WAFD INC

The USA PATRIOT Act of 2001 ("Patriot Act"), through amendments to the federal Bank Secrecy

Act (“BSA”), substantially broadened the scope of United States anti money-laundering laws and regulations by imposing

significant new compliance and due diligence obligations, creating new crimes and penalties and expanding the extra-territorial

scope of United States jurisdiction. The United States Treasury Department has issued a number of regulations under the Patriot

Act that apply to financial institutions such as the Bank. These regulations impose obligations on financial institutions to

maintain appropriate policies, procedures and controls to detect, prevent and report money laundering and terrorist financing

and to verify the identity of their customers. Failure of a financial institution to maintain and implement adequate risk-based

programs reasonably designed to combat money laundering and terrorist financing, or to comply satisfactorily with all relevant

Patriot Act and BSA requirements, could have serious legal and reputational consequences for the institution.

Anti-Money Laundering Act of 2020. The Anti-Money Laundering Act of 2020 (“AML Act”) was enacted as part of the

National Defense Authorization Act and requires the U.S. Treasury Department to issue National Anti-Money Laundering and

Countering the Financing of Terrorism Priorities ("AML/CFT"), which occurred in June 2021. The AML Act also includes a

requirement to conduct studies and issue regulations that may alter some of the due diligence, recordkeeping and reporting

requirements that the BSA and Patriot Act impose on financial institutions. The AML Act also promotes increased information-

sharing and use of technology and increases penalties for violations of the BSA and includes whistleblower incentives, both of

which could increase the prospect of regulatory enforcement.

Regulatory Capital Requirements. Bank holding companies and federally insured banks are required to maintain minimum

levels of regulatory capital. The Federal Reserve establishes capital standards applicable to all bank holding companies, and the

WDFI and FDIC establish capital standards applicable to Washington state chartered, non-member banks. The capital rules

reflect, in part, certain standards initially adopted by the Basel Committee on Banking Supervision in December 2010 (which

standards are commonly referred to as “Basel III”) as well as requirements contemplated by the Dodd-Frank Act.

The capital rules require a capital ratio of common equity Tier 1 capital to risk based assets. Common equity Tier 1 capital

generally consists of retained earnings and common stock instruments (subject to certain adjustments) as well as accumulated

other comprehensive income (“AOCI”) except to the extent that the Company and the Bank exercise a one-time irrevocable

option to exclude certain components of AOCI, which the Company and the Bank have done. Tier 1 capital also includes non-

cumulative perpetual preferred stock and limited amounts of minority interests. Regulatory deductions from capital include

goodwill and intangible assets. The capital rules prescribe the manner in which certain capital elements are determined,

including but not limited to, requiring certain deductions related to mortgage servicing rights and deferred tax assets. Total

capital consists of Tier 1 capital and supplementary capital. Supplementary capital consists of certain capital instruments that

do not qualify as core capital as well as general valuation loan and lease loss allowances up to a maximum of 1.25% of risk-

weighted assets. Supplementary capital may be used to satisfy the risk-based requirement only in an amount equal to the

amount of Tier 1 capital.

In determining the required amount of risk-based capital, total assets, including certain off-balance-sheet items, are

multiplied by a risk-weight factor based on the risks inherent in the type of assets held by an institution. The risk categories

range from 0% for low-risk assets such as U.S. Treasury securities and GNMA securities to 1,250% for various types of loans

and other assets deemed to be of higher risk. Single-family residential loans having loan-to-value ratios not exceeding 90% and

meeting certain additional criteria, as well as certain multi-family residential loans, qualify for a 50% risk-weight treatment.

The book value of each asset is multiplied by the risk factor applicable to the asset category, and the sum of the products of this

calculation equals total risk-weighted assets. The rules set forth the methods of calculating certain risk-based assets, which in

turn affects the calculation of risk-based ratios. Higher or more sensitive risk weights are assigned to various categories of

assets, among which are commercial real estate, credit facilities that finance the acquisition, development or construction of real

property, certain exposures or credit that are 90 days past due or are non-accrual, foreign exposures, certain corporate

exposures, securitization exposures, equity exposures and in certain cases mortgage servicing rights and deferred tax assets.

