WINTRUST FINANCIAL CORP

Previous wording

•Includes risks related to deterioration in economic conditions and economic declines in the Chicago metropolitan, southern Wisconsin and west Michigan market areas, since our business is concentrated in these regions, and climate change and related environmental and sustainability matters.

Current wording

•Includes risks related to deterioration in economic conditions and economic declines in the Chicago metropolitan, southern Wisconsin and west Michigan market areas, since our business is concentrated in these regions, as well as climate change and related environmental and sustainability matters.

Previous wording

As a lending institution, our business is directly affected by the ability of our borrowers to repay their loans, as well as by the value of collateral, such as real estate, that secures many of our loans. Any economic deterioration from current levels or slowing of current economic activity could lead to an increase in loan charge-offs and negatively affect consumer confidence as well as the level of business activity. Net charge-offs totaled $94.4 million in 2024 compared to $45.5 million in 2023. Our balance of non-performing loans and other real estate owned (“OREO”) was $170.8 million and $23.1 million, respectively, at December 31, 2024 compared to $139.0 million and $13.3 million, respectively, at December 31, 2023. Deterioration in the economy and real estate markets, higher inflation, rising interest rates or increased unemployment rates, particularly in the markets in which we operate, will likely diminish the ability of our borrowers to repay loans that we have made to them, decrease the value of any collateral securing such loans and may cause increases in delinquencies, problem assets, charge-offs and provision for credit losses, all of which could materially adversely affect our financial condition and results of operations. Further, the underwriting and credit monitoring policies and procedures that we have adopted may not prevent losses that could have a material adverse effect on our business, financial condition, results of operations and cash flows.

Current wording

As a lending institution, our business is directly affected by the ability of our borrowers to repay their loans, as well as by the value of collateral, such as real estate, that secures many of our loans. Any economic deterioration from current levels or slowing of current economic activity could lead to an increase in loan charge-offs and negatively affect consumer confidence as well as the level of business activity. Net charge-offs totaled $72.3 million in 2025 compared to $94.4 million in 2024. Our balance of non-performing loans and other real estate owned (“OREO”) was $185.8 million and $20.8 million, respectively, at December 31, 2025 compared to $170.8 million and $23.1 million, respectively, at December 31, 2024. Deterioration in the economy and real estate markets, higher inflation, rising interest rates or increased unemployment rates, particularly in the markets in which we operate, will likely diminish the ability of our borrowers to repay loans that we have made to them, decrease the value of any collateral securing such loans and may cause increases in delinquencies, problem assets, charge-offs and provision for credit losses, all of which could materially adversely affect our financial condition and results of operations. Further, the underwriting and credit monitoring policies and procedures that we have adopted may not prevent losses that could have a material adverse effect on our business, financial condition, results of operations and cash flows.

Previous wording

The physical risks of climate change include discrete events, such as flooding, hurricanes, tornadoes and wildfires, and longer-term shifts in climate patterns, such as extreme heat, sea level rise, and more frequent and prolonged drought. Such events could disrupt our operations or those of our customers or third parties on which we rely, including through direct damage to assets and indirect impacts from supply chain disruption and market volatility. Additionally, transitioning to a low-carbon economy would entail extensive policy, legal, technology, human capital and market initiatives, each of which may be costly. Transition risks, including changes in consumer preferences, additional regulatory requirements or taxes and additional counterparty or customer requirements, could increase our expenses, undermine our strategies and impact our financial condition.

Current wording

The physical risks of climate change include discrete events, such as flooding, hurricanes, tornadoes and wildfires, and longer-term shifts in climate patterns, such as extreme heat, sea level rise, increased severe weather, and more frequent and prolonged drought. Such events could disrupt our operations or those of our customers or third parties on which we rely, including through direct damage to assets and indirect impacts from supply chain disruption and market volatility. Additionally, transitioning to a low-carbon economy would entail extensive policy, legal, technology, human capital and market initiatives, each of which may be costly. Transition risks, including changes in consumer preferences, additional regulatory requirements or taxes and additional counterparty or customer requirements, could increase our expenses, undermine our strategies and impact our financial condition.

Previous wording

We face competition in attracting and retaining deposits, making loans, and providing other financial services (including wealth management services) throughout our market area. Our competitors include national, regional and other community banks, and a wide range of other financial institutions such as credit unions, government-sponsored enterprises, mutual fund companies, insurance companies, factoring companies and other non-bank financial companies such as marketplace lenders and other financial technology companies. Many of these competitors have substantially greater resources and market presence or more advanced technology than Wintrust and, as a result of their size, may be able to offer a broader range of products and services, better pricing for those products and services, or newer technologies to deliver those products and services than we can. The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. For example, the Economic Growth Act and its implementing regulations significantly reduce the regulatory burden of certain large BHCs and raise the asset thresholds at which more onerous requirements apply, which could cause certain large BHCs to become more competitive or to more aggressively pursue expansion. Also, technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as mobile payment and other automatic transfer and payment systems, and for banks that do not have a physical presence in our markets to compete for deposits. The absence of regulatory requirements may give non-bank financial companies a competitive advantage over Wintrust.

Current wording

We face competition in attracting and retaining deposits, making loans, and providing other financial services (including wealth management services) throughout our market area. Our competitors include national, regional and other community banks, and a wide range of other financial institutions such as credit unions, government-sponsored enterprises, mutual fund companies, insurance companies, factoring companies and other non-bank financial companies such as marketplace lenders, cryptocurrency companies (including stablecoins) and other financial technology companies. Many of these competitors have substantially greater resources and market presence or more advanced technology than Wintrust and, as a result of their size, may be able to offer a broader range of products and services, better pricing for those products and services, or newer technologies to deliver those products and services than we can. The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. There could be new tailoring regulations, similar to the implementing regulations of the Economic Growth Act, that significantly reduce the regulatory burden of certain large BHCs and raise the asset thresholds at which more onerous requirements apply, which could cause certain large BHCs to become more competitive or to more aggressively pursue expansion. Also, technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as mobile payment and other automatic transfer and payment systems, and for banks that do not have a physical presence in our markets to compete for deposits. The absence of, or differences in, regulatory requirements may give non-bank financial companies a competitive advantage over, or encourage additional entrants to become competitors of, Wintrust. For example, the Guiding and Establishing National Innovation for U.S. Stablecoins Act of 2025 (GENIUS Act) provides a legal framework for stablecoins to be issued in the United States, which may allow new and existing competitors to compete for funds that may have otherwise been deposited with banks.

Previous wording

Maintaining trust in the Company is critical to our ability to attract and maintain customers, investors and employees. If our reputation is damaged, our business could be significantly harmed. Harm to our reputation could arise from numerous sources, including, among others, employee misconduct, security and cybersecurity breaches, compliance failures, litigation or regulatory outcomes or governmental investigations. Our reputation could also be harmed by the failure or perceived failure of an affiliate or a vendor or other third party with which we do business, to comply with applicable laws or regulations. In addition, our reputation or prospects could be significantly damaged by adverse publicity or negative information regarding the Company, whether or not true, that may be posted on social media, non-mainstream news services or other parts of the internet, and this risk can be magnified by the speed and pervasiveness with which information is disseminated through those channels.

Current wording

Maintaining trust in the Company is critical to our ability to attract and maintain customers, investors and employees. If our reputation is damaged, our business could be significantly harmed. Harm to our reputation could arise from numerous sources, including, among others, employee misconduct, cyber-attacks, information security breaches and other similar incidents, compliance failures, litigation or regulatory outcomes or governmental investigations. Our reputation could also be harmed by the failure or perceived failure of an affiliate or a vendor or other third party with which we do business, to comply with applicable laws or regulations. In addition, our reputation or prospects could be significantly damaged by adverse publicity or negative information regarding the Company, whether or not true, that may be posted on social media, non-mainstream news services or other parts of the internet, and this risk can be magnified by the speed and pervasiveness with which information is disseminated through those channels.

