Capitol Federal Financial, Inc. (CFFN) Risk Factors

Item 1A. Risk Factors

There are risks inherent in the Bank's and Company's business. The following is a summary of material risks and uncertainties relating to the operations of the Bank and the Company. Adverse experiences with these could have a material impact on the Company's financial condition and results of operations. Some of these risks and uncertainties are interrelated, and the occurrence of one or more of them may exacerbate the effect of others. These material risks and uncertainties are not necessarily presented in order of significance. In addition to the risks set forth below and the other risks described in this Annual Report, there may be risks and uncertainties that are not currently known to us or that we currently deem to be immaterial that could materially and adversely affect our business, financial condition or operating results.

Risks Related to Macroeconomic Conditions

Changes in interest rates could have an adverse impact on our results of operations and financial condition.

Our results of operations are primarily dependent on net interest income, which is the difference between the interest earned on loans, securities, cash at the FRB and dividends received on FHLB stock, and the interest paid on deposits and borrowings. Changes in interest rates could have an adverse impact on our results of operations and financial condition because the majority of our interest-earning assets are long-term, fixed-rate loans, while the majority of our interest-bearing liabilities are shorter term, and therefore subject to a greater degree of interest rate fluctuations. This type of risk is known as interest rate risk and is affected by prevailing economic and competitive conditions that are beyond the Company's control, including general economic conditions, inflationary trends and/or monetary policies of the FRB and fiscal policies of the United States federal government.

The impact of changes in interest rates is generally observed on the income statement. The magnitude of the impact will be determined by the difference between the amount of interest-earning assets and interest-bearing liabilities, both of which either reprice or mature within a given period of time, in addition to the yields earned on interest-earning assets and rates paid on interest-bearing liabilities. This difference provides an indication of the extent to which our net interest rate spread will be impacted by changes in interest rates. In addition, changes in interest rates will impact the expected level of repricing of the Bank's mortgage-related assets and callable debt securities. Generally, as interest rates decline, the amount of interest-earning assets expected to reprice will increase as borrowers have an economic incentive to reduce the cost of their mortgage or debt, which would negatively impact the Bank's interest income to the extent deposits are not repriced lower at a faster pace. Conversely, as interest rates rise, the amount of interest-earning assets expected to reprice will decline as the economic incentive to refinance the mortgage or debt is diminished. As this occurs, the amount of interest-earning assets repricing could diminish to the point where interest-bearing liabilities reprice to a higher interest rate at a faster pace than interest-earning assets, thus negatively impacting the Bank's net interest income. For additional information about the interest-rate risk we face, see "Part II, Item 7A. Quantitative and Qualitative Disclosures about Market Risk."

Changes in interest rates can also have an adverse effect on our financial condition, as available-for-sale ("AFS") securities are reported at estimated fair value. Stockholders' equity, specifically, accumulated other comprehensive income (loss) ("AOCI"), is increased or decreased by the amount of change in the estimated fair value of our AFS securities, net of deferred income taxes. Increases in interest rates generally decrease the fair value of AFS securities, which adversely impacts

10

stockholders' equity. For additional information, see "Part II, Item 8. Financial Statements and Supplementary Data – Notes to Consolidated Financial Statements – Note 15. Accumulated Other Comprehensive Income."

Changes in interest rates, as they relate to customers, can also have an adverse impact on our financial condition and results of operations. In times of rising interest rates, default risk may increase among borrowers with adjustable-rate loans as the rates on their loans adjust upward and their payments increase. Fluctuations in interest rates also affect customer demand for loan and deposit products. Competition from financial institutions and others could affect our ability to attract and retain deposits and could result in the Bank paying more for deposits.

In addition to general changes in interest rates, changes that affect the shape of the yield curve could negatively impact the Bank. The Bank's interest-bearing liabilities are generally priced based on short-term interest rates while the majority of the Bank's interest-earning assets are priced based on long-term interest rates. Income for the Bank is primarily driven by the spread between these rates. As a result, a steeper yield curve, meaning long-term interest rates are higher than short-term interest rates, would provide the Bank with a better opportunity to increase net interest income. When the yield curve is flat, meaning long-term interest rates and short-term interest rates are essentially the same, or when the yield curve is inverted, meaning long-term interest rates are lower than short-term interest rates, the net yield between interest-earning assets and interest-bearing liabilities that reprice is compressed or diminished and would likely negatively impact the Bank's net interest income. See "Part II, Item 7A. Quantitative and Qualitative Disclosures About Market Risk" for additional information about the Bank's interest rate risk management.

