Huntington Bancshares

“Huntington’s acquisition of Cadence results in Huntington’s total consolidated assets exceeding $250 billion at closing and is expected to cause Huntington’s total average consolidated assets to exceed $250 billion in the fourth quarter of 2026, causing Huntington and the Bank to become subject to the standards applicable to Category III banking organizations, following a transition period.”

Annual report 2025A · The company itself

“The final notice amended the LFI Rating System by considering a firm with no more than one deficient-1 rating to be “well managed.” Firms that do not meet this standard, as well as firms with a deficient-2 rating for any component, would not be deemed “well managed” and would face limitations on certain acquisitions and new activities.”

Annual report 2025A · The company itself

“Enhanced Prudential Standards BHCs with consolidated assets of more than $100 billion, such as Huntington, are currently subject to certain enhanced prudential standards. As a result, Huntington is subject to more stringent standards, including liquidity and capital requirements, leverage limits, stress testing, resolution planning, and risk management standards, than those applicable to institutions with less than $100 billion in total consolidated assets.”

Annual report 2025A · The company itself

“Once Huntington exceeds $250 billion in total average consolidated assets, including following consummating the acquisition of Cadence, and not exceed certain risk-based thresholds, Huntington and the Bank will each qualify as a Category III banking organization and become subject to additional enhanced prudential standards, such as limitations on Huntington’s aggregate net credit exposures to any single, unaffiliated company (referred to as SCCL).”

Annual report 2025A · The company itself

“As a Category IV banking organization, Huntington is subject to internal liquidity stress tests and standards. When Huntington becomes a Category III banking organization, Huntington will continue to be subject to internal liquidity stress tests and standards to which Category IV banking organizations are subject, but the frequency of its liquidity stress tests will change from a quarterly basis to a monthly basis.”

Annual report 2025A · The company itself

“Long-term Debt Requirements In August 2023, the U.S. banking agencies issued a proposed rule that would require certain large banking organizations such as Huntington to comply with long-term debt requirements and “clean holding company requirements” similar to those that currently only apply to U.S. global systemically important banking organizations. This proposal would also impose a long-term debt requirement on certain categories of insured depository institutions that are not consolidated subsidiaries of U.S. global systematically important banking organizations, including insured depository institutions with $100 billion or more in total assets, such as the Bank. If adopted, this proposal would require Huntington and the Bank to each maintain a minimum outstanding eligible long-term debt amount of no less than the greater of (i) 6% of total risk-weighted assets, (ii) 2.5% of total leverage exposure (if subject to the supplementary leverage ratio), or (iii) 3.5% of average total consolidated assets.”

Annual report 2025A · The company itself

“Capital Planning and Stress Testing Huntington is required to develop, maintain, and submit to the Federal Reserve a capital plan every year, which is subject to supervisory review in connection with the Federal Reserve’s CCAR process. Huntington is required to include within its capital plan an assessment of the expected uses and sources of capital and a description of all planned capital actions over a nine-quarter planning horizon, a detailed description of the process for assessing capital adequacy, its capital policy, and a discussion of any expected changes to its business plan that are likely to have a material impact on its capital adequacy. Under the stress buffer requirements, the CCAR process is used to determine a BHC’s SCB requirement.”

Annual report 2025A · The company itself

“The Federal Reserve expects BHCs subject to CCAR, such as Huntington, to have sufficient capital to withstand a highly adverse operating environment and to be able to continue operations, maintain ready access to funding, meet obligations to creditors and counterparties, and serve as credit intermediaries. In addition, the Federal Reserve evaluates the planned capital actions of these BHCs, including planned capital distributions such as dividend payments or stock repurchases. This involves a quantitative assessment of capital based on supervisory-run stress tests that assess the ability to maintain capital levels above certain minimum ratios, after taking into consideration all capital actions included in a BHC’s capital plan, under baseline and stressful conditions throughout the nine-quarter planning horizon.”

Annual report 2025A · The company itself

“Once Huntington exceeds $250 billion in total average consolidated assets, Huntington will be required to submit to the Federal Reserve and the FDIC every three years a 165(d) Resolution Plan for its orderly resolution in the event it faces material financial distress or failure, with submissions alternating between a full resolution plan and a targeted resolution plan.”

Annual report 2025A · The company itself

“Heightened Governance and Risk Management Standards The OCC has published guidelines to set expectations for the governance and risk management practices of national banks with total assets equal to or greater than $50 billion, including the Bank. The guidelines require covered institutions to establish and adhere to a written governance framework in order to manage and control their risk-taking activities.”

Annual report 2025A · The company itself

“Cybersecurity and data privacy are also areas of increasing state legislative focus. For example, under California state law, the CCPA broadly defines personal information and substantially increases the rights of California residents to understand how their personal information is collected, used, and otherwise processed by commercial businesses, such as affording them the right to access and request deletion of their information and to opt out of certain sharing and sales of personal information. The CCPA contemplates civil penalties of up to $2,500 for each violation and up to $7,500 for each intentional violation and includes a private right of action (permitting lawsuits to be brought by private individuals instead of the state Attorney General or other government actor for certain breaches).”

Annual report 2025A · The company itself

“We operate in a highly regulated industry, and the laws and regulations that govern our operations, corporate governance, executive compensation and financial accounting, or reporting, including changes in them, or our failure to comply with them, may adversely affect us and our business model. The banking industry is highly regulated.”

Annual report 2025A · The company itself

“We are subject to supervision, regulation, and examination by various federal and state regulators, including the Federal Reserve, OCC, SEC, CFPB, FDIC, FINRA, and various state regulatory agencies. The statutory and regulatory framework that governs us is generally intended to protect depositors and customers, the DIF, the U.S. banking and financial system, and financial markets as a whole - not to protect shareholders.”

Annual report 2025A · The company itself

“These laws and regulations, many of which are discussed in Item 1: Business - “Regulatory Matters,” among other matters, prescribe minimum capital requirements, impose limitations on our business activities (including foreclosure and collection practices), limit the dividend or distributions that we can pay, restrict the ability of institutions to guarantee our debt, and impose certain specific accounting requirements that may be more restrictive and may result in greater or earlier charges to earnings or reductions in our capital than GAAP. Compliance with laws and regulations can be difficult and costly, and changes to laws and regulations often impose additional compliance costs.”

Annual report 2025A · The company itself

“Such regulation and supervision may increase our costs and limit our ability to pursue business opportunities. Further, our failure to comply with these laws and regulations, even if the failure was inadvertent or reflects a difference in interpretation, could subject us to restrictions on our business activities, fines, and other penalties, any of which could adversely affect our results of operations, capital base, and the price of our securities.”