Previous wording

Increased focus on environmental, social and governance (“ESG”) issues could damage our reputation or prospects if customers, prospective customers, investors or third parties assigning ESG ratings to the Company are of the opinion that the Company’s practices, including without limitation our lending practices, are not sufficiently robust from an ESG perspective, or otherwise disagree with the Company’s practices. Simultaneous, disparate and divergent sentiments on ESG-related matters from multiple stakeholder groups increase the risk that any action or lack thereof by us on such matters will be perceived negatively by some stakeholders. Failing to comply with expectations and standards from investors, customers, regulators, policymakers and other stakeholders regarding ESG-related issues, or taking action in conflict with one or another of those stakeholders’ expectations, could also lead to a loss of business, adverse publicity, an adverse impact on our reputation, customer complaints or other adverse consequences.

Current wording

Evolving focus on environmental, social and governance (“ESG”) issues could damage our reputation or prospects if customers, prospective customers, investors or third parties assigning ESG ratings to the Company are of the opinion that the Company’s practices, including without limitation our lending practices, are not sufficiently robust from an ESG perspective, or otherwise disagree with the Company’s practices. Simultaneous, disparate and divergent sentiments on ESG-related matters from multiple stakeholder groups increase the risk that any action or lack thereof by us on such matters will be perceived negatively by some stakeholders. We may be subject to laws or regulations related to ESG or sustainability matters, including those impacting disclosure, diligence or investment decisions. Failing to comply with expectations and standards from investors, customers, regulators, lawmakers and other stakeholders regarding ESG-related issues, or taking action in conflict with one or another of those stakeholders’ expectations, could also lead to a loss of business, adverse publicity, increased costs, an adverse impact on our reputation, customer complaints or other adverse consequences.

Previous wording

At the same time, “anti-ESG” sentiment has gained momentum among certain groups across the United States, and the federal and certain state governments have proposed or enacted anti-ESG legislation, rules, regulations and policies. Such anti-ESG measures may lead to increased scrutiny and expose us to the risk of litigation, regulatory exposure and reputational harm. Additionally, certain states now require that certain investment managers make investments based solely on financial considerations, without regard to consideration of ESG factors. If investors subject to such legislation viewed us, our policies or our practices as being in contradiction of such anti-ESG requirements, such investors may not invest in us, which could negatively affect our financial performance.

Current wording

At the same time, certain groups across the United States, and the federal and certain state governments have proposed or enacted anti-ESG legislation, rules, regulations and policies. Such anti-ESG measures may lead to increased scrutiny and expose us to the risk of litigation, regulatory exposure and reputational harm. Additionally, certain states now require that certain investment managers make investments based solely on financial considerations, without regard to consideration of ESG factors. If investors subject to such legislation viewed us, our policies or our practices as being in contradiction of such anti-ESG requirements, such investors may not invest in us, which could negatively affect our financial performance.

Previous wording

Technology and other changes are allowing parties to complete financial transactions that historically have involved banks through alternative methods. For example, consumers can now maintain funds that would have historically been held as bank deposits in brokerage accounts or mutual funds. Consumers can also complete transactions such as paying bills and transferring funds directly without the assistance of banks. The process of eliminating banks as intermediaries could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits. The loss of these revenue streams and the lower cost deposits as a source of funds could have a material adverse effect on our business, financial condition and results of operations.

Current wording

Technology and other changes are allowing parties to complete financial transactions that historically have involved banks through alternative methods. For example, consumers can now maintain funds that would have historically been held as bank deposits in brokerage accounts or mutual funds. Consumers can also complete transactions such as paying bills and transferring funds directly without the assistance of banks. In addition, transactions using digital assets, including cryptocurrencies, stablecoins and other similar assets, have increased substantially over the course of the last several years. The process of eliminating banks as intermediaries could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits. The loss of these revenue streams and the lower cost deposits as a source of funds could have a material adverse effect on our business, financial condition and results of operations.

Previous wording

The standards by which bank and financial institution acquisitions will be evaluated are currently in flux and some banking organizations are experiencing delays in the processing of applications. For example, the OCC adopted a final rule in September 2024 amending its procedures for reviewing applications under the Bank Merger Act (the “BMA”) and adding a policy statement on the OCC’s substantive approach to evaluating bank mergers under the BMA. The policy statement outlines the general principles the OCC will apply when reviewing bank merger applications and clarifies how the OCC would consider the statutory factors under the BMA. The policy statement also identifies certain indicators that are more likely to withstand scrutiny and be approved expeditiously and those that would raise supervisory or regulatory concerns. Indicators generally consistent with timely approval include, among others, appropriate capital and supervisory ratings, lack of enforcement or fair lending actions, lack of significant CRA or consumer compliance concerns or significant adverse effect on competition and that the resulting institution would have total assets less than $50 billion.

Current wording

The standards by which bank and financial institution acquisitions will be evaluated may be subject to change. For example, the OCC adopted a final rule in September 2024 amending its procedures for reviewing applications under the BMA and adding a policy statement on the OCC’s substantive approach to evaluating bank mergers under the BMA but in May 2025 reversed these 2024 issuances. Concurrent with the OCC’s 2024 issuance, the DOJ withdrew its 1995 Bank Merger Guidelines and issued the 2024 Banking Addendum to the 2023 Merger Guidelines. Unlike the OCC, the DOJ has not reinstated the guidance that was in effect prior to 2024.

Previous wording

Our financial results have been and will continue to be impacted by our strategy of branch openings and de novo bank formations. We expect to increase the opening of additional branches and may, under certain circumstances, resume de novo bank formations. It may take longer than expected or more than the amount of time Wintrust has historically experienced for new banks and/or banking facilities to reach profitability, and there can be no guarantee that these branches or banks will ever be profitable. Moreover, the FDIC's enhanced supervisory period for de novo banks of three years, including higher capital requirements during this period, could also delay a new bank's ability to contribute to the Company's earnings and impact the Company's willingness to expand through de novo bank formation. To the extent we undertake additional de novo bank, branch and business formations, our level of reported net income, return on average equity and return on average assets will be impacted by startup costs associated with such operations, and it is likely to continue to experience the effects of higher expenses relative to operating income from the new operations. These expenses may be higher than we expected or than our experience has shown, which could have a material adverse effect on our business, financial condition and results of operations.

Current wording

Our financial results have been and will continue to be impacted by our strategy of branch openings and de novo bank formations. We expect to increase the opening of additional branches and may, under certain circumstances, resume de novo bank formations. It may take longer than expected or more than the amount of time Wintrust has historically experienced for new banks and/or banking facilities to reach profitability, and there can be no guarantee that these branches or banks will ever be profitable. Moreover, the OCC’s and FDIC's enhanced supervisory period for de novo banks of three years, including higher capital requirements during this period, could also delay a new bank's ability to contribute to the Company's earnings and impact the Company's willingness to expand through de novo bank formation. To the extent we undertake additional de novo bank, branch and business formations, our level of reported net income, return on average equity and return on average assets will be impacted by startup costs associated with such operations, and it is likely to continue to experience the effects of higher expenses relative to operating income from the new operations. These expenses may be higher than we expected or than our experience has shown, which could have a material adverse effect on our business, financial condition and results of operations.

Previous wording

The Federal Reserve lowered interest rates towards the end of 2024, while maintaining its balance sheet reduction throughout the entire year. Inflation remains above the Federal Reserve's two percent target rate and while the Federal Reserve may seek to further lower interest rates in 2025, the range of potential rate paths will ultimately be driven by inflation data, labor market performance, and economic growth. It is anticipated the Federal Funds Rate will remain restrictive in the near term. Sustained higher interest rates and continued Federal Reserve asset reductions may adversely affect market stability, market liquidity, and our financial performance and condition. We cannot predict the nature or timing of future changes in monetary policies, or the precise effects that future changes in monetary policies may have on our activities and financial results.

Current wording

The Federal Reserve lowered interest rates towards the end of 2024 and during 2025. Inflation remains above the Federal Reserve's two percent target rate and while the Federal Reserve may seek to further lower interest rates in 2026, the range of potential rate paths will ultimately be driven by inflation data, labor market performance, and economic growth. We cannot predict the nature or timing of future changes in monetary policies, or the precise effects that future changes in monetary policies may have on our activities and financial results.

