ASSOCIATED BANC-CORP

Previous wording

An investment in our common stock is subject to risks inherent to our business. The material risks and uncertainties that management believes affect us are described below. Before making an investment decision, you should carefully consider the risks and uncertainties described below, together with all of the other information included or incorporated by reference herein. The risks and uncertainties described below are not the only ones facing us. Additional risks and uncertainties that management is not aware of or focused on or that management currently deems immaterial may also impair our business operations. This report is qualified in its entirety by these risk factors. See also, Special Note Regarding Forward-Looking Statements and Risk Factors Summary.

Current wording

An investment in our common stock is subject to risks inherent to our business. The material risks and uncertainties that management believes affect us are described below. Before making an investment decision, you should carefully consider the risks and uncertainties described below, together with all of the other information included or incorporated by reference herein. The risks and uncertainties described below are not the only ones facing us. Additional risks and uncertainties that management is not aware of or focused on or that management currently deems immaterial may impair our business operations. This report is qualified in its entirety by these risk factors. See also, Special Note Regarding Forward-Looking Statements and Risk Factors Summary.

Previous wording

Our success depends, to a certain extent, upon global, domestic and local economic and political conditions, as well as governmental monetary policies. Conditions such as changes in interest rates, money supply, levels of employment and other factors beyond our control may have a negative impact on economic activity. Any contraction of economic activity, including an economic recession, may adversely affect our asset quality, deposit levels and loan demand and, therefore, our earnings. In particular, interest rates are highly sensitive to many factors that are beyond our control, including global, domestic and local economic conditions and the policies of various governmental and regulatory agencies and, specifically, the Federal Reserve. Throughout 2022 and 2023, the FOMC raised the target range for the federal funds rate on eleven separate occasions, citing factors including the hardships caused by the ongoing Russia-Ukraine conflict, continued global supply chain disruptions and imbalances, and increased inflationary pressure. In the third and fourth quarters of 2024, however, the FOMC pivoted and lowered the federal funds rate from 5.50% to 4.50% based principally on reduced levels of inflation and labor market factors. At its January 29, 2025 meeting, the FOMC decided to maintain the target range for the federal funds rate at 4.25% to 4.50%.

Current wording

Our success depends, to a certain extent, upon global, domestic and local economic and political conditions, as well as governmental monetary policies. Conditions such as changes in interest rates, money supply, levels of employment and other factors beyond our control may have a negative impact on economic activity. Any contraction of economic activity, including an economic recession, may adversely affect our asset quality, deposit levels and loan demand and, therefore, our earnings. In particular, interest rates are highly sensitive to many factors that are beyond our control, including global, domestic and local economic conditions and the policies of various governmental and regulatory agencies and, specifically, the Federal Reserve. Throughout 2022 and 2023, the FOMC raised the target range for the federal funds rate on eleven separate occasions, citing factors including the hardships caused by the ongoing Russia-Ukraine conflict, continued global supply chain disruptions and imbalances, and increased inflationary pressure. In the third and fourth quarters of 2024, however, the FOMC pivoted and lowered the federal funds rate from 5.50% to 4.50% based principally on reduced levels of inflation and labor market factors. The FOMC continued to lower the federal funds rate several times in 2025, with the federal funds rate reaching a target range of 3.50% to 3.75% at the FOMC’s December 10, 2025 meeting. The FOMC maintained these rates at its January 28, 2026 meeting.

Previous wording

As of December 31, 2024, various economic indicators suggested that real GDP had expanded solidly throughout 2024. The unemployment rate had increased, on net, but remained low relative to historic norms. Consumer price inflation, as measured by the 12-month change in the price index for personal consumption expenditures, had moved lower compared to its peak level in 2023, approaching the Federal Reserve’s 2 percent inflation objective. Against the backdrop of restrictive monetary policy, the U.S. economy had stronger-than-expected GDP growth, loosing of tight labor markets and falling inflation in 2024. While this positive growth may continue in 2025, some economists are projecting that, due to emerging policy risks such as stricter immigration policies and trade tariffs, the U.S. economy may be flat or experience a modest decrease in gross domestic output in 2025. For instance, the U.S. Bureau of Economic Analysis projects that real GDP will decrease modestly in 2025. Any such downturn in economic output, especially domestically and in the regions in which we operate, may adversely affect our asset quality, deposit levels, loan demand and results of operations.

Current wording

As of December 31, 2025, various economic indicators suggested that real GDP had expanded solidly throughout 2025. The unemployment rate had increased, on net, but remained low relative to historic norms. Consumer price inflation, as measured by the 12-month change in the price index for personal consumption expenditures, decreased compared to its peak level in

Previous wording

As a result of the economic and geopolitical factors discussed above, financial institutions also face heightened credit risk, among other forms of risk. Of note, because we have a significant amount of real estate loans, decreases in real estate values could adversely affect the value of property used as collateral, which, in turn, can adversely affect the value of our loan and investment portfolios. Adverse economic developments, specifically including inflation-related impacts, may have a negative effect on the ability of our borrowers to make timely repayments of their loans or to finance future home purchases. According to the Federal Reserve's November 2024 Financial Stability Report, several economic indicators suggest that CRE prices still remain high relative to fundamentals while market delinquency rates are elevated. However, the outlook for CRE remains dependent on the broader economic environment and, specifically, how major subsectors respond to a high interest rate environment and continued higher prices for commodities, goods and services. In any case, credit performance over the medium- and long-term is susceptible to economic and market forces and therefore forecasts remain uncertain; however, some degree of instability in the CRE markets is expected in the coming quarters as loans continue to be refinanced in markets with higher vacancy rates under current economic conditions. Instability and uncertainty in the commercial and residential real estate markets, as well as in the broader commercial and retail credit markets, could have a material adverse effect on our financial condition and results of operations.

Current wording

As a result of the economic and geopolitical factors discussed above, financial institutions face heightened credit risk, among other forms of risk. Of note, because we have a significant amount of real estate loans, decreases in real estate values could adversely affect the value of property used as collateral, which, in turn, can adversely affect the value of our loan and investment portfolios. Adverse economic developments, specifically including inflation-related impacts, may have a negative effect on the ability of our borrowers to make timely repayments of their loans or to finance future home purchases. The outlook for CRE is dependent on the economic environment and how major subsectors respond to the interest rate environment and continued higher prices for commodities, goods and services. Credit performance over the medium- and long-term is susceptible to economic and market forces and therefore forecasts remain uncertain; however, some degree of instability in the CRE markets is expected in the coming quarters as loans continue to be refinanced in markets with higher vacancy rates.

