Associated Banc-Corp (ASB) 10-K2023 FY Annual report

This document, including the documents that are incorporated by reference, contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended and Section 21E of the Exchange Act. You can identify forward-looking statements by words such as "may," "should," "expect," "plan," "anticipate," "intend," "believe," "estimate," "predict," "potential," "continue," "could," "future," "outlook," or the negative of those terms or other words of similar meaning. You should read statements that contain these words carefully because they discuss our future expectations or state other "forward-looking" information. Such forward-looking statements may relate to our financial condition, results of operations, plans, objectives, future performance, or business and are based upon the beliefs and assumptions of our management and the information available to our management at the time these disclosures are prepared. These forward-looking statements involve risks and uncertainties that we may not be able to accurately predict or control and our actual results may differ materially from those we described in our forward-looking statements. Shareholders should be aware that the occurrence of the events discussed under the heading Risk Factors in this document, and in the information incorporated by reference herein, could have an adverse effect on our business, results of operations, and financial condition. These factors, many of which are beyond our control, include the following.

Associated Banc-Corp is a bank holding company registered pursuant to the BHC Act. Our bank subsidiary, Associated Bank, traces its history back to the founding of the Bank of Neenah in 1861. We were incorporated in Wisconsin in 1964 and were inactive until 1969 when permission was received from the Federal Reserve to acquire three banks. At December 31, 2023, we owned one nationally chartered commercial bank headquartered in Green Bay, Wisconsin, which serves local communities across the upper Midwest, one nationally chartered trust company headquartered in Milwaukee, Wisconsin, and 12 limited purpose banking and nonbanking subsidiaries either located in or conducting business primarily in our three state branch footprint (Wisconsin, Illinois, and Minnesota) that are closely related or incidental to the business of banking or financial in nature. Measured by total assets reported at December 31, 2023, we are the largest bank holding company headquartered in Wisconsin.

Through Associated Bank and various nonbanking subsidiaries, we provide a broad array of banking and nonbanking products and services to individuals and businesses through 196 banking branches at December 31, 2023, serving more than 100 communities, primarily within our three-state branch footprint. Our business is primarily relationship-driven and is organized into three reportable segments: Corporate and Commercial Specialty; Community, Consumer, and Business; and Risk Management and Shared Services.

See Note 21 Segment Reporting of the notes to consolidated financial statements in Part II, Item 8, Financial Statements and Supplementary Data, for additional information concerning our reportable segments.

We are not dependent upon a single or a few customers, the loss of which would have a material adverse effect on us.

We are very fortunate to have a diverse, committed team of approximately 4,100 colleagues at December 31, 2023 who are capable, determined and empowered to drive our company forward. None of our colleagues are represented by unions.

Further, we feel a critical component of our success is our ability to recognize and value diversity while promoting inclusion, both internally and in the communities we serve.

As of December 31, 2023, as a result of these efforts, our colleague representation is as follows:

We continue to develop and implement programs to support DE&I:

In 2023, we used our expertise to provide loans and investments as well as financial support to:

Our DE&I efforts have been recognized in 2023 by our communities as follows:

The financial services industry is highly competitive. We compete for loans, deposits, and financial services in all of our principal markets. We compete directly with other bank and nonbank institutions located within our markets, internet-based banks, out-of-market banks and bank holding companies that advertise or otherwise serve our markets, money market funds and other mutual funds, brokerage houses, and various other financial institutions. Additionally, we compete with insurance companies, leasing companies, regulated small loan companies, credit unions, governmental agencies, and commercial entities offering financial services products, including nonbank lenders and financial technology companies. Competition involves, among other things, efforts to retain current customers and to obtain new loans and deposits, the scope and types of services offered, interest rates paid on deposits and charged on loans, as well as other aspects of banking. We also face direct competition from subsidiaries of bank holding companies that have far greater assets and resources than ours.

The Corporation and its banking and nonbanking subsidiaries are subject to extensive regulation and oversight both at the federal and state levels. The following is an overview of the statutory and regulatory framework that affects the business of the Corporation and our subsidiaries.

As a registered bank holding company under the BHC Act, we are regulated, supervised, and examined by the Federal Reserve. In connection with applicable requirements, bank holding companies file periodic reports and other information with the Federal Reserve. The BHC Act also governs the activities that are permissible for bank holding companies and their affiliates and permits the Federal Reserve, in certain circumstances, to issue cease and desist orders and other enforcement actions against bank holding companies and their nonbanking affiliates to correct and curtail unsafe or unsound banking practices. Under the Dodd-Frank Act and longstanding Federal Reserve policy, bank holding companies are required to act as a source of financial strength to each of their banking subsidiaries pursuant to which such holding company may be required to commit financial resources to support such subsidiaries in circumstances when, absent such requirements, they might not otherwise do so. The BHC Act further regulates holding company activities, including requirements and limitations relating to capital, transactions with officers, directors and affiliates, securities issuances, dividend payments, inter-affiliate liabilities, extensions of credit, and expansion through mergers and acquisitions.

The BHC Act allows certain qualifying bank holding companies that elect treatment as “financial holding companies” to engage in activities that are financial in nature and that explicitly include the underwriting and sale of insurance. The Parent Company thus far has not elected to be treated as a financial holding company. Bank holding companies that have not elected such treatment generally must limit their activities to banking activities and activities that are closely related to banking.

Associated Bank and our nationally-chartered trust company subsidiary are regulated, supervised and examined by the OCC. The OCC has primary supervisory and regulatory authority over the operations of Associated Bank and the Corporation's trust company subsidiary. As part of this authority, Associated Bank and our trust company subsidiary are required to file periodic reports with the OCC and are subject to regulation, supervision and examination by the OCC. To support its supervisory function, the OCC has the authority to assess and charge fees on all national banks according to a set fee schedule. On December 1, 2023, the OCC published its assessment rates for the 2024 calendar year. The OCC elected to maintain its general assessment schedule from 2023 with no adjustments for inflation.

The federal banking agencies have adopted the Interagency Guidelines for Establishing Standards for Safety and Soundness (the “Guidelines”). The Guidelines establish certain safety and soundness standards for all depository institutions. The operational and managerial standards in the Guidelines relate to the following: (1) internal controls and information systems; (2) internal audit systems; (3) loan documentation; (4) credit underwriting; (5) interest rate exposure; (6) asset growth; (7)

compensation, fees and benefits; (8) asset quality; and (9) earnings. Rather than providing specific rules, the Guidelines set forth basic compliance considerations and guidance with respect to a depository institution. Failure to meet the standards in the Guidelines, however, could result in a request by the OCC for a written compliance plan to demonstrate efforts to come into compliance with such Guidelines. Failure to provide and implement a plan requires the appropriate federal banking agency to issue an order to the institution requiring compliance.

We are required as a supervisory matter to implement an effective corporate and risk governance framework commensurate with our size, complexity and risk profile. Fundamental components of this framework include the authorities and responsibilities of directors and senior managers to govern the operations and structure of the Corporation and the Bank, as well as the implementation and management of systems and processes designed to identify, measure, monitor and control the risks to the organization, specifically including strategic, reputation, compliance and operational risks.

Corporate and risk governance oversight is a core supervisory function of the federal banking agencies, including the OCC. National banks with at least $50 billion in total assets are subject to prescribed standards for the implementation of risk governance frameworks addressing credit risk, interest rate risk, liquidity risk, price risk, operational risk, compliance risk, strategic risk, and reputation risks. Additionally, on October 11, 2023, the FDIC issued a proposed rule and guidelines that would require all FDIC-supervised IDIs with total assets of $10 billion or more to adopt heightened corporate governance and risk management standards pursuant to which covered institutions would be required to develop and implement a comprehensive and independent risk management function and effective programs for internal controls, risk management, and audits. The prospects and timing for the adoption by the FDIC of a final rule are not certain at this time.

Although the Bank presently is not subject to the existing OCC risk governance standards for larger banks based on its current asset size, and the Bank, as a national bank supervised by the OCC, is not within the scope of the FDIC’s proposed rule, certain expectations set forth in existing and proposed regulatory guidelines may be imposed upon the Bank in the ordinary course of supervision and examination.

Further, the federal banking agencies have in recent years increased their focus on banks’ third-party risk management controls and practices. On June 6, 2023, the federal banking agencies, including the OCC, adopted interagency guidance on risk management of third-party relationships. The guidance applies broadly to any business agreement between a banking organization and another entity, by contract or otherwise (including affiliated entities), and it requires banking organizations to analyze the risks associated with each third-party relationship and establish effective governance and risk management processes for all stages of a third-party relationship, including planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination. See Item 1A, Risk Factors — Operational Risks for additional discussion of this topic.

We are required to obtain prior Federal Reserve approval before acquiring more than 5 percent of the voting shares, or substantially all of the assets, of a bank holding company, bank or savings association. In addition, the prior approval of the OCC is required for a national bank to merge with another bank or purchase the assets or assume the deposits of another bank. In determining whether to approve a proposed bank acquisition, federal bank regulators will consider, among other factors, the effect of the acquisition on competition, the public benefits expected to be received from the acquisition, the projected capital ratios and levels on a post-acquisition basis, and the acquiring institution’s record of addressing the credit needs of the communities it serves, including the needs of LMI neighborhoods, consistent with the safe and sound operation of the bank, under the CRA.

The Parent Company is a legal entity separate and distinct from the Bank and other nonbanking subsidiaries. A substantial portion of our cash flow comes from dividends paid to us by Associated Bank. The OCC’s prior approval of the payment of dividends by Associated Bank to the Parent Company is required only if the total of all dividends declared by the Bank in any calendar year exceeds the sum of the Bank’s retained net income for that year and its retained net income for the preceding two calendar years, less any required transfers to surplus. Federal law also prohibits national banks from paying dividends that would be greater than the bank’s undivided profits after deducting statutory bad debt in excess of the bank’s allowance for loan losses. In addition, under the FDICIA, an IDI, such as the Bank, is prohibited from making capital distributions, including the payment of dividends, if, after making such distribution, the institution would become “undercapitalized” (as such term is used in the FDICIA).

In addition, we and the Bank are subject to various general regulatory policies and requirements relating to the payment of dividends, including requirements to maintain adequate capital above regulatory minimums. The appropriate federal regulatory authority is authorized to determine under certain circumstances relating to the financial condition of a bank or bank holding company that the payment of dividends would be an unsafe or unsound practice and to prohibit payment thereof. Under the Dodd-Frank Act and the requirements of the Federal Reserve, the Parent Company, as a bank holding company, is required to serve as a source of financial strength to the Bank and to commit resources to support the Bank. In addition, consistent with its “source of strength” policy, the Federal Reserve has stated that, as a matter of prudent banking, a bank holding company should not maintain a level of cash dividends to its shareholders that places undue pressure on the capital of its bank subsidiaries, or that can be funded only through additional borrowings or other arrangements that may undermine the bank holding company’s ability to serve as a source of strength. The appropriate federal regulatory authorities have indicated that paying dividends that deplete a bank’s capital base to an inadequate level would be an unsafe and unsound banking practice and that banking organizations should generally pay dividends only out of current operating earnings.

We are subject to various regulatory capital requirements both at the Parent Company and at the Bank level administered by the Federal Reserve and the OCC, respectively. Failure to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators that, if undertaken, could have an adverse material effect on our financial condition and results of operations. Under capital adequacy guidelines and the regulatory framework for prompt corrective action (described below), we must meet specific capital guidelines that involve quantitative measures of our assets, liabilities, and certain off-balance sheet items as calculated under regulatory accounting policies. Our capital amounts and classification are also subject to judgments by the regulators regarding qualitative components, risk weightings, and other factors. We have consistently maintained regulatory capital ratios at or above the well capitalized standards.

The Federal Reserve, the OCC and the FDIC have adopted risk-based capital regulations implementing certain provisions of the Dodd-Frank Act and Basel III. The agencies’ previous capital regulations were amended in 2013 following the enactment of the Dodd-Frank Act to strengthen the components of regulatory capital, increase risk-based capital requirements, and make selected changes to the calculation of risk-weighted assets. In general, subject to certain exceptions as discussed further below, minimum capital standards established under the risk-based capital regulations include a CET1 capital to risk-weighted assets ratio of 4.5 percent, a Tier 1 capital to risk-weighted assets ratio of 6.0 percent, a total capital to risk-weighted assets ratio of 8.0 percent, and a Tier 1 capital to adjusted average total assets leverage ratio of 4.0 percent. In determining the amount of risk-weighted assets for purposes of calculating risk-based capital ratios, all assets, including certain off-balance sheet assets (for example, recourse obligations, direct credit substitutes and residual interests) are multiplied by a risk-weight factor assigned by the regulations based on the risks believed inherent in the type of asset. Higher levels of capital are required for asset categories believed to present greater risk. CET1 capital is generally defined as common shareholders’ equity and retained earnings. Tier 1 capital is generally defined as CET1 and additional Tier 1 capital. Additional Tier 1 capital includes certain noncumulative perpetual preferred stock and related surplus and minority interests in equity accounts of consolidated subsidiaries. Total capital includes Tier 1 capital (CET1 capital plus additional Tier 1 capital) and Tier 2 capital. Tier 2 capital is comprised of capital instruments and related surplus, meeting specified requirements, and may include cumulative preferred stock and long-term perpetual preferred stock, mandatory convertible securities, intermediate preferred stock and subordinated debt. Also included in Tier 2 capital is the allowance for credit losses limited to a maximum of 1.25 percent of risk-weighted assets. Calculation of all types of regulatory capital is subject to deductions and adjustments specified in the regulations. In assessing an institution’s capital adequacy, the OCC takes into consideration not only these numeric factors, but qualitative factors as well, and has the authority to establish higher capital requirements for individual institutions where deemed necessary.

In addition to establishing the minimum regulatory capital requirements, the capital regulations limit capital distributions and certain discretionary bonus payments to management if the institution does not hold a capital conservation buffer consisting of 2.5 percent of CET1 capital to risk-weighted assets above the amount necessary to meet its minimum risk-based capital requirements.

Through subsequent rulemaking, the federal banking agencies provided certain forms of relief to banking organizations that are not subject to the capital regulation's advanced approaches, such as the Corporation. For instance, non-advanced approaches institutions are subject to simpler regulatory capital requirements for MSAs, certain DTAs arising from temporary differences, investments in the capital of unconsolidated financial institutions, and requirements for the amount of capital issued by a consolidated subsidiary of a banking organization and held by third parties (sometimes referred to as a minority interest) that is includable in regulatory capital.

Specifically, such institutions may deduct from CET1 capital any amount of MSAs, temporary difference DTAs, and investments in the capital of unconsolidated financial institutions that individually exceeds 25 percent of CET1 capital.

On July 27, 2023, the federal banking agencies issued a proposed rule to implement the final components of the Basel III standards set by the Basel Committee on Banking Supervision in 2017. The proposed rule, which would not apply to the Corporation and the Bank as proposed, would substantially revise the existing regulatory capital framework for institutions with $100 billion or more of assets. See Item 1A, Risk Factors — Legal, Regulatory, Compliance and Reputational Risks for additional discussion of this topic.

In June 2016, the FASB issued an accounting standard update, “Financial Instruments-Credit Losses (Topic 326), Measurement of Credit Losses on Financial Instruments,” which replaced the “incurred loss” model for recognizing credit losses with an “expected loss” model referred to as the CECL model. Under the CECL model, we are required to present certain financial assets carried at amortized cost, such as loans held for investment and HTM securities, at the net amount expected to be collected. The measurement of expected credit losses is to be based on information about past events, including historical experience, current conditions, and reasonable and supportable forecasts that affect the collectability of the reported amount. On December 21, 2018, the federal banking agencies approved a final rule modifying their regulatory capital rules and providing an option to phase in over a period of three years the day-one regulatory capital effects of the CECL model. The final rule also revises the agencies’ other rules to reflect the update to the accounting standards. The final rule took effect April 1, 2019. However, on August 26, 2020, the federal bank regulatory agencies issued a final rule that provided institutions that had adopted the CECL accounting standard in 2020 with the option to mitigate the estimated capital effects of CECL for two years, followed by a three-year transition period. Taken together, these measures offer institutions a transition period of up to five years. The Corporation elected to utilize the 2020 Capital Transition Relief as permitted under applicable regulations. As a result, the three-year phase-out period described above commenced in 2022.

As part of the regulatory relief provided by the Economic Growth Act, the asset threshold requiring IDIs to conduct and report to their primary federal bank regulators annual company-run stress tests, as well as to comply with leverage limits, liquidity requirements, and resolution planning requirements, was raised from $10 billion to $250 billion in total consolidated assets and the stress testing requirement was made “periodic” rather than annual. As a result of the legislation and related OCC rulemaking thereunder, the Bank is no longer subject to Dodd-Frank Act stress testing requirements. The Economic Growth Act also provided that bank holding companies under $100 billion in assets were no longer subject to stress testing requirements. The amended regulations also provide the Federal Reserve with discretion to subject bank holding companies with more than $100 billion in total assets to enhanced supervision. In addition, Section 214 of the Economic Growth Act and its implementing regulation prohibit the federal banking agencies from requiring the Bank to assign a heightened risk weight to certain HVCRE ADC loans as previously required under the Basel III Capital Rules. Notwithstanding these regulatory amendments, the federal banking agencies indicated through interagency guidance that the capital planning and risk management practices of institutions with total assets less than $100 billion would continue to be reviewed through the regular supervisory process. Although the Corporation will continue to monitor and stress test its capital consistent with the safety and soundness expectations of the

federal regulators, the Corporation no longer publishes stress testing results as a result of the legislative and regulatory amendments.

