FIRST CITIZENS BANCSHARES INC DE

General

First Citizens BancShares, Inc. (the “Parent Company” and when including all of its subsidiaries on a consolidated basis, “BancShares,” “we,” “us,” or “our”) was incorporated under the laws of Delaware on August 7, 1986, to become the holding company of First-Citizens Bank & Trust Company (“FCB”), its banking subsidiary. FCB opened in 1898 as the Bank of Smithfield in Smithfield, North Carolina, and later changed its name to First-Citizens Bank & Trust Company.

BancShares has expanded through de novo branching and acquisitions and as of December 31, 2024, operates a network of more than 500 branches and offices nationwide, predominantly located in the Southeast, Mid-Atlantic, Midwest, and Western United States, providing a broad range of financial services to individuals, businesses and professionals. At December 31, 2024, BancShares had total consolidated assets of $223.72 billion.

Throughout its history, the operations of BancShares have been significantly influenced by descendants of Robert P. Holding, who came to control FCB during the 1920s. Robert P. Holding’s children and grandchildren have served as members of the Board of Directors (the “Board”) of BancShares and of the Board of Directors of FCB (collectively with the Board of BancShares, the “Boards”), as chief executive officers and in other executive management positions and, since BancShares’ formation in 1986, have remained stockholders owning a large percentage of its common stock.

The Chairman of the Boards and Chief Executive Officer, Frank B. Holding, Jr., is the grandson of Robert P. Holding. Hope Holding Bryant, Vice Chairwoman of the Boards, is Robert P. Holding’s granddaughter. Peter M. Bristow, President and member of the Boards, is the brother-in-law of Frank B. Holding, Jr. and Hope Holding Bryant.

BancShares provides financial services for a wide range of consumer and commercial clients. This includes retail and mortgage banking, wealth management, small and middle market banking, factoring and leasing. BancShares provides commercial factoring, receivables management and secured financing services to businesses (generally manufacturers or importers of goods) that operate in various industries, including apparel, textile, furniture, home furnishings and consumer electronics. BancShares also provides deposit, cash management and lending to homeowner associations and property management companies. BancShares also owns a fleet of railcars and locomotives that are leased to railroads and shippers. Refer to the Segments section below for more information on markets we serve and products and services we offer.

BancShares delivers banking products and services to its customers through an extensive branch network and additionally operates a nationwide digital banking platform that delivers deposit products to consumers (the “Direct Bank”). Services offered at most branches include accepting deposits, cashing checks and providing for consumer and commercial cash needs. Consumer and business customers may also conduct banking transactions through various digital channels.

In addition to our banking operations, we provide various investment products and services through FCB’s wholly owned subsidiaries, including First Citizens Investor Services, Inc. (“FCIS”) and First Citizens Asset Management, Inc. (“FCAM”), and a non-bank subsidiary First Citizens Capital Securities, LLC (“FCCS”). As a registered broker-dealer, FCIS provides a full range of investment products, including annuities, brokerage services and third-party mutual funds. As registered investment advisers, FCIS and FCAM provide investment management services and advice. FCCS is a broker-dealer that also provides underwriting and private placement services. We also have other wholly owned subsidiaries, including SVB Wealth LLC, SVB Asset Management, and First Citizens Institutional Asset Management, LLC, which are active investment advisers.

Information regarding our business activities and operations is found in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations.

Business Combinations

In addition to organically growing our business, BancShares has historically pursued growth through strategic mergers and acquisitions to enhance organizational value, strengthen its presence in existing markets, as well as expand its footprint in new markets.

On March 27, 2023 (the “SVBB Acquisition Date”), FCB acquired substantially all loans and certain other assets and assumed all customer deposits and certain other liabilities of Silicon Valley Bridge Bank, N.A. (“SVBB”) from the Federal Deposit Insurance Corporation (the “FDIC”) pursuant to the terms of a purchase and assumption agreement (the “SVBB Purchase Agreement”) by and among FCB, the FDIC, and the FDIC, as receiver of SVBB (the “SVBB Acquisition”). SVBB was established following the closure of the former Silicon Valley Bank. BancShares maintains the Silicon Valley Bank brand as Silicon Valley Bank, a division of FCB.

On January 3, 2022, BancShares completed its merger (the “CIT Merger”) with CIT Group Inc. (“CIT”) and its subsidiary CIT Bank, N.A., a national banking association. BancShares maintains the CIT brand as CIT Group, a division of FCB.

For further discussion, refer to the “Business Combinations” section of Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations and Item 8. Financial Statements and Supplementary Data, Note 2—Business Combinations.

Segments

As of December 31, 2023, our reportable segments included the General Bank, the Commercial Bank, Silicon Valley Bank (“SVB”), and Rail segments. All other financial information is included in the “Corporate” section of segment disclosures.

Effective January 1, 2024, we made the following changes to our segment reporting:

•the private banking and wealth management components of the SVB segment were integrated into the General Bank segment which already included other wealth management activities;

•the SVB segment was renamed SVB Commercial as its customers primarily include commercial clients in key innovation markets, as well as private equity and venture capital clients; and

•the Direct Bank (a nationwide digital banking platform that delivers deposit products to consumers) previously allocated to the General Bank segment was transitioned to Corporate which already included borrowings and brokered deposits.

Segment disclosures and related information for all fiscal periods included in this Annual Report on Form 10-K were retrospectively revised to conform with the above described changes to our reportable segments.

(1) All other financial information not included in the segments is reported in “Corporate.”

Reportable segments are discussed further in the “Results by Segments” section of Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations and Item 8. Financial Statements and Supplementary Data, Note 22—Segment Information.

Competition

The financial services industry is highly competitive and continues to evolve as a result of changes in regulation, technology, product delivery systems, the accelerating pace of consolidation among financial service providers, and the general market and economic climate. BancShares competes with national, regional and local financial services providers. In recent years, the ability of non-bank financial entities to provide services previously limited to commercial banks has intensified competition. Non-bank financial service providers are not subject to the same significant regulatory restrictions as traditional commercial banks and, as such, can often operate with greater flexibility and lower cost structures. More than ever, customers have the ability to select from a variety of traditional and nontraditional alternatives. Competition is based on a number of factors including, among others, customer service, quality and range of products and services offered, price, reputation, interest rates on loans and deposits and customer convenience. Our non-bank services compete with other insurance companies, investment firms and brokerage firms.

FCB’s largest notable concentration of deposits by market share as of June 30, 2024 were in North Carolina (including our Direct Bank deposits) and South Carolina at 11.3% and 9.3%, respectively, which makes FCB the third largest bank in North Carolina and the fourth largest bank in South Carolina based on deposit market share according to the FDIC Deposit Market Share Report. The two banks larger than FCB based on deposits in both North Carolina and South Carolina were Bank of America and Truist Bank. The additional bank larger than FCB based on deposits in South Carolina was Wells Fargo. These banks collectively held 64.5% and 40.9% of North Carolina and South Carolina deposits, respectively.

As of December 31, 2024, FCB had more than 500 total domestic branches and offices, which included 214 in North Carolina, 120 in South Carolina and 83 in California. During January 2025, one of our leased branches in California was destroyed by wildfire as further discussed in the “Recent Events” section of Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations.

Geographic Locations

As of December 31, 2024, BancShares operated branches in Arizona, California, Colorado, Florida, Georgia, Hawaii, Kansas, Maryland, Massachusetts, Missouri, Nebraska, New Mexico, Nevada, North Carolina, Oklahoma, Oregon, South Carolina, Tennessee, Texas, Virginia, Washington, West Virginia, and Wisconsin.

