WAFD INC

USA Patriot Act of 2001. The USA PATRIOT Act of 2001 ("Patriot Act"), through amendments to the federal Bank Secrecy Act (“BSA”), substantially broadened the scope of United States anti money-laundering laws and regulations by imposing significant new compliance and due diligence obligations, creating new crimes and penalties and expanding the extra-territorial scope of United States jurisdiction. The United States Treasury Department has issued a number of regulations under the Patriot Act that apply to financial institutions such as the Bank. These regulations impose obligations on financial institutions to maintain appropriate policies, procedures and controls to detect, prevent and report money laundering and terrorist financing and to verify the identity of their customers. Failure of a financial institution to maintain and implement adequate risk-based programs reasonably designed to combat money laundering and terrorist financing, or to comply satisfactorily with all relevant Patriot Act and BSA requirements, could have serious legal and reputational consequences for the institution.

Anti-Money Laundering Act of 2020. The Anti-Money Laundering Act of 2020 (“AML Act”) was enacted as part of the National Defense Authorization Act and requires the U.S. Treasury Department to issue National Anti-Money Laundering and

Countering the Financing of Terrorism Priorities ("AML/CFT"), which occurred in June 2021. The AML Act also includes a requirement to conduct studies and issue regulations that may alter some of the due diligence, recordkeeping and reporting requirements that the BSA and Patriot Act impose on financial institutions. The AML Act also promotes increased information-sharing and use of technology and increases penalties for violations of the BSA and includes whistleblower incentives, both of which could increase the prospect of regulatory enforcement.

Regulatory Capital Requirements. Bank holding companies and federally insured banks are required to maintain minimum levels of regulatory capital. The Federal Reserve establishes capital standards applicable to all bank holding companies, and the WDFI and FDIC establish capital standards applicable to Washington state chartered, non-member banks. The capital rules reflect, in part, certain standards initially adopted by the Basel Committee on Banking Supervision in December 2010 (which standards are commonly referred to as “Basel III”) as well as requirements contemplated by the Dodd-Frank Act.

The capital rules require a capital ratio of common equity Tier 1 capital to risk based assets. Common equity Tier 1 capital generally consists of retained earnings and common stock instruments (subject to certain adjustments) as well as accumulated other comprehensive income (“AOCI”) except to the extent that the Company and the Bank exercise a one-time irrevocable option to exclude certain components of AOCI, which the Company and the Bank have done. Tier 1 capital also includes non-cumulative perpetual preferred stock and limited amounts of minority interests. Regulatory deductions from capital include goodwill and intangible assets. The capital rules prescribe the manner in which certain capital elements are determined, including but not limited to, requiring certain deductions related to mortgage servicing rights and deferred tax assets. Total capital consists of Tier 1 capital and supplementary capital. Supplementary capital consists of certain capital instruments that do not qualify as core capital as well as general valuation loan and lease loss allowances up to a maximum of 1.25% of risk-weighted assets. Supplementary capital may be used to satisfy the risk-based requirement only in an amount equal to the amount of Tier 1 capital.

In determining the required amount of risk-based capital, total assets, including certain off-balance-sheet items, are multiplied by a risk-weight factor based on the risks inherent in the type of assets held by an institution. The risk categories range from 0% for low-risk assets such as U.S. Treasury securities and GNMA securities to 1,250% for various types of loans and other assets deemed to be of higher risk. Single-family residential loans having loan-to-value ratios not exceeding 90% and meeting certain additional criteria, as well as certain multi-family residential loans, qualify for a 50% risk-weight treatment. The book value of each asset is multiplied by the risk factor applicable to the asset category, and the sum of the products of this calculation equals total risk-weighted assets. The rules set forth the methods of calculating certain risk-based assets, which in turn affects the calculation of risk-based ratios. Higher or more sensitive risk weights are assigned to various categories of assets, among which are commercial real estate, credit facilities that finance the acquisition, development or construction of real property, certain exposures or credit that are 90 days past due or are non-accrual, foreign exposures, certain corporate exposures, securitization exposures, equity exposures and in certain cases mortgage servicing rights and deferred tax assets.