The Federal Reserve, the OCC, and the CFPB have extensive supervisory authority over their regulated institutions, including, among other things, the power to compel higher reserves, the ability to assess civil money penalties, the ability to issue cease-and-desist or removal orders and the ability to initiate injunctive actions. In general, these enforcement actions may be initiated for violations of laws and regulations or for unsafe or unsound banking practices. Other actions or inactions by the Parent Company may provide the basis for enforcement action, including misleading or untimely reports.

Federal banking regulators are authorized and, under certain circumstances, required to take certain actions against banks that fail to meet their capital requirements. The federal banking agencies have additional enforcement authority with respect to undercapitalized depository institutions.

“Well capitalized” institutions may generally operate without supervisory restriction. “Adequately capitalized” institutions cannot normally pay dividends or make any capital contributions that would leave them undercapitalized; they cannot pay a management fee to a controlling person if, after paying the fee, they would be undercapitalized; and they cannot accept, renew or roll over any brokered deposit unless the bank has applied for and been granted a waiver by the FDIC.

The federal banking agencies are required to take action to restrict the activities of an “undercapitalized,” “significantly undercapitalized,” or “critically undercapitalized” IDI. Any such bank must submit a capital restoration plan that is guaranteed by the parent holding company. Until such plan is approved, it may not increase its assets, acquire another institution, establish a branch or engage in any new activities, and generally may not make capital distributions. In certain situations, a federal banking agency may reclassify a well-capitalized institution as adequately capitalized and may require an adequately capitalized or undercapitalized institution to comply with supervisory actions as if the institution were in the next lower category.

Institutions must file a capital restoration plan with the OCC within 45 days of the date it receives a notice from the OCC that it is “undercapitalized,” “significantly undercapitalized,” or “critically undercapitalized.” Compliance with a capital restoration plan must be guaranteed by a parent holding company. In addition, the OCC is permitted to take any one of a number of discretionary supervisory actions, including but not limited to the issuance of a capital directive and the replacement of senior executive officers and directors.

Finally, bank regulatory agencies have the ability to impose higher than normal capital requirements known as individual minimum capital requirements for institutions with a high-risk profile.

At December 31, 2023, the Bank satisfied the capital requirements necessary to be deemed “well-capitalized.” In the event of a change to this status, the imposition of any of the measures described above could have a material adverse effect on the Corporation and on its profitability and operations. The Corporation’s shareholders do not have preemptive rights and, therefore, if the Corporation is directed by the OCC or the FDIC to issue additional shares of common stock, such issuance may result in dilution in shareholders’ percentage of ownership of the Corporation.

Associated Bank is a member of the FDIC and pays an insurance premium to the FDIC based upon its assessment rates on a quarterly basis. Deposits are insured up to applicable limits by the FDIC and such insurance is backed by the full faith and credit of the United States Government.

Under the Dodd-Frank Act, a permanent increase in deposit insurance was authorized to $250,000 per depositor, per IDI for each account ownership category.

The Dodd-Frank Act also set the minimum DIF reserve ratio at 1.35 percent of estimated insured deposits. The FDIC was required to attain this ratio by September 30, 2020. The Dodd-Frank Act also required the FDIC to define the deposit insurance assessment base for an IDI as an amount equal to the institution’s average consolidated total assets during the assessment period minus average tangible equity. The assessment rate schedule for larger institutions like Associated Bank (i.e., institutions with at least $10 billion in assets) differentiates between such large institutions by use of a “scorecard” that combines an institution’s CAMELS ratings with certain forward-looking financial information to measure the risk to the DIF. Pursuant to this “scorecard” method, two scores (a performance score and a loss severity score) will be combined and converted to an initial base assessment rate. The performance score measures an institution’s financial performance and ability to withstand stress. The loss severity score measures the relative magnitude of potential losses to the DIF in the event of the institution’s failure.

Total scores are converted pursuant to a predetermined formula into an initial base assessment rate. Assessment rates range from 2.5 bp to 45 bp for large institutions.

The FDIC has the flexibility to adopt actual rates that are higher or lower than the total base assessment rates adopted without notice and comment, if certain conditions are met.

On October 18, 2022, the FDIC adopted a final rule, applicable to all IDIs, to increase base deposit insurance assessment rate schedules uniformly by 2 bp beginning in the first quarterly assessment period of 2023. The increase was instituted to account for extraordinary growth in insured deposits during the first and second quarters of 2020, which caused a substantial decrease in the DIF reserve ratio. The FDIC indicated that the new assessment rate schedules will remain in effect until the DIF reserve ratio meets or exceeds 2 percent.

Further, on November 16, 2023, the FDIC issued a final rule to implement a special assessment to recover the loss to the DIF associated with protecting uninsured depositors following the closure of SVB and SBNY. Under the final rule, the assessment base for an IDI will be equal to the institution’s estimated uninsured deposits as of December 31, 2022, adjusted to exclude the first $5 billion in estimated uninsured deposits. Under the final rule, the FDIC will collect the special assessment at an annual rate of 13.4 bp beginning with the first quarterly assessment period of 2024 and will continue to collect special assessments for an anticipated total of eight quarterly assessment periods. At December 31, 2023, our estimated level of uninsured deposits is $14.8 billion. See Item 1A, Risk Factors — Legal, Regulatory, Compliance and Reputational Risks for additional discussion of this topic.

DIF-insured institutions pay a FICO assessment in order to fund the interest on bonds issued in the 1980s in connection with the failures in the thrift industry. The FICO assessment was computed on assets as required by the Dodd-Frank Act. These assessments continued until the bonds matured in September 2019. The Corporation’s assessment rate for FDIC was approximately 9 bp for 2023.

The FDIC is authorized to conduct examinations of and require reporting by FDIC-insured institutions. It is also authorized to terminate a depository bank’s deposit insurance upon a finding by the FDIC that the bank’s financial condition is unsafe or unsound or that the institution has engaged in unsafe or unsound practices or has violated any applicable rule, regulation, order or condition enacted or imposed by the bank’s regulatory agency. The termination of deposit insurance for our national bank subsidiary would have a material adverse effect on our earnings, operations and financial condition.

Historically, deposit insurance premiums we have paid to the FDIC have been deductible for federal income tax purposes; however, the Tax Act disallows the deduction of such premium payments for banking organizations with total consolidated assets of $50 billion or more. For banks with less than $50 billion in total consolidated assets, such as ours, the premium deduction is phased out based on the proportion of a bank’s assets exceeding $10 billion.

Section 29 of the FDI Act and FDIC regulations thereunder limit the ability of an IDI, such as the Bank, to accept, renew or roll over brokered deposits unless the institution is well-capitalized under the prompt corrective action framework described above, or unless it is adequately capitalized and obtains a waiver from the FDIC. In addition, less than well-capitalized banks are subject to restrictions on the interest rates they may pay on deposits. The characterization of deposits as "brokered" may result in the imposition of higher deposit assessments on such deposits. As mandated by the Economic Growth Act, the FDIC adopted a final rule in February 2019 to include a limited exception for reciprocal deposits for FDIC-IDIs that are well rated and well capitalized (or adequately capitalized and have obtained a waiver from the FDIC as mentioned above). Under the limited exception, qualified FDIC-IDIs, like the Bank, are able to except from treatment as "brokered" deposits up to $5 billion or 20 percent of the institution's total liabilities in reciprocal deposits (which is defined as deposits received by a financial institution through a deposit placement network with the same maturity (if any) and in the same aggregate amount as deposits placed by the institution in other network member banks).

In December of 2020, the FDIC issued a final rule amending its brokered deposits regulation. The final rule sought to clarify and modernize the FDIC's regulatory framework for brokered deposits. Notable aspects of the rule include (1) the establishment of bright-line standards for determining whether an entity meets the statutory definition of "deposit broker"; (2) the identification of a number of business relationships in which the agent of nominee is automatically not deemed to be a "deposit broker" because their primary purpose is not the placement of funds with depository institutions (the "primary purpose exception"); (3) the establishment of a more transparent application process for entities that seek the "primary purpose exception", but do not qualify as one of the identified business relationships to which the exception is automatically applicable; and (4) the clarification that third parties that have an exclusive deposit-placement arrangement with only one IDI are not considered a "deposit broker." Full compliance with the amended brokered deposits regulation was required by January 1, 2022.

The FDIC staff continues to implement the final rule through the issuance of interpretative guidance and other administrative actions.

Transactions between our national banking subsidiary and its related parties or any affiliate are governed by Sections 23A and 23B of the Federal Reserve Act. An affiliate is any company or entity, which controls, is controlled by or is under common control with the bank. In a holding company context, at a minimum, the parent holding company of a national bank, and any companies that are controlled by such parent holding company, are affiliates of the bank. Generally, Sections 23A and 23B (i) limit the extent to which an institution or its subsidiaries may engage in “covered transactions” with any one affiliate to an amount equal to 10 percent of such institution’s capital stock and surplus, and contain an aggregate limit on all such transactions with all affiliates to an amount equal to 20 percent of such capital stock and surplus, and (ii) require that all such transactions be on terms substantially the same, or at least as favorable, to the institution or subsidiary as those provided to a nonaffiliate. The term “covered transaction” includes the making of loans, purchase of assets, issuance of a guarantee and similar types of transactions. Certain types of covered transactions must be collateralized according to a schedule set forth in the statute based on the type of collateral.

Certain transactions with our directors, officers or controlling persons are also subject to conflicts of interest regulations. Among other things, these regulations require that loans to such persons and their related interests be made on terms substantially the same as for loans to unaffiliated individuals and must not create an abnormal risk of repayment or other unfavorable features for the financial institution. See Note 4 Loans of the notes to consolidated financial statements in Part II, Item 8, Financial Statements and Supplementary Data, for additional information on loans to related parties.

Associated Bank is subject to periodic CRA reviews by the OCC. The CRA does not establish specific lending requirements or programs for financial institutions and does not limit the ability of such institutions to develop products and services believed best-suited for a particular community. An institution’s CRA assessment may be used by its regulators in their evaluation of certain applications, including a merger, acquisition or the establishment of a branch office. An unsatisfactory rating may be used as the basis for denial of such an application. The Bank received a “Satisfactory” CRA rating in its most recent evaluation.

On October 24, 2023, the federal banking agencies jointly issued a final rule to strengthen and modernize the existing CRA regulations. Under the final rule, the agencies will evaluate a bank’s CRA performance based upon the varied activities that it conducts and the communities in which it operates. CRA evaluations and data collection requirements will be tailored based on bank size and type. The Bank would be considered a large bank with assets of greater than $10 billion under the final rule and therefore will be evaluated under new lending, retail services and products, community development financing, and community development services tests. The final rule includes CRA assessment areas associated with mobile and online banking, and new metrics and benchmarks to assess retail lending performance. In addition, the final rule emphasizes smaller loans and investments that can have a high impact and be more responsive to the needs of LMI communities. The final rule will take effect on April 1, 2024; however, compliance with the majority of the final rule's provisions will not be required until January 1, 2026, and the data reporting requirements of the final rule will not take effect until January 1, 2027.

The changing privacy laws in the United States, Europe and elsewhere create new individual privacy rights and impose increased obligations on companies handling personal information, including the CCPA, as amended by the CPRA. While GLBA-regulated nonpublic, personal information generally is exempt under the CCPA (as well as the other state consumer privacy laws), the CCPA and certain other state laws apply to the personal information of representatives of any business contacts that the Bank engages with who are California residents, employees who are California residents, and any other personal information that the Bank collects outside of the scope of GLBA, such as with respect to certain data collected from visitors to our website.

In addition, multiple states, Congress and regulators within and outside of the United States are considering similar laws or regulations which could create new individual privacy rights and impose increased obligations on companies handling personal information, specifically including financial institutions.

The federal banking agencies, including the OCC, have issued a rule imposing cybersecurity notification requirements for banking organizations and their service providers. Specifically, the rule requires banking organizations to notify their primary federal regulator as soon as possible and no later than 36 hours after the discovery of a "computer-security incident" that rises to the level of a "notification incident," as those terms are defined under the final rule. Banks' service providers are required under the rule to notify any affected bank to or on behalf of which the service provider provides services "as soon as possible" after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for as much as four hours.

The federal banking agencies have also adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of the board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services. Moreover, recent cyberattacks against banks and other financial institutions that resulted in unauthorized access to confidential customer information have prompted the federal banking regulators to issue more extensive guidance on cybersecurity risk management. Among other things, financial institutions are expected to design multiple layers of security controls to establish lines of defense and ensure that their risk management processes address the risks posed by compromised customer credentials, including security measures to authenticate customers accessing internet-based services. A financial institution also should have a robust business continuity program to recover from a cyberattack and procedures for monitoring the security of third-party service providers that may have access to nonpublic data at the institution. See Item 1A, Risk Factors — Operational Risks for additional discussion of this topic.

Additionally, recent and ongoing developments may impact our data security- and privacy-related internal controls and risk profile. On October 19, 2023, the CFPB announced a proposed rule to adopt a regulation regarding personal financial data rights that is designed to promote “open banking.” If enacted as proposed, the regulation would require, among other things, that data providers, including any financial institution, make available to consumers and certain authorized third parties upon request certain covered transaction, account and payment information.

On October 30, 2023, the current Presidential Administration issued an Executive Order on Safe, Secure and Trustworthy Development and Use of AI, emphasizing the need for transparency, accountability and fairness in the development and use of AI. The order seeks to balance innovation with addressing risks associated with AI by providing eight guiding principles and priorities, such as ensuring that consumers are protected from fraud, discrimination and privacy risks related to AI. The Executive Order also requires certain federal agencies, including the CFPB, to address potential discrimination in the housing and consumer financial markets relating to the use by financial institutions of AI technologies. Prior to the issuance of the Executive Order, the CFPB published a report addressing the use by financial institutions of AI chatbots in the provision of financial products and services, which report also highlighted the limitations and various risks posed by such activity. States have also started to regulate the use of AI technologies. For example, the California Privacy Protection Agency is currently in the process of finalizing regulations under the CCPA regarding the use of automated decision making.

The BSA, which is intended to require financial institutions to develop policies, procedures, and practices to prevent and deter money laundering, mandates that every national bank have a written, board-approved program that is reasonably designed to assure and monitor compliance with the BSA. The program must, at a minimum: (1) provide for a system of internal controls to assure ongoing compliance; (2) provide for independent testing for compliance; (3) designate an individual responsible for coordinating and monitoring day-to-day compliance; and (4) provide training for appropriate personnel. In addition, national banks are required to adopt a customer identification program as part of their BSA compliance program. National banks are also required to file SARs when they detect certain known or suspected violations of federal law or suspicious transactions related to a money laundering activity or a violation of the BSA. The regulations implementing the BSA require financial institutions to establish risk-based procedures for conducting ongoing customer due diligence and procedures for understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile. In addition, FinCEN has promulgated customer due diligence and customer identification rules that require banks to identify and verify the identity of the beneficial owners of all legal entity customers (other than those that are excluded) at the time a new account is opened (other than accounts that are exempted).

In addition to complying with the BSA, the Bank is subject to the Patriot Act. The Patriot Act is designed to deny terrorists and criminals the ability to obtain access to the United States’ financial system and has significant implications for depository institutions, brokers, dealers, and other businesses involved in the transfer of money. The Patriot Act mandates that financial

service companies implement additional policies and procedures and take heightened measures designed to address any or all of the following matters: customer identification programs, money laundering, terrorist financing, identifying and reporting suspicious activities and currency transactions, currency crimes, and cooperation between financial institutions and law enforcement authorities.

On December 3, 2019, three federal banking agencies and FinCEN issued a joint statement clarifying the compliance procedures and reporting requirements that banks must file for customers engaged in the growth or cultivation of hemp, including a clear statement that banks need not file a SAR on customers engaged in the growth or cultivation of hemp in accordance with applicable laws and regulations. This statement does not apply to cannabis-related business; thus, the statement only pertains to customers who are lawfully growing or cultivating hemp and are not otherwise engaged in unlawful or suspicious activity.

Further, on January 1, 2021, Congress passed the NDAA, which enacted the most significant overhaul of the BSA and related AML laws since the Patriot Act. Notable amendments include (1) significant changes to the collection of beneficial ownership information and the establishment of a beneficial ownership registry, which requires corporate entities (generally, any corporation, LLC, or other similar entity with 20 or fewer employees and annual gross income of $5 million or less) to report beneficial ownership information to FinCEN (which will be maintained by FinCEN and made available upon request to financial institutions); (2) enhanced whistleblower provisions, which provide that one or more whistleblowers who voluntarily provide original information leading to the successful enforcement of violations of the AML laws in any judicial or administrative action brought by the Secretary of the Treasury or the Attorney General resulting in monetary sanctions exceeding $1 million (including disgorgement and interest but excluding forfeiture, restitution, or compensation to victims) will receive not more than 30 percent of the monetary sanctions collected and will receive increased protections; (3) increased penalties for violations of the BSA; (4) improvements to existing information sharing provisions that permit financial institutions to share information relating to SARs with foreign branches, subsidiaries, and affiliates (except those located in China, Russia, or certain other jurisdictions) for the purpose of combating illicit finance risks; and (5) expanded duties and powers of FinCEN. Many of the amendments require the Department of Treasury and FinCEN to promulgate rules. On September 29, 2022, FinCEN issued a final regulation implementing the BSA amendments included in the NDAA with respect to beneficial ownership.

Further, in June of 2020, the five agencies referenced above issued a final rule that modified the Volcker Rule's prohibition on banking entities' investing in or sponsoring "covered funds." The final rule (1) streamlined the covered funds portion of the rule; (2) addressed the extraterritorial treatment of certain foreign funds; and (3) permits banking entities to offer financial services and engage in other activities that do not raise concerns that the Volcker Rule was intended to address.