An economic downturn, including a decline in real estate values, especially affecting our geographic market areas and certain regions of the country where we have commercial real estate loans or purchased loans secured by one- to four-family properties, could have an adverse impact on our business and financial results.

As we strategically grow our commercial real estate lending portfolio, we have continued to prospect for new relationships and maintain existing relationships not only in our local markets but in geographically diverse markets. As a result, we are particularly exposed to downturns in regional housing and commercial real estate markets and, to a lesser extent, housing and commercial real estate markets nationwide, along with changes in the levels of unemployment or underemployment. We monitor the current status and trends of local and national employment levels and trends and current conditions in the real estate and housing markets, as well as commercial real estate markets, in our local market areas and certain areas where we have commercial real estate loans and purchased one- to four-family loans. Decreases in real estate values could adversely affect the value of the property used as collateral for our commercial real estate and one- to four-family loans, which could cause us to realize a loss in the event of a foreclosure. Additionally, if insurance obtained by our borrowers is insufficient to cover any losses sustained to the collateral, the decreases in the value of collateral securing our loans as a result of natural disasters or other related events could adversely impact our financial condition and results of operations. If insurance coverage is unavailable to our borrowers due to the reluctance of insurance companies to renew policies covering the collateral or due to other factors, the resulting increase in cost of home ownership could affect the ability of borrowers to repay loans. Adverse conditions in our local economies and in certain areas where we have commercial real estate loans and purchased one-to four-family loans, such as inflation, unemployment, supply chain disruptions, recession, natural disasters or pandemics, or other factors beyond our control, could adversely impact the ability of our borrowers to repay their loans. Declines in collateral values and adverse economic conditions could result in increased delinquencies, non-performing assets, loan losses, and future loan loss provisions.

Risks Related to Lending Activities

The increase in commercial loans in our loan portfolio exposes us to increased lending and credit risks, which could adversely impact our financial condition and results of operations.

As part of the Company's strategic initiatives to develop a full-service commercial banking business, we are growing our commercial loan portfolio. Maintaining strong asset quality in association with the commercial loan growth is a top priority for the Bank. We are applying disciplined underwriting and ongoing credit and performance monitoring and we monitor concentration levels by collateral type, geographic location and borrowing relationship. However, there are still lending and credit risks that could adversely impact our financial condition and results of operations as commercial loans are generally considered to have different and greater credit risks than one- to four-family residential real estate loans.

Commercial loans typically have larger loan balances than one- to four-family residential loans and may involve multiple loans to groups of related borrowers. Repayment of commercial loans often depends on the successful operation of a

11

business or of the underlying property which may be affected by factors outside the borrower's control, such as adverse conditions in the real estate market, the economy, the implementation of tariffs, environmental factors, natural disasters or pandemics, and/or changes in government regulation. Also, there are risks inherent in commercial real estate construction lending as the value of the project is uncertain prior to the completion of construction and subsequent lease-up. A sudden downturn in the economy, labor and/or supply chain issues, or other unforeseen events could result in stalled projects or collateral shortfalls, thus exposing us to increased credit risk. Additionally, if we foreclose on these loans, our holding period for the collateral may be longer than for a one- to-four family residential property as there are generally fewer potential purchasers of this type of collateral.

Commercial and industrial loans are primarily made based on the identified cash flow of the borrower and secondarily on the collateral underlying the loans. A borrower's cash flow may prove to be unpredictable, and collateral securing these loans may fluctuate in value. Most often, this collateral consists of accounts receivable, inventory and equipment. Significant adverse changes in a borrower's industries and businesses could cause rapid declines in values of, and collectability associated with, those business assets, which could result in inadequate collateral coverage for our commercial and industrial loans and expose us to future losses. In the case of loans secured by accounts receivable, the availability of funds for the repayment of these loans may be substantially dependent on the ability of the borrower to collect amounts due from its clients. Inventory and equipment may depreciate over time, may be difficult to appraise, may be illiquid and may fluctuate in value based on the success of the business. If the cash flow from business operations is reduced, the borrower's ability to repay the loan may be impaired.

