PARK NATIONAL CORP /OH/

In March 2015, federal regulators issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish several lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the financial institution’s operations after a cybersecurity attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the financial institution or its critical service providers fall victim to this type of cybersecurity attack. If Park National Bank fails to observe the regulatory guidance, it could be subject to various regulatory sanctions, including financial penalties.

In November 2021, the OCC, the Federal Reserve Board and the FDIC issued a final rule that became effective in May 2022, requiring banking organizations that experience a computer-security incident to notify certain entities. A computer-security incident occurs when actual or potential harm to the confidentiality, integrity or availability of an information system or the information occurs, or there is a violation or imminent threat of a violation to banking security policies and procedures. The affected bank must notify its respective federal regulator of the computer-security incident as soon as possible and no later than 36 hours after the bank determines a computer-security incident that rises to the level of a notification incident has occurred. These notifications are intended to promote early awareness of threats to banking organizations and will help banks react to those threats before they manifest into larger incidents. This rule also requires bank service providers to notify their bank organization customers of a computer-security incident that has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours.

On July 26, 2023, the SEC adopted final rules that require public companies to promptly disclose material cybersecurity incidents in a Current Report on Form 8-K and detailed information regarding their cybersecurity risk management, strategy, and governance on an annual basis in an Annual Report on Form 10-K. Companies are required to report on Form 8-K any cybersecurity incident they determine to be material within four business days of making that determination. See “ITEM 1C CYBERSECURITY”. These SEC rules, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations

Furthermore, once final rules are adopted, the Cyber Incident Reporting for Critical Infrastructure Act, enacted in March 2022, will require certain covered entities to report a covered cyber incident to the U.S. Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency (“CISA”) within 72 hours after a covered entity reasonably believes an incident has occurred. Separate reporting to CISA will also be required within 24 hours if a ransom payment is made as a result of a ransomware attack.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. Park expects this trend of state-level activity in those areas to continue, and continues to monitor developments in the states in which our customers are located.

In the ordinary course of business, Park relies on electronic communications and information systems to conduct its operations and to store sensitive data. Park employs an in-depth, layered, defensive approach that leverages people, processes, encryption and multi-factor authentication technology to manage and maintain cybersecurity controls. Park employs a variety of preventative and detective tools to monitor, block and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of Park’s defensive measures, the threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date, Park has not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, Park’s systems and those of its customers and third-party service providers are under constant threat and it is possible that Park could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these

-15- threats, as well as due to the expanding use of internet banking, mobile banking and other technology-based products and services by us and our customers. See “ITEM 1A. RISK FACTORS” for a further discussion of risks related to cybersecurity.

Anti-Money Laundering and the Patriot Act

A major focus of governmental policy on financial institutions in recent years has been aimed at combating money laundering and terrorist financing. The Uniting and Strengthening of America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001, as amended (the “Patriot Act”), substantially broadened the scope of U.S. anti-money laundering laws and regulations by imposing significant new compliance and due diligence obligations, creating new crimes and penalties and expanding the extra-territorial jurisdiction of the U.S. The Patriot Act gives the U.S. government powers to address terrorist threats through enhanced domestic security measures, expanded surveillance powers, increased information sharing and broadened anti-money laundering requirements. Title III of the Patriot Act encourages information sharing among bank regulatory agencies and law enforcement bodies. Further, certain provisions of Title III impose affirmative obligations on a broad range of financial institutions. Among other requirements, Title III and related regulations require regulated financial institutions to establish a program specifying procedures for obtaining identifying information from customers seeking to open new accounts and establish enhanced due diligence policies, procedures and controls designed to detect and report suspicious activity. Park National Bank has established policies and procedures that Park National Bank believes comply with the requirements of the Patriot Act.

The Anti-Money Laundering Act of 2020 (the "AMLA"), which amends the Bank Secrecy Act of 1970 (the "BSA"), was enacted in January 2021. The AMLA is intended to be a comprehensive reform and modernization to U.S. bank secrecy and anti-money laundering laws. Among other things, it codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the development of standards for evaluating technology and internal processes for BSA compliance; and expands enforcement-related and investigation-related authority, including increasing available sanctions for certain BSA violations and instituting BSA whistleblower initiatives and protections.