The federal banking agencies have issued guidance on sound incentive compensation policies that applies to all banking organizations supervised by the agencies (thereby including both the Parent Company and the Bank). Pursuant to the guidance, to be consistent with safety and soundness principles, a banking organization’s incentive compensation arrangements should: (1) provide employees with incentives that appropriately balance risk and reward; (2) be compatible with effective controls and risk management; and (3) be supported by strong corporate governance including active and effective oversight by the banking organization’s board of directors. Monitoring methods and processes used by a banking organization should be commensurate with the size and complexity of the organization and its use of incentive compensation.

The Dodd-Frank Act required the federal banking agencies and the SEC to establish joint regulations or guidelines for specified regulated entities, such as us, having at least $1 billion in total assets, to prohibit incentive-based payment arrangements that encourage inappropriate risk taking by providing an executive officer, employee, director or principal shareholder with excessive compensation, fees, or benefits or that could lead to material financial loss to the entity. In addition, these regulators must establish regulations or guidelines requiring enhanced disclosure to regulators of incentive-based compensation arrangements. Pursuant to SEC regulations and NYSE rules enacted in 2022, we adopted a "clawback" policy with respect to the recovery of incentive-based compensation paid to current or former executive officers in the event of material noncompliance with any financial reporting requirement under the securities laws. A copy of our clawback policy is attached as Exhibit 97 to this 10-K.

The Federal Reserve will review, as part of its standard, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Corporation, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

The scope and content of the U.S. banking regulators’ policies on executive compensation may continue to evolve in the near future. It cannot be determined at this time whether compliance with such policies will adversely affect the Corporation’s ability to hire, retain and motivate its key employees.

Federal and applicable state banking laws also require us to take steps to protect consumers. Bank regulatory agencies are increasingly focusing attention on compliance with consumer protection laws and regulations. These laws include disclosures regarding truth in lending, truth in savings, and funds availability.

To promote fairness and transparency for mortgages, credit cards, and other consumer financial products and services, the Dodd-Frank Act established the CFPB. This agency is responsible for interpreting and enforcing federal consumer financial laws, as defined by the Dodd-Frank Act, that, among other things, govern the provision of deposit accounts along with mortgage origination and servicing. Some federal consumer financial laws enforced by the CFPB include the Equal Credit Opportunity Act, TILA, the Truth in Savings Act, the Home Mortgage Disclosure Act, RESPA, the Fair Debt Collection Practices Act, and the Fair Credit Reporting Act. The CFPB is also authorized to prevent any institution under its authority from engaging in an unfair, deceptive, or abusive act or practice in connection with consumer financial products and services.

Under TILA as implemented by Regulation Z, mortgage lenders are required to make a reasonable and good faith determination based on verified and documented information that a consumer applying for a mortgage loan has a reasonable ability to repay the loan according to its terms. Mortgage lenders are required to determine consumers’ ATR in one of two ways. The first alternative requires the mortgage lender to consider the following eight underwriting factors when making the credit decision: (1) current or reasonably expected income or assets; (2) current employment status; (3) the monthly payment on the covered transaction; (4) the monthly payment on any simultaneous loan; (5) the monthly payment for mortgage-related obligations; (6) current debt obligations, alimony, and child support; (7) the monthly DTI ratio or residual income; and (8) credit history. Alternatively, the mortgage lender can originate "qualified mortgages," or QMs, which generally are mortgage loans without negative amortization, interest-only payments, balloon payments, or terms exceeding 30 years. QMs are entitled by rule to a presumption that the creditor making the loan satisfied the ATR requirements provided certain requirements are met. The Corporation is predominantly an originator of compliant QMs. The CFPB also has implemented the TILA-RESPA Integrated

Disclosure rules, which harmonize disclosure and certain regulatory compliance requirements required under those two statutes with respect to residential mortgage loans.

Additionally, the CFPB has the authority to take supervisory and enforcement action against banks and other financial services companies under the agency’s jurisdiction that fail to comply with federal consumer financial laws. As an IDI with total assets of more than $10 billion, the Bank is subject to the CFPB’s supervisory and enforcement authorities. The Dodd-Frank Act also permits states to adopt stricter consumer protection laws and state attorneys general to enforce consumer protection rules issued by the CFPB. As a result of these aspects of the Dodd-Frank Act, the Bank operates in a stringent consumer compliance environment. Therefore, the Bank is likely to incur additional costs related to consumer protection compliance, including but not limited to potential costs associated with CFPB examinations, regulatory and enforcement actions and consumer-oriented litigation, which is likely to increase as a result of the consumer protection provisions of the Dodd-Frank Act. The CFPB has been active in bringing enforcement actions against banks and other financial institutions to enforce consumer financial laws. The federal financial regulatory agencies, including the OCC and states attorneys general, also have become increasingly active in this area with respect to institutions over which they have jurisdiction. We have incurred and may in the future incur additional costs in complying with these requirements.

Pursuant to the Dodd-Frank Act, the FDIC has backup enforcement authority over a depository institution holding company, such as the Parent Company, if the conduct or threatened conduct of such holding company poses a risk to the DIF, although such authority may not be used if the holding company is generally in sound condition and does not pose a foreseeable and material risk to the DIF. The Dodd-Frank Act may have a material impact on the Corporation’s and the Bank’s operations, particularly through increased compliance costs resulting from possible future consumer and fair lending regulations. See Item 1A, Risk Factors — Legal, Regulatory, Compliance and Reputational Risks for additional discussion of this topic.

In recent years, the CFPB—with the support of the current Presidential Administration—has launched an initiative aimed at eliminating or restricting a number of fees assessed by financial institutions, including overdraft and non-sufficient funds fees as well as other transaction- and account management-related fees deemed by the CFPB to be “junk fees.” The CFPB has carried out its initiative through a mixture of supervision, examination and enforcement actions. See Item 1A, Risk Factors — Legal, Regulatory, Compliance and Reputational Risks for additional discussion of this topic.

In recent years the federal banking agencies have increased their focus on climate-related risks impacting the operations of banks, the communities they serve and the broader financial system. Accordingly, the agencies have begun to enhance their supervisory expectations regarding the climate risk management practices of larger banking organizations, including by encouraging such banks to: ensure that management of climate-related risk exposures has been incorporated into existing governance structures; evaluate the potential impact of climate-related risks on the bank’s financial condition, operations and business objectives as part of its strategic planning process; account for the effects of climate change in stress testing scenarios and systemic risk assessments; revise expectations for credit portfolio concentrations based on climate-related factors; consider investments in climate-related initiatives and lending to communities disproportionately impacted by the effects of climate change; evaluate the impact of climate change on the bank’s borrowers and consider possible changes to underwriting criteria to account for climate-related risks to mortgaged properties; incorporate climate-related financial risk into the bank’s internal reporting, monitoring and escalation processes; and prepare for the transition risks to the bank associated with the adjustment to a low-carbon economy and related changes in laws, regulations, governmental policies, technology, and consumer behavior and expectations.

On October 21, 2021, the Financial Stability Oversight Council published a report identifying climate-related financial risks as an “emerging threat” to financial stability. On October 24, 2023, the OCC, the FDIC and the Federal Reserve jointly finalized principles for climate-related financial risk management for national banks with more than $100 billion in total assets. Although these risk management principles do not apply to the Bank directly based upon our current size, the OCC has indicated that all banks, regardless of their size, may have material exposures to climate-related financial and other risks that require prudent management. As climate-related supervisory guidance is formalized, and relevant risk areas and corresponding control expectations are further refined, we may be required to expend significant capital and incur compliance, operating, maintenance and remediation costs in order to conform to such requirements.

In addition, states are considering taking similar actions on climate-related financial risks, including certain states in which we operate. For example, in January of 2023, the Minnesota Pollution Control Agency released its Greenhouse Gas Emissions Report for years 2005-2020. The Report indicated that Minnesota is on track to meet its GHG reduction goals, including reducing emissions 50% by 2030 and achieving net-zero emissions by 2050. The Report relies on the state’s September 2022 Climate Action Framework as the path forward to a carbon-neutral, resilient, and equitable future. That same month, Illinois Governor JB Pritzker signed legislation preventing counties from enacting preemptive local ordinances that outright ban local

wind and solar projects, as such ordinances hinder the state’s climate goals set forth in the Climate and Equitable Jobs Act of 2021. Then, in February 2023, Minnesota Governor Tim Walz signed a bill that will move the state to 100% clean energy by 2040. In October 2023, California Governor Gavin Newsom signed two climate-related disclosure bills into law. The Climate Corporate Data Accountability Act (referred to as SB 253) requires both public and private U.S. businesses with revenues greater than $1 billion doing business in California to report their GHG emissions, including scopes 1, 2, and 3, beginning in 2026 (for 2025 data) and also requires reporting companies to get third-party assurance of their reports. Other states have proposed similar legislation to SB 253. The Climate-Related Financial Risk Act (referred to as SB 261) mandates that U.S. businesses with annual revenues over $500 million doing business in California to bi-annually disclose climate-related financial risks and their mitigation strategies beginning January 1, 2026. Additionally, in November 2023, the Wisconsin legislature introduced 20 draft bills addressing, through a mix of funding and legal requirements, weatherization of public school buildings, green jobs training, climate change scholarships, environmental impacts on vulnerable communities, agricultural waste reduction, climate change consideration in local planning decisions, consideration of carbon when vetting utility projects, and increased funding for Focus on Energy, a state program that supports new energy efficiency and renewable energy projects. State-level initiatives such as these may require us to expend capital to conform to any requirements that apply to us.

Additionally, in March of 2022, the SEC proposed new climate-related disclosure rules, the Proposed Rules for The Enhancement and Standardization of the Climate-Related Disclosure for Investors File No. S7-10-22. If adopted as expected, the rules would require new climate-related disclosures in SEC filings and audited financial statements, including certain climate-related metrics and GHG emissions data, information about climate-related targets and goals, transition plans, if any, and attestation requirements.

The Corporation has established an Environmental Sustainability Risk Policy and Environmental Sustainability Statement focused on environmental risk management; climate change, carbon emissions and natural resources; and environmental and social lending which will serve as the foundation to Associated's Environmental Sustainability Risk Management System, a system for supporting the Environmental Sustainability Risk Policy and environmental sustainability risk reporting. The EMS is intended to help manage environmental and climate risk in a comprehensive, systematic, planned and documented manner, and to help all policy practices integrate into the Corporation's Enterprise Risk Management program and align them with business objectives. Oversight for climate-related risks includes Board-level, senior management and Board and management committee oversight.

The Corporation’s Board of Directors is responsible for overseeing the corporate ESG strategies and risks of Associated, including risks and opportunities related to environmental sustainability. In fulfilling its responsibilities, the Board has delegated responsibilities to the following Board-level committees:

The CGSRC has appointed senior management responsibility to the Environmental, Social and Governance Committee (ESGC), an executive level committee chaired by the Corporation’s General Counsel. Additional committee members include the President and Chief Executive Officer; Head of Consumer and Business Banking; Chief Human Resources Officer; Director of ESG and Sustainability; Director of Diversity, Equity and Inclusion; Director of Community Accountability; and Director of Enterprise Risk Management and Corporate Risk Strategy.

The federal banking agencies have issued interpretive guidance and statements regarding the engagement by banking organizations in certain digital asset activities. In November of 2021, the OCC published an interpretive letter clarifying that the digital asset activities of national banks that have been addressed by the OCC in prior interpretive precedent published in 2020 and 2021 are viewed by the agency as legally permissible provided that banks (i) are able to demonstrate to the OCC that their digital asset activities can be conducted in a safe and sound manner and (ii) notify the OCC’s supervisory staff of their intention to engage in such activities and receive the OCC’s non-objection prior to doing so. On August 16, 2022, the Federal Reserve released supervisory guidance encouraging all banking organizations supervised by the agency to notify its lead supervisory point of contact at the Federal Reserve prior to engaging in any digital asset-related activity. Prior to engaging in any such activities, banking organizations are expected to ensure their proposed activities are legally permissible under relevant state and federal laws, and ensure they have implemented adequate systems, risk management, and internal controls to ensure that the activities are conducted in a safe and sound manner consistent with applicable laws, including consumer protection laws.

On January 3, 2023, the federal banking agencies issued additional guidance in the form of a joint statement addressing digital asset-related risks to banking organizations. That statement noted the recent volatility and exposure of vulnerabilities in the digital asset sector and indicated that the agencies are continuing to assess whether or how the digital asset-related activities of banking organizations can be conducted in a safe and sound manner and in compliance with all applicable laws and regulations. The statement stressed that each agency has developed, and expects banking organizations to follow, supervisory processes for evaluating proposed and existing digital asset activities.

On February 23, 2023, the federal banking agencies issued a joint statement addressing liquidity risks to banking organizations resulting from crypto-asset market vulnerabilities. The joint statement noted that deposits placed by a crypto-asset-related entity and deposits that constitute stablecoin-related reserves may pose heightened liquidity risks to banking organizations due to the unpredictability of the scale and timing of deposit inflows and outflows. The statement stressed that banking organizations should establish and maintain effective risk management and controls commensurate with the level of liquidity risks from such funding sources. Further, on August 8, 2023, the Federal Reserve announced the establishment of a Novel Activities Supervision Program, which is designed in part to enhance the Federal Reserve’s supervision processes in respect of banking organizations’ crypto-asset related activities and use of distributed ledger technologies and other novel technologies in the delivery of financial products and services.

Although the federal banking agencies have not developed formal regulations governing the digital asset activities of banking organizations, the supervisory framework summarized above dictates that, in order to effectively identify and manage digital asset-related risks and obtain supervisory non-objection to the proposed engagement in digital asset activities, banking organizations must implement appropriate risk management practices, including with respect to board and management oversight, policies and procedures, risk assessments, internal controls and monitoring.

The Bank is also subject to a variety of other regulations with respect to the operation of its businesses, including but not limited to the Dodd-Frank Act, which among other restrictions placed limitations on the interchange fees charged for debit card transactions, TILA, Truth in Savings Act, Equal Credit Opportunity Act, Electronic Funds Transfer Act, Fair Housing Act, Home Mortgage Disclosure Act, Fair Debt Collection Practices Act, Fair Credit Reporting Act, Expedited Funds Availability (Regulation CC), Reserve Requirements (Regulation D), Insider Transactions (Regulation O), Privacy of Consumer Information (Regulation P), Margin Stock Loans (Regulation U), Right To Financial Privacy Act, Flood Disaster Protection Act, Homeowners Protection Act, Servicemembers Civil Relief Act, RESPA, TCPA, CAN-SPAM Act, Children’s Online Privacy Protection Act, and the John Warner NDAA. Further, in January of 2021, the OCC issued a notice of proposed rulemaking to amend current rules related to national banks' ownership of real property. The proposal would provide a set of general standards, including an occupancy test and excess capacity standards, that the OCC will use to determine whether the acquisition and holding of real estate is necessary for the transaction of an institution's business. The prospects and timing for the adoption of a final rule are uncertain at this time.

Our earnings and growth, as well as the earnings and growth of the banking industry, are affected by the credit policies of monetary authorities, including the Federal Reserve. An important function of the Federal Reserve is to regulate the national supply of bank credit in order to combat recession and curb inflationary pressures. Among the instruments of monetary policy used by the Federal Reserve to implement these objectives are open market operations in U.S. government securities, changes in reserve requirements against member bank deposits, and changes in the Federal Reserve discount rate. These instruments are used in varying combinations to influence overall growth of bank loans, investments, and deposits, and may also affect interest rates charged on loans or paid for deposits. The monetary policies of the Federal Reserve authorities have had a significant effect on the operating results of commercial banks in the past and are expected to continue to have such an effect in the future.

In view of changing conditions in the national economy and in money markets, as well as the effect of credit policies by monetary and fiscal authorities, including the Federal Reserve, it is difficult to predict the impact of possible future changes in interest rates, deposit levels, and loan demand, or their effect on our business and earnings or on the financial condition of our various customers.

In addition to regulation, supervision and examination by federal banking agencies, the Corporation and certain of its subsidiaries, including those that engage in securities brokerage, dealing and investment advisory activities, are subject to other federal and applicable state securities laws and regulations, and to supervision and examination by other regulatory authorities, including the SEC, FINRA, NYSE, DOL and others.

Separately, in June of 2019, pursuant to the Dodd-Frank Act, the SEC adopted Regulation Best Interest, which, among other things, establishes a new standard of conduct for a broker-dealer to act in the best interest of a retail customer when making a recommendation of any securities transaction or investment strategy involving securities to such customer. The new rule requires us to review and possibly modify our compliance activities, which is causing us to incur some additional costs. In addition, state laws that impose a fiduciary duty also may require monitoring, as well as require that we undertake additional compliance measures.

Our success depends, to a certain extent, upon global, domestic and local economic and political conditions, as well as governmental monetary policies. Conditions such as changes in interest rates, money supply, levels of employment and other factors beyond our control may have a negative impact on economic activity. Any contraction of economic activity, including an economic recession, may adversely affect our asset quality, deposit levels and loan demand and, therefore, our earnings. In particular, interest rates are highly sensitive to many factors that are beyond our control, including global, domestic and local economic conditions and the policies of various governmental and regulatory agencies and, specifically, the Federal Reserve. Throughout 2022 and 2023, the FOMC raised the target range for the federal funds rate on eleven separate occasions, citing factors including the hardships caused by the ongoing Russia-Ukraine conflict, continued global supply chain disruptions and imbalances, and increased inflationary pressure.

