Zions Bancorporation National Association (ZION) Risk Analysis

We are subject to risks arising from legal claims, litigation, and regulatory or governmental proceedings. Our exposure to such matters may increase due to a variety of factors, including economic pressures affecting customers and counterparties, a rise in claims and actions related to fraudulent schemes involving our customers, the implementation of new regulations under recently enacted legislation, changes in political leadership and priorities, and heightened enforcement and legal actions targeting financial institutions. These proceedings may result in material adverse effects on our financial condition, operating results, or ability to conduct business. Potential consequences include unfavorable judgments, settlements, fines, civil money penalties, injunctions, operational restrictions, or other forms of relief. Although we maintain insurance coverage intended to mitigate financial exposure related to legal defense, settlements, and awards, such coverage is subject to deductibles and policy limits and may not fully offset all associated costs. Participation in legal or regulatory matters-regardless of outcome-can also negatively impact our reputation and divert management attention from core business operations. Moreover, the financial services industry has experienced a notable increase in settlement amounts, which has adversely affected our ability to obtain insurance coverage for certain claims, raised deductible thresholds, and driven up premium costs. As a result, our financial performance is increasingly susceptible to adverse outcomes from legal proceedings. Given the inherent uncertainty in forecasting the timing and financial impact of litigation and enforcement actions, adverse effects may occur sporadically and could be significant. Additionally, regulatory enforcement actions may influence our supervisory and CRA ratings, potentially limiting or restricting certain business activities.

There has been increased focus among policymakers, investors, and other stakeholders on corporate practices related to environmental, social, and other sustainability matters. For example, recent executive orders issued by the current administration aim to restrict or prohibit certain corporate diversity initiatives and limit the consideration of environmental and social factors by financial institutions in customer-related decisions. Given the differing viewpoints among stakeholders on these issues, we face increased legal, regulatory, and operational risks. We may be unable to meet the conflicting expectations of all key stakeholders, which could adversely affect our business, operational results, and brands. Evolving policy, legal, regulatory, and political developments-as well as changing investor and regulatory expectations-may require adjustments to our business practices, strategies, or commitments and may increase compliance, operational, or other costs. Certain states have enacted or proposed laws addressing climate change and other sustainability issues, including climate-related disclosure requirements. Other states have proposed or adopted laws or actions restricting the consideration of environmental and social factors in state investments and contracting. In addition, in August 2025, President Trump signed Executive Order 14331, "Guaranteeing Fair Banking Access for All Americans," which states that financial services should not be denied based on constitutionally or statutorily protected beliefs, affiliations, or political views. The Executive Order directs the Treasury Secretary and federal banking regulators to address politicized or unlawful debanking activities. These and other laws, regulations, guidance, and expectations-many of which may have broad or extraterritorial application-have subjected, and may continue to subject, us to additional or conflicting requirements across the jurisdictions in which we operate. Such developments could negatively affect our business and brands, increase regulatory, compliance, credit, and operational risks, raise associated costs, or limit our ability to operate in certain jurisdictions. For more information, see "Other Regulations and Proposals" in Supervision and Regulation on page 12.

We rely extensively on communications and information systems to support our business operations. These systems process and store confidential, proprietary, personal, or otherwise sensitive data, including financial and other confidential business information. Like other financial institutions, we and our customers are subject to persistent and increasingly sophisticated cyber threats from a range of threat actors, including organized cybercriminals, hackers, and state-sponsored organizations. The proliferation of advanced technologies-such as AI-alongside widespread internet connectivity and increased sophistication of the activities of threat actors has significantly heightened information security risks across the financial services industry. Emerging technologies-including generative AI, mobile platforms, quantum computing, and cloud computing-continue to heighten operational and cybersecurity risks. The complexity and unpredictability of these technologies, as well as limited control over certain aspects of their security, present additional challenges. Threat actors employ a variety of tactics, including exploiting system vulnerabilities or misconfigurations, launching denial-of-service attacks, deploying ransomware, compromising business email systems, deceiving employees through email phishing and social engineering, and targeting our suppliers. These threats can be difficult to detect over extended periods and may be further exacerbated by the use of AI. Third-party providers, including suppliers and their subcontractors, present operational and information security risks. These risks include potential security breaches or failures within their systems or those of their downstream partners. In such instances, we may not receive timely notification of incidents affecting our services or data, nor have the ability to participate in related investigations, disclosures, or remediation efforts. Additional risks may arise from human error, noncompliance with security protocols, or intentional misconduct by employees or third parties. Our ability to control and monitor the operational and cybersecurity measures implemented by third-party providers is limited, and under applicable laws, regulations, or contractual obligations, we may be held responsible for cyber incidents within third-party systems that impact us or our customers. As cybersecurity threats continue to evolve, we remain committed to allocating the necessary resources in an effort to strengthen our defenses and address any information security vulnerabilities. While past cybersecurity incidents involving our systems and those of our third-party providers have not resulted in material impacts to our data, customers, or operations, we cannot guarantee that future incidents will not occur or that they will be effectively mitigated. The potential severity and consequences of such events are inherently uncertain. Furthermore, system upgrades and enhancements may introduce risks related to implementation and integration with existing infrastructure. Given the complexity and interdependence of our technology environment, efforts to improve security can inadvertently lead to system disruptions or new vulnerabilities. Additional risks may arise if hardware and software vendors are unable to deliver timely patches or if we are unable to implement necessary updates promptly-particularly in cases where threat actors are actively exploiting known vulnerabilities. Despite substantial investments in cybersecurity, our systems may remain susceptible to evolving threats, and our mitigation efforts may be deemed inadequate by regulatory authorities or courts. Any failure, disruption, or security incident-whether actual or perceived-affecting our communications and information technology systems or those of our third-party providers could impact our operations and services, damage our reputation, result in loss of customer business, increase regulatory scrutiny, expose us to civil litigation and financial liability, and lead to other material adverse consequences. Furthermore, any insurance coverage we maintain may be insufficient to fully compensate for losses arising from the foregoing risks. We also cannot assure that such coverage will remain available on acceptable terms, or at all, or that insurers will not deny coverage for future claims. For information about our cybersecurity risk management practices, see Part I, Item 1C. Cybersecurity on page 26.

