U.S. Bancorp

“The Company’s current workforce strategy is focused on promoting in-person engagement across more than 20 corporate hub locations, its branch network and business centers to support the Company’s business and customer needs.”

Annual report 2025A · The company itself

“USBNA provides a wide range of products and services to individuals, businesses, institutional organizations, governmental entities and other financial institutions.”

Annual report 2025A · The company itself

“USBNA provides a wide range of products and services to individuals, businesses, institutional organizations, governmental entities and other financial institutions.”

Annual report 2025A · The company itself

“USBNA provides a wide range of products and services to individuals, businesses, institutional organizations, governmental entities and other financial institutions.”

Annual report 2025A · The company itself

“Any change in the statutes, regulations or regulatory policies applicable to the Company, including changes in their interpretation or implementation, could have a material effect on its business or organization.”

Annual report 2025A · The company itself

“Enhanced Prudential Standards Under the Dodd-Frank Act, as modified by the Economic Growth, Regulatory Relief and Consumer Protection Act and the Tailoring Rules, large bank holding companies, such as the Company, are subject to certain enhanced prudential standards based on the banking organization’s size and certain “risk-based indicators.” The prudential standards include enhanced risk-based capital and leverage requirements, enhanced liquidity requirements, enhanced risk management and risk committee requirements, a requirement to submit a resolution plan, single-counterparty credit limits and stress tests.”

Annual report 2025A · The company itself

“These quantitative calculations are minimums, and the Federal Reserve and OCC may determine that a banking organization, based on its size, complexity or risk profile, must maintain a higher level of capital in order to operate in a safe and sound manner.”

Annual report 2025A · The company itself

“In July 2023, the U.S. federal bank regulatory authorities proposed a rule implementing the Basel Committee’s finalization of the post-crisis regulatory capital reforms, commonly referred to as “Basel III Endgame.” The proposal would set stricter criteria for the use of internal models by replacing the market risk rule with the “Fundamental Review of the Trading Book,” and would introduce new standardized approaches for credit risk, operational risk and credit valuation adjustment risk, which would replace the current models-based approaches. In addition, under the proposed rule, also subject to a phase-in period, Category III banking institutions, such as the Company, would no longer be permitted to opt out of including certain components of accumulated other comprehensive income in regulatory capital, which would result in unrealized gains and losses on available-for-sale securities being included in the calculation of the Company’s regulatory capital ratios.”

Annual report 2025A · The company itself

“Anti-Money Laundering and Sanctions The Company is subject to several federal laws that are designed to combat money laundering and terrorist financing, and to restrict transactions with persons, companies, or foreign governments sanctioned by United States authorities. This category of laws includes the Bank Secrecy Act (the “BSA”), the Money Laundering Control Act, the USA PATRIOT Act (collectively, “AML laws”), and implementing regulations for the International Emergency Economic Powers Act and the Trading with the Enemy Act, as administered by the U.S. Department of the Treasury’s Office of Foreign Assets Control (“sanctions laws”).”

Annual report 2025A · The company itself

“In July 2025, the agencies proposed a rule to rescind the revised CRA framework and to replace it with the framework that existed prior to the 2023 rule.”

Annual report 2025A · The company itself

“Data privacy and data protection are areas of increasing legislative focus in the United States, and several U.S. states have enacted comprehensive consumer privacy laws that impose compliance obligations with respect to personal information.”

Annual report 2025A · The company itself

“In addition, in the European Union (“EU”), privacy law is governed by the General Data Protection Regulation (“GDPR”), which is directly binding and applicable in each EU member state. The GDPR contains enhanced compliance obligations and increased penalties for non-compliance and is regularly enforced by European regulators.”

Annual report 2025A · The company itself

“In October 2024, the CFPB finalized a rule regarding personal financial data rights, which applies to financial institutions that control or possess data relating to covered consumer financial products or services, such as Regulation E accounts and credit card issuers. Under the final rule, USBNA will be required to provide consumers and, upon the consumer’s request, their authorized third parties with electronic access to “covered data.” This includes transaction information, account balances, upcoming bill information, information to initiate payment to and from accounts, the terms and conditions under which an account or credit card was provided, and certain other basic account verification information. The final rule requires “data providers” such as USBNA to create detailed access interfaces for both consumers and developers in order to effectuate consumers’ access to, and transfer of, their personal financial data.”

Annual report 2025A · The company itself

“Consumer Protection USBNA’s retail banking activities are subject to a variety of federal and state statutes and regulations designed to protect consumers. These laws and regulations, among other things, require disclosures of the cost of credit and terms of deposit accounts, provide substantive consumer rights, prohibit discrimination in credit transactions, regulate the use of credit report information, provide financial privacy protections, prohibit unfair, deceptive and abusive practices and subject USBNA to substantial regulatory oversight.”