Previous wording

We are subject to extensive federal and state regulation and supervision. The cost of compliance with such laws and regulations can be substantial and adversely affect our ability to operate profitably. While we are unable to predict the scope or impact of any potential legislation or regulatory action until it becomes final, it is possible that changes in applicable laws, regulations or interpretations thereof could significantly increase our regulatory compliance costs, impede the efficiency of our internal business processes, negatively impact the recoverability of certain of our recorded assets, require us to increase our regulatory capital, interfere with our executive compensation plans, or limit our ability to pursue business opportunities in an efficient manner including our plan for de novo growth and growth through acquisitions.

Current wording

We are subject to extensive federal and state regulation and supervision. The cost of compliance with such laws and regulations can be substantial and adversely affect our ability to operate profitably. Changes in the U.S. presidential administration and Congress have led and will likely continue to lead to changes in law or policy. In addition, changes in key personnel at the agencies that regulate us, including the federal banking regulators, may result in differing interpretations of existing rules and guidelines. Although the current presidential administration has indicated an intent to pursue the regulation of the financial services industry differently than was the case under the previous administration, there is significant uncertainty regarding the direction this administration will continue to take and its ability to implement its policies and objectives, as well as the ultimate impact on potential new regulatory initiatives and the enforcement of existing laws and regulations. While we are unable to predict the scope or impact of any potential legislation or regulatory action, it is possible that changes in applicable laws, regulations or interpretations thereof could significantly increase our regulatory compliance costs, impede the efficiency of our internal business processes, negatively impact the recoverability of certain of our recorded assets, require us to increase our regulatory capital, interfere with our executive compensation plans, or limit our ability to pursue business opportunities in an efficient manner including our plan for de novo growth and growth through acquisitions. It is also possible the expected changes in regulation do not occur or are reversed by a subsequent administration, or the regulatory measures that are ultimately enacted deliver significant competitive advantages to financial services that are structured differently or serve different markets than us.

Previous wording

In addition to various data privacy and cybersecurity laws and regulations already in place, U.S. states are increasingly adopting laws and regulations imposing comprehensive data privacy and cybersecurity obligations, which may be more stringent, broader in scope, or offer greater individual rights, with respect to personal information than federal or other state laws and regulations, and such laws and regulations may differ from each other, which may complicate compliance efforts and increase compliance costs. Certain aspects of federal and state laws and regulations relating to data privacy and cybersecurity, as well as their enforcement, remain unclear, and we may be required to modify our practices in an effort to comply with them.

Current wording

In addition to various data privacy and cybersecurity laws, regulations, rules and standards already in place, U.S. states are increasingly adopting laws, regulations, rules and standards imposing comprehensive data privacy and cybersecurity obligations, which may be more stringent, broader in scope, or offer greater individual rights, with respect to personal information than federal or other state laws, regulations, rules and standards and such laws, regulations, rules and standards may differ from each other, which may complicate compliance efforts and increase compliance costs. Certain aspects of federal and state laws, regulations, rules and standards relating to data privacy and cybersecurity, as well as their enforcement, remain unclear, and we may be required to modify our practices in an effort to comply with them.

Previous wording

Further, while we strive to publish and prominently display privacy policies that are accurate, comprehensive, and compliant with applicable laws, regulations, rules and industry standards, we cannot ensure that our privacy policies and other statements regarding our practices will be sufficient to protect us from claims, proceedings, liability or adverse publicity relating to data privacy or cybersecurity. Although we endeavor to comply with our privacy policies, we may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policies and other documentation that provide promises and assurances about data privacy and cybersecurity can subject us to potential federal or state action if they are found to be deceptive, unfair, or misrepresentative of our actual practices. Additional risks could arise in connection with any failure or perceived failure by us, our service providers or other third parties with which we do business to provide adequate disclosure or transparency to our customers about the personal information collected from them and its use, to receive, document or honor the privacy preferences expressed by our customers, to protect personal information from unauthorized disclosure, or to maintain proper training on privacy practices for all employees or third parties who have access to personal information in our possession or control.

Current wording

Further, while we strive to publish and prominently display privacy policies that are accurate, comprehensive, and compliant with applicable laws, regulations, rules, standards and contractual obligations, we cannot ensure that our privacy policies and other statements regarding our practices will be sufficient to protect us from claims, proceedings, liability or adverse publicity relating to data privacy or cybersecurity. Although we endeavor to comply with our privacy policies, we may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policies and other documentation that provide promises and assurances about data privacy and cybersecurity can subject us to potential federal or state action if they are found to be deceptive, unfair, or misrepresentative of our actual practices. Additional risks could arise in connection with any failure or perceived failure by us, our service providers or other third parties with which we do business to provide adequate disclosure or transparency to our customers about the personal information collected from them and its use, to receive, document or honor the privacy preferences expressed by our customers, to protect personal information from unauthorized disclosure, or to maintain proper training on privacy practices for all employees or third parties who have access to personal information in our possession or control.

Previous wording

Any failure or perceived failure by us to comply with our privacy policies, or applicable data privacy and cybersecurity laws, regulations, rules, standards or contractual obligations, or any compromise of security that results in unauthorized access to, or unauthorized loss, destruction, use, modification, acquisition, disclosure, release or transfer of personal information, may result in requirements to modify or cease certain operations or practices, the expenditure of substantial costs, time and other resources, proceedings or actions against us, legal liability, governmental investigations, enforcement actions, claims, fines, judgments, awards, penalties, sanctions and costly litigation (including class actions). Any of the foregoing could harm our reputation, distract our management and technical personnel, increase our costs of doing business, adversely affect the demand for our products and services, and ultimately result in the imposition of liability, any of which could have a material adverse effect on our business, financial condition and results of operations. For more information regarding data privacy and cybersecurity laws and regulations, see “Protection of Client Information” under Supervision and Regulation in Item 1.

Current wording

Any failure or perceived failure by us to comply with our privacy policies, or applicable data privacy and cybersecurity laws, regulations, rules, standards or contractual obligations, or any compromise of security that results in unauthorized access to, or unauthorized loss, destruction, use, modification, acquisition, disclosure, release, transfer or other processing of personal information, may result in requirements to modify or cease certain operations or practices, the expenditure of substantial costs, time and other resources, proceedings or actions against us, legal liability, governmental investigations, enforcement actions, claims, fines, judgments, awards, penalties, sanctions and costly litigation (including class actions). Any of the foregoing could harm our reputation, distract our management and technical personnel, increase our costs of doing business, adversely affect the demand for our products and services, and ultimately result in the imposition of liability, any of which could have a material adverse effect on our business, financial condition and results of operations. For more information regarding data privacy and cybersecurity laws, regulations, rules and standards, see “Protection of Client Information” under Supervision and Regulation in Item 1.

Previous wording

Federal, state and local laws have been adopted that are intended to eliminate certain lending practices considered “predatory.” These laws prohibit practices such as steering borrowers away from more affordable products, selling unnecessary insurance to borrowers, repeatedly refinancing loans and making loans without a reasonable expectation that the borrowers will be able to repay the loans irrespective of the value of the underlying property. The CFPB has promulgated many mortgage-related rules since it was established under the Dodd-Frank Act, including rules relating to the ability to repay loans and relating to qualified mortgage standards. Most of these mortgage-related rules have been adopted, although portions of certain of these rules have not yet become effective. We may find it necessary to tighten our mortgage loan underwriting standards in response to the CFPB rules, which may constrain our ability to make loans consistent with our business strategies. It is our policy not to make predatory loans and to determine borrowers' ability to repay, but the law and related rules create the potential for increased liability with respect to our lending and loan investment activities. They increase our cost of doing business and, ultimately, may prevent us from making certain loans and cause us to reduce the average percentage rate or the points and fees on loans that we do make. In addition, regulation related to redlining, fair lending, CRA compliance and BSA compliance create significant burdens which necessitate increased costs. Any failure to comply with any of these regulations could have a significant impact on our ability to operate, our ability to acquire or open new banks and/or result in meaningful fines.