The deterioration of one commercial loan or a commercial borrowing relationship could cause a significant increase in the dollar amount of delinquencies, non-performing assets, net charge-offs, and future loan loss provisions. An increase in valuation allowances and charge-offs related to our commercial loan portfolio could have an adverse effect on our business, financial condition, results of operations and future prospects.

Risks Related to Cybersecurity, Third Parties, and Technology.

The occurrence of any information system failure or interruption, breach of security or cyberattack, at the Company, at its third-party service providers or counterparties may have an adverse effect on our business, reputation, financial condition and results of operations.

Information systems are essential to the conduct of our business, as we use such systems to manage our customer relationships, our general ledger, our deposits and our loans. In the normal course of our business, we collect, process, retain and transmit (by email and other electronic means) sensitive and confidential information regarding our customers, employees and others. We also outsource certain aspects of our data processing, data processing operations, remote network monitoring, engineering and managed security services to third-party service providers. In addition to confidential information regarding our customers, employees and others, we, and in some cases a third party, compile, process, transmit and store proprietary, non-public information concerning our business, operations, plans and strategies.

Information security risks for financial institutions continue to increase in part because of evolving technologies, the use of the internet and telecommunications technologies (including mobile devices) to conduct financial and other business transactions and the increased sophistication and activities of organized crime, perpetrators of fraud, hackers, terrorists and others. Cyber criminals use a variety of tactics, such as ransomware, denial of service, and theft of sensitive business and customer information to extort payment or other concessions from victims. In some cases, these attacks have caused significant impacts on other businesses' access to data and ability to provide services. We are not able to anticipate or implement effective preventive measures against all incidents of these types, especially because the techniques used change frequently and because attacks can originate from a wide variety of sources, including attacks on third-party vendors and their applications and products used by the Bank.

We use a variety of physical, procedural and technological safeguards to prevent or limit the impact of system failures, interruptions and security breaches and to protect confidential information from mishandling, misuse or loss, including detection and response mechanisms designed to contain and mitigate security incidents. However, there can be no assurance that such events will not occur or that they will be promptly detected and adequately addressed if they do, and early detection of security breaches may be thwarted by sophisticated attacks and malware designed to avoid detection. If there is a failure in or breach of our information systems, or those of a third-party service provider, the confidential and other information

12

processed and stored in, and transmitted through, such information systems could be jeopardized, or could otherwise cause interruptions or malfunctions in our operations or the operations of our customers, employees, or others.

Our business and operations depend on the secure processing, storage and transmission of confidential and other information in our information systems and those of our third-party service providers. Although we devote significant resources and management focus to ensuring the integrity of our information systems through information security measures, risk management practices, relationships with threat intelligence providers and business continuity planning, our facilities, computer systems, software and networks, and those of our third-party service providers, may be vulnerable to external or internal security breaches, acts of vandalism, unauthorized access, misuse, computer viruses or other malicious code and cyberattacks that could have a security impact. In addition, breaches of security may occur through intentional or unintentional acts by those having authorized or unauthorized access to our confidential or other information or the confidential or other information of our customers, employees or others. While we regularly conduct security and risk assessments on our systems and those of our third-party service providers, there can be no assurance that their information security protocols are sufficient to withstand a cyberattack or other security breach. Across our industry, the cost of minimizing these risks and investigating incidents has continued to increase with the frequency and sophistication of these threats.

The occurrence of any of the foregoing could subject us to litigation or regulatory scrutiny, cause us significant reputational damage or erode confidence in the security of our information systems, products and services, cause us to lose customers or have greater difficulty in attracting new customers, have an adverse effect on the value of our common stock or subject us to financial losses that may not be covered by insurance, any of which could have an adverse effect on our business, financial condition and results of operations. As information security risks and cyber threats continue to evolve, we may be required to expend significant additional resources to further enhance or modify our information security measures and/or to investigate and remediate any information security vulnerabilities or other exposures arising from operational and security risks.

