FIRST CITIZENS BANCSHARES INC /DE/ (FCNCA) Business

Item 1. Business

General

First Citizens BancShares, Inc. (the “Parent Company” and when including all of its subsidiaries on a consolidated basis, “BancShares,” “we,” “us,” or “our”) was incorporated under the laws of Delaware on August 7, 1986, to become the holding company of First-Citizens Bank & Trust Company (“FCB”), its banking subsidiary. FCB opened in 1898 as the Bank of Smithfield in Smithfield, North Carolina, and later changed its name to First-Citizens Bank & Trust Company.

BancShares has expanded through de novo branching and acquisitions and as of December 31, 2025, operates an extensive network of branches and offices, predominantly located in the Southeast, Mid-Atlantic, Midwest, and Western United States, providing a broad range of financial services to individuals, businesses and professionals. At December 31, 2025, BancShares had total consolidated assets of $229.70 billion.

Throughout its history, the operations of BancShares have been significantly influenced by descendants of Robert P. Holding, who came to control FCB during the 1920s. Robert P. Holding’s children and grandchildren have served as members of the Board of Directors of BancShares (the “Board”) and of the Board of Directors of FCB (collectively with the Board of BancShares, the “Boards”), as chief executive officers and in other executive management positions and, since BancShares’ formation in 1986, have remained stockholders owning a large percentage of its common stock.

The Chairman of the Boards and Chief Executive Officer, Frank B. Holding, Jr., is the grandson of Robert P. Holding. Hope Holding Bryant, Vice Chairwoman of the Boards, is Robert P. Holding’s granddaughter. Peter M. Bristow, President and member of the Boards, is the brother-in-law of Frank B. Holding, Jr. and Hope Holding Bryant.

BancShares provides financial services for a wide range of consumer and commercial clients. BancShares offers deposit products, loans, and wealth management and private banking services to consumer clients. BancShares provides lending, leasing, capital markets and other financial and advisory services, to small and middle-market companies across a variety of industries. Additionally, BancShares provides a full suite of financial products and services to private equity firms, venture capital firms, and commercial clients in innovation markets, such as technology, life sciences and healthcare industries. BancShares also provides deposit, cash management and lending to homeowner associations and property management companies and owns a fleet of railcars and locomotives that are leased to railroads and shippers.

BancShares delivers banking products and services to its customers through an extensive branch network and additionally operates a nationwide digital banking platform that delivers deposit products to consumers (the “Direct Bank”). Services offered at most branches include accepting deposits, cashing checks and providing for consumer and commercial cash needs. Consumer and business customers may also conduct banking transactions through various digital channels.

In addition to our banking operations, we provide various investment products and services through FCB’s wholly owned subsidiaries, including First Citizens Investor Services, Inc. (“FCIS”), First Citizens Asset Management, Inc. (“FCAM”), First Citizens Delaware Trust Company, and a non-bank subsidiary, First Citizens Capital Securities, LLC (“FCCS”). As a registered broker-dealer, FCIS provides a full range of investment products, including annuities, brokerage services and third-party mutual funds. As registered investment advisers, FCIS and FCAM provide investment management services and advice. FCCS is a broker-dealer that also provides underwriting and private placement services. We also have other wholly owned subsidiaries, including SVB Wealth LLC, SVB Asset Management, and First Citizens Institutional Asset Management, LLC, which are active investment advisers.

Information regarding our business activities and operations is found in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations.

4

Business Combinations

In addition to organically growing our business, BancShares has historically pursued growth through strategic mergers and acquisitions to enhance organizational value, strengthen its presence in existing markets, as well as expand its footprint in new markets.

On October 16, 2025, FCB announced that it had entered into an agreement to consummate the acquisition of 138 branches from BMO Bank N.A. located throughout the Midwest, Great Plains and West regions of the U.S. (the “BMO Branch Acquisition”). In connection with the BMO Branch Acquisition, FCB expects to assume approximately $5.7 billion in deposit liabilities and acquire approximately $1.1 billion in loans. We expect the transaction to close in the second half of 2026, subject to customary closing terms and conditions and regulatory approvals.

On March 27, 2023, FCB acquired substantially all loans and certain other assets and assumed all customer deposits and certain other liabilities of Silicon Valley Bridge Bank, N.A. (“SVBB”) from the Federal Deposit Insurance Corporation (the “FDIC”) pursuant to the terms of a purchase and assumption agreement by and among FCB, the FDIC, and the FDIC, as receiver of SVBB (the “SVBB Acquisition”). SVBB was established following the closure of the former Silicon Valley Bank. BancShares maintains the Silicon Valley Bank brand as Silicon Valley Bank, a division of FCB.