Annual report 2025A · The company itself

“Under the supervision of the CFPB, our consumer and business banking products and services are subject to heightened regulatory oversight and scrutiny with respect to compliance with consumer laws and regulations. We may face a greater number or wider scope of investigations, enforcement actions, and litigation in the future related to consumer practices, thereby increasing costs associated with responding to or defending such actions.”

Annual report 2025A · The company itself

“Legislative and regulatory actions taken now or in the future that impact the financial industry may materially adversely affect us by increasing our costs, adding complexity in doing business, impeding the efficiency of our internal business processes, negatively impacting the recoverability of certain of our recorded assets, requiring us to increase our regulatory capital, limiting our ability to pursue business opportunities, and otherwise resulting in a material adverse impact on our financial condition, results of operation, liquidity, or stock price. Both the scope of the laws and regulations and the intensity of the supervision to which we are subject may increase in times of financial crisis, as well as a result of other factors such as technological and market changes.”

Annual report 2025A · The company itself

“The Trump administration has sought to implement a regulatory reform agenda that is significantly different than that of the Biden administration. There have been changes in rulemaking, supervision, examination, and enforcement priorities of the federal banking agencies.”

Annual report 2025A · The company itself

“For example, during 2023, the FDIC took control and was appointed receiver of Silicon Valley Bank, Signature Bank, and First Republic Bank, respectively. The failure of other banks and financial institutions and the measures taken by governments and regulators in response to these events, including increased regulatory scrutiny and heightened supervisory expectations, could adversely impact our business, financial condition, and results of operations.”

Annual report 2025A · The company itself

“There is also increased scrutiny of compliance with the rules enforced by the OFAC. If our policies, procedures, and systems are deemed deficient or the policies, procedures, and systems of the financial institutions that we have already acquired or may acquire in the future are deficient, we would be subject to liability, including fines and regulatory actions such as restrictions on our ability to pay dividends and the necessity to obtain regulatory approvals to proceed with certain planned business activities, including acquisition plans, which would negatively impact our business, financial condition, and results of operations.”

Annual report 2025A · The company itself

“Cybersecurity and data privacy are areas of heightened legislative and regulatory focus. As cybersecurity and data privacy risks for banking organizations and the broader financial system have significantly increased in recent years, cybersecurity and data privacy issues have become the subject of increasing legislative and regulatory focus.”

Annual report 2025A · The company itself

“We share, use, collect, disclose and otherwise process personal information of our customers and counterparties, including, but not limited to, personal financial information. The sharing, use, collection, disclosure, and other processing of this type of information is governed by increasingly stringent and evolving legislation and regulations, the intent of which is to protect the privacy of personal information, including personal financial information.”

Annual report 2025A · The company itself

“We are also required to maintain minimum capital ratios and the Federal Reserve and OCC may determine that Huntington and/or the Bank, based on size, complexity, or risk profile, must maintain capital ratios above these minimums in order to operate in a safe and sound manner. In the event we are required to raise capital to maintain required minimum capital and leverage ratios or ratios above the required applicable minimums, we may be forced to do so when market conditions are undesirable or on terms that are less favorable to us than we would otherwise require.”

Annual report 2025A · The company itself

“We also face the risk of becoming subject to new or more stringent requirements in connection with the introduction of new regulations or modification of existing regulations, which could require us to hold more capital or liquidity or have other adverse effects on our businesses or profitability. For example, proposed changes to applicable capital and liquidity requirements, such as the Basel III Endgame Proposal and the long-term debt proposal, could result in increased expenses or cost of funding, which could negatively affect our financial results or our ability to pay dividends and engage in share repurchases.”

Annual report 2025A · The company itself

“The Anti-Money Laundering Act of 2020, enacted as part of the National Defense Authorization Act, requires the U.S. Treasury to issue National Anti-Money Laundering and Countering the Financing of Terrorism Priorities, and conduct studies and issue regulations that may, over the next few years, significantly alter some of the due diligence, recordkeeping, and reporting requirements that the Bank Secrecy Act imposes on banks. The Anti-Money Laundering Act of 2020 also contains provisions that promote increased information-sharing and use of technology and increases penalties for violations of the Bank Secrecy Act and includes whistleblower incentives, both of which could increase the prospect of regulatory enforcement.”

Annual report 2025A · The company itself

“Failure to comply with these sanctions could have serious legal and reputational consequences.”

Annual report 2025A · The company itself

“Further, the GLBA, and its regulations such as Regulation P and Regulation S-P, require financial institutions to disclose their data privacy policies and practices relating to sharing personal information and enables retail customers to opt out of our ability to share their personal information with unaffiliated third parties under certain circumstances. The GLBA and its regulations require financial institutions to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records and information.”

Annual report 2025A · The company itself

“In October 2023, the Federal Reserve released a notice of proposed rulemaking that would lower the maximum interchange fee that a large debit card issuer can receive on a debit card transaction. Under the proposal, the Federal Reserve would set the components of the maximum interchange fee to amounts lower than those in the currently applicable Regulation II.”

Annual report 2025A · The company itself

“Consumer Protection Regulation and Supervision We are subject to supervision and regulation by the CFPB with respect to federal consumer protection laws. We are also subject to certain state consumer protection laws, and under the Dodd-Frank Act, state attorneys general and other state officials are empowered to enforce certain federal consumer protection laws and regulations. State authorities have increased their focus on and enforcement of consumer protection rules.”

Annual report 2025A · The company itself

“In May 2025, President Trump signed a Congressional Review Act resolution that overturned the CFPB’s December 2024 final rule, which would have taken effect October 1, 2025 and imposed certain requirements on overdraft fees, similar to those that apply to credit cards, unless the financial institution limited the amount of overdraft fees to the higher of the amount of costs and losses to provide overdraft services or $5.00.”

Annual report 2025A · The company itself

“Community Reinvestment Act The CRA is intended to encourage banks to help meet the credit needs of their service areas, including low- and moderate-income neighborhoods, consistent with safe and soundness practices. The relevant federal bank regulatory agency, the OCC in the Bank’s case, examines each bank and assigns it a public CRA rating. A bank’s record of fair lending compliance is part of the resulting CRA examination report.”

Annual report 2025A · The company itself

“Cybersecurity and Data Privacy Federal and state legislation and regulations contain extensive cybersecurity and data privacy provisions. Our regulatory agencies including the CFPB, FDIC, Federal Reserve, and OCC also have oversight over us, the Bank, and our subsidiaries with respect to cybersecurity and data privacy.”