Current wording

Federal, state and local laws have been adopted that are intended to eliminate certain lending practices considered “predatory.” These laws prohibit practices such as steering borrowers away from more affordable products, selling unnecessary insurance to borrowers, repeatedly refinancing loans and making loans without a reasonable expectation that the borrowers will be able to repay the loans irrespective of the value of the underlying property. The CFPB has promulgated many mortgage-related rules since it was established under the Dodd-Frank Act, including rules relating to the ability to repay loans and relating to qualified mortgage standards. We may find it necessary to tighten our mortgage loan underwriting standards in response to consumer lending laws or rules, which may constrain our ability to make loans consistent with our business strategies. It is our policy not to make predatory loans and to determine borrowers' ability to repay, but the law and related rules create the potential for increased liability with respect to our lending and loan investment activities. They increase our cost of doing business and, ultimately, may prevent us from making certain loans and cause us to reduce the average percentage rate or the points and fees on loans that we do make. In addition, regulation related to redlining, fair lending, CRA compliance and BSA compliance create significant burdens which necessitate increased costs. Any failure to comply with any of these regulations could have a significant impact on our ability to operate, our ability to acquire or open new banks and/or result in meaningful fines.

Previous wording

The U.S. Basel III Rule, as well as other aspects of current or proposed regulatory or legislative changes to laws applicable to banking organizations, have increased our compliance costs, impacted the profitability of our business activities and may change certain of our business practices, including the ability to offer new products, obtain financing, attract deposits, make loans, and achieve satisfactory interest spreads, and could expose us to additional costs, including increased compliance costs. These changes also may require us to invest significant management attention and resources to make any necessary changes to operations in order to comply, and could therefore also materially and adversely affect our business, financial condition and results of operations.

Current wording

The federal banking agencies’ capital rules, as well as other aspects of current or proposed regulatory or legislative changes to laws or regulations applicable to banking organizations, have increased our compliance costs, impacted the profitability of our business activities and may change certain of our business practices, including the ability to offer new products, obtain financing, attract deposits, make loans, and achieve satisfactory interest spreads, and could expose us to additional costs, including increased compliance costs. These changes also may require us to invest significant management attention and resources to make any necessary changes to operations in order to comply, and could therefore also materially and adversely affect our business, financial condition and results of operations.

Previous wording

The Dodd-Frank Act and FDIC regulations use an assessment base for federal deposit insurance premiums based on average total consolidated assets less average tangible capital. There is a risk that the banks’ deposit insurance premiums will increase in the future if failures of insured depository institutions once again deplete the DIF. Additionally, to recoup losses to the DIF resulting from the bank failures of 2023, the FDIC also adopted a special assessment that became effective in 2024 and will be collected over an initial eight quarterly assessment periods, which the FDIC currently projects will be extended for an additional two quarters at a lower rate, subject to certain adjustments. There is a risk that the FDIC could adopt additional special assessments in the future to recoup future DIF losses. Either of these events could negatively impact our financial condition and results of operations. For more information regarding the most recent increase to the banks’ deposit insurance premiums, see “Insurance of Deposit Accounts” under Supervision and Regulation in Item 1.

Current wording

FDIC regulations use an assessment base for federal deposit insurance premiums based on average total consolidated assets less average tangible capital. There is a risk that the banks’ deposit insurance premiums will increase in the future if failures of insured depository institutions once again deplete the DIF. Additionally, to recoup losses to the DIF resulting from the bank failures of 2023, the FDIC also adopted a special assessment that became effective in 2024 and will be collected over eight quarterly assessment periods, with the eighth quarter to be collected at a lower rate, subject to certain adjustments. There is a risk that the FDIC could adopt additional special assessments in the future to recoup future DIF losses. Either of these events could negatively impact our financial condition and results of operations. For more information regarding the most recent increase to the banks’ deposit insurance premiums, see “Insurance of Deposit Accounts” under Supervision and Regulation in Item 1.

Previous wording

Non-compliance with the USA PATRIOT Act, BSA or other laws and regulations could result in fines or sanctions.

Current wording

Non-compliance with the Bank Secrecy Act and its implementing regulations, and other applicable anti-money laundering laws and regulations could result in fines or sanctions.

Previous wording

The USA PATRIOT Act and the BSA require financial institutions to develop risk-based compliance programs designed to prevent financial institutions from being used for money laundering, the funding of terrorist activities or other illicit finance activities. If such activities are detected, financial institutions are obligated to file suspicious activity reports with FinCEN. The BSA and its implementing regulations require covered financial institutions to establish procedures for identifying and verifying the identity of customers seeking to open new accounts. Failure to comply with the BSA and its implementing regulations could result in fines or sanctions. An increasing number of banking institutions have received large fines for non-compliance with the BSA and its implementing regulations. Although we have developed policies and procedures designed to assist in compliance with these laws and regulations, no assurance can be given that these policies and procedures will be effective in preventing violations of these laws and regulations.

Current wording

The Bank Secrecy Act, as amended by the USA PATRIOT Act (the “BSA”), and its implementing regulations require financial institutions to develop risk-based anti-money laundering compliance programs designed to, among other things, prevent financial institutions from being used for money laundering, terrorist financing or other illicit finance activities. If suspicious activities are detected, financial institutions are required to file suspicious activity reports with FinCEN. The BSA and its implementing regulations require covered financial institutions to establish procedures for identifying and verifying the identity of customers seeking to open new accounts. Failure to comply with the BSA and its implementing regulations could result in fines or sanctions. An increasing number of banks have received large fines for non-compliance with the BSA and its implementing regulations. Although we have developed policies and procedures designed to assist in compliance with the BSA and its implementing regulations, no assurance can be given that these policies and procedures will be effective in preventing violations of applicable law.

Previous wording

Because our allowance for credit losses represents an estimate of lifetime losses, there is no certainty that it will be adequate over time to cover credit losses in the portfolios, particularly if there are changes in expectations of general economic or market conditions, or events that adversely affect specific customers. In 2024, we charged off $94.4 million in loans (net of recoveries) and increased our allowance for credit losses from $427.6 million at December 31, 2023 to $437.1 million at December 31, 2024. Our allowance for loan and unfunded lending-related commitment losses represented 0.91% and 1.01% of total loans outstanding at December 31, 2024 and 2023, respectively.

Current wording

Because our allowance for credit losses represents an estimate of lifetime losses, there is no certainty that it will be adequate over time to cover credit losses in the portfolios, particularly if there are changes in expectations of general economic or market conditions, or events that adversely affect specific customers. In 2025, we charged off $72.3 million in loans (net of recoveries) and increased our allowance for credit losses from $437.1 million at December 31, 2024 to $460.5 million at December 31, 2025. Our allowance for loan and unfunded lending-related commitment losses represented 0.87% and 0.91% of total loans outstanding at December 31, 2025 and 2024, respectively.

Previous wording

The repayment of our commercial loans is dependent upon the financial success and viability of the borrower. If the economy weakens for a prolonged period or experiences deterioration or if the industry or market in which the borrower operates weakens, our borrowers may experience depressed or dramatic and sudden decreases in revenues that could hinder their ability to repay their loans. Our commercial loan portfolio totaled $15.6 billion or 32% of our total loan portfolio, at December 31, 2024, compared to $12.8 billion, or 30% of our total loan portfolio, at December 31, 2023.

Current wording

The repayment of our commercial loans is dependent upon the financial success and viability of the borrower. If the economy weakens for a prolonged period or experiences deterioration or if the industry or market in which the borrower operates weakens, our borrowers may experience depressed or dramatic and sudden decreases in revenues that could hinder their ability to repay their loans. Our commercial loan portfolio totaled $17.0 billion or 32% of our total loan portfolio, at December 31, 2025, compared to $15.6 billion, or 32% of our total loan portfolio, at December 31, 2024.

