Zions Bancorporation National Association (ZION) Risk Analysis

Our corporate affairs are governed by the National Bank Act, and related regulations are administered by the OCC. As to securities laws, the OCC maintains its own securities offering framework applicable to national banks and their securities offerings, and our compliance with the Exchange Act is governed and enforced by the OCC. State corporate codes, including that of Utah, are widely recognized, updated by legislative action from time-to-time, and may be based on and influenced by model statutes. The federal securities law regime established by the Securities Act and the Exchange Act and the SEC's extensive and well-developed framework thereunder are widely used by public companies. The OCC's statutory and regulatory frameworks have been used by publicly traded banking organizations relatively rarely and are not as well developed as the corporate and securities law frameworks applicable to other public corporations. While certain specific risks associated with operating under these frameworks are described below, unless and until these frameworks are further developed and established over time, the uncertainty of how these frameworks might apply to any given corporate or securities matters may prevent us from effecting transactions in an efficient and optimal manner or perhaps at all.

We are subject to risks associated with legal claims, litigation, and regulatory and other government proceedings. Our exposure to these proceedings may increase as a result of stresses on customers, counterparties, and others arising from the past or current economic environments, more frequent claims and actions resulting from fraud schemes perpetrated by or involving our customers, new regulations promulgated under recently enacted statutes, the creation of new examination and enforcement bodies, changes in administration and other political developments, and enforcement and legal actions against banking organizations. Any such matters may result in material adverse consequences to our results of operations, financial condition, or ability to conduct our business, including adverse judgments, settlements, fines, penalties (e.g., civil money penalties under applicable banking laws), injunctions, restrictions on our business activities, or other relief. We maintain insurance coverage to mitigate the financial risk of defense costs, settlements, and awards, but the coverage is subject to deductibles and limits of coverage. Our involvement in any such matters, even if the matters are ultimately determined in our favor, could also cause significant harm to our reputation and divert management attention from the operation of our business. In general, the amounts paid by financial institutions in settlement of proceedings or investigations have been increasing dramatically. This has affected and will continue to adversely affect (1) our ability to obtain insurance coverage for certain claims, (2) our deductible levels, and (3) the cost of premiums associated with our coverage. Consequently, our financial results are subject to greater risk of adverse outcomes from legal claims. Due to the difficulty in predicting the timing of, and damages or penalties associated with, the resolution of legal claims, it is possible that adverse financial impacts from litigation could occur sporadically and could be significant. In addition, any enforcement matters could impact our supervisory and CRA ratings, which may restrict or limit our activities.

The U.S. government is currently operating under a continuing resolution that provides short-term appropriations. Efforts to pass spending bills for long-term government funding have proven challenging, increasing the risk of a government shutdown. Concurrently, the national debt continues to grow as Congress struggles to formulate a plan for greater fiscal responsibility. These circumstances may result in downgrades in the U.S. credit rating or defaults, introducing additional volatility into the U.S. economy. This could impact capital and credit markets, the banking industry, financial markets, and interest rates, among other unforeseen consequences. In such an event, the Bank's liquidity, operating margins, financial condition, and results of operations could be materially and adversely affected.

We provide a wide range of banking products and related services through our local management teams and distinctive brands across Arizona, California, Colorado, Idaho, Nevada, New Mexico, Oregon, Texas, Utah, Washington, and Wyoming. At December 31, 2024, loan balances from our banking operations in Utah, Idaho, Texas, and California accounted for 77% of the commercial lending portfolio, 70% of the CRE lending portfolio, and 70% of the consumer lending portfolio. Due to this geographic concentration, our financial performance is largely influenced by economic conditions in these markets. Consequently, any deterioration in economic conditions, including those triggered by climate change or natural disasters, could disproportionately impact these states, leading to higher credit losses and significantly affecting our overall operations and financial results. For information about our lending exposure to various industries and how we manage credit risk, see "Credit Risk Management" in MD&A on page 56.

We may encounter significant operational disruptions arising from our numerous projects and initiatives. These disruptions may include significant time delays, cost overruns, loss of key personnel, technological issues, and processing failures. Additionally, we may experience operational disruptions due to capacity constraints, service level failures, inadequate performance, and certain replacement costs. Any or all of these issues could disrupt our systems, processes, control environment, procedures, employees, and customers. The ultimate effect of any significant disruption to our business could subject us to additional regulatory scrutiny or expose us to civil litigation and possible financial liability, any of which could materially impact us, including our control environment, operating efficiency, and results of operations.

We rely heavily on communications and information systems to conduct our business. Our systems process and maintain information that is confidential, proprietary, personal, or otherwise sensitive, including financial and other confidential business information. We, our customers, and other financial institutions with which we interact, are subject to ongoing, continuous attempts by threat actors, such as organized cybercrime, hackers, and state-sponsored organizations, to penetrate key systems. Information security risks for us and other large financial institutions have increased significantly in recent years, partly due to the proliferation of new technologies, including artificial intelligence, the ubiquity of internet connections, and the increased sophistication and activities of threat actors. Moreover, developments in our and third parties' use of generative artificial intelligence, as well as the use of mobile and cloud technologies, could heighten these and other operational risks, as certain aspects of the security of such technologies may be complex, unpredictable, or beyond our control. The types of attacks these threat actors use include, but are not limited to, exploiting customer or system vulnerabilities or misconfigurations, denial-of-service, ransomware, compromising business emails, deceiving employees through email phishing or social engineering, and compromising any of our suppliers. Such threats may be difficult to detect over extended periods and could be further exacerbated through threat actors' use of artificial intelligence. Third parties, including our suppliers and their subcontractors, also present operational and information security risks to us, including security incidents or failures of their own systems and downstream systems. In incidents involving third parties, we may not be informed promptly of any effect on our services or our data, nor be able to participate in any related investigation, notification, or remediation. The possibility of third-party or employee error, failure to follow security procedures, or malfeasance also presents these risks. As cybersecurity threats continue to evolve, we allocate necessary resources to modify or enhance our defenses and investigate or remediate any information security vulnerabilities. While we and our third-party suppliers have experienced cybersecurity incidents in the past that have not materially impacted our data, customers, or operations, there can be no assurance that future failures, interruptions, or significant security breaches will not occur or that they will be adequately addressed. It is impossible to determine the severity or potential effects of these incidents with any certainty. System enhancements and updates may also create risks associated with implementing new systems and integrating them with existing ones. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our defenses itself can create a risk of systems disruptions and security issues. We may face additional risks to the extent our hardware and software providers are unable to deliver patches and updates to mitigate vulnerabilities or we are unable to implement patches in a timely manner, particularly when a vulnerability is being actively exploited by threat actors. We have devoted and will continue to devote significant resources to the security of our computer systems, but they may still be vulnerable to these threats and our efforts may subsequently be deemed to have been inadequate by regulators or courts. The occurrence of any failure, interruption or security incident to our information systems or those of our third-party suppliers could interfere with or disrupt our operations and services, damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny, expose us to civil litigation and financial liability, or otherwise result in material adverse consequences on us. For information about how we manage cybersecurity risk, see Part I, Item 1C. Cybersecurity on page 24.

Concentrations of risk from counterparties could adversely affect us. Similar exposures across our loan and investment securities portfolios could pose additional credit risk. Additionally, concentrations with counterparties in derivative or securities financing transactions could further elevate this risk.