Annual report 2025A · The company itself

“Operational Risks •Our operational or security systems or infrastructure, or those of third parties, could fail or be breached, which could disrupt our business and adversely impact our operations, liquidity, and financial condition, as well as cause legal or reputational harm. •We face risks from cyber-attacks and other information or security breaches, including denial of service attacks, hacking, social engineering attacks targeting our colleagues, contractors, and customers, malware intrusion or data corruption attempts, and identity theft that could result in the disclosure of confidential, proprietary, personal and other information, any of which could adversely affect our business or reputation, and create significant legal and financial exposure.”

Annual report 2025A · The company itself

“We face indirect technology, cybersecurity, data privacy and operational risks relating to the contractors, customers, clients, and other third parties with which we do business or upon which we rely to facilitate or enable our business activities, including, for example, financial counterparties, regulators, and providers of critical infrastructure such as internet access and electrical power. As a result of increasing consolidation, interdependence, and complexity of financial entities and technology systems and infrastructure, a disruption, compromise or failure that significantly degrades, damages or destroys the systems or infrastructure, or the confidential, proprietary, personal and other information stored or processed thereon, of one or more financial entities could have a material impact on counterparties or other market participants, including us.”

Annual report 2025A · The company itself

“Our financial, accounting, data processing, backup, or other operational or security systems and infrastructure may also fail to operate properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control, which could adversely affect our ability to process transactions, provide services, or otherwise conduct business. Such events may include: sudden increases in customer transaction volume; electrical, telecommunications, or other major service outages; disruptions in client access to our digital platforms and mobile applications; disease pandemics; cyber-attacks or other information or security breaches; software or hardware failures; and events arising from local or larger scale political or social matters, including wars and terrorist attacks.”

Annual report 2025A · The company itself

“In addition, the enactment of the CIRCIA in 2022, once rulemaking is complete, will require, among other things, certain companies to report significant cyber incidents to the CISA Agency within 72 hours from the time the company reasonably believes the incident occurred (and within 24 hours of making a ransom payment as a result of a ransomware attack). On April 4, 2024, the CISA Agency proposed a rule under the CIRCIA that would clarify the scope of cyber incidents to be reported and would further define covered entities subject to the CIRCIA to expressly include companies in the financial services industry that are required to report cyber incidents to their primary federal regulators. Although the CIRCIA originally required the CISA Agency to finalize its regulations by October 4, 2025, the CISA Agency has extended such deadline to May 2026.”

Annual report 2025A · The company itself

“In addition, the Federal Reserve, OCC, and FDIC require, among other things, a banking organization to notify its primary federal regulator as soon as possible and within 36 hours after identifying a “computer-security incident” that the banking organization believes in good faith could materially disrupt, degrade, or impair its business or operations in a manner that would, among other things, jeopardize the viability of its operations, result in customers being unable to access their deposit and other accounts, result in a material loss of revenue, profit, or franchise value, or pose a threat to the stability of the U.S. financial sector.”

Annual report 2025A · The company itself

“Cybersecurity and data privacy are areas of heightened legislative and regulatory focus. As cybersecurity and data privacy risks for banking organizations and the broader financial system have significantly increased in recent years, cybersecurity and data privacy issues have become the subject of increasing legislative and regulatory focus.”

Annual report 2025A · The company itself

“Cybersecurity Cybersecurity represents an important component of Huntington’s overall cross-functional approach to risk management. We actively manage a cybersecurity operation designed to detect, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions to our business.”

Annual report 2025A · The company itself

“The CISA is intended to improve cybersecurity in the U.S. by enhanced sharing of information about security threats among the U.S. government and private sector entities, including financial institutions, and empowers the CISA Agency to oversee this information-sharing process. The CISA also authorizes companies to monitor their own systems notwithstanding any other provision of law and allows companies to carry out defensive measures on their own systems from cyber-attacks or other information or security breaches. The law includes liability protections for companies that share cyber-threat information with third parties so long as such sharing activity is conducted in accordance with the CISA. Although the CISA originally expired on September 30, 2025 and was temporarily reauthorized to remain in effect through January 30, 2026, the long-term status of the CISA remains uncertain pending further action by the U.S.”

Annual report 2025A · The company itself

“FinTechs continue to emerge in key areas of banking. In addition, larger established technology platform companies continue to evaluate, and in some cases, create businesses focused on banking products. We closely monitor activity in the marketplace to ensure that our products and services are technologically competitive.”

Annual report 2025A · The company itself

“Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, including AI, and the use of the internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as we continue to increase our mobile-payment and other internet-based product offerings and expand our internal usage of web-based products and applications.”

Annual report 2025A · The company itself

“Our measurement methodologies rely on many assumptions, historical analyses, and correlations. These assumptions may not capture or fully incorporate conditions leading to losses, particularly in times of market distress, and the historical correlations on which we rely may no longer be relevant.”

Annual report 2025A · The company itself

“AI is complex and rapidly evolving, and the introduction of AI, a relatively new and emerging technology in the early stages of commercial use, into our business and operations may subject us to new or heightened legal, regulatory, ethical, operational, reputational, or other risks. The models underlying AI may be incorrectly or inadequately designed or implemented and trained on, or otherwise use, data or algorithms that are, and output that may be, incomplete, inadequate, misleading, biased, poor-quality or otherwise flawed, any of which may not be easily detectable.”

Annual report 2025A · The company itself

“If the AI that we use is deficient, inaccurate or controversial, we could incur operational inefficiencies, competitive harm, legal and regulatory action, brand or reputational harm, or other adverse impacts on our business and financial results.”

Annual report 2025A · The company itself

“Further, if we do not have sufficient rights to use the data or algorithms on which our AI solutions rely or the output generated thereby, we also may incur liability through the violation of applicable laws and regulations, such as fair lending laws and regulations, third-party intellectual property, privacy or other rights, or contracts to which we are a party.”

Annual report 2025A · The company itself

“We rely on quantitative models to measure risks and to estimate certain financial values. Quantitative models may be used to help manage certain aspects of our business and to assist with certain business decisions, including estimating expected lifetime credit losses, measuring the fair value of financial instruments when reliable market prices are unavailable, estimating the effects of changing interest rates and other market measures on our financial condition and results of operations, managing risk, and for capital planning purposes (including during the CCAR capital planning and capital adequacy process).”

Annual report 2025A · The company itself

“We use AI in connection with our business and operations, which exposes us to inherent risks that may expose us to material harm. We use AI in connection with our business and operations, including through the models we employ.”