For further discussion, refer to Note 2—Business Combinations of Item 8. Financial Statements and Supplementary Data.

Segments

As of December 31, 2025, our reportable segments included the General Bank, the Commercial Bank, and Rail. All other financial information not included in the segments is reported in the Corporate section of the segment disclosures. We made the following changes to our segment reporting during 2025 (the “Segment Reporting Updates”):

•All components previously reported in the Silicon Valley Bank (“SVB”) Commercial segment and certain components of the General Bank segment were consolidated into the Commercial Bank segment.

•We made minor updates to our segment expense allocations.

Segment disclosures for the years ended December 31, 2024 and 2023 included in this Form 10-K were recast to conform with the Segment Reporting Updates summarized above.

(1) All other financial information not included in the segments is reported in “Corporate.”

Reportable segments are discussed further in the “Results by Segments” section of Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations and Note 21—Segment Information of Item 8. Financial Statements and Supplementary Data.

5

Competition

The financial services industry is highly competitive and continues to evolve as a result of changes in regulation, technology, product delivery systems, the accelerating pace of consolidation among financial service providers, and the general market and economic climate. BancShares competes with national, regional and local financial services providers. In recent years, the ability of non-bank financial entities to provide services previously limited to commercial banks has intensified competition. Non-bank financial service providers are not subject to the same significant regulatory restrictions as traditional commercial banks and, as such, can often operate with greater flexibility and lower cost structures. More than ever, customers have the ability to select from a variety of traditional and nontraditional alternatives. Competition is based on a number of factors including, among others, customer service, quality and range of products and services offered, price, reputation, interest rates on loans and deposits and customer convenience. Our non-bank services compete with other insurance companies, investment firms and brokerage firms.

FCB’s largest notable concentration of deposits by market share as of June 30, 2025 were in North Carolina (including our nationwide Direct Bank deposits) and South Carolina at 11.8% and 9.5%, respectively, which makes FCB the third largest bank in North Carolina and the fourth largest bank in South Carolina based on deposit market share according to the FDIC Deposit Market Share Report. The two banks larger than FCB based on deposits in North Carolina were Bank of America and Truist Bank which collectively held 63.1% of North Carolina deposits. The three banks larger than FCB based on deposits in South Carolina were Bank of America, Wells Fargo and Truist Bank which collectively held 39.1% of South Carolina deposits.

Geographic Locations

As of December 31, 2025, FCB had more than 500 total domestic branches and offices, which included 209 in North Carolina, 119 in South Carolina, and 72 in California.

As of December 31, 2025, BancShares operated branches in Arizona, California, Colorado, Florida, Georgia, Hawaii, Kansas, Maryland, Massachusetts, Missouri, Nebraska, Nevada, New Mexico, North Carolina, Oklahoma, Oregon, South Carolina, Tennessee, Texas, Virginia, Washington, West Virginia, and Wisconsin.

Refer to the “Risk Management—Concentration Risk—Concentration” section in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations for information on our commercial and consumer loan concentrations by state.

Human Capital

As of December 31, 2025, BancShares employed approximately 17,876 full-time staff and approximately 265 part-time staff for a total of 18,141 employees.

Our ability to attract, retain, and develop associates is critical to our success. We strive to ensure we have the right talent in the right jobs and with the right skills to fulfill our strategic objectives. Our vision is realized by cultivating a foundation that includes both a strong business strategy and a unified culture. A relationship-based, client-centered, and long-term focused approach supports our strategic objectives and reinforces a culture that prioritizes shared values and behaviors. These unwavering commitments position us to support our clients, colleagues, and communities in pursuing their greatest ambitions. Our client-centric approach has always been the bedrock of who we are, building deep and lasting relationships that prioritize the client experience. Our long-term focus allows us to make strategic decisions and investments designed to build long-term value and stability for all stakeholders, while skillfully managing risk along the way.

Our human resources team works to identify and deploy the critical talent needed to support our strategic objectives and our unified culture. We attract and retain talent by offering learning and development opportunities, internal career mobility, a comprehensive total rewards package, and a welcoming values-based culture.

In addition, our human resources team monitors and evaluates various metrics, specifically around attraction, retention, and development of talent. Our annual voluntary turnover remained below the financial services industry benchmark through December 2025. We believe this reflects our strong corporate culture, competitive compensation and benefits structure, and commitment to career development.