New or revised laws and regulations may significantly impact our current and planned privacy, data protection and information security-related practices, the collection, use, sharing, retention and safeguarding of consumer and employee information, and current or planned business activities. Compliance with current or future privacy, data protection and information security laws could result in higher compliance and technology costs and could restrict our ability to provide certain products and services, which could have an adverse effect on our business, financial condition and results of operations.

Our customers are also targets of cyberattacks and identity theft. There continues to be instances involving financial services and consumer-based companies reporting the unauthorized disclosure of client or customer information or the destruction or theft of corporate data. Large scale identity theft could result in customers' accounts being compromised and fraudulent activities being performed in their names. We have implemented certain safeguards against these types of activities, but they may not fully protect us from financial losses. The occurrence of a security breach involving our customers' information, regardless of its origin, could damage our reputation and result in a loss of customers and business, subject us to additional regulatory scrutiny, and expose us to litigation and possible financial liability. Any of these events could have an adverse effect on our business, financial condition and results of operations. See "Part I, Item 1C. Cybersecurity" for additional discussion related to cybersecurity.

Third-party vendors subject the Bank and the Company to potential business, reputation and financial risks.

Third-party vendors are sources of operational and information security risk to the Bank and the Company, including risks associated with operation errors, information system interruptions or breaches, and unauthorized disclosures of sensitive or confidential customer information. The Bank and the Company require third-party vendors to maintain certain levels of information security; however, vendors may remain vulnerable to breaches, unauthorized access, misuse, computer viruses, and/or other malicious attacks that could ultimately compromise sensitive information. We have developed procedures and processes for selecting and monitoring third-party vendors, but ultimately are dependent on these third-party vendors to secure their information. If these vendors encounter any of these types of issues, or if we have difficulty communicating with them, we could be exposed to disruption of operations, loss of service or connectivity to customers, reputational damage, and litigation risk that could have an adverse effect on our business, financial condition and results of operations.

The failure of an external vendor to perform in accordance with the contracted arrangements under service level agreements, because of changes in the vendor's organizational structure, financial condition, support for existing products and services or

13

strategic focus or for any other reason, could be disruptive to our operations, which could have an adverse effect on our business and, in turn, our financial condition and results of operations. Additionally, replacing certain third-party vendors could also entail significant delay and expense.

We are heavily reliant on technology, and a failure to effectively implement technology initiatives or anticipate future technology needs or demands could adversely affect our business or performance.

Like most financial institutions, the Bank significantly depends on technology to deliver its products and services and to otherwise conduct business. The Bank continues to invest in new technological solutions, system upgrades, and other technology initiatives, which allows us to offer new and competitive products and services to our customers. Many of these solutions and initiatives have a significant duration, are tied to critical information systems, and require substantial resources. Although the Bank takes steps to mitigate the risks and uncertainties associated with these solutions and initiatives, there is no guarantee that they will be implemented on time, within budget, or without negative operational or customer impact. The Company and its third-party vendors may develop or incorporate artificial intelligence technology into certain business processes, services or products. The use of artificial intelligence presents several risks, including an uncertain and evolving legal and regulatory environment, along with the reliability of information generated and the complexity and rapid pace of change in artificial intelligence models. The Bank also may not succeed in anticipating its future technology needs, the technology demands of its customers, or the competitive landscape for technology. If the Bank were to falter in any of these areas, it could have an adverse effect on our business, financial condition and results of operations.

Risks Related to Competition

Strong competition may limit our growth and profitability.

The Company operates in a highly competitive environment for quality commercial banking relationships, one-to four-family lending relationships and attracting and growing deposits. Our competition includes larger national, regional and local financial institutions, savings institutions, credit unions, investment banking and mortgage brokerage firms, farm credit lenders, commercial finance companies, insurance companies, online competitors that are not confined to any specific market area, and non-bank lenders and smaller local institutions that offer aggressive pricing and specialized loan structures and banking services. We compete by offering a comprehensive suite of products and services, competitive loan pricing, and we have a strong reputation in the market areas we serve.