Both the Company and the Bank are required to have a common equity Tier 1 capital ratio of 4.5%. In addition, both the

Company and the Bank are required to have a Tier 1 leverage ratio of 4.0%, a Tier 1 risk-based ratio of 6.0% and a total risk-

based ratio of 8.0%. Both the Company and the Bank are required to establish a “conservation buffer,” consisting of common

equity Tier 1 capital, equal to 2.5%. The capital conservation buffer is designed to ensure that banks build up capital buffers

outside periods of stress, which can be drawn down as losses are incurred. An institution that does not meet the conservation

buffer will be subject to restrictions on certain activities including payment of dividends, stock repurchases and discretionary

bonuses to executive officers.

The Federal Reserve and the FDIC are also authorized to impose capital requirements in excess of these standards on

individual institutions on a case-by-case basis. Management believes that the current capital levels of the Company and the

Bank are sufficient to be in compliance with the fully phased-in standards under the rules.

Any bank holding company or bank that fails to meet the capital requirements is subject to possible enforcement actions.

Such actions could include a capital directive, a cease and desist or consent order, civil money penalties, restrictions on an

institution's operations and/or the appointment of a conservator or receiver. FRB, FDIC and WDFI capital regulations provide

that such supervisory actions, through enforcement proceedings or otherwise, could require one or more of a variety of

corrective actions.

For information regarding compliance with each of these capital requirements by the Company and the Bank as of

September 30, 2025, see Note R to the Consolidated Financial Statements included in Item 8 hereof.

Prompt Corrective Action. Federal statutes establish a supervisory framework based on five capital categories: well

capitalized, adequately capitalized, undercapitalized, significantly undercapitalized and critically undercapitalized. An

institution’s category depends upon its capital levels in relation to relevant capital measures, which include a risk-based capital

measure, a leverage ratio capital measure and certain other factors. The federal banking agencies have adopted regulations that

implement this statutory framework.

The prompt corrective action rules, which apply to the Bank but not the Company, are modified to include a common

equity Tier 1 risk-based ratio and to increase certain other capital requirements for the various thresholds. For example, the

requirements for the Bank to be considered well-capitalized under the rules are a 5.0% Tier 1 leverage ratio, a 6.5% common

equity Tier 1 risk-based ratio, an 8.0% Tier 1 risk-based capital ratio and a 10.0% total risk-based capital ratio. To be

adequately capitalized, those ratios are 4.0%, 4.5%. 6.0% and 8.0%, respectively.

An institution that is not well capitalized is subject to certain restrictions on brokered deposits, including restrictions on

the rates it can offer on its deposits, generally. Any institution that is neither well capitalized nor adequately capitalized is

considered undercapitalized. Federal law authorizes the FDIC to reclassify a well-capitalized institution as adequately

capitalized and may require an adequately capitalized institution or an undercapitalized institution to comply with supervisory

actions as if it were in the next lower category. The FDIC may not reclassify a significantly undercapitalized institution as

critically undercapitalized. As of September 30, 2025, the Bank exceeded the requirements of a well-capitalized institution.

Stress Testing. The Economic Growth, Regulatory Relief, and Consumer Protection Act ("EGRRCPA") set the asset threshold

for enhanced prudential standards and stress testing at $100 billion of total consolidated assets. Neither the Company nor the

Bank are subject to enhanced stress test regulations. The federal bank regulatory agencies (FRB, FDIC and the Office of the

Comptroller of the Currency) have indicated that the capital planning and risk management practices of financial institutions

with total assets less than $100 billion will continue to be reviewed through the regular supervisory process. The Bank

continues to use customized stress testing to support the business and as part of its risk management and capital planning

process.