Previous wording

The Trump Administration, during its first term from 2017 to 2021, imposed certain tariffs and retaliatory tariffs, as well as other trade restrictions on products and materials that our customers import or export. President Trump again has signaled that his new Administration will impose tariffs and retaliatory tariffs against U.S. trading partners. During his election campaign, President Trump indicated that he would impose a 25% tariff against all goods imported from Canada and Mexico, a 60% tariff on goods from China and a blanket tariff of 10% to 20% on other imports to the U.S. On February 1, 2025, President Trump issued an Executive Order imposing tariffs at various levels on imports from Canada, Mexico, and China. The newly imposed tariffs have resulted in immediate threats of retaliatory tariffs against U.S. goods and resulted in discussions with the countries which have delayed many of the U.S. imposed tariffs while discussions with each trading partner continue.

Current wording

The Trump Administration, during its second term beginning 2025, imposed tariffs against goods imported from U.S. trading partners, including Canada, Mexico and China. The tariffs have resulted in threats of retaliatory tariffs against U.S. goods, discussions with the countries which have delayed many of the U.S. imposed tariffs while discussions with each trading partner continue and litigation in the U.S. courts.

Previous wording

The above and other potential tariffs and trade restrictions may cause the prices of our customers' products to increase, which could reduce demand for such products, or reduce our customers' margins, and adversely impact their revenues, financial results, and ability to service debt. This in turn could adversely affect our financial condition and results of operations. In addition, to the extent changes in the political environment have a negative impact on us or on the markets in which we operate our business, our results of operations and financial condition could be materially and adversely impacted in the future. At this time, it remains unclear what the U.S. government or foreign governments will or will not do with respect to additional tariffs that may be imposed or international trade agreements and policies.

Current wording

Tariffs and trade restrictions may cause the prices of our customers' products to increase, which could reduce demand for such products, or reduce our customers' margins, and adversely impact their revenues, financial results, and ability to service debt. This in turn could adversely affect our financial condition and results of operations. To the extent changes in the political environment have a negative impact on us or on the markets in which we operate our business, our results of operations and financial condition could be materially and adversely impacted in the future. At this time, it remains unclear what the U.S. government or foreign governments will or will not do in response to additional tariffs that may be imposed or international trade agreements and policies.

Previous wording

All borrowers have the potential to default, and our remedies in the event of such default (such as seizure and/or sale of collateral, legal actions, and guarantees) may not fully satisfy the debt owed to us. We maintain an ACLL, which is a reserve established through a provision for credit losses charged to expense, that represents management’s best estimate of probable credit losses over the life of the loan within the existing portfolio of loans. The ACLL, in the judgment of management, is necessary to reserve for estimated credit losses and risks inherent in the loan portfolio. The level of the ACLL reflects management’s continuing evaluation of industry concentrations; specific credit risks; loan loss experience; current loan portfolio quality; present economic, political, and regulatory conditions; and unidentified losses inherent in the current loan portfolio. The determination of the appropriate level of the ACLL inherently involves a high degree of subjectivity and requires us to make significant estimates of current credit risks using existing qualitative and quantitative information, all of which may undergo material changes. Changes in economic conditions affecting borrowers, new information regarding existing loans, identification of additional problem loans, and other factors, both within and outside of our control, may require an increase in the ACLL. In addition, bank regulatory agencies periodically review our ACLL and may require an increase in the provision for credit losses or the recognition of additional loan charge offs, based on judgments different than those of management. An increase in the ACLL would result in a decrease in net income, and possibly risk-based capital, and could have a material adverse effect on our financial condition and results of operations.

Current wording

All borrowers have the potential to default, and our remedies in the event of such default (such as seizure and/or sale of collateral, legal actions, and guarantees) may not fully satisfy the debt owed to us. We maintain an ACLL, which is a reserve established through a provision for credit losses charged to expense, that represents management’s best estimate of probable credit losses over the life of the loan within the existing portfolio of loans. The ACLL, in the judgment of management, is necessary to reserve for estimated credit losses and risks inherent in the loan portfolio. The level of the ACLL reflects management’s continuing evaluation of industry concentrations; specific credit risks; loan loss experience; current loan portfolio quality; present economic, political, and regulatory conditions; and unidentified losses inherent in the current loan portfolio. The determination of the appropriate level of the ACLL inherently involves a high degree of subjectivity and requires us to make significant estimates of current credit risks using existing qualitative and quantitative information, all of which may undergo material changes. Changes in economic conditions affecting borrowers, new information regarding existing loans, identification of additional problem loans, and other factors, both within and outside of our control, may require an increase in the ACLL. Bank regulatory agencies periodically review our ACLL and may require an increase in the provision for credit losses or the recognition of additional loan charge offs, based on judgments different than those of management. An increase in the ACLL would result in a decrease in net income, and possibly risk-based capital, and could have a material adverse effect on our financial condition and results of operations.

Previous wording

As of December 31, 2024, approximately 64% of our loan portfolio consisted of commercial and industrial, real estate construction, and CRE loans (collectively, "commercial loans"). Commercial loans are generally viewed as having more inherent risk of default than residential mortgage loans or other consumer loans. Further, the commercial loan balance per borrower is typically larger than that for residential mortgage loans and other consumer loans, implying higher potential losses on an individual loan basis. Because our loan portfolio contains a number of commercial loans with significant balances, the deterioration of one or a few of these loans could cause a significant increase in nonaccrual loans, which could have a material adverse effect on our financial condition and results of operations.

Current wording

As of December 31, 2025, 65% of our loan portfolio consisted of commercial and industrial, real estate construction, and CRE loans (collectively, "commercial loans"). Commercial loans are generally viewed as having more inherent risk of default than residential mortgage loans or other consumer loans. Further, the commercial loan balance per borrower is typically larger than that for residential mortgage loans and other consumer loans, implying higher potential losses on an individual loan basis. Because our loan portfolio contains a number of commercial loans with significant balances, the deterioration of one or a few of these loans could cause a significant increase in nonaccrual loans, which could have a material adverse effect on our financial condition and results of operations.

