Northern Trust

“Our earnings also could be affected by poor investment returns or changes in our clients’ investment preferences driven by factors beyond market volatility or weak economic conditions. Poor absolute or relative investment performance in funds or client accounts that we manage or in investment products that we design or provide could result in declines in the market values of portfolios that we manage and/or administer and could affect our ability to retain existing assets and to attract new clients or additional assets from existing clients.”

Annual report 2025A · The company itself

“Liquidity Risks If we do not manage our liquidity effectively, our business could suffer. Liquidity is essential for the operation of our business. Market conditions, unforeseen outflows of funds or other events could have a negative effect on our level or cost of funding, affecting our ongoing ability to accommodate liability maturities and deposit withdrawals, meet contractual obligations, and fund new business transactions at a reasonable cost and in a timely manner.”

Annual report 2025A · The company itself

“We also manage investment products that, while not obligations of ours, may be exposed to liquidity risks. These products, such as money market and other short-term investments provide clients a right to the return of cash or assets on limited notice. If clients demand a return of their cash or assets, particularly on limited notice, and these investment products do not have the liquidity to support those demands, we could be forced to sell investment securities held by these investment products at unfavorable prices potentially damaging our reputation with the investment community.”

Annual report 2025A · The company itself

“However, our ability to access the capital markets, if needed, will depend on a number of factors, including the state of the financial markets. Heightened interest rates, disruptions in financial markets, negative perceptions of our business or our financial strength, or other factors may impact our ability to raise additional capital, if needed, on terms favorable to us.”

Annual report 2025A · The company itself

“At December 31, 2025, total AUC/A and AUC increased from the prior year primarily driven by favorable markets.”

Annual report 2025A · The company itself

“AUM at the end of 2025 increased from 2024, primarily reflecting favorable markets and net asset inflows.”

Annual report 2025A · The company itself

“Average taxable Securities were $45.9 billion in 2025 and $43.9 billion in 2024. Average nontaxable Securities, which represent securities that are primarily exempt from U.S. federal and state income taxes, were $8.2 billion in 2025 and $6.2 billion in 2024.”

Annual report 2025A · The company itself

“Investment solutions are delivered through separately managed accounts, bank common and collective funds, registered investment companies, exchange traded funds, non-U.S. collective investment funds, and unregistered private investment funds. Asset Management’s capabilities include active and passive equity; active and passive fixed income; cash management; multi-asset and alternative asset classes (such as private equity and hedge funds of funds); and multi-manager advisory services and products.”

Annual report 2025A · The company itself

“TABLE 18: CONSOLIDATED ASSETS UNDER MANAGEMENT BY INVESTMENT TYPE DECEMBER 31, CHANGE ($ In Billions) 2025 2024 2023 2025 / 2024 2024 / 2023 Equities $ 1,015.6 $ 903.1 $ 785.5 12 % 15 % Fixed Income Securities Securities Lending Collateral Total Assets Under Management $ 1,803.2 $ 1,610.4 $ 1,434.5 12 % 12 % The following table presents activity in consolidated AUM by product during the years ended December 31, 2025, 2024 and 2023.”

Annual report 2025A · The company itself

“DATA PRIVACY AND SECURITY Federal law establishes a minimum federal standard of financial privacy by, among other provisions, requiring financial institutions to adopt, disclose, and enforce privacy policies with respect to consumer information, setting limitations on disclosure to third parties of consumer information, setting standards for protecting client information and preventing unlawful access to such information, and requiring notice of data breaches in certain circumstances. For example, the Federal Trade Commission has the authority to regulate and enforce against unfair or deceptive acts or practices in or affecting commerce, including acts and practices with respect to data privacy and security, and the Gramm-Leach-Bliley Act regulates the confidentiality and security of customer information obtained by financial institutions and certain other types of financial services businesses.”

Annual report 2025A · The company itself

“Most U.S. states, the EU and other non-U.S. jurisdictions also have adopted their own statutes and/or regulations concerning data privacy and security and requiring notification of data breaches―for example, the General Data Protection Regulation (GDPR) in Europe and its equivalent in the UK (UK GDPR), the Personal Information Protection Law (PIPL) in China, and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, CCPA) in the United States. Similar laws are in effect or being implemented in other jurisdictions in which we operate across the globe.”

Annual report 2025A · The company itself

“In the United States, the CCPA broadly defines personal information and substantially increases the rights of California residents to understand how their personal information is collected, used, and otherwise processed by commercial businesses, such as affording them the right to access and request deletion of their information and to opt out of certain sharing and sales of personal information. The CCPA includes a private right of action (permitting lawsuits to be brought by private individuals instead of the state Attorney General or other government actor for certain breaches), and contemplates civil penalties of up to $2,500 for each violation and up to $7,500 for each intentional violation.”

Annual report 2025A · The company itself

“Any failure or perceived failure by us to comply with our privacy policies, or applicable data privacy and security laws, regulations, rules, standards or contractual obligations, or any compromise of security that results in unauthorized access to, or unauthorized loss, destruction, use, modification, acquisition, disclosure, release or transfer of personal information, may result in requirements to modify or cease certain operations or practices, the expenditure of substantial costs, time and other resources, proceedings or actions against us, legal liability, governmental investigations, enforcement actions, claims, fines, judgments, awards, penalties, sanctions and costly litigation (including class actions).”

Annual report 2025A · The company itself

“Despite internal policies in place with respect to the usage of AI, if any of our employees or service providers were to use any third-party AI-powered software in connection with our business or the services they provide to us, it may lead to the inadvertent disclosure or incorporation of our confidential information into publicly available training set, which may impact our ability to realize the benefit of, or adequately maintain, protect and enforce our intellectual property or confidential information, harming our competitive position and business.”

