CULLEN/FROST BANKERS, INC. (CFR) Business

Verbatim Item 1 Business section from CULLEN/FROST BANKERS, INC.'s latest 10-K. Filing date: 2026-02-05. Accession: 0000039263-26-000011.

This page reproduces the company's own Item 1 Business text from the linked SEC filing. It is filer text, not grepcent analysis, scoring, or investment advice.

Informational only - not investment advice. See Disclaimer.

Extracted from Item 1 Business to the first Item 1A/1B/1C/2 boundary after HTML sanitization. Confidence: high. Source form: 10-K. Character span: 91561-177321.

Back to CFR company profile

ITEM 1. BUSINESS

The disclosures set forth in this item are qualified by Item 1A. Risk Factors and the section captioned “Forward-Looking Statements and Factors that Could Affect Future Results” in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations of this report and other cautionary statements set forth elsewhere in this report.

The Corporation

Cullen/Frost Bankers, Inc., a Texas business corporation incorporated in 1977, is a financial holding company and a bank holding company headquartered in San Antonio, Texas that provides, through its subsidiaries, a broad array of products and services throughout numerous Texas markets. The terms “Cullen/Frost,” “the Corporation,” “we,” “us” and “our” mean Cullen/Frost Bankers, Inc. and its subsidiaries, when appropriate. We offer commercial and consumer banking services, as well as trust and investment management, insurance, brokerage, mutual funds, leasing, treasury management, capital markets advisory and item processing services. At December 31, 2025, Cullen/Frost had consolidated total assets of $53.0 billion and was one of the largest independent bank holding companies headquartered in the State of Texas.

Our philosophy is to grow and prosper, building long-term relationships based on top quality service, high ethical standards, and safe, sound assets. We operate as a locally-oriented, community-based financial services organization, augmented by experienced, centralized support in select critical areas. Our local market orientation is reflected in our regional management and regional advisory boards, which are comprised of local business persons, professionals and other community representatives that assist our regional management in responding to local banking needs. Despite this local market, community-based focus, we offer many of the products available at much larger money-center financial institutions.

We serve a wide variety of industries including, among others, energy, manufacturing, services, construction, retail, telecommunications, healthcare, military and transportation. Our customer base is similarly diverse. We are not dependent upon any single industry or customer.

Our operating objectives include expansion, diversification within our markets, growth of our fee-based income, and growth internally and, to a lesser extent, through acquisitions of financial institutions, branches and financial services businesses. While we are currently focused on organic growth, we may seek merger or acquisition partners that are culturally similar and have experienced management and possess either significant market presence or have potential for improved profitability through financial management, economies of scale and expanded services. From time to time, we evaluate merger and acquisition opportunities and conduct due diligence activities related to possible transactions with other financial institutions and financial services companies. As a result, merger or acquisition discussions and, in some cases, negotiations may take place and future mergers or acquisitions involving cash, debt or equity securities may occur. Acquisitions typically involve the payment of a premium over book and market values, and, therefore, some dilution of our tangible book value and net income per common share may occur in connection with any future transaction. Our ability to engage in certain merger or acquisition transactions, whether or not any regulatory approval is required, will be dependent upon our bank regulators’ views at the time as to the capital levels, quality of management and our overall condition and their assessment of a variety of other factors. Certain merger or acquisition transactions, including those involving the acquisition of a depository institution or the assumption of the deposits of any depository institution, require formal approval from various bank regulatory authorities, which will be subject to a variety of factors and considerations.

Although Cullen/Frost is a corporate entity, legally separate and distinct from its affiliates, bank holding companies such as Cullen/Frost are required to act as a source of financial strength for their subsidiary banks. The principal source of Cullen/Frost’s income is dividends from its subsidiaries. There are certain regulatory restrictions on the extent to which these subsidiaries can pay dividends or otherwise supply funds to Cullen/Frost. See the section captioned “Supervision and Regulation” elsewhere in this item for further discussion of these matters.

Cullen/Frost’s executive offices are located at 111 W. Houston Street, San Antonio, Texas 78205, and its telephone number is (210) 220-4011.

Subsidiaries of Cullen/Frost

Frost Bank

Frost Bank, the principal operating subsidiary and sole banking subsidiary of Cullen/Frost, is a Texas-chartered bank primarily engaged in the business of commercial and consumer banking through approximately 204 financial centers across Texas in the Austin, Dallas, Fort Worth, Gulf Coast, Houston, Permian Basin, and San Antonio regions. Frost Bank also operates approximately 1,760 automated-teller machines (“ATMs”) throughout the State of Texas, the majority of which are operated in connection with branding and licensing agreements with various retailers. Frost Bank was originally chartered as a national banking association in 1899, but its origin can be traced to a mercantile partnership organized in 1868. At December 31, 2025, Frost Bank had consolidated total assets of $53.1 billion and total deposits of $43.3 billion and was one of the largest commercial banks headquartered in the State of Texas.

Significant services offered by Frost Bank include:

•Commercial Banking. Frost Bank provides commercial banking services to corporations and other business customers. Deposit products consist of traditional business checking and savings accounts, which Frost Bank offers through its traditional branches and on-line banking platforms. Loans are made for a wide variety of general corporate purposes, including financing for industrial and commercial properties and to a lesser extent, financing for interim construction related to industrial and commercial properties, financing for equipment, inventories and accounts receivable, and acquisition financing. We also originate commercial leases.

•Treasury Management Services. Frost Bank offers a full suite of treasury management services designed to help businesses optimize their cash flow, manage liquidity, and streamline their financial operations. Frost Bank offers Frost Connect, a secure digital banking platform designed to help customers manage their banking needs online including account management, fund transfers, bill payments, mobile check deposits, and access to financial tools and resources. Frost Connect includes additional features for businesses such as payroll services, cash management, and detailed financial reporting.

•Merchant Services. Frost Bank provides merchant services through its integrated point-of-sale systems designed to provide businesses with efficient and secure solutions for processing transactions at the point of sale. Frost Bank also offers business bank debit and credit cards to make business purchases.

•Correspondent Banking. Frost Bank acts as correspondent for approximately 178 financial institutions, which are primarily banks in Texas. These banks maintain deposits with Frost Bank, which offers them a full range of services including check clearing, transfer of funds, fixed income security services, and securities custody and clearance services.

•Capital Markets Division. Frost Bank’s Capital Markets Division supports the transaction needs of fixed-income institutional investors. Services include sales and trading, new issue underwriting, money market trading, advisory services and securities safekeeping and clearance. Frost Bank's Capital Markets department also provides financial services designed to support government entities, non-profit organizations, and other public sector customers. Services include traditional banking, investment and insurance services as well as services designed to help facilitate funding, manage debt, and optimize financial operations for public projects and initiatives, among other things.

•Global Trade Services. Frost Bank provides global trade services designed to support businesses engaged in international trade by providing a range of financial products and services designed to help facilitate cross-border transactions, manage risks, and optimize cash flow. Services include foreign exchange, online global trade services, and trade services, such as standby letters of credit, import/export letters of credit, demand guarantees, and documentary collections, among other things.

•Consumer Services. Frost Bank provides a full range of consumer banking services that are designed to meet the financial needs of individual customers, providing a range of products and services including a full suite of traditional deposit products, including various types of checking, savings, money market and certificate of deposit accounts; safe deposit facilities; online and mobile banking; drive-in and night deposit services; ATM’s; and consumer lending products, including home equity lines of credit, home equity loans, home improvement loans, 1-4 family residential mortgages, overdraft facilities, and other consumer loans.