Previous wording

Our policy generally has been to originate CRE loans primarily in the states in which the Bank operates. At December 31, 2024, CRE loans, including owner occupied, investor, and real estate construction loans, totaled $8.4 billion, or 28%, of our total loan portfolio and 195% of total risk-based capital. As a result of our growth in this portfolio over the past several years and planned future growth, these loans require more ongoing evaluation and monitoring and we are continuously enhancing risk management policies, procedures and controls as needed. CRE loans generally involve a greater degree of credit risk than residential mortgage loans because they typically have larger balances and are more affected by adverse conditions in the economy. Because payments on loans secured by CRE often depend upon the successful operation and management of the properties and the businesses that operate from within them, repayment of such loans may be affected by factors outside the borrower’s control, such as adverse conditions in the real estate market or the economy or changes in government regulation. CRE markets have been facing downward pressure since 2022 due in large part to increased interest rates and declining property values. Although CRE markets showed signs of stabilization in 2024, the prospects for the CRE markets and property valuation remain uncertain. Accordingly, the federal banking agencies have continued to express concerns about weaknesses in the current CRE market and have applied increased regulatory scrutiny to institutions with CRE loan portfolios that are fast growing or large relative to the institutions' total capital. Our failure to adequately maintain appropriate risk management policies, procedures and controls in response to regulatory expectations could adversely affect our ability to increase this portfolio going forward and could result in an increased rate of delinquencies in, and increased losses from, this portfolio as well as enhanced regulatory scrutiny and regulatory expectations for increased capital. At December 31, 2024, nonaccrual CRE loans totaled $18 million, or less than 1% of our total portfolio of CRE loans.

Current wording

Our policy generally has been to originate CRE loans primarily in the states in which the Bank operates. At December 31, 2025, CRE loans, including owner occupied, investor, and real estate construction loans, totaled $8.4 billion, or 27%, of our total loan portfolio and 183% of total risk-based capital. CRE loans generally involve a greater degree of credit risk than residential mortgage loans because they typically have larger balances and are more affected by adverse conditions in the economy. Because payments on loans secured by CRE depend upon the successful operation and management of the properties and the businesses that operate from within them, repayment of such loans can be affected by factors outside the borrower’s control, such as adverse conditions in the real estate market or the economy or changes in government regulation.

Previous wording

In deciding whether to extend credit or enter into other transactions, we may rely on information furnished by or on behalf of customers and counterparties, including financial statements, credit reports, and other financial information. We may also rely on representations of those customers, counterparties, or other third parties, such as independent auditors, as to the accuracy and completeness of that information. Reliance on inaccurate or misleading financial statements, credit reports, or other financial information could cause us to enter into unfavorable transactions, which could have a material adverse effect on our financial condition and results of operations.

Current wording

In deciding whether to extend credit or enter into other transactions, we rely on information furnished by or on behalf of customers and counterparties, including financial statements, credit reports, and other financial information. We may rely on representations of those customers, counterparties, or other third parties, such as independent auditors, as to the accuracy and completeness of that information. Reliance on inaccurate or misleading financial statements, credit reports, or other financial information could cause us to enter into unfavorable transactions, which could have a material adverse effect on our financial condition and results of operations.

Previous wording

We settle funds on behalf of financial institutions, other businesses and consumers and receive funds from clients, card issuers, payment networks and consumers on a daily basis for a variety of transaction types. Transactions we facilitate include wire transfers, debit card, credit card and electronic bill payment transactions, supporting consumers, financial institutions and other businesses. These payment activities rely upon the technology infrastructure that facilitates the verification of activity with counterparties and the facilitation of the payment. If the continuity of operations or integrity of processing were compromised, this could result in a financial loss to us due to a failure in payment facilitation. In addition, we may issue credit to consumers, financial institutions or other businesses as part of the funds settlement. A default on this credit by a counterparty could result in a financial loss to us.

Current wording

We settle funds on behalf of financial institutions, other businesses and consumers and receive funds from clients, card issuers, payment networks and consumers on a daily basis for a variety of transaction types. Transactions we facilitate include wire transfers, debit card, credit card and electronic bill payment transactions, supporting consumers, financial institutions and other businesses. These payment activities rely upon the technology infrastructure that facilitates the verification of activity with counterparties and the facilitation of the payment. If the continuity of operations or integrity of processing were compromised, it could result in a financial loss to us. We may issue credit to consumers, financial institutions or other businesses as part of the funds settlement. A default on this credit by a counterparty could result in a financial loss to us.

Previous wording

A significant portion of our loan portfolio is secured by real property. During the ordinary course of business, we may foreclose on and take title to properties securing certain loans. In doing so, there is a risk that hazardous or toxic substances could be found on these properties. If hazardous or toxic substances are found, we may be liable for remediation costs, as well as for personal injury and property damage. Environmental laws may require us to incur substantial expenses which may materially reduce the affected property’s value or limit our ability to use or sell the affected property. In addition, future laws or more stringent interpretations or enforcement policies with respect to existing laws may increase our exposure to environmental liability. Although we have policies and procedures to perform an environmental review before lending against or initiating any foreclosure action on real property, these reviews may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on our financial condition and results of operations.

Current wording

A significant portion of our loan portfolio is secured by real property. During the ordinary course of business, we may foreclose on and take title to properties securing certain loans. In doing so, there is a risk that hazardous or toxic substances could be found on these properties. If hazardous or toxic substances are found, we may be liable for remediation costs, as well as for personal injury and property damage. Environmental laws may require us to incur substantial expenses which may materially reduce the affected property’s value or limit our ability to use or sell the affected property. Future laws or more stringent interpretations or enforcement policies with respect to existing laws may increase our exposure to environmental liability. Although we have policies and procedures to perform an environmental review before lending against or initiating any foreclosure action on real property, these reviews may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on our financial condition and results of operations.

Previous wording

In the aftermath of the significant bank failures that occurred in 2023, the federal banking agencies have enhanced their scrutiny of banks' liquidity risk management. The agencies concluded that a significant contributing factor to the failures of the institutions in 2023 was the proportion of the deposits held by each institution that exceeded FDIC insurance limits. Noting that uninsured deposits accounted for nearly 47 percent of domestic deposits in 2021, the FDIC stated that large concentrations of uninsured deposits increase the potential for bank runs and can threaten financial stability. In the months preceding and following these failures, many large depositors withdrew deposits in excess of applicable deposit insurance limits and deposited these funds in other financial institutions and, in many instances, moved these funds into money market mutual funds or other similar securities accounts in an effort to diversify the risk of further bank failure(s).

Current wording

In the aftermath of the significant bank failures that occurred in 2023, the federal banking agencies have enhanced their scrutiny of banks' liquidity risk management.