Refer to the Concentration Risk section in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations for information on our commercial and consumer loan concentrations by state.

Human Capital

As of December 31, 2024, BancShares employed approximately 17,191 full-time staff and approximately 284 part-time staff for a total of 17,475 employees.

Our ability to attract, retain, and develop associates is critical to our success. We prioritize supporting our business by striving to ensure we have the right talent in the right jobs and with the right skills to fulfill our strategic objectives. Our vision is realized by cultivating a foundation that includes both a strong business strategy and a unified culture. A relationship-based, client-centered, and long-term focused approach supports our strategic objectives and reinforces a culture that prioritizes shared values and behaviors. These unwavering commitments position us to support our clients, colleagues, and communities in pursuing their greatest ambitions. Our client-centric approach has always been the bedrock of who we are, building deep and lasting relationships that prioritize the client experience. Our long-term focus allows us to make strategic decisions and investments designed to build long-term value and stability for all stakeholders, while skillfully managing risk along the way.

Our human resources team works to identify and deploy the critical talent needed to support these strategic objectives and our unified culture. We make talent attraction and retention a priority by offering learning and development opportunities, internal career mobility, a comprehensive total rewards package, and a welcoming values-based culture.

Fostering our culture is a strategic initiative, especially following the merger and acquisition activity over the past few years. During 2024, we reinforced our commitment to cultivating a unified culture by delivering initiatives that connected associates across the globe. To align and communicate our culture, we formalized and delivered compelling values, visuals and branding, creating a cohesive cultural identity. We delivered collaborative workshops to form connection and alignment across the organization and launched engaging new hire welcome sessions to instill our values from day one. In addition, we established our new workforce in India. These cultural efforts built a strong foundation to create a more connected, unified workforce as we move forward as one team in 2025.

In addition, our human resources team monitors and evaluates various metrics, specifically around attraction, retention, and development of talent. Our annual voluntary turnover, minus acquisition headcount, is typically lower than commonly used industry benchmarks. Aside from the expected effects from acquisition activity, voluntary turnover remained below the financial services industry benchmark through December 2024. We believe this reflects our strong corporate culture, competitive compensation and benefits structure, and commitment to career development.

Inclusion

We value diversity in people, in the markets we serve, and in the products and services we offer. We seek individuals with varied backgrounds because we understand that our differences contribute to a diversity of thought that enhances associate and customer relationships and propels innovation in our products and services. As a relationship-based culture, we believe it is important that associates feel included and valued and that we provide access to resources and opportunities that support long-term business success for BancShares and our associates.

At BancShares, we also prioritize creating connections, achieving our clients’ goals, fostering a culture of belonging, and promoting educational and engagement opportunities to deepen relationships across the company. To further these efforts, we support a variety of business resource groups that are open to all our associates regardless of race, gender, or nationality. These groups play a key role in creating an inclusive workplace culture, striving to attract and retain the best available talent, enriching both associate and customer experiences, and achieving key business objectives.

Benefits

At BancShares, a strong focus on our associates’ well-being is part of our culture and integral to our total rewards philosophy. Recognizing that well-being is an individual journey, our competitive benefits program has been thoughtfully designed to provide associates with options to choose from in five well-being dimensions – physical, financial, emotional, social, and community. Supporting the health and well-being of our associates, BancShares offers benefits that include, but are not limited to:

•medical plan options that include telehealth, dental and vision plan options, and wellness programs;

•a 401(k) plan, flexible spending accounts, life and accidental death and dismemberment insurance, short-term and long-term disability coverage, numerous voluntary coverages, and discount programs;

•paid time off and other time away such as holidays, parental leave, and volunteer leave; and

•an employee assistance program.

Regulatory Considerations

BancShares is subject to laws and regulation that govern its operations and impact the products and services it may offer, the risks that it may take, the corporate and financial actions it may take, and the information it must publicly disclose. In connection with those laws and regulations, BancShares is subject to regulation, supervision and periodic examination by supervisory authorities, including the FDIC, the Board of Governors of the Federal Reserve System (the “Federal Reserve”), the Federal Reserve Bank (the “FRB”), and the Consumer Financial Protection Bureau (“CFPB”). FCB, as a North Carolina state-charted bank that is not a member of the Federal Reserve System, is also subject to the laws and regulations of North Carolina and supervision by the North Carolina Office of the Commissioner of Banks, as well as other state laws and state regulators in the states in which FCB operates. BancShares, as a publicly traded company, is also subject to disclosure and reporting requirements under Securities and Exchange Commission (“SEC”) rules and Nasdaq Stock Market (“Nasdaq”) continued listing standards, as well as rules pertaining to governance and corporate actions. Certain of BancShares’ subsidiaries are also subject to additional supervision and regulation, as discussed below, and FCB is also subject to laws and regulations applicable to banks that govern trust and other fiduciary activities.

Banking laws, regulations, and policies are continually under review by the U.S. Congress, state legislatures, and federal and state regulatory agencies. In addition to laws and regulations, state and federal bank regulatory agencies may issue policy statements, interpretive letters, and similar written guidance applicable to BancShares.

Regulations applicable to banking organizations generally serve to protect depositors and other customers, the Depositors Insurance Fund (“DIF”), the broader economy, and the stability of the U.S. financial system. Certain other laws and regulations, including those administered by the CFPB, are focused on consumer financial protection. In addition, disclosure and reporting requirements under SEC rules and regulations primarily aim to protect investors and securities markets. BancShares expects that its business will remain subject to extensive regulation and supervision.

Examinations by banking regulators consider compliance with applicable laws and regulations and evaluate against certain enhanced prudential standards, as discussed below. Following examinations, banking organizations may receive supervisory findings or ultimately be assigned supervisory ratings. Examination reports and supervisory ratings, as well as mandatory or discretionary actions by regulators under the applicable supervisory framework, could significantly impact a banking organization’s operations or result in substantial monetary penalties. Nonmonetary requirements may be imposed if there is a failure to comply with applicable laws or regulations, operations are conducted in an unsafe or unsound manner, represent an unfair, deceptive, abusive act or practice, or do not meet supervisory expectations.

There are numerous rules governing the supervision and regulation of BancShares. The following discussion is a high-level summary of the laws and regulations that apply to BancShares, but the summary is not intended to be exhaustive or describe all of the laws, regulations and policies that apply to BancShares.

Enhanced Prudential Standards

BancShares is subject to certain enhanced prudential standards as a bank holding company (“BHC”) with more than $100 billion in consolidated assets under the Bank Holding Company Act of 1956, as amended (the “BHCA”) and the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, as amended (the “Dodd-Frank Act”), and the implementing regulations promulgated thereunder. Under the Dodd-Frank Act, certain enhanced prudential standards are mandatory for banking organizations with $250 billion or more in total consolidated assets, as well as nonbank financial companies that are deemed to be systemically important by the Federal Reserve. Pursuant to the Economic Growth, Regulatory Relief, and Consumer Protection Act, the Federal Reserve is authorized to apply any enhanced prudential standards to a banking organization with $100 billion or more in total consolidated assets on a tailored basis based on identified risk-based factors. The Federal Reserve, along with the FDIC and the Office of the Comptroller of the Currency (the “OCC”), adopted tailoring rules (“Tailoring Rules”) for the applicability of enhanced prudential standards to banking organizations with $100 billion in total consolidated assets, which apply to the holding company and their subsidiary depository institutions. The Parent Company and FCB are currently subject to certain enhanced prudential standards as further described below.

