they detect certain known or suspected violations of federal law or suspicious transactions related to money laundering activity or a violation of the BSA. The regulations implementing the BSA require financial institutions to establish risk-based procedures for conducting ongoing customer due diligence and procedures for understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile. In addition, FinCEN has promulgated customer due diligence and customer identification rules that require banks to identify and verify the identity of the beneficial owners of all legal entity customers (other than those that are excluded) at the time a new account is opened (other than accounts that are exempted).

In addition to complying with the BSA, the Bank is subject to the Patriot Act. The Patriot Act is designed to deny terrorists and criminals the ability to obtain access to the United States’ financial system and has significant implications for depository institutions, brokers, dealers, and other businesses involved in the transfer of money. The Patriot Act mandates that financial service companies implement additional policies and procedures and take heightened measures designed to address any or all of the following matters: customer identification programs, money laundering, terrorist financing, identifying and reporting suspicious activities and currency transactions, currency crimes, and cooperation between financial institutions and law enforcement authorities.

Following the legalization of domestic production of hemp, three federal banking agencies and FinCEN issued a joint statement clarifying the compliance procedures and reporting requirements that banks must file for customers engaged in the growth or cultivation of hemp, including a clear statement that banks need not file a SAR on customers engaged in the growth or cultivation of hemp in accordance with applicable laws and regulations. This statement does not apply to marijuana-related businesses; thus, the statement only pertains to customers who are lawfully growing or cultivating hemp and are not otherwise engaged in unlawful or suspicious activity. The manufacture, sale, distribution and possession of marijuana remains illegal under federal law even though such activity may be legal under many states’ laws. This incongruity between federal and state law creates risks for financial institutions with marijuana-related business customers. In 2014, FinCEN issued guidance clarifying how financial institutions can provide services to marijuana-related businesses consistent with their BSA obligations, including SAR filings. That guidance remains in effect.

On June 28, 2024, FinCEN issued a proposed rule to strengthen and modernize financial institutions’ AML/CFT programs. Key requirements of the proposed rule include (1) conducting periodic risk assessments to measure AML/CFT risks; (2) designating a qualified AML/CFT officer; and (3) periodic testing of the AML/CFT program by an independent internal or external party. The proposed rule would also require that a financial institution’s AML/CFT program be established, maintained and enforced by persons in the United States who are accessible to, and subject to oversight and supervision by, the secretary of the Treasury and the appropriate federal functional regulator.

Interstate Branching

Pursuant to the Dodd-Frank Act, national and state-chartered banks may open an initial branch in a state other than its home state (e.g., a host state) by establishing ade novo branch at any location in such host state at which a bank chartered in such host state could establish a branch. Applications to establish such branches must still be filed with the appropriate primary federal regulator.

Volcker Rule

The Dodd-Frank Act prohibits IDIs and their holding companies from engaging in proprietary trading except in limited circumstances, and prohibits them from owning equity interests in excess of three percent of Tier 1 Capital in private equity and hedge funds (known as the “Volcker Rule”). Five U.S. financial regulators with jurisdiction over the Volcker Rule, including the Federal Reserve and the OCC, have adopted implementing regulations. Those regulations prohibit banking entities from (1) engaging in short-term proprietary trading for their own accounts, and (2) having certain ownership interests in and relationships with hedge funds or private equity funds, which are referred to as “covered funds.” The regulations also require each regulated entity to establish an internal compliance program that is consistent with the extent to which it engages in activities covered by the Volcker Rule. The Volcker Rule was subsequently revised to simplify and streamline compliance requirements for firms that do not have significant trading activities and enhance requirements for firms that do. Under the current framework, compliance requirements are based on the amount of assets and liabilities that a bank trades. Firms with significant trading activities (i.e., those with $20 billion or more in trading assets and liabilities) have heightened compliance obligations. Although we benefit from significantly reduced compliance obligations due to the level of our trading assets being below the $20 billion threshold as a result of the final rule, we remain subject to the modified rules and requirements related to covered funds. With respect to the Volcker Rule's covered fund restrictions, the Volcker Rule’s implementing regulations currently exclude several funds from the “covered fund” definition, including certain credit funds, venture capital funds, loan securitization vehicles, and wealth management and customer facilitation vehicles, and allow IDIs to invest in certain foreign public funds as well as exempt the activities of qualifying foreign excluded funds from the Volcker Rule's prohibitions.