Previous wording

If a significant portion of our deposits were to be withdrawn within a short period of time such that additional sources of funding would be required to meet withdrawal demands, the Corporation may be unable to obtain funding at favorable terms, which may have an adverse effect on our net interest margin. Moreover, obtaining adequate funding to meet our deposit obligations may be more challenging during periods of elevated prevailing interest rates, such as the present period. Our ability to attract depositors during a time of actual or perceived distress or instability in the marketplace may be limited. Further, interest rates paid for borrowings generally exceed the interest rates paid on deposits. This spread may be exacerbated by higher prevailing interest rates. In addition, because our AFS investment securities lose value when interest rates rise, after-tax proceeds resulting from the sale of such assets may be diminished during periods when interest rates are elevated. Under such circumstances, we may be required to access funding from sources such as the Federal Reserve’s discount window in order to manage our liquidity risk. For additional information regarding uninsured deposits and liquidity, see sections Deposits and Customer Funding and Liquidity of Part II, Item 7, Management's Discussion and Analysis of Financial Condition and Results of Operations.

Current wording

The ease and speed of the electronic withdrawals may accelerate this process. If a significant portion of our deposits were to be withdrawn within a short period such that additional sources of funding would be required to meet withdrawal demands, the Corporation may be unable to obtain funding at favorable terms, which may have an adverse effect on our net interest margin. Our ability to attract depositors during a time of actual or perceived distress or instability in the marketplace may be limited. Further, interest rates paid for borrowings generally exceed the interest rates paid on deposits. Because our AFS investment securities lose value when interest rates rise, after-tax proceeds resulting from the sale of such assets may be diminished during periods when interest rates are elevated. Under such circumstances, we may be required to access funding from sources such as the Federal Reserve’s discount window and the FHLB system in order to manage our liquidity risk. For additional information regarding uninsured deposits and liquidity, see sections Deposits and Customer Funding and Liquidity of Part II, Item 7, Management's Discussion and Analysis of Financial Condition and Results of Operations.

Previous wording

Credit ratings are subject to ongoing review by rating agencies, which consider a number of factors, including our financial strength, performance, prospects and operations as well as factors not under our control. Other factors that influence our credit ratings include changes to the rating agencies’ methodologies for our industry or certain security types; the rating agencies’ assessment of the general operating environment for financial services companies; our relative positions in the markets in which we compete; our various risk exposures and risk management policies and activities; pending litigation and other contingencies; our reputation; our liquidity position, diversity of funding sources and funding costs; the current and expected level and volatility of our earnings; our capital position and capital management practices; our corporate governance; current or future regulatory and legislative initiatives; and the agencies’ views on whether the U.S. government would provide meaningful support to the Corporation or its subsidiaries in a crisis. Rating agencies could make adjustments to our credit ratings at any time, and there can be no assurance that they will maintain our ratings at current levels or that downgrades will not occur.

Current wording

Credit ratings are subject to review by rating agencies, which consider a number of factors, including our financial strength, performance, prospects and operations as well as factors not under our control. Other factors that influence our credit ratings include changes to the rating agencies’ methodologies for our industry or certain security types; the rating agencies’ assessment of the general operating environment for financial services companies; our relative positions in the markets in which we compete; our various risk exposures and risk management policies and activities; pending litigation and other contingencies; our reputation; our liquidity position, diversity of funding sources and funding costs; the current and expected level and volatility of our earnings; our capital position and capital management practices; our corporate governance; current or future regulatory and legislative initiatives; and the agencies’ views on whether the U.S. government would provide meaningful support to the Corporation or its subsidiaries in a crisis. Rating agencies could make adjustments to our credit ratings at any time, and there can be no assurance that they will maintain our ratings at current levels or that downgrades will not occur.

Previous wording

In August 2023, Moody’s and S&P Global Ratings each downgraded our long-term issuer credit ratings, and the ratings remained unchanged as of December 31, 2024. Any additional downgrade in our credit ratings could potentially adversely affect the cost and other terms upon which we are able to borrow or obtain funding, increase our cost of capital and/or limit our access to capital markets. Credit rating downgrades or negative watch warnings could also negatively impact our reputation and the perception of the Corporation by lenders, investors and other third parties, which could also impair our ability to compete in certain markets or engage in certain transactions. In particular, holders of deposits which exceed FDIC insurance limits may perceive such a downgrade or warning negatively and withdraw all or a portion of such deposits. While certain aspects of a credit rating downgrade are quantifiable, the impact that such a downgrade would have on our liquidity, business and results of operations in future periods is inherently uncertain and would depend on a number of interrelated factors, including, among other things, the magnitude of the downgrade, the rating relative to peers, the rating assigned by the relevant agency pre-downgrade, individual client behavior and future mitigating actions we might take.

Current wording

In August 2023, Moody’s and S&P Global Ratings each downgraded our long-term issuer credit ratings, and the ratings remained unchanged as of December 31, 2025. Any additional downgrade in our credit ratings could potentially adversely affect the cost and other terms upon which we are able to borrow or obtain funding, increase our cost of capital and/or limit our access to capital markets. Credit rating downgrades or negative watch warnings could negatively impact our reputation and the perception of the Corporation by lenders, investors and other third parties, which could impair our ability to compete in certain markets or engage in certain transactions. In particular, holders of deposits which exceed FDIC insurance limits may perceive such a downgrade or warning negatively and withdraw all or a portion of such deposits. While certain aspects of a credit rating downgrade are quantifiable, the impact that such a downgrade would have on our liquidity, business and results of operations in future periods is inherently uncertain and would depend on a number of interrelated factors, including, among other things, the magnitude of the downgrade, the rating relative to peers, the rating assigned by the relevant agency pre-downgrade, individual client behavior and future mitigating actions we might take.

Previous wording

Our earnings and cash flows are largely dependent upon our net interest income. Interest rates are highly sensitive to many factors that are beyond our control, including general economic conditions and policies of various governmental and regulatory agencies and, in particular, the Federal Reserve. Changes in monetary policy, including changes in interest rates, could influence not only the interest we receive on loans and investments and the amount of interest we pay on deposits and borrowings, but such changes could also affect (i) our ability to originate loans and obtain deposits; (ii) the fair value of our financial assets and liabilities; and (iii) the average duration of our mortgage portfolio and other interest-earning assets.

Current wording

Our earnings and cash flows are largely dependent upon our net interest income. Interest rates are highly sensitive to many factors that are beyond our control, including general economic conditions and policies of various governmental and regulatory agencies and, in particular, the Federal Reserve. Changes in monetary policy, including changes in interest rates, could influence not only the interest we receive on loans and investments and the amount of interest we pay on deposits and borrowings, but such changes could affect (i) our ability to originate loans and obtain deposits; (ii) the fair value of our financial assets and liabilities; and (iii) the average duration of our mortgage portfolio and other interest-earning assets.