Inclusion

We value diversity in people, in the markets we serve, and in the products and services we offer. We seek individuals with varied backgrounds because we understand that our differences contribute to a diversity of thought that enhances associate and customer relationships and propels innovation in our products and services. As a relationship-based culture, we believe it is important that associates feel respected, included and valued and that we provide access to resources and opportunities that support long-term success for the business and our associates.

6

At BancShares, we also prioritize creating connections, helping our clients achieve their goals, fostering a culture of belonging, and promoting educational and engagement opportunities to deepen relationships across the company. To further these efforts, we support a variety of programs that help create an inclusive workplace culture, attract and retain the best available talent, enrich both associate and customer experiences, and achieve key business objectives.

Associate Well-Being

At BancShares, a strong focus on our associates’ well-being is part of our culture and integral to our total rewards philosophy. Recognizing that well-being is an individual journey, our benefits program has been thoughtfully designed to provide associates with options in five well-being dimensions – physical, financial, emotional, social, and community. Supporting the health and well-being of our associates, BancShares offers benefits that include, but are not limited to:

•medical plan options that include telehealth, dental and vision plan options, and wellness programs;

•a 401(k) plan, flexible spending accounts, life and accidental death and dismemberment insurance, short-term and long-term disability coverage, numerous voluntary coverages, and discount programs;

•paid time off and other time away such as holidays, parental leave, and volunteer leave; and

•a comprehensive mental health and well-being offering.

Regulatory Considerations

BancShares is a bank holding company (“BHC”) that is subject to laws and regulations that govern its operations and impact the products and services it may offer, the risks that it may take, the corporate and financial actions it may take, and the information it must publicly disclose. In connection with those laws and regulations, BancShares is subject to regulation, supervision and periodic examination by supervisory authorities, including the FDIC, the Board of Governors of the Federal Reserve System (the “Federal Reserve”), the Federal Reserve Bank (the “FRB”), and the Consumer Financial Protection Bureau (the “CFPB”). FCB, as a North Carolina state-charted bank that is not a member of the Federal Reserve, is also subject to the laws and regulations of North Carolina and supervision by the North Carolina Office of the Commissioner of Banks, as well as other state laws and state regulators in the states in which FCB operates. BancShares, as a publicly traded company, is also subject to disclosure and reporting requirements under Securities and Exchange Commission (“SEC”) rules and Nasdaq Stock Market (“Nasdaq”) continued listing standards, as well as rules pertaining to governance and corporate actions. Certain of BancShares’ subsidiaries are also subject to additional supervision and regulation, as discussed below, and FCB and certain of our other subsidiaries are subject to laws and regulations that govern their trust and other fiduciary activities.

Banking laws, regulations, and policies are continually under review by the U.S. Congress, state legislatures, and federal and state regulatory agencies. In addition to laws and regulations, state and federal bank regulatory agencies may issue policy statements, interpretive letters, and similar written guidance applicable to BancShares.

Regulations applicable to banking organizations generally serve to protect depositors and other customers, the Deposit Insurance Fund (the “DIF”), the broader economy, and the stability of the U.S. financial system. Certain other laws and regulations, including those administered by the CFPB, are focused on consumer financial protection. In addition, disclosure and reporting requirements under SEC rules and regulations primarily aim to protect investors and securities markets. BancShares expects that its business will remain subject to extensive regulation and supervision.

Examinations by banking regulators consider compliance with applicable laws and regulations and evaluate against certain enhanced prudential standards, as discussed below. Following examinations, banking organizations may receive supervisory findings or ultimately be assigned supervisory ratings. Examination reports and supervisory ratings, as well as mandatory or discretionary actions by regulators under the applicable supervisory framework, could significantly impact a banking organization’s operations or result in substantial monetary penalties. In the fall of 2025, the FDIC issued proposed rules, and the Federal Reserve announced new supervisory operating principals, each of which are intended to focus bank examiners on issues that may present material financial risks that threaten the safety and soundness of banking organizations and on taking timely, proportionate action to address those risks. The Federal Reserve’s new supervisory operating principles are also intended to reduce duplication between examinations by other federal and state banking regulators and streamline the remediation of supervisory issues.

The following discussion is a high-level summary of the material laws and regulations that apply to BancShares, but the summary is not intended to be exhaustive or describe all of the laws, regulations and policies that apply to BancShares.