Office of Foreign Assets Control Regulation

The U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”) administers and enforces economic and trade sanctions against targeted foreign countries and regimes, under authority of various laws, including designated foreign countries, nationals and others. OFAC publishes lists of specially designated targets and countries. Park is responsible for, among other things, blocking accounts of, and transactions with, such targets and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence. Failure to comply with these sanctions could have serious financial, legal and reputational consequences, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required. Regulatory authorities have imposed cease and desist orders and civil money penalties against institutions found to be violating these obligations.

Community Reinvestment Act

The CRA requires Park National Bank's primary federal regulatory agency, the OCC, to assess Park National Bank's record in meeting the credit needs of the communities served by Park National Bank consistent with safe and sound banking practice. Under the CRA, each depository institution is required to help meet the credit needs of its market area by, among other things, providing credit to low-income and moderate-income individuals and communities. Depository institutions are periodically examined for compliance with the CRA and are assigned ratings that must be publically disclosed. The OCC assigns one of four ratings: outstanding, satisfactory, needs to improve or substantial noncompliance. The rating assigned to a financial institution is considered in connection with various applications submitted by the financial institution or its holding company to its banking regulators, including applications to acquire another financial institution or to open or close a branch office. In addition, all subsidiary banks of a financial holding company must maintain a satisfactory or outstanding rating in order for the financial holding company to avoid limitations on its activities. Park National Bank received a rating of "satisfactory" in its latest CRA examination.

Corporate Governance

As mandated by the Sarbanes-Oxley Act of 2002, as amended, the SEC has adopted rules and regulations governing, among other issues, corporate governance, auditing and accounting, executive compensation and enhanced and timely disclosure of corporate information. NYSE American has also adopted corporate governance rules. The Board of Directors of Park has taken a series of actions to strengthen and improve Park’s already strong corporate governance practices in light of the rules of the SEC and NYSE American. The Board of Directors has adopted and annually reviews charters for the Audit

-16-

Committee, the Compensation Committee, the Executive Committee, the Nominating and Corporate Governance Committee (including as Exhibit A thereto, Corporate Governance Guidelines) and the Risk Committee, as well as a Code of Business Conduct and Ethics governing the directors, officers and associates of Park and Park's subsidiaries.

Executive and Incentive Compensation

The Dodd-Frank Act requires that the federal bank regulatory agencies, including the Federal Reserve Board and the OCC, establish joint regulations or guidelines related to incentive-based compensation. No final rule implementing this provision of the Dodd-Frank Act has, as of the date of the filing of this Annual Report on Form 10-K, been adopted, but a proposed rule was published in 2016, and again in 2024, that expanded upon a prior proposed rule published in 2011. The proposed rule is intended to: (i) prohibit incentive-based payment arrangements that the bank regulatory agencies determine could encourage certain financial institutions to take inappropriate risks by providing excessive compensation or that could lead to material financial loss; (ii) require the board of directors of those financial institutions to take certain oversight actions related to incentive-based compensation; and (iii) require those financial institutions to disclose information concerning incentive-based compensation arrangements to the appropriate federal regulator. Although a final rule has not been issued, Park and Park National Bank have undertaken efforts to ensure that their incentive compensation plans do not encourage inappropriate risks, consistent with the principles identified above.

In June 2010, the Federal Reserve Board, the OCC and the FDIC issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization's incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization's ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management and (iii) be supported by strong corporate governance, including active and effective oversight by the organization's board of directors. These three principles are incorporated into the proposed joint compensation regulations under the Dodd-Frank Act, described above.

The Federal Reserve Board and the OCC review, as part of their respective regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as Park and Park National Bank, that are not "large, complex banking organizations." These reviews are tailored to each organization based on the scope and complexity of the organization's activities and the prevalence of incentive compensation arrangements. Deficiencies will be incorporated into the organization's supervisory ratings, which can affect the organization's ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization's safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

Public company compensation committee members must meet heightened independence requirements and consider the independence of compensation consultants, legal counsel and other advisors to the compensation committee. A compensation committee must have the authority to hire advisors and the public company must fund the reasonable compensation of such advisors.