Annual report 2025A · The company itself

“Technology and Cyber Risk Oversight The Technology and Cyber Risk Management function provides oversight to the identification, assessment, measurement, monitoring, and reporting on technology and cyber risk matters. Technology and cyber risk is best managed at the source of the risk, and is mitigated through internal controls and risk management designed to identify, understand, and keep such risk at levels consistent with the organization’s overall risk appetite while also managing the inherent risk in supporting the organization’s growth and client preferences for interacting with technology.”

Annual report 2025A · The company itself

“Regulation of AI is rapidly evolving in the U.S. and worldwide as legislators and regulators are increasingly focused on these powerful emerging technologies. The technologies underlying AI and its uses are subject to a variety of laws and regulations, including intellectual property, privacy, data protection, cybersecurity, consumer protection, competition, and equal opportunity laws, and are expected to be subject to increased regulation and new laws or new applications of existing laws and regulations. Additionally, several U.S. states, including Colorado and California, have passed or are continuing to propose laws and regulations that govern various facets and uses of AI, including consequential decisions, and, in Europe, the EU’s Artificial Intelligence Act (EU AI Act) entered into force on August 1, 2024.”

Annual report 2025A · The company itself

“The final text of the EU AI Act was published in the Official Journal of the European Union in July 2024 and entered into force in August 2024. Most of the EU AI Act’s substantive obligations will apply following a two-year implementation period, beginning in August 2026. The EU AI Act will have a significant impact on organizations that develop, deploy, or use AI systems both inside and outside the EU.”

Annual report 2025A · The company itself

“Further, the regulatory framework for AI and similar technologies, and automated decision making, is changing rapidly. It is possible that new laws and regulations will be adopted in the U.S. and in non-U.S. jurisdictions, or that existing laws and regulations may be interpreted, in ways that would affect the operation of our products and services and the way in which we use AI and similar technologies.”

Annual report 2025A · The company itself

“Northern Trust has certain processes and controls in place designed to mitigate the risks associated with the use of AI solutions, including monitoring the development and applicability of such evolving laws and regulations, and has taken, and will continue to take steps designed to comply with laws and regulations applicable to Northern Trust’s use of AI.”

Annual report 2025A · The company itself

“Additionally, technological advances (such as the use of generative AI) and the growth of internet-based commerce have made it possible for other types of institutions to offer a variety of products and services competitive with certain areas of our business. Many of these nontraditional service providers have fewer regulatory constraints and some have lower cost structures.”

Annual report 2025A · The company itself

“Further, our competitors or other third parties may incorporate AI into their products more quickly or more successfully than us, which could impair our ability to compete effectively.”

Annual report 2025A · The company itself

“In addition, the use of generative AI, a relatively new and emerging technology in the early stages of commercial use, exposes us to additional risks, such as damage to our reputation, competitive position, and business, legal and regulatory risks and additional costs. For example, generative AI has been known to produce false or “hallucinatory” inferences or output, and certain generative AI uses machine learning and predictive analytics, which can create inaccurate, incomplete, or misleading content, unintended biases, and other discriminatory or unexpected results, errors or inadequacies, any of which may not be easily detectable.”

Annual report 2025A · The company itself

“Northern Trust will continue to enable its strategy through significant investments in talent and culture, technology, data, AI and operational excellence.”

Annual report 2025A · The company itself

“ARTIFICIAL INTELLIGENCE Northern Trust uses a variety of machine learning and artificial intelligence (AI) solutions to process transactional activity more efficiently and to mitigate risk. These uses currently include, among others, digitizing documents, detecting anomalous, fraudulent transactions and training services teams on operational processes.”

Annual report 2025A · The company itself

“Our success in the competitive environment in which we operate requires consistent investment of capital and human resources in innovation, particularly in light of the current “FinTech” environment, in which the financial services industry is undergoing rapid technological changes and financial institutions are investing significantly in evaluating new technologies, such as AI, machine learning, blockchain and other distributed ledger technologies, and developing potentially industry-changing new products, services and industry standards.”

Annual report 2025A · The company itself

“We use various systems and models, including AI-powered solutions, in analyzing and monitoring several risk categories, as well as for other business purposes.”

Annual report 2025A · The company itself

“Increased expenses have affected—and a failure to control our costs and expenses in the future, whether as a result of inflation or otherwise, could affect—our earnings negatively.”

Annual report 2025A · The company itself

“Our success depends, in large part, on our ability to attract new employees, retain and motivate our existing employees, and continue to compensate our employees competitively. Competition for the best employees in most activities in which we engage can be intense, and there can be no assurance that we will be successful in our efforts to recruit and retain necessary personnel.”

Annual report 2025A · The company itself

“Northern Trust will continue to enable its strategy through significant investments in talent and culture, technology, data, AI and operational excellence.”

Annual report 2025A · The company itself

“THE EMPLOYEE EXPERIENCE We elevate the employee experience from recruitment to retirement by investing in three core areas: professional development, rewarding performance, and strengthening workforce and operational resiliency. By fostering an environment where our employees thrive, we ensure that our workforce is fully engaged, motivated, celebrated, and equipped to drive our strategy.”

Annual report 2025A · The company itself

“PROFESSIONAL DEVELOPMENT From internships to executive development, our goal is to help our employees excel in their current roles and acquire new skills for future growth. Through Northern Trust University, we deliver comprehensive professional and functional training programs designed to equip our employees at every stage of their careers.”