Annual report 2025A · The company itself

“Cadence Merger Risks •We are expected to incur substantial costs related to the Cadence Merger and integration. •Combining Huntington and Cadence may be more difficult, costly or time consuming than expected and Huntington and Cadence may fail to realize the anticipated benefits of the Cadence Merger. •The future results of the combined company following the Cadence Merger may suffer if the combined company does not effectively manage its expanded operations. •The combined company may be unable to retain Huntington or Cadence personnel successfully.”

Annual report 2025A · The company itself

“Combining Huntington and Cadence may be more difficult, costly or time consuming than expected and Huntington and Cadence may fail to realize the anticipated benefits of the Cadence Merger. The success of the Cadence Merger will depend, in part, on the ability to realize the anticipated cost savings from combining the businesses of Huntington and Cadence.”

Annual report 2025A · The company itself

“Prior to completion of the Cadence Merger on February 1, 2026, Huntington and Cadence operated independently. It is possible that the integration process could result in the loss of key employees, the disruption of each company’s ongoing businesses or inconsistencies in standards, controls, procedures, and policies that adversely affect the companies’ ability to maintain relationships with clients, customers, depositors, and colleagues or to achieve the anticipated benefits and cost savings of the Cadence Merger.”

Annual report 2025A · The company itself

“•We face significant operational risks which could lead to financial loss, expensive litigation, and loss of confidence by our customers, regulators, and capital markets. •We grow our business in part by acquiring, from time to time, other financial services businesses and businesses with technologies or other assets valuable to us.”

Annual report 2025A · The company itself

“We are expected to incur substantial costs related to the Cadence Merger and integration. We have incurred and will incur substantial expenses in connection with the negotiation and completion of the transactions contemplated by the Cadence Merger Agreement.”

Annual report 2025A · The company itself

“We are expected to incur substantial costs in connection with the related integration of Cadence. There are a large number of processes, policies, procedures, operations, technologies, and systems that may need to be integrated, including purchasing, accounting and finance, payroll, compliance, treasury management, branch operations, vendor management, risk management, lines of business, pricing and benefits.”

Annual report 2025A · The company itself

“If we lose access to capital markets, we may not be able to meet the cash flow requirements of our depositors, creditors, and borrowers, or have the operating cash needed to fund corporate expansion and other corporate activities. Wholesale funding sources can include securitization, federal funds purchased, securities sold under repurchase agreements, brokered deposits, and long-term debt.”

Annual report 2025A · The company itself

“Rising interest rates, disruptions in financial markets, negative perceptions of our business or our financial strength, negative perceptions of the overall banking industry or of other regional banks, or other factors may impact our ability to raise additional capital, if needed, on terms acceptable to us.”

Annual report 2025A · The company itself

“Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have a material adverse effect on our results of operations and financial condition. Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have a material adverse effect on our results of operations and financial condition.”

Annual report 2025A · The company itself

“We are also required to maintain minimum capital ratios and the Federal Reserve and OCC may determine that Huntington and/or the Bank, based on size, complexity, or risk profile, must maintain capital ratios above these minimums in order to operate in a safe and sound manner. In the event we are required to raise capital to maintain required minimum capital and leverage ratios or ratios above the required applicable minimums, we may be forced to do so when market conditions are undesirable or on terms that are less favorable to us than we would otherwise require.”

Annual report 2025A · The company itself

“As a public company, our economic impact begins with our commitment to creating sustainable, long-term shareholder value through top-tier performance, while maintaining an aggregate moderate-to-low, through-the-cycle risk appetite and a well-capitalized position.”

Annual report 2025A · The company itself

“FinTechs continue to emerge in key areas of banking. In addition, larger established technology platform companies continue to evaluate, and in some cases, create businesses focused on banking products. We closely monitor activity in the marketplace to ensure that our products and services are technologically competitive.”

Annual report 2025A · The company itself

“Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, including AI, and the use of the internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as we continue to increase our mobile-payment and other internet-based product offerings and expand our internal usage of web-based products and applications.”

Annual report 2025A · The company itself

“The continuous widespread adoption of new technologies, including internet services and mobile applications, and advanced ATM functionality, is influencing how individuals and firms conduct their financial affairs and is changing the delivery channels for financial services. Our “People-First, Customer-Centered” strategic plan considers the implications of these changes in technology and how it may impact our customers.”

Annual report 2025A · The company itself

“Our success depends, in part, on our ability to successfully implement our strategic plan as well as adapt existing products and services and develop competitive new products and services demanded by our customers. The widespread adoption of technologies will continue to require substantial investments to modify or adapt existing products and services and to develop new products or services.”

Annual report 2025A · The company itself

“We face risks from cyber-attacks and other information or security breaches, including denial of service attacks, hacking, social engineering attacks targeting our colleagues, contractors, and customers, malware intrusion or data corruption attempts, and identity theft that could result in the disclosure of confidential, proprietary, personal and other information, any of which could adversely affect our business or reputation, and create significant legal and financial exposure.”

Annual report 2025A · The company itself

“Item 1: Business General Business Description We are a multi-state diversified regional bank holding company organized under Maryland law in 1966 and headquartered in Columbus, Ohio. Through the Bank, we are committed to making people’s lives better, helping businesses thrive, and strengthening the communities we serve, and we have been servicing the financial needs of our customers since 1866. Through our subsidiaries, we provide full-service commercial and consumer deposit, lending, and other banking and financial services.”

Annual report 2025A · The company itself

“Following is a description of our two business segments, Consumer & Regional Banking and Commercial Banking, along with the Treasury / Other function: •Consumer & Regional Banking: The Consumer & Regional Banking segment provides a wide array of financial products and services to consumer and business customers including, but not limited to, deposits, lending, payments, mortgage banking, dealer financing, investment management, trust, brokerage, insurance, and other financial products and services.”

Annual report 2025A · The company itself

“Regional Banking, along with our business and specialty banking offerings, is a dynamic part of our business. Regional Banking is defined as serving small to mid-sized businesses.”

Annual report 2025A · The company itself

“As a regional bank, our economic impact includes helping individuals and families reach their goals of financial stability and homeownership; providing businesses, especially small and mid-sized businesses, with the resources to grow; serving and supporting the underbanked; and working in partnership to create more prosperous and resilient communities.”

Annual report 2025A · The company itself

“Our primary source of liquidity is our large supply of deposits from consumer and commercial customers. The continued availability of this supply depends on customer willingness to maintain deposit balances with banks in general, and with us in particular. The availability of deposits can also be impacted by regulatory changes (e.g., changes in FDIC insurance, liquidity requirements, etc.), changes in the financial condition of Huntington, other banks, or the banking industry in general, changes in the interest rates our competitors pay on their deposits, and other events which can impact the perceived safety or economic benefits of bank deposits.”