7

Enhanced Prudential Standards

BancShares is subject to certain enhanced prudential standards as a BHC with over $100 billion in consolidated assets under the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, as amended (the “Dodd-Frank Act”), in addition to the prudential standards required under the Bank Holding Company Act of 1956, as amended (the “BHCA”), and the implementing regulations promulgated thereunder. Under the Dodd-Frank Act, certain enhanced prudential standards are mandatory for banking organizations with $250 billion or more in total consolidated assets, as well as nonbank financial companies that are designated as systemically important financial institutions by the Financial Stability Oversight Council and subject to regulation and supervision by the Federal Reserve. Pursuant to authorization under the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018, the Federal Reserve, along with the FDIC and the Office of the Comptroller of the Currency (the “OCC”), adopted tailoring rules (the “Tailoring Rules”) for the applicability of enhanced prudential standards to banking organizations with $100 billion or more in total consolidated assets, which apply to holding companies of FDIC-insured depository institutions (“IDIs”) and their subsidiary depository institutions. The Parent Company and FCB are currently subject to certain enhanced prudential standards as further described below.

Tailoring Rules. Under the Tailoring Rules, the Federal Reserve groups banking organizations into four categories based on total consolidated assets, off-balance sheet exposure, nonbank assets, weighted short-term wholesale funding, and cross-jurisdictional activities. Category I banking organizations, which are the U.S. Globally Systemically Important Banks (“GSIBs”), are subject to the most stringent enhanced prudential requirements, and Category IV banking organizations (i.e., those that have between $100 billion and $250 billion in total consolidated assets, and less than $75 billion in nonbank assets, off-balance sheet exposure, cross-jurisdictional activities, and weighted short-term wholesale funding) are subject to the least stringent enhanced prudential requirements. Category II banking organizations have $700 billion or more in total consolidated assets, or $100 billion or more in total consolidated assets and $75 billion or more in cross-jurisdictional activities, and are not GSIBs. Category III banking organizations have $250 billion or more in total consolidated assets, or $100 billion or more in total consolidated assets and $75 billion or more in weighted short-term wholesale funding, nonbank assets, or off-balance sheet exposure, and do not meet the criteria for Category I or II banking organizations. BancShares is subject to the enhanced prudential standards under the Tailoring Rules as a Category IV banking organization. The enhanced prudential standards that apply to BancShares include, but are not limited to, enhanced enterprise risk management and liquidity management requirements, supervisory stress testing and capital plan submission requirements, and enhanced governance standards. As BancShares continues to grow, it may cross additional risk-based asset thresholds, subjecting it to additional regulatory requirements and enhanced scrutiny.

Basel III. The federal banking agencies have established a framework for enhanced capital and liquidity requirements for banking organizations with $100 billion or more in total assets that implements portions of the Basel III accords, developed by the Basel Committee on Banking Supervision (as implemented in the U.S., “Basel III”). Under Basel III, banking organizations with $100 billion or more in total consolidated assets that are Category III or IV banking organizations may follow a standardized approach to calculating risk-weighted assets (“RWA”) and risk-based capital requirements, while Category I and II banking organizations are required to use an internal ratings-based approach to calculate RWA and risk-based capital consistent with an advanced approaches framework (“Advanced Approaches”). Category I, II and III banking organizations are also required under Advanced Approaches to comply with enhanced risk-based capital requirements on a tailored basis (e.g., a countercyclical capital buffer if activated and a supplementary leverage ratio requirement). In addition, Category I and II banking organizations, consistent with Advanced Approaches, must include accumulated other comprehensive income (“AOCI”) in capital for purposes of calculating regulatory capital requirements, but Category III and IV banking organizations are able to opt-out of this requirement. BancShares, as a Category IV banking organization, follows the standardized approach to calculating RWA and has elected to opt-out of including AOCI in capital for purposes of calculating regulatory capital requirements.