Annual report 2025A · The company itself

“The failure to respond properly to, and invest in, changes and advancements in technology and/or to compete for and retain employees with the necessary technical skills and expertise could limit our ability to attract and retain clients, prevent us from offering products and services comparable to those offered by our competitors, inhibit our ability to meet regulatory requirements or otherwise have a material adverse effect on our operations.”

Annual report 2025A · The company itself

“Additionally, technological advances (such as the use of generative AI) and the growth of internet-based commerce have made it possible for other types of institutions to offer a variety of products and services competitive with certain areas of our business. Many of these nontraditional service providers have fewer regulatory constraints and some have lower cost structures.”

Annual report 2025A · The company itself

“Our success in the competitive environment in which we operate requires consistent investment of capital and human resources in innovation, particularly in light of the current “FinTech” environment, in which the financial services industry is undergoing rapid technological changes and financial institutions are investing significantly in evaluating new technologies, such as AI, machine learning, blockchain and other distributed ledger technologies, and developing potentially industry-changing new products, services and industry standards.”

Annual report 2025A · The company itself

“The allowance evaluated on a collective basis for undrawn loan commitments and letters of credit decreased $7.1 million to $23.3 million at December 31, 2025, compared with $30.4 million at December 31, 2024, primarily in the C&I portfolio, driven by a refinement of factors used to estimate credit losses.”

Annual report 2025A · The company itself

“ASSET SERVICING Asset Servicing (AS) is a leading global provider of asset servicing and related services to corporate and public retirement funds, foundations, endowments, fund managers, insurance companies, sovereign wealth funds, and other institutional investors around the globe.”

Annual report 2025A · The company itself

“In supporting these targeted segments, Wealth Management provides trust, investment management, custody, and philanthropic services; financial consulting; guardianship and estate administration; family business consulting; family financial education; brokerage services; and private and business banking.”

Annual report 2025A · The company itself

“Northern Trust emphasizes the development and growth of scalable, sustainable fee-based income.”

Annual report 2025A · The company itself

“Asset servicing and related services encompass a full range of capabilities including but not limited to: custody; fund administration; investment operations outsourcing; investment management; investment risk and analytical services; employee benefit services; securities lending; foreign exchange; treasury management; brokerage services; transition management services; banking; and cash management.”

Annual report 2025A · The company itself

“•Transition risks may result from shifts in policy, technology, and market preferences toward a lower-carbon economy which can impact asset valuations, core costs (including energy) and client demand. At the same time, regulatory expectations, government policy and stakeholder scrutiny can increase compliance costs and reputational exposure.”

Annual report 2025A · The company itself

“This includes the development and marketing of effective and competitive new products, objectively understanding how climate changes might impact the financial performance of direct and indirect client investments, and other services designed to address our clients’ climate related needs.”

Annual report 2025A · The company itself

“Foreign Currency Market Risk Foreign Currency Non-Trading Risk Overview Northern Trust’s balance sheet is exposed to non-trading foreign currency risk as a result of its holdings of non-U.S.-dollar-denominated assets and liabilities, investment in non-U.S. subsidiaries, and future non-U.S.-dollar-denominated revenue and expense. To manage currency exposures on the balance sheet, Northern Trust attempts to match its assets and liabilities by currency. If those currency offsets do not exist on the balance sheet, Northern Trust will use foreign exchange derivative contracts to mitigate its currency exposure.”

Annual report 2025A · The company itself

“Asset servicing and related services encompass a full range of capabilities including but not limited to: custody; fund administration; investment operations outsourcing; investment management; investment risk and analytical services; employee benefit services; securities lending; foreign exchange; treasury management; brokerage services; transition management services; banking; and cash management.”

Annual report 2025A · The company itself

“Investment solutions are delivered through separately managed accounts, bank common and collective funds, registered investment companies, exchange traded funds, non-U.S. collective investment funds, and unregistered private investment funds. Asset Management’s capabilities include active and passive equity; active and passive fixed income; cash management; multi-asset and alternative asset classes (such as private equity and hedge funds of funds); and multi-manager advisory services and products.”

Annual report 2025A · The company itself

“TABLE 20: OTHER NONINTEREST INCOME Treasury Management Fees Other Operating Income 207.7 1,157.4 228.7 (82) N/M Investment Security Gains (Losses), net — (189.3) (169.5) N/M 12 Total Other Noninterest Income $ 657.6 $ 1,385.5 $ 429.7 (53) % N/M Security Commissions and Trading Income Security Commissions and Trading Income, generated primarily from securities brokerage services provided by Northern Trust Securities, Inc., increased in 2025 from 2024, primarily driven by higher revenue from growth in outsourced trading activity.”

Annual report 2025A · The company itself

“Northern Trust will continue to enable its strategy through significant investments in talent and culture, technology, data, AI and operational excellence.”

Annual report 2025A · The company itself

“Asset servicing and related services encompass a full range of capabilities including but not limited to: custody; fund administration; investment operations outsourcing; investment management; investment risk and analytical services; employee benefit services; securities lending; foreign exchange; treasury management; brokerage services; transition management services; banking; and cash management.”

Annual report 2025A · The company itself

“WEALTH MANAGEMENT Wealth Management (WM) focuses on high-net-worth individuals and families, business owners, executives, professionals, retirees, and established privately-held businesses in its target markets.”