Our competitors may offer products and services that we do not or cannot provide if the offerings fall outside our accepted level of risk. Additionally, they may offer deposit and loan rates that we cannot offer as it may adversely impact our net interest income. The Bank cannot grow profitably without growing our deposit portfolio as those funds are generally used to fund loan growth. Our profitability depends upon our ability to compete with other entities for the same customer base.

Risks Related to Regulation

We operate in a highly regulated environment, which limits the manner and scope of our business activities, and we may be adversely affected by new and/or changes in laws and regulations or interpretation of existing laws and regulations.

We are subject to extensive regulation, supervision, and examination by the OCC, the FRB, and the FDIC. These regulatory authorities exercise broad discretion in connection with their supervisory and enforcement activities, including the ability to impose restrictions on a bank's operations, reclassify assets, determine the adequacy of a bank's ACL, and determine the level of deposit insurance premiums assessed. The CFPB has broad powers to supervise and enforce consumer protection laws, including a wide range of consumer protection laws that apply to all banks and savings institutions, like the authority to prohibit unfair, deceptive or abusive acts and practices. The CFPB also has examination and enforcement authority over all banks with regulatory assets exceeding $10 billion at four consecutive quarter-ends. There are increased direct costs, additional regulatory burdens with indirect costs, and lost revenue, mainly related to interchange fees, associated with the Bank being over $10 billion in regulatory assets at certain points in time and for four consecutive quarter-ends. As long as the Bank does not exceed $10 billion in regulatory assets for four consecutive quarter ends, it will continue to be examined for compliance with consumer protection laws and the regulations of the CFPB by the Bank's primary bank regulator, the OCC. The Dodd-Frank Act also weakens the federal preemption rules that have been applicable for national banks and federal savings associations and gives state attorneys general the ability to enforce federal consumer protection laws.

14

Any change in such regulation and oversight, whether in the form of regulatory policy, regulations, legislation, interpretation or application, could have an adverse impact on our operations. Bank regulatory agencies, such as the OCC, the FRB and the FDIC, govern the activities in which we may engage, primarily for the protection of depositors' funds, the DIF and the safety and soundness of the banking system as a whole, and not for the protection or benefit of investors. The CFPB enforces consumer protection laws and regulations for the benefit of consumers and not the protection or benefit of investors. In addition, changes in laws and regulations, or the application of these laws and regulations, may continue to impact our costs of regulatory compliance and of doing business, and otherwise affect our operations. New Presidential Executive Orders, laws and regulations may significantly affect the markets in which we do business, the markets for and value of our loans and securities, the products we offer, the fees we can charge and our ongoing operations, costs, and profitability.

The Company is also directly subject to the requirements of entities that set and interpret accounting standards such as the Financial Accounting Standards Board, and indirectly subject to the actions and interpretations of the Public Company Accounting Oversight Board, which establishes auditing and related professional practice standards for registered public accounting firms and inspects registered firms to assess their compliance with certain laws, rules, and professional standards in public company audits. These regulations, along with existing tax, accounting, securities, and monetary laws, regulations, rules, standards, policies and interpretations, control the methods by which financial institutions and their holding companies conduct business, engage in strategic and tax planning, implement strategic initiatives, and govern financial reporting.

The Company's failure to comply with laws, regulations or policies, including Presidential Executive Orders, could result in civil or criminal sanctions and money penalties by state and federal agencies, and/or reputational damage, which could have an adverse effect on the Company's business, financial condition and results of operations. See "Part I, Item 1. Business - Regulation and Supervision" for more information about the regulations to which the Company is subject.

Other Risks

The Company's ability to pay dividends and repurchase shares is subject to the ability of the Bank to make capital distributions to the Company.

The long-term ability of the Company to pay dividends to its stockholders and repurchase shares is based primarily upon the ability of the Bank to generate sufficient earnings to make capital distributions to the Company and on the availability of cash at the holding company level in the event the Bank's earnings are not sufficient to make capital distributions to the Company. Under certain circumstances, capital distributions from the Bank to the Company may be subject to regulatory approvals. See "Item 1. Business – Regulation and Supervision" for additional information.