•International Banking. Frost Bank provides international banking services to customers residing in or dealing with businesses located in Mexico. These services consist of accepting deposits (only payable in the U.S. in U.S. dollars), making loans (generally only in U.S. dollars), issuing letters of credit, handling foreign collections, transmitting funds, and to a limited extent, dealing in foreign exchange.

•Trust Services. Frost Bank provides a wide range of trust, investment, agency and custodial services for individual and corporate customers. These services include the administration of estates and personal trusts, as well as the management of investment accounts for individuals, employee benefit plans and charitable foundations. At December 31, 2025, the estimated fair value of trust assets was $51.0 billion, including managed assets of $26.7 billion and custody assets of $24.3 billion.

Frost Insurance Agency, Inc.

Frost Insurance Agency (“FIA”) is a wholly owned subsidiary of Frost Bank. FIA provides a broad range of insurance products and services to both business and consumer customers. Products and services include property and casualty insurance and employee benefits plans for businesses, among other things. FIA also arranges for life, disability, long-term care, property and real estate, automobile, and valuables insurance for individuals.

Frost Brokerage Services, Inc.

Frost Brokerage Services, Inc. (“FBS”) is a wholly owned subsidiary of Frost Bank that provides brokerage services and performs other transactions or operations related to the sale and purchase of securities of all types. FBS is registered as a fully disclosed introducing broker-dealer under the Securities Exchange Act of 1934 and, as such, does not hold any customer accounts or maintain custody of customer assets.

Frost Investment Advisors, LLC

Frost Investment Advisors, LLC is a registered investment advisor and a wholly owned subsidiary of Frost Bank that provides investment management services to Frost-managed mutual funds, institutions and individuals.

Frost Investment Services, LLC

Frost Investment Services, LLC is a registered investment advisor and a wholly owned subsidiary of Frost Bank that provides investment management services to individuals.

Tri–Frost Corporation

Tri-Frost Corporation is a wholly owned subsidiary of Frost Bank that primarily holds securities and receives cash flows related to principal and interest on the securities until such time that the securities mature.

Cullen/Frost Capital Trust II

Cullen/Frost Capital Trust II (“Trust II”) is a Delaware statutory business trust formed in 2004 for the purpose of issuing $120.0 million in trust preferred securities and lending the proceeds to Cullen/Frost. Cullen/Frost guarantees, on a limited basis, payments of distributions on the trust preferred securities and payments on redemption of the trust preferred securities. Trust II is a variable interest entity for which we are not the primary beneficiary. As such, the accounts of Trust II are not included in our consolidated financial statements. See our accounting policy related to consolidation in Note 1 - Summary of Significant Accounting Policies in the notes to consolidated financial statements included in Item 8. Financial Statements and Supplementary Data elsewhere in this report.

Although the accounts of Trust II are not included in our consolidated financial statements, the $120.0 million in trust preferred securities issued by Trust II are included in the regulatory capital of Cullen/Frost during the reported periods. See the section captioned “Supervision and Regulation - Capital Requirements” for a discussion of the regulatory capital treatment of our trust preferred securities.

Other Subsidiaries

Cullen/Frost has various other subsidiaries that are not significant to the consolidated entity.

Operating Segments

Our operations are managed along two reportable operating segments consisting of Banking and Frost Wealth Advisors. See the sections captioned “Results of Segment Operations” in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations and Note 17 - Operating Segments in the notes to consolidated financial statements included in Item 8. Financial Statements and Supplementary Data elsewhere in this report.

Competition

There is significant competition among commercial banks in our market areas. In addition, we also compete with other providers of financial services, such as savings and loan associations, credit unions, consumer finance companies, securities firms, private equity and debt funds, insurance companies, insurance agencies, commercial finance and leasing companies, full service brokerage firms, discount brokerage firms, and financial/wealth technology (“fintech/wealthtech”) firms. Some of our competitors have greater resources and, as such, may have higher lending limits and may offer other services that are not provided by us. We generally compete on the basis of customer service and responsiveness to customer needs, available loan and deposit products, the rates of interest charged on loans, the rates of interest paid for funds, and the availability and pricing of trust, brokerage and insurance services. For further discussion, see the section captioned “We Operate In A Highly Competitive Industry and Market Area” in Item 1A. Risk Factors.

Supervision and Regulation

Cullen/Frost, Frost Bank and most of its non-banking subsidiaries are subject to extensive regulation under federal and state laws. The regulatory framework is intended primarily for the protection of depositors, federal deposit insurance funds and the banking system as a whole and not for the protection of shareholders and creditors.

Significant elements of the laws and regulations applicable to Cullen/Frost and its subsidiaries are described below. The description is qualified in its entirety by reference to the full text of the statutes, regulations and policies that are described. Also, such statutes, regulations and policies are continually under review by Congress and state legislatures and federal and state regulatory agencies. A change in statutes, regulations or regulatory policies applicable to Cullen/Frost and its subsidiaries could have a material effect on our business, financial condition or our results of operations.

Regulatory Agencies

Cullen/Frost is a legal entity separate and distinct from Frost Bank and its other subsidiaries. As a financial holding company and a bank holding company, Cullen/Frost is regulated under the Bank Holding Company Act of 1956, as amended (“BHC Act”), and it and its subsidiaries are subject to inspection, examination and supervision by the Federal Reserve Board. The BHC Act provides generally for “umbrella” regulation of financial holding companies such as Cullen/Frost by the Federal Reserve Board, and for functional regulation of banking activities by bank regulators, securities activities by securities regulators, and insurance activities by insurance regulators. Cullen/Frost is also under the jurisdiction of the Securities and Exchange Commission (“SEC”) and is subject to the disclosure and regulatory requirements of the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended, as administered by the SEC. Cullen/Frost’s common stock is listed on the New York Stock Exchange (“NYSE”) under the trading symbol “CFR” and our Depositary Shares, each representing a 1/40th interest in a share of our 4.450% Non-Cumulative Perpetual Preferred Stock, Series B, is listed on the NYSE under the trading symbol “CFR PrB.” Accordingly, Cullen/Frost is also subject to the rules of the NYSE for listed companies.

Frost Bank is a Texas state chartered bank and a member of the Federal Reserve System. Accordingly, the Texas Department of Banking and the Federal Reserve Board are the primary regulators of Frost Bank. Deposits at Frost Bank are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

All member banks of the Federal Reserve System, including Frost Bank, are required to hold stock in the Federal Reserve System's Reserve Banks in an amount equal to six percent of their capital stock and surplus (half paid to acquire the stock with the remainder held as a cash reserve). Member banks do not have any control over the Federal Reserve System as a result of owning the stock and the stock cannot be sold or traded. The annual dividend rate for larger member banks, including Frost Bank, is tied to 10-year U.S. Treasuries with the maximum dividend rate

capped at six percent. The total amount of stock dividends that Frost Bank received from the Federal Reserve totaled $1.5 million in 2025, $1.5 million in 2024 and $1.4 million in 2023.

Most of our non-bank subsidiaries also are subject to regulation by the Federal Reserve Board and other federal and state agencies. Frost Brokerage Services, Inc. is regulated by the SEC, the Financial Industry Regulatory Authority (“FINRA”) and state securities regulators. Frost Investment Advisors, LLC and Frost Investment Services, LLC are subject to the disclosure and regulatory requirements of the Investment Advisors Act of 1940, as administered by the SEC. Our insurance subsidiary is subject to regulation by applicable state insurance regulatory agencies. Other non-bank subsidiaries are subject to both federal and state laws and regulations. Frost Bank and its affiliates are also subject to supervision, regulation, examination and enforcement by the Consumer Financial Protection Bureau (“CFPB”) and state regulators with respect to consumer protection laws and regulations.