Previous wording

As of January 29, 2025, the date of the FOMC's most recent meeting, the target range for the federal funds rate was 4.25% to 4.50%, which is down from the recent peak of 5.25% to 5.50% prior to the FOMC meeting in September 2024. It remains uncertain whether the FOMC will further reduce the target range for the federal funds rate to stimulate economic activity and promote job growth or leave the rate at its relatively elevated level for an additional prolonged period of time. Earnings could also be adversely affected if the interest rates received on loans and other investments fall more quickly than the interest rates paid on deposits and other borrowings. The Corporation's interest rate risk profile is such that, generally, a higher yield curve adds to income while a lower yield curve has a negative impact on earnings. Our most significant interest rate risk may result from timing differences in the maturity and re-pricing characteristics of assets and liabilities, changes in the shape of the yield curve, and the potential exercise of explicit or embedded options.

Current wording

As of January 28, 2026, the date of the FOMC's most recent meeting, the target range for the federal funds rate was 3.50% to 3.75%, which is down from the peak of 5.25% to 5.50% prior to the FOMC meeting in September 2024. Despite direct pressure from the President and the anticipated change in the Chair of the Federal Reserve, it remains uncertain whether the FOMC will further reduce the target range for the federal funds rate to stimulate economic activity and promote job growth or leave the rate at its current level for an additional period of time. Earnings could be adversely affected if the interest rates received on loans and other investments fall more quickly than the interest rates paid on deposits and other borrowings. The Corporation's interest rate risk profile is such that, generally, a higher yield curve adds to income while a lower yield curve has a negative impact on earnings. Our most significant interest rate risk may result from timing differences in the maturity and re-pricing characteristics of assets and liabilities, changes in the shape of the yield curve, and the potential exercise of explicit or embedded options.

Previous wording

Although management believes it has implemented effective asset and liability management strategies, including the potential use of derivatives as hedging instruments, to reduce the potential effects of changes in interest rates on our results of operations, any substantial, unexpected, prolonged change in market interest rates could have a material adverse effect on our financial condition and results of operations, and any related economic downturn, especially domestically and in the regions in which we operate, may adversely affect our asset quality, deposit levels, loan demand and results of operations. Also, our interest rate risk modeling techniques and assumptions may not fully predict or capture the impact of actual interest rate changes on our balance sheet.

Current wording

Although management believes it has implemented effective asset and liability management strategies, including the use of derivatives as hedging instruments, to reduce the effects of changes in interest rates on our results of operations, any substantial, unexpected, prolonged change in market interest rates could have a material adverse effect on our financial condition and results of operations, and any related economic impact, especially domestically and in the regions in which we operate, may adversely affect our asset quality, deposit levels, loan demand and results of operations. Our interest rate risk modeling techniques and assumptions may not fully predict or capture the impact of actual interest rate changes on our balance sheet.

Previous wording

Changes in interest rates can impact our mortgage-related revenues and net revenues associated with our mortgage activities. A decline in mortgage rates generally increases the demand for mortgage loans as borrowers refinance, but also generally leads to accelerated payoffs. Conversely, in a constant or increasing rate environment, we would expect fewer loans to be refinanced and a decline in payoffs. Although we use models to assess the impact of interest rates on mortgage-related revenues, the estimates of revenues produced by these models are dependent on estimates and assumptions of future loan demand, prepayment speeds and other factors which may differ from actual subsequent experience.

Current wording

Changes in interest rates can impact our mortgage-related revenues. A decline in mortgage rates generally increases the demand for mortgage loans as borrowers refinance, but generally leads to accelerated payoffs. Conversely, in a constant or increasing rate environment, we would expect fewer loans to be refinanced and a decline in payoffs. Although we use models to assess the impact of interest rates on mortgage-related revenues, the estimates of revenues produced by these models are dependent on estimates and assumptions of future loan demand, prepayment speeds and other factors which may differ from actual subsequent experience.

Previous wording

The Corporation maintains an investment portfolio consisting of various high quality liquid fixed-income securities. The total carrying value of the securities portfolio, which includes FHLB and Federal Reserve Bank stocks, was $8.5 billion as of December 31, 2024, and the estimated duration of the aggregate portfolio was approximately 5.3 years. The nature of fixed-income securities is such that changes in market interest rates impact the value of these assets.

Current wording

The Corporation maintains an investment portfolio consisting of high-quality liquid fixed-income securities. The total carrying value of the AFS securities portfolio was $5.4 billion as of December 31, 2025, and the estimated duration of the aggregate portfolio was approximately 3.2 years. The nature of fixed-income securities is such that changes in market interest rates impact the value of these assets.

Previous wording

Changes in interest rates could also reduce the value of our residential mortgage-related securities and MSRs, which could negatively affect our earnings.

Current wording

Changes in interest rates could reduce the value of our residential mortgage-related securities and MSRs, which could negatively affect our earnings.

Previous wording

The Corporation earns revenue from the fees it receives for originating mortgage loans and for servicing mortgage loans. When rates rise, the demand for mortgage loans tends to fall, reducing the revenue the Corporation receives from loan originations. At the same time, revenue from MSRs can increase through increases in fair value. When rates fall, mortgage originations tend to increase and the value of MSRs tends to decline, also with some offsetting revenue effect. Even though the origination of mortgage loans can act as a “natural hedge,” the hedge is not perfect, either in amount or timing. For example, the negative effect on revenue from a decrease in the fair value of residential MSRs is immediate, but any offsetting revenue benefit from more originations and the MSRs relating to the new loans would be recognized during the month of origination. It is also possible that even if interest rates were to fall, mortgage originations may also fall or any increase in mortgage originations may not be enough to offset the decrease in the MSRs value caused by the lower rates.

Current wording

The Corporation earns revenue from the fees it receives for originating mortgage loans and for servicing mortgage loans. When rates rise, the demand for mortgage loans tends to fall, reducing the revenue the Corporation receives from loan originations. At the same time, revenue from MSRs can increase through increases in fair value. When rates fall, mortgage originations tend to increase and the value of MSRs tends to decline, with some offsetting revenue effect. Even though the origination of mortgage loans can act as a natural hedge, the hedge is not perfect, either in amount or timing. For example, the negative effect on revenue from a decrease in the fair value of MSRs is immediate, but any offsetting revenue benefit from more originations and the MSRs relating to the new loans would be recognized during the month of origination. It is possible that even if interest rates were to fall, mortgage originations may fall or any increase in mortgage originations may not be enough to offset the decrease in the MSRs value caused by the lower rates.