Annual report 2025A · The company itself

“Asset Servicing Asset Servicing is a leading global provider of asset servicing and related services to corporate and public retirement funds, foundations, endowments, fund managers, insurance companies, sovereign wealth funds, and other institutional investors around the globe. Asset servicing and related services encompass a full range of capabilities including but not limited to: custody; fund administration; investment operations outsourcing; investment management; investment risk and analytical services; employee benefit services; securities lending; foreign exchange; treasury management; brokerage services; transition management services; banking; and cash management.”

Annual report 2025A · The company itself

“Changes in laws or regulations applicable to Northern Trust may have a material effect on its businesses and results of operations. The scope of the laws and regulations, and the intensity of the supervision to which Northern Trust is subject have increased in recent years, initially in response to the financial crisis, and more recently in light of other factors, including the banking turmoil in early 2023, technological factors, and market changes.”

Annual report 2025A · The company itself

“ENHANCED PRUDENTIAL STANDARDS Under the Federal Reserve Board’s tailoring rules, the Corporation is subject to the enhanced prudential standards applicable to Category II banking organizations. As a Category II banking organization, the Corporation must submit annual capital plans to the Federal Reserve Board, conduct supervisory and internal periodic stress tests to evaluate capital adequacy in adverse economic conditions, maintain enhanced risk management procedures, and comply with a liquidity risk management framework (discussed below in “Liquidity Standards”) and single counterparty credit limits, and conduct liquidity stress tests.”

Annual report 2025A · The company itself

“In 2023, the U.S. banking agencies issued a proposed rule to implement the Basel III endgame agreement for large banks (Basel III Endgame Proposal). The Federal Reserve announced in September 2024 that it would publish a re-proposal of its regulations finalizing the Basel III standards. That re-proposal is expected in early 2026.”

Annual report 2025A · The company itself

“For example, branches and subsidiaries conducting banking and asset servicing businesses in the UK are authorized to do so pursuant to the UK Financial Services and Markets Act 2000. They are authorized by the Prudential Regulation Authority (PRA) and/or the Financial Conduct Authority (FCA). The PRA and FCA exercise broad supervisory and disciplinary powers that include the power to revoke temporarily or permanently authorization to conduct a regulated business upon breach of the relevant regulations, impose capital requirements, suspend registered employees, and impose censures and fines on both regulated businesses and their regulated employees.”

Annual report 2025A · The company itself

“For example, Northern Trust Global Services SE, as an EU-domiciled credit institution in Luxembourg, is subject to the prudential supervision of the ECB and the CSSF.”

Annual report 2025A · The company itself

“However, in 2022, the UK government proposed legislation that makes significant reforms to the UK’s financial services regulations. In particular, the Financial Services and Markets Act 2023 includes measures that will, over time, revoke retained EU law relating to financial services. In addition, the UK government announced a package of post-Brexit reforms to drive growth and competitiveness in the financial services sector. The Financial Services and Markets Act 2023 along with these other reforms may directly and indirectly impact the Corporation.”

Annual report 2025A · The company itself

“The EU Capital Requirements Directive of June 26, 2013 (CRD) and the EU Capital Requirements Regulation of June 26, 2013 (CRR) set out the framework for prudential regulation of credit institutions in the EU, including, among other things, capital and liquidity requirements, leverage, and disclosure and reporting. CRR and CRD have been subject to extensive amendments relating to the leverage ratio, the net stable funding ratio, large exposures, and market and counterparty credit risk, enhancing the resiliency of EU banks to potential future economic shocks, the transition to climate neutrality and finalizing the implementation of the Basel III agreement.”

Annual report 2025A · The company itself

“MIFID (which came into force in 2018), the linked Markets in Financial Instruments Regulation (MIFIR), and the European Market Infrastructure Regulation 648/2012 (EMIR) are the primary pieces of EU legislation which regulate, among other things, trading in derivative and securities markets, transaction reporting, investor protection, clearing and risk mitigation.”

Annual report 2025A · The company itself

“The CSDR aims principally to ensure that transactions between buyers and sellers of dematerialized securities are settled in a safe and timely manner by introducing common securities settlement standards across the EU.”

Annual report 2025A · The company itself

“Any downgrades in our credit ratings, or an actual or perceived reduction in our financial strength, could affect our borrowing costs, capital costs and liquidity adversely.”

Annual report 2025A · The company itself

“Virtually every aspect of our business in the United States and around the world is regulated by domestic and foreign governmental agencies that have broad supervisory powers and the ability to impose sanctions. These regulations cover a variety of matters, including prohibited activities, required capital levels, resolution planning, human trafficking and modern slavery, and data privacy and security.”

Annual report 2025A · The company itself

“Changes by the U.S. and other governments to laws, regulations and policies applicable to the financial services industry could heighten the challenges we face and make regulatory compliance more difficult and costly.”

Annual report 2025A · The company itself

“These initiatives have increased compliance costs and regulatory risks and may lead to financial and reputational damage in the event of a compliance violation, even if the failure to comply was inadvertent or reflected a difference in interpretation.”

Annual report 2025A · The company itself

“For example, governments and regulators could take actions that increase intervention in the normal operation of our businesses and the businesses of our competitors in the financial services industry, and these likely would involve additional legislative and regulatory requirements imposed on banks and other financial services companies. Any such actions could increase compliance costs and regulatory risks, lead to financial and reputational damage in the event of a violation, affect our ability to compete successfully or limit how we conduct our business, and also could impact the nature and level of competition in the industry in unpredictable ways.”

Annual report 2025A · The company itself

“The evolving regulatory and supervisory environment and uncertainty about the timing and scope of future laws, regulations and policies may contribute to decisions we may make to suspend, reduce or withdraw from existing businesses, activities or initiatives, which may result in potential lost revenue or significant restructuring or related costs or exposures.”