Bank Holding Company Activities

In general, the BHC Act limits the business of bank holding companies to banking, managing or controlling banks and other activities that the Federal Reserve Board has determined to be so closely related to banking as to be a proper incident thereto. In addition, bank holding companies that qualify and elect to be financial holding companies may engage in any activity, or acquire and retain the shares of a company engaged in any activity, that is either (i) financial in nature or incidental to such financial activity (as determined by the Federal Reserve Board in consultation with the Secretary of the Treasury) or (ii) complementary to a financial activity and does not pose a substantial risk to the safety and soundness of depository institutions or the financial system generally (as solely determined by the Federal Reserve Board), without prior approval of the Federal Reserve Board. Activities that are financial in nature include securities underwriting and dealing, insurance underwriting and making merchant banking investments, among others.

To maintain financial holding company status, a financial holding company and all of its depository institution subsidiaries must be “well capitalized” and “well managed.” A depository institution subsidiary is considered to be “well capitalized” if it satisfies the requirements for this status discussed in the section captioned “Prompt Corrective Action,” elsewhere in this item. A depository institution subsidiary is considered “well managed” if it received a composite rating and management rating of at least “satisfactory” in its most recent examination. A financial holding company’s status will also depend upon it maintaining its status as “well capitalized” and “well managed” under applicable Federal Reserve Board regulations. If a financial holding company ceases to meet these capital and management requirements, the BHC Act, and the Federal Reserve Board’s regulations provide that the financial holding company must enter into a confidential agreement with the Federal Reserve Board to comply with all applicable capital and management requirements. Until the financial holding company returns to compliance, the Federal Reserve Board may impose limitations or conditions on the conduct of its activities, and the company may not commence any of the broader financial activities permissible for financial holding companies or acquire a company engaged in such financial activities without prior approval of the Federal Reserve Board. If the company does not return to compliance within 180 days, the Federal Reserve Board may require divestiture of the holding company’s depository institutions. Bank holding companies and banks must also be both well capitalized and well managed in order to acquire banks located outside their home state.

In order for a financial holding company to commence any new activity permitted by the BHC Act or to acquire a company engaged in any new activity permitted by the BHC Act, each insured depository institution subsidiary of the financial holding company must have received a rating of at least “satisfactory” in its most recent Community Reinvestment Act “CRA” performance evaluation. See the section captioned “Community Reinvestment Act” elsewhere in this item.

The Federal Reserve Board has the power to order any bank holding company or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the Federal Reserve Board has reasonable grounds to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company.

The BHC Act, the Bank Merger Act, the Texas Finance Code and other federal and state statutes regulate acquisitions of commercial banks and their parent holding companies. The BHC Act requires the prior approval of the Federal Reserve Board for the direct or indirect acquisition by a bank holding company of more than 5.0% of the voting shares of a commercial bank or its parent holding company. Under the Bank Merger Act, the prior approval of the Federal Reserve Board or other appropriate bank regulatory authority is required for a member bank to merge with another bank or purchase substantially all of the assets or assume any deposits of another bank. In reviewing

applications seeking approval of merger and acquisition transactions, the bank regulatory authorities will consider, among other things, the competitive effect and public benefits of the transactions, the applicant's managerial and financial resources, the capital position of the combined organization, the risks to the stability of the U.S. banking or financial system (e.g., systemic risk), the applicant’s performance record under the CRA (see the section captioned “Community Reinvestment Act” elsewhere in this item) and its compliance with law, including fair lending, fair housing and other consumer protection laws, and the effectiveness of the subject organizations in combating money laundering activities.

Dividends and Stock Repurchases

The principal source of Cullen/Frost’s liquidity is dividends from Frost Bank. The prior approval of the Federal Reserve Board is required if the total of all dividends declared by a state-chartered member bank in any calendar year would exceed the sum of the bank’s net profits for that year and its retained net profits for the preceding two calendar years, less any required transfers to surplus or to fund the retirement of preferred stock. Federal law also prohibits a state-chartered, member bank from paying dividends that would be greater than the bank’s undivided profits. Frost Bank is also subject to limitations under Texas state law regarding the level of dividends that may be paid. Under the foregoing dividend restrictions, and while maintaining its “well capitalized” status, Frost Bank could pay aggregate dividends of approximately $977.4 million to Cullen/Frost, without obtaining affirmative governmental approvals, at December 31, 2025. This amount is not necessarily indicative of amounts that may be paid or available to be paid in future periods.

In addition, Cullen/Frost and Frost Bank are subject to other regulatory policies and requirements relating to the payment of dividends, including requirements to maintain adequate capital above regulatory minimums. The appropriate federal regulatory authority is authorized to determine under certain circumstances relating to the financial condition of a bank holding company or a bank that the payment of dividends would be an unsafe or unsound practice and to prohibit payment thereof. Additionally, it is Federal Reserve policy that bank holding companies generally should pay dividends on common stock only out of net income available to common shareholders over the past year and only if the prospective rate of earnings retention appears consistent with the organization’s current and expected future capital needs, asset quality and overall financial condition. Federal Reserve policy also provides that a bank holding company should inform the Federal Reserve reasonably in advance of declaring or paying a dividend that exceeds earnings for the period for which the dividend is being paid or that could result in a material adverse change to the bank holding company’s capital structure.

In certain circumstances, Cullen/Frost’s repurchases of its common stock may be subject to a prior approval or notice requirement under other regulations, policies or supervisory expectations of the Federal Reserve Board. Any redemption or repurchase of preferred stock or subordinated debt remains subject to the prior approval of the Federal Reserve Board.

The Inflation Reduction Act of 2022 (the “IRA”) imposes a 1% excise tax on the fair market value of stock repurchased after December 31, 2022 by publicly traded U.S. corporations. With certain exceptions, the value of stock repurchased is determined net of stock issued in the year, including shares issued pursuant to compensatory arrangements.

Transactions with Affiliates

Transactions between Frost Bank and its subsidiaries, on the one hand, and Cullen/Frost or any other subsidiary, on the other hand, are regulated under federal banking law. The Federal Reserve Act imposes quantitative and qualitative requirements and collateral requirements on covered transactions by Frost Bank with, or for the benefit of, its affiliates, and generally requires those transactions to be on terms at least as favorable to Frost Bank as if the transaction were conducted with an unaffiliated third party. Covered transactions are defined by statute to include a loan or extension of credit, as well as a purchase of securities issued by an affiliate, a purchase of assets (unless otherwise exempted by the Federal Reserve Board) from the affiliate, certain derivative transactions that create a credit exposure to an affiliate, the acceptance of securities issued by the affiliate as collateral for a loan, and the issuance of a guarantee, acceptance or letter of credit on behalf of an affiliate. In general, any such transaction by Frost Bank or its subsidiaries must be limited to certain thresholds on an individual and aggregate basis and, for credit transactions with any affiliate, must be secured by designated amounts of specified collateral.

Federal law also limits a bank’s authority to extend credit to its directors, executive officers and 10% stockholders, as well as to entities controlled by such persons. Among other things, extensions of credit to insiders are required to be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with unaffiliated persons. Also, the terms of such extensions of credit may not involve more than the normal risk of non-repayment or present other unfavorable features and may not exceed certain limitations on the amount of credit extended to such persons individually and in the aggregate.