Tailoring Rules. Under the Tailoring Rules, the Federal Reserve groups banking organizations into four categories based on total consolidated assets, off-balance sheet exposure, nonbank assets, weighted short-term wholesale funding, and cross-jurisdictional activities. Category I banking organizations, which are the U.S. Globally Systemically Important Banks (“GSIBs”), are subject to the most stringent enhanced prudential requirements, and Category IV banking organizations (i.e., between $100 billion and $250 billion in total consolidated assets, and less than $75 billion in nonbank assets, off-balance sheet exposure, cross-jurisdictional activities, and weighted short-term wholesale funding) are subject to the least stringent requirements. Category II banking organizations have $700 billion or more in total consolidated assets, or $100 billion or more in total consolidated assets and $75 billion or more in cross-jurisdictional activities, and do not meet the criteria for Category I banking organizations. Category III banking organizations have $250 billion or more in total consolidated assets, or $100 billion or more in total consolidated assets and $75 billion or more in weighted short-term wholesale funding, nonbank assets, or off-balance sheet exposure, and do not meet the criteria for Category I or II banking organizations. BancShares first became subject to the enhanced prudential standards under the Tailoring Rules as a Category IV banking organization in 2022, subject to the applicable transition provisions. The enhanced prudential standards that apply to BancShares include, but are not limited to, enhanced enterprise risk management and liquidity management requirements, supervisory stress testing and capital plan submission requirements, and enhanced governance standards. Further, BancShares is required to maintain a compliance system that is commensurate with its asset size, risk profile, complexity, and activities. As BancShares continues to grow, it may cross additional risk-based asset thresholds, subjecting it to additional regulatory requirements and enhanced scrutiny.

Basel III. The federal banking agencies have established a framework for enhanced capital and liquidity requirements for banking organizations with $100 billion or more in total assets that implements portions of the Basel III accords, developed by the Basel Committee on Banking Supervision (as implemented in the U.S., “Basel III”). Under Basel III, banking organizations with $100 billion or more in total consolidated assets that are Category III or IV banking organizations may follow a standardized approach to calculating risk-weighted assets (“RWA”) and risk-based capital requirements, while Category I and II banking organizations are required to use an internal ratings-based approach to calculate RWA and risk-based capital consistent with an advanced approaches framework (“Advanced Approaches”). Category I, II and III banking organizations are also required under Advanced Approaches to comply with enhanced risk-based capital requirements on a tailored basis (e.g., a countercyclical capital buffer if activated and a supplementary leverage ratio requirement). In addition, Category I and II banking organizations, consistent with Advanced Approaches, must include accumulated other comprehensive income (“AOCI”) in capital for purposes of calculating regulatory capital requirements, but Category III and IV banking organizations are able to opt-out of this requirement. As noted above, Category III banking organizations may follow a standardized approach to calculating RWA.

Capital Planning and Stress Testing. As a Category IV banking organization, BancShares is required to submit an annual capital plan to the Federal Reserve and is subject to biennial supervisory stress testing by the Federal Reserve under its Comprehensive Capital Analysis and Review (“CCAR”) process in accordance with the applicable transition provisions. The Federal Reserve requires a banking organization to resubmit its capital plan if there is a material change in the banking organization’s risk profile, financial condition or corporate structure since its most recent capital plan submission, or the Federal Reserve otherwise notifies the banking organization that a resubmission is required. The mandatory elements of a capital plan include (i) an assessment of the expected uses and sources of capital over the planning horizon, (ii) a description of the banking organization’s process for assessing capital adequacy, (iii) the banking organization’s capital policy, and (iv) a discussion of any expected changes to the banking organization’s business plan that are likely to have a material impact on capital adequacy. The Federal Reserve calculates a banking organization’s stress capital buffer (“SCB”) requirement as part of the CCAR process, as further discussed below. The Federal Reserve evaluates capital planning and stress testing with a focus on whether those processes are supported by strong risk management and control frameworks. Significant deficiencies in a banking organization’s capital planning and stress testing processes may result in supervisory directives that require the banking organization to address the identified deficiencies and potentially limit the organization’s capital distributions. BancShares submitted a capital plan in 2024 in accordance with the regulatory requirements. As a banking organization with less than $250 billion in total consolidated assets, BancShares is not subject to the company-run stress testing requirements under the Dodd-Frank Act.

Capital Requirements. The Parent Company and FCB are subject to regulatory capital requirements under Basel III for the Tier 1 leverage ratio and ratios of qualifying capital to RWA (the “Risk-Based Capital Ratios” and, together with the Tier 1 leverage ratio, the “Regulatory Capital Ratios”). The total risk-based capital, Tier 1 risk-based capital, and common equity Tier 1 risk-based capital (“CET1”) ratios are the Risk-Based Capital Ratios. CET1 capital is generally common stock, additional paid in capital, and retained earnings less applicable capital deductions.

As a Category IV banking organization, the Parent Company is also subject to the SCB requirements for the Risk-Based Capital Ratios, subject to the applicable transition provisions. The SCB is calculated by the Federal Reserve for each large banking organization and reflects losses under the severely adverse scenario in the supervisory stress tests. The SCB is calculated as the greater of (i) the difference between the organization’s starting and minimum projected Risk-Based Capital Ratios under the severely adverse scenario in the supervisory stress test, plus the sum of the dollar amount of the firm’s planned common stock dividends for each of the fourth through seventh quarters of the planning horizon as a percentage of RWA, or (ii) 2.5%, which is equal to the minimum capital conservation buffer under Basel III. The Parent Company will participate in the 2026 supervisory stress test which will determine the SCB applicable to the Parent Company. Additionally, federal banking agencies have developed prompt corrective action (“PCA”) thresholds (described below) for Regulatory Capital Ratios to determine whether an institution is well capitalized. Failure of a banking organization to meet regulatory capital guidelines may subject it to a variety of enforcement remedies, including constraints on capital distributions and discretionary executive compensation, restrictions on its operations and activities, termination of deposit insurance by the FDIC and, under certain conditions, the appointment of a conservator or receiver.

As of December 31, 2024, the Regulatory Capital Ratios of the Parent Company and FCB exceeded the applicable Basel III requirements and the PCA well capitalized thresholds as further addressed under “Capital” in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations. The following table includes the Basel III requirements and PCA well capitalized thresholds for the Regulatory Capital Ratios.

Resolution Planning. Consistent with its status as a Category IV banking organization, subject to the applicable transition provisions, BancShares is not required to submit a resolution plan under the Dodd-Frank Act and the implementing regulations of the Federal Reserve and FDIC (a “Living Will”). A Living Will must describe the banking organization’s strategy for the rapid and orderly resolution of the parent company and nonbank entities within the banking organization under the U.S. Bankruptcy Code in a manner that substantially mitigates the risk that the failure would have serious adverse effects on financial stability in the United States.

