WESTERN ALLIANCE BANCORPORATION

Insider Adoption of Termination of Trading Arrangements

During the quarter ended December 31, 2024, none of our directors or officers informed us of the adoption or termination of any "Rule 10b5-1 trading arrangement" or "non-Rule 10b5-1 trading arrangement," as those terms are defined in Item 408 of Regulation S-K.

Departure of Directors or Certain Officers; Election of Directors; Appointment of Certain Officers; Compensatory Arrangements of Certain Officers (Item 5.02(c))

As previously reported on the Company’s Current Report on Form 8-K filed on July 30, 2024, J. Kelly Ardrey, Jr., the Company’s Chief Accounting Officer, notified the Company of his intention to retire from the Company, effective March 3, 2025. In anticipation of Mr. Ardrey’s retirement, on February 24, 2025, Ben Mucha was appointed as Chief Accounting Officer, effective as of March 3, 2025. Mr. Mucha (53) has been the Company’s Deputy Chief Accounting Officer since March 2023. Prior to joining the Company, Mr. Mucha was Assistant Controller (March 2020 to March 2023) and Director of External Reporting and Corporate Accounting (October 2018-March 2020) with U.S. Bank.

There are no arrangements or understandings between Mr. Mucha and any other person pursuant to which he was appointed as Chief Accounting Officer, and there are no transactions between Mr. Mucha and the Company that would require disclosure under Item 404(a) of Regulation S-K. There are no family relationships between Mr. Mucha and any director or executive officer. No material plans, contracts or arrangements have been entered into between the Company and Mr. Mucha in connection with his appointment.

Other Events (Item 8.01)

On February 19, 2025, the Company determined to report information related to a data security incident which it has been investigating. On January 27, 2025, the Company was made aware that a threat actor obtained unauthorized access to files transferred through a third-party secure file transfer software used by WAB. The Company was made aware of a zero-day vulnerability at the vendor on October 27, 2024 (the “Vendor Incident”), and immediately activated its incident response process to investigate and deployed all patches as recommended by the software developer. The Company and its information security consultants found no evidence of any unlawful infiltration or exfiltration of any Company or customer data until January 27, 2025, when the Company’s surveillance process identified files related to the Vendor Incident published by the threat actor. The files included data flowing through the file transfer software between October 12-24, 2024, prior to notification of the Vendor Incident. The Company will work with clients who may have been impacted and will make appropriate notifications to impacted individuals. Although the Company continues to investigate and has not determined the full impact of this incident, at this time the incident has not had a material impact on the Company’s business or operations. The Company does not anticipate any material impact on the Company’s financial condition or results of operations.