Previous wording

As of both December 31, 2024 and 2023, approximately 36% and 35%, respectively, of our total loan portfolio was secured by real estate, the majority of which is commercial real estate. The commercial and residential real estate markets continue to experience a variety of difficulties, including the Chicago metropolitan area, southern Wisconsin and west Michigan, in which a majority of our real estate loans are concentrated. Continued uncertainty in economic conditions may impair a borrower’s business operations, slow the execution of new leases and lead to existing lease turnover. As a result of these factors, vacancy rates for retail, office and industrial space may increase, and hotel occupancy rates may decline. High vacancy and lower occupancy rates could also result in rents falling. The combination of these factors could result in the deterioration in the fundamentals underlying the commercial real estate market and the deterioration in value of some of our loans. Any such deterioration could adversely affect the ability of our borrowers to repay the amounts due under their loans. Specifically, the office property segment, which represents 3.45% of our total loan portfolio, is undergoing a structural shift given the rise of a remote work environment, resulting in heightened vacancies and potentially reduced leasing needs. It is anticipated that this heightened risk environment for the office segment may take several years to resolve. Increases in commercial and consumer delinquency levels or declines in real estate market values would require increased net charge-offs and increases in the allowance for loan and lease losses, which could have a material adverse effect on our business, financial condition and results of operations.

Current wording

As of both December 31, 2025 and 2024, approximately 36% and 36%, respectively, of our total loan portfolio was secured by real estate, the majority of which is commercial real estate. The commercial and residential real estate markets continue to experience a variety of difficulties, including the Chicago metropolitan area, southern Wisconsin and west Michigan, in which a majority of our real estate loans are concentrated. Continued uncertainty in economic conditions may impair a borrower’s business operations, slow the execution of new leases and lead to existing lease turnover. As a result of these factors, vacancy rates for retail, office and industrial space may increase, and hotel occupancy rates may decline. High vacancy and lower occupancy rates could also result in rents falling. The combination of these factors could result in the deterioration in the fundamentals underlying the commercial real estate market and the deterioration in value of some of our loans. Any such deterioration could adversely affect the ability of our borrowers to repay the amounts due under their loans. Specifically, the office property segment, which represents 3.18% of our total loan portfolio, is undergoing a structural shift given the rise of a remote work environment, resulting in heightened vacancies and potentially reduced leasing needs. It is anticipated that this heightened risk environment for the office segment may take several years to resolve. Increases in commercial and consumer delinquency levels or declines in real estate market values would require increased net charge-offs and increases in the allowance for loan and lease losses, which could have a material adverse effect on our business, financial condition and results of operations.

Previous wording

We provide financing for the payment of property and casualty insurance premiums and life insurance premiums on a national basis through FIRST Insurance Funding and Wintrust Life Finance, respectively, and financing for the payment of property and casualty insurance premiums in Canada through our wholly-owned subsidiary, FIFC Canada. Property and casualty insurance premium finance loans involve a different, and possibly higher, risk of delinquency or collection than life insurance premium finance loans and the loan portfolios of our bank subsidiaries because these loans are issued primarily through relationships with a large number of unaffiliated insurance agents and because the borrowers are located nationwide. As a result, risk management and general supervisory oversight may be difficult. As of December 31, 2024, we had $7.3 billion of property and casualty insurance premium finance loans outstanding, of which $6.4 billion related to the Company's U.S. operations at FIRST Insurance Funding and $824.4 million related to the Company's Canadian operations at FIFC Canada. Together, these loans represented 15% of our total loan portfolio as of such date.

Current wording

We provide financing for the payment of property and casualty insurance premiums and life insurance premiums on a national basis through FIRST Insurance Funding and Wintrust Life Finance, respectively, and financing for the payment of property and casualty insurance premiums in Canada through our wholly-owned subsidiary, FIFC Canada. Property and casualty insurance premium finance loans involve a different, and possibly higher, risk of delinquency or collection than life insurance premium finance loans and the loan portfolios of our bank subsidiaries because these loans are issued primarily through relationships with a large number of unaffiliated insurance agents and because the borrowers are located nationwide. As a result, risk management and general supervisory oversight may be difficult. As of December 31, 2025, we had $8.2 billion of property and casualty insurance premium finance loans outstanding, of which $7.3 billion related to the Company's U.S. operations at FIRST Insurance Funding and $875.4 million related to the Company's Canadian operations at FIFC Canada. Together, these loans represented 16% of our total loan portfolio as of such date.

Previous wording

FIRST Insurance Funding, Wintrust Life Finance and FIFC Canada's premium finance loans are primarily secured by the insurance policies financed by the loans. These insurance policies are written by a large number of geographically dispersed insurance companies. Our premium finance receivables balances finance insurance policies that are spread among a large number of insurers; however, one of the insurers represents approximately 10% of such balances and two additional insurers represent approximately 8% and 6% each of such balances. FIRST Insurance Funding, Wintrust Life Finance and FIFC Canada consistently monitor carrier ratings and financial performance of our carriers. While FIRST Insurance Funding, Wintrust Life Finance and FIFC Canada can mitigate risks as a result of this monitoring to the extent that commercial or life insurance providers experience widespread difficulties or credit downgrades, the value of our collateral will be reduced. FIRST Insurance Funding, Wintrust Life Finance and FIFC Canada are also subject to the possibility of insolvency of insurance carriers in the commercial and life insurance businesses that are in possession of our collateral. If one or more large nationwide insurers were to fail, the value of our portfolio could be significantly negatively impacted. A significant downgrade in the value of the collateral supporting our premium finance business could impair our ability to create liquidity for this business, which, in turn could negatively impact our ability to expand.

Current wording

FIRST Insurance Funding, Wintrust Life Finance and FIFC Canada's premium finance loans are primarily secured by the insurance policies financed by the loans. These insurance policies are written by a large number of geographically dispersed insurance companies. Our premium finance receivables balances finance insurance policies that are spread among a large number of insurers; however, one of the insurers represents approximately 9% of such balances and two additional insurers represent approximately 8% each of such balances. FIRST Insurance Funding, Wintrust Life Finance and FIFC Canada consistently monitor carrier ratings and financial performance of our carriers. While FIRST Insurance Funding, Wintrust Life Finance and FIFC Canada can mitigate risks as a result of this monitoring to the extent that commercial or life insurance providers experience widespread difficulties or credit downgrades, the value of our collateral will be reduced. FIRST Insurance Funding, Wintrust Life Finance and FIFC Canada are also subject to the possibility of insolvency of insurance carriers in the commercial and life insurance businesses that are in possession of our collateral. If one or more large nationwide insurers were to fail, the value of our portfolio could be significantly negatively impacted. A significant downgrade in the value of the collateral supporting our premium finance business could impair our ability to create liquidity for this business, which, in turn could negatively impact our ability to expand.

Previous wording

We are exposed to interest rate risk in our core banking activities of lending and deposit taking, since changes in prevailing interest rates affect the value of our assets and liabilities. Such changes may adversely affect our net interest income, which is the difference between interest income and interest expense. Our net interest income is affected by the fact that assets and liabilities reprice at different times and by different amounts as interest rates change. Net interest income represents our largest component of net income, and was $2.0 billion and $1.8 billion for the years ended December 31, 2024 and 2023, respectively.

Current wording

We are exposed to interest rate risk in our core banking activities of lending and deposit taking, since changes in prevailing interest rates affect the value of our assets and liabilities. Such changes may adversely affect our net interest income, which is the difference between interest income and interest expense. Our net interest income is affected by the fact that assets and liabilities reprice at different times and by different amounts as interest rates change. Net interest income represents our largest component of net income, and was $2.2 billion and $2.0 billion for the years ended December 31, 2025 and 2024, respectively.

Previous wording

In response to inflationary forces, the Federal Reserve has maintained a restrictive monetary policy stance, despite lowering rates at the end of 2024. The federal funds rate ended 2024 at a range of 4.25-4.50%. Though we expect the Federal Reserve to slow the rate of decreases, we cannot predict the nature or timing of future changes in monetary policies or the precise effects that they may have on our activities and financial results. For more discussion of this issue, see the above risk factor “Changes in the United States’ monetary policy may restrict our ability to conduct our business in a profitable manner.”