Previous wording

The Corporation typically uses derivatives and other instruments to hedge its mortgage banking interest rate risk. The Corporation generally does not hedge all of its risks and the fact that hedges are used does not mean they will be successful. Hedging is a complex process, requiring sophisticated models and constant monitoring. The Corporation could incur significant losses from its hedging activities. There may be periods where the Corporation elects not to use derivatives and other instruments to hedge mortgage banking interest rate risk, which could also cause the Corporation to incur substantial losses.

Current wording

The Corporation typically uses derivatives and other instruments to hedge its mortgage banking interest rate risk. The Corporation generally does not hedge all of its risks and the fact that hedges are used does not mean they will be successful. Hedging is a complex process, requiring sophisticated models and constant monitoring. The Corporation could incur significant losses from its hedging activities. There may be periods where the Corporation elects not to use derivatives and other instruments to hedge mortgage banking interest rate risk, which could cause the Corporation to incur substantial losses.

Previous wording

The Parent Company is a separate and distinct legal entity from its banking and other subsidiaries. A substantial portion of the Parent Company’s cash flow comes from dividends from its subsidiaries. These dividends are the principal source of funds to pay dividends on the Parent Company’s common and preferred stock, and to pay interest and principal on the Parent Company’s debt. Various federal and/or applicable state laws and regulations limit the amount of dividends that the Bank and certain of our nonbanking subsidiaries may pay to us. Also, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors. In the event the Bank subsidiary is unable to pay dividends to us, we may not be able to service debt, pay obligations, or pay dividends on our common and preferred stock. The inability to receive dividends from the Bank could have a material adverse effect on our business, financial condition, and results of operations.

Current wording

The Parent Company is a separate and distinct legal entity from its banking and other subsidiaries. A substantial portion of the Parent Company’s cash flow comes from dividends from its subsidiaries. These dividends are the principal source of funds to pay dividends on the Parent Company’s common and preferred stock, and to pay interest and principal on the Parent Company’s debt. Various federal and/or applicable state laws and regulations limit the amount of dividends that the Bank and certain of our nonbanking subsidiaries may pay to us. Our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors. In the event the Bank subsidiary is unable to pay dividends to us, we may not be able to service debt, pay obligations, or pay dividends on our common and preferred stock. The inability to receive dividends from the Bank would have a material adverse effect on our business, financial condition, and results of operations.

Previous wording

We operate in many different businesses in diverse markets and rely on the ability of our employees and systems to process transactions. Operational risk is the risk of loss resulting from our operations, including but not limited to, the risk of fraud by employees or persons outside the Corporation, the execution of unauthorized transactions, errors relating to transaction processing and technology, breaches of our internal control systems or failures of those of our suppliers or counterparties, compliance failures, cyber-attacks, technology failures, or unforeseen problems encountered while implementing new computer systems or upgrades to existing systems, business continuation and disaster recovery issues, and other external events. In recent periods, the OCC has observed an increased incidence of check fraud, wire fraud, peer-to-peer payment fraud, and the use of AI technology to facilitate the perpetration of social engineering and impersonation schemes and identity theft. Insurance coverage may not be available for such losses, or where available, such losses may exceed insurance limits. This risk of loss also includes the potential legal actions that could arise as a result of an operational deficiency or as a result of noncompliance with applicable regulatory standards, adverse business decisions or their implementation, and customer attrition due to potential negative publicity. The occurrence of any of these events could cause us to suffer financial loss, face regulatory action and suffer damage to our reputation.

Current wording

We operate in many different businesses in diverse markets and rely on the ability of our employees and systems to process transactions. Operational risk is the risk of loss resulting from our operations, including but not limited to, the risk of fraud by employees or persons outside the Corporation, the execution of unauthorized transactions, errors relating to transaction processing and technology, breaches of our internal control systems or failures of those of our suppliers or counterparties, compliance failures, cyber-attacks or other security breaches, technology failures, or unforeseen problems encountered while implementing new computer systems or upgrades to existing systems, business continuation and disaster recovery issues, and other external events. In recent periods, the OCC has observed an increased incidence of check fraud, wire fraud, peer-to-peer payment fraud, and the use of AI technology to facilitate the perpetration of social engineering and impersonation schemes and identity theft. Insurance coverage may not be available for such losses, or where available, such losses may exceed insurance limits. This risk of loss includes the potential legal actions that could arise as a result of an operational deficiency or as a result of noncompliance with applicable regulatory standards, adverse business decisions or their implementation, and customer attrition due to potential negative publicity. The occurrence of any of these events could cause us to suffer financial loss, face regulatory action and suffer damage to our reputation.

Previous wording

Unauthorized disclosure of sensitive or confidential client or customer information, whether through a cyber-attack, other breach of our computer systems or otherwise, could severely harm our business.

Current wording

Unauthorized disclosure of sensitive or confidential client or customer information (including personal information), whether through a cyber-attack, other breach of our computer systems or otherwise, could severely harm our business.

Previous wording

In the normal course of our business, we collect, process, and retain sensitive and confidential client and customer information on our behalf and on behalf of other third parties. Despite the security measures we have in place, our facilities and systems may be vulnerable to cyber-attacks, security breaches, acts of vandalism, computer viruses, malware, misplaced or lost data, programming and/or human errors, or other similar events.

Current wording

In the normal course of our business, we collect, share, use, store and otherwise process sensitive and confidential client and customer information, including personal information, on our behalf and on behalf of other third parties. Despite the security measures we have in place, our facilities, systems and networks may be vulnerable to cyber-attacks, security breaches, acts of vandalism, theft, computer viruses, malware, ransomware, denial of service attacks, phishing or other social engineering attacks, credential stuffing, account takeovers, misplaced or lost data, programming and/or human errors, software or hardware failures, or other similar events.

Previous wording

We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business. Operational risk related to cyber-attacks is increasing as cyber-attacks evolve and have a greater and more pervasive economic impact. In addition to cyber-attacks or other security breaches involving the theft of sensitive and confidential information, hackers have engaged in attacks against large financial institutions, designed to disrupt key business services, such as customer-facing web sites. Critical infrastructure sectors, including financial services, increasingly have been the targets of cyber-attacks, including attacks emanating from foreign countries. Cyber-attacks involving large financial institutions, including distributed denial of service attacks designed to disrupt external customer-facing services, nation state cyber-attacks and ransomware attacks designed to deny organizations access to key internal resources or systems or other critical data, as well as targeted social engineering and phishing email and text message attacks designed to allow unauthorized persons to obtain access to an institution’s information systems and data or that of its customers, are becoming more common and increasingly sophisticated.