FCB is required to submit a full resolution plan (“Resolution Plan”) to the FDIC under the Covered Insured Depository Institution rule (“CIDI Rule”). The CIDI Rule generally applies to FDIC-insured depository institutions (“IDIs”) with consolidated assets of $50 billion or more (with tailored requirements for IDIs with less than $100 billion in total consolidated assets). Resolution Plans submitted under the CIDI Rule generally require a more detailed discussion of the strategy for resolving the IDI than Living Wills (i.e., resolution plans required under the Dodd-Frank Act). The CIDI Rule requires that the Resolution Plans enable the FDIC as receiver to resolve the IDI in the event of its insolvency in a manner that ensures that depositors receive access to their insured deposits in a timely manner, maximizes the net present value return from the sale or disposition of a failed bank’s assets, and minimizes the amount of any loss realized by the creditors in the resolution. Following an amendment to the CIDI rule effective October 1, 2024, Resolution Plans are evaluated under a new credibility standard. FCB is required to, among other things, submit a full Resolution Plan every three years and provide interim targeted information between full submissions. BancShares’ first submission under the new regulatory reporting requirements will be due July 1, 2025.

Risk Management. As a Category IV banking organization, subject to the applicable transition provisions, BancShares is required to maintain an enterprise-wide risk management system, governance program, and compliance system commensurate with its size, risks, activities, and complexity. This includes prescribed standards for the implementation of risk governance frameworks addressing credit risk, interest rate risk, liquidity risk, price risk, operational risk, compliance risk, strategic risk, and reputation risks, as well as third-party risk management controls and practices. As part of its risk management regulatory framework, the federal banking agencies have adopted guidelines prescribing safety and soundness standards. These guidelines establish general standards relating to internal controls and information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth and compensation, fees and benefits. Additional topics include cybersecurity, climate financial-risk management, and compensation, as discussed further below. In general, the guidelines are principle-based and set forth regulatory expectations for, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines. There are a number of obligations and restrictions imposed on banking organizations by law and regulatory policy that are designed to minimize potential loss to the depositors of such depository institutions and to the DIF in the event of failure of a depository institution. BancShares continues to enhance its risk management and compliance program post-SVBB Acquisition to meet regulatory expectations.

Category III Requirements. BancShares would become a Category III banking organization under the Tailoring Rules, and would be subject to more stringent enhanced prudential standards, if it had consolidated assets of $250 billion or more, or $100 billion or more in total consolidated assets and $75 billion or more in weighted short-term wholesale funding, nonbank assets, or off-balance sheet exposure, based on a four-quarter trailing average. Enhanced prudential standards and risk-based capital requirements for Category III banking organizations include, but are not limited to, the Living Wills requirement, annual (rather than biennial) supervisory capital stress testing, biennial company-run stress testing (if consolidated assets were $250 billion or more), Liquidity Coverage Ratio (“LCR”) and Net Stable Funding Ratio (“NSFR”) requirements, and, under Advanced Approaches, enhanced risk-based capital requirements (e.g., a countercyclical capital buffer if activated and a supplementary leverage ratio requirement, among others). The Category III requirements apply at the holding company level as well to the subsidiary depository institution, to the extent applicable. The LCR requirement is designed to ensure that banking organizations have sufficient high-quality liquid assets to survive a significant liquidity stress event lasting for 30 calendar days, and the NSFR requirement complements the LCR and ensures that a banking organization maintains a stable funding profile in relation to the composition of their assets and off-balance sheet activities over a one-year time horizon. The NSFR requirement ensures that a banking organization maintains minimum amounts of stable funding to support its assets, commitments, and derivatives exposures over a one-year time horizon. As a Category III banking organization, BancShares would be subject to a full LCR requirement and full NSFR requirement, unless it has less than $75 billion in average weighted short-term wholesale funding, in which case it would subject to a reduced LCR requirement and NSFR requirement at 85% of the full requirements. As a Category IV banking organization, subject to the applicable transition provisions, BancShares would be subject to modified LCR and NSFR requirements if it has $50 billion or more, but less than $75 billion, in average weighted short-term wholesale funding.

Proposed Rule for Basel III Endgame. In 2023, the federal banking agencies proposed a rule to implement the final components of the Basel III accords (the “Basel III Endgame”), which would apply additional capital requirements addressing credit risk, operational risk, and market risk for banking organizations with $100 billion or more in total consolidated assets. In general, the rules implementing Basel III Endgame as originally proposed would, among other things, require covered banking organizations to calculate total RWA for its Regulatory Capital Ratios under both an expanded risk-based approach and a standardized approach, use the lower of each as its binding Regulatory Capital Ratio for regulatory purposes (including capital planning, stress testing, and buffer frameworks), and require Category IV banking organizations to comply with the same enhanced risk-based capital requirements that apply to Category III banking organizations (e.g., a countercyclical capital buffer if activated and a supplementary leverage ratio requirement, among others). The proposal also would require Category III and Category IV banking organizations to follow the same requirements as Category I and Category II banking organizations in terms of mandatory inclusion of AOCI in capital for purposes of calculating regulatory capital requirements, as well as capital deductions and rules for minority interests.

In September of 2024, Federal Reserve Board Governor and Vice-Chair for Supervision, Michael Barr, announced his recommendation for a re-proposal of the rule that would not apply the Basel III Endgame changes to banking organizations with total consolidated assets between $100 billion and $250 billion, except as to mandatory inclusion of AOCI in capital for purposes of calculating regulatory capital requirements. Barr announced his resignation as Vice-Chair for Supervision, and the prospects for a final rule or re-proposal are uncertain at this time. We continue to evaluate the proposal, assess its potential impact and monitor for a re-proposal.

Proposed Long-Term Debt & Clean Holding Company Requirements. The federal banking agencies have proposed a rule that would require BancShares, as a banking organization with over $100 billion in total consolidated assets, to adhere to certain long-term debt and additional clean holding company requirements. In 2023, the federal banking agencies released the proposed rule which would require BancShares to (1) issue and maintain outstanding a minimum amount of long-term debt that would be available to absorb losses in the event of failure, (2) comply with “clean holding company” requirements for these holding companies (e.g., prohibition on engaging in certain activities at the holding company that could complicate its resolution) and (3) apply a stringent capital treatment to its holdings of long-term debt issued by other large banking organizations to discourage cross-holdings of long-term debt by other banking organizations. The minimum amount of eligible long-term debt required to be maintained would be equal to the greater of (i) 6% of the total RWA of the banking organization, (ii) 3.5% of average total consolidated assets of the banking organization, and, (iii) if it were subject to the supplementary leverage ratio, 2.5% of the leverage exposure under the supplementary leverage ratio for the banking organization. Debt instruments issued to satisfy the minimum long-term debt requirement would be required to meet certain criteria to ensure that the debt instruments can readily absorb losses in resolution. Compliance with the new requirements would be required through a phased-in approach over a three-year period, during which banking organizations would need to meet 25% of their long-term requirements by one year after effectiveness of the rule, 50% after two years, and 100% after three years. Additionally, if necessary for FCB to satisfy the minimum long-term debt requirements as a subsidiary of a covered company, the Parent Company would be required to purchase eligible internal debt securities from FCB in the amount necessary to satisfy such requirement. The proposal would allow banking organizations to receive credit for existing outstanding long-term debt that meets certain criteria. We continue to evaluate the proposal and assess its potential impact, and we expect we would need to issue additional long-term debt to satisfy these requirements.