EGRRCPA also enacted several important changes in some technical compliance areas that we believe will help reduce

our regulatory burden, including:

•Prohibiting federal banking regulators from imposing higher capital standards on High Volatility Commercial Real

Estate (“HVCRE”) exposures unless they are for acquisition, development or construction (“ADC”), and clarifying

ADC status;

•Exempting from appraisal requirements certain transactions involving real property in rural areas and valued at less

than $400,000; and

•Directing the Consumer Financial Protection Bureau to provide guidance on the applicability of the Truth in Lending

and Real Estate Settlement Procedures Act Integrated Disclosure rule to mortgage assumption transactions and

construction-to-permanent home loans, as well the extent to which lenders can rely on model disclosures that do not

reflect recent regulatory changes.

Despite the improvements for mid-size financial institutions such as the Company that has resulted from

EGRRCPA, many provisions of the Dodd-Frank Act and its implementing regulations remain in place and will continue to

result in additional operating and compliance costs that could have a material adverse effect on our business, financial

condition, and results of operation. In addition, the EGRRCPA requires the enactment of a number of implementing

regulations, the details of which may have a material effect on the ultimate impact of the law.

Cybersecurity. The federal banking regulatory agencies have established certain expectations with respect to an institution's

information security and cybersecurity programs, with an increasing focus on risk management, processes related to

information technology and operational resiliency, and the use of third parties in the provision of financial services. In January

2020, these agencies jointly issued a statement reminding supervised financial institutions of sound cybersecurity risk

management principles that expanded on areas articulated in the Interagency Guidelines Establishing Information Security

Standards written in Section 39 of the Federal Deposit Insurance Act and Sections 501 and 505(b) of the Gramm-Leach-Bliley

Act.

State regulators also continue to be active in implementing privacy and cybersecurity standards and regulations. Several

states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing

detailed requirements with respect to these programs, including data encryption requirements. Many states have also

implemented or modified their data breach notification and data privacy requirements. We expect this trend of state-level

activity in those areas to continue and are continually monitoring developments in the states in which the Company operates.

In November 2021, the federal banking regulatory agencies adopted a rule regarding notification requirements for banking

organizations related to significant computer security incidents. Under the final rule, a bank holding company, such as the

Company, and an FDIC-supervised insured depository institution, such as the Bank, are required to notify the Federal Reserve

or FDIC, respectively, within 36 hours of incidents that have materially disrupted or degraded, or are reasonably likely to

materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base,

jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. Service

providers are required under the rule to notify any affected bank client it provides services to as soon as possible when it

determines it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to

materially disrupt or degrade, covered services provided by that entity to the Bank for four or more hours.

See Item 1C - Cybersecurity, for additional disclosures regarding the Company's cybersecurity risk management, strategy

and governance.

Financial Privacy. Under the Gramm-Leach-Bliley Act of 1999, as amended, a financial institution may not disclose non-

public personal information about a consumer to unaffiliated third parties unless the institution satisfies various disclosure

requirements and the consumer has not elected to opt out of the information sharing. The financial institution must provide its

customers with a notice of its privacy policies and practices. The Federal Reserve, the FDIC, and other financial regulatory

agencies issued regulations implementing notice requirements and restrictions on a financial institution's ability to disclose non-

public personal information about consumers to unaffiliated third parties.

Additionally, a growing number of states continue to pass laws addressing privacy, information security, cybersecurity,

data breaches, and related notification obligations. As a company subject to the GLBA, we often benefit from an entity-level

exemption under most comprehensive state data privacy statutes. Of the states whose privacy laws provide data-level

exemptions, we are subject to the laws of California. In California, the Company must generally comply with its privacy laws

except for consumer financial data subject to GLBA.