Annual report 2025A · The company itself

“Deposits Our largest source of liquidity on a consolidated basis is customer deposits, which provide stable and lower-cost funding. Our customer deposits come from a base of primary bank customer relationships, and we continue to focus on acquiring and deepening those relationships, resulting in a diversified deposit base.”

Annual report 2025A · The company itself

“Our target clients span from mid-market to large corporate customers across a national footprint.”

Annual report 2025A · The company itself

“Asset Finance serves our clients’ capital expenditure and working capital needs through equipment financing, asset-based lending, distribution finance, structured lending, and municipal financing solutions.”

Annual report 2025A · The company itself

“Following is a description of our two business segments, Consumer & Regional Banking and Commercial Banking, along with the Treasury / Other function: •Consumer & Regional Banking: The Consumer & Regional Banking segment provides a wide array of financial products and services to consumer and business customers including, but not limited to, deposits, lending, payments, mortgage banking, dealer financing, investment management, trust, brokerage, insurance, and other financial products and services.”

Annual report 2025A · The company itself

“As a regional bank, our economic impact includes helping individuals and families reach their goals of financial stability and homeownership; providing businesses, especially small and mid-sized businesses, with the resources to grow; serving and supporting the underbanked; and working in partnership to create more prosperous and resilient communities.”

Annual report 2025A · The company itself

“Corporate, Specialty, and Government Banking serves medium to large enterprises. We focus on specific industry verticals such as government and non-profits, healthcare, technology and telecommunications, franchises, financial sponsors, Native American financial services, mortgage financial services, fund finance, and global services.”

Annual report 2025A · The company itself

“Consumer Finance provides direct and indirect consumer loans, as well as dealer finance loans and deposits. Direct consumer loan products, including mortgage and home equity, are originated through branch, online, and third-party channels. Indirect consumer loans are originated through deep relationships with dealerships to finance consumer purchases of automobiles, recreational vehicles, marine craft, and powersports.”

Annual report 2025A · The company itself

“Corporate, Specialty, and Government Banking serves medium to large enterprises. We focus on specific industry verticals such as government and non-profits, healthcare, technology and telecommunications, franchises, financial sponsors, Native American financial services, mortgage financial services, fund finance, and global services.”

Annual report 2025A · The company itself

“Consumer Finance provides direct and indirect consumer loans, as well as dealer finance loans and deposits. Direct consumer loan products, including mortgage and home equity, are originated through branch, online, and third-party channels. Indirect consumer loans are originated through deep relationships with dealerships to finance consumer purchases of automobiles, recreational vehicles, marine craft, and powersports.”

Annual report 2025A · The company itself

“Commercial Real Estate Banking provides banking solutions to commercial real estate developers and institutional sponsors across the nation.”

Annual report 2025A · The company itself

“Corporate, Specialty, and Government Banking serves medium to large enterprises. We focus on specific industry verticals such as government and non-profits, healthcare, technology and telecommunications, franchises, financial sponsors, Native American financial services, mortgage financial services, fund finance, and global services.”

Annual report 2025A · The company itself

“Market Risks •Changes in interest rates could reduce our net interest income, reduce transactional income, and negatively impact the value of our loans, securities, and other assets.”

Annual report 2025A · The company itself

“Our results of operations depend substantially on net interest income, which is the difference between interest earned on interest earning assets (such as investments and loans) and interest paid on interest bearing liabilities (such as deposits and borrowings). Interest rates are highly sensitive to many factors, including governmental monetary policies, inflation, and domestic and international economic and political conditions. Conditions such as inflation, deflation, recession, unemployment, money supply, and other factors beyond our control may also affect interest rates. In addition, the Federal Reserve’s monetary policies, including changes in the federal funds rate and increasing or reducing the size of its balance sheet, may also affect interest rates.”

Annual report 2025A · The company itself

“If our interest earning assets mature or reprice faster than interest bearing liabilities in a declining interest rate environment, our net interest income could be materially adversely impacted.”

Annual report 2025A · The company itself

“Changes in interest rates can affect the value of loans, securities, assets under management, and other assets, including mortgage servicing rights. An increase in interest rates that adversely affects the ability of borrowers to pay the principal or interest on loans and leases may lead to an increase in NPAs and a reduction of income recognized, which could have a material adverse effect on our results of operations and cash flows.”

Annual report 2025A · The company itself

“Rising interest rates reduce the value of our fixed-rate securities. Unrealized losses from available-for-sale securities impact our OCI, shareholders’ equity, and the Tangible Common Equity ratio. Any realized securities losses impact our regulatory capital ratios.”

Annual report 2025A · The company itself

“Certain investment securities, notably mortgage-backed securities, are sensitive to rising and falling interest rates. Generally, when rates rise, prepayments of principal and interest will decrease, and the duration of mortgage-backed securities will increase. Conversely, when rates fall, prepayments of principal and interest will increase, and the duration of mortgage-backed securities will decrease. In either case, interest rates have a significant impact on the value of mortgage-backed securities.”

Annual report 2025A · The company itself

“Our performance could be negatively affected to the extent there is deterioration in business and economic conditions, including persistent inflation, rising interest rates, supply chain issues, labor shortages, or changes in U.S. trade policies, including the imposition of tariffs and retaliatory tariffs, which have direct or indirect material adverse impacts on us, our customers, and our counterparties.”

Annual report 2025A · The company itself

“Changes in Huntington’s financial condition or in the general banking industry, or changes in interest rates, could result in a loss of depositor confidence.”

Annual report 2025A · The company itself

“Our primary source of liquidity is our large supply of deposits from consumer and commercial customers. The continued availability of this supply depends on customer willingness to maintain deposit balances with banks in general, and with us in particular. The availability of deposits can also be impacted by regulatory changes (e.g., changes in FDIC insurance, liquidity requirements, etc.), changes in the financial condition of Huntington, other banks, or the banking industry in general, changes in the interest rates our competitors pay on their deposits, and other events which can impact the perceived safety or economic benefits of bank deposits.”

Annual report 2025A · The company itself

“If we lose access to capital markets, we may not be able to meet the cash flow requirements of our depositors, creditors, and borrowers, or have the operating cash needed to fund corporate expansion and other corporate activities. Wholesale funding sources can include securitization, federal funds purchased, securities sold under repurchase agreements, brokered deposits, and long-term debt.”

Annual report 2025A · The company itself

“Rising interest rates, disruptions in financial markets, negative perceptions of our business or our financial strength, negative perceptions of the overall banking industry or of other regional banks, or other factors may impact our ability to raise additional capital, if needed, on terms acceptable to us.”