Limitations on Dividends and Other Payments

The Parent Company and FCB are subject to limitations on dividends and other payments. A principal source of the Parent Company’s liquidity is dividends from FCB. Failure to meet any enhanced prudential standards discussed above, or other mandatory or discretionary action by regulators, could impact the Parent Company or FCB’s ability to declare dividends or make other payments or capital distributions, including equity repurchases. Federal and state banking agencies also have the authority to prohibit BancShares from engaging in an unsafe or unsound practice in conducting its business, which may limit or preclude capital distributions, depending on financial condition. In addition, the Parent Company’s ability to make capital distributions, including paying dividends and repurchasing shares, is subject to the Federal Reserve’s restrictions on capital distributions under the Basel III capital rules. Furthermore, under the Federal Deposit Insurance Act (the “FDI Act”), IDIs, such as FCB, are prohibited from making capital distributions, including the payment of dividends, if, after making such distributions, the institution would become undercapitalized. Additionally, banking organizations that are not considered well capitalized under the Basel III capital rules could be subject to restrictions on dividends, equity repurchases and compensation based on the amount of the shortfall. State law also prescribes certain limitations on payment of dividends.

Limitations on Mergers & Acquisitions

BancShares is subject to laws that may require regulatory approval for, or that otherwise impose limitations on, mergers, acquisitions or similar transactions. Failure to meet any enhanced prudential standards discussed above, or other mandatory or discretionary action by regulators, could impact the Parent Company or FCB’s ability to complete or place limitations on the consummation of mergers, acquisitions or similar transactions. For example, under the BHCA, a BHC must obtain approval from the Federal Reserve prior to directly or indirectly acquiring ownership or control of 5% of the voting shares or substantially all of the assets of another depository institution holding company or IDI, or prior to merging or consolidating with another depository institution holding company. In addition, federal market share limitations impose conditions that an acquiring BHC, after and as a result of the acquisition, control no more than 10% of the total amount of deposits of IDIs in the U.S. and no more than 30%, subject to variation by state law, of such deposits in applicable states. Federal Reserve rules also prohibit a financial holding company (“FHC”), which we have elected to be, from combining with another company if the resulting company’s liabilities would exceed 10% of the aggregate consolidated liabilities of all financial companies nationally.

The BHCA and other federal laws enumerate the factors the Federal Reserve must consider when reviewing the merger of BHCs, the acquisition of banks, or the acquisition of voting securities of a bank or BHC. These factors include the competitive effects of the proposal in the relevant geographic markets; the financial and managerial resources and future prospects of the companies and banks involved in the transaction; the effect of the transaction on the financial stability of the United States; the organizations' compliance with anti-money laundering (“AML”) laws and regulations; the convenience and needs of the communities to be served; and the records of performance under the Community Reinvestment Act (“CRA”) of the IDIs involved in the transaction.

In addition, under the FDI Act as amended by the Bank Merger Act (“BMA”), any IDI must also obtain approval of the FDIC before any merger, acquisition or certain similar transactions with another institution if the resulting institution will be a state chartered bank that is not a member of the Federal Reserve System. The FDIC maintains a policy statement outlining the agency’s approach to evaluating bank merger and acquisition proposals under the BMA. The policy statement was last updated on September 17, 2024 to, among other things, clarify the FDIC’s approach to evaluating the statutory factors under the BMA, and specifically provide clarity regarding what features of merger transactions may be consistent with favorable findings on the statutory factors under BMA. The policy statement was adopted under former FDIC Chair, Martin Gruenberg. Acting Chair of the FDIC, Travis Hill, recently announced several priorities for the agency, including replacing the 2024 current statement of policy with the goal of improving the merger approval process. Until further action by the FDIC, the 2024 current statement of policy remains in effect, and it is unclear when a replacement policy statement would be adopted and how it will differ from the current policy statement.

The Department of Justice (“DOJ”) is responsible for evaluating mergers and acquisitions under the federal antitrust laws, and the Federal Trade Commission (“FTC”) is responsible for evaluating nonbank acquisitions by a banking organization under the Hart-Scott-Rodino Antitrust Improvements Act of 1976 (“HSR Act”). On September 17, 2024, the DOJ announced its withdrawal from the 1995 Bank Merger Guidelines and stated that the 2023 Merger Guidelines adopted by the DOJ and FTC in 2023, along with a new Banking Addendum, would be followed. Under the BHCA and BMA, mergers and acquisitions by BancShares are subject to a waiting period of 30-days unless the U.S. Attorney General consents to a shorter waiting period or the waiting period is otherwise waived by the approving banking agency due to an emergency that requires expeditious action or the proposal involves a probable bank failure. Transactions subject to review under the HSR Act are also subject to a 30-day waiting period, but the waiting period is only 15 days for transactions that are for cash tender offers or certain bankruptcy sales.

Holding Company Status

The Parent Company, as a BHC, is subject to laws that restrict the activities in which it is permitted to participate and impose requirements for support of FCB.

Activities. The Parent Company is generally limited to managing or controlling banks, furnishing services to or performing services for its subsidiaries, and engaging in other activities the Federal Reserve determines by regulation or order to be so closely related to banking or managing or controlling banks as to be a proper incident thereto. However, in addition to being a BHC, the Parent Company elected to be an FHC under the Gramm-Leach-Bliley Act of 1999 (the “GLBA”). BHCs that qualify and elect to be FHCs and continue to meet the eligibility requirements as an FHC (discussed below), though still limited in their activities, may more broadly engage in any activity, or acquire and retain the shares of a company engaged in any activity, that is either (i) financial in nature or incidental to such financial activity (as determined by the Federal Reserve in consultation with the Secretary of the U.S. Treasury) or (ii) complementary to such financial activity and does not pose a substantial risk to the safety and soundness of depository institutions or the financial system generally (as solely determined by the Federal Reserve). Such activities may include, among other things, securities underwriting or merchant banking.

The eligibility requirements for an FHC include that the FHC and each of its subsidiary IDIs remain “well capitalized” and “well managed,” and any subsidiary IDI must have received a rating under the CRA of at least “satisfactory” in its most recent examination. An IDI and its holding company are considered to be well capitalized if they each satisfy the requirements for this status under applicable bank capital requirements. An FHC with $100 billion or more in total consolidated assets is considered well managed if it receives a rating of “Broadly Meets Expectations” or “Conditionally Meets Expectations” for each of the component ratings under the Federal Reserve’s Large Financial Institution (“LFI”) rating system. Under the LFI rating system, the Federal Reserve assigns ratings based on three supervisory components: (i) capital planning and positions, (ii) liquidity risk management and positions, and (iii) governance and controls. If an FHC ceases to meet all of these requirements, the Federal Reserve may impose limitations or conditions on the conduct of its activities, as well as its ability to make certain acquisitions. If the failure to meet these standards persists, an FHC may be required to divest its IDI subsidiaries or cease all activities other than those activities that may be conducted by BHCs that are not FHCs. Furthermore, if an IDI subsidiary of an FHC has not maintained a satisfactory CRA rating, the FHC would not be able to commence any new financial activities or acquire a company that engages in such activities, though it may still be permitted to continue its existing activities.

The Volcker Rule. The Volcker Rule generally prohibits “banking entities” from engaging in proprietary trading or owning, investing in, or sponsoring “covered funds” which is defined to include hedge funds and private equity funds, subject to certain exemptions. The Volcker Rule applies to the Parent Company, FCB, and their subsidiaries and affiliates that fit the definition of a “banking entity” under the implementing regulations. In connection with the SVBB Acquisition, BancShares acquired interests in a portfolio of private funds, which are held and managed in accordance with the Volcker Rule. BancShares has developed and implemented a Volcker Rule compliance program commensurate with the size, scope, and complexity of its activities and its business structure.