8

Capital Planning and Stress Testing. As a Category IV banking organization, BancShares is required to submit an annual capital plan to the Federal Reserve and is subject to biennial supervisory stress testing by the Federal Reserve under its Comprehensive Capital Analysis and Review (“CCAR”) process. BancShares submitted a capital plan in 2024 and 2025 in accordance with regulatory requirements and will participate in the CCAR process as a Category IV banking organization for the first time during 2026. BancShares must resubmit its capital plan if there is a material change in its risk profile, financial condition or corporate structure since its most recent capital plan submission, or if the Federal Reserve otherwise notifies it that a resubmission is required. The mandatory elements of a capital plan include (i) an assessment of the expected uses and sources of capital over the planning horizon, (ii) a description of the banking organization’s process for assessing capital adequacy, (iii) the banking organization’s capital policy, and (iv) a discussion of any expected changes to the banking organization’s business plan that are likely to have a material impact on capital adequacy. The Federal Reserve calculates a banking organization’s stress capital buffer (“SCB”) requirement as part of the CCAR process, which replaces the capital conservation buffer (“CCB”) under Basel III, as further discussed below. In April 2025, the Federal Reserve issued a proposal to, among other things, delay the annual effective date of a new SCB requirement from October 1 to January 1 of the following year, giving banks additional time to adjust to their new capital requirements. In October 2025, the Federal Reserve issued another proposal to make other changes to the supervisory stress tests under CCAR to enhance the transparency and public accountability of the stress testing framework. Significant deficiencies in a banking organization’s capital planning and stress testing processes may result in supervisory directives that require the banking organization to address the identified deficiencies and potentially limit the organization’s capital distributions. As a banking organization with less than $250 billion in total consolidated assets, BancShares is not subject to the company-run stress testing requirements under the Dodd-Frank Act.

Capital Requirements. BancShares and FCB are subject to regulatory capital requirements under Basel III for the Tier 1 leverage ratio and ratios of qualifying capital to RWA (the “Risk-Based Capital Ratios” and, together with the Tier 1 leverage ratio, the “Regulatory Capital Ratios”). The total risk-based capital, Tier 1 risk-based capital, and common equity Tier 1 risk-based capital (“CET1”) ratios are the Risk-Based Capital Ratios. CET1 capital is generally common stock, additional paid in capital, and retained earnings less applicable capital deductions.

BancShares is also subject to the SCB requirements for the Risk-Based Capital Ratios, as calculated by the Federal Reserve in connection with its supervisory stress tests under the CCAR process. Specifically, the SCB is calculated by the Federal Reserve for each banking organization that participates in the CCAR process as the greater of (i) the difference between the organization’s starting and minimum projected Risk-Based Capital Ratios under the severely adverse scenario in the supervisory stress test, plus the sum of the dollar amount of the firm’s planned common stock dividends for each of the fourth through seventh quarters of the planning horizon as a percentage of RWA, or (ii) 2.50%, which is equal to the minimum CCB under Basel III. BancShares will participate in the 2026 supervisory stress test which will determine the SCB applicable to BancShares. Additionally, federal banking agencies have developed prompt corrective action (“PCA”) thresholds (described below) for Regulatory Capital Ratios to determine whether an institution is well capitalized. Failure of a banking organization to meet regulatory capital guidelines may subject it to a variety of enforcement remedies, including constraints on capital distributions and discretionary executive compensation, restrictions on its operations and activities, termination of deposit insurance by the FDIC and, under certain conditions, the appointment of a conservator or receiver.

As of December 31, 2025, the Regulatory Capital Ratios of BancShares and FCB exceeded the applicable Basel III requirements and the PCA well capitalized thresholds as further addressed under “Capital” in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations. The following table includes the Basel III requirements and PCA well capitalized thresholds for the Regulatory Capital Ratios.

Resolution Planning. Consistent with its status as a Category IV banking organization, BancShares is not required to submit a resolution plan under the Dodd-Frank Act (a “Living Will”). A Living Will must describe the banking organization’s strategy for the rapid and orderly resolution of the parent company and nonbank entities within the banking organization under the U.S. Bankruptcy Code in a manner that substantially mitigates the risk that the failure would have serious adverse effects on financial stability in the United States.

9

FCB is required to submit a full resolution plan (“Resolution Plan”) to the FDIC under the Covered Insured Depository Institution rule (“CIDI Rule”). The CIDI Rule generally applies to IDIs with consolidated assets of $50 billion or more. Resolution Plans submitted under the CIDI Rule generally require a more detailed discussion of the strategy for resolving the IDI than Living Wills (i.e., resolution plans required under the Dodd-Frank Act). The CIDI Rule requires that the Resolution Plans enable the FDIC as receiver to resolve the IDI in the event of its insolvency in a manner that ensures that depositors receive access to their insured deposits in a timely manner, maximizes the net present value return from the sale or disposition of a failed bank’s assets, and minimizes the amount of any loss realized by the creditors in the resolution. On April 18, 2025, the FDIC announced modifications to Resolution Plan requirements under the CIDI Rule to exempt IDIs subject to full resolution submission requirements from certain content requirements, such as the requirements to utilize a bridge bank strategy and a hypothetical failure scenario in the plan. FCB is required to, among other things, submit a full Resolution Plan every three years and provide interim targeted information between full submissions.