Source of Strength Doctrine

Federal Reserve Board policy and federal law require bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. Under this requirement, Cullen/Frost is expected to commit resources to support Frost Bank, including at times when Cullen/Frost may not be in a financial position to provide such resources. Any capital loans by a bank holding company to any of its subsidiary banks are subordinate in right of payment to depositors and to certain other indebtedness of such subsidiary banks. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Capital Requirements

Cullen/Frost and Frost Bank are each required to comply with applicable capital adequacy standards adopted by the Federal Reserve Board (the “Basel III Capital Rules”) and codified in 12 C.F.R. Part 217. The Basel III Capital Rules define qualifying capital instruments and specify minimum amounts of capital as a percentage of assets that banking organizations are required to maintain. Under the Basel III Capital Rules, risk-based capital ratios are calculated by dividing Common Equity Tier 1 (“CET1”) capital, Tier 1 capital and total capital, respectively, by risk-weighted assets. Assets and off-balance sheet credit equivalents are assigned a risk weight based primarily on supervisory assessments of relative credit risk.

The Basel III Capital Rules require Cullen/Frost and Frost Bank to maintain the following:

•A minimum ratio of Common Equity Tier 1 (“CET1”) to risk-weighted assets of at least 4.5%, plus a 2.5% “capital conservation buffer” that is composed entirely of CET1 capital (resulting in a minimum ratio of CET1 to risk-weighted assets of 7.0%);

•A minimum ratio of Tier 1 capital to risk-weighted assets of at least 6.0%, plus the capital conservation buffer (resulting in a minimum Tier 1 capital ratio of 8.5%);

•A minimum ratio of total capital (Tier 1 capital plus Tier 2 capital) to risk-weighted assets of at least 8.0%, plus the capital conservation buffer (resulting in a minimum total capital ratio of 10.5%); and

•A minimum leverage ratio of 4.0%, calculated as the ratio of Tier 1 capital to average consolidated assets as reported on consolidated financial statements (known as the “leverage ratio”).

The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions that fail to meet the effective minimum ratios once the capital conservation buffer is taken into account, as detailed above, will be subject to constraints on capital distributions, including dividends and share repurchases, and certain discretionary executive compensation. The severity of the constraints depends on the amount of the shortfall and the institution’s “eligible retained income” (that is, the greater of (i) net income for the preceding four quarters, net of distributions and associated tax effects not reflected in net income and (ii) average net income over the preceding four quarters).

The Basel III Capital Rules also provide for a number of deductions from and adjustments to CET1. As non-advanced approaches organizations under the Basel III Capital Rules, Cullen/Frost and Frost Bank are subject to rules that provide for simplified capital requirements relating to the threshold deductions. These include, for example, the requirement that certain deferred tax assets and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 25% of CET1.

In addition, under the general risk-based capital rules, the effects of accumulated other comprehensive income items included in capital were excluded for the purposes of determining regulatory capital ratios. Under the Basel III Capital Rules, the effects of certain accumulated other comprehensive income items are not excluded; however, non-advanced approaches banking organizations, including Cullen/Frost and Frost Bank, were able to make a one-time

permanent election to continue to exclude these items. Both Cullen/Frost and Frost Bank made this election in order to avoid significant variations in the level of capital depending upon the impact of interest rate fluctuations on the fair value of their available-for-sale securities portfolio. Under the Basel III Capital Rules, trust preferred securities no longer included in our Tier 1 capital may nonetheless be included as a component of Tier 2 capital on a permanent basis without phase-out.

In February 2019, the federal bank regulatory agencies issued a final rule (the “2019 CECL Rule”) that revised certain capital regulations to account for changes to credit loss accounting under U.S. GAAP. The 2019 CECL Rule included a transition option that allows banking organizations to phase in, over a three-year period, the day-one adverse effects of adopting a new accounting standard related to the measurement of current expected credit losses (“CECL”) on their regulatory capital ratios (three-year transition option). In March 2020, the federal bank regulatory agencies issued an interim final rule that maintains the three-year transition option of the 2019 CECL Rule and also provided banking organizations that were required under U.S. GAAP (as of January 2020) to implement CECL before the end of 2020 the option to delay for two years an estimate of the effect of CECL on regulatory capital, relative to the incurred loss methodology’s effect on regulatory capital, followed by a three-year transition period (five-year transition option). We elected to adopt the five-year transition option. This CECL transitional adjustment totaled $15.4 million at December 31, 2024, after which point the transitional period ended.

The Basel III Capital Rules prescribe a standardized approach for risk weightings that expanded the risk-weighting categories from the general risk-based capital rules to a much larger and more risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. government and agency securities, to 600% for certain equity exposures (and higher percentages for certain other types of interests), and resulting in higher risk weights for a variety of asset categories.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms. Among other things, these standards revised the Basel Committee’s standardized approach for credit risk (including the recalibration of risk weights and the introduction of new capital requirements for certain “unconditionally cancellable commitments,” such as unused credit card lines of credit) and provided a new standardized approach for operational risk capital. Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches banking organizations, and therefore not to Cullen/Frost or Frost Bank.

In July 2023, the federal banking regulators proposed revisions to the Basel III Capital Rules to implement the Basel Committee’s 2017 standards and make other changes to the Basel III Capital Rules. The proposal introduced revised credit risk, equity risk, operational risk, credit valuation adjustment risk and market risk requirements, among other changes, which would substantially increase the levels of required capital. Nonetheless, these revised capital requirements would not apply to us because Cullen/Frost and Frost Bank each have less than $100 billion in total consolidated assets and trading assets and liabilities below the threshold for market risk requirements. The Federal Reserve has indicated that it expects a revised proposal will be issued in early 2026. The revised proposal is not expected to apply to us.

Liquidity Requirements

The Basel III liquidity framework and regulations of the Federal Reserve require that certain banks and bank holding companies measure their liquidity against specific liquidity tests. One test, referred to as the liquidity coverage ratio (“LCR”), is designed to ensure that the banking entity maintains an adequate level of unencumbered high-quality liquid assets equal to the entity’s expected net cash outflow for a 30-day time horizon (or, if greater, 25% of its expected total cash outflow) under an acute liquidity stress scenario. The other test, referred to as the net stable funding ratio (“NSFR”), is designed to promote more medium- and long-term funding of the assets and activities of banking entities over a one-year time horizon. Rules applicable to certain large banking organizations have been implemented for LCR and for NSFR; however, based on our asset size, these rules do not currently apply to Cullen/Frost and Frost Bank.

Prompt Corrective Action

The Federal Deposit Insurance Act, as amended (the “FDIA”) requires among other things, the federal banking agencies to take “prompt corrective action” in respect of depository institutions that do not meet minimum capital requirements. The FDIA includes the following five capital tiers: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” and “critically undercapitalized.”

A bank will be (i) “well capitalized” if the institution has a total risk-based capital ratio of 10.0% or greater, a CET1 capital ratio of 6.5% or greater, a Tier 1 risk-based capital ratio of 8.0% or greater, and a leverage ratio of 5.0% or greater, and is not subject to any order or written directive by any such regulatory authority to meet and maintain a specific capital level for any capital measure; (ii) “adequately capitalized” if the institution has a total risk-based capital ratio of 8.0% or greater, a CET1 capital ratio of 4.5% or greater, a Tier 1 risk-based capital ratio of 6.0% or greater, and a leverage ratio of 4.0% or greater and is not “well capitalized”; (iii) “undercapitalized” if the institution has a total risk-based capital ratio that is less than 8.0%, a CET1 capital ratio less than 4.5%, a Tier 1 risk-based capital ratio of less than 6.0% or a leverage ratio of less than 4.0%; (iv) “significantly undercapitalized” if the institution has a total risk-based capital ratio of less than 6.0%, a CET1 capital ratio less than 3.0%, a Tier 1 risk-based capital ratio of less than 4.0% or a leverage ratio of less than 3.0%; and (v) “critically undercapitalized” if the institution’s tangible equity is equal to or less than 2.0% of average quarterly tangible assets. An institution may be downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios if it is determined to be in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters. A bank’s capital category is determined solely for the purpose of applying prompt corrective action regulations, and the capital category may not constitute an accurate representation of the bank’s overall financial condition or prospects for other purposes.