Annual report 2025A · The company itself

“We are exposed primarily to interest rate risk as a result of offering a wide array of financial products to our customers, and secondarily to price risk from trading securities, securities owned by our broker-dealer subsidiaries, foreign exchange positions, equity investments, and investments in securities backed by mortgage loans.”

Annual report 2025A · The company itself

“To illustrate a hypothetical sensitivity analysis, management calculated a quantitative allowance using a 100% weighting applied to an adverse scenario reflecting an amount of stress in excess of current expectations. This scenario contemplates elevated interest rates weakening credit-sensitive consumer spending and confidence more than expected. In this scenario, the impact of tariffs and immigration policy on the economy is significantly worse than expected, causing inflation to increase.”

Annual report 2025A · The company itself

“We face risks from cyber-attacks and other information or security breaches, including denial of service attacks, hacking, social engineering attacks targeting our colleagues, contractors, and customers, malware intrusion or data corruption attempts, and identity theft that could result in the disclosure of confidential, proprietary, personal and other information, any of which could adversely affect our business or reputation, and create significant legal and financial exposure.”

Annual report 2025A · The company itself

“Our computer and data management systems and network infrastructure, and those of third parties on which we are highly dependent, are subject to cybersecurity risks and could be susceptible to cyber-attacks or other information or security breaches. Our business relies on the secure processing, transmission, storage, and retrieval of confidential, proprietary, personal, and other information in our computer and data management systems and network infrastructure, and in the computer and data management systems and network infrastructure of third parties.”

Annual report 2025A · The company itself

“We, along with our customers, regulators, and other third parties, including other financial services institutions and companies engaged in data processing, have been subject to, and are likely to continue to be the target of, cyber-attacks or other information or security breaches. These cyber-attacks or other information or security breaches include computer viruses, denial of service attacks, hacking, social engineering attacks (including phishing and smishing attacks) targeting our colleagues, contractors, and customers, malware intrusion or data corruption attempts, ransomware, improper access by employees or contractors, identity theft, and other security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss, destruction, or other processing of confidential, proprietary, personal, and other information of ours, our employees, our customers, or of third parties, damage our systems and infrastructure or otherwise materially disrupt our, our customers’, or other third parties’ network access or business operations.”

Annual report 2025A · The company itself

“Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, including AI, and the use of the internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as we continue to increase our mobile-payment and other internet-based product offerings and expand our internal usage of web-based products and applications.”

Annual report 2025A · The company itself

“In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of cyber threat actors, such as organized crime affiliates, terrorist organizations, state-sponsored actors, hostile foreign governments, disgruntled employees or vendors, activists, and other external parties, including those involved in corporate espionage, any of whom may enhance their efforts through the use of AI.”

Annual report 2025A · The company itself

“Due to increasing geopolitical tensions, nation state cyber-attacks and ransomware are both increasing in sophistication and prevalence.”

Annual report 2025A · The company itself

“Remote work further increases the risk that we may experience cyber-attack or other information or security breaches as a result of our colleagues, contractors, and other third parties with which we do business or upon which we rely working remotely on less secure systems and environments.”

Annual report 2025A · The company itself

“Cyber-attacks or other information or security breaches, whether directed at us or third parties, may result in a material loss or have material consequences. Furthermore, the public perception that a cyber-attack or other information or security breach on our systems or infrastructure has been successful, whether or not this perception is correct, may damage our reputation with customers, clients, and third parties with which we do business.”

Annual report 2025A · The company itself

“A successful penetration or circumvention of our cybersecurity measures could cause us serious negative consequences, including: loss of customers, clients, and business opportunities; costs associated with maintaining business relationships after a cyber-attack or other information or security breach; significant business disruption to our operations and business, misappropriation, exposure, or destruction of our confidential, proprietary, personal, and other information, intellectual property, funds, and/or those of our customers or clients; or damage to our, our customers’, our clients’, and/or third parties’ systems or infrastructure. The occurrence of any of these events could result in a violation of applicable data privacy laws and regulations and other laws and regulations, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our cybersecurity measures, reputational damage, reimbursement or other compensatory costs, additional compliance costs, and could adversely impact our results of operations, liquidity, and financial condition.”

Annual report 2025A · The company itself

“We are exposed to many types of operational risks, including the risk of fraud or theft by colleagues or outsiders, unauthorized transactions by colleagues or outsiders, operational errors by colleagues, business disruption, and system failures. Huntington executes against a significant number of controls, a large percent of which are manual and dependent on adequate execution by colleagues and third-party service providers.”

Annual report 2025A · The company itself

“Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have a material adverse effect on our results of operations and financial condition. Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have a material adverse effect on our results of operations and financial condition.”

Annual report 2025A · The company itself

“For example, global conflicts (including the continuing conflicts involving Ukraine and the Russian Federation and those in the Middle East) or other similar events, as well as government actions or other restrictions in connection with such events, and trade negotiations between the U.S. and other nations could adversely impact economic and market conditions for the Company and its clients and counterparties.”

Annual report 2025A · The company itself

“In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of cyber threat actors, such as organized crime affiliates, terrorist organizations, state-sponsored actors, hostile foreign governments, disgruntled employees or vendors, activists, and other external parties, including those involved in corporate espionage, any of whom may enhance their efforts through the use of AI.”

Annual report 2025A · The company itself

“Due to increasing geopolitical tensions, nation state cyber-attacks and ransomware are both increasing in sophistication and prevalence.”

Annual report 2025A · The company itself

“We maintain a contingency funding plan that provides for liquidity stress testing, which assesses the potential erosion of funds in the event of an institution-specific event or systemic financial market crisis. Examples of institution specific events could include a downgrade in our public credit rating by a rating agency, a large charge to earnings, declines in profitability or other financial measures, declines in liquidity sources including reductions in deposit balances or access to contingent funding sources, or a significant merger or acquisition. Examples of systemic events unrelated to us that could have an effect on our access to liquidity would be terrorism or war, natural disasters, political events, failure of a major financial institution, or the default or bankruptcy of a major corporation, mutual fund, or hedge fund.”

Annual report 2025A · The company itself

“Increased geopolitical tensions heighten the risk that China might block the Taiwan strait, limiting the supply chain for semiconductors and raising fears of a broader conflict. Additionally, concerns grow that the Russian invasion of Ukraine lasts longer than in the baseline scenario and that the Middle East conflict will widen.”

Annual report 2025A · The company itself

“Our results of operations depend substantially on net interest income, which is the difference between interest earned on interest earning assets (such as investments and loans) and interest paid on interest bearing liabilities (such as deposits and borrowings). Interest rates are highly sensitive to many factors, including governmental monetary policies, inflation, and domestic and international economic and political conditions. Conditions such as inflation, deflation, recession, unemployment, money supply, and other factors beyond our control may also affect interest rates. In addition, the Federal Reserve’s monetary policies, including changes in the federal funds rate and increasing or reducing the size of its balance sheet, may also affect interest rates.”