Risk Management. As a Category IV banking organization, BancShares is required to maintain an enterprise-wide risk management system, governance program, and compliance system commensurate with its size, risks, activities, and complexity. This includes prescribed standards for the implementation of risk governance frameworks addressing credit risk, market risk, capital risk, liquidity risk, operational risk, compliance risk, and strategic risk. The federal banking agencies have adopted guidelines establishing general standards related but not limited to, internal controls and information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth and compensation, fees and benefits. Some additional topics include cybersecurity, climate financial-risk management, and compensation, as discussed further below. In general, the guidelines are principle-based and set forth regulatory expectations for, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines.

Category III Requirements. BancShares would become a Category III banking organization under the Tailoring Rules, and would be subject to more stringent enhanced prudential standards, if it had consolidated assets of $250 billion or more, or $100 billion or more in total consolidated assets and $75 billion or more in weighted short-term wholesale funding, nonbank assets, or off-balance sheet exposure, based on a four-quarter trailing average. Enhanced prudential standards and risk-based capital requirements for Category III banking organizations include, but are not limited to, the Living Wills requirement, annual (rather than biennial) supervisory capital stress testing, biennial company-run stress testing (if consolidated assets were $250 billion or more), Liquidity Coverage Ratio (“LCR”) and Net Stable Funding Ratio (“NSFR”) requirements, and, under Advanced Approaches, enhanced risk-based capital requirements (e.g., a countercyclical capital buffer if activated and a supplementary leverage ratio requirement, among others). The Category III requirements apply at the holding company level as well to the subsidiary depository institution, to the extent applicable. The LCR requirement is designed to ensure that banking organizations have sufficient high-quality liquid assets to survive a significant liquidity stress event lasting for 30 calendar days. The NSFR requirement is designed to ensure that a banking organization maintains minimum amounts of stable funding to support its assets, commitments, and derivatives exposures over a one-year time horizon. As a Category III banking organization, BancShares would be subject to a full LCR requirement and full NSFR requirement, unless it has less than $75 billion in average weighted short-term wholesale funding, in which case it would subject to a reduced LCR requirement and NSFR requirement at 85% of the full requirements. As a Category IV banking organization, BancShares would be subject to modified LCR and NSFR requirements if it has $50 billion or more, but less than $75 billion, in average weighted short-term wholesale funding.

Proposed Rule for Basel III Endgame. In 2023, the federal banking agencies proposed interagency rules to implement the final components of the Basel III accords (the “Basel III Endgame”), which included additional capital requirements addressing credit risk, operational risk, and market risk, as well as proposed interagency rules for new long term debt and clean holding company requirements for banking organizations with over $100 billion in total consolidated assets. The proposed rules were never finalized, and the federal banking agencies have publicly stated their intention to introduce a revised proposal for the implementation of the Basel III Endgame, with the proposal expected in 2026, and implementation of final rules expected beginning in 2027. We will continue to monitor further developments regarding such revised proposal.

10

Limitations on Dividends and Other Payments

The Parent Company and FCB are subject to limitations on dividends and other payments. A principal source of the Parent Company’s liquidity is dividends from FCB. Failure to meet any enhanced prudential standards discussed above, or other mandatory or discretionary action by regulators, could impact the Parent Company’s or FCB’s ability to declare dividends or make other payments or capital distributions, including equity repurchases. Federal and state banking agencies also have the authority to prohibit BancShares from engaging in an unsafe or unsound practice in conducting its business, which may limit or preclude capital distributions, depending on financial condition. In addition, the Parent Company’s ability to make capital distributions, including paying dividends and repurchasing shares, is subject to the Federal Reserve’s restrictions on capital distributions under CCAR (as described above) as well as under the Basel III capital rules. Furthermore, under the Federal Deposit Insurance Act (the “FDI Act”), IDIs, such as FCB, are prohibited from making capital distributions, including the payment of dividends, if, after making such distributions, the institution would become undercapitalized. Additionally, banking organizations that are not considered well capitalized under the Basel III capital rules could be subject to restrictions on dividends, equity repurchases and compensation based on the amount of the shortfall. State law also prescribes certain limitations on payment of dividends.