Both the Company and the Bank are required to have a common equity Tier 1 capital ratio of 4.5%. In addition, both the Company and the Bank are required to have a Tier 1 leverage ratio of 4.0%, a Tier 1 risk-based ratio of 6.0% and a total risk-based ratio of 8.0%. Both the Company and the Bank are required to establish a “conservation buffer,” consisting of common equity Tier 1 capital, equal to 2.5%. The capital conservation buffer is designed to ensure that banks build up capital buffers outside periods of stress, which can be drawn down as losses are incurred. An institution that does not meet the conservation buffer will be subject to restrictions on certain activities including payment of dividends, stock repurchases and discretionary bonuses to executive officers.

The Federal Reserve and the FDIC are also authorized to impose capital requirements in excess of these standards on individual institutions on a case-by-case basis. Management believes that the current capital levels of the Company and the Bank are sufficient to be in compliance with the fully phased-in standards under the rules.

Any bank holding company or bank that fails to meet the capital requirements is subject to possible enforcement actions. Such actions could include a capital directive, a cease and desist or consent order, civil money penalties, restrictions on an institution's operations and/or the appointment of a conservator or receiver. FRB, FDIC and WDFI capital regulations provide that such supervisory actions, through enforcement proceedings or otherwise, could require one or more of a variety of corrective actions.

For information regarding compliance with each of these capital requirements by the Company and the Bank as of September 30, 2024, see Note R to the Consolidated Financial Statements included in Item 8 hereof.

Prompt Corrective Action. Federal statutes establish a supervisory framework based on five capital categories: well capitalized, adequately capitalized, undercapitalized, significantly undercapitalized and critically undercapitalized. An institution’s category depends upon its capital levels in relation to relevant capital measures, which include a risk-based capital measure, a leverage ratio capital measure and certain other factors. The federal banking agencies have adopted regulations that implement this statutory framework.

The prompt corrective action rules, which apply to the Bank but not the Company, are modified to include a common equity Tier 1 risk-based ratio and to increase certain other capital requirements for the various thresholds. For example, the requirements for the Bank to be considered well-capitalized under the rules are a 5.0% Tier 1 leverage ratio, a 6.5% common equity Tier 1 risk-based ratio, an 8.0% Tier 1 risk-based capital ratio and a 10.0% total risk-based capital ratio. To be adequately capitalized, those ratios are 4.0%, 4.5%. 6.0% and 8.0%, respectively.

An institution that is not well capitalized is subject to certain restrictions on brokered deposits, including restrictions on the rates it can offer on its deposits, generally. Any institution that is neither well capitalized nor adequately capitalized is considered undercapitalized. Federal law authorizes the FDIC to reclassify a well-capitalized institution as adequately capitalized and may require an adequately capitalized institution or an undercapitalized institution to comply with supervisory actions as if it were in the next lower category. The FDIC may not reclassify a significantly undercapitalized institution as critically undercapitalized. As of September 30, 2024, the Bank exceeded the requirements of a well-capitalized institution.

Dodd-Frank Act Stress Tests ("DFAST"). On July 6, 2018, bank regulatory agencies (the FRB, FDIC and the Office of the Comptroller of the Currency) issued a joint interagency statement regarding the impact of the Economic Growth, Regulatory Relief, and Consumer Protection Act ("EGRRCPA") on financial institutions. The EGRRCPA gave immediate relief from stress testing for applicable bank holding companies but not financial institutions until November 25, 2019. Pursuant to direction from the Bank's regulators, the Bank was provided similar relief and is no longer required to submit company-run annual stress tests. Notwithstanding these amendments to the stress testing requirements, the federal banking agencies indicated through interagency guidance that the capital planning and risk management practices of institutions with total assets less than $100 billion would continue to be reviewed through the regular supervisory process. Although the Bank will continue to monitor its capital consistent with the safety and soundness expectations of the federal regulators, the Bank will no longer conduct company-run stress testing as a result of the legislative and regulatory amendments. The Bank continues to use customized stress testing to support the business and as part of its risk management and capital planning process.