Annual report 2025A · The company itself

“For example, during 2023, the FDIC took control and was appointed receiver of Silicon Valley Bank, Signature Bank, and First Republic Bank. The failure of other banks and financial institutions and the measures taken by governments and regulators in response to these events could adversely impact our business, financial condition and results of operations.”

Annual report 2025A · The company itself

“Importantly, significant monetary fines have been imposed since the introduction of such stringent privacy laws in the EU and the UK and regulatory expectations of governance and accountability with respect to the protection of personal, proprietary, confidential and sensitive information continue to expand and evolve.”

Annual report 2025A · The company itself

“The Corporation and other financial institutions have become subject to increased scrutiny, more intense supervision and regulation, and a higher risk of enforcement action, which we expect to continue. For example, the failures in 2023 of Silicon Valley Bank, Signature Bank, and First Republic Bank and the regulatory investigations into these failures resulted in increased regulatory scrutiny and heightened supervisory expectations of these banks, which could require us to expend significant time and effort to implement enhanced compliance procedures or to incur other expenses.”

Annual report 2025A · The company itself

“The same may be said for competitors based in non-U.S. jurisdictions, where legal and regulatory environments may be more favorable than those applicable to the Corporation and the Bank as U.S.-domiciled financial institutions.”

Annual report 2025A · The company itself

“Widespread adoption and rapid evolution of emerging technologies, including with respect to digital assets, such as stablecoins, as well as developments in the regulatory landscape relating to emerging technologies, such as the enactment and implementation of the Guiding and Establishing National Innovation for U.S. Stablecoins Act of 2025 (GENIUS ACT) and potential enactment of the Digital Asst Market Clarity Act of 2025 (CLARITY Act) or similar market structure legislation, may affect our clients’ needs and expectations for products and services.”

Annual report 2025A · The company itself

“LIQUIDITY STANDARDS Northern Trust is subject to the U.S. liquidity coverage ratio (LCR) requirement, which is designed to ensure that covered banking organizations, including the Corporation and the Bank, maintain an adequate level of unencumbered high-quality liquid assets equal to their expected net cash outflow for a 30-day time horizon under a prescribed regulatory liquidity stress scenario. As of December 31, 2025, the Corporation and the Bank were in compliance with applicable LCR requirements.”

Annual report 2025A · The company itself

“Changes in interest rates could affect our earnings negatively. The direction and level of interest rates are important factors in our earnings. Interest rate changes could affect the interest earned on assets differently than interest paid on liabilities.”

Annual report 2025A · The company itself

“In response to rising inflation, the Federal Reserve Board increased interest rates from historically low levels during 2022 and 2023. While a rising interest rate environment generally has had a positive effect on our net interest margin, in some circumstances, a rise in interest rates has affected us negatively, and could again in the future affect us negatively.”

Annual report 2025A · The company itself

“For example, the rapid increases in interest rates during 2022 and 2023 adversely impacted the value of certain of our investment securities, and consequently, our capital, liquidity, and earnings.”

Annual report 2025A · The company itself

“Additionally, higher interest rates historically have caused, and could in the future cause: market volatility and downturns in equity markets, resulting in a decrease in the valuations of the assets we manage or service for others, which generally impact our earnings negatively; our clients to transfer funds into investments with higher rates of return, resulting in decreased deposit levels and higher fund or account redemptions; our borrowers to experience difficulties in making higher interest payments, resulting in increased credit costs, provisions for loan and lease losses and charge-offs; reduced bond and fixed income fund liquidity, resulting in lower performance, yields and fees; or higher funding costs.”

Annual report 2025A · The company itself

“Conversely, low-interest-rate environments generally result in a compressed net interest margin and also have a negative impact on our fees earned on certain of our products.”

Annual report 2025A · The company itself

“Market volatility and/or weak economic conditions can result in losses or the need for additional provisions for credit losses, both of which reduce our earnings. Credit risk levels and our earnings can be affected by market volatility and/or weakness in the economy in general and in the particular locales in which we extend credit, a deterioration in credit quality, or a reduced demand for credit. Adverse changes in the financial performance or condition of our borrowers resulting from market volatility, elevated interest rates, and/or weakened economic conditions could impact the borrowers’ abilities to repay outstanding loans, which could in turn impact our financial condition and results of operations negatively.”

Annual report 2025A · The company itself

“However, our ability to access the capital markets, if needed, will depend on a number of factors, including the state of the financial markets. Heightened interest rates, disruptions in financial markets, negative perceptions of our business or our financial strength, or other factors may impact our ability to raise additional capital, if needed, on terms favorable to us.”

Annual report 2025A · The company itself

“Net Interest Income, stated on an FTE basis, increased from 2024, primarily driven by higher deposits and lower funding costs, partially offset by lower yields on interest-earning assets.”

Annual report 2025A · The company itself

“Market Risk There are two types of market risk, interest rate risk associated with the banking book and trading risk. Interest rate risk associated with the banking book is the potential for movements in interest rates to cause changes in Net Interest Income and the market value of equity, including Accumulated Other Comprehensive Income (Loss) from the AFS debt securities portfolio. Trading risk is the potential for movements in market variables such as foreign exchange and interest rates to cause changes in the value of trading positions.”

Annual report 2025A · The company itself

“The foregoing or similar events also could impact us negatively to the extent that they result in reduced capital markets activity, lower asset price levels, or disruptions in general economic activity in the U.S. or abroad, or in financial market settlement functions. In addition, these or similar events may impact economic growth negatively, which could have an adverse effect on our business and operations, and may have other adverse effects on us in ways that we are unable to predict.”