Source of Strength. Under the Dodd-Frank Act, BHCs are required to act as a source of financial strength to their subsidiary banks. Pursuant to this requirement, the Parent Company is expected to commit resources to support FCB, including at times when the Parent Company may not be in a financial position to provide such resources. Any indebtedness resulting from capital loans made by a BHC to any of its subsidiary banks are subordinate in right of payment to depositors and to certain other indebtedness of such subsidiary banks. In the event of a BHC’s bankruptcy, any commitment by the BHC to a federal banking agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Community Reinvestment Act

The CRA requires the federal banking agencies to encourage financial institutions to help meet the credit needs of the local communities, including low- and moderate-income (“LMI”) neighborhoods. As discussed above, if FCB receives a CRA rating of less than “satisfactory” from the FDIC, its activities as an FHC may be limited. Performance under the CRA is also considered when federal banking agencies analyze applications for mergers and acquisitions, as well as branch openings.

In 2023, the federal banking agencies jointly issued a final rule to strengthen and modernize the existing CRA regulations. The effective date of the rule was April 1, 2024, with compliance of the majority of its provisions required by January 1, 2026 and the compliance with data reporting requirements required by January 1, 2027. Under the final rule, the agencies will evaluate a bank’s CRA performance based upon the varied activities that it conducts and the communities in which it operates, and CRA evaluations and data collection requirements will be tailored based on bank size and type. The final rule was preliminarily enjoined on March 29, 2024, following legal challenge. We continue to monitor the case and for any appeal by the agencies.

In connection with the objectives of the CRA, FCB is currently implementing a community benefits plan that was developed in collaboration with representatives of national, state, and local community reinvestment organizations. Under the community benefit plan, FCB committed to invest $16 billion over a five-year period beginning in 2021 in the communities served by FCB, including $3.2 billion in home purchase, home improvement and mortgage refinance loans focused on LMI and minority borrowers in majority-minority geographies, $5.9 billion in small business lending, and $6.9 billion in community development lending and investments. The plan also provides for $50 million in CRA grants.

In addition, FCB is currently implementing an addendum to SVB’s prior community benefits plan. The addendum was agreed to by FCB in November 2023 in connection with the SVBB Acquisition and was developed through working with national, statewide, and local community reinvestment organizations to extend support to Northern California and Eastern Massachusetts. Under the addendum, FCB committed to a $6.5 billion community benefit target with the following components: $2.25 billion in small business lending, $3.6 billion in CRA development lending and investing, and $650 million in residential mortgages to LMI borrowers and in selected LMI census tracts. Additionally, FCB committed to $35 million in CRA grants, with $10 million of that sum dedicated to an affordable home mortgage subsidy program.

FDIC Insurance

FCB is required to pay the FDIC premiums for deposit insurance according to base deposit insurance assessment rate schedules, which remain elevated following a uniform increase of 2 basis points (“bps”) by the FDIC that began in the first quarterly assessment period of 2023. The FDIC increased the base deposit insurance assessments rates following growth in insured deposits during the first and second quarters of 2020 that caused the DIF reserve ratio to decline below the statutory minimum of 1.35%. The increased assessment rate schedules are expected to remain in effect until the reserve ratio meets or exceeds 2%, absent further action by the FDIC.

In addition, FCB is subject to special assessments to recover the loss to the DIF associated with the bank failures in spring of 2023. The assessment base for an IDI is equal to the institution’s estimated uninsured deposits as of December 31, 2022, adjusted to exclude the first $5 billion in estimated uninsured deposits. The FDIC began collecting the special assessment at an annual rate of 13.4 bps beginning with the first quarterly assessment period of 2024, and the agency is expected to continue to collect special assessments for an anticipated total of eight quarterly assessment periods. We accrued a FDIC insurance special assessment charge of $64 million in 2023. During 2024, the FDIC revised its loss estimate, indicating higher losses than originally estimated to the DIF, and therefore we accrued an additional charge of approximately $11 million, that is expected to be paid in two quarterly periods after the initial assessment payments.

Requirements for Brokered Deposits and Deposit Brokers; Limited Exception for Reciprocal Deposits

FCB may be limited in its ability to accept deposits made to it with the assistance of a third-party deposit broker if it is not well capitalized. Section 29 of the FDI Act and the FDIC’s implementing regulations limit the ability of an IDI to accept brokered deposits unless the institution is well capitalized, or the IDI is adequately capitalized and obtains a waiver from the FDIC. IDIs that are less than well capitalized generally cannot accept brokered deposits, and are subject to restrictions on the interest rates paid on deposits. IDIs that are well capitalized or adequately capitalized and meet certain other criteria are able to exempt from treatment as “brokered” deposits up to $5 billion or 20% of the institution’s total liabilities in reciprocal deposits (defined generally as deposits received by a depository institution through a deposit placement network with the same maturity and in the same aggregate amount as deposits placed by the depository institution in other network institutions).

Transactions with Insiders and Affiliates

Pursuant to the Federal Reserve Act, Regulation W and Regulation O, the authority of FCB to engage in transactions with or make loans to insiders or “affiliates” is limited. Among other things, loan transactions with an affiliate generally must be collateralized and certain transactions between FCB and its affiliates, including the sale of assets, the payment of money or the provision of services, must be on terms and conditions that are substantially the same, or at least as favorable to FCB, as those prevailing for comparable nonaffiliated transactions. Additionally, FCB is subject to individual and aggregate lending limits with respect to “extensions of credit” to Insiders. Further, FCB generally may not purchase securities issued or underwritten by affiliates. FCB receives management fees from its subsidiaries and the Parent Company for expenses incurred for performing various functions on their behalf. These fees are charged to each company based upon the estimated cost for usage of services by that company. All intercompany transactions are eliminated from the consolidated financial statements.

Crypto-Asset Related Activities

Under applicable guidance from the Federal Reserve and FDIC, banking organizations must give notice and obtain supervisory feedback prior to engaging in any crypto-related activities. In addition, prior to engaging in any such activities, the banking organization is expected to ensure that the activities are legally permissible under relevant state and federal laws and ensure that the banking organization has adequate systems, risk management, and controls to ensure that the activities are conducted in a safe and sound manner consistent with applicable laws, including consumer protection laws. As a result of the change in the presidential administration and anticipated corresponding changes in the leadership of the federal banking agencies, it is uncertain whether the agencies will continue to adhere to this supervisory framework. BancShares does not engage in any crypto-related activities but continues to monitor the regulatory landscape.

Anti-Money Laundering & Economic Sanctions

FCB and one of its subsidiaries, FC International, Inc. (“FC International”), are subject to the Bank Secrecy Act of 1970 (“BSA”) and subsequent laws and regulations, including USA PATRIOT Act of 2001 (the “Patriot Act”), that require financial institutions to take steps to prevent the use of their systems to facilitate the flow of illegal or illicit money or terrorist funds, including AML compliance programs, and to report certain activity to the government. The BSA, which is administered by the U.S. Financial Crimes Enforcement Network, also requires covered financial institutions to provide AML training to employees, designate an AML compliance officer and annually audit the AML program to assess its effectiveness, and imposes compliance and due diligence obligations, including standards for verifying customer identification at account opening and maintaining expanded records, as well as beneficial ownership requirements. The United States has also imposed economic sanctions on transactions with certain designated foreign countries, nationals and others, which are enforced by the U.S. Treasury’s Office of Foreign Asset Control (“OFAC”). Failure of a financial institution to maintain and implement adequate compliance programs for the foregoing, or to comply with all the relevant laws and regulations, could have serious legal and reputational consequences, including material fines and sanctions. FCB has implemented a program designed to facilitate compliance with the full extent of the applicable BSA, OFAC and Patriot Act related laws, regulations and related sanctions.