The FDIA prohibits an insured depository institution from accepting brokered deposits or offering interest rates on any deposits significantly higher than the prevailing rate in the bank’s normal market area or nationally (depending upon where the deposits are solicited), unless it is (i) well capitalized, or (ii) adequately capitalized and receives a waiver from the FDIC.

Additionally, the FDIA generally prohibits a depository institution from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the depository institution would thereafter be “undercapitalized.” “Undercapitalized” institutions are subject to growth limitations and are required to submit a capital restoration plan. The agencies may not accept such a plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the depository institution’s capital. In addition, for a capital restoration plan to be acceptable, the depository institution’s parent holding company must guarantee that the institution will comply with such capital restoration plan. The bank holding company must also provide appropriate assurances of performance. The aggregate liability of the parent holding company is limited to the lesser of (i) an amount equal to 5.0% of the depository institution’s total assets at the time it became undercapitalized and (ii) the amount which is necessary (or would have been necessary) to bring the institution into compliance with all capital standards applicable with respect to such institution as of the time it fails to comply with the plan. If a depository institution fails to submit an acceptable plan, it is treated as if it is “significantly undercapitalized.”

“Significantly undercapitalized” depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become “adequately capitalized,” requirements to reduce total assets, and cessation of receipt of deposits from correspondent banks. “Critically undercapitalized” institutions are subject to the appointment of a receiver or conservator.

The appropriate federal banking agency may, under certain circumstances, reclassify a well capitalized insured depository institution as adequately capitalized. The FDIA provides that an institution may be reclassified if the appropriate federal banking agency determines (after notice and opportunity for hearing) that the institution is in an unsafe or unsound condition or deems the institution to be engaging in an unsafe or unsound practice. The appropriate agency is also permitted to require an adequately capitalized or undercapitalized institution to comply with the supervisory provisions as if the institution were in the next lower category (but not treat a significantly undercapitalized institution as critically undercapitalized) based on supervisory information other than the capital levels of the institution.

As of December 31, 2025, Frost Bank, was “well capitalized” based on the aforementioned ratios. For further information regarding the capital ratios and leverage ratio of Cullen/Frost and Frost Bank see the discussion under the section captioned “Capital and Liquidity” included in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations and Note 8 - Capital and Regulatory Matters in the notes to consolidated financial statements included in Item 8. Financial Statements and Supplementary Data, elsewhere in this report.

The prompt corrective action regulations do not apply to bank holding companies. However, the Federal Reserve Board is authorized to take appropriate action at the bank holding company level, based upon the undercapitalized status of the bank holding company’s depository institution subsidiaries.

Safety and Soundness Standards

The FDIA requires the federal bank regulatory agencies to prescribe standards, by regulations or guidelines, relating to internal controls, information systems and internal audit systems, loan documentation, credit underwriting, interest rate risk exposure, asset growth, asset quality, earnings, stock valuation and compensation, fees and benefits, and such other operational and managerial standards as the agencies deem appropriate. Guidelines adopted by the federal bank regulatory agencies establish general standards relating to internal controls and information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth and compensation, fees and benefits. In general, the guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines. The guidelines prohibit excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal stockholder. In addition, the agencies adopted regulations that authorize, but do not require, an agency to order an institution that has been given notice by an agency that it is not satisfying any of such safety and soundness standards to submit a compliance plan. If, after being so notified, an institution fails to submit an acceptable compliance plan or fails in any material respect to implement an acceptable compliance plan, the agency must issue an order directing action to correct the deficiency and may issue an order directing other actions of the types to which an undercapitalized institution is subject under the “prompt corrective action” provisions of the FDIA. See “Prompt Corrective Action” above. If an institution fails to comply with such an order, the agency may seek to enforce such order in judicial proceedings and to impose civil money penalties and cease and desist orders.

In October 2025, the FDIC and OCC issued a proposed rule that would define the term “unsafe or unsound practice” for purposes of their enforcement powers under the FDIA. The proposed definition would focus on whether the practice is likely to materially harm, or already has materially harmed, the financial condition of an institution. The Federal Reserve has not issued a similar proposal.

Deposit Insurance

Deposits at Frost Bank are insured up to applicable limits by the Deposit Insurance Fund (“DIF”) of the FDIC and Frost Bank is subject to deposit insurance assessments to maintain the DIF. Deposit insurance assessments are based on average total assets minus average tangible equity. For larger institutions, such as Frost Bank, the FDIC uses a performance score and a loss-severity score that are used to calculate an initial assessment rate. In calculating these scores, the FDIC uses a bank’s capital level and supervisory ratings and certain financial measures to assess an institution’s ability to withstand asset-related stress and funding-related stress. The FDIC has the ability to make discretionary adjustments to the total score based upon significant risk factors that are not adequately captured in the calculations.

Under the FDIA, the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC. In addition, the FDIC is authorized to conduct examinations of and require reporting by FDIC-insured institutions.

In October 2022, the FDIC adopted a final rule that increased the initial base deposit insurance assessment rate schedules uniformly by 2 basis points beginning with the first quarterly assessment period of 2023. The increased assessment was expected to improve the likelihood that the DIF reserve ratio would reach the statutory minimum of 1.35% by the statutory deadline prescribed under the FDIC’s amended restoration plan.

In November 2023, the FDIC issued a final rule to implement a special assessment to recover losses to the DIF incurred as a result of bank failures earlier that year and the FDIC's use of the systemic risk exception to cover certain deposits that were otherwise uninsured. The special assessment was based on estimated uninsured deposits as of December 31, 2022 (excluding the first $5.0 billion) and was assessed at a quarterly rate of 3.36 basis points, over eight quarterly assessment periods, beginning in the first quarter of 2024. As a result of this final rule, we accrued $51.5 million ($40.7 million after tax) related to this assessment in 2023. This amount was based on our estimate of the full amount of the assessment at that time. During 2024, the FDIC increased their loss estimate related to the aforementioned bank failures. As a result, we accrued an additional $9.0 million ($7.1 million after tax) in 2024. At

that time, due to the increased estimate of losses, the FDIC also projected that the special assessment will be collected for an additional two quarters beyond the initial eight-quarter collection period, at a lower rate.

In December 2025, based upon the first six quarterly collections of the special assessment and anticipated collections for the seventh quarterly special assessment, the FDIC issued an interim final rule to amend the collection of the special assessment to reduce the eighth quarterly assessment rate from 3.36 basis points to 2.97 basis points. Because the cumulative amount collected through the initial eight quarter special assessment period is projected to equal the FDIC’s loss estimate, the additional two quarter extend assessment period was removed. In light this interim final rule, we reversed a total of $9.7 million ($7.7 million after tax) of our special deposit insurance assessment accrual based upon a decrease in expected future payments related to the special deposit insurance assessment. The interim final rule also requires the FDIC to provide an offset to regular quarterly deposit insurance assessments for institutions subject to the special assessment if the aggregate amount collected exceeds estimated losses following the resolution of pending litigation, and again following the termination of the receiverships. As provided for in the special assessment rule, if losses at the termination of the receiverships exceed the amount collected, the FDIC will implement a one-time final shortfall special assessment to ensure the full amount of actual losses is recovered as required by law. The extent to which any such future offsets or a future one-time shortfall special assessment will impact our future deposit insurance expense is currently uncertain.

