Associated Banc-Corp (ASB) Risk Analysis

The CFPB has broad rulemaking authority to administer and carry out federal consumer financial protection laws. In previous years, the CFPB has initiated enforcement actions against a variety of bank and non-bank market participants with respect to a number of consumer financial products and services that have resulted in those participants expending significant time, money and resources to adjust to the initiatives being pursued by the CFPB. Past CFPB enforcement actions may serve as precedent for how the CFPB interprets and enforces consumer protection laws, including practices or acts that are deemed to be unfair, deceptive or abusive, with respect to all supervised institutions, which may result in the imposition of higher standards of compliance with such laws. With the change in Administration, there have been, and likely will continue to be, changes in the funding, leadership and staff of the CFPB. This turnover has led to changes in agency policies, tactics and interpretations. The current Administration and Congress have sought, and may continue to seek, to limit the scope and reach of the CFPB's authority. The extent and timing of any such changes and any resulting impact on our business and financial results cannot be predicted at this time. It is also unclear whether these changes will be reversed, either by the courts or by a later Administration.

We may be involved from time to time in a variety of litigation arising out of our business. Our insurance may not cover all claims that may be asserted against us, and any claims asserted against us, regardless of merit or eventual outcome, may harm our reputation. Should the ultimate judgments or settlements in any litigation exceed our insurance coverage, they could have a material adverse effect on our financial condition and results of operations for any period. We may not be able to obtain appropriate types or levels of insurance in the future, nor may we be able to obtain adequate replacement policies with acceptable terms, if at all.

We are subject to federal and applicable state income tax regulations. Income tax regulations are often complex and require interpretation. Changes in income tax regulations could negatively impact our results of operations. In the normal course of business, we are routinely subject to examinations and challenges from federal and applicable state tax authorities regarding the amount of taxes due in connection with investments we have made and the businesses in which we have engaged. Recently, federal and state taxing authorities have become increasingly aggressive in challenging tax positions taken by financial institutions. These tax positions may relate to tax compliance, sales and use, franchise, gross receipts, payroll, property and income tax issues, including tax base, apportionment and tax credit planning. The challenges made by tax authorities may result in adjustments to the timing or amount of taxable income or deductions or the allocation of income among tax jurisdictions. If any such challenges are made and are not resolved in our favor, they could have a material adverse effect on our financial condition and results of operations.