SEC regulations require public companies to provide various disclosures about executive compensation in annual reports and proxy statements and to present to their shareholders a non-binding vote on the approval of executive compensation.

Public companies are required to adopt and implement "clawback" policies for incentive compensation payments and to disclose the details of the procedures which allow recovery of incentive compensation that was paid on the basis of erroneous financial information necessitating an accounting restatement due to material noncompliance with financial reporting requirements. This clawback policy is intended to apply to compensation paid within the three completed fiscal years immediately preceding the date the issuer is required to prepare a restatement and would cover all executives (including former executives) who received incentive awards. Park has adopted and implemented a clawback policy.

Consumer Protection Laws and Regulations

Banks are subject to regular examination to ensure compliance with federal consumer protection statutes and regulations, including, but not limited to, the following:

•Equal Credit Opportunity Act (prohibiting discrimination in any credit transaction on the basis of any of various criteria)

-17-

•Truth in Lending Act (requiring that credit terms be disclosed in a manner that permits a consumer to understand and compare credit terms more readily and knowledgeably)

•Fair Housing Act (making it unlawful for a lender to discriminate in its housing-related lending activities against any person on the basis of certain criteria)

•Home Mortgage Disclosure Act (requiring financial institutions to collect data that enables regulatory agencies to determine whether financial institutions are serving the housing credit needs of the communities in which they are located)

•Real Estate Settlement Procedures Act (requiring that lenders provide borrowers with disclosures regarding the nature and cost of real estate settlements and prohibits abusive practices that increase borrowers' costs)

•Fair Credit Reporting Act (governing the provision of consumer information to credit reporting agencies and the use of consumer information)

•Fair Debt Collection Practices Act (governing the manner in which consumer debts may be collected by collection agencies)

•Truth in Savings Act (requiring disclosure of deposit terms to consumers)

•Electronic Funds Transfer Act (governing automatic deposits to and withdrawals from deposit accounts and customers' rights and liabilities arising from the use of ATMs and other electronic banking services)

The bank regulators also use their authority under the Federal Trade Commission Act to take supervisory or enforcement action with respect to unfair or deceptive acts or practices by banks that may not necessarily fall within the scope of a specific banking or consumer finance law.

Legislative and Regulatory Initiatives

From time to time, various legislative and regulatory initiatives are introduced in the U.S. Congress and state legislatures, as well as by regulatory agencies. Such initiatives may include proposals to expand or contract the powers of bank holding companies and depository institutions or proposals to substantially change the financial institution regulatory system. Such legislation could change banking statutes and the operating environment of Park and Park National Bank in substantial and unpredictable ways. If enacted, such legislation could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among banks, savings associations, credit unions and other financial institutions. Park cannot predict whether any such legislation will be enacted, and, if enacted, the effect that such legislation, or any implementing regulations, would have on the financial condition or results of operations of Park. A change in statutes, regulations or regulatory policies applicable to Park or any of Park's subsidiaries could have a material effect on Park's business, financial condition and results of operations.

Effect of Environmental Regulation

Compliance with federal, state and local provisions regulating the discharge of materials into the environment, or otherwise relating to the protection of the environment, has not had a material effect upon the capital expenditures, earnings or competitive position of Park and Park's subsidiaries. Park believes the nature of the operations of Park's subsidiaries has little, if any, environmental impact. As a result, Park, anticipates no material capital expenditures for environmental control facilities for Park's current fiscal year or for the foreseeable future.

Park believes its primary exposure to environmental risk is through the lending activities of Park's subsidiaries. In cases where management believes environmental risk potentially exists, Park’s subsidiaries mitigate their environmental risk exposures by requiring environmental site assessments at the time of loan origination to confirm collateral quality as to commercial real estate parcels posing higher than normal potential for environmental impact, as determined by reference to present and past uses of the subject property and adjacent sites. In addition, environmental assessments are typically required prior to any foreclosure activity involving non-residential real estate collateral.

-18-