Enhanced Prudential Standards

The Federal Reserve Board is required to monitor emerging risks to financial stability and enact enhanced supervision and prudential standards applicable to large bank holding companies and certain non-bank covered companies designated as systemically important by the Financial Stability Oversight Council. The Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) mandates that certain regulatory requirements applicable to these systemically important financial institutions be more stringent than those applicable to other financial institutions. The enhanced prudential standards rules, as amended in 2019, require bank holding companies with consolidated assets in excess of $50 billion, including Cullen/Frost, to maintain a risk committee that approves and periodically reviews its risk-management policies and oversees its risk-management framework.

Resolution Planning

The FDIC requires certain insured depository institutions (“IDIs”) with more than $50 billion in total consolidated assets to submit to the FDIC periodic plans for resolution in the event of the institution’s failure. In June 2024, the FDIC finalized amendments to the resolution planning requirements for IDIs with $50 billion or more in total assets. The amendments require IDIs with between $50 billion and $100 billion in assets, which includes Frost Bank, to submit informational filings on a three-year cycle, with an interim supplement updating key information submitted in the off years. The final rule became effective October 1, 2024. Frost Bank's initial informational filing is due on April 1, 2026.

In December 2025, the FDIC announced its intention to propose amendments to its resolution planning rule to codify content requirement exemptions and make additional changes that take into account key findings from its review of 2025 plan submissions. In light of these plans, the FDIC has suspended submission requirements for Group B IDIs, which includes Frost Bank, subsequent to any full resolution submissions scheduled to be filed on or before April 1, 2026 or July 1, 2026 until such time as the amendments to the resolution planning rules are finalized.

The Volcker Rule

The so-called Volcker Rule under the Dodd-Frank Act restricts banks and their affiliates from engaging in proprietary trading and investing in and sponsoring hedge funds and private equity funds. The Volcker Rule does not significantly impact the operations of Cullen/Frost and its subsidiaries as we do not have any significant engagement in the businesses prohibited by the Volcker Rule.

Depositor Preference

The FDIA provides that, in the event of the “liquidation or other resolution” of an insured depository institution, the claims of depositors of the institution, including the claims of the FDIC as subrogee of insured depositors, and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution. If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors, including depositors whose

deposits are payable only outside of the United States and the parent bank holding company, with respect to any extensions of credit they have made to such insured depository institution.

Interchange Fees

Under the Durbin Amendment to the Dodd-Frank Act, the Federal Reserve adopted rules establishing standards for assessing whether the interchange fees that may be charged with respect to certain electronic debit transactions are “reasonable and proportional” to the costs incurred by issuers for processing such transactions.

Interchange fees, or “swipe” fees, are charges that merchants pay to us and other card-issuing banks for processing electronic payment transactions. Federal Reserve Board rules applicable to financial institutions that have assets of $10 billion or more provide that the maximum permissible interchange fee for an electronic debit transaction is the sum of 21 cents per transaction and 5 basis points multiplied by the value of the transaction. An upward adjustment of no more than 1 cent to an issuer’s debit card interchange fee is allowed if the card issuer develops and implements policies and procedures reasonably designed to achieve certain fraud-prevention standards. The Federal Reserve Board also has rules governing routing and exclusivity that require issuers to offer two unaffiliated networks for routing transactions on each debit or prepaid product. In August 2025, the U.S. District Court for the District of North Dakota ruled to vacate the Federal Reserve’s current interchange rules but simultaneously stayed its own vacatur pending appeal to the circuit court. The outcome of this litigation could significantly and adversely affect the fees banks can charge on debit card transactions.

In October 2023, the Federal Reserve issued a proposal under which the maximum permissible interchange fee for an electronic debit transaction would be the sum of 14.4 cents per transaction and 4 basis points multiplied by the value of the transaction. Furthermore, the fraud-prevention adjustment would increase from a maximum of 1 cent to 1.3 cents per debit card transaction. The proposal would adopt an approach for future adjustments to the interchange fee cap, which would occur every other year based on issuer cost data gathered by the Federal Reserve from large debit card issuers. The comment period for this proposal ended in May 2024. The extent to which any such proposed changes in permissible interchange fees will impact our future revenues is currently uncertain.

Consumer Financial Protection

We are subject to a number of federal and state consumer protection laws that extensively govern our relationship with our customers. These laws include the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Truth in Lending Act, the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Home Mortgage Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Fair Debt Collection Practices Act, the Service Members Civil Relief Act and these laws’ respective state-law counterparts, as well as state usury laws and laws regarding unfair and deceptive acts and practices. These and other federal laws, among other things, require disclosures of the cost of credit and terms of deposit accounts, provide substantive consumer rights, prohibit discrimination in credit transactions, regulate the use of credit report information, provide financial privacy protections, prohibit unfair, deceptive and abusive practices, restrict our ability to raise interest rates and subject us to substantial regulatory oversight. Violations of applicable consumer protection laws can result in significant potential liability from litigation brought by customers, including actual damages, restitution and attorneys’ fees. Federal bank regulators, state attorneys general and state and local consumer protection agencies may also seek to enforce consumer protection requirements and obtain these and other remedies, including regulatory sanctions, customer rescission rights, action by the state and local attorneys general in each jurisdiction in which we operate and civil money penalties. Failure to comply with consumer protection requirements may also result in our failure to obtain any required bank regulatory approval for merger or acquisition transactions we may wish to pursue or our prohibition from engaging in such transactions even if approval is not required.

The Consumer Financial Protection Bureau (“CFPB”) is a federal agency responsible for implementing, examining and enforcing compliance with federal consumer protection laws. The CFPB has broad rulemaking authority for a wide range of consumer financial laws that apply to all banks, including, among other things, laws relating to fair lending and the authority to prohibit “unfair, deceptive or abusive” acts and practices. Abusive acts or practices are defined as those that materially interfere with a consumer’s ability to understand a term or condition of a consumer financial product or service or take unreasonable advantage of a consumer’s (i) lack of financial savvy, (ii) inability to self-protect in the selection or use of consumer financial products or services, or (iii) reasonable reliance on a covered entity to act in the consumer’s interests. The CFPB can issue cease-and-desist orders against banks and other entities that violate consumer financial laws. The CFPB may also institute a civil action against an entity in violation of federal consumer financial law in order to impose a civil penalty or injunction. The CFPB has

examination and enforcement authority over all banks with more than $10 billion in assets, as well as their affiliates. Banking regulators take into account compliance with consumer protection laws when considering approval of a proposed transaction.

In October 2024, the CFPB issued a final rule that requires a provider of payment accounts or products, such as a bank, to make data available to consumers, free upon request, regarding the products or services they obtain from the provider. Any such data provider is also required to make such data available to third parties, with the consumer’s express authorization and through an interface that satisfies formatting, performance, and security standards, for the purpose of such third parties providing the consumer with financial products or services requested by the consumer. Data required to be made available under the rule includes transaction information, account balance, account and routing numbers, terms and conditions, upcoming bill information, and certain account verification data. The final rule is intended to give consumers control over their financial data, including with whom it is shared, and encourage competition in the provision of consumer financial products or services. The rule is the subject of litigation, which is currently stayed while the CFPB considers revisions to the rule.

During 2025, the CFPB reduced its staff by over 80%. The reduction in force is the subject of litigation, and the staffing cuts are currently stayed pending the federal circuit court's en banc rehearing of the case. The impact of these developments on banking organizations subject to CFPB regulation and supervision, including Cullen/Frost, is uncertain. States and state attorneys general may increase regulatory, investigative and enforcement activity with respect to consumer protection, in response to changes in regulation, supervision and enforcement of consumer protection laws by federal regulators.