Current wording

The Federal Reserve has lowered rates at the end of 2024 and during 2025. The federal funds rate ended 2025 at a range of 3.50-3.75%. We cannot predict the nature or timing of future changes in monetary policies or the precise effects that they may have on our activities and financial results. For more discussion of this issue, see the above risk factor “Changes in the United States’ monetary policy may restrict our ability to conduct our business in a profitable manner.”

Previous wording

We seek to mitigate our interest rate risk through several strategies, which may not be successful. With the relatively low interest rates that prevailed in past years, we were able to augment the total return of our investment securities portfolio by selling call options on fixed-income securities that we own. We recorded fee income of approximately $10.2 million, $21.9 million and $14.1 million for the years ended December 31, 2024, 2023 and 2022, respectively. We also mitigate our interest rate risk by entering into interest rate swaps and other interest rate derivative contracts from time to time with counterparties. The Company held $6.7 billion of derivatives effective as of December 31, 2024 that were designated as cash flow hedges against the potential downward repricing of variable rate loans. To the extent that the market value of any derivative contract moves to a negative market value, we are subject to loss if the counterparty defaults. In the future, there can be no assurance that such mitigation strategies will be available or successful or that we will be successful in implementing any new mitigation strategies necessary to address the current rising interest rate environment. In addition, transactions entered into as part of mitigation strategies employed to mitigate risks associated with a prolonged low interest rate environment could be less beneficial or result in losses if interest rates continue to rise.

Current wording

We seek to mitigate our interest rate risk through several strategies, which may not be successful. With the relatively low interest rates that prevailed in past years, we were able to augment the total return of our investment securities portfolio by selling call options on fixed-income securities that we own. We recorded fee income of approximately $20.7 million, $10.2 million and $21.9 million for the years ended December 31, 2025, 2024 and 2023, respectively. We also mitigate our interest rate risk by entering into interest rate swaps and other interest rate derivative contracts from time to time with counterparties. The Company held $6.85 billion of derivative contracts as of December 31, 2025 that were designated as cash flow hedges against the potential downward repricing of variable rate loans. To the extent that the market value of any derivative contract moves to a negative market value, we are subject to loss if the counterparty defaults. In the future, there can be no assurance that such mitigation strategies will be available or successful or that we will be successful in implementing any new mitigation strategies necessary to address the current rising interest rate environment. In addition, transactions entered into as part of mitigation strategies employed to mitigate risks associated with a prolonged low interest rate environment could be less beneficial or result in losses if interest rates continue to rise.

Previous wording

Deposits are a low cost and stable source of funding. Wintrust competes with banks and other financial institutions for deposits and as a result, Wintrust could lose deposits in the future, clients may shift their deposits into higher cost products or Wintrust may need to raise interest rates to avoid deposit attrition. Funding costs may also increase if lost deposits are replaced with wholesale funding. Higher funding costs reduce Wintrust’s net interest margin, net interest income and net income. Any of a variety of single or combined factors could contribute to adverse movement in deposits or deposit costs, including but not limited to economic uncertainty, rapid movements in market interest rates or the Federal Reserve’s monetary policy, entrance of competitors, disruptive technology or decreased confidence in Wintrust or the banking industry.

Current wording

Deposits are a low cost and stable source of funding. Wintrust competes with banks and other financial institutions, including financial technology companies, for deposits (see the above risk factor “Risks Related to Economic Conditions and Operating Environment - The financial services industry is very competitive, and if we are not able to compete effectively, we may lose market share and our business could suffer”) and as a result, Wintrust could lose deposits in the future, clients may shift their deposits into higher cost products or Wintrust may need to raise interest rates to avoid deposit attrition. Funding costs may also increase if lost deposits are replaced with wholesale funding. Higher funding costs reduce Wintrust’s net interest margin, net interest income and net income. Any of a variety of single or combined factors could contribute to adverse movement in deposits or deposit costs, including but not limited to economic uncertainty, rapid movements in market interest rates or the Federal Reserve’s monetary policy, entrance of competitors, disruptive technology or decreased confidence in Wintrust or the banking industry.

Previous wording

As of December 31, 2024, we have been rated by Fitch Ratings as "BBB+" and Morningstar DBRS as "A (low)". A credit rating is not a recommendation to buy, sell or hold securities and may be subject to revision or withdrawal at any time by the assigning rating organization.

Current wording

As of December 31, 2025, we have been rated by Fitch Ratings as "BBB+", Morningstar DBRS as "A (low)" and Kroll Bond Rating Agency as “A-”. A credit rating is not a recommendation to buy, sell or hold securities and may be subject to revision or withdrawal at any time by the assigning rating organization.

Previous wording

Our creditworthiness is not fixed and should be expected to change over time as a result of company performance and industry conditions. We cannot give any assurances that our credit ratings will remain at current levels, and it is possible that our ratings could be lowered or withdrawn by Fitch Ratings or Morningstar DBRS. Any actual or threatened downgrade or withdrawal of our credit rating could affect our perception in the marketplace and our ability to raise capital, and could increase our debt financing costs.

Current wording

Our creditworthiness is not fixed and should be expected to change over time as a result of company performance and industry conditions. We cannot give any assurances that our credit ratings will remain at current levels, and it is possible that our ratings could be lowered or withdrawn by Fitch Ratings, Morningstar DBRS or Kroll Bond Rating Agency. Any actual or threatened downgrade or withdrawal of our credit rating could affect our perception in the marketplace and our ability to raise capital, and could increase our debt financing costs.

Previous wording

Accounting standards require the Company to categorize these securities according to a fair value hierarchy. As of December 31, 2024, approximately 97% of the Company's available-for-sale debt securities and equity securities with a readily determinable fair value were categorized in level 1 or 2 of the fair value hierarchy (meaning that their fair values were determined by unadjusted quoted prices in active markets for identical assets, quoted prices for similar assets or other observable inputs). Significant prolonged reduced investor demand could manifest itself in lower fair values for these securities and may result in recognition of an other-than-temporary or permanent impairment of available-for-sale debt securities and unrealized losses of equity securities with a readily determinable fair value recognized in earnings, which could lead to accounting charges and have a material adverse effect on the Company's financial condition and results of operations.

Current wording

Accounting standards require the Company to categorize these securities according to a fair value hierarchy. As of December 31, 2025, approximately 98% of the Company's available-for-sale debt securities and equity securities with a readily determinable fair value were categorized in level 1 or 2 of the fair value hierarchy (meaning that their fair values were determined by unadjusted quoted prices in active markets for identical assets, quoted prices for similar assets or other observable inputs). Significant prolonged reduced investor demand could manifest itself in lower fair values for these securities and may result in recognition of an other-than-temporary or permanent impairment of available-for-sale debt securities and unrealized losses of equity securities with a readily determinable fair value recognized in earnings, which could lead to accounting charges and have a material adverse effect on the Company's financial condition and results of operations.

Previous wording

The potential for operational risk exposure exists throughout our business and, as a result of our interactions with, and reliance on, third parties, is not limited to our own internal operational functions. Our operational and security systems, networks and infrastructure, including our computer systems and networks, data management, and internal processes, as well as those of third parties, are integral to our performance. We rely on our employees and third parties in our day-to-day and ongoing operations, who may, as a result of human error, misconduct, malfeasance or failure, or breach of our or of third-party systems or infrastructure, expose us to risk. For example, our ability to conduct business may be adversely affected by any significant disruptions to us or to third parties with whom we interact or upon whom we rely. In addition, our ability to implement backup systems and other safeguards with respect to third-party systems is more limited than with respect to our own systems. Moreover, technological or financial difficulties of one of our third-party vendors or their subcontractors could adversely affect our business to the extent those difficulties results in the interruption or discontinuation of services provided by an affected vendor. Our financial, accounting, data processing, backup or other operating or security systems, networks and infrastructure, or those of third parties, may fail to operate properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control, which could adversely affect our ability to process transactions or provide services. Such events may include sudden increases in customer transaction volume; electrical, telecommunications or other major physical infrastructure outages; natural disasters such as earthquakes, tornadoes, wildfires, hurricanes and floods; disease pandemics; and events arising from local or larger scale political or social matters, including wars and terrorist acts. In addition, we may need to take our systems or networks offline if they become infected with malware or a computer virus or as a result of another form of cyber-attack, information security breach or other similar incident. In the event that backup systems are utilized, they may not process data as quickly as our primary systems and some data might not have been saved to backup systems, potentially resulting in a temporary or permanent loss of such data. Our business recovery plan may not be adequate and may not prevent significant interruptions of our operations or substantial losses. We frequently update our systems to support our operations and growth and to remain compliant with all applicable laws, rules and regulations. This updating entails significant costs and creates risks associated with implementing new systems and networks and integrating them with existing ones, including business interruptions. Implementation and testing of controls relate…

Excerpt shortened here; the source contains the full paragraph.