The tightening of the Federal Reserve’s monetary policies, including repeated and aggressive increases in target range for the federal funds rate as well as the conclusion of the Federal Reserve’s tapering of asset purchases, together with ongoing economic and geopolitical instability, increases the risk of an economic recession. Although forecasts have varied, many economists are projecting that, while indicators of U.S. economic performance, such as income growth, may be strong and levels of inflation may continue to decrease, the U.S. economy may be flat or experience a modest decrease in gross domestic output in 2024 while inflation is expected to remain elevated relative to historic levels in the coming quarters. Any such downturn in economic output, especially domestically and in the regions in which we operate, may adversely affect our asset quality, deposit levels, loan demand and results of operations.

As a result of the economic and geopolitical factors discussed above, financial institutions also face heightened credit risk, among other forms of risk. Of note, because we have a significant amount of real estate loans, decreases in real estate values could adversely affect the value of property used as collateral, which, in turn, can adversely affect the value of our loan and investment portfolios. Adverse economic developments, specifically including inflation-related impacts, may have a negative effect on the ability of our borrowers to make timely repayments of their loans or to finance future home purchases. According to the Federal Reserve's October 2023 Financial Stability Report, CRE values remained elevated relative to fundamentals, even as prices continued to decline. While CRE values continue to fluctuate, some markets are showing signs of stabilizing prices. However, the outlook for CRE remains dependent on the broader economic environment and, specifically, how major subsectors respond to a rising interest rate environment and higher prices for commodities, goods and services. In any case, credit performance over the medium- and long-term is susceptible to economic and market forces and therefore forecasts remain uncertain; however, some degree of instability in the CRE markets is expected in the coming quarters as loans are refinanced in markets with higher vacancy rates under current economic conditions. Instability and uncertainty in the commercial and residential real estate markets, as well as in the broader commercial and retail credit markets, could have a material adverse effect on our financial condition and results of operations.

All borrowers have the potential to default, and our remedies in the event of such default (such as seizure and/or sale of collateral, legal actions, and guarantees) may not fully satisfy the debt owed to us. We maintain an allowance for credit losses, which is a reserve established through a provision for credit losses charged to expense, that represents management’s best estimate of probable credit losses over the life of the loan within the existing portfolio of loans. The allowance for credit losses, in the judgment of management, is necessary to reserve for estimated credit losses and risks inherent in the loan portfolio. The level of the allowance for credit losses reflects management’s continuing evaluation of industry concentrations; specific credit risks; loan loss experience; current loan portfolio quality; present economic, political, and regulatory conditions; and unidentified losses inherent in the current loan portfolio. The determination of the appropriate level of the allowance for credit losses inherently involves a high degree of subjectivity and requires us to make significant estimates of current credit risks using existing qualitative and quantitative information, all of which may undergo material changes. Changes in economic conditions affecting borrowers, new information regarding existing loans, identification of additional problem loans, and other factors, both within and outside of our control, may require an increase in the allowance for credit losses. In addition, bank regulatory agencies periodically review our allowance for credit losses and may require an increase in the provision for credit losses or the recognition of additional loan charge offs, based on judgments different than those of management. An increase in the allowance for credit losses would result in a decrease in net income, and possibly risk-based capital, and could have a material adverse effect on our financial condition and results of operations.

As of December 31, 2023, approximately 62% of our loan portfolio consisted of commercial and industrial, real estate construction, and CRE loans (collectively, "commercial loans"). Commercial loans are generally viewed as having more inherent risk of default than residential mortgage loans or other consumer loans. Further, the commercial loan balance per borrower is typically larger than that for residential mortgage loans and other consumer loans, implying higher potential losses on an individual loan basis. Because our loan portfolio contains a number of commercial loans with balances over $25 million, the deterioration of one or a few of these loans could cause a significant increase in nonaccrual loans, which could have a material adverse effect on our financial condition and results of operations.

Our policy generally has been to originate CRE loans primarily in the states in which the Bank operates. At December 31, 2023, CRE loans, including owner occupied, investor, and real estate construction loans, totaled $8.5 billion, or 29%, of our total loan portfolio. As a result of our growth in this portfolio over the past several years and planned future growth, these loans require more ongoing evaluation and monitoring and we are implementing enhanced risk management policies, procedures and controls. CRE loans generally involve a greater degree of credit risk than residential mortgage loans because they typically have larger balances and are more affected by adverse conditions in the economy. Because payments on loans secured by CRE often depend upon the successful operation and management of the properties and the businesses which operate from within them, repayment of such loans may be affected by factors outside the borrower’s control, such as adverse conditions in the real estate market or the economy or changes in government regulation. In recent years, CRE markets have been experiencing substantial growth, and increased competitive pressures have contributed significantly to historically low capitalization rates and rising property values. However, CRE markets have been facing downward pressure since 2022 due in large part to increasing interest rates and declining property values. Accordingly, the federal banking agencies have expressed concerns about weaknesses in the current CRE market and have applied increased regulatory scrutiny to institutions with CRE loan portfolios that are fast growing or large relative to the institutions' total capital. To address supervisory expectations with respect to financial institutions' handling of CRE borrowers who are experiencing financial difficulty, in June of 2023, the federal banking agencies, including the OCC, issued an interagency policy statement addressing prudent CRE loan accommodations and workouts. Our failure to adequately implement enhanced risk management policies, procedures and controls could adversely affect our ability to increase this portfolio going forward and could result in an increased rate of delinquencies in, and increased losses from, this portfolio. At December 31, 2023, nonaccrual CRE loans totaled $1 million, or less than 1% of our total portfolio of CRE loans.

In deciding whether to extend credit or enter into other transactions, we may rely on information furnished by or on behalf of customers and counterparties, including financial statements, credit reports, and other financial information. We may also rely on representations of those customers, counterparties, or other third parties, such as independent auditors, as to the accuracy and completeness of that information. Reliance on inaccurate or misleading financial statements, credit reports, or other financial

information could cause us to enter into unfavorable transactions, which could have a material adverse effect on our financial condition and results of operations.

We settle funds on behalf of financial institutions, other businesses and consumers and receive funds from clients, card issuers, payment networks and consumers on a daily basis for a variety of transaction types. Transactions we facilitate include wire transfers, debit card, credit card and electronic bill payment transactions, supporting consumers, financial institutions and other businesses. These payment activities rely upon the technology infrastructure that facilitates the verification of activity with counterparties and the facilitation of the payment. If the continuity of operations or integrity of processing were compromised, this could result in a financial loss to us due to a failure in payment facilitation. In addition, we may issue credit to consumers, financial institutions or other businesses as part of the funds settlement. A default on this credit by a counterparty could result in a financial loss to us.

A significant portion of our loan portfolio is secured by real property. During the ordinary course of business, we may foreclose on and take title to properties securing certain loans. In doing so, there is a risk that hazardous or toxic substances could be found on these properties. If hazardous or toxic substances are found, we may be liable for remediation costs, as well as for personal injury and property damage. Environmental laws may require us to incur substantial expenses which may materially reduce the affected property’s value or limit our ability to use or sell the affected property. In addition, future laws or more stringent interpretations or enforcement policies with respect to existing laws may increase our exposure to environmental liability. Although we have policies and procedures to perform an environmental review before lending against or initiating any foreclosure action on real property, these reviews may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on our financial condition and results of operations.

The Corporation requires liquidity to meet its deposit and debt obligations as they come due. Access to liquidity could be impaired by an inability to access the capital markets or unforeseen outflows of deposits. Risk factors that could impair our ability to access capital markets include a downturn in our Midwest markets, difficult credit markets, credit rating downgrades, or regulatory actions against the Corporation. The Corporation’s access to deposits can be impacted by the liquidity needs of our customers as a substantial portion of the Corporation’s liabilities are demand while a substantial portion of the Corporation’s assets are loans that cannot be sold in the same timeframe. Historically, the Corporation has been able to meet its cash flow needs as necessary. If a sufficiently large number of depositors sought to withdraw their deposits for whatever reason, the Corporation may be unable to obtain the necessary funding at favorable terms.

In its assessment of the failures of SVB and SBNY in the first quarter of 2023, the FDIC concluded that a significant contributing factor to the failures of the institutions was the proportion of the deposits held by each institution that exceeded FDIC insurance limits. Noting that uninsured deposits accounted for nearly 47 percent of domestic deposits in 2021, the FDIC stated that large concentrations of uninsured deposits increase the potential for bank runs and can threaten financial stability. The FDIC similarly concluded that an overreliance on uninsured deposits contributed to the subsequent failure of First Republic Bank in the second quarter of 2023. In response to the failures of SVB, SBNY, and First Republic Bank, many large depositors across the industry have withdrawn deposits in excess of applicable deposit insurance limits and deposited these funds in other financial institutions and, in many instances, moved these funds into money market mutual funds or other similar securities accounts in an effort to diversify the risk of further bank failure(s).

Uninsured deposits historically have been viewed by the FDIC as less stable than insured deposits. According to statements made by the FDIC staff and the leadership of the federal banking agencies, customers with larger uninsured deposit account balances often are small- and mid-sized businesses that rely upon deposit funds for payment of operational expenses and, as a result, are more likely to closely monitor the financial condition and performance of their depository institutions. As a result, in the event of financial distress, uninsured depositors historically have been more likely to withdraw their deposits. To that end, the federal banking agencies, including the FDIC and OCC, issued an interagency policy statement in July 2023 to underscore the importance of robust liquidity risk management and contingency funding planning. In the policy statement, the regulators noted that banks should maintain actionable contingency funding plans that take into account a range of possible stress

scenarios, assess the stability of their funding and maintain a broad range of funding sources, ensure that collateral is available for borrowing, and review and revise contingency funding plans periodically and more frequently as market conditions and strategic initiatives change.

If a significant portion of our deposits were to be withdrawn within a short period of time such that additional sources of funding would be required to meet withdrawal demands, the Corporation may be unable to obtain funding at favorable terms, which may have an adverse effect on our net interest margin. Moreover, obtaining adequate funding to meet our deposit obligations may be more challenging during periods of elevated prevailing interest rates, such as the present period. Our ability to attract depositors during a time of actual or perceived distress or instability in the marketplace may be limited. Further, interest rates paid for borrowings generally exceed the interest rates paid on deposits. This spread may be exacerbated by higher prevailing interest rates. In addition, because our AFS investment securities lose value when interest rates rise, after-tax proceeds resulting from the sale of such assets may be diminished during periods when interest rates are elevated. Under such circumstances, we may be required to access funding from sources such as the Federal Reserve’s discount window or its recently established BTFP in order to manage our liquidity risk. For additional information regarding uninsured deposits and liquidity, see sections Deposits and Customer Funding and Liquidity of Part II, Item 7, Management's Discussion and Analysis of Financial Condition and Results of Operations.

Credit ratings are subject to ongoing review by rating agencies, which consider a number of factors, including our financial strength, performance, prospects and operations as well as factors not under our control. Other factors that influence our credit ratings include changes to the rating agencies’ methodologies for our industry or certain security types; the rating agencies’ assessment of the general operating environment for financial services companies; our relative positions in the markets in which we compete; our various risk exposures and risk management policies and activities; pending litigation and other contingencies; our reputation; our liquidity position, diversity of funding sources and funding costs; the current and expected level and volatility of our earnings; our capital position and capital management practices; our corporate governance; current or future regulatory and legislative initiatives; and the agencies’ views on whether the U.S. government would provide meaningful support to the Corporation or its subsidiaries in a crisis. Rating agencies could make adjustments to our credit ratings at any time, and there can be no assurance that they will maintain our ratings at current levels or that downgrades will not occur.

In August 2023, Moody’s and S&P Global Ratings each downgraded our long-term issuer credit ratings. Any additional downgrade in our credit ratings could potentially adversely affect the cost and other terms upon which we are able to borrow or obtain funding, increase our cost of capital and/or limit our access to capital markets. Credit rating downgrades or negative watch warnings could also negatively impact our reputation and the perception of the Corporation by lenders, investors and other third parties, which could also impair our ability to compete in certain markets or engage in certain transactions. In particular, holders of deposits which exceed FDIC insurance limits may perceive such a downgrade or warning negatively and withdraw all or a portion of such deposits. While certain aspects of a credit rating downgrade are quantifiable, the impact that such a downgrade would have on our liquidity, business and results of operations in future periods is inherently uncertain and would depend on a number of interrelated factors, including, among other things, the magnitude of the downgrade, the rating relative to peers, the rating assigned by the relevant agency pre-downgrade, individual client behavior and future mitigating actions we might take.

Our earnings and cash flows are largely dependent upon our net interest income. Interest rates are highly sensitive to many factors that are beyond our control, including general economic conditions and policies of various governmental and regulatory agencies and, in particular, the Federal Reserve. Changes in monetary policy, including changes in interest rates, could influence not only the interest we receive on loans and investments and the amount of interest we pay on deposits and borrowings, but such changes could also affect (i) our ability to originate loans and obtain deposits; (ii) the fair value of our financial assets and liabilities; and (iii) the average duration of our mortgage portfolio and other interest-earning assets. In January 2022, due to elevated levels of inflation and corresponding pressure to raise interest rates, the Federal Reserve announced after several periods of historically low federal funds rates and yields on Treasury notes that it would be slowing the pace of its bond purchasing and increasing the target range for the federal funds rate over time. The FOMC since has increased the target range eleven times throughout 2022 and 2023. As of December 31, 2023, the target range for the federal funds rate had been increased to 5.25% to 5.50%. It remains uncertain whether the FOMC will further increase the target range for the federal funds rate to attain a monetary policy sufficiently restrictive to return inflation to more normalized levels, begin to reduce the federal funds rate or leave the rate at its current elevated level for a lengthy period of time. Our interest rate spread, net interest margin and net interest income increased during this period of rising interest rates as our interest earning assets generally reprice more quickly than our interest earning liabilities.

If the interest rates paid on deposits and other borrowings increase at a faster rate than the interest rates received on loans and other investments, our net interest income, and therefore earnings, could be adversely affected. Earnings could also be adversely affected if the interest rates received on loans and other investments fall more quickly than the interest rates paid on deposits and other borrowings. The Corporation's interest rate risk profile is such that, generally, a higher yield curve adds to income while a lower yield curve has a negative impact on earnings. Our most significant interest rate risk may result from timing differences in the maturity and re-pricing characteristics of assets and liabilities, changes in the shape of the yield curve, and the potential exercise of explicit or embedded options.

Although management believes it has implemented effective asset and liability management strategies, including the potential use of derivatives as hedging instruments, to reduce the potential effects of changes in interest rates on our results of operations, any substantial, unexpected, prolonged change in market interest rates could have a material adverse effect on our financial condition and results of operations, and any related economic downturn, especially domestically and in the regions in which we operate, may adversely affect our asset quality, deposit levels, loan demand and results of operations. Also, our interest rate risk modeling techniques and assumptions likely may not fully predict or capture the impact of actual interest rate changes on our balance sheet.

Changes in interest rates can impact our mortgage-related revenues and net revenues associated with our mortgage activities. A decline in mortgage rates generally increases the demand for mortgage loans as borrowers refinance, but also generally leads to accelerated payoffs. Conversely, in a constant or increasing rate environment, we would expect fewer loans to be refinanced and a decline in payoffs. Although we use models to assess the impact of interest rates on mortgage-related revenues, the estimates of revenues produced by these models are dependent on estimates and assumptions of future loan demand, prepayment speeds and other factors which may differ from actual subsequent experience.

The Corporation maintains an investment portfolio consisting of various high quality liquid fixed-income securities. The total carrying value of the securities portfolio, which includes FHLB and Federal Reserve Bank stocks, was $7.7 billion as of December 31, 2023, and the estimated duration of the aggregate portfolio was approximately 5.7 years. The nature of fixed-income securities is such that changes in market interest rates impact the value of these assets.

The Corporation earns revenue from the fees it receives for originating mortgage loans and for servicing mortgage loans. When rates rise, the demand for mortgage loans tends to fall, reducing the revenue the Corporation receives from loan originations. At the same time, revenue from MSRs can increase through increases in fair value. When rates fall, mortgage originations tend to increase and the value of MSRs tends to decline, also with some offsetting revenue effect. Even though the origination of mortgage loans can act as a “natural hedge,” the hedge is not perfect, either in amount or timing. For example, the negative effect on revenue from a decrease in the fair value of residential MSRs is immediate, but any offsetting revenue benefit from more originations and the MSRs relating to the new loans would accrue over time. It is also possible that even if interest rates were to fall, mortgage originations may also fall or any increase in mortgage originations may not be enough to offset the decrease in the MSRs value caused by the lower rates.

The Corporation typically uses derivatives and other instruments to hedge its mortgage banking interest rate risk. The Corporation generally does not hedge all of its risks and the fact that hedges are used does not mean they will be successful. Hedging is a complex process, requiring sophisticated models and constant monitoring. The Corporation could incur significant losses from its hedging activities. There may be periods where the Corporation elects not to use derivatives and other instruments to hedge mortgage banking interest rate risk.

The Parent Company is a separate and distinct legal entity from its banking and other subsidiaries. A substantial portion of the Parent Company’s cash flow comes from dividends from its subsidiaries. These dividends are the principal source of funds to pay dividends on the Parent Company’s common and preferred stock, and to pay interest and principal on the Parent Company’s debt. Various federal and/or applicable state laws and regulations limit the amount of dividends that the Bank and certain of our nonbanking subsidiaries may pay to us. Also, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors. In the event the Bank subsidiary is unable to pay dividends to us, we may not be able to service debt, pay obligations, or pay dividends on our common and preferred stock. The inability to receive dividends from the Bank could have a material adverse effect on our business, financial condition, and results of operations.