Community Reinvestment Act

The CRA requires depository institutions to assist in meeting the credit needs of their market areas consistent with safe and sound banking practice. Under the CRA, each depository institution is required to help meet the credit needs of its market areas by, among other things, providing credit to low- and moderate-income individuals and communities. Depository institutions are periodically examined for compliance with the CRA and are assigned ratings. In order for a financial holding company to commence any new activity permitted by the BHC Act, or to acquire any company engaged in any new activity permitted by the BHC Act, each insured depository institution subsidiary of the financial holding company must have received a rating of at least “satisfactory” in its most recent examination under the CRA. Furthermore, banking regulators take into account CRA ratings when considering a request for an approval of a proposed transaction. Frost Bank received a rating of “satisfactory” in its most recent CRA performance evaluations.

Financial Privacy

The federal banking regulators have adopted rules under the Gramm-Leach-Bliley Act of 1999 that limit the ability of banks and other financial institutions to disclose non-public information about consumers to nonaffiliated third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a nonaffiliated third party. These regulations affect how consumer information is transmitted through diversified financial companies and conveyed to outside vendors.

Anti-Money Laundering and the USA Patriot Act

A major focus of governmental policy on financial institutions has been aimed at combating money laundering and terrorist financing. The U.S. Bank Secrecy Act (the “BSA”) and the USA PATRIOT Act of 2001 (the “USA Patriot Act”) require financial institutions to develop programs to prevent them from being used for, and to detect and deter, money laundering, terrorist financing, and other illegal activities. The USA Patriot Act substantially broadened the scope of United States anti-money laundering laws and regulations by imposing significant new compliance and due diligence obligations, creating new crimes and penalties and expanding the extra-territorial jurisdiction of the United States. Financial institutions are also prohibited from entering into specified financial transactions and account relationships and must use enhanced due diligence procedures in their dealings with certain types of high-risk customers and implement a written customer identification program. Financial institutions must take certain steps to assist government agencies in detecting and preventing money laundering and report certain types of suspicious transactions. Regulatory authorities routinely examine financial institutions for compliance with these obligations, and failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have

serious financial, legal and reputational consequences for the institution, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required. Regulatory authorities have imposed cease and desist orders and civil money penalties against institutions found to be violating these obligations.

In August 2024, Financial Crimes Enforcement Network (“FinCEN”), which drafts regulations implementing the U.S. Patriot Act, BSA and other anti-money laundering legislation, adopted a rule extending anti-money laundering obligations, including maintenance of an anti-money laundering program and filing certain reports with FinCEN, to registered investment advisers, like certain of Cullen/Frost’s subsidiaries. In December 2025, FinCEN delayed the effective date of the rule to January 1, 2028 in part to allow FinCEN to review the rule.

Office of Foreign Assets Control Regulation

The U.S. Treasury Department’s Office of Foreign Assets Control, or OFAC, administers and enforces economic and trade sanctions against targeted foreign countries and regimes, under authority of various laws, including designated foreign countries, nationals and others. OFAC publishes lists of specially designated targets and countries. These sanctions include: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments in, or providing investment-related advice or assistance to, a sanctioned country, and (ii) blocking assets in which the government or specially designated nationals of the sanctioned country have an interest by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). We are responsible for, among other things, blocking accounts of, and transactions with, such targets and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence. Failure to comply with these sanctions could have serious financial, legal and reputational consequences, including the imposition of civil money penalties or causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required.

Incentive Compensation

The Federal Reserve Board reviews, as part of its regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as Cullen/Frost, that are not “large, complex banking organizations.” These reviews are tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

Under regulatory guidance applicable to all banking organizations, incentive compensation policies must be consistent with safety and soundness principles. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

In October 2022, the SEC adopted a final rule directing national securities exchanges and associations, including the NYSE, to implement listing standards that require listed companies to adopt policies mandating the recovery or “clawback” of excess incentive-based compensation earned by a current or former executive officer during the three fiscal years preceding the date the listed company is required to prepare an accounting restatement, including to correct an error that would result in a material misstatement if the error were corrected in the current period or left uncorrected in the current period. The NYSE’s listing standards pursuant to the SEC’s rule became effective on October 2, 2023. We adopted a compensation recovery policy pursuant to the NYSE listing standards on October 25, 2023. The policy is included as Exhibit 97.1 to this Form 10-K.

Cybersecurity

The federal banking regulators regularly issue new guidance and standards, and update existing guidance and standards, regarding cybersecurity intended to enhance cyber risk management among financial institutions. Financial institutions are expected to comply with such guidance and standards and to accordingly develop appropriate security controls and risk management processes. If we fail to observe such regulatory guidance or standards, we could be subject to various regulatory sanctions, including financial penalties. In 2023, the SEC issued a final rule that requires disclosure of material cybersecurity incidents, as well as cybersecurity risk management, strategy and governance. Under this rule, banking organizations that are SEC registrants must generally disclose information about a material cybersecurity incident within four business days of determining it is material with periodic updates as to the status of the incident in subsequent filings, as necessary.

Banking organizations are required to notify their primary banking regulator within 36 hours of determining that a “computer-security incident” has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss, or its operations that would impact the stability of the United States.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and many states, including Texas, have also recently implemented or modified their data breach notification, information security and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments in the states in which our customers are located.

Risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to be elevated for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our customers.

In May 2024, the SEC finalized amendments to Regulation S-P to require broker-dealers, investment companies and investment advisers registered with the SEC to adopt written policies and procedures for incident response programs to address unauthorized access to or use of customer information. The amended Regulation S-P also requires covered entities to notify, within 30 days, individuals affected by an incident involving sensitive customer information and provide them with details about the incident and other information intended to help affected individuals respond appropriately.

See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity and Item 1C. Cybersecurity for a further discussion of risk management strategies and governance processes related to cybersecurity.

Climate-Related and Other ESG Developments

In recent years, certain lawmakers and regulators in and outside the United States have increased their focus on financial institutions' and other companies' risk oversight, disclosures and practices in connection with climate change and other environmental, social and governance (“ESG”) matters. In addition, several states, including Texas, have enacted or proposed statutes or regulations addressing climate change and other ESG issues, including “anti-ESG” statutes or regulations.

Fair Access to Financial Services

In recent years, certain states have enacted, or have proposed to enact, statutes, regulations or policies that prohibit financial institutions from denying or canceling products or services to a person or business, or otherwise discriminating against a person or business in making available products or services, on the basis of certain social or political factors or other activities. In August 2025, President Trump signed Executive Order 14331, “Guaranteeing Fair Banking Access for All Americans,” which states that it is the policy of the United States that no American should be denied access to financial services because of their constitutionally or statutorily protected beliefs, affiliations, or political views. The Executive Order directs the Treasury Secretary and federal banking regulators to address politicized or unlawful debanking activities.

Future Legislation and Regulation

Congress may enact legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although any change could impact the regulatory structure under which we or our competitors operate and may significantly increase costs, impede the efficiency of internal business processes, require an increase in regulatory capital, require modifications to our business strategy, and limit our ability to pursue business opportunities in an efficient manner. It could also affect our competitors differently than us, including in a manner that would make them more competitive. A change in statutes, regulations or regulatory policies applicable to Cullen/Frost or any of its subsidiaries could have a material, adverse effect on our business, financial condition and results of operations.

Human Capital Resources

At December 31, 2025, we employed 6,008 full-time equivalent employees. At that date, the average tenure of all of our full-time employees was approximately 9.4 years while the average tenure of our executive officers was approximately 30.3 years. None of our employees are represented by collective bargaining agreements. We believe our employee relations to be good.