Current wording

The potential for operational risk exposure exists throughout our business and, as a result of our interactions with, and reliance on, third parties, is not limited to our own internal operational functions. Our operational and security systems, networks and infrastructure, including our computer systems and networks, data management, and internal processes, as well as those of third parties, are integral to our performance. We rely on our employees and third parties in our day-to-day and ongoing operations, who may, as a result of human error, misconduct, malfeasance or failure, or breach of our or of third-party systems, networks or infrastructure, expose us to risk. For example, our ability to conduct business may be adversely affected by any significant disruptions to us or to third parties with whom we interact or upon whom we rely. In addition, our ability to implement backup systems and other safeguards with respect to third-party systems, networks and infrastructure is more limited than with respect to our own systems, networks and infrastructure. Moreover, technological or financial difficulties of one of our third-party vendors or service providers or their subcontractors could adversely affect our business to the extent those difficulties result in the interruption or discontinuation of products or services provided by an affected vendor or service provider. Our financial, accounting, data processing, backup or other operating or security systems, networks and infrastructure, or those of third parties, may fail to operate properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control, which could adversely affect our ability to process transactions or provide services. Such events may include sudden increases in customer transaction volume; electrical, telecommunications or other major physical infrastructure outages; natural disasters such as earthquakes, tornadoes, wildfires, hurricanes and floods; disease pandemics; and events arising from local or larger scale political or social matters, including wars and terrorist acts. In addition, we may need to take our systems, networks or infrastructure offline if they become infected with malware or a computer virus or as a result of another form of cyber-attack, information security breach or other similar incident. In the event that backup systems are utilized, they may not process data as quickly as our primary systems, networks or infrastructure and some data might not have been saved to backup systems, potentially resulting in a temporary or permanent loss of such data. Our business recovery plan may not be adequate and may not prevent significant interruptions of our operations or substantial losses. We frequently update our systems, network and infrastructure in an effort to support our operations and growth and remain compliant with all applicable laws, regulations, rules and standards. This updating entai…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

We may not be insured against all types of losses as a result of disruptions to or failures of our operational and security systems, networks and infrastructure or those of third parties, and our insurance coverage may not be available on reasonable terms, or at all, or may be inadequate to cover all losses resulting from such disruptions or failures. Disruptions or failures in our business structure or in the structure of one or more of our third-party vendors could interrupt the operations or increase the cost of doing business. The occurrence of any disruptions or failures impacting our or our third-party vendors’ operational or security systems, networks or infrastructure could result in a loss of customer business and expose us to additional regulatory scrutiny, civil litigation, and possible financial liability, any of which could adversely impact our results of operations, liquidity and financial condition, as well as cause reputational harm.

Current wording

We may not be insured against all types of losses as a result of disruptions to or failures of our operational and security systems, networks and infrastructure or those of third parties, and our insurance coverage may not be available on reasonable terms, or at all, or may be inadequate to cover all losses resulting from such disruptions or failures. Disruptions or failures in our business structure or in the structure of one or more of our third-party vendors or service providers could interrupt the operations or increase the cost of doing business. The occurrence of any disruptions or failures impacting our or our third-party vendors’ or service providers’ operational or security systems, networks or infrastructure could result in a loss of customer business and expose us to additional regulatory scrutiny, civil litigation, and possible financial liability, any of which could adversely impact our results of operations, liquidity and financial condition, as well as cause reputational harm.

Previous wording

Our computer systems and network infrastructure and those of third parties, on which we are highly dependent, are subject to security risks and could be susceptible to cyber-attacks, information security breaches and other similar incidents. Our business relies on the secure processing, transmission, storage and retrieval of confidential, personal, proprietary and other information in our computer and data management systems and networks, and in the computer and data management systems and networks of third parties. In addition, to access our network, products and services, our customers and other third parties may use personal mobile devices or computing devices that are outside of our network environment and are subject to their own cybersecurity risks.

Current wording

Our computer systems, networks and infrastructure and those of third parties, on which we are highly dependent, are subject to security risks and could be susceptible to cyber-attacks, information security breaches and other similar incidents. Our business relies on the secure processing, transmission, storage and retrieval of confidential, personal, proprietary and other information in our computer and data management systems, networks and infrastructure, and in the computer and data management systems, networks and infrastructure of third parties. In addition, to access our network, products and services, our customers and other third parties may use personal mobile devices or computing devices that are outside of our network environment and are subject to their own cybersecurity risks.

Previous wording

We, our customers, regulators and other third parties, including other financial services institutions and companies engaged in data processing, have been subject to, and are likely to continue to be the target of, cyber-attacks, information or security breaches, and other similar incidents. These may include, among other things, computer viruses, malicious or destructive code, phishing attacks, denial of service or information, ransomware, malfeasance or improper access by employees or vendors, attacks on personal email of employees, hacking, terrorist activities, identity theft, social engineering, credential stuffing, account takeovers, insider threats, human error, fraud, or other similar incidents that could result in the unauthorized release, gathering, monitoring, misuse, misappropriation, loss, disclosure or destruction of confidential, personal, proprietary and other information of ours, our employees, our customers or of third parties, damage to our systems and networks or other material disruption of our or our customers’ or other third parties’ network access or business operations. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities or incidents. Despite efforts to ensure the integrity of our systems and implement controls, processes, policies and other protective measures, we may not be able to anticipate all security breaches, nor may we be able to implement guaranteed preventive measures against such security breaches. Cyber threats are rapidly evolving and we may not be able to anticipate or prevent all such attacks and could be held liable for any security breach or loss.

Current wording

We, our customers, regulators and other third parties, including other financial services institutions and companies engaged in data processing, have been subject to, and are likely to continue to be the target of, cyber-attacks, information or security breaches, and other similar incidents. These may include, among other things, computer viruses, malicious or destructive code, phishing attacks, denial of service or information, ransomware, malfeasance or improper access by employees or vendors, attacks on personal email of employees, hacking, terrorist activities, identity theft, social engineering, credential stuffing, account takeovers, insider threats, human error, fraud, or other similar incidents that could result in the unauthorized release, gathering, monitoring, misuse, misappropriation, loss, disclosure or destruction of confidential, personal, proprietary and other information of ours, our employees, our customers or of third parties, damage to our systems and networks or other material disruption of our or our customers’ or other third parties’ network access or business operations. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities or incidents. Despite efforts to ensure the integrity of our systems, networks and infrastructure and implement controls, processes, policies and other protective measures, we may not be able to anticipate all cyber-attacks, information security breaches and other similar incidents, nor may we be able to implement guaranteed preventive, mitigating or remedial measures against such cyber-attacks, information security breaches and other similar incidents. Cyber threats are rapidly evolving and we may not be able to anticipate or prevent, mitigate or remediate all such cyber threats and could be held liable for any cyber-attack, information security breach or other similar incident.