Incentive Compensation Policies and Restrictions

The federal banking agencies have issued guidance on sound incentive compensation policies that applies to all banking organizations supervised by the agencies (thereby including both the Parent Company and the Bank). Pursuant to the guidance, to be consistent with safety and soundness principles, a banking organization’s incentive compensation arrangements should: (1) provide employees with incentives that appropriately balance risk and reward; (2) be compatible with effective controls and risk management; and (3) be supported by strong corporate governance including active and effective oversight by the banking organization’s board of directors. Monitoring methods and processes used by a banking organization should be commensurate with the size and complexity of the organization and its use of incentive compensation.

The Dodd-Frank Act required the federal banking agencies and the SEC to establish joint regulations or guidelines for specified regulated entities, such as us, having at least $1 billion in total assets, to prohibit incentive-based payment arrangements that encourage inappropriate risk taking by providing an executive officer, employee, director or principal shareholder with excessive compensation, fees, or benefits or that could lead to material financial loss to the entity. On May 6, 2024, the FDIC, the OCC and the FHFA issued a notice of proposed rulemaking to address incentive-based compensation arrangements. The proposed rule includes general qualitative requirements applicable to all covered financial institutions as well as additional requirements for financial institutions with total consolidated assets of $50 billion or more. The general qualitative requirements include (1) prohibiting incentive-based compensation arrangements that encourage inappropriate risks; (2) prohibiting incentive arrangements that encourage inappropriate risks that could lead to a material financial loss; (3) establishing requirements for performance measures to appropriately balance risk and reward; (4) requiring board oversight of incentive compensation arrangements; and (5) appropriate recordkeeping. The prospects and timing for the adoption of the proposed rule remain uncertain because both the Federal Reserve and the SEC have not joined the proposal.

In addition, these regulators must establish regulations or guidelines requiring enhanced disclosure to regulators of incentive-based compensation arrangements. Pursuant to SEC regulations and NYSE rules enacted in 2022, we adopted a "clawback" policy with respect to the recovery of incentive-based compensation paid to current or former executive officers in the event of material noncompliance with any financial reporting requirement under the securities laws. A copy of our clawback policy is attached as Exhibit 97 to this Annual Report on 10-K.

The Federal Reserve will review, as part of its standard, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Corporation, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

Consumer Financial Services Regulations

Federal and applicable state banking laws also require us to take steps to protect consumers. Bank regulatory agencies are increasingly focusing attention on compliance with consumer protection laws and regulations. These laws include disclosures regarding truth in lending, truth in savings, and funds availability.

To promote fairness and transparency for mortgages, credit cards, and other consumer financial products and services, the Dodd-Frank Act established the CFPB. This agency is responsible for interpreting and enforcing federal consumer financial laws, as defined by the Dodd-Frank Act, that, among other things, govern the provision of deposit accounts along with mortgage origination and servicing. Some federal consumer financial laws enforced by the CFPB include the ECOA, TILA, the Truth in Savings Act, the Home Mortgage Disclosure Act, RESPA, the Fair Debt Collection Practices Act, and the FCRA. The CFPB is also authorized to prevent any institution under its authority from engaging in an unfair, deceptive, or abusive act or practice in connection with consumer financial products and services.

Under TILA as implemented by Regulation Z, mortgage lenders are required to make a reasonable and good faith determination based on verified and documented information that a consumer applying for a mortgage loan has a reasonable ability to repay the loan according to its terms. Mortgage lenders are required to determine consumers’ ATR in one of two ways. The first alternative requires the mortgage lender to consider the following eight underwriting factors when making the credit decision: (1) current or reasonably expected income or assets; (2) current employment status; (3) the monthly payment on the covered transaction; (4) the monthly payment on any simultaneous loan; (5) the monthly payment for mortgage-related obligations; (6) current debt obligations, alimony, and child support; (7) the monthly DTI ratio or residual income; and (8) credit history. Alternatively, the mortgage lender can originate QMs, which generally are mortgage loans without negative amortization, interest-only payments, balloon payments, or terms exceeding 30 years. QMs are entitled by rule to a presumption that the creditor making the loan satisfied the ATR requirements provided certain requirements are met. The Corporation is predominantly an originator of compliant QMs. The CFPB also has implemented the TILA-RESPA Integrated Disclosure rules, which harmonize disclosure and certain regulatory compliance requirements required under those two statutes with respect to residential mortgage loans.