Annual report 2025A · The company itself

“Inflation could negatively impact our business, our profitability, and our stock price.”

Annual report 2025A · The company itself

“Prolonged periods of inflation may impact our profitability by negatively impacting our fixed costs and expenses, including increasing funding costs and expense related to talent acquisition and retention. Additionally, inflation may lead to a decrease in consumer and clients’ purchasing power and negatively affect the need or demand for our products and services. If significant inflation continues, our business could be negatively affected by, among other things, increased default rates leading to credit losses which could decrease our appetite for new credit extensions.”

Annual report 2025A · The company itself

“Our performance could be negatively affected to the extent there is deterioration in business and economic conditions, including persistent inflation, rising interest rates, supply chain issues, labor shortages, or changes in U.S. trade policies, including the imposition of tariffs and retaliatory tariffs, which have direct or indirect material adverse impacts on us, our customers, and our counterparties.”

Annual report 2025A · The company itself

“In addition, global supply chain disruptions may cause prolonged inflation, adversely impact consumer and business confidence, and adversely affect the economy as well as our financial condition and results.”

Annual report 2025A · The company itself

“To illustrate a hypothetical sensitivity analysis, management calculated a quantitative allowance using a 100% weighting applied to an adverse scenario reflecting an amount of stress in excess of current expectations. This scenario contemplates elevated interest rates weakening credit-sensitive consumer spending and confidence more than expected. In this scenario, the impact of tariffs and immigration policy on the economy is significantly worse than expected, causing inflation to increase.”

Annual report 2025A · The company itself

“Our results of operations depend substantially on net interest income, which is the difference between interest earned on interest earning assets (such as investments and loans) and interest paid on interest bearing liabilities (such as deposits and borrowings). Interest rates are highly sensitive to many factors, including governmental monetary policies, inflation, and domestic and international economic and political conditions. Conditions such as inflation, deflation, recession, unemployment, money supply, and other factors beyond our control may also affect interest rates. In addition, the Federal Reserve’s monetary policies, including changes in the federal funds rate and increasing or reducing the size of its balance sheet, may also affect interest rates.”

Annual report 2025A · The company itself

“Weakness in economic conditions could adversely affect our business. Continued economic uncertainty and a recessionary or stagnant economy could adversely affect our business, financial condition, and results of operations.”

Annual report 2025A · The company itself

“A U.S. government debt default would have a material adverse impact on our business and financial performance, including a decrease in the value of Treasury bonds and other government securities held by us, which could negatively impact Huntington’s and the Bank’s capital positions and their ability to meet regulatory requirements. Other negative impacts of a U.S. government debt default, budget deficit concerns, government shutdown, or related credit ratings downgrades could include volatile capital markets, an adverse impact on the U.S. economy and the U.S. dollar, as well as increased default rates among borrowers in light of increased economic uncertainty.”

Annual report 2025A · The company itself

“Changes in Huntington’s financial condition or in the general banking industry, or changes in interest rates, could result in a loss of depositor confidence.”

Annual report 2025A · The company itself

“We maintain a contingency funding plan that provides for liquidity stress testing, which assesses the potential erosion of funds in the event of an institution-specific event or systemic financial market crisis. Examples of institution specific events could include a downgrade in our public credit rating by a rating agency, a large charge to earnings, declines in profitability or other financial measures, declines in liquidity sources including reductions in deposit balances or access to contingent funding sources, or a significant merger or acquisition. Examples of systemic events unrelated to us that could have an effect on our access to liquidity would be terrorism or war, natural disasters, political events, failure of a major financial institution, or the default or bankruptcy of a major corporation, mutual fund, or hedge fund.”

Annual report 2025A · The company itself

“We are exposed to many types of operational risks, including the risk of fraud or theft by colleagues or outsiders, unauthorized transactions by colleagues or outsiders, operational errors by colleagues, business disruption, and system failures. Huntington executes against a significant number of controls, a large percent of which are manual and dependent on adequate execution by colleagues and third-party service providers.”

Annual report 2025A · The company itself

“We believe that our continued growth and future success will depend in large part on the skills of our management team and our ability to motivate and retain these individuals and other key personnel. The loss of service of one or more of our executive officers or key personnel could reduce our ability to successfully implement our long-term business strategy, our business could suffer, and the value of our stock could be materially adversely affected.”

Annual report 2025A · The company itself

“Our success also depends on the experience of our branch managers and lending officers and on their relationships with the customers and communities they serve. The loss of these key personnel could negatively impact our banking operations.”

Annual report 2025A · The company itself

“The combined company may be unable to retain Huntington or Cadence personnel successfully. The success of the Cadence Merger will depend in part on the combined company’s ability to retain the talents and dedication of key employees currently employed by Huntington and Cadence.”

Annual report 2025A · The company itself

“The scope and content of compensation regulation in the financial industry are continuing to develop, and we expect that these regulations and resulting market practices will continue to evolve over a number of years. The federal bank regulatory agencies have issued joint guidance on executive compensation designed to ensure that the incentive compensation policies of banking organizations, such as Huntington and the Bank, do not encourage imprudent risk taking and are consistent with the safety and soundness of the organization.”

Annual report 2025A · The company itself

“In addition, our reputation and client relationships may be damaged as a result of our practices related to climate change, including our involvement, or our customers’ involvement, in certain industries or projects, in the absence of mitigation and/or transition measures, associated with causing or exacerbating climate change, as well as any decisions we make to continue to conduct or change our activities in response to considerations relating to climate change.”

Annual report 2025A · The company itself

“Our ability to attract and retain customers, clients, investors, and employees is affected by our reputation. Significant harm to our reputation can arise from various sources, including officer, director, or employee misconduct, actual or perceived unethical behavior, conflicts of interest, security breaches, litigation or regulatory outcomes, compensation practices, failing to deliver minimum or required standards of service and quality, failing to address customer and agency complaints, compliance failures, unauthorized release, gathering, monitoring, misuse, loss, destruction or other processing of confidential, proprietary, personal, and other information due to cyber-attacks or other information or security breaches, disruptions, compromises or failures of our systems or infrastructure, perception of our corporate responsibility or environmental practices and disclosures, and the activities of our clients, customers, and counterparties, including vendors.”

Annual report 2025A · The company itself

“Divergent ideological and social views may create competing stakeholder, legislative, and regulatory scrutiny that may impact our reputation or operations. In particular, there is an increasing number of state-level anti-ESG initiatives in the U.S. that may conflict with other regulatory requirements or our various stakeholders’ expectations.”