We operate in many different businesses in diverse markets and rely on the ability of our employees and systems to process transactions. Operational risk is the risk of loss resulting from our operations, including but not limited to, the risk of fraud by employees or persons outside the Corporation, the execution of unauthorized transactions, errors relating to transaction processing and technology, breaches of our internal control systems or failures of those of our suppliers or counterparties, compliance failures, cyber-attacks, technology failures, or unforeseen problems encountered while implementing new computer systems or upgrades to existing systems, business continuation and disaster recovery issues, and other external events. Insurance coverage may not be available for such losses, or where available, such losses may exceed insurance limits. This risk of loss also includes the potential legal actions that could arise as a result of an operational deficiency or as a result of noncompliance with applicable regulatory standards, adverse business decisions or their implementation, and customer attrition due to potential negative publicity. The occurrence of any of these events could cause us to suffer financial loss, face regulatory action and suffer damage to our reputation.

In the normal course of our business, we collect, process, and retain sensitive and confidential client and customer information on our behalf and on behalf of other third parties. Despite the security measures we have in place, our facilities and systems may be vulnerable to cyber-attacks, security breaches, acts of vandalism, computer viruses, malware, misplaced or lost data, programming and/or human errors, or other similar events.

We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business. Operational risk related to cyber-attacks is increasing as cyber-attacks evolve and have a greater and more pervasive economic impact. In addition to cyber-attacks or other security breaches involving the theft of sensitive and confidential information, hackers have engaged in attacks against large financial institutions, designed to disrupt key business services, such as customer-facing web sites. Critical infrastructure sectors, including financial services, increasingly have been the targets of cyber-attacks, including attacks emanating from foreign countries. Cyber-attacks involving large financial institutions, including distributed denial of service attacks designed to disrupt external customer-facing services, nation state cyberattacks and ransomware attacks designed to deny organizations access to key internal resources or systems or other critical data, as well as targeted social engineering and phishing email and text message attacks designed to allow unauthorized persons to obtain access to an institution’s information systems and data or that of its customers, are becoming more common and increasingly sophisticated. In particular, there has been an observed increase in the number of distributed denial of service attacks against the financial sector, for which the increase is believed to be partially attributable to politically motivated attacks as well as financial demands coupled with extortion. Further, threat actors are increasingly seeking to target vulnerabilities in software systems (including bugs, vulnerabilities in third-party systems or software and technical misconfigurations in hardware and software) and weak authentication controls used by large numbers of banking organizations in order to conduct malicious cyber activities. These types of attacks have resulted in increased supply chain and third-party risk. In addition, on March 21, 2022, the current Presidential Administration issued a warning regarding the potential for Russia to engage in malicious cyber activities, specifically including attacks on critical infrastructure such as the financial sector, in

response to the international economic sanctions that have been imposed against the Russian government and organizations and individuals within Russia relating to its invasion of and ongoing conflict with Ukraine.

Because the methods of cyber-attacks change frequently or, in some cases, are not recognized until launch, we are not able to anticipate or implement effective preventive measures against all possible security breaches and the probability of a successful attack cannot be predicted. Although we employ detection and response mechanisms designed to contain and mitigate security incidents, early detection may be thwarted by persistent sophisticated attacks and malware designed to avoid detection.

We also face risks related to cyber-attacks and other security breaches in connection with card transactions that typically involve the transmission of sensitive information regarding our customers through various third parties. Some of these parties have in the past been the target of security breaches and cyber-attacks, and because the transactions involve third parties and environments that we do not control or secure, future security breaches or cyber-attacks affecting any of these third parties could impact us, and in some cases we may have exposure and suffer losses for breaches or attacks relating to them. We also rely on numerous other third-party service providers to conduct other aspects of our business operations and face similar risks relating to them. We cannot be sure that such third-party information security protocols are sufficient to withstand a cyber-attack or other security breach.

Cybersecurity risks for financial institutions also have evolved as a result of the increased interconnectedness of operating environments and the use of new technologies, devices and delivery channels to transmit data and conduct financial transactions. The adoption of new products, services and delivery channels contribute to a more complex operating environment, which enhances operational risk and presents the potential for additional structural vulnerabilities. As such, a single cyber-attack is now able to compromise hundreds of organizations and affect a significant number of consumers. In addition, the adoption of hybrid and remote work environments following the COVID-19 pandemic presents institutions with additional cybersecurity vulnerabilities and risks.

The Corporation regularly evaluates its systems and controls and implements upgrades as necessary. The additional cost to the Corporation of our cyber security monitoring and protection systems and controls includes the cost of hardware and software, third party technology providers, consulting and forensic testing firms, insurance premium costs and legal fees, in addition to the incremental cost of our personnel who focus a substantial portion of their responsibilities on cyber security.

Any successful cyber-attack or other security breach involving the misappropriation, loss, leak or other unauthorized disclosure of sensitive or confidential customer information, confidential and proprietary information relating to our bank and operations, unauthorized access to our information systems or that of our third-party service providers, or unauthorized access to other data that compromises our ability to function could severely damage our reputation, erode confidence in the security of our systems, products and services, expose us to the risk of litigation and liability, disrupt our operations and have a material adverse effect on our business. Any successful cyber-attack may also subject the Corporation to regulatory investigations, litigation (including class action litigation) or enforcement, or require the payment of regulatory fines or penalties or undertaking costly remediation efforts with respect to third parties affected by a cyber security incident, all or any of which could adversely affect the Corporation’s business, financial condition or results of operations and damage its reputation. Finally, we cannot guarantee that any costs and liabilities incurred in relation to an attack or incident will be covered by our existing insurance policies or that applicable insurance will be available to us in the future on economically reasonable terms or at all.

The Corporation may be subject to the data risks and cyber security vulnerabilities of the acquired company until the Corporation has sufficient time to fully integrate the acquiree’s customers and operations. Although the Corporation conducts comprehensive due diligence of cyber-security policies, procedures and controls of our acquisition counterparties, and the Corporation maintains adequate policies, procedures, controls and information security protocols to facilitate a successful integration, there can be no assurance that such measures, controls and protocols are sufficient to withstand a cyber-attack or other security breach with respect to the companies we acquire, particularly during the period of time between closing and final integration.

We have experienced cybersecurity attacks in the past. Any failure, interruption, or breach in security or operational integrity of our or our third-party vendors' communications and information systems, including those caused by a cybersecurity attack, could result in failures or disruptions in our customer relationship management, general ledger, deposit, loan, and other systems. While we have policies and procedures designed to prevent or limit the effect of the failure, interruption, or security breach of our communications and information systems, we cannot completely ensure that any such failures, interruptions, or security breaches will not occur or, if they do occur, that they will be adequately addressed. The occurrence of any failures, interruptions, or security breaches of our or our third-party vendors' communications and information systems, including those caused by a cybersecurity attack, could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our financial condition and results of operations.

We are subject to the PCI-DSS, issued by the Payment Card Industry Security Standards Council. PCI-DSS contains compliance guidelines with regard to our security surrounding the physical and electronic storage, processing and transmission of cardholder data. Compliance with PCI-DSS and implementing related procedures, technology and information security measures requires significant resources and ongoing attention. Costs and potential problems and interruptions associated with the implementation of new or upgraded systems and technology, such as those necessary to achieve compliance with PCI-DSS or with maintenance or adequate support of existing systems could also disrupt or reduce the efficiency of our operations. Any material interruptions or failures in our payment-related systems or third parties that we rely upon could have a material adverse effect on our business, results of operations and financial condition. If there are amendments to PCI-DSS, the cost of compliance could increase, and we may suffer loss of critical data and interruptions or delays in our operations as a result. If we or our service providers are unable to comply with the standards imposed by PCI-DSS, we may be subject to fines and restrictions on our ability to offer certain services, which could materially and adversely affect our business.

We are subject to a number of U.S. federal, state, local and foreign laws and regulations relating to consumer privacy and data protection. Under privacy protection provisions of the GLBA and its implementing regulations and guidance, we are limited in our ability to disclose certain non-public information about consumers to nonaffiliated third parties. The GLBA regulates, among other things, the use of certain information about individuals (“non-public personal information”) in the context of the provision of financial services, including by banks and other financial institutions. The GLBA includes both a “Privacy Rule,” which imposes obligations on financial institutions relating to the use or disclosure of non-public personal information, and a “Safeguards Rule,” which imposes obligations on financial institutions and, indirectly, their service providers to implement and maintain physical, administrative and technological measures to protect the security of non-public personal financial information. Any failure to comply with the GLBA could result in substantial financial penalties and significant reputational harm.

While GLBA-regulated nonpublic, personal information generally is exempt under the CCPA, the CCPA applies to the personal information of representatives of any business contacts that the Bank engages with who are California residents, California employees, and California consumers whose personal information we may collect outside the scope of the GLBA (e.g., certain personal information collected from visitors to our websites). The CCPA went into effect in 2020 and imposes obligations on businesses that process personal information of California residents. Among other things, the CCPA: requires disclosures to such residents about the data collection, use and disclosure practices of covered businesses; provides such individuals expanded rights to access, delete, and correct their personal information, and opt-out of certain sales or transfers of personal information; and provides such individuals with a private right of action and statutory damages for certain data breaches. The CCPA and CPRA mark the beginning of a trend toward more stringent privacy legislation in the United States, and multiple states have enacted, or are expected to enact, similar laws, including the Oregon Consumer Privacy Law which takes effect on July 1, 2024, not all of which exempt financial institutions categorically. Many other states are currently reviewing or proposing the need for greater regulation of the collection, sharing, use and other processing of information related to individuals for marketing purposes or otherwise, and there remains increased interest at the federal level as well. Further, in order to comply with the

varying state laws around data breaches, we must maintain adequate security measures, which require significant investments in resources and ongoing attention.

Additionally, laws, regulations, and standards covering marketing, advertising, and other activities conducted by telephone, email, mobile devices, and the internet are or may become applicable to our business, such as the TCPA, the CAN-SPAM Act, and similar state consumer protection and communication privacy laws, such as California’s Invasion of Privacy Act.

We occasionally make telephone calls and/or send SMS text messages to customers. The actual or perceived improper calling of customer phones and/or sending of text messages may subject us to potential risks, including liabilities or claims relating to consumer protection laws such as the TCPA. Numerous class-action suits under federal and state laws have been filed in recent years against companies who conduct telemarketing and/or SMS texting programs, with many resulting in multi-million-dollar settlements to the plaintiffs. Any future such litigation against us could be costly and time-consuming to defend. In particular, the TCPA imposes significant restrictions on the ability to make telephone calls or send text messages to mobile telephone numbers without the prior consent of the person being contacted. Federal or state regulatory authorities or private litigants may claim that the notices and disclosures we provide, form of consents we obtain or our outreach practices are not adequate or violate applicable law. This may in the future result in civil claims against us. Claims that we have violated the TCPA could be costly to litigate, whether or not they have merit, and could expose us to substantial statutory damages or costly settlements.

We also send marketing messages via email and are subject to the CAN-SPAM Act. The CAN-SPAM Act imposes certain obligations regarding the content of emails and providing opt-outs (with the corresponding requirement to honor such opt-outs promptly). While we strive to ensure that all of our marketing communications comply with the requirements set forth in the CAN-SPAM Act, any violations could result in the FTC seeking civil penalties against us.

Moreover, we are considered a “user” of consumer reports provided by consumer reporting agencies under the Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactions Act (collectively, “FCRA”). FCRA regulates and protects consumer information collected by consumer reporting agencies and imposes specific obligations on “users” of consumer reports. Such obligations may include restricting the sharing of information contained in a consumer report, notifying consumers when such reports are used to make an adverse decision, and, in the context of completing employee background checks, providing a notice containing certain disclosures to the consumer and obtaining their consent.

Our business increasingly relies on AI, machine learning and automated decision making to improve our services and our customer’s experience. The regulatory framework around the development and use of these emerging technologies is rapidly evolving, and many federal, state and foreign government bodies and agencies have introduced and/or are currently considering additional laws and regulations. As a result, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on our business.

Any of the foregoing, together with developing guidance and/or decisions in this area, may affect our use of AI and our ability to provide and improve our services, require additional compliance measures and changes to our operations and processes, and result in increased compliance costs and potential increases in civil claims against us. Any actual or perceived failure to comply with evolving regulatory frameworks around the development and use of AI, machine learning and automated decision making could adversely affect our business, results of operations, and financial condition.

We outsource certain information system and data management and processing functions to third-party providers, including, among others, Fiserv, Inc. and its affiliates to compete in a rapidly evolving financial marketplace. These third-party service providers are sources of operational and informational security risk to us, including risks associated with operational errors, information system interruptions or breaches, and unauthorized disclosures of sensitive or confidential client or customer information. Concentration among larger third-party providers servicing large segments of the banking industry can also potentially affect wide segments of the financial industry. If third-party service providers encounter any of these issues, or if we have difficulty communicating with them, we could be exposed to disruption of operations, loss of service or connectivity to customers, reputational damage, and litigation risk that could have a material adverse effect on our results of operations or our business.

Third-party vendors provide key components of our business infrastructure, such as internet connections, network access and core application processing. While we have selected these third-party vendors in accordance with supervisory requirements, we

do not control their actions. The actions of these third parties, including as a result of their not providing us their services for any reason or their performing their services poorly, could adversely affect our ability to deliver products and services to our customers and otherwise to conduct our business. Replacing these third-party vendors could also entail significant delay and expense.

Integral to our performance is the continued efficacy of our technical systems, operational infrastructure, relationships with third parties and the vast array of associates and key executives in our day-to-day and ongoing operations. Failure by any or all of these resources subjects us to risks that may vary in size, scale and scope. This includes, but is not limited to, operational or technical failures, ineffectiveness or exposure due to interruption in third party support, problems arising from systems conversions, as well as the loss of key individuals or failure on the part of key individuals to perform properly. Although management has established policies and procedures to address such failures, the occurrence of any such event could have a material adverse effect on our business, which, in turn, could have a material adverse effect on our financial condition and results of operations.

We are subject to changes in tax law that could increase our effective tax rates. These law changes may be retroactive to previous periods and as a result could negatively affect our current and future financial performance. For example, legislation enacted in 2017 resulted in a reduction in our federal corporate tax rate from 35% in 2017 to 21% in 2018, which had a favorable impact on our earnings and capital generation abilities. However, this legislation also enacted limitations on certain deductions, such as the deduction of FDIC deposit insurance premiums, which partially offset the anticipated increase in net earnings from the lower tax rate. Any increase in the corporate tax rate or surcharges that may be adopted by Congress would adversely affect our results of operations in future periods.

In addition, the Bank’s customers experienced and likely will continue to experience varying effects from both the individual and business tax provisions of the Tax Act and other future changes in tax law and such effects, whether positive or negative, may have a corresponding impact on our business and the economy as a whole.

Further, on August 16, 2022, the Inflation Reduction Act of 2022 was enacted into law. The legislation imposed a non-deductible 1% excise tax on repurchases of stock by “covered corporations,” including the Corporation. As a result, our results of operations in future periods may be impacted adversely to the extent of any significant stock repurchases by the Corporation.

In assessing whether the impairment of investment securities is related to a deterioration in credit factors, management considers the length of time and extent to which the fair value has been less than cost, the financial condition and near-term prospects of the issuer, and the intent and ability to retain our investment in the security for a period of time sufficient to allow for any anticipated recovery in fair value in the near term.

Under current accounting standards, goodwill is not amortized but, instead, is subject to impairment tests on at least an annual basis or more frequently if an event occurs or circumstances change that reduce the fair value of a reporting unit below its carrying amount. A decline in our stock price or occurrence of a triggering event following any of our quarterly earnings releases and prior to the filing of the periodic report for that period could, under certain circumstances, cause us to perform a goodwill impairment test and result in an impairment charge being recorded for that period which was not reflected in such earnings release. During 2023, the annual impairment test conducted in May, using a qualitative assessment, indicated that the estimated fair value of all of the Corporation’s reporting units exceeded the carrying value. In the event that we conclude in a future assessment that all or a portion of our goodwill may be impaired, a non-cash charge for the amount of such impairment would be recorded to earnings. Such a charge would have no impact on tangible capital. At December 31, 2023, we had goodwill of $1.1 billion, which represents approximately 26% of stockholders’ equity.

In assessing the realizability of DTAs, management considers whether it is more likely than not that some portion or all of the DTAs will not be realized. Assessing the need for, or the sufficiency of, a valuation allowance requires management to evaluate all available evidence, both negative and positive, including the recent trend of quarterly earnings. Positive evidence necessary to overcome the negative evidence includes whether future taxable income in sufficient amounts and character within the carryback and carryforward periods is available under the tax law, including the use of tax planning strategies. When negative evidence (e.g., cumulative losses in recent years, history of operating loss or tax credit carryforwards expiring unused) exists, more positive evidence than negative evidence will be necessary.

The impact of each of these impairment matters could have a material adverse effect on our business, results of operations, and financial condition.

Generating returns that satisfy clients in a variety of asset classes is important to maintaining existing business and attracting new business. Administering or managing assets in accordance with the terms of governing documents and applicable laws is also important to client satisfaction. Failure in either of the foregoing areas can expose us to liability, and result in a decrease in our revenues and earnings.