We rely on various information technology systems to support both internal operations and customer-facing services. A vulnerability, failure, or outage affecting any of these systems could affect our ability to execute critical functions and deliver services to customers, such as online banking, mobile banking, remote deposit capture, treasury and payment services, and other services dependent on system processing. These risks are heightened as systems and software approach the end of their useful life or require increasingly frequent updates and modifications. Although we maintain well-established business continuity, disaster recovery, and crisis management protocols, these measures may not be sufficient to fully restore operations in the event of a significant system disruption. As such, we cannot ensure that such incidents will not result in significant operational or customer-facing impacts. For risks related to technology system enhancements, see "Strategic and Business Risk" in Risk Factors on page 17.

The occurrence of pandemics, natural disasters, and other climate-related or catastrophic events could materially and adversely affect our operations and financial performance. We maintain substantial operations and serve a significant customer base in regions such as Utah, Texas, California, and other regions-areas which are historically susceptible to natural and other environmental disasters. These include hurricanes, tornadoes, earthquakes, wildfires, floods, mudslides, prolonged droughts, and other weather-related events, many of which may be exacerbated by the effects of climate change and occur with increasing frequency and severity. Events, such as the 2025 wildfires in Southern California, have presented physical risks to our facilities, disrupted local economic activity, and adversely affected our business and customers-particularly through reduced access to insurance and essential services. Additionally, similar events occurring in other parts of the world may also have indirect impact on our operations and customers.

Our ability to successfully execute strategic initiatives, deliver high-quality services, and remain competitive may be adversely affected if we are unable to recruit and retain qualified personnel, or if employee compensation and benefits expenses increase significantly. Regulatory guidance and rules issued by banking authorities impose restrictions on the structure and amount of compensation that financial institutions may offer, which can hinder our capacity to attract and retain key personnel. These constraints may place us at a disadvantage relative to competitors-particularly financial technology firms and other entities not subject to the same regulatory limitations-when competing for skilled professionals. Additionally, broader economic conditions and evolving workforce dynamics, including shifting employee priorities, regulatory expectations, increased geographic mobility, and the adoption of remote work models, may further challenge our talent retention efforts and contribute to increased compensation demands, associated costs, or other operational challenges. Moreover, inflationary pressures have led to increased compensation costs, a trend that is expected to persist and may continue to impact our financial performance. If we experience such adverse effects with respect to our employees, our business, financial condition, and results of operations could be adversely or materially impacted.

Consolidation in our industry-whether through smaller banks merging to create larger, more competitive institutions or through combinations of banks and non-bank entities-may intensify competitive pressures, particularly in affected regions or for specific products. To the extent we expand into new markets, we may encounter competitors with greater experience and established customer relationships, which could adversely impact our ability to compete effectively. Failure to adequately respond to these competitive dynamics could hinder our ability to attract and retain customers across our businesses.

We continue to face persistent and increasingly sophisticated attempts to defraud the Bank and our customers from a variety of sources. The frequency of these schemes may increase in an adverse economic environment. Our ability to identify and prevent fraud depends on the effectiveness of our systems, processes, and personnel; however, despite the safeguards we have implemented, some fraudulent activities may still go undetected. As a result, we may not be able to detect, prevent, or mitigate all future incidents, which could lead to material financial losses. Furthermore, even in cases where we are not financially responsible for reimbursing customers for fraudulent losses, such incidents can harm our reputation and impair our ability to attract and retain customers.