UNITED BANKSHARES INC/WV

The federal banking regulators regularly issue new guidance and standards, and update existing guidance and standards regarding cybersecurity intended to enhance cyber risk management among financial institutions. Financial institutions are expected to comply with such guidance and standards and to accordingly develop appropriate security controls and risk management processes. If we fail to observe such regulatory guidance or standards, we could be subject to various regulatory sanctions, including financial penalties.

Banking organizations are required to notify their primary banking regulator within 36 hours of determining that a “computer-security incident” has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss, or its operations that would impact the stability of the United States.

In July 2023, the SEC issued a final rule, “Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure,” which requires registrants to provide investors, through enhanced and standardized disclosures, greater insight into material cybersecurity incidents and the registrants’ cybersecurity risk management, strategy and governance. See Item 1C. Cybersecurity for information on United’s risk management, strategy and governance processes related to cybersecurity.

Fair Access to Financial Services

In recent years, certain states have enacted, or have proposed to enact, statutes, regulations or policies that prohibit financial institutions from denying or canceling products or services to a person or business, or otherwise discriminating against a person or business in making available products or services, on the basis of certain social or political factors or other activities. In August 2025, President Trump signed Executive Order 14331, “Guaranteeing Fair Banking Access for All Americans,” which states that it is the policy of the United States that no American should be denied access to financial services because of their constitutionally or statutorily protected beliefs, affiliations, or political views. The Executive Order directs the Treasury Secretary and federal banking regulators to address politicized or unlawful debanking activities.