Oversight of our corporate culture is an important element of our board of director’s oversight of risk because our people are critical to the success of our corporate strategy. Our board sets the “tone at the top,” and holds senior management accountable for embodying, maintaining, and communicating our culture to employees. In that regard, our culture is designed to promote our commitment to making people's lives better and to uphold that principle in everything we do. That commitment has been a central pillar in our approach to our employees, our planet and the communities we have proudly served for over 150 years. Our culture is designed to adhere to the timeless values of integrity, caring and excellence. In keeping with that culture, we expect our people to treat each other and our customers with the highest level of honesty and respect and go out of their way to do the right thing, and we strive to be a force for good in everyday life. We dedicate resources to promote a safe workplace; attract, develop and retain talented employees; promote a culture of integrity, caring and excellence; and reward and recognize employees for both the results they deliver and, importantly, how they deliver them. We also seek to design careers that are fulfilling ones, with competitive compensation and benefits alongside a positive work-life balance. We also dedicate resources to fostering professional and personal growth with continuing education, on-the-job training and development programs.

Our employees are key to our success as an organization. We are committed to providing equal opportunity to and avoiding unlawful discrimination against all applicants and employees and attracting, retaining and promoting top quality talent regardless of personal aspects such as sex, sexual orientation, gender identity, race, color, national origin and age. We are dedicated to providing a workplace for our employees that is supportive, and free of any form of unlawful discrimination or harassment; rewarding and recognizing our employees based on their individual results and performance as well as that of their department and the company overall; and recognizing and respecting all of the characteristics and differences that make each of our employees unique.

By promoting and fostering a workforce that we believe is reflective of the values of our customers and communities, we seek to better understand the financial needs of our prospects and customers and provide them with relevant financial service products. This enables us to better serve our customers and communities, enhancing our success as an organization. Understanding and supporting our community has always been a priority to us. We have established a voluntary, employee-led and staffed team that is committed to touching and improving the lives of people that live and work in our community. Additionally, we provide employees the opportunity to use paid time off to perform community service activities in their choice of ways. In 2025, this amounted to over 27,000 hours of community service performed by our employees. Our efforts are designed to enrich the lives of not only those that are in need but also the lives of our employees who participate in these meaningful and rewarding opportunities.

Information About Our Executive Officers

The names, ages, recent business experience and positions or offices held by each of the executive officers of Cullen/Frost are as follows:

Name and Position Held	Age	Recent Business Experience
Phillip D. Green Chairman of the Board, Chief Executive Officer and Director	71	Officer of Frost Bank since 1980. Chairman of the Board and Chief Executive Officer since April 2016.
Daniel J. Geddes Group Executive Vice President, Chief Financial Officer	51	Officer of Frost Bank since 1998. Group Executive Vice President, Chief Financial Officer since January 2025. Group Executive Vice President from July 2024 to December 2024. San Antonio Region President from August 2021 to June 2024. Market President and the Houston Expansion Lead from October 2018 to August 2021.
Annette Alonzo Group Executive Vice President, Chief Human Resources Officer	57	Officer of Frost Bank since 1993. Group Executive Vice President, Chief Human Resources Officer since April 2016.
Robert A. Berman Group Executive Vice President, Research and Strategy	63	Officer of Frost Bank since 1989. Group Executive Vice President, Research and Strategy of Frost Bank since May 2001.
Paul H. Bracher President, Group Executive Vice President, Chief Banking Officer	69	Officer of Frost Bank since 1982. Group Executive Vice President, Chief Banking Officer since January 2015. President of Cullen/Frost since April 2016. President of Frost Bank since January 2024.
Howard L. Kasanoff Group Executive Vice President, Chief Credit Officer	56	Officer of Frost Bank since June 1994. Group Executive Vice President, Chief Credit Officer since January 2023. Senior Executive Vice President, Director of Complex Risk from October 2017 to December 2022.
Ericka L. Pullin Group Executive Vice President, Culture and People Development	51	Officer of Frost Bank since 2000. Group Executive Vice President, Culture and People Development since July 2025. Executive Vice President and Market Research Manager from May 2021 to July 2025. Senior Vice President and Market Research Manager from September 2014 to May 2021.
Coolidge E. Rhodes, Jr. Group Executive Vice President, General Counsel and Corporate Secretary	50	Officer of Frost Bank since September 2021. Group Executive Vice President, General Counsel since September 2021 and Secretary since October 2021. Managing director and chief compliance officer at New Fortress Energy, Inc. from February 2020 to September 2021.
Carol J. Severyn Group Executive Vice President, Chief Risk Officer	61	Officer of Frost Bank since 1993. Group Executive Vice President, Chief Risk Officer since January 2019. Executive Vice President and Auditor from January 2004 to January 2019.
Jimmy Stead Group Executive Vice President, Chief Consumer Banking and Technology Officer	50	Officer of Frost Bank since 2001. Group Executive Vice President, Chief Consumer Banking and Technology Officer since January 2020. Group Executive Vice President, Chief Consumer Banking Officer from January 2017 to January 2020.
Kenny Wilson Group Executive Vice President, Chief Wealth Officer	73	Officer of Frost Bank since 2023. Group Executive Vice President, Chief Wealth Officer since August 2023. Chief Executive Officer for Haven for Hope from April 2016 to December 2021. Prior to that, Mr. Wilson was Market President and Market Executive for Private Banking for Bank of America in both the San Antonio and Austin markets.

There are no arrangements or understandings between any executive officer of Cullen/Frost and any other person pursuant to which such executive officer was or is to be selected as an officer.

Available Information

Under the Securities Exchange Act of 1934, we are required to file annual, quarterly and current reports, proxy statements and other information with the Securities and Exchange Commission (“SEC”). The SEC maintains a website at http://www.sec.gov that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC. We file electronically with the SEC.

We make available, free of charge through our website, our reports on Forms 10-K, 10-Q and 8-K, and amendments to those reports, as soon as reasonably practicable after such reports are filed with or furnished to the SEC. Additionally, we have adopted and posted on our website a code of ethics that applies to our principal executive officer, principal financial officer and principal accounting officer. Our website also includes our Corporate Governance Guidelines and the charters for our Audit Committee, our Compensation and Benefits Committee, our Risk Committee, our Corporate Governance and Nominating Committee, and our Technology and Cybersecurity Committee. The address for our website is http://www.frostbank.com. We will provide a printed copy of any of the aforementioned documents to any requesting shareholder.

CULLEN/FROST BANKERS, INC. (CFR) Business

ITEM 1. BUSINESS

The Corporation

Table of Contents

Subsidiaries of Cullen/Frost

Frost Bank

Table of Contents

Frost Investment Advisors, LLC

Frost Investment Services, LLC

Tri–Frost Corporation

Cullen/Frost Capital Trust II

Other Subsidiaries

Table of Contents

Operating Segments

Competition

Supervision and Regulation

Regulatory Agencies

Table of Contents

Bank Holding Company Activities

Table of Contents

Dividends and Stock Repurchases

Transactions with Affiliates

Table of Contents

Source of Strength Doctrine

Capital Requirements

Table of Contents

Liquidity Requirements

Prompt Corrective Action

Table of Contents

Table of Contents

Safety and Soundness Standards

Deposit Insurance

Table of Contents

Enhanced Prudential Standards

Resolution Planning

The Volcker Rule

Depositor Preference

Table of Contents

Interchange Fees

Consumer Financial Protection

Table of Contents

Community Reinvestment Act

Financial Privacy

Anti-Money Laundering and the USA Patriot Act

Table of Contents

Office of Foreign Assets Control Regulation

Incentive Compensation

Table of Contents

Cybersecurity

See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity and Item 1C. Cybersecurity for a further discussion of risk management strategies and governance processes related to cybersecurity.

Climate-Related and Other ESG Developments

Fair Access to Financial Services

Table of Contents

Future Legislation and Regulation

Human Capital Resources

Table of Contents

Information About Our Executive Officers

Table of Contents

Available Information