Annual report 2025A · The company itself

“Our financial, accounting, data processing, backup, or other operational or security systems and infrastructure may also fail to operate properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control, which could adversely affect our ability to process transactions, provide services, or otherwise conduct business. Such events may include: sudden increases in customer transaction volume; electrical, telecommunications, or other major service outages; disruptions in client access to our digital platforms and mobile applications; disease pandemics; cyber-attacks or other information or security breaches; software or hardware failures; and events arising from local or larger scale political or social matters, including wars and terrorist attacks.”

Annual report 2025A · The company itself

“Our computer and data management systems and network infrastructure, and those of third parties on which we are highly dependent, are subject to cybersecurity risks and could be susceptible to cyber-attacks or other information or security breaches. Our business relies on the secure processing, transmission, storage, and retrieval of confidential, proprietary, personal, and other information in our computer and data management systems and network infrastructure, and in the computer and data management systems and network infrastructure of third parties.”

Annual report 2025A · The company itself

“We rely on third parties to provide key components of our business infrastructure. We rely on third-party service providers, both domestically and offshore, to leverage subject matter expertise and industry best practice, provide enhanced products and services, and reduce costs.”

Annual report 2025A · The company itself

“Our performance could be negatively affected to the extent there is deterioration in business and economic conditions, including persistent inflation, rising interest rates, supply chain issues, labor shortages, or changes in U.S. trade policies, including the imposition of tariffs and retaliatory tariffs, which have direct or indirect material adverse impacts on us, our customers, and our counterparties.”

Annual report 2025A · The company itself

“For example, global conflicts (including the continuing conflicts involving Ukraine and the Russian Federation and those in the Middle East) or other similar events, as well as government actions or other restrictions in connection with such events, and trade negotiations between the U.S. and other nations could adversely impact economic and market conditions for the Company and its clients and counterparties.”

Annual report 2025A · The company itself

“To illustrate a hypothetical sensitivity analysis, management calculated a quantitative allowance using a 100% weighting applied to an adverse scenario reflecting an amount of stress in excess of current expectations. This scenario contemplates elevated interest rates weakening credit-sensitive consumer spending and confidence more than expected. In this scenario, the impact of tariffs and immigration policy on the economy is significantly worse than expected, causing inflation to increase.”

Annual report 2025A · The company itself

“AI and the use thereof is also subject to a variety of existing laws and regulations, including fair lending, consumer protection, intellectual property, cybersecurity, data privacy, and equal opportunity, and is expected to be subject to new laws and regulations or new applications of existing laws and regulations. AI is the subject of evolving review by various governmental and regulatory agencies, and changes in laws and regulations governing AI may adversely affect our ability to use AI.”

Annual report 2025A · The company itself

“A U.S. government debt default would have a material adverse impact on our business and financial performance, including a decrease in the value of Treasury bonds and other government securities held by us, which could negatively impact Huntington’s and the Bank’s capital positions and their ability to meet regulatory requirements. Other negative impacts of a U.S. government debt default, budget deficit concerns, government shutdown, or related credit ratings downgrades could include volatile capital markets, an adverse impact on the U.S. economy and the U.S. dollar, as well as increased default rates among borrowers in light of increased economic uncertainty.”

Annual report 2025A · The company itself

“We rely on third parties to provide key components of our business infrastructure. We rely on third-party service providers, both domestically and offshore, to leverage subject matter expertise and industry best practice, provide enhanced products and services, and reduce costs.”

Annual report 2025A · The company itself

“Although there are benefits in entering into third-party relationships with vendors and others, there are risks associated with such activities. When entering a third-party relationship, the risks associated with that activity are not passed to the third party but remain our responsibility.”

Annual report 2025A · The company itself

“The physical risks of climate change include discrete events, such as flooding, hurricanes, and wildfires, and longer-term shifts in climate patterns, such as extreme heat, sea level rise, and more frequent and prolonged drought. Under medium or longer-term scenarios, such events, if uninterrupted or unaddressed, could disrupt our operations or those of our customers or third parties on which we rely, including through direct damage to assets and indirect impacts from supply chain disruption and market volatility.”

Annual report 2025A · The company itself

“Additionally, these changes require us to adapt our product and services, as well as our distribution of them, to evolving industry standards and customer preferences. Failure to address competitive pressures could make it more difficult for us to attract and retain customers across our businesses.”

Annual report 2025A · The company itself

“Additionally, transitioning to a low-carbon economy may entail extensive policy, legal, technology, and market initiatives. Transition risks, including changes in consumer preferences and additional regulatory requirements or supervisory expectations or taxes, could increase our expenses and undermine our strategies.”

Annual report 2025A · The company itself

“Additionally, transitioning to a low-carbon economy may entail extensive policy, legal, technology, and market initiatives. Transition risks, including changes in consumer preferences and additional regulatory requirements or supervisory expectations or taxes, could increase our expenses and undermine our strategies.”

Annual report 2025A · The company itself

“In addition, global supply chain disruptions may cause prolonged inflation, adversely impact consumer and business confidence, and adversely affect the economy as well as our financial condition and results.”

Annual report 2025A · The company itself

“Remote work further increases the risk that we may experience cyber-attack or other information or security breaches as a result of our colleagues, contractors, and other third parties with which we do business or upon which we rely working remotely on less secure systems and environments.”

Annual report 2025A · The company itself

“The Bank accepts customer deposits that are insured by the DIF and, therefore, must pay insurance premiums. The FDIC may increase the Bank’s insurance premiums based on various factors, including the FDIC’s assessment of its risk profile.”

Annual report 2025A · The company itself

“We are exposed primarily to interest rate risk as a result of offering a wide array of financial products to our customers, and secondarily to price risk from trading securities, securities owned by our broker-dealer subsidiaries, foreign exchange positions, equity investments, and investments in securities backed by mortgage loans.”

Annual report 2025A · The company itself

“We are exposed primarily to interest rate risk as a result of offering a wide array of financial products to our customers, and secondarily to price risk from trading securities, securities owned by our broker-dealer subsidiaries, foreign exchange positions, equity investments, and investments in securities backed by mortgage loans.”

Annual report 2025A · The company itself

“As of December 31, 2025, we operated more than 1,000 branches in 14 states.”

Annual report 2025A · The company itself

“Following the completion of our merger with Cadence Bank on February 1, 2026, as further discussed below, we operate nearly 1,400 branches in 21 states, with certain businesses operating in extended geographies.”

Annual report 2025A · The company itself