The current and anticipated effects of climate change are creating an increasing level of concern for the state of the global environment. As a result, political and social attention to the issue of climate change has increased. In recent years, governments across the world have entered into international agreements or have otherwise acted to attempt to reduce global temperatures, in part by limiting GHG emissions. The Federal Reserve Board became a member of the Network of Central Banks and Supervisors for Greening the Financial System and, in its Financial Stability Report of November 2020, specifically addressed the implications of climate change for markets, financial exposures, financial institutions, and financial stability. The U.S. Congress, state legislatures and federal and state regulatory agencies have continued to propose and advance numerous legislative and regulatory initiatives seeking to mitigate the effects of climate change, including mandatory substantive and/or disclosure requirements regarding climate change. Such initiatives have been pursued with rigor under the current Presidential Administration. The Financial Stability Oversight Council, of which the OCC is a member, published a report in October 2021 identifying climate-related financial risk as an “emerging threat” to financial stability. The leadership of the federal banking agencies, including the Comptroller of the Currency, have emphasized that climate-related risks are faced by banking organizations of all types and sizes, specifically including physical and transition risks, and are in the process of enhancing supervisory expectations regarding banks' risk management practices. To that end, on October 24, 2023, the federal banking agencies, including the OCC, issued interagency guidance on principles for climate-related financial risk management by large financial institutions. The guidance reiterates the agencies’ view that financial institutions are likely to be affected by both the physical risks and transition risks associated with climate change, which can manifest as traditional risks such as credit, market, liquidity, operation, and legal risks. To address these risks, the guidance covers six areas: governance; policies, procedures, and limits; strategic planning; risk management; data, risk management, and reporting; and scenario analysis. The guidance applies only to banking organizations with total consolidated assets of greater than $100 billion and therefore does not apply to the Bank directly. In addition, the OCC stressed in its 2024 Bank Supervision Operating Plan that climate-related financial risk is one of its supervision priorities and objectives; however, the OCC noted that its focus on climate-related financial risks will be limited to financial institutions with total assets of over $100 billion. Additionally, in March 2022, the SEC proposed new climate-related disclosure rules, which if finalized, would require new climate-related disclosures in SEC filings and audited financial statements, including certain climate-related metrics and direct and indirect GHG emissions data, information about climate-related targets and goals, transition plans, if any, and attestation requirements. In October 2023, California Governor Gavin Newsom signed two climate-related disclosure bills into law. The Climate Corporate Data Accountability Act (referred to as SB 253) requires both public and private U.S. businesses with revenues greater than $1 billion doing business in California to report their GHG emissions including scopes 1, 2, and 3, beginning in 2026 (for 2025 data) and also requires reporting companies to get third-party assurance of their reports. Other states have proposed legislation similar to SB 253. The Climate-Related Financial Risk Act (referred to as SB 261) mandates U.S. businesses with annual revenues over $500 million doing business in California to bi-annually disclose climate-related financial risks and their mitigation strategies beginning January 1, 2026. Disclosure requirements imposed by different regulators may not always be uniform, which may result in increased complexity, and cost, for compliance. Additionally, many of our suppliers and business partners may be subject to similar requirements, which may augment or create additional risks, including risks that may not be known to us.

Although these new guidelines do not apply to a banking organization of our size, as the Corporation continues to grow and expand the scope of our operations, our regulators generally will expect us to enhance our internal control programs and processes, including with respect to risk management and stress testing under a variety of adverse scenarios and related capital planning. In the event the federal banking agencies were to expand the scope of coverage of the new climate risk guidelines to institutions of our size or promulgate new regulations or supervisory guidance applicable to the Corporation, we would expect to experience increased compliance costs and other compliance-related risks.

Such events could affect the stability of our deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, adversely impact our employee base, cause significant property damage, result in loss of revenue, and/or cause us to incur additional expenses. Although management has established disaster recovery policies and procedures, the occurrence of any such event could have a material adverse effect on our business, which, in turn, could have a material adverse effect on our financial condition and results of operations.

The Corporation is subject to a variety of risks arising from ESG matters as governmental and regulatory bodies, investors, customers, employees and other stakeholders and third parties have been increasingly focused on ESG matters. ESG matters include, among other things, climate risk, hiring practices, the diversity of our work force, and racial and social justice issues involving our personnel, customers and third parties with whom we otherwise do business. Risks arising from ESG matters may adversely affect, among other things, our reputation and the market price of our securities.

Further, we may be exposed to negative publicity based on the identity and activities of those to whom we lend and with which we otherwise do business and the public’s view of the approach and performance of our customers and business partners with respect to ESG matters. Any such negative publicity could arise from adverse news coverage in traditional media and could also spread through the use of social media platforms. The Corporation’s relationships and reputation with its existing and prospective customers and third parties with which we do business could be damaged if we were to become the subject of any such negative publicity. This, in turn, could have an adverse effect on our ability to attract and retain customers and employees and could have a negative impact on the market price for securities.

Investors have begun to consider the steps taken and resources allocated by financial institutions and other commercial organizations to address ESG matters when making investment and operational decisions. Certain investors are beginning to incorporate the business risks of climate change and the adequacy of companies’ responses to the risks posed by climate change and other ESG matters into their investment theses. Additionally, organizations that provide information to investors on corporate governance and related matters have developed ratings processes for evaluating companies on their approach to ESG matters. Unfavorable ratings of the Corporation may adversely affect investor sentiment towards the Corporation or the market price of our securities.

Further, as we continue to focus on developing ESG practices, and as investor and other stakeholder expectations, voluntary and regulatory ESG disclosure standards and policies continue to evolve, we have expanded and expect to further expand our public disclosures in these areas. Such disclosures may reflect aspirational goals, targets, and other expectations and assumptions, which are necessarily uncertain and may not be realized. Failure to realize (or timely achieve progress on) such aspirational goals and targets could adversely affect our third party ESG ratings, our reputation or otherwise adversely affect us.

Increased attention to ESG matters also has caused public officials, including certain state attorneys general, treasurers, and legislators, to take various actions to impact the extent to which ESG principles are considered by private investors. For instance, certain states have enacted laws or issued directives designed to penalize financial institutions that the state believes are boycotting certain industries such as the fossil fuel and firearms industries. These developments illustrate that ESG-based investing has become a divisive political issue. Shifts in investing priorities based on ESG principles may result in adverse effects on the market price of our securities to the extent that investors that give significant weight to such principles determine that the Corporation has not made sufficient progress on ESG matters. Conversely, the market price of our securities may be

adversely affected if a government official or agency seeks to limit the Corporation’s business with a certain government entity or initiates an investigation or enforcement action because of what is perceived to be the Corporation’s unwarranted focus on ESG matters.

The policies of the Federal Reserve impact us significantly. The Federal Reserve regulates the supply of money and credit in the United States. Its policies directly and indirectly influence the rate of interest earned on loans and paid on borrowings and interest-bearing deposits and can also affect the value of financial instruments we hold. Those policies determine to a significant extent our cost of funds for lending and investing. Changes in those policies are beyond our control and are difficult to predict. Federal Reserve policies can also affect our borrowers, potentially increasing the risk that they may fail to repay their loans. For example, a tightening of the money supply by the Federal Reserve could reduce the demand for a borrower’s products and services. This could adversely affect the borrower’s earnings and ability to repay its loan, which could have a material adverse effect on our financial condition and results of operations.

We face substantial competition in all areas of our operations from a variety of different competitors, both within and beyond our principal markets, many of which are larger and may have more financial resources. Such competitors primarily include national, regional, and internet banks within the various markets in which we operate. We also face competition from many other types of financial institutions, including, without limitation, savings and loans, credit unions, finance companies, brokerage firms, insurance companies, and other financial intermediaries. The financial services industry could become even more competitive as a result of legislative and regulatory changes and continued consolidation. In recent years, the OCC has begun to accept applications from financial technology companies to become special purpose national banks. These and similar developments at the state level are likely to result in even greater competition within all areas of our operations.

In addition, as customer preferences and expectations continue to evolve, technology has lowered barriers to entry and made it possible for nonbanks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. In addition, some of the largest technology firms are engaging in joint ventures with the largest banks to provide and/or expand financial service offerings with a technological sophistication and breadth of marketing that smaller institutions do not have. Many of our competitors have fewer regulatory constraints and may have lower cost structures. Additionally, due to their size, many competitors may be able to achieve economies of scale and, as a result, may offer a broader range of products and services as well as better pricing for those products and services than we can.

Our ability to compete successfully depends on a number of factors, including, among other things:

Failure to perform in any of these areas could significantly weaken our competitive position, which could adversely affect our growth and profitability, which, in turn, could have a material adverse effect on our financial condition and results of operations.

Our success depends on the general economic conditions of the specific local markets in which we operate, particularly Wisconsin, Illinois and Minnesota. Local economic conditions have a significant impact on the demand for our products and services, as well as the ability of our customers to repay loans, on the value of the collateral securing loans, and the stability of our deposit funding sources. A significant decline in general local economic conditions caused by inflation, recession, unemployment, changes in securities markets, changes in housing market prices, or other factors could have a material adverse effect on our financial condition and results of operations.

Our operations and profitability are impacted by general business and economic conditions in the United States and abroad. These conditions include short-term and long-term interest rates, inflation, money supply, political issues, ramifications of conflicts including the Russia-Ukraine conflict, legislative and regulatory changes, fluctuations in both debt and equity capital markets, broad trends in industry and finance, the strength of the United States economy, and uncertainty in financial markets

globally, all of which are beyond our control. A deterioration in economic conditions, including those arising from government shutdowns, defaults, anticipated defaults or rating agency downgrades of sovereign debt (including debt of the U.S.), or increases in unemployment, could result in an increase in loan delinquencies and NPAs, decreases in loan collateral values, and a decrease in demand for our products and services, among other things, any of which could have a material adverse impact on our financial condition and results of operations.

From time to time, we may implement new lines of business or offer new products and services within existing lines of business. There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and/or new products and services, we may invest significant time and resources. Initial timetables for the introduction and development of new lines of business and/or new products or services may not be achieved and price and profitability targets may not prove feasible. External factors, such as competitive alternatives and shifting market preferences, may also impact the successful implementation of a new line of business and/or a new product or service. Furthermore, strategic planning remains important as we adopt innovative products, services, and processes in response to the evolving demands for financial services and the entrance of new competitors, such as out-of-market banks and financial technology firms. Any new line of business and/or new product or service could have a significant impact on the effectiveness of our system of internal controls, so we must responsibly innovate in a manner that is consistent with sound risk management and is aligned with the Bank's overall business strategies. Failure to successfully manage these risks in the development and implementation of new lines of business and/or new products or services could have a material adverse effect on our business, results of operations and financial condition.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services, including the potential utilization of blockchain technology to provide alternative high speed payment systems. The effective use of technology increases efficiency and enables financial institutions to better serve customers and to reduce costs. Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers. Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse impact on our business and, in turn, our financial condition and results of operations.

As part of our growth strategy, we regularly evaluate merger and acquisition opportunities and conduct due diligence activities related to possible transactions with other financial institutions and financial services companies. As a result, negotiations may take place and future mergers or acquisitions involving cash, debt, or equity securities may occur at any time. We seek merger or acquisition partners that are culturally similar, have experienced management, and possess either significant market presence or have potential for improved profitability through financial management, economies of scale, or expanded services.

Acquiring other banks, businesses, or branches involves potential adverse impact to our financial results and various other risks commonly associated with acquisitions, including, among other things:

Acquisitions also involve operational risks and uncertainties, and acquired companies may have unknown or contingent liabilities, exposure to unexpected asset quality problems that require write-downs or write-offs (as well as restructuring and impairment or other charges), difficulty retaining key employees and customers and other issues that could negatively affect our business. We may not be able to realize any projected cost savings, synergies or other benefits associated with any such acquisition we complete. Acquisitions typically involve the payment of a premium over book and market values and, therefore, some dilution of our tangible book value and net income per common share may occur in connection with any future transaction. Failure to successfully integrate the entities we acquire into our existing operations could increase our operating costs significantly and have a material adverse effect on our business, financial condition, and results of operations.

In addition, we face significant competition from other financial services institutions, some of which may have greater financial resources than we do, when considering acquisition opportunities. Accordingly, attractive opportunities may not be available to us and there can be no assurance that we will be successful in identifying or completing future acquisitions.

Acquisitions by the Corporation, particularly those of financial institutions, are subject to approval by a variety of federal and state regulatory agencies (collectively, “regulatory approvals”). The process for obtaining these required regulatory approvals has become substantially more difficult in recent years. Regulatory approvals could be delayed, impeded, restrictively conditioned or denied due to existing or new regulatory issues the Corporation has, or may have, with regulatory agencies, including, without limitation, issues related to BSA compliance, CRA issues, fair lending laws, fair housing laws, consumer protection laws, unfair, deceptive, or abusive acts or practices regulations, and other similar laws and regulations. We may fail to pursue, evaluate or complete strategic and competitively significant acquisition opportunities as a result of our inability, or perceived or anticipated inability, to obtain regulatory approvals in a timely manner, under reasonable conditions or at all. The regulatory approvals may contain conditions on the completion of the merger that adversely affect our business following the closing, or which are not anticipated or cannot be met. Difficulties associated with potential acquisitions that may result from these factors could have a material adverse impact on our business, and, in turn, our financial condition and results of operations.

Moreover, in July 2021, President Biden issued an Executive Order on Promoting Competition in the American Economy which encouraged the federal banking agencies to review their current merger oversight practices. In response, the FDIC issued a request for public comment on the effectiveness of the existing framework for evaluating bank mergers and acquisitions under the FDI Act. In addition, the acting Comptroller of the Currency publicly stressed the need to update the framework used for analyzing bank mergers and noted that, without enhancements, there is an increased risk of approving mergers that diminish competition, hurt communities, or present systemic risks. The FTC and DOJ closely evaluate proposed mergers and acquisitions, including within the financial services sector, that have the potential to limit competition. To that end, the FTC and DOJ jointly released final Merger Guidelines, which includes a more expansive, context-specific method of analysis to evaluate competitive effects. Further, the Director of the CFPB has publicly sought a greater role for the CFPB in the evaluation of proposed bank mergers. The prospects and timing for the adoption by the federal banking agencies of revised bank merger guidelines are not certain at this time.

Any enhanced regulatory scrutiny of bank mergers and acquisitions and revision of the framework for merger application review may adversely affect the marketplace for such transactions, could result in our acquisitions in future periods being delayed, impeded or restricted in certain respects and result in new rules that possibly limit the size of financial institutions we may be able to acquire in the future and alter the terms for such transactions.

We are subject to extensive federal and applicable state regulation and supervision, primarily through Associated Bank and certain nonbank subsidiaries. Banking regulations are primarily intended to protect depositors’ funds, federal deposit insurance funds, and the banking system as a whole, not shareholders. These regulations affect our lending practices, capital structure, investment practices, dividend policy, and growth, among other things. Congress and federal regulatory agencies continually review banking laws, regulations, and policies for possible changes, and proposed changes can continue to be expected under the current Presidential Administration. Changes to statutes, regulations, or regulatory policies, including changes in interpretation or implementation of statutes, regulations, or policies, could affect us in substantial and unpredictable ways. Such changes could subject us to additional costs, limit the types of financial services and products we may offer, and/or increase the ability of nonbanks to offer competing financial services and products, among other things. Failure to comply with laws, regulations, or policies could result in sanctions by regulatory agencies, civil money penalties, and/or reputation damage, which could have a material adverse effect on our business, financial condition, and results of operations. While we have policies and procedures designed to prevent these types of violations, there can be no assurance that such violations will not occur.

Significantly, the enactment of the Economic Growth Act, and the promulgation of its implementing regulations, repealed or modified several important provisions of the Dodd-Frank Act. Among other things, the Economic Growth Act and its implementing regulations raised the total asset thresholds to $250 billion for Dodd-Frank Act annual company-run stress testing, leverage limits, liquidity requirements, and resolution planning requirements for bank holding companies, subject to the ability of the Federal Reserve to apply such requirements to institutions with assets of $100 billion or more to address financial stability risks or safety and soundness concerns. However, in response to several large bank failures in the spring of 2023, the federal banking agencies have engaged in rulemaking that likely will significantly increase compliance costs should we grow in excess of $50 billion in assets.

In addition, the federal banking agencies, including the OCC, and the CFPB have in recent years adopted a more aggressive enforcement posture—specifically with respect to fair lending and loan servicing, bank and financial institution sales practices, management of consumer accounts and the charging of various fees.

Last Congress, Democrats controlled the White House and both Chambers of Congress. As a result, Democrats were able to set the policy agenda both legislatively and in the regulatory agencies that have rulemaking and supervisory authority over the financial services industry generally and the Bank specifically. These dynamics shifted after the 2022 midterm elections. While Democrats retained control of the U.S. Senate, the party has a slim majority of 51 seats. Republicans assumed control of the U.S. House of Representatives, with a slim majority of 222 seats. In consideration of the divided control of Congress, the narrow majorities in each chamber, and the current political environment, the legislative process is expected to be more

challenging in the current legislative session. In addition, two vacant seats previously held by Republicans will need to be filled in early 2024, which could impact the margin by which Republicans control the House of Representatives.

Although agendas are expected to vary substantially in each chamber, congressional committees with jurisdiction over the banking sector have pursued, and likely will continue to pursue, oversight in a variety of areas, including addressing climate-related risks, promoting diversity and equality within the banking industry and addressing other ESG matters, improving competition in the banking sector and enhancing oversight of bank mergers and acquisitions, and establishing a regulatory framework for digital assets and markets. The prospects for the enactment of major banking reform legislation under the new Congress are unclear at this time.