The Company values constructive input from stockholders, and our Board of Directors and management team are committed to acting in the best interests of all stockholders. All publicly traded companies face the risk that stockholders may disagree with the composition of the Board of Directors, the Company's strategic direction, or the way the Company is managed and may seek to effect change through various strategies that range from private engagement to public filings, proxy contests, efforts to force transactions not supported by the Board of Directors, and litigation. Responding to these actions may be costly and time-consuming, disrupt the Company's operations and/or divert the attention of the Board of Directors and executive management. Such activities could interfere with the Company's ability to execute its strategic plan and to attract and retain qualified executive leadership, as well as create perceived uncertainty as to the Company's future direction, which could also affect the market price and volatility of the Company's common stock.

The Bank's bad debt recapture amount may impact the amount and timing of capital distributions to the Company.

The Bank reported a net loss on its fiscal year 2024 federal tax return due to the sale of securities in October 2023 associated with the securities strategy which resulted in negative current and accumulated earnings and profits for fiscal year 2024. As a result of the negative current and accumulated earnings and profits, capital distributions from the Bank to the holding company during fiscal year 2024 were deemed to be drawn out of the Bank's pre-1988 bad debt reserves and resulted in the recognition of income tax expense based on the amount of the capital distribution multiplied by the then-current Bank income tax rate. This additional tax expense reduced the amount of Bank earnings available to be distributed to the holding company during fiscal year 2024. During the fourth quarter of fiscal year 2025, the Bank reached a point where there was sufficient taxable income to replenish the Bank's tax accumulated earnings and profits to a positive level, allowing the Bank to make distributions to the holding company and not have that distribution subject to the pre-1988 bad debt recapture tax. Due to the Bank's expected continuing positive tax accumulated and earnings profit balance, it is anticipated that the Bank will be in a position to distribute earnings to the holding company during fiscal year 2026. Earnings distributions from the Bank to the

15

holding company will be limited to the extent necessary to prevent the Bank from re-entering a negative accumulated earnings and profit position which would require the payment of the pre-1988 bad debt recapture tax on earnings moved from the Bank to the holding company. See additional discussion regarding the Bank's pre-1988 bad debt recapture in "Part I, Item 1. Business - Taxation" and "Part II, Item 8. Financial Statements and Supplementary Data - Notes to Consolidated Financial Statements - Note 9. Income Taxes".

Our risk management and compliance programs and functions may not be effective in mitigating risk and loss.

We maintain an enterprise risk management program that is designed to identify, quantify, monitor, report, and control the risks that we face. These risks include: interest-rate, credit, liquidity, operations, compliance and litigation. We also maintain a compliance program to identify, measure, assess, and report on our adherence to applicable laws, policies and procedures. While we assess and improve these programs on an ongoing basis, there can be no assurance that our risk management or compliance programs, along with other related controls, will effectively mitigate all risk and limit losses in our business. If conditions or circumstances arise that expose flaws or gaps in our risk management or compliance programs, or if our controls do not function as designed, the performance and value of our business could be adversely affected.

The Company may not be able to attract and retain skilled employees.

The Company's success depends, in large part, on its ability to attract and retain key people. Competition for the best people can be intense, and the Company spends considerable time and resources attracting and hiring qualified people for its operations. The unexpected loss of the services of one or more of the Company's key personnel could have an adverse impact on the Company's business because of their skills, knowledge of the Company's market, and years of industry experience, as well as the difficulty of promptly finding qualified replacement personnel.

The Bank and the Company may be adversely affected by an increasing prevalence of fraud and other financial crimes.

Reported instances of fraud and related financial crimes are rising nationwide. Like all financial institutions, the Bank and the Company are vulnerable to increasing fraud losses as fraud schemes perpetrated against the Bank, the Company, and our customers continue to evolve and become more sophisticated. While the Bank and the Company have procedures and systems in place to detect, prevent, and mitigate fraud losses, fraud losses may still occur and could be material to the Bank and the Company's results of operations.