We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business. Operational risk related to cyber-attacks is increasing as cyber-attacks evolve and have a greater and more pervasive economic impact. In addition to cyber-attacks or other security breaches involving the theft, loss, destruction, gathering, monitoring, dissemination, misappropriation, misuse, alteration, or unauthorized disclosure of or unauthorized access to sensitive and confidential information (including personal information), hackers have engaged in attacks against large financial institutions, designed to disrupt key business services, such as customer-facing web sites. Critical infrastructure sectors, including financial services, increasingly have been the targets of cyber-attacks, including attacks emanating from foreign countries. Cyber-attacks involving large financial institutions, including distributed denial of service attacks designed to disrupt external customer-facing services, cyber-attacks carried out by terrorists, nation states, nation-state supported actors, organized criminal groups or "hacktivists", and ransomware attacks designed to deny organizations access to key internal resources or systems or other critical data, as well as targeted social engineering and phishing email and text message attacks designed to allow unauthorized persons to obtain access to an institution's information systems and data or that of its customers, are becoming more common and increasingly sophisticated. Cyber-attacks continue to evolve and become more pervasive throughout the financial services sector. In particular, there has been an observed increase in the number of distributed denial of service and ransomware attacks against the financial sector, for which the increase is believed to be partially attributable to politically motivated attacks as well as financial demands coupled with extortion. Further, threat actors continue to exploit publicly known software vulnerabilities and weak authentication controls used by large numbers of banking organizations in order to conduct malicious cyber activities. These types of attacks have resulted in increased supply chain and third-party risk. Such cybersecurity threats may see their frequency increased, and effectiveness enhanced, by the use of AI. Because the methods of cyber-attacks change frequently or, in some cases, are not recognized until launch, we are not able to anticipate or implement effective preventive measures against all possible security breaches and the probability of a successful attack cannot be predicted. Although we employ detection and response mechanisms designed to contain and mitigate security incidents, early detection may be thwarted by persistent sophisticated attacks and malware designed to avoid detection. We face risks related to cyber-attacks and other security breaches in connection with card transactions that typically involve the transmission of sensitive information (including personal information) regarding our customers through various third parties. Some of these parties have in the past been the target of security breaches and cyber-attacks, and because the transactions involve third parties and environments that we do not control or secure, future security breaches or cyber-attacks affecting any of these third parties could impact us, and in some cases we may have exposure and suffer losses for breaches or attacks relating to them. We rely on numerous other third-party service providers to conduct other aspects of our business operations and face similar risks relating to them. We cannot be sure that such third-party information security protocols are sufficient to withstand a cyber-attack or other security breach. Cybersecurity risks for financial institutions have evolved as a result of the increased interconnectedness of operating environments and the use of new technologies, devices and delivery channels to transmit data and conduct financial transactions. The adoption of new products, services and delivery channels contribute to a more complex operating environment, which enhances operational risk and presents the potential for additional structural vulnerabilities. As such, a single cyber-attack is now able to compromise hundreds of organizations and affect a significant number of consumers. The adoption of hybrid and remote work environments in the past several years presents institutions with additional cybersecurity vulnerabilities and risks. The Corporation endeavors to regularly evaluate its systems and controls and implement upgrades as necessary. The additional cost to the Corporation of our cybersecurity monitoring and protection systems and controls includes the cost of hardware and software, third party technology providers, consulting and forensic testing firms, insurance premium costs and legal fees and the incremental cost of our personnel who focus a substantial portion of their responsibilities on cybersecurity. Any attempted or successful cyber-attack or other security breach involving the theft, loss, destruction, gathering, monitoring, dissemination, misappropriation, misuse, alteration, or unauthorized disclosure of or unauthorized access to sensitive or confidential client or customer information (including personal information), confidential and proprietary information relating to our bank and operations, unauthorized access to our information systems or networks or that of our third-party service providers, or unauthorized access to other data that compromises our ability to function could severely damage our reputation, erode confidence in the security of our systems and networks, products and services, expose us to the risk of litigation and liability, disrupt our operations and have a material adverse effect on our business. Any attempted or successful cyber-attack may subject the Corporation to regulatory investigations, litigation (including class action litigation) or enforcement, or require the payment of regulatory fines or penalties or undertaking costly remediation efforts with respect to third parties affected by a cybersecurity incident, all or any of which could adversely affect the Corporation's business, financial condition or results of operations and damage its reputation. Finally, we cannot guarantee that any costs and liabilities incurred in relation to an attack or incident will be covered by our existing insurance policies or that applicable insurance will be available to us in the future on economically reasonable terms or at all.

Our operations and profitability are impacted by general business and economic conditions in the United States and abroad. These conditions include short-term and long-term interest rates, inflation, money supply, political issues, ramifications of conflicts including the Russia-Ukraine conflict, Israeli-Palestinian conflict and other conflicts and government turmoil in the Middle East, Europe and Latin America, legislative and regulatory changes, fluctuations in both debt and equity capital markets, broad trends in industry and finance, the strength of the United States economy, and uncertainty in financial markets globally, all of which are beyond our control. A deterioration in economic conditions, including those arising from government shutdowns, defaults, anticipated defaults or rating agency downgrades of sovereign debt (including debt of the U.S.), or increases in unemployment, could result in an increase in loan delinquencies and NPAs, decreases in loan collateral values, and a decrease in demand for our products and services, among other things, any of which could have a material adverse impact on our financial condition and results of operations.