In California, the California Consumer Protection Act (“CCPA”), as amended, took effect on January 1, 2020, and grants

California residents a range of privacy rights, including the right to know what personal information is collected, the right to

correct inaccurate information, the right to request deletion of personal information (subject to certain exceptions) as well as the

right to opt out of the “sale” of personal information (generally understood to be the sharing of personal information with a

third party for its own purposes) and the right to limit use of sensitive information to the use necessary for the purpose for

which the information was collected. CCPA also imposes additional compliance obligations such as the provision of detailed

privacy disclosure, and, starting in the years 2027-2028, the obligation to conduct a cybersecurity audit and a risk assessment

regarding how a company’s use of personal data affects individuals. The CCPA authorizes civil penalties for violations and

provides a private right of action for certain data breaches involving personal information, which increases the risks and

potential exposure associated with breach-related litigation. Since 2023, violations of CCPA are concurrently enforced by the

California Attorney General and by a dedicated privacy regulator, the Privacy Protection Agency (“CPPA”). Both have been

active in enforcing the CPPA and its accompanying regulations over the last few years by bringing enforcement actions that

carry six and seven figure fines, as well as injunctive relief. If this investigative focus continues, our compliance costs are likely

to increase, and we face increased litigation exposure if former employees in California use the laws protections to obtain pre-

complaint information to use in a lawsuit.

Furthermore, privacy and data protection areas are expected to receive further attention at the federal level. Congress and

federal regulatory agencies may enact similar laws or regulations that could create new individual privacy rights and impose

increased obligations on companies handling personal data. Federal privacy legislation continues to focus on sectoral privacy

issues, including financial privacy, rather than advancing a comprehensive federal privacy framework.

Other states may also adopt comprehensive privacy and data security laws modeled after California which could provide

data-level rather than entity level exemptions. This is already the case in several states where the Company does not currently

conduct business. Such new laws may impose new compliance requirements on the Company, or expand the potential for

enforcement against the Company to new jurisdictions and regulators. These evolving laws add complexity and are likely to

result in additional compliance expenditures. They may also require changes in the way we do business, especially in

connection with marketing activities.

Taxation

In addition to federal income tax, the Company is also subject to income, franchise, excise or gross receipts tax in states

(and some cities) where the Company has branches or is deemed to have sufficient nexus for tax purposes. The Company

generally files consolidated federal and state income tax returns with its subsidiaries.

The Company's federal income tax returns are open and subject to potential examination by the IRS for fiscal year 2022

and later.

Competition

We operate in a highly competitive environment. Our competitors include other banks, savings associations, community

banks, credit unions, fintech companies and other financial intermediaries, and new market participants offering services similar

to those that we offer. We compete with some competitors within our geographic market area, and with others on a product

specific basis. Our ability to compete effectively depends on our ability to provide first-rate, friendly and professional customer

service and deliver the banking solutions that our customers want and need. We are also dependent upon our ability to attract

and retain employees while managing compensation and other costs.

Availability of Financial Data

Under the Securities Exchange Act of 1934 ("Exchange Act"), the Company is required to file annual, quarterly and

current reports, proxy statements and other information with the SEC. We file reports on Forms 10-K, 10-Q and 8-K, and

amendments to those reports, with the SEC. The public may obtain copies of these reports at the SEC's website: www.sec.gov.

The Company has adopted and posted on its website a code of ethics that applies to its senior financial officers. The

Company’s website also includes the charters for its audit committee, compensation committee, risk management committee,

executive committee, technology committee and nominating and governance committee.

The address for the Company’s website is www.wafdbank.com. The Company makes available on its website, free of

charge, its annual reports on Form 10-K, current quarterly reports on Form 10-Q, reports on Form 8-K, proxy statements and

any amendments to those reports (among others), as soon as reasonably practicable after we electronically file such material

with, or furnish it to, the SEC. We also make available on our website public financial information for which a report is not

required to be filed with or furnished to the SEC. Our SEC reports and such other information can be accessed through the

investor relations section of our website (https://www.wafdbank.com/about-us/investor-relations). The Company’s website

provides a link to all our filings on the SEC’s Edgar website, and the company will provide a printed copy of any of our annual

reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, proxy statements and any amendments to

those reports (among others) to any requesting shareholder, free of charge. The information found on our website is not part of

this or any other report that we file or furnish to the SEC.