Consumer Laws and Regulations

FCB is subject to certain laws and regulations designed to protect consumers in transactions with banks. These laws include the Truth in Lending Act (“TILA”), the Truth in Savings Act, the Electronic Funds Transfer Act, the Expedited Funds Availability Act, the Equal Credit Opportunity Act, Real Estate Settlement Procedures Act, Home Mortgage Disclosure Act, the Fair Credit Reporting Act, the Fair Debt Collection Practices Act, the Fair Housing Act and the Servicemembers Civil Relief Act, many of which are enforced by the CFPB. Under TILA in particular, residential mortgage lenders are required to make a reasonable and good faith determination based on verified and documented information that a consumer applying for a mortgage loan has a reasonable ability to repay the loan according to its terms, based on certain prescribed evaluation alternatives. The foregoing laws and related regulations mandate certain disclosures and regulate the manner in which financial institutions transact business with certain customers.

A number of regulatory authorities may enforce consumer laws and regulations. The CFPB is BancShares’ primary federal regulator for the regulation, supervision, and enforcement of the federal consumer protection laws. The CFPB is generally authorized to prevent any institution under its authority from engaging in an unfair, deceptive, or abusive act or practice in connection with consumer financial products and service, and to take supervisory and enforcement action against financial services companies under the agency’s jurisdiction that fail to comply with federal consumer financial laws. Enforcement actions may include imposition of substantial monetary penalties and nonmonetary requirements. In recent years, the CFPB has been focused on enforcement actions and rulemakings aimed at eliminating or restricting a number of fees assessed by financial institutions such as overdraft and non-sufficient funds (“NSF”) fees as well as other transaction- and account management-related fees deemed by the CFPB to be “junk fees.” In response to this and other legislative and regulatory scrutiny, in January 2022, we announced an elimination of NSF fees and a decrease in overdraft fees. On December 12, 2024, the CFPB adopted its final overdraft rule, which requires institutions with more than $10 billion in assets to (i) cap their overdraft fee at $5, (ii) cap their fee at an amount that covers costs and losses, or (iii) treat overdraft lending the same as other loans and comply with the standard legal and regulatory requirements that govern other consumer loans, like credit cards, with account disclosures, periodic statements, and autopay options. The compliance date for the rule is October 1, 2025. On December 16, 2024, several trade groups filed a lawsuit in federal court against the CFPB challenging the statutory authority of the agency to adopt the rule. On February 8, 2025, the acting director of the CFPB issued a notice to staff to cease all supervision and examination activity. We continue to monitor the impacts of the change in political environment on the CFPB as a result of the Trump administration and makeup of Congress, the status of the lawsuit, and prepare for compliance with the rule.

FCB, as a state-chartered bank, is also subject to state consumer protection laws in the states in which it operates, and the Dodd-Frank Act enhanced the ability of state attorneys general to enforce federal consumer protection laws.

Privacy, Data Protection, and Cybersecurity

BancShares is subject to a number of federal, state, local and foreign laws and regulations relating to consumer privacy and data protection. These laws include certain portions of the GLBA, the federal banking agencies’ Computer-Security Incident Notification rule (the “36 Hour Rule”), the SEC’s item for cybersecurity incidents Current Report on Form 8-K (“Cybersecurity Form 8-K Item”), the California Consumer Privacy Act of 2018 (the “CCPA”), and the New York Department of Financial Services’ (“NYDFS”) 2017 cybersecurity regulation (the “NY Cybersecurity Regulation”).

These laws govern the collection, sharing, use, disclosure and protection of personal information, the intent of which is to increase transparency related to how personal information is processed, choices individuals have to control how their information is used and to protect the privacy of such information. The GLBA and its implementing regulations and guidance limit the ability of financial institutions to disclose certain non-public information about consumers to nonaffiliated third parties, and further require financial institutions to notify consumers of their privacy policies and practices, allow consumers to prevent disclosure of certain personal information to a nonaffiliated third-party in some cases, implement appropriate safeguards to their customers’ nonpublic, personal information, and, in some instances, notify regulators and/or customers in the event of a data breach under applicable laws. The 36 Hour Rule requires that banking organizations notify their primary federal regulator as soon as possible and no later than 36 hours after the discovery of a computer-security incident that rises to the level of a notification incident under the rule, and that bank service providers notify any affected bank to which, or on behalf of which, the service provider provides services as soon as possible after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for as much as four hours. The Cybersecurity Form 8-K Item generally requires that public companies disclose a material cybersecurity incident on a Current Report on Form 8-K within four days of management’s determination that the incident is material. The CCPA provides for enhanced individual privacy rights and imposes increased obligations on companies handling personal information, and the NY Cybersecurity Regulation requires financial institutions regulated by NYDFS to, among other things, implement certain cybersecurity controls and make reports to NYDFS upon the occurrence of certain cybersecurity events.

In addition, on October 22, 2024, the CFPB adopted its final rule for Personal Financial Data Rights, commonly known as the “Open Banking” rule, designed to facilitate the transfer of customer information at the direction of the customer to other financial institutions. This rule requires financial institutions to make consumers’ data available upon their request and without charge to other authorized financial institutions or other third parties in a secure and reliable manner and defines obligations for those third parties accessing consumers’ data, including privacy protections.

In addition to the foregoing, federal banking agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of the board of directors. These guidelines and related regulatory materials increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services. Under SEC rules, companies also must provide enhanced disclosures in their Annual Reports on Form 10-K with respect to cybersecurity risk assessment and management, strategy and governance, including disclosures regarding management’s role in overseeing the public company’s cybersecurity risk management and compliance program. Refer to Item 1C. Cybersecurity for additional information.

The U.S. Congress, federal and state regulators, as well as regulators outside the United States, have implemented or are considering implementing data protection laws or regulations, which could create new individual privacy rights and impose increased obligations on companies handling personal information, impacting our data security- and privacy-related internal controls and risk profile. For example, in Europe and in the United Kingdom, both the EU General Data Protection Regulation and the UK General Data Protection Regulation impose extensive obligations on companies that process personal data of individuals in Europe, with the potential for significant fines for non-compliance (up to 4% of total annual worldwide revenue). Some of its requirements include prompt notice of data breaches, in certain circumstances, to affected individuals and supervisory authorities.

Climate

BancShares is subject to a number of laws relating to climate, among those being the federal banking agencies’ Principles for Climate-Related Financial Risk Management for LFIs (the “CRFR Banking Principles”) and California’s Climate Corporate Data Accountability Act (the “California CCDAA”) and Climate-Related Financial Risk Act (the “California CFRA”). The CRFR Banking Principles provide a high-level framework for the safe and sound management of exposures to climate-related financial risks, including physical and transition risks associated with climate change, and cover governance; policies, procedures, and limits; strategic planning; risk management; data, risk measurement, and reporting; and scenario analysis. The California CCDAA requires annual public disclosure of scope 1, 2, and 3 greenhouse gas emissions, with scope 1 and 2 reporting required in 2026 and scope 3 in 2027, and the California CRFRA requires biennial public disclosure of climate-related financial risks, with the first disclosure required by January 1, 2026. New York is considering a law similar to the California CRFRA.