Limitations on Mergers & Acquisitions

BancShares is subject to laws that may require regulatory approval for, or that otherwise impose limitations on, mergers, acquisitions or similar transactions. Failure to meet any enhanced prudential standards discussed above, or other mandatory or discretionary action by regulators, could impact the Parent Company’s or FCB’s ability to complete or place limitations on the consummation of mergers, acquisitions or similar transactions. For example, under the BHCA, a BHC must obtain approval from the Federal Reserve prior to directly or indirectly acquiring ownership or control of 5% of the voting shares or substantially all of the assets of another depository institution holding company or IDI, or prior to merging or consolidating with another depository institution holding company. In addition, federal market share limitations impose conditions that an acquiring BHC, after and as a result of the acquisition, control no more than 10% of the total amount of deposits of IDIs in the U.S. and no more than 30%, subject to variation by state law, of such deposits in applicable states. Federal Reserve rules also prohibit a financial holding company (“FHC”), which we have elected to be, from combining with another company if the resulting company’s liabilities would exceed 10% of the aggregate consolidated liabilities of all financial companies nationally.

The BHCA and other federal laws enumerate the factors the Federal Reserve must consider when reviewing the merger of BHCs, the acquisition of banks, or the acquisition of voting securities of a bank or BHC. These factors include the competitive effects of the proposal in the relevant geographic markets; the financial and managerial resources and future prospects of the companies and banks involved in the transaction; the effect of the transaction on the financial stability of the United States; the organizations' compliance with anti-money laundering (“AML”) laws and regulations; the convenience and needs of the communities to be served; and the records of performance under the Community Reinvestment Act (“CRA”) of the IDIs involved in the transaction.

In addition, under the FDI Act as amended by the Bank Merger Act (“BMA”), any IDI must also obtain approval of the FDIC before any merger, acquisition or certain similar transactions with another institution if the resulting institution will be a state chartered bank that is not a member of the Federal Reserve. The FDIC maintains a policy statement outlining the agency’s approach to evaluating bank merger and acquisition proposals under the BMA.

The Department of Justice (“DOJ”) is responsible for evaluating mergers and acquisitions under the federal antitrust laws, and the Federal Trade Commission (“FTC”) is responsible for evaluating nonbank acquisitions by a banking organization under the Hart-Scott-Rodino Antitrust Improvements Act of 1976 (“HSR Act”). Under the BHCA and BMA, mergers and acquisitions by BancShares are subject to a waiting period of 30-days unless the U.S. Attorney General consents to a shorter waiting period or the waiting period is otherwise waived by the approving banking agency due to an emergency that requires expeditious action or the proposal involves a probable bank failure. Transactions subject to review under the HSR Act are also subject to a 30-day waiting period, but the waiting period is only 15 days for transactions that are for cash tender offers or certain bankruptcy sales.

Holding Company Status

Activities. As a BHC, the Parent Company’s activities are generally limited to managing or controlling banks, furnishing services to or performing services for its subsidiaries, and engaging in other activities the Federal Reserve determines by regulation or order to be so closely related to banking or managing or controlling banks as to be a proper incident thereto. In addition to being a BHC, the Parent Company elected to be an FHC under the Gramm-Leach-Bliley Act of 1999 (the “GLBA”). BHCs that qualify and elect to be FHCs and continue to meet the eligibility requirements as an FHC (discussed below), though still limited in their activities, may more broadly engage in any activity, or acquire and retain the shares of a company engaged in any activity, that is either (i) financial in nature or incidental to such financial activity (as determined by the Federal Reserve in consultation with the Secretary of the U.S. Treasury) or (ii) complementary to such financial activity and does not pose a substantial risk to the safety and soundness of depository institutions or the financial system generally (as solely determined by the Federal Reserve). Such activities may include, among other things, securities underwriting or merchant banking.

11

The eligibility requirements for an FHC include that the FHC and each of its subsidiary IDIs remain “well capitalized” and “well managed,” and any subsidiary IDI must have received a rating under the CRA of at least “satisfactory” in its most recent examination. An IDI and its holding company are considered to be well capitalized if they each satisfy the requirements for this status under applicable bank capital requirements. An FHC with $100 billion or more in total consolidated assets is considered well managed if it receives a rating of “Broadly Meets Expectations” or “Conditionally Meets Expectations” for at least two of the three supervisory components and no more than one “Deficient-1” component rating under the Federal Reserve’s Large Financial Institution (“LFI”) rating system. Under the LFI rating system, the Federal Reserve assigns ratings based on three supervisory components: (i) capital planning and positions, (ii) liquidity risk management and positions, and (iii) governance and controls, and each component has four potential ratings: “Broadly Meets Expectations,” “Conditionally Meets Expectations,” “Deficient-1” and “Deficient-2”. If an FHC ceases to meet all of the eligibility requirements to be an FHC, the Federal Reserve may impose limitations or conditions on the conduct of its activities, as well as its ability to make certain acquisitions. If the failure to meet these standards persists, an FHC may be required to divest its IDI subsidiaries or cease all activities other than those activities that may be conducted by BHCs that are not FHCs. Furthermore, if an IDI subsidiary of an FHC has not maintained a satisfactory CRA rating, the FHC would not be able to commence any new financial activities or acquire a company that engages in such activities, though it may still be permitted to continue its existing activities.