Additionally, the CFPB has the authority to take supervisory and enforcement action against banks and other financial services companies under the agency’s jurisdiction that fail to comply with federal consumer financial laws. As an IDI with total assets of more than $10 billion, the Bank is subject to the CFPB’s supervisory and enforcement authorities. The Dodd-Frank Act also permits states to adopt stricter consumer protection laws and state attorneys general to enforce consumer protection rules issued by the CFPB. As a result of these aspects of the Dodd-Frank Act, the Bank operates in a stringent consumer compliance environment. Therefore, the Bank is likely to incur additional costs related to consumer protection compliance, including but not limited to potential costs associated with CFPB examinations, regulatory and enforcement actions and consumer-oriented litigation, which is likely to increase as a result of the consumer protection provisions of the Dodd-Frank Act. The CFPB has been active in bringing enforcement actions against banks and other financial institutions to enforce consumer financial laws. The federal financial regulatory agencies, including the OCC and states attorneys general, also have become increasingly active in this area with respect to institutions over which they have jurisdiction. We have incurred and may in the future incur additional costs in complying with these requirements.

In recent years, the CFPB—with the support of the Biden Administration—has launched an initiative aimed at eliminating or restricting a number of fees assessed by financial institutions, including overdraft and NSF fees as well as other transaction- and account management-related fees deemed by the CFPB to be “junk fees.” The CFPB has carried out its initiative through a mixture of supervision, examination and enforcement actions. Of note, on December 12, 2024, the CFPB published a final rule to amend Regulation Z, which implements TILA, and Regulation E, which implements EFTA, to require IDIs with total assets exceeding $10 billion, such as Associated Bank, that offer overdraft protection services to comply with applicable disclosure requirements for extensions of consumer credit or cap any charges to pay an overdraft credit transaction either at $5 or an amount that would allow the institution to cover its costs and losses with respect to the overdraft credit transaction, should the institution wish to calculate such amount in accordance with requirements of the final rule. The final rule is scheduled to take effect on October 1, 2025; however, with the recent change in Administration and leadership of the CFPB, continued implementation of the final rule is not certain.

Environmental and Social Risk Management and Regulation

In past years, various state and federal policymakers have increased their focus on environmental and social, including climate-related, matters. Federal banking agencies have taken actions to enhance their supervisory expectations regarding the climate risk management practices of larger banking organizations, and in 2023, the OCC, the FDIC and the Federal Reserve jointly finalized principles for climate-related financial risk management for national banks with more than $100 billion in total assets, which while not directly applicable to the Corporation may inform various expectations for our own risk management processes. The SEC also finalized its climate-related disclosure rules in March 2024, though such rules have been stayed pending litigation. At the state level, various states have adopted or are considering adopting actions to address climate-related matters. For example, Minnesota, Wisconsin, and Illinois each have announced goals to transition their states to a low-carbon future, including reduction of GHG emissions and/or transition to low-carbon energy. States have adopted various policies and laws in connection with such goals or to otherwise address potential climate-related risks. There is also increased attention to disclosure of certain environmental and social information. For example, California has adopted laws requiring in-scope companies to provide certain climate-related information, including GHG emissions and climate-related financial risks and related management strategies, and similar laws are being considered in other states. Simultaneously, certain other policymakers have proposed or adopted requirements to constrain consideration by companies and financial institutions of various environmental and social factors, including certain climate-related considerations.