Compensation

Our compensation practices are subject to oversight by the federal banking agencies, Nasdaq, and, with respect to some of our subsidiaries, by other financial regulatory agencies. The federal banking agencies have issued joint guidance on executive compensation designed to ensure that the incentive compensation policies of banking organizations take into account risk factors and are consistent with the safety and soundness of the organization. The guidance also provides that supervisory findings with respect to incentive compensation will be incorporated into the organization’s supervisory ratings, which can affect its ability to make acquisitions or other corporate decisions. The guidance further provides that the agencies may pursue enforcement actions against a banking organization if its incentive compensation and related risk management, control or governance processes pose a risk to the organization’s safe and sound practices. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness, and the organization is not taking prompt and effective measures to correct the deficiencies. Pursuant to SEC rules and the listing standards of the Nasdaq mandated by the Dodd-Frank Act, Nasdaq listed companies are required to (i) adopt and implement a compliant incentive compensation clawback policy; (ii) file the clawback policy as an exhibit to their annual reports; and (iii) provide certain disclosures relating to any compensation recovery triggered by the clawback policy. Our clawback policy is filed as Exhibit 97 to this Annual Report on Form 10-K. In addition, the Dodd-Frank Act requires the federal banking agencies and the SEC to issue regulations requiring covered financial institutions to prohibit incentive compensation arrangements that encourage inappropriate risks by providing compensation that is excessive or that could lead to material financial loss to the institution. On May 6, 2024, the FDIC, the OCC and the Federal Housing Finance Agency issued a notice of proposed rulemaking (“NPR”) to address incentive-based compensation arrangements. The proposed rule includes general qualitative requirements aimed at making incentive-compensation arrangements more sensitive to risk that are applicable to all covered financial institutions, as well as additional requirements for financial institutions with total consolidated assets of $50 billion or more. The prospects and timing for the adoption of the proposed rule remain uncertain because both the Federal Reserve and the SEC have not joined the proposal.

Artificial Intelligence

We are subject to regulation of our business and operations, including risk management, with respect to artificial intelligence (“AI”). In 2023, the Biden Administration issued an Executive Order on Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (“Executive Order 14110”) that required certain federal agencies, including the CFPB, to address potential discrimination in the housing and consumer financial markets relating to the use by financial institutions of AI technologies. On June 24, 2024, the CFPB along with the federal banking agencies, the National Credit Union Administration, and the Federal Housing Finance Agency, adopted a final rule on Quality Control Standards for Automated Valuation Models to address the use of algorithms and AI in estimating home values. The final rule implements quality control standards mandated by the Dodd-Frank Act for the use of automated valuation models by mortgage originators and secondary market issuers in determining the collateral worth of a mortgage secured by a consumer’s principal dwelling.

In addition, on March 27, 2024, the U.S. Treasury released a report that cautioned financial institutions like us to be aware of the special vulnerabilities of AI-based tools and the novel capacities that AI grants to threat actors seeking to carry out targeted cyberattacks against financial institutions. On September 23, 2024, the DOJ updated its guidance to federal prosecutors in conducting an investigation of a corporation related to the evaluation of corporate compliance programs, including an expectation that companies will have conducted a risk assessment regarding the use of new technologies like AI and taken appropriate steps to mitigate related risk. On January 20, 2025, President Trump revoked Executive Order 14110, and on January 23, 2025, President Trump issued an Executive Order on Removing Barriers to American Leadership in Artificial Intelligence, and mandating the review of policies, directives, regulations, orders and other actions taken pursuant to the revoked Executive Order 14110.

States are actively regulating the use of AI technologies, including initiatives from the California Privacy Protection Agency and the NYDFS. We continue to monitor and evaluate proposals related to AI regulation and assess their potential impact.

Other Regulated Subsidiaries

BancShares’ broker-dealer and registered investment adviser subsidiaries are regulated by the SEC and, with respect to broker-dealers, by the Financial Industry Regulatory Authority (“FINRA”). The broker-dealer and investment adviser subsidiaries also are subject to additional regulation by states and local jurisdictions. The SEC and FINRA have active enforcement functions that oversee broker-dealers and investment advisers and can bring actions that result in fines, restitution, a limitation on permitted activities, disqualification to continue to conduct certain activities and an inability to rely on certain favorable exemptions. Certain types of infractions and violations also can affect the ability to issue new securities expeditiously. In addition, certain changes in the activities of a broker-dealer require approval from FINRA, and FINRA takes into account a variety of considerations in acting upon applications for such approval, including internal controls, capital levels, management experience and quality, prior enforcement and disciplinary history, and supervisory concerns.

BancShares’ insurance activities are subject to licensing and regulation by state insurance regulatory agencies. Insurance regulatory authorities generally have broad administrative powers with respect to, among other things: licensing companies and agents to transact business; establishing statutory capital and reserve requirements and the solvency standards that must be met and maintained; regulating certain premium rates; reviewing and approving policy forms; regulating unfair trade and claims practices, including through the imposition of restrictions on marketing and sales practices, distribution arrangements and payment of inducements; approving changes in control of insurance companies; restricting the payment of dividends and other transactions between affiliates; and regulating the types, amounts and valuation of investments. Our Vermont insurance captive subsidiary is required to file reports, generally including detailed annual financial statements, with the insurance regulatory authority, and its operations and accounts are subject to periodic examination by such authorities.

BancShares’ equipment financing and leasing operations are subject to laws, rules, and regulations administered by authorities in jurisdictions where business is conducted. In the United States, equipment financing and leasing operations are subject to rules and regulations relating to health, safety, operations, maintenance, and mechanical standards promulgated by federal and state agencies and industry organizations.

In connection with its Rail segment, BancShares’ maintains a wholly owned subsidiary, FC International, which is a corporation chartered by the Federal Reserve pursuant to Section 25A of the Federal Reserve Act (“Edge Act”). Edge Act corporations are banking organizations that are authorized to engage in international banking and foreign financial transactions, and the U.S. activities of such corporations are generally limited to those that are incidental to their foreign operations. FC International holds equity interests in foreign companies that support our Rail segment. FC International is subject to supervision and regulation by the Federal Reserve, including examination, reporting, capital, and the BSA and AML requirements pursuant to the Edge Act and the Federal Reserve’s Regulation K.

Impact of Presidential and Congressional Elections on Recent Rulemaking

Control of the White House and the U.S. Congress shifted to the Republican Party in January 2025 as a result of the recent presidential and congressional elections. President Trump and many Republican members of Congress have advocated for a significant reduction of financial services regulation, potentially including amendments to the Dodd-Frank Act and other federal banking laws, and structural changes to regulatory agencies. Consequently, Congress and/or the relevant federal agencies may seek to roll back or modify some or much of the rulemaking and regulatory guidance issued under the Biden administration, particularly the actions taken in the past year. Notably, the CFPB announced the appointment of a new acting director as of February 7, 2025, and instructed employees to “cease all supervision and examination activity” as of February 8, 2025. Further, a change in the leadership of the FDIC and OCC is expected under the Trump administration; however, the timing and impact of any future changes in leadership on the regulatory, enforcement, and supervisory priorities of each agency is uncertain at this time. We will continue to closely monitor developments and changes to the regulatory agencies.

Available Information

We make available on our investor relations website (ir.firstcitizens.com) BancShares’ Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to those reports, free of charge, as soon as reasonably practicable after they are electronically filed with or furnished to the SEC. Interested parties may also directly access the SEC’s website (www.sec.gov), which contains reports, proxy and information statements and other information electronically filed by BancShares. Except as specifically incorporated by reference into this Annual Report on Form 10-K, information on those websites is not part of this report.