Previous wording

Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, and the use of the internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as we continue to increase our mobile-payment and other internet-based product offerings and expand our internal usage of web-based products and applications. In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of organized crime affiliates, terrorist organizations, hostile foreign governments, nation states, nation state-supported actors, disgruntled employees or vendors, activists and other external parties, including those involved in corporate espionage. Even the most advanced internal control environment may be vulnerable to compromise. Targeted social engineering attacks and "spear phishing" attacks are becoming more sophisticated and are extremely difficult to prevent. In such an attack, an attacker will attempt to fraudulently induce colleagues, customers or other users of our systems and networks to disclose sensitive information (including confidential, personal, proprietary and other information) in order to gain access to its data or that of its clients. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cyber criminals change frequently and may not be recognized until launched or until well after a breach has occurred. The risk of a security breach caused by a cyber-attack, information security breach or other similar incident at a vendor or by unauthorized vendor access has also increased in recent years. Additionally, the existence of cyber-attacks, information security breaches or other similar incidents at third-party vendors with access to our data may not be disclosed to us in a timely manner. While we generally perform cybersecurity diligence on our key vendors, because we do not control our vendors and our ability to monitor their cybersecurity is limited, we cannot ensure the cybersecurity measures they take will be sufficient to protect any information we share them. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber-attacks, information security breaches or other similar incidents attributed to our service providers as they relate to the information we share with them.

Current wording

Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, and the use of the internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as we continue to increase our mobile-payment and other internet-based product offerings and expand our internal usage of web-based products and applications. In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of organized crime affiliates, terrorist organizations, hostile foreign governments, nation states, nation state-supported actors, disgruntled employees or vendors, activists and other external parties, including those involved in corporate espionage, and any of the foregoing may see their efforts enhanced by the use of artificial intelligence and machine learning. Even the most advanced internal control environment may be vulnerable to compromise. Targeted social engineering attacks and "spear phishing" attacks are becoming more sophisticated and are extremely difficult to prevent. In such an attack, an attacker will attempt to fraudulently induce colleagues, customers or other users of our systems and networks to disclose sensitive information (including confidential, personal, proprietary and other information) in order to gain access to its data or that of its clients. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cyber criminals change frequently and may not be recognized until launched or until well after a breach has occurred. The risk of a security breach caused by a cyber-attack, information security breach or other similar incident at a vendor or by unauthorized vendor access has also increased in recent years. Additionally, the existence of cyber-attacks, information security breaches or other similar incidents at third-party vendors and service providers with access to our data may not be disclosed to us in a timely manner. While we generally perform cybersecurity diligence on our key vendors and service providers, because we do not control our vendors and service providers and our ability to monitor their cybersecurity is limited, we cannot ensure the cybersecurity measures they take will be sufficient to protect any information we share them. Due to applicable laws, regulations, rules, standards or contractual obligations, we may be held responsible for cyber-attacks, information security breaches or other similar incidents attributed to our vendors and service providers as they relate to the information we share with them.

Previous wording

We also face indirect technology, cybersecurity and operational risks relating to the customers, clients and other third parties with whom we do business or upon whom we rely to facilitate or enable our business activities, including, for example, financial counterparties, regulators and providers of critical infrastructure such as internet access and electrical power. As a result of increasing consolidation, interdependence and complexity of financial entities and technology systems, a technology failure, cyber-attack, information security breach or other similar incident that significantly degrades, deletes or compromises the systems, networks or data of one or more financial entities could have a material impact on counterparties or other market participants, including us. This consolidation, interconnectivity and complexity increases the risk of operational failure, on both individual and industry-wide bases, as disparate systems need to be integrated, often on an accelerated basis. Any third-party technology failure, cyber-attack, information security breach, termination, constraint or other similar incident could, among other things, adversely affect our ability to effect transactions, service our clients, manage our exposure to risk or expand our business.

Current wording

We also face indirect technology, cybersecurity and operational risks relating to the customers, clients and other third parties with whom we do business or upon whom we rely to facilitate or enable our business activities, including, for example, financial counterparties, regulators and providers of critical infrastructure such as internet access and electrical power. As a result of increasing consolidation, interdependence and complexity of financial entities and technology systems, a technology failure, cyber-attack, information security breach or other similar incident that significantly degrades, deletes or compromises the systems, networks or infrastructure, including the data therein, of one or more financial entities could have a material impact on counterparties or other market participants, including us. This consolidation, interconnectivity and complexity increases the risk of operational failure, on both individual and industry-wide bases, as disparate systems, networks and infrastructure need to be integrated, often on an accelerated basis. Any third-party technology failure, cyber-attack, information security breach, termination, constraint or other similar incident could, among other things, adversely affect our ability to effect transactions, service our clients, manage our exposure to risk or expand our business.

Previous wording

Although we believe that we have appropriate information security procedures and controls designed to prevent or limit the effects of a cyber-attack, information security breach or other similar incident, our or our customers’ and/or third parties’ computers, systems or networks may be the target of cyber-attacks, information security breaches or other similar incidents that could result in the unauthorized release, accessing, gathering, monitoring, loss, destruction, modification, acquisition, transfer, use or other processing of our or our customers’ confidential, personal, proprietary and other information. Additionally, we may not be insured against all types of losses as a result of cyber-attacks, information security breaches and other similar incidents, and our insurer may deny coverage as to any future claim or insurance coverage may not be available on reasonable terms, or at all, or may be inadequate to cover all losses resulting from such incidents.

Current wording

Although we believe that we have appropriate information security procedures and controls designed to prevent or limit the effects of a cyber-attack, information security breach or other similar incident, our or our customers’ and/or third parties’ systems, networks and infrastructure may be the target of cyber-attacks, information security breaches or other similar incidents that could result in the unauthorized release, accessing, gathering, monitoring, loss, destruction, modification, acquisition, transfer, use or other processing of our or our customers’ confidential, personal, proprietary and other information. Additionally, we may not be insured against all types of losses as a result of cyber-attacks, information security breaches and other similar incidents, and our insurer may deny coverage as to any future claim or insurance coverage may not be available on reasonable terms, or at all, or may be inadequate to cover all losses resulting from such incidents.

Previous wording

Cyber-attacks, information security breaches or similar incidents, whether directed at us or third parties, may result in a material loss or have material consequences. Furthermore, the public perception that a cyber-attack on our systems has been successful, whether or not this perception is correct, may damage our reputation with customers and third parties with whom we do business. Hacking or other unauthorized disclosure of personal information and identity theft risks, in particular, could cause serious reputational harm. A successful penetration or circumvention of system security could cause us serious negative consequences, including our loss of customers and business opportunities, significant disruption to our operations and business, misappropriation or destruction of our confidential, personal, proprietary or other information and/or that of our customers or other third parties, or damage to our or our customers’ and/or third parties’ computers, systems or networks, and could result in a violation of applicable data privacy and cybersecurity laws and regulations and other laws and regulations, litigation exposure, regulatory fines, penalties or intervention, remediation costs, loss of confidence in our security measures, reputational damage, reimbursement or other compensatory costs, remediation costs, additional compliance costs, and could adversely impact our results of operations, liquidity and financial condition.

Current wording

Cyber-attacks, information security breaches or similar incidents, whether directed at us or third parties, may result in a material loss or have material consequences. Furthermore, the public perception that a cyber-attack, information security breach or other similar incident on our systems, networks or infrastructure has been successful, whether or not this perception is correct, may damage our reputation with customers and third parties with whom we do business. Hacking or other unauthorized disclosure of personal information and identity theft risks, in particular, could cause serious reputational harm. A successful cyber-attack, information security breach or other similar incident could cause us serious negative consequences, including our loss of customers and business opportunities, significant disruption to our operations and business, misappropriation or destruction of our confidential, personal, proprietary or other information and/or that of our customers or other third parties, or damage to our or our customers’ and/or third parties’ systems, networks or infrastructure, and could result in a violation of applicable data privacy and cybersecurity and other laws, regulations, rules, standards and contractual obligations, litigation exposure, regulatory fines, penalties or intervention, remediation costs, loss of confidence in our security measures, reputational damage, reimbursement or other compensatory costs, remediation costs, additional compliance costs, and could adversely impact our results of operations, liquidity and financial condition.