EGRRCPA also enacted several important changes in some technical compliance areas that we believe will help reduce our regulatory burden, including:

•Prohibiting federal banking regulators from imposing higher capital standards on High Volatility Commercial Real Estate (“HVCRE”) exposures unless they are for acquisition, development or construction (“ADC”), and clarifying ADC status;

•Exempting from appraisal requirements certain transactions involving real property in rural areas and valued at less than $400,000; and

•Directing the Consumer Financial Protection Bureau to provide guidance on the applicability of the Truth in Lending and Real Estate Settlement Procedures Act Integrated Disclosure rule to mortgage assumption transactions and construction-to-permanent home loans, as well the extent to which lenders can rely on model disclosures that do not reflect recent regulatory changes.

Despite the improvements for mid-size financial institutions such as the Company that has resulted from EGRRCPA, many provisions of the Dodd-Frank Act and its implementing regulations remain in place and will continue to result in additional operating and compliance costs that could have a material adverse effect on our business, financial condition, and results of operation. In addition, the EGRRCPA requires the enactment of a number of implementing regulations, the details of which may have a material effect on the ultimate impact of the law.

Cybersecurity. The federal banking agencies have established certain expectations with respect to an institution's information security and cybersecurity programs, with an increasing focus on risk management, processes related to information technology and operational resiliency, and the use of third parties in the provision of financial services. In January 2020, the federal banking agencies jointly issued a statement reminding supervised financial institutions of sound cybersecurity risk management principles that expanded on areas articulated in the Interagency Guidelines Establishing Information Security Standards written in Section 39 of the Federal Deposit Insurance Act and Sections 501 and 505(b) of the Gramm-Leach-Bliley Act.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments in the states in which the Company operates.

In November 2021, the U.S. federal bank regulatory agencies adopted a rule regarding notification requirements for banking organizations related to significant computer security incidents. Under the final rule, a bank holding company, such as the Company, and an FDIC-supervised insured depository institution, such as the Bank, are required to notify the Federal Reserve or FDIC, respectively, within 36 hours of incidents that have materially disrupted or degraded, or are reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. Service providers are required under the rule to notify any affected bank client it provides services to as soon as possible when it determines it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided by that entity to the Bank for four or more hours.

See Item 1C - Cybersecurity, for additional disclosures regarding the Company's cybersecurity risk management, strategy and governance.

Financial Privacy. Under the Gramm-Leach-Bliley Act of 1999, as amended, a financial institution may not disclose non-public personal information about a consumer to unaffiliated third parties unless the institution satisfies various disclosure requirements and the consumer has not elected to opt out of the information sharing. The financial institution must provide its customers with a notice of its privacy policies and practices. The Federal Reserve, the FDIC, and other financial regulatory agencies issued regulations implementing notice requirements and restrictions on a financial institution's ability to disclose non-public personal information about consumers to unaffiliated third parties.

In addition, privacy and data protection are areas of increasing state legislative focus, and several states have recently enacted consumer privacy laws that impose significant compliance obligations with respect to personal information. For example, the Company is subject to the California Consumer Privacy Act (“CCPA”) and its implementing regulations. The CCPA gives consumers the right to request disclosure of information collected about them, and whether that information has been sold or shared with others, the right to request deletion of personal information (subject to certain exceptions), the right to opt out of the sale of the consumer’s personal information, and the right not to be discriminated against for exercising these rights. The CCPA contains several exemptions, including an exemption applicable to information that is collected, processed, sold, or disclosed pursuant to the Gramm-Leach-Bliley Act of 1999, as amended. In November 2020, voters in the state of California approved the California Privacy Rights Act (“CPRA”), a ballot measure that amends and supplements the substantive requirements of the CCPA by, among other things, expanding certain rights relating to personal information and its use, collection, and disclosure by covered businesses and providing certain mechanisms for administration and enforcement of the statue by creating the California Privacy Protection Agency, a watchdog privacy agency. Similar laws may in the future be adopted by other states where the Company does business. The Company has made and will make operational adjustments in accordance with the requirements of the CCPA and other state privacy laws.