Annual report 2025A · The company itself

“Market volatility and/or weak economic conditions can result in losses or the need for additional provisions for credit losses, both of which reduce our earnings. Credit risk levels and our earnings can be affected by market volatility and/or weakness in the economy in general and in the particular locales in which we extend credit, a deterioration in credit quality, or a reduced demand for credit. Adverse changes in the financial performance or condition of our borrowers resulting from market volatility, elevated interest rates, and/or weakened economic conditions could impact the borrowers’ abilities to repay outstanding loans, which could in turn impact our financial condition and results of operations negatively.”

Annual report 2025A · The company itself

“In addition, regulatory responses in connection with severe market downturns or unforeseen stress events could alter or disrupt our planned future strategies and actions.”

Annual report 2025A · The company itself

“Adverse developments affecting the overall strength and soundness of other financial institutions, the financial services industry as a whole and the general economic climate and the U.S. Treasury market could have a negative impact on perceptions about the strength and soundness of our business even if we are not subject to the same adverse developments.”

Annual report 2025A · The company itself

“Macroeconomic factors that are particularly correlated to Northern Trust’s loan portfolio are GDP growth, unemployment, non-farm employment, corporate profits, consumer spending, personal income, commercial real estate prices, housing price index, credit spreads, and market volatility.”

Annual report 2025A · The company itself

“Our systems involve the storage, transmission and other processing of clients’ and our personal, proprietary, confidential and sensitive information, and security breaches, including cyber-attacks or other information security incidents, have previously exposed us and could in the future expose us to theft, loss, destruction, gathering, monitoring, dissemination, misappropriation, misuse, alteration, or unauthorized disclosure of or unauthorized access to this information. Despite our implementation of a variety of security measures, our computer systems, networks, and data, including clients’ or our personal, proprietary, confidential and sensitive information, could be subject to cyber-attacks or other information security incidents, such as, among other things, from physical and electronic break-ins or unauthorized tampering, theft, malware and computer virus attacks, ransomware attacks, social engineering attacks (including phishing and vishing attacks), credential stuffing, account takeovers, insider threats or denial-of-service attacks.”

Annual report 2025A · The company itself

“Reliance on mobile or cloud technology or any failure by mobile technology and cloud service providers to adequately safeguard their systems and networks and prevent cyber-attacks or other information security incidents could disrupt our operations or the operations of our or their service providers and result in misappropriation, corruption or loss of personal, confidential, proprietary, or other sensitive information or the inability to conduct ordinary business operations.”

Annual report 2025A · The company itself

“We and our clients have been, and expect to continue to be, subject to a wide variety of cyber-attacks and other similar threats, including computer viruses, ransomware and other malicious code, distributed denial-of-service attacks, and phishing and vishing attacks, and it is possible that we could suffer material losses resulting from a breach. Because the techniques used to obtain unauthorized access, disable or degrade service or sabotage systems and networks change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques, to implement adequate preventative measures, or to address them until they are discovered.”

Annual report 2025A · The company itself

“We could be the subject of legal claims or proceedings related to information security incidents, including regulatory investigations and other legal actions, carrying the potential for damages, fines, sanctions or other penalties, injunctive relief requiring costly compliance measures and reputational damage. Further, the market perception of the effectiveness of our information security measures could be harmed, our reputation could suffer and we could lose clients in conjunction with security incidents, each of which could have a negative effect on our business, financial condition and results of operations.”

Annual report 2025A · The company itself

“Operational Risk Overview Operational risk is inherent in each of Northern Trust’s businesses and corporate functions and reflects the potential for inadequate information systems, operating problems, challenges related to reliance on third parties, product design and delivery difficulties, potential legal actions or catastrophes to result in losses. This includes the potential that continuity of service and resilience may be impacted. Operational risk includes information technology and cybersecurity, compliance, fiduciary and legal risks, which under the Corporation’s risk structure are governed and managed explicitly.”

Annual report 2025A · The company itself

“In response to rising inflation, the Federal Reserve Board increased interest rates from historically low levels during 2022 and 2023. While a rising interest rate environment generally has had a positive effect on our net interest margin, in some circumstances, a rise in interest rates has affected us negatively, and could again in the future affect us negatively.”

Annual report 2025A · The company itself

“Changes in the monetary, trade and other policies of various regulatory authorities, central banks, governments and international agencies may reduce our earnings and affect our growth prospects negatively. The monetary, trade and other policies of U.S. and international governments, agencies and regulatory bodies have a significant impact on economic conditions and overall financial market performance. For example, the Federal Reserve Board regulates the supply of money and credit in the U.S. through quantitative tightening and/or easing, and its policies determine in large part the level of interest rates and our cost of funds for lending and investing, and play a role in contributing to or moderating levels of inflation, all of which meaningfully impact our earnings.”

Annual report 2025A · The company itself

“Increased expenses have affected—and a failure to control our costs and expenses in the future, whether as a result of inflation or otherwise, could affect—our earnings negatively.”

Annual report 2025A · The company itself

“The Inflation Reduction Act of 2022, imposes a 1% excise tax on the fair market value of stock repurchases after December 31, 2022. There have been proposals to significantly increase this excise tax rate. Any such material increases may impact our future strategies relating to the return of capital to our shareholders, including the size of, or execution against, current or future repurchase programs related to shares of our common stock.”

