SIMMONS FIRST NATIONAL CORP

Current report

Our business is heavily reliant on information technology systems, facilities, and processes; and a disruption in those systems, facilities, and processes, or a breach, including cyber-attacks, in the security of our systems, could have significant, negative impacts on our business, result in the disclosure of confidential information, and create significant financial and legal exposure for us.

Current report

Our businesses are dependent on our ability and the ability of our third-party service providers to process, record and monitor a large number of transactions and personally identifiable information. If the financial, accounting, data processing or other operating systems and facilities fail to operate properly, become disabled, experience security breaches or have other significant shortcomings, our results of operations could be materially, adversely affected.

Current report

Although we and our third party service providers devote significant resources to maintain and regularly upgrade our systems and processes that are designed to protect the security of computer systems, software, networks and other technology assets and the confidentiality, integrity and availability of information belonging to us and our customers, there is no assurance that our security systems and those of our third-party service providers will provide absolute security. Financial services institutions and companies engaged in data processing have reported breaches in the security of their websites or other systems, some of which have involved sophisticated and targeted attacks intended to obtain unauthorized access to confidential information, destroy data, disable or degrade service, or sabotage systems, often through the introduction of computer viruses or malware, cyber-attacks and other means. Certain financial institutions in the United States have also experienced attacks from technically sophisticated and well-resourced third parties that were intended to disrupt normal business activities by making internet banking systems inaccessible to customers for extended periods. These “denial-of-service” attacks have not breached our data security systems, but require substantial resources to defend, and may affect customer satisfaction and behavior. We, our customers, regulators and other third parties, including other financial services institutions and companies engaged in data processing, have been subject to, and are likely to continue to be the target of, cyber-attacks. The techniques used in cyber-attacks change rapidly and are increasingly sophisticated, including through the use of generative artificial intelligence and deepfakes, and we expect in the future through the use of quantum computing, and we may not be able to anticipate cyber-attacks or data security breaches.

Current report

Despite our efforts and those of our third party service providers to ensure the integrity of our systems, it is possible that we may not be able to anticipate or to implement effective preventive measures against all security breaches of these types, especially because the techniques used change frequently or are not recognized until launched, and because security attacks can originate from a wide variety of sources, including persons who are involved with organized crime or associated with external service providers or who may be linked to terrorist organizations or hostile foreign governments. Those parties may also attempt to fraudulently induce employees, customers or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or clients. These risks may increase in the future as artificial intelligence continues to evolve and we continue to increase our mobile payments and other internet-based product offerings and expand our internal usage of web-based products and applications. Furthermore, because certain of our employees are working, or may work, remotely, there is an increased risk of disruption to our systems because remote networks and infrastructure may not be as secure as in our office environment. If our security systems were penetrated or circumvented, it could cause serious negative consequences for us, including significant disruption of our operations, misappropriation of our confidential information or that of our customers, or damage our computers or systems and those of our customers and counterparties, and could result in violations of applicable privacy and other laws, financial loss to us or to our customers, loss of confidence in our security measures, customer dissatisfaction, significant litigation exposure, and harm to our reputation, all of which could have a material adverse effect on us.

Current report

Additionally, as cyber-attacks continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities or incidents.

Current report

If we are unsuccessful in developing new, and adapting our current, products and services so that they respond to changing industry standards and customer preferences, our business may suffer.

Current report

We provide a variety of commercial and consumer banking, as well as other financial, products and services designed to meet a broad range of needs. While many of these products and services are traditional both in their characteristics and their delivery channels, advancements in technology, changes in the regulatory environment, and evolving customer preferences require that we continuously evaluate the terms under which we provide our existing products and services (including, among other things, interest rates and loan covenants), the methods by which we deliver them (including the use of online and mobile banking), whether to partner with a FinTech company or other third-party vendor to provide products and services, and the potential for new products and services in order to remain competitive. These efforts, though, could require substantial investments, and we can provide no assurance that we will develop new products and services, or adequately adapt our existing products and services, in a timely or successful manner. Our inability to do so could harm our business and adversely affect our results of operations and reputation. Furthermore, any new line of business and/or new product or service could require the establishment of new key and other controls and have a significant impact on our existing system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business and/or new products or services could have a material adverse effect on our business and, in turn, our financial condition and results of operations.

Current report

Recently, the financial services industry has experienced rapid developments in artificial intelligence, including agentic artificial intelligence. The use of artificial intelligence models developed by third parties introduces risks related to how those models are developed, trained, and deployed, including unauthorized material in training data and limited visibility into risk mitigation steps. The legal and regulatory environment for artificial intelligence is uncertain and rapidly involving, potentially increasing compliance costs and risks of noncompliance. We may be exposed to the risk that generative artificial intelligence models may produce incorrect outputs, release confidential information, reflect biases, or otherwise cause harm. Their complexity may make it challenging to understand all outputs and comply with documentation or explanation requirements. Further, regulators have warned financial institutions of an increased risk of cyber attacks with the use of artificial intelligence. Any of these risk could adversely affect our business, expose us to liability or other adverse legal or regulatory consequences, or otherwise adversely affect our financial results.

Previous report

Changes in, or interpretations of, tax rules and regulations or our tax positions may adversely affect our income taxes, financial condition or results of operations.

Previous report

Significant judgment is required in determining our provision for income taxes. In the ordinary course of our business, there are many transactions and calculations where the ultimate tax determination is uncertain. We are subject to audit by various tax authorities. In accordance with U.S. GAAP, we recognize income tax benefits, net of required valuation and uncertain tax position allowances. Although we believe our tax estimates are reasonable, the final determination of tax audits and any related litigation could be materially different than reflected in historical income tax provisions and accruals. Should additional taxes be assessed as a result of an audit or litigation, an adverse effect on our income tax provision and net income in the period or periods for which that determination is made could result.

Previous report

During the third quarter of 2025, we completed a balance sheet repositioning focused on our investment securities portfolio in which we reclassified our held-to-maturity securities to available-for-sale and then sold approximately $3.2 billion (amortized cost basis) of investment securities. The sale of investment securities resulted in a realized after-tax loss of approximately $625.6 million (based on actual tax rate of 21.946%).

Previous report

We expect that the losses described above should be entitled to ordinary treatment. However, the Internal Revenue Service could determine that the losses described above should not be entitled to ordinary treatment, in which case we could be subject to material amounts of taxes which would have a material adverse effect on our financial condition and results of operations.