Annual report 2025A · The company itself

“USBNA and its subsidiaries are subject to supervision and regulation by the CFPB with respect to federal consumer laws. The CFPB has in the past undertaken numerous rule-making and other initiatives, including launching an initiative to reduce the amounts and types of fees financial institutions may charge, including by recently proposing a rule that would significantly reduce the permissible amount of credit card late fees, issuing informal guidance and taking enforcement actions against certain financial institutions.”

Annual report 2025A · The company itself

“Executive and Incentive Compensation Guidelines adopted by the federal banking agencies prohibit excessive compensation as an unsafe and unsound practice and describe compensation as “excessive” when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal stockholder. The Federal Reserve has issued comprehensive guidance on incentive compensation policies (the “Incentive Compensation Guidance”) intended to ensure that the incentive compensation policies of banking organizations do not undermine safety and soundness by encouraging excessive risk-taking.”

Annual report 2025A · The company itself

“The GLBA also requires financial institutions to implement a comprehensive information security program.”

Annual report 2025A · The company itself

“The federal banking regulators, as well as the SEC, CFPB, CFTC, and related self-regulatory organizations, regularly issue guidance on cybersecurity that is intended to enhance cyber risk management among financial institutions and provide timely information to investors. A financial institution’s management is required to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cybersecurity incident. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations if the institution or its critical service providers experience a cybersecurity incident.”

Annual report 2025A · The company itself

“The Company and its subsidiaries are subject to increasing numbers of regulatory notification and disclosure requirements related to cybersecurity. Banking organizations, such as the Company and USBNA, are required to notify their primary federal regulator within 36 hours of a computer-security incident that results in actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores or transmits, which has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector.”

Annual report 2025A · The company itself

“The Company’s success depends, in large part, on its ability to attract, develop and retain skilled employees. The Company recognizes that supporting, engaging and continuously upskilling its workforce is key to meeting evolving corporate and customer needs.”

Annual report 2025A · The company itself

“Compensation, Health & Wellness Programs Maintaining competitive compensation and benefits practices is a continued focus for the Company, with periodic peer and benchmarking reviews used to assist with competitive alignment and employee retention.”

Annual report 2025A · The company itself

“As of December 31, 2025, the Company employed a total of 68,520 employees globally.”

Annual report 2025A · The company itself

“The financial services industry continues to become more competitive as new technological advances enable more companies to provide financial products and services, including electronic and internet-based financial solutions such as lending and payment solutions, digital currencies, digital wallets and alternative payment methods. Competition has also increased from companies that are not subject to the same regulatory restrictions as domestic banks and bank holding companies, including by financial technology companies, or “fintechs,” which may offer bank-like products or services that compete directly with the Company’s products and services.”

Annual report 2025A · The company itself

“In October 2024, the CFPB finalized a rule regarding personal financial data rights, which applies to financial institutions that control or possess data relating to covered consumer financial products or services, such as Regulation E accounts and credit card issuers. Under the final rule, USBNA will be required to provide consumers and, upon the consumer’s request, their authorized third parties with electronic access to “covered data.” This includes transaction information, account balances, upcoming bill information, information to initiate payment to and from accounts, the terms and conditions under which an account or credit card was provided, and certain other basic account verification information. The final rule requires “data providers” such as USBNA to create detailed access interfaces for both consumers and developers in order to effectuate consumers’ access to, and transfer of, their personal financial data.”

Annual report 2025A · The company itself

“In addition, in the European Union (“EU”), privacy law is governed by the General Data Protection Regulation (“GDPR”), which is directly binding and applicable in each EU member state. The GDPR contains enhanced compliance obligations and increased penalties for non-compliance and is regularly enforced by European regulators.”

Annual report 2025A · The company itself

“The Company’s subsidiaries provide domestic merchant processing services directly to merchants, as well as similar merchant services in Canada and segments of Europe.”

Annual report 2025A · The company itself

“The financial services industry continues to become more competitive as new technological advances enable more companies to provide financial products and services, including electronic and internet-based financial solutions such as lending and payment solutions, digital currencies, digital wallets and alternative payment methods. Competition has also increased from companies that are not subject to the same regulatory restrictions as domestic banks and bank holding companies, including by financial technology companies, or “fintechs,” which may offer bank-like products or services that compete directly with the Company’s products and services.”

Annual report 2025A · The company itself

“Banking and investment services are provided through a network of branches and banking offices across the United States, primarily in the Midwest and West regions, including 2,075 branches across 26 states as of December 31, 2025.”

Annual report 2025A · The company itself

“The Company’s subsidiaries provide domestic merchant processing services directly to merchants, as well as similar merchant services in Canada and segments of Europe.”

Annual report 2025A · The company itself

“The Company’s subsidiaries provide domestic merchant processing services directly to merchants, as well as similar merchant services in Canada and segments of Europe.”

Annual report 2025A · The company itself