Annual report 2025A · The company itself

“Pandemics, natural disasters, global climate change, acts of terrorism, geopolitical tensions, and global conflicts may have a negative impact on our business and operations. Pandemics, natural disasters, global climate change, acts of terrorism, geopolitical tensions, global conflicts or other similar events, as well as government actions or other restrictions in connection with such events, have had in the past, or may in the future have, a negative impact on our business and operations.”

Annual report 2025A · The company itself

“When such client deposit liabilities are on our consolidated balance sheet, we maintain a corresponding amount of cash on deposit with the subcustodian or clearing agency, which increases our credit exposure to that entity and can accumulate over time based upon distributions on, or other activities related to, our clients’ assets. If the subcustodian or clearing agency were to become insolvent in circumstances not involving expropriation of assets or other sovereign risk events and/or factors or events beyond our reasonable control that excuse performance under force majeure or other contractual provisions, the risk of loss on such cash on deposit may potentially be incurred by us.”

Annual report 2025A · The company itself

“For example, during 2023, the FDIC took control and was appointed receiver of Silicon Valley Bank, Signature Bank, and First Republic Bank. The failure of other banks and financial institutions and the measures taken by governments and regulators in response to these events could adversely impact our business, financial condition and results of operations.”

Annual report 2025A · The company itself

“The same may be said for competitors based in non-U.S. jurisdictions, where legal and regulatory environments may be more favorable than those applicable to the Corporation and the Bank as U.S.-domiciled financial institutions.”

Annual report 2025A · The company itself

“Pandemics, natural disasters, global climate change, acts of terrorism, geopolitical tensions, and global conflicts may have a negative impact on our business and operations. Pandemics, natural disasters, global climate change, acts of terrorism, geopolitical tensions, global conflicts or other similar events, as well as government actions or other restrictions in connection with such events, have had in the past, or may in the future have, a negative impact on our business and operations.”

Annual report 2025A · The company itself

“Climate change could also result in transition risk arising from changes in policy, regulations, technology, business practices or market preferences toward a lower-carbon economy. While these changes could create opportunities, they could also adversely impact us and our clients. These impacts could result in increased operational or compliance costs, higher energy expenses, additional taxes, and the devaluation of assets.”

Annual report 2025A · The company itself

“Climate-related Risk Climate-driven risks can arise from both the physical impacts of climate change and the transition impacts associated with changes in regulation, markets, and stakeholder expectations. •Physical risks include the consequences of acute climate events such as floods, hurricanes, and wildfires which may disrupt operations, resilience capabilities and the valuation of assets for the enterprise, its clients and third parties. Over time, chronic climate events such as rising sea levels and temperature shifts may affect asset valuations, insurance coverage, and client creditworthiness.”

Annual report 2025A · The company itself

“Organizations that violate certain provisions of the GDPR could be fined up to €20 million or 4% of their annual worldwide revenue for the preceding fiscal year, whichever is greater.”

Annual report 2025A · The company itself

“On December 29, 2019, the EU Sustainable Finance Disclosure Regulations (SFDR) entered into force. SFDR aims to prevent “greenwashing” (conveying a misleading or false impression a product is more environmentally favorable than it actually is) by requiring disclosure of how sustainability risks and environmental, social and governance (ESG) factors are part of the investment and business processes of asset managers.”

Annual report 2025A · The company itself

“Furthermore, ESG-related issues have been the subject of increased focus by regulators and stakeholders, including outside the U.S., and particularly in Europe. Any inability to meet applicable requirements or expectations, including those from conflicting U.S. and non-U.S. global expectations, may adversely impact our reputation.”

Annual report 2025A · The company itself

“Market volatility and/or weak economic conditions also could affect wealth creation, investment preferences, trading activities, and savings patterns, which in turn could impact demand for certain products and services that we provide.”

Annual report 2025A · The company itself

“Macroeconomic factors that are particularly correlated to Northern Trust’s loan portfolio are GDP growth, unemployment, non-farm employment, corporate profits, consumer spending, personal income, commercial real estate prices, housing price index, credit spreads, and market volatility.”

Annual report 2025A · The company itself

“Reliance on mobile or cloud technology or any failure by mobile technology and cloud service providers to adequately safeguard their systems and networks and prevent cyber-attacks or other information security incidents could disrupt our operations or the operations of our or their service providers and result in misappropriation, corruption or loss of personal, confidential, proprietary, or other sensitive information or the inability to conduct ordinary business operations.”

Annual report 2025A · The company itself

“Our businesses depend on information technology infrastructure, both internal and external, to record and process, among other things, a large volume of increasingly complex transactions and other data, in many currencies, on a daily basis, across numerous and diverse markets and jurisdictions. Due to our dependence on technology and the important role it plays in our business operations, combined with the increasing sophistication and frequency of potential cyber-attacks and other information security incidents, we must constantly improve and update our information technology infrastructure. Upgrading, replacing, and modernizing these systems can require significant resources and often involves implementation, integration and security risks that could cause financial, reputational, and operational harm.”

Annual report 2025A · The company itself

“Changes in a number of particular market conditions, including in foreign currency exchange rates, cross-border investing activity and the demand for borrowing or lending securities, could affect our earnings negatively. We provide foreign exchange services to our clients, primarily in connection with our Asset Servicing business. Foreign currency volatility influences our foreign exchange trading income as does the level of client activity.”

Annual report 2025A · The company itself

“We also are exposed to non-trading foreign currency risk as a result of our holdings of non-U.S. dollar denominated assets and liabilities, investments in non-U.S. subsidiaries, and future non-U.S. dollar denominated revenue and expense.”