Moreover, the turnover of the Presidential Administration in 2021 resulted in certain changes in the leadership and senior staffs of the federal banking agencies and the Treasury Department, with certain significant leadership positions yet to be filled, including the Comptroller of the Currency. These changes have impacted the rulemaking, supervision, examination and enforcement priorities and policies of the agencies and likely will continue to do so over the next several years. The potential impact of any changes in agency personnel, policies and priorities on the financial services sector, including the Bank, cannot be predicted at this time.

On March 10, 2023, SVB was closed by the DFPI. Two days later, on March 12, 2023, SBNY also failed. Nearly two months later, on May 1, 2023, First Republic Bank was closed by the DFPI. In each case, the FDIC was appointed as receiver. With respect to the failures of SVB and SBNY, the FDIC, together with the Federal Reserve and the U.S. Treasury Secretary, took action under applicable emergency systemic risk authority to fully protect the depositors of each bank as the institutions were wound down. SVB and SBNY each had substantial business relationships with, and exposure to, entities within the innovation sector, including financial technology and digital asset companies, and had received an influx of deposits over the course of several years which coincided with the rapid growth of that sector. In recent periods, however, SVB and SBNY each had begun to experience significant deposit losses. These losses increased rapidly in early March, ultimately causing each institution to fail. While First Republic Bank’s business model was different in certain respects, it too experienced rapid growth as peer banks stalled and had significant asset and funding concentrations, each of which contributed to the failure of the institution.

Investor and customer confidence in the banking sector, particularly with regard to mid-size and larger regional banking organizations, waned in response to the failures of SVB, SBNY and First Republic Bank. Notably, the Corporation’s share price decreased by 22% during the month of March, consistent with other regional banking organizations. According to data published by the Federal Reserve, deposits at domestic commercial banks decreased by approximately $280 billion between the end of February 2023 and the week ended March 29, 2023. The Bank’s deposits decreased by $248 million during this period, which was a decrease of less than 1%. According to the data published by the Federal Reserve, deposits at domestic commercial banks have been stable throughout the last three quarters of 2023, with no further notable decrease.

Congress and the federal banking agencies have and continue to evaluate the events leading to the failures of SVB, SBNY and First Republic Bank to ascertain possible explanations for these developments. Legislators and the leadership of the federal banking agencies noted that inadequate prudential regulation of regional banking organizations (generally, institutions with less than $250 billion in total assets), insufficient supervision of such organizations, poor management and inadequate risk management practices, specifically including interest rate and liquidity risks in consideration of each institution’s business model, and substantial uninsured deposit liabilities were causes of the failures.

Further evaluation of recent developments in the banking sector may lead to governmental initiatives intended to prevent future bank failures and stem significant deposit outflows from the banking sector, including (i) legislation aimed at preventing similar future bank runs and failures and stabilizing confidence in the banking sector over the long term, (ii) agency rulemaking to modify and enhance relevant regulatory requirements, specifically with respect to liquidity risk management, deposit concentrations, capital adequacy, stress testing and contingency planning, and safe and sound banking practices, and (iii) enhancement of the agencies’ supervision and examination policies and priorities. In fact, in July 2023, the federal banking agencies issued a notice of proposed rulemaking that would substantially revise the regulatory capital framework for banking organizations with total assets of $100 billion or more and banking organizations with significant trading activity. Among other things, the proposed rule would require all banking organizations with over $100 billion in assets to include unrecognized gains and losses on AFS debt securities via the inclusion of accumulated other comprehensive income in capital. In addition, banking organizations with over $100 billion in assets would be subject to the supplementary leverage ratio and countercyclical capital buffer. The proposed rule, if adopted as proposed, would not apply to the Bank directly based on the Bank's current asset size. The federal banking agencies may also re-evaluate applicable liquidity risk management standards, such as by reconsidering the

mix of assets that are deemed to be "high-quality liquid assets" and/or how HQLA holdings and cash inflows and outflows are tabulated and weighted for liquidity management purposes.

Although we cannot predict with certainty which initiatives may be pursued by lawmakers and agency leadership, nor can we predict the terms and scope of any such initiatives, any of the potential changes referenced above could, among other things, subject us to additional costs, limit the types of financial services and products we may offer, and limit our future growth, any of which could materially and adversely affect our business, results of operations or financial condition.

On November 16, 2023, the FDIC issued a final rule on special assessment to recover the loss to the DIF associated with the resolution of SVB and SBNY, which was estimated to be approximately $16.3 billion as of the date of the issuance of the final rule. Under the final rule, the assessment base for an IDI will be equal to the institution’s estimated uninsured deposits as of December 31, 2022, adjusted to exclude the first $5 billion in estimated uninsured deposits. Under the final rule, the FDIC will collect the special assessment at an annual rate of 13.4 bp beginning with the first quarterly assessment period of 2024 and will continue to collect special assessments for an anticipated total of eight quarterly assessment periods. The Bank had uninsured deposits of $16.4 billion as of December 31, 2022, and the Bank expects that it will pay a special assessment based on the assessment base of $11.4 billion, which excludes the first $5 billion from the $16.4 billion uninsured deposits the Bank had as of December 31, 2022. Such an increase in our assessment fees may have a materially adverse effect on our results of operations and financial condition.

The SEC’s Regulation Best Interest which was implemented in 2019 established a new standard of conduct for a broker-dealer to act in the best interest of a retail customer when making a recommendation of any securities transaction or investment strategy involving securities to such customer. The regulation required us to review and modify our compliance activities, including our policies, procedures, and controls, which caused us to incur additional costs. In addition, state laws that impose a fiduciary duty also may require monitoring, as well as require that we undertake additional compliance measures. In addition, the Bank's insurance agency subsidiary is also subject to regulation and supervision in the various states in which it operates. The implementation and administration by the SEC of Regulation Best Interest, as well as any new state laws that impose a fiduciary duty, may negatively impact our results of operation, as well as increase costs associated with legal, compliance, operations, and information technology.

The CFPB has broad rulemaking authority to administer and carry out the provisions of the Dodd-Frank Act with respect to financial institutions that offer covered financial products and services to consumers. As an independent bureau within the Federal Reserve System, the CFPB may impose requirements more severe than the previous bank regulatory agencies. The CFPB has also been directed to write rules identifying practices or acts that are unfair, deceptive or abusive in connection with any transaction with a consumer for a consumer financial product or service, or the offering of a consumer financial product or service. The CFPB has initiated enforcement actions against a variety of bank and non-bank market participants with respect to a number of consumer financial products and services that have resulted in those participants expending significant time, money and resources to adjust to the initiatives being pursued by the CFPB. The CFPB has pursued a more aggressive enforcement policy with respect to a range of regulatory compliance matters under the current Presidential Administration, specifically including fair lending, loan servicing, financial institution sales and marketing practices, and financial institution consumer fee and account management practices. CFPB enforcement actions may serve as precedent for how the CFPB interprets and enforces consumer protection laws, including practices or acts that are deemed to be unfair, deceptive or abusive, with respect to all supervised institutions, which may result in the imposition of higher standards of compliance with such laws. Moreover, the Bank is subject to supervision and examination by the CFPB for compliance with the CFPB’s regulations and policies. The costs and limitations related to this additional regulatory reporting regimen have yet to be fully determined, although they may be material, and the limitations and restrictions that will be placed upon the Bank with respect to its consumer product offerings and services may produce significant, material effects on the Bank’s (and the Corporation’s) profitability.

Federal and state banking agencies closely examine the mortgage and mortgage servicing activities of depository financial institutions. Should any of these regulators have serious concerns with respect to our mortgage or mortgage servicing activities in this regard, the regulators’ response to such concerns could result in material adverse effects on our growth strategy and profitability. Further, staff changes to key positions within the CFPB under the current Presidential Administration have resulted in the CFPB pursuing more strict enforcement policies, specifically in the area of fair lending, loan servicing, collections and other consumer related areas.

We may be required to repurchase residential mortgage loans, or to reimburse the purchaser for losses with respect to residential mortgage loans, which have been sold to secondary market purchasers in the event there are breaches of certain representations and warranties contained within the sales agreements, such as representations and warranties related to credit information, loan documentation, collateral and insurability. Consequently, we are exposed to credit risk, and potentially funding risk, associated with sold loans. As a result we have established reserves in our consolidated financial statements for potential losses related to the residential mortgage loans we have sold. The adequacy of the reserves and the ultimate amount of losses incurred will depend on, among other things, the actual future mortgage loan performance, the actual level of future repurchase and reimbursement requests, the actual success rate of claimants, actual recoveries on the collateral and macroeconomic conditions. Due to uncertainties relating to these factors, there can be no assurance that the reserves we establish will be adequate or that the total amount of losses incurred will not have a material adverse effect on our financial condition or results of operations.

Revenues derived from transaction fees associated with overdraft protection programs offered to our customers represent a significant portion of our noninterest income. In 2023, the Corporation collected approximately $14 million in overdraft transaction fees. Members of Congress and the leadership of the OCC and CFPB have expressed a heightened interest in bank overdraft protection programs. In December 2021, the CFPB published a report providing data on banks’ overdraft and non-sufficient funds fee revenues as well as observations regarding consumer protection issues relating to participation in such programs. Since then, the CFPB has used the supervision process to obtain additional information about financial institutions’ overdraft practices. In 2023, the CFPB brought enforcement actions against a number of financial institutions for overdraft practices that the CFPB alleged to be unlawful and ordered each of these institutions to pay a substantial civil money penalty in addition to customer restitution. The CFPB found that these institutions engaged in unlawful overdraft practices by, among other things, systematically and repeatedly charging fees to customers with insufficient funds in their accounts, imposing overdraft fees without adequate disclosures, charging overdraft fees without proper consent, and misleading customers about the terms and costs of overdraft coverage. The CFPB also has published guidance containing instructions for financial institutions to avoid the imposition of unlawful overdraft fees. The CFPB is expected to commence rulemaking in this area in the coming months. These actions are a component of the CFPB’s broader supervision and enforcement initiative targeting so-called consumer “junk fees.”

In addition, the OCC issued a bulletin to banks in April 2023 to address the risks associated with overdraft protection programs and overdraft fees. Specifically, the OCC noted in the bulletin that APSN transaction and representment fee practices may present a heightened risk of violations of Section 5 of the Federal Trade Commission Act of 2010, which prohibits unfair, deceptive, or abusive acts or practices. An APSN transaction refers to the practice of assessing overdraft fees on debit card transactions that authorize when a customer’s available balance is positive but later post to the account when the available balance is negative. Representment fees refer to assessing an additional fee each time a third party submits the same transaction for payment after a bank returns the transaction for non-sufficient funds. The OCC further noted that banks should establish and maintain sound risk management of overdraft protection programs by establishing effective board and management oversight and appropriate procedures and practices for managing risks associated with overdraft protection programs.

In response to this increased congressional and regulatory scrutiny, and in response to enhanced supervision and enforcement of overdraft protection practices, certain banking organizations have modified their overdraft protection programs, including by discontinuing the imposition of overdraft transaction fees. In 2022, the Corporation eliminated non-sufficient funds fees, overdraft protection transfer fees, and continuous overdraft fees and reduced the daily limit of overdraft fee occurrences from four to two. We may further modify our overdraft program and practices in response to competitive pressures, supervisory guidance and observable trends from public enforcement actions. Despite our ongoing compliance efforts, we may become

subject to regulatory enforcement actions with respect to our programs and practices with respect to overdraft and non-sufficient funds fees. In addition, as supervisory expectations and industry practices regarding overdraft protection programs change, our continued offering of overdraft protection may result in negative public opinion and increased reputation risk.

We are subject to federal and applicable state income tax regulations. Income tax regulations are often complex and require interpretation. Changes in income tax regulations could negatively impact our results of operations. In the normal course of business, we are routinely subject to examinations and challenges from federal and applicable state tax authorities regarding the amount of taxes due in connection with investments we have made and the businesses in which we have engaged. Recently, federal and state taxing authorities have become increasingly aggressive in challenging tax positions taken by financial institutions. These tax positions may relate to tax compliance, sales and use, franchise, gross receipts, payroll, property and income tax issues, including tax base, apportionment and tax credit planning. The challenges made by tax authorities may result in adjustments to the timing or amount of taxable income or deductions or the allocation of income among tax jurisdictions. If any such challenges are made and are not resolved in our favor, they could have a material adverse effect on our financial condition and results of operations.

From time to time, customers make claims and take legal action pertaining to the performance of our fiduciary responsibilities. Whether customer claims and legal action related to the performance of our fiduciary responsibilities are founded or unfounded, if such claims and legal actions are not resolved in a manner favorable to us, they may result in significant financial liability and/or adversely affect the market perception of us and our products and services, as well as impact customer demand for those products and services. Any financial liability or reputation damage could have a material adverse effect on our business, which, in turn, could have a material adverse effect on our financial condition and results of operations.

We may be involved from time to time in a variety of litigation arising out of our business. Our insurance may not cover all claims that may be asserted against us, and any claims asserted against us, regardless of merit or eventual outcome, may harm our reputation. Should the ultimate judgments or settlements in any litigation exceed our insurance coverage, they could have a material adverse effect on our financial condition and results of operation for any period. In addition, we may not be able to obtain appropriate types or levels of insurance in the future, nor may we be able to obtain adequate replacement policies with acceptable terms, if at all.

Reputation risk, or the risk to our earnings and capital from negative public opinion, is inherent in our business. Negative public opinion could adversely affect our ability to keep and attract customers and expose us to adverse legal and regulatory consequences. Negative public opinion could result from our actual or alleged conduct in any number of activities, including lending or foreclosure practices, corporate governance, regulatory compliance, mergers and acquisitions, and disclosure, sharing or inadequate protection of customer information, and from actions taken by government regulators and community organizations in response to that conduct. Because we conduct most of our business under the "Associated Bank" brand, negative public opinion about one business could affect our other businesses.

We have established a Code of Business Conduct and Ethics and Related Party Transaction Policies and Procedures to address the ethical conduct of business and to avoid potential conflicts of interest. Any system of controls, however well designed and operated, is based, in part, on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met. Any failure or circumvention of our related controls and procedures or failure to comply with the established Code of Business Conduct and Ethics and Related Party Transaction Policies and Procedures could have a material adverse effect on our reputation, business, results of operations, and/or financial condition.

Price volatility may make it more difficult for you to sell your securities when you want and at prices you find attractive. Our securities prices can fluctuate widely in response to a variety of factors including, among other things:

General market fluctuations, industry factors, and general economic and political conditions and events, such as economic slowdowns or recessions, interest rate changes, or credit loss trends, could also cause our securities prices to decrease regardless of our operating results.

We are not restricted from issuing additional securities, including preferred stock, common stock and securities that are convertible into or exchangeable for, or that represent the right to receive, common stock. The issuance of additional shares of common stock or the issuance of convertible securities would dilute the ownership interest of our existing common shareholders. The market price of our common stock could decline as a result of an equity offering, as well as other sales of a large block of shares of our common stock or similar securities in the market after an equity offering, or the perception that such sales could occur. Both we and our regulators perform a variety of analyses of our assets, including the preparation of stress case scenarios, and as a result of those assessments we could determine, or our regulators could require us, to raise additional capital.

Although we have historically paid a quarterly cash dividend to the holders of our common stock, holders of our common stock are not entitled to receive dividends. Downturns in the domestic and global economies could cause our board of directors to consider, among other things, the elimination of dividends paid on our common stock. This could adversely affect the market price of our common stock. Furthermore, as a bank holding company, our ability to pay dividends is subject to the guidelines of the Federal Reserve regarding capital adequacy and dividends. Dividends also may be limited as a result of safety and soundness considerations.

Shares of the common stock are equity interests in us and do not constitute indebtedness. As such, shares of the common stock will rank junior to all of our indebtedness and to other non-equity claims against us and our assets available to satisfy claims against us, including our liquidation. Additionally, holders of our common stock are subject to prior dividend and liquidation rights of holders of our outstanding preferred stock. Our board of directors is authorized to issue additional classes or series of preferred stock without any action on the part of the holders of our common stock, and we are permitted to incur additional debt. Upon liquidation, lenders and holders of our debt securities and preferred stock would receive distributions of our available assets prior to holders of our common stock. Furthermore, our right to participate in a distribution of assets upon any of our subsidiaries’ liquidation or reorganization is subject to the prior claims of that subsidiary’s creditors, including holders of any preferred stock of that subsidiary.

Provisions of our articles of incorporation and bylaws, and federal banking laws, including regulatory approval requirements, could make it more difficult for a third party to acquire us, even if doing so would be perceived to be beneficial to our shareholders. The combination of these provisions may prohibit a non-negotiated merger or other business combination, which, in turn, could adversely affect the market price of our common stock.

Our common stock is not a bank deposit and, therefore, is not insured against loss by the FDIC, any other DIF, or by any other public or private entity. An investment in our common stock is inherently risky for the reasons described in this "Risk Factors" section and elsewhere in this report and is subject to the same market forces that affect the price of common stock in any company. As a result, if you acquire our common stock, you may lose some or all of your investment.

An entity (including a "group" composed of natural persons) owning or controlling with the power to vote 25% or more of our outstanding common stock, or 5% or more if such holder otherwise exercises a "controlling influence" over us, may be subject to regulation as a "bank holding company" in accordance with the BHC Act. In addition, (1) any bank holding company or foreign bank with a U.S. presence may be required to obtain the approval of the Federal Reserve under the BHC Act to acquire or retain 5% or more of our outstanding common stock, and (2) any person not otherwise defined as a company by the BHC Act and its implementing regulations may be required to obtain the approval of the Federal Reserve under the Change in Bank Control Act to acquire or retain 10% or more of our outstanding common stock. Becoming a bank holding company imposes certain statutory and regulatory restrictions and obligations, such as providing managerial and financial strength for its bank subsidiaries. Regulation as a bank holding company could require the holder to divest all or a portion of the holder’s investment in our common stock or such nonbanking investments that may be deemed impermissible or incompatible with bank holding company status, such as a material investment in a company unrelated to banking. Further, in 2020, the Federal Reserve implemented a final rule that simplifies and increases the transparency of its rules for determining when one company controls another company for purposes of the BHC Act. The rule, which has been further interpreted by the Federal Reserve staff since its implementation, has and will likely continue to have a meaningful impact on control determinations related to investments in banks and bank holding companies and investments by bank holding companies in nonbank companies.