Current wording

We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business. Operational risk related to cyber-attacks is increasing as cyber-attacks evolve and have a greater and more pervasive economic impact. In addition to cyber-attacks or other security breaches involving the theft, loss, destruction, gathering, monitoring, dissemination, misappropriation, misuse, alteration, or unauthorized disclosure of or unauthorized access to sensitive and confidential information (including personal information), hackers have engaged in attacks against large financial institutions, designed to disrupt key business services, such as customer-facing web sites. Critical infrastructure sectors, including financial services, increasingly have been the targets of cyber-attacks, including attacks emanating from foreign countries. Cyber-attacks involving large financial institutions, including distributed denial of service attacks designed to disrupt external customer-facing services, cyber-attacks carried out by terrorists, nation states, nation-state supported actors, organized criminal groups or “hacktivists”, and ransomware attacks designed to deny organizations access to key internal resources or systems or other critical data, as well as targeted social engineering and phishing email and text message attacks designed to allow unauthorized persons to obtain access to an institution’s information systems and data or that of its customers, are becoming more common and increasingly sophisticated.

Previous wording

Cyber-attacks continue to evolve and become more pervasive throughout the financial services sector. In particular, there has been an observed increase in the number of distributed denial of service and ransomware attacks against the financial sector, for which the increase is believed to be partially attributable to politically motivated attacks as well as financial demands coupled with extortion. Further, threat actors continue to exploit publicly known software vulnerabilities and weak authentication controls used by large numbers of banking organizations in order to conduct malicious cyber activities. These types of attacks have resulted in increased supply chain and third-party risk.

Current wording

Cyber-attacks continue to evolve and become more pervasive throughout the financial services sector. In particular, there has been an observed increase in the number of distributed denial of service and ransomware attacks against the financial sector, for which the increase is believed to be partially attributable to politically motivated attacks as well as financial demands coupled with extortion. Further, threat actors continue to exploit publicly known software vulnerabilities and weak authentication controls used by large numbers of banking organizations in order to conduct malicious cyber activities. These types of attacks have resulted in increased supply chain and third-party risk. Such cybersecurity threats may see their frequency increased, and effectiveness enhanced, by the use of AI.

Previous wording

We also face risks related to cyber-attacks and other security breaches in connection with card transactions that typically involve the transmission of sensitive information regarding our customers through various third parties. Some of these parties have in the past been the target of security breaches and cyber-attacks, and because the transactions involve third parties and environments that we do not control or secure, future security breaches or cyber-attacks affecting any of these third parties could impact us, and in some cases we may have exposure and suffer losses for breaches or attacks relating to them. We also rely on numerous other third-party service providers to conduct other aspects of our business operations and face similar risks relating to them. We cannot be sure that such third-party information security protocols are sufficient to withstand a cyber-attack or other security breach.

Current wording

We face risks related to cyber-attacks and other security breaches in connection with card transactions that typically involve the transmission of sensitive information (including personal information) regarding our customers through various third parties. Some of these parties have in the past been the target of security breaches and cyber-attacks, and because the transactions involve third parties and environments that we do not control or secure, future security breaches or cyber-attacks affecting any of these third parties could impact us, and in some cases we may have exposure and suffer losses for breaches or attacks relating to them. We rely on numerous other third-party service providers to conduct other aspects of our business operations and face similar risks relating to them. We cannot be sure that such third-party information security protocols are sufficient to withstand a cyber-attack or other security breach.

Previous wording

Cybersecurity risks for financial institutions also have evolved as a result of the increased interconnectedness of operating environments and the use of new technologies, devices and delivery channels to transmit data and conduct financial transactions. The adoption of new products, services and delivery channels contribute to a more complex operating environment, which enhances operational risk and presents the potential for additional structural vulnerabilities. As such, a single cyber-attack is now able to compromise hundreds of organizations and affect a significant number of consumers. In addition, the adoption of hybrid and remote work environments following the COVID-19 pandemic presents institutions with additional cybersecurity vulnerabilities and risks.

Current wording

Cybersecurity risks for financial institutions have evolved as a result of the increased interconnectedness of operating environments and the use of new technologies, devices and delivery channels to transmit data and conduct financial transactions. The adoption of new products, services and delivery channels contribute to a more complex operating environment, which enhances operational risk and presents the potential for additional structural vulnerabilities. As such, a single cyber-attack is now able to compromise hundreds of organizations and affect a significant number of consumers. The adoption of hybrid and remote work environments in the past several years presents institutions with additional cybersecurity vulnerabilities and risks.

Previous wording

The Corporation regularly evaluates its systems and controls and implements upgrades as necessary. The additional cost to the Corporation of our cybersecurity monitoring and protection systems and controls includes the cost of hardware and software, third party technology providers, consulting and forensic testing firms, insurance premium costs and legal fees, in addition to the incremental cost of our personnel who focus a substantial portion of their responsibilities on cybersecurity.

Current wording

The Corporation endeavors to regularly evaluate its systems and controls and implement upgrades as necessary. The additional cost to the Corporation of our cybersecurity monitoring and protection systems and controls includes the cost of hardware and software, third party technology providers, consulting and forensic testing firms, insurance premium costs and legal fees and the incremental cost of our personnel who focus a substantial portion of their responsibilities on cybersecurity.

Previous wording

Any successful cyber-attack or other security breach involving the misappropriation, loss, leak or other unauthorized disclosure of sensitive or confidential customer information, confidential and proprietary information relating to our bank and operations, unauthorized access to our information systems or that of our third-party service providers, or unauthorized access to other data that compromises our ability to function could severely damage our reputation, erode confidence in the security of our systems, products and services, expose us to the risk of litigation and liability, disrupt our operations and have a material adverse effect on our business. Any successful cyber-attack may also subject the Corporation to regulatory investigations, litigation (including class action litigation) or enforcement, or require the payment of regulatory fines or penalties or undertaking costly remediation efforts with respect to third parties affected by a cybersecurity incident, all or any of which could adversely affect the Corporation’s business, financial condition or results of operations and damage its reputation. Finally, we cannot guarantee that any costs and liabilities incurred in relation to an attack or incident will be covered by our existing insurance policies or that applicable insurance will be available to us in the future on economically reasonable terms or at all.