Annual report 2025A · The company itself

“Widespread adoption and rapid evolution of emerging technologies, including with respect to digital assets, such as stablecoins, as well as developments in the regulatory landscape relating to emerging technologies, such as the enactment and implementation of the Guiding and Establishing National Innovation for U.S. Stablecoins Act of 2025 (GENIUS ACT) and potential enactment of the Digital Asst Market Clarity Act of 2025 (CLARITY Act) or similar market structure legislation, may affect our clients’ needs and expectations for products and services.”

Annual report 2025A · The company itself

“LIQUIDITY STANDARDS Northern Trust is subject to the U.S. liquidity coverage ratio (LCR) requirement, which is designed to ensure that covered banking organizations, including the Corporation and the Bank, maintain an adequate level of unencumbered high-quality liquid assets equal to their expected net cash outflow for a 30-day time horizon under a prescribed regulatory liquidity stress scenario. As of December 31, 2025, the Corporation and the Bank were in compliance with applicable LCR requirements.”

Annual report 2025A · The company itself

“Macroeconomic factors that are particularly correlated to Northern Trust’s loan portfolio are GDP growth, unemployment, non-farm employment, corporate profits, consumer spending, personal income, commercial real estate prices, housing price index, credit spreads, and market volatility.”

Annual report 2025A · The company itself

“Macroeconomic factors that are particularly correlated to Northern Trust’s loan portfolio are GDP growth, unemployment, non-farm employment, corporate profits, consumer spending, personal income, commercial real estate prices, housing price index, credit spreads, and market volatility.”

Annual report 2025A · The company itself

“Our ability to attract and retain key executives and other employees may be hindered as a result of existing and potential regulations applicable to incentive compensation and other aspects of our compensation programs. These laws and regulations may not apply in the same manner to all financial institutions and other companies, which therefore may subject us to more restrictions than other institutions and companies with which we compete for talent and may also hinder our ability to compete for talent with other industries.”

Annual report 2025A · The company itself

“The risk that we may be perceived as less creditworthy relative to other market participants is higher in a market environment in which the consolidation, and in some instances failure, of financial institutions, including major global financial institutions, could result in a smaller number of larger counterparties and competitors.”

Annual report 2025A · The company itself

“For example, developments related to the U.S. federal debt ceiling, including the possibility of a government shutdown, default by the U.S. government on its debt obligations, or related credit-rating downgrades, could have adverse effects on the broader economy, disrupt access to capital markets, and contribute to, or worsen, an economic recession.”

Annual report 2025A · The company itself

“Allowance Related to Credit Exposure Evaluated on a Collective Basis: The allowance evaluated on a collective basis for loans decreased $10.7 million to $154.1 million at December 31, 2025, compared with $164.8 million at December 31, 2024, primarily in the CRE portfolio, driven by an improved industry outlook.”

Annual report 2025A · The company itself

“The Corporation has a global presence with offices in 24 U.S. states and Washington, D.C., and across 22 locations in Canada, Europe, the Middle East and the Asia-Pacific region.”

Annual report 2025A · The company itself

“Client relationships are managed through the Bank and the Bank’s and the Corporation’s other subsidiaries, including support from locations in North America, Europe, the Middle East, and the Asia-Pacific region.”

Annual report 2025A · The company itself

“Wealth Management services are delivered by multidisciplinary teams through a network of offices in 19 U.S. states and Washington, D.C., as well as offices in London, Guernsey, Singapore, and Abu Dhabi.”

Annual report 2025A · The company itself

“On the basis of averages, the percentage of total assets attributable to foreign activities was 32% as of both December 31, 2025 and 2024. On the basis of averages, the percentage of total liabilities attributable to foreign activities was 54% as of both December 31, 2025 and 2024.”

Annual report 2025A · The company itself

“The Corporation has a global presence with offices in 24 U.S. states and Washington, D.C., and across 22 locations in Canada, Europe, the Middle East and the Asia-Pacific region.”

Annual report 2025A · The company itself

“Client relationships are managed through the Bank and the Bank’s and the Corporation’s other subsidiaries, including support from locations in North America, Europe, the Middle East, and the Asia-Pacific region.”

Annual report 2025A · The company itself

“On the basis of averages, the percentage of total assets attributable to foreign activities was 32% as of both December 31, 2025 and 2024. On the basis of averages, the percentage of total liabilities attributable to foreign activities was 54% as of both December 31, 2025 and 2024.”

Annual report 2025A · The company itself

“The Corporation has a global presence with offices in 24 U.S. states and Washington, D.C., and across 22 locations in Canada, Europe, the Middle East and the Asia-Pacific region.”

Annual report 2025A · The company itself

“Client relationships are managed through the Bank and the Bank’s and the Corporation’s other subsidiaries, including support from locations in North America, Europe, the Middle East, and the Asia-Pacific region.”

Annual report 2025A · The company itself

“Wealth Management services are delivered by multidisciplinary teams through a network of offices in 19 U.S. states and Washington, D.C., as well as offices in London, Guernsey, Singapore, and Abu Dhabi.”

Annual report 2025A · The company itself

“In addition, our current or future approach to in-office and remote work arrangements may not meet the needs or expectations of our current or prospective employees, may not be perceived as favorable as compared to the arrangements offered by competitors and may not be conducive to a collaborative working environment, which could adversely affect our ability to attract, retain and motivate employees.”

Annual report 2025A · The company itself

“The increase in total deposits was primarily attributable to non-U.S. offices.”

Annual report 2025A · The company itself