Furthermore, privacy and data protection areas are expected to receive further attention at the federal level. Congress and federal regulatory agencies are considering similar laws or regulations that could create new individual privacy rights and impose increased obligations on companies handling personal data. On April 1, 2022, the federal banking agencies’ new rule became effective, providing for new notification requirements for banking organizations and their service providers for significant cybersecurity incidents. Specifically, the new rule requires banking organizations to notify their primary federal regulator as soon as possible, and no later than 36 hours after, the discovery of a computer-security incident that rises to the level of a notification incident as defined by the rule. Notification is required for incidents that have materially affected or are reasonably likely to materially affect the viability of a banking organization’s operations, its ability to deliver banking products and services, or the stability of the financial sector. Service providers are required under the rule to notify any affected bank to which it provides services as soon as possible when it determines it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided by that entity to the bank for four or more hours. The potential effects of state or federal privacy and data protection laws on the Company’s business cannot be determined at this time and will depend both on whether such laws are adopted by states in which the Company does business and/or at the federal level and the requirements imposed by any such laws.

Taxation

In addition to federal income tax, the Company is also subject to income, franchise, excise or gross receipts tax in states (and some cities) where the Company has branches or is deemed to have sufficient nexus for tax purposes. The Company generally files consolidated federal and state income tax returns with its subsidiaries.

The Company's federal income tax returns are open and subject to potential examination by the IRS for fiscal year 2021 and later.

Competition

We operate in a highly competitive environment. Our competitors include other banks, savings associations, community banks, credit unions, fintech companies and other financial intermediaries, and new market participants offering services similar to those that we offer. We compete with some competitors within our geographic market area, and with others on a product specific basis, such as the residential mortgage market. Our ability to compete effectively depends on our ability to provide first-rate, friendly and professional customer service and deliver the banking solutions that our customers want and need. We are also dependent upon our ability to attract and retain employees while managing compensation and other costs.

Availability of Financial Data

Under the Securities Exchange Act of 1934 ("Exchange Act"), the Company is required to file annual, quarterly and current reports, proxy statements and other information with the SEC. We file reports on Forms 10-K, 10-Q and 8-K, and amendments to those reports, with the SEC. The public may obtain copies of these reports at the SEC's website: www.sec.gov.

The Company has adopted and posted on its website a code of ethics that applies to its senior financial officers. The Company’s website also includes the charters for its audit committee, compensation committee, risk management committee, executive committee, technology committee and nominating and governance committee.

The address for the Company’s website is www.wafdbank.com. The Company makes available on its website, free of charge, its annual reports on Form 10-K, current quarterly reports on Form 10-Q, reports on Form 8-K, proxy statements and any amendments to those reports (among others), as soon as reasonably practicable after we electronically file such material with, or furnish it to, the Securities and Exchange Commission (SEC). We also make available on our website public financial information for which a report is not required to be filed with or furnished to the SEC. Our SEC reports and such other information can be accessed through the investor relations section of our website (https://www.wafdbank.com/about-us/investor-relations). The Company’s website provides a link to all our filings on the SEC’s Edgar website, and the company will provide a printed copy of any of our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, proxy statements and any amendments to those reports (among others) to any requesting shareholder, free of charge. The information found on our website is not part of this or any other report that we file or furnish to the SEC.