The Corporation has established an Environmental Risk Management Policy and Program ("Program") Statement focused on environmental risk management; our environmental focus on efficient energy and resource use; and the environmental sustainability transition which will serve as the foundation to Associated's Environmental Sustainability Risk Management Program, a program for supporting environmental sustainability risk reporting. The Program is intended to help manage environmental and climate risk in a comprehensive, systematic, planned and documented manner, and to help policy practices integrate into the Corporation's Enterprise Risk Management program and align them with business objectives and any applicable laws. Oversight for climate-related risks includes Board-level, senior management and Board and management committee oversight.

Digital Asset Regulation

In recent years, the federal banking agencies have expressed increased concerns regarding the engagement by banking organizations in certain digital assets activities and issued a series of guidance materials addressing digital asset-related risks. For example, in 2021, the OCC issued an interpretive letter generally clarifying that certain digital assets activities of national banks are permissible subject to safety-and-soundness standards and the OCC’s prior approval. Similarly, in 2022, the Federal Reserve released a supervisory guidance requiring all banking organizations supervised by the agency to notify the Federal Reserve prior to engaging in any digital asset-related activity. The Federal Reserve’s guidance also reiterates that all digital asset-related activities must be legally permissible under applicable law and satisfy the relevant safety-and-soundness, risk management and internal controls requirements. In 2023, the federal banking agencies, including the OCC and the FDIC, issued guidance in the form of a joint statement to address, among other things, various risks resulting from the digital asset sector, risks stemming from the crypto-asset market vulnerabilities, deposit concentration and liquidity risk, and effective risk management and internal controls. Most recently, in August 2023, the Federal Reserve announced the establishment of a Novel Activities Supervision Program, which is designed in part to enhance the Federal Reserve’s supervision processes in respect of banking organizations’ crypto-asset related activities and use of distributed ledger technologies and other novel technologies in the delivery of financial products and services.

Although the federal banking agencies have not developed formal regulations governing the digital asset activities of banking organizations, the supervisory framework summarized above currently dictates that, in order to effectively identify and manage digital asset-related risks and obtain supervisory non-objection to the proposed engagement in digital asset activities, banking organizations must implement appropriate risk management practices, including with respect to board and management oversight, policies and procedures, risk assessments, internal controls and monitoring. As a result of change in Administration and anticipated corresponding changes in the leadership of the federal banking agencies, it is uncertain whether the agencies will continue to adhere to this supervisory framework. Of note, on January 23, 2025, the Trump Administration announced an Executive Order establishing the President's Working Group on Digital Asset Markets ("Working Group"). Under the Order, the Working Group, which includes the Treasury Secretary but does not include the Comptroller of the Currency specifically nor does it include the leadership of the Federal Reserve or the FDIC, is responsible for evaluating existing laws and regulations affecting the digital asset sector and recommending regulatory and legislative proposals to govern the issuance and operation of digital assets. Additionally, on January 21, 2025, Acting FDIC Chairman Travis Hill issued a statement outlining the FDIC's priorities in the coming months, which include adopting a "more transparent approach to fintech partnerships and to digital assets and tokenization." Concurrently, the SEC announced the formation of a crypto task force dedicated to developing a

"comprehensive and clear regulatory framework for crypto assets." The work and recommendations of the SEC's task force may, to some extent, inform the federal banking agencies' views on their supervisory framework. To date, the Bank has not engaged in any digital asset-related activities or transactions but we continue to evaluate the state of the market and the regulatory landscape and may elect to engage in such activities in the future after due consideration of relevant risks and opportunities.

Other Banking Regulations

The Bank is also subject to a variety of other regulations with respect to the operation of its businesses, including but not limited to the Dodd-Frank Act, which among other restrictions placed limitations on the interchange fees charged for debit card transactions, TILA, Truth in Savings Act, ECOA, EFTA, Fair Housing Act, Home Mortgage Disclosure Act, Fair Debt Collection Practices Act, FCRA, Expedited Funds Availability (Regulation CC), Reserve Requirements (Regulation D), Insider Transactions (Regulation O), Privacy of Consumer Information (Regulation P), Margin Stock Loans (Regulation U), Right To Financial Privacy Act, Flood Disaster Protection Act, Homeowners Protection Act, Servicemembers Civil Relief Act, RESPA, TCPA, CAN-SPAM Act, Children’s Online Privacy Protection Act, and the John Warner NDAA. Further, in January of 2021, the OCC issued a notice of proposed rulemaking to amend current rules related to national banks' ownership of real property. The proposal would provide a set of general standards, including an occupancy test and excess capacity standards, that the OCC will use to determine whether the acquisition and holding of real estate is necessary for the transaction of an institution's business. The prospects and timing for the adoption of a final rule are uncertain at this time.

