FIRST CITIZENS BANCSHARES INC /DE/

EVALUATION OF DISCLOSURE CONTROLS AND PROCEDURES

Under the supervision of and with the participation of management, including our Chief Executive Officer and Chief Financial Officer, we evaluated the effectiveness of the design and operation of our disclosure controls and procedures, as such term is defined in Rule 13a-15(e) promulgated under the Exchange Act, as of the end of the period covered by this Annual Report on Form 10-K. Based on such evaluation, our Chief Executive Officer and Chief Financial Officer concluded that our disclosure controls and procedures were effective to provide reasonable assurance that we are able to record, process, summarize and report in a timely manner the information required to be disclosed in the reports we file under the Exchange Act.

CHANGES IN INTERNAL CONTROL OVER FINANCIAL REPORTING

We review our internal controls over financial reporting on an ongoing basis and make changes intended to ensure the quality of our financial reporting. There were no changes in our internal control over financial reporting during the fourth quarter of 2025 that have materially affected, or are reasonably likely to materially affect, BancShares’ internal control over financial reporting.

MANAGEMENT’S ANNUAL REPORT ON INTERNAL CONTROL OVER FINANCIAL REPORTING

The management of BancShares is responsible for establishing and maintaining adequate internal control over financial reporting. BancShares’ internal control system was designed to provide reasonable assurance to BancShares’ management and the Board regarding the preparation and fair presentation of published financial statements.

BancShares’ management assessed the effectiveness of BancShares’ internal control over financial reporting as of December 31, 2025. In making this assessment, it used the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission in Internal Control-Integrated Framework (2013). Based on that assessment, BancShares’ management believes, as of December 31, 2025, BancShares’ internal control over financial reporting is effective. All internal control systems, no matter how well designed, have inherent limitations. Therefore, even those systems determined to be effective can provide only reasonable assurance with respect to financial statement preparation and presentation. A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis. A significant deficiency is a control deficiency, or combination of control deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company’s financial reporting. A material weakness in internal control over financial reporting is a control deficiency, or combination of control deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of a company’s annual or interim financial statements will not be prevented or detected on a timely basis.

BancShares’ independent registered public accounting firm has issued an audit report on BancShares’ internal control over financial reporting. This report appears under “Report of Independent Registered Public Accounting Firm on Internal Control over Financial Reporting” in Item 8. Financial Statements and Supplementary Data.