Over the past several years, we have faced increased competition for residential mortgage loans due to the unprecedented involvement of the GSEs in the mortgage market as a result of the economic crisis, which has caused the interest rate for 30 year fixed-rate mortgage loans that conform to GSE guidelines to remain artificially low. In addition, the U.S. Congress has expanded the conforming loan limits in many of our operating markets, allowing larger balance loans to continue to be acquired by the GSEs. Although reform of the GSE system has been viewed as a priority by many within Congress and the executive branch for several years, it is unknown at this time what reforms, if any, will be made, the extent of the future involvement in the residential mortgage market and the impact of any reforms on that market and the United States economy as a whole.

Our accounting policies are fundamental to understanding our financial results and condition. Some of these policies require the use of estimates and assumptions that may affect the value of our assets or liabilities and financial results. Some of our accounting policies are critical because they require management to make difficult, subjective and complex judgments about matters that are inherently uncertain and because it is likely that materially different amounts would be reported under different conditions or using different assumptions. If such estimates or assumptions underlying our financial statements are incorrect, we may experience material losses.

From time to time, the FASB and the SEC change the financial accounting and reporting standards or the interpretation of those standards that govern the preparation of our external financial statements. These changes are beyond our control, can be hard to predict and could materially impact how we report our results of operations and financial condition. We could be required to apply a new or revised standard retroactively, resulting in our restating prior period financial statements in material amounts.

Management regularly reviews and updates our internal controls, disclosure controls and procedures, and corporate governance policies and procedures. Any system of controls, however well designed and operated, is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the controls are met. Any failure or circumvention of our controls and procedures or failure to comply with regulations related to controls and procedures could have a material adverse effect on our business, results of operations, and financial condition.

Our success depends, in large part, on our ability to attract and retain skilled people. Competition for the best people in most activities engaged in by us can be intense, and we may not be able to hire sufficiently skilled people or to retain them. The unexpected loss of services of one or more of our key personnel could have a material adverse impact on our business because of their skills, knowledge of our markets, years of industry experience, and the difficulty of promptly finding qualified replacement personnel.

Our business is primarily relationship-driven in that many of our key employees have extensive customer relationships. Loss of a key employee with such customer relationships may lead to the loss of business if the customers were to follow that employee to a competitor or otherwise choose to transition to another financial services provider. While we believe our relationship with our key personnel is good, we cannot guarantee that all of our key personnel will remain with our organization. Loss of such key personnel could result in the loss of some of our customers.

The Corporation recognizes the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Corporation. The Board of Directors, through the ERC, provides direction and oversight of the enterprise-wide risk management framework of the Corporation, and cybersecurity represents a component of the Corporation’s overall approach to enterprise-wide risk management. The Information Security Program establishes policies and procedures for the measurement of the effectiveness and efficiency of information security controls related to both design and operations. The Corporation leverages the following guidelines and frameworks to develop and maintain the Information Security Program: FFIEC Information Security IT Examination Handbook, FFIEC Business Continuity Planning Handbook, FFIEC Cybersecurity Assessment Tool, Center for Internet Security Critical Security Controls, National Institute of Standards and Technology Special Publication 800 Series, ISO-27000 Standard and GLBA 501(b). In general, the Corporation seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on confidentiality, security and availability of the information that the Corporation collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cyber threats when they occur.

As one of the elements of the Corporation’s overall enterprise-wide risk management approach, the Information Security Program is focused on the following key areas:

The Corporation leverages regular assessments to identify current and potential threats and vulnerabilities within the Corporation’s environment. Technical vulnerabilities are identified using automated vulnerability scanning tools, penetration testing, and system management tools, whereas non-technical vulnerabilities are identified via process or procedural reviews. The Corporation conducts a variety of assessments throughout the year, both internally and through third parties. Vulnerability assessment and penetration tests are performed on a regular basis to provide the Corporation with an unbiased view of its environment and controls. Vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to management on a regular basis. A multi-step approach is applied to identify, report and remediate these vulnerabilities, and the Corporation adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments. The results of key assessments are reported in summary to the Board of Directors annually.

The Board of Directors, through the ERC, provides direction and oversight of the enterprise-wide risk management framework of the Corporation, including the management of risks arising from cybersecurity threats. The ERC reviews and approves the Information Security Policy. The Board of Directors receives regular presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Corporation’s peers and third parties. The Board of Directors also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the full Board of Directors discusses the Corporation’s approach to cybersecurity risk management with the Corporation’s CISO.

The CISO, under the guidance of our CIO, CRO, CEO and General Counsel, works collaboratively across the Corporation to implement a program designed to protect the Corporation’s information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Corporation’s incident response and recovery plans including an assessment of the potential materiality of any cybersecurity incident. To facilitate the success of the Corporation’s cybersecurity risk management program, multidisciplinary teams throughout the Corporation are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and the 2nd Line Information Security Risk Management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Corporate Crisis Management Team and ultimately the ERC when appropriate.

The CISO has served in various roles in Information Technology and Information Security for over 35 years, including serving in a Chief Information Security Officer role of two large public companies, including Associated Bank for 17 years. The CISO holds an undergraduate degree in Management Information Systems and has attained the professional Information Systems

Audit and Control Association certification of Certified Information Security Manager in 2005. The CIO holds an undergraduate degree in business management, with a minor in international business, and is currently pursuing a master’s degree in cybersecurity and has served in various roles in information technology for over 30 years, including serving as either the Chief Technology Officer or Chief Information Officer of four public companies. The CRO has over 30 years of banking experience, holds a degree in computer science, and earned the CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors. The Corporation’s CEO and General Counsel each hold degrees in their respective fields, and each has extensive experience managing risks at the Corporation and similar financial institutions, including risks arising from cybersecurity threats.

At December 31, 2023, Associated Bank operated 196 banking branches serving over 100 different communities throughout Wisconsin, Illinois, and Minnesota. Most of the banking locations are freestanding buildings owned by us, with a drive thru and a parking lot; a smaller subset resides in supermarkets and office towers, which are generally leased. Associated Bank also operated loan production offices in Indiana, Michigan, Missouri, New York, Ohio and Texas. 

Matthew R. Braeger has been Executive Vice President, Chief Audit Executive of Associated and Associated Bank since February 2018. He served as Deputy Chief Audit Executive from October 2017 to February 2018. He joined Associated in April 2013 as Senior Vice President, Business Support Audit Director. Previously, he held audit management positions with Fiserv, Inc. and public accounting audit roles with Ernst & Young, LLP. Mr. Braeger has more than 20 years of auditing experience, primarily in banking technology and financial services.

Bryan J. Carson has been Executive Vice President, Chief Product and Marketing Officer of Associated and Associated Bank since July 2022. He served as Executive Vice President of Deposit Products, Customer Segmentation, and Branch & ATM Distribution at Huntington Bank from 2018 to 2022. Prior to that, he served as Chief Marketing Officer from 2015 to 2018 and Senior Vice President of Deposit Products & Pricing at Huntington Bank from 2010 to 2015.

Dennis M. DeLoye has been Executive Vice President, Head of Community Markets and Regional President Northeast Wisconsin of Associated and Associated Bank since April 2022. Mr. DeLoye previously served as Executive Vice President, Deputy Head of Community Markets and Regional President Northeast Wisconsin from November 2021 to April 2022. DeLoye joined Associated in 2016 and has served as community market president for the Central and Northern Wisconsin markets.

Nicole M. Kitowski has been Executive Vice President, Chief Risk Officer of Associated and Associated Bank since February 2018. She joined Associated in 1992 and has held leadership roles in Consumer Banking, Operations and Technology, and Corporate Risk, including Deputy Chief Risk Officer from March 2016 to February 2018 and Corporate BSA, AML, OFAC Officer from June 2014 to March 2016.

Derek S. Meyer has been Executive Vice President, Chief Financial Officer of Associated and Associated Bank since August 2022. Prior to joining Associated, Derek served as the Executive Vice President, Corporate Treasurer of Huntington Bank from 2019 to June 2022. Mr. Meyer also served as Executive Vice President, Financial Planning & Analysis Director from February 2015 to 2019. During his 22 years at Huntington Bank, he held various senior leadership roles and was responsible for crucial finance functions including treasury, financial planning and analysis, stress testing, mergers and acquisition due diligence, regulatory matters, and process and controls implementation.

Paul G. Schmidt has been Executive Vice President, Head of CRE of Associated and Associated Bank since January 2016 and was appointed Head of Facilities and Twin Cities Market President in July 2022. He joined Associated in April 2015 as Executive Vice President of CRE. He was named Deputy Head of CRE in September 2015. Mr. Schmidt brings more than 32 years of banking experience to Associated. Most recently, he held the position of Executive Vice President, Division Manager, CRE at Wells Fargo from 2002 to 2015.

Tammy C. Stadler has been Executive Vice President, Corporate Controller and Chief Accounting Officer of Associated and Associated Bank since July 2021. She previously served as Executive Vice President, Principal Accounting Officer from April 2017 until July 2021. She joined Associated in April 1996 as Corporate Tax Director and has served as Executive Vice President, Corporate Controller since April 2014. From 1992 to 1996 she was the Assistant Treasurer and Taxes for Air Wisconsin Airline Corp. From 1990 to 1992 she held the position of Senior Tax Analyst with Fort Howard Paper Corp. Prior to her time with Fort Howard, Ms. Stadler worked as a certified public accountant with Coopers and Lybrand and Deloitte and Touche.

David L. Stein has been Executive Vice President, Head of Consumer and Business Banking of Associated and Associated Bank since January 2017 and was named Madison Market President in January 2019. He was previously Executive Vice President, Head of Consumer and Commercial Banking from April 2014 until January 2017 and Executive Vice President, Head of Retail Banking from June 2007 until April 2014. He was the President of the Southwest Region of Associated Bank from January 2005 until June 2007. He held various positions with J.P. Morgan Chase & Co., and one of its predecessors, Bank One Corporation, from 1989 until joining Associated in 2005.

John A. Utz has been Executive Vice President, Head of Corporate Banking and Milwaukee Market President of Associated and Associated Bank since September 2015 and was Head of Wealth Management from April 2020 to July 2021. He joined Associated in March 2010 with upwards of 20 years of banking experience, having previously served as President of Union Bank’s UnionBanCal Equities and head of its Capital Markets division from September 2007 to March 2010, and as head of the National Banking and Asset Management teams from October 2002 to September 2007.

Terry L. Williams has been Executive Vice President, Chief Information Officer of Associated and Associated Bank since January 2023. Prior to joining Associated, he served as Chief Information Officer and Chief Technology Officer for Belcan, LLC from 2016 to 2022. Prior to that, he served as Executive Vice President and General Manager Customer-Facing Solutions of Standard Register from 2014 to 2015.

Information in response to this item is incorporated by reference to the discussion of dividend restrictions under Part I, Item 1, Business - Supervision and Regulation - Holding Company Dividends, and in Note 10 Stockholders' Equity of the notes to consolidated financial statements included under Part II, Item 8, Financial Statements and Supplementary Data, of this Annual Report on Form 10-K. The Corporation’s common stock is traded on the NYSE under the symbol ASB.

The number of shareholders of record of the Corporation’s common stock, $0.01 par value, as of January 31, 2024, was 6,669. Certain of the Corporation’s shares are held in “nominee” or “street” name and the number of beneficial owners of such shares was 29,828.

Payment of future dividends is within the discretion of the Board of Directors and will depend, among other factors, on earnings, capital requirements, and the operating and financial condition of the Corporation. The Board of Directors makes the dividend determination on a quarterly basis.

During the fourth quarter of 2023, the Corporation repurchased approximately $86,000 of common stock, all of which were repurchases related to tax withholding on equity compensation, with no open market repurchases during the quarter. The repurchase details are presented in the table below. For a detailed discussion of the common stock and depositary share purchases during 2023 and 2022, see Part II, Item 8, Note 10 Stockholders' Equity of the notes to consolidated financial statements.

Set forth below is a line graph (and the underlying data points) comparing the yearly percentage change in the cumulative total shareholder return (change in year-end stock price plus reinvested dividends) on the Corporation’s common stock with the cumulative total return of the S&P 500 Index, the S&P 400 Regional Banks Sub-Industry Index, and the KBW Nasdaq Regional Banking Total Return Index for the period of five fiscal years commencing on January 1, 2019 and ending December 31, 2023. The S&P 400 Regional Banks Sub-Industry Index is comprised of stocks on the S&P Total Market Index that are classified in the regional banks sub-industry. The KBW Nasdaq Regional Banking Total Return Index is comprised of U.S. companies that do business as regional banks or thrifts. The graph assumes the respective values of the investment in the Corporation’s common stock and each index were $100 on December 31, 2018. Historical stock price performance shown on the graph is not necessarily indicative of the future price performance.

The Total Shareholder Return Performance Graph shall not be deemed incorporated by reference by any general statement incorporating by reference this Annual Report on Form 10-K into any filing under the Securities Act or under the Exchange Act, except to the extent the Corporation specifically incorporates this information by reference, and shall not otherwise be deemed filed under such Acts.

The following discussion is management’s analysis to assist in the understanding and evaluation of the consolidated financial condition and results of operations of the Corporation. It should be read in conjunction with the consolidated financial statements and footnotes and the selected financial data presented elsewhere in this report. Within the tables presented, certain columns and rows may not sum due to the use of rounded numbers for disclosure purposes.

The Corporation is a bank holding company headquartered in Wisconsin, providing a broad array of banking and nonbanking products and services to businesses and consumers primarily within our three-state footprint. The Corporation’s primary sources of revenue, through the Bank, are net interest income (predominantly from loans and investment securities) and noninterest income (principally fees and other revenue from financial services provided to customers or ancillary services tied to loans and deposits).

Net interest income is the primary source of the Corporation’s revenue. Net interest income is the difference between interest income on interest-earning assets, such as loans and investment securities, and the interest expense on interest-bearing deposits and other borrowings used to fund interest-earning and other assets or activities. Net interest income is affected by the amount and composition of earning assets and interest-bearing liabilities, as well as the sensitivity of the balance sheet to changes in interest rates, including characteristics such as the fixed or variable nature of the financial instruments, contractual maturities, re-pricing frequencies, loan prepayment behavior, and the use of interest rate derivative financial instruments.

Interest rate spread and net interest margin are utilized to measure and explain changes in net interest income. Interest rate spread is the difference between the yield on earning assets and the rate paid on interest-bearing liabilities that fund those assets. The net interest margin is expressed as the percentage of net interest income to average earning assets. The net interest margin

exceeds the interest rate spread because net free funds, principally noninterest-bearing demand deposits and stockholders’ equity, also support earning assets. To compare tax-exempt asset yields to taxable yields, the yield on tax-exempt loans and investment securities is computed on a fully tax-equivalent basis. Net interest income, interest rate spread, and net interest margin are discussed on a fully tax-equivalent basis.

Table 1 provides average daily balances of earning assets and interest-bearing liabilities, the associated interest income and expense, and the corresponding interest rates earned and paid, as well as net interest income, interest rate spread, and net interest margin on a fully tax-equivalent basis for the years ended December 31, 2023, 2022, and 2021. Table 2 presents additional information to facilitate the review and discussion of fully tax-equivalent net interest income, interest rate spread, and net interest margin.

The provision for credit losses is predominantly a function of the Corporation’s reserving methodology and judgments as to other qualitative and quantitative factors used to determine the appropriate level of the ACLL, which focuses on changes in the size and character of the loan portfolio, changes in levels of individually evaluated and other nonaccrual loans, historical losses and delinquencies in each portfolio category, the risk inherent in specific loans, concentrations of loans to specific borrowers or industries, existing economic conditions and economic forecasts, the fair value of underlying collateral, and other factors which could affect potential credit losses. The forecast the Corporation used for December 31, 2023 was the Moody's baseline scenario from November 2023, which was reviewed against the December 2023 baseline scenario with no material updates made, over a 2 year reasonable and supportable period with straight-line reversion to historical losses over the second year of the period. See additional discussion under the sections titled Loans, Credit Risk, Nonperforming Assets, and Allowance for Credit Losses on Loans.

The Corporation recognized income tax expense of $23 million for 2023, compared to income tax expense of $94 million for 2022. The Corporation's effective tax rate was 11.21% for 2023, compared to an effective tax rate of 20.34% for 2022. The decrease in income tax expense during 2023 was primarily driven by a decrease in income before taxes in 2023. The decrease in the effective tax rate during 2023 was primarily driven by a decrease in state tax expense and the effect of tax exempt interest.

See Note 1 Summary of Significant Accounting Policies of the notes to consolidated financial statements for the Corporation’s income tax accounting policy. Income tax expense recorded on the consolidated statements of income involves the interpretation and application of certain accounting pronouncements and federal and state tax laws and regulations. The Corporation is subject to examination by various taxing authorities. Examination by taxing authorities may impact the amount of tax expense and/or the reserve for uncertainty in income taxes if their interpretations differ from those of management, based on their judgments about information available to them at the time of their examinations. See Note 13 Income Taxes of the notes to consolidated financial statements for more information.