There continues to be a concern, including on the part of certain state regulators, regarding climate change and its impacts. Climate change could manifest as a financial risk to us either through changes in the physical climate or from the process of transitioning to a low-carbon economy. Both physical risks and transition risks associated with climate change could have negative impacts on the financial condition or creditworthiness of our customers, and on its exposure to those customers. Physical risks include the increased frequency or severity of acute weather events, such as floods, wildfires and tropical cyclones, and chronic shifts in the climate, such as persistent changes in precipitation levels, rising sea levels, or increases in average ambient temperature. Transition risks arise from societal adjustment to a low-carbon economy, such as changes in public policy, adoption of new technologies or changes in consumer preferences toward low-carbon goods and services. These risks could also be influenced by changes in the physical climate. Concerns over the anticipated and unanticipated impacts of climate change (including physical risk and transition risk) have led and may continue to lead to governmental efforts to mitigate those impacts. The Corporation may be compelled to change or cease some of its business or operational practices or to incur additional capital, compliance, and other costs because of climate- or environmental-driven changes in applicable law or supervisory expectations or due to related political, social, market, or similar pressure. The Corporation and its customers may face cost increases, asset value reductions, operating process changes, and other issues. In addition, the Corporation could face reductions in creditworthiness on the part of some customers or in the value of asset securing loans. The Corporation's efforts to take these risks into account in making lending and other decisions may not be effective in protecting it from the negative impact of new laws and regulations or changes in consumer or business behavior. Further, there is increased scrutiny of climate change-related and other ESG-related policies, goals and disclosures. The Corporation's stakeholders may disagree with these policies and goals, or conversely, believe that these policies and goals are insufficient, which may lead to a decrease in demand for our products and services or damage our reputation. For example, certain federal and state laws and regulations relating to climate or other ESG issues may include provisions that conflict with other laws and regulations, which may increase our costs or limit our ability to conduct business in certain jurisdictions In particular, there is an increasing number of state-level anti-ESG initiatives in the United States that may conflict with other regulatory requirements or our various stakeholders' expectations. Such divergent, sometimes conflicting, views on such matters increase the risk that any action or lack thereof by the Corporation on such matters will be perceived negatively by some stakeholders. The Corporation may also incur additional costs and require additional resources as it evolves its strategy, practices and related disclosures with respect to these matters. In addition, there are and will continue to be challenges related to capturing, verifying, analyzing and disclosing climate-related data that is subject to measurement uncertainties.

Our business is dependent on our and third parties' information technology systems and networks. Any failure, interruption, or breach in security or operational integrity of our or our third-party service providers' communications and information systems or networks, including those caused by a cyber-attack, could result in failures or disruptions in our customer relationship management, general ledger, deposit, loan, and other systems. Our computer, communications, data processing, networks, backup, business continuity or other operating, information or technology systems and networks, including those that we outsource to providers, may fail to operate properly or become disabled, overloaded or damaged as a result of a number of factors, including events that are wholly or partially beyond our control, which could have a negative effect on our ability to conduct our business activities. While we have policies and procedures designed to prevent or limit the effect of the failure, interruption, or security breach of our or our third parties' communications and information systems and networks, we cannot completely ensure that any such failures, interruptions, or security breaches will not occur, nor can we ensure that our prevention procedures and information security program will function as designed and planned. Our business interruption insurance may be inadequate to compensate us for all losses that may occur as a result of any system, network or operational failure or disruption. The occurrence of any failures, interruptions, or security breaches of our or our third-party service providers' communications and information systems and networks, including those caused by a cyber-attack, could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our financial condition and results of operations.

From time to time, we may implement new lines of business or offer new products and services within existing lines of business. There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and/or new products and services, we may invest significant time and resources. Initial timetables for the introduction and development of new lines of business and/or new products or services may not be achieved, and price and profitability targets may not prove feasible. External factors, such as competitive alternatives and shifting market preferences, may impact the successful implementation of a new line of business and/or a new product or service. Furthermore, strategic planning remains important as we adopt innovative products, services, and processes in response to the evolving demands for financial services and the entrance of new competitors, such as out-of-market banks and financial technology firms. Any new line of business and/or new product or service could have a significant impact on the effectiveness of our system of internal controls, so we must responsibly innovate in a manner that is consistent with sound risk management and is aligned with the Bank's overall business strategies. Failure to successfully manage these risks in the development and implementation of new lines of business and/or new products or services could have a material adverse effect on our business, results of operations and financial condition.

Our business is primarily relationship-driven in that many of our key colleagues have extensive customer relationships. Loss of a key colleague with such customer relationships may lead to the loss of business if the customers were to follow that colleague to a competitor or otherwise choose to transition to another financial services provider. While we believe our relationship with our key personnel is good, we cannot guarantee that all of our key personnel will remain with our organization. Loss of such key personnel could result in the loss of some of our customers.