The laws and regulations to which we are subject are constantly under review by Congress, the federal regulatory agencies, and the state authorities. These laws and regulations could be changed drastically in the future, which could affect our profitability, our ability to compete effectively, or the composition of the financial services industry in which we compete.

Impact of Presidential and Congressional Elections on Recent Rulemaking

Control of the White House and the U.S. Congress shifted to the Republican Party in January 2025 as a result of the November 2024 Presidential and Congressional elections. President Trump and many Republican members of Congress have advocated for a significant reduction of financial services regulation, potentially including amendments to the Dodd-Frank Act and other federal banking laws, and structural changes to the CFPB. The new Administration and Congress may also cause broader economic changes due to changes in governing ideology and governing style. In consideration of these factors, it is possible, though uncertain, that Congress and/or the relevant federal agencies may seek to roll back or modify some or much of the rulemaking and regulatory guidance issued under the Biden administration, particularly the actions taken in the past year. Further, a change in the leadership of the FDIC, OCC and CFPB is expected under the new Administration; however, the timing and impact of each such change in leadership on the regulatory, enforcement and supervisory priorities of each agency are not fully known at this time. It is therefore unclear at the present time what effect the aforementioned changes will have on the banking industry.

Government Monetary Policies and Economic Controls

Our earnings and growth, as well as the earnings and growth of the banking industry, are affected by the credit policies of monetary authorities, including the Federal Reserve. An important function of the Federal Reserve is to regulate the national supply of bank credit in order to combat recession and curb inflationary pressures. Among the instruments of monetary policy used by the Federal Reserve to implement these objectives are open market operations in U.S. government securities, changes in reserve requirements against member bank deposits, and changes in the Federal Reserve discount rate. These instruments are used in varying combinations to influence overall growth of bank loans, investments, and deposits, and may also affect interest rates charged on loans or paid for deposits. The monetary policies of the Federal Reserve authorities have had a significant effect on the operating results of commercial banks in the past and are expected to continue to have such an effect in the future.

In view of changing conditions in the national economy and in money markets, as well as the effect of credit policies by monetary and fiscal authorities, including the Federal Reserve, it is difficult to predict the impact of possible future changes in interest rates, deposit levels, and loan demand, or their effect on our business and earnings or on the financial condition of our various customers.

Other Regulatory Authorities

In addition to regulation, supervision and examination by federal banking agencies, the Corporation and certain of its subsidiaries, including those that engage in securities brokerage, dealing and investment advisory activities, are subject to other federal and applicable state securities laws and regulations, and to supervision and examination by other regulatory authorities, including the SEC, FINRA, NYSE, DOL and others.

Separately, in June of 2019, pursuant to the Dodd-Frank Act, the SEC adopted Regulation Best Interest, which, among other things, establishes a new standard of conduct for a broker-dealer to act in the best interest of a retail customer when making a recommendation of any securities transaction or investment strategy involving securities to such customer. The new rule requires us to review and possibly modify our compliance activities, which is causing us to incur some additional costs. In addition, state laws that impose a fiduciary duty also may require monitoring, as well as require that we undertake additional compliance measures.

Available Information

We file annual, quarterly, and current reports, proxy statements, and other information with the SEC. These filings are available to the public on the Internet at the SEC’s web site atwww.sec.gov.

Our principal internet address iswww.associatedbank.com. We make available free of charge on or through our website our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC. In addition, shareholders may request a copy of any of our filings (excluding exhibits) at no cost by writing at Associated Banc-Corp, Attn: Investor Relations, 433 Main Street, Green Bay, WI 54301 or e-mailing us at investor.relations@associatedbank.com.