Current wording

Any attempted or successful cyber-attack or other security breach involving the theft, loss, destruction, gathering, monitoring, dissemination, misappropriation, misuse, alteration, or unauthorized disclosure of or unauthorized access to sensitive or confidential client or customer information (including personal information), confidential and proprietary information relating to our bank and operations, unauthorized access to our information systems or networks or that of our third-party service providers, or unauthorized access to other data that compromises our ability to function could severely damage our reputation, erode confidence in the security of our systems and networks, products and services, expose us to the risk of litigation and liability, disrupt our operations and have a material adverse effect on our business. Any attempted or successful cyber-attack may subject the Corporation to regulatory investigations, litigation (including class action litigation) or enforcement, or require the payment of regulatory fines or penalties or undertaking costly remediation efforts with respect to third parties affected by a cybersecurity incident, all or any of which could adversely affect the Corporation’s business, financial condition or results of operations and damage its reputation. Finally, we cannot guarantee that any costs and liabilities incurred in relation to an attack or incident will be covered by our existing insurance policies or that applicable insurance will be available to us in the future on economically reasonable terms or at all.

Previous wording

The Corporation may be subject to the data risks and cybersecurity vulnerabilities of the acquired company until the Corporation has sufficient time to fully integrate the acquiree’s customers and operations. Although the Corporation conducts comprehensive due diligence of cybersecurity policies, procedures and controls of our acquisition counterparties, and the Corporation maintains adequate policies, procedures, controls and information security protocols to facilitate a successful integration, there can be no assurance that such measures, controls and protocols are sufficient to withstand a cyber-attack or other security breach with respect to the companies we acquire, particularly during the period of time between closing and final integration.

Current wording

The Corporation may be subject to the data risks and cybersecurity vulnerabilities of the acquired company until the Corporation has sufficient time to fully integrate the acquiree’s customers and operations. Although the Corporation endeavors to conduct comprehensive due diligence of cybersecurity policies, procedures and controls of our acquisition counterparties, and the Corporation endeavors to maintain adequate policies, procedures, controls and information security protocols to facilitate a successful integration, there can be no assurance that such measures, controls and protocols are sufficient to withstand a cyber-attack or other security breach with respect to the companies we acquire, particularly during the period of time between closing and final integration.

Previous wording

We have experienced cybersecurity attacks in the past. Any failure, interruption, or breach in security or operational integrity of our or our third-party vendors' communications and information systems, including those caused by a cybersecurity attack, could result in failures or disruptions in our customer relationship management, general ledger, deposit, loan, and other systems. While we have policies and procedures designed to prevent or limit the effect of the failure, interruption, or security breach of our communications and information systems, we cannot completely ensure that any such failures, interruptions, or security breaches will not occur, nor can we ensure that our prevention procedures and information security program will function as designed and planned. The occurrence of any failures, interruptions, or security breaches of our or our third-party vendors' communications and information systems, including those caused by a cybersecurity attack, could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our financial condition and results of operations.

Current wording

While we have policies and procedures designed to prevent or limit the effect of the failure, interruption, or security breach of our or our third parties' communications and information systems and networks, we cannot completely ensure that any such failures, interruptions, or security breaches will not occur, nor can we ensure that our prevention procedures and information security program will function as designed and planned. Our business interruption insurance may be inadequate to compensate us for all losses that may occur as a result of any system, network or operational failure or disruption. The occurrence of any failures, interruptions, or security breaches of our or our third-party service providers' communications and information systems and networks, including those caused by a cyber-attack, could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our financial condition and results of operations.

Previous wording

We are subject to the PCI-DSS, issued by the Payment Card Industry Security Standards Council. PCI-DSS contains compliance guidelines with regard to our security surrounding the physical and electronic storage, processing and transmission of cardholder data. Compliance with PCI-DSS and implementing related procedures, technology and information security measures requires significant resources and ongoing attention. Costs and potential problems and interruptions associated with the implementation of new or upgraded systems and technology, such as those necessary to achieve compliance with PCI-DSS or with maintenance or adequate support of existing systems could also disrupt or reduce the efficiency of our operations. Any material interruptions or failures in our payment-related systems or third parties that we rely upon could have a material adverse effect on our business, results of operations and financial condition. If there are amendments to PCI-DSS, the cost of compliance could increase, and we may suffer loss of critical data and interruptions or delays in our operations as a result. If we or our service providers are unable to comply with the standards imposed by PCI-DSS, we may be subject to fines and restrictions on our ability to offer certain services, which could materially and adversely affect our business.

Current wording

We are subject to the PCI-DSS, issued by the Payment Card Industry Security Standards Council. PCI-DSS contains compliance guidelines with regard to our security surrounding the physical and electronic storage, processing and transmission of cardholder data. Compliance with PCI-DSS and implementing related procedures, technology and information security measures requires significant resources and ongoing attention. Costs and potential problems and interruptions associated with the implementation of new or upgraded systems and technology, such as those necessary to achieve compliance with PCI-DSS or with maintenance or adequate support of existing systems could disrupt or reduce the efficiency of our operations. Any material interruptions or failures in our payment-related systems or third parties that we rely upon could have a material adverse effect on our business, results of operations and financial condition. If there are amendments to PCI-DSS, the cost of compliance could increase, and we may suffer loss of critical data and interruptions or delays in our operations as a result. If we or our service providers are unable to comply with the standards imposed by PCI-DSS, we may be subject to fines and restrictions on our ability to offer certain services, which could materially and adversely affect our business.

Previous wording

Compliance with the rapidly evolving federal and state laws relating to the handling of information about individuals involves significant expenditure and resources, and any failure by us or our vendors to comply may result in significant liability, negative publicity, and/or an erosion of trust, which could materially adversely affect our business, results of operations, and financial condition.

Current wording

Compliance with the rapidly evolving federal and state laws relating to the handling of information about individuals involves significant expenditure and resources, and any failure by us or our service providers to comply may result in significant liability, negative publicity, and/or an erosion of trust, which could materially adversely affect our business, results of operations, and financial condition.

Previous wording

We and our vendors are subject to a number of U.S. federal, state, and local laws and regulations, industry standards and other requirements relating to consumer privacy and data protection. For more information, see “Privacy, Data Protection, and Cybersecurity” in the Item 1, Business section above.

Current wording

We and our service providers are subject to a number of U.S. federal, state, and local laws and regulations, industry standards and other requirements relating to consumer privacy and data protection. For more information, see “Privacy, Data Protection, and Cybersecurity” in the Item 1, Business section above.

Previous wording

Many other states are currently reviewing or proposing the need for greater regulation of the collection, sharing, use and other processing of information related to individuals for marketing purposes or otherwise, and there remains interest in expanding personal information protection requirements at the federal level as well. Both to comply with applicable existing law and to prepare for potential expansions in laws requiring such protection, we must maintain adequate privacy and security measures, which require significant investments in resources and ongoing attention.

Current wording

Both to comply with applicable existing law and to prepare for potential expansions in laws requiring protection of personal information, we must endeavor to maintain adequate privacy and security measures, which require significant investments in resources and ongoing attention.