The Volcker Rule. The Volcker Rule generally prohibits “banking entities” from engaging in proprietary trading or owning, investing in, or sponsoring “covered funds” which is defined to include hedge funds and private equity funds, subject to certain exemptions. The Volcker Rule applies to the Parent Company, FCB, and their subsidiaries and affiliates that fit the definition of a “banking entity” under the implementing regulations. BancShares has developed and implemented a Volcker Rule compliance program commensurate with the size, scope, and complexity of its activities and its business structure.

Source of Strength. Under the Dodd-Frank Act, BHCs are required to act as a source of financial strength to their subsidiary banks. Pursuant to this requirement, the Parent Company is expected to commit resources to support FCB, including at times when the Parent Company may not be in a financial position to provide such resources. Any indebtedness resulting from capital loans made by a BHC to any of its subsidiary banks are subordinate in right of payment to depositors and to certain other indebtedness of such subsidiary banks. In the event of a BHC’s bankruptcy, any commitment by the BHC to a federal banking agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Community Reinvestment Act

The CRA requires the federal banking agencies to encourage financial institutions to help meet the credit needs of the local communities, including low- and moderate-income (“LMI”) neighborhoods. As discussed above, if FCB receives a CRA rating of less than “satisfactory” from the FDIC, its activities as an FHC may be limited. Performance under the CRA is also considered when federal banking agencies analyze applications for mergers and acquisitions, as well as branch openings.

In 2023, the federal banking agencies jointly issued a final rule to strengthen and modernize the existing CRA regulations. Under the final rule, the agencies would evaluate a bank’s CRA performance based upon the varied activities that it conducts and the communities in which it operates, and CRA evaluations and data collection requirements would be tailored based on bank size and type. The final rule was preliminarily enjoined on March 29, 2024 following legal challenges, and as a result the agencies continue to apply the prior CRA regulations that were adopted in 1995. On July 16, 2025, the federal banking agencies issued a notice of proposed rulemaking (“NPR”) to rescind the final 2023 rule and reinstate the prior CRA regulations, with certain conforming and technical amendments. Although the proposed rule has not become effective, it is widely expected that the final 2023 rule will be rescinded and that the federal banking agencies will again address modernization of the CRA regulations.

In connection with the objectives of the CRA, FCB oversaw a community benefits plan that was developed in collaboration with representatives of national, state, and local community reinvestment organizations. Under the community benefit plan, FCB committed to invest $16 billion over a five-year period beginning in 2021 and ending on December 31, 2025, in the communities served by FCB, including $3.2 billion in home purchase, home improvement and mortgage refinance loans focused on LMI and minority borrowers in majority-minority geographies, $5.9 billion in small business lending, and $6.9 billion in community development lending and investments. The plan also provided for $50 million in CRA grants.

FCB is currently implementing an addendum to SVB’s prior community benefits plan that was agreed to by FCB in connection with the SVBB Acquisition and is scheduled to conclude on December 31, 2026. Under the addendum, FCB committed to a $6.5 billion community benefit target with the following components: $2.25 billion in small business lending, $3.6 billion in CRA development lending and investing, and $650 million in residential mortgages to LMI borrowers and in selected LMI census tracts. Additionally, FCB committed to $35 million in CRA grants, with $10 million of that sum dedicated to an affordable home mortgage subsidy program.

12

FDIC Insurance

FCB is required to pay the FDIC premiums for deposit insurance according to base deposit insurance assessment rate schedules, which remain elevated following a uniform increase of 2 basis points (“bps”) by the FDIC that began in the first quarterly assessment period of 2023. The FDIC increased the base deposit insurance assessments rates following growth in insured deposits during the first and second quarters of 2020 that caused the DIF reserve ratio to decline below the statutory minimum of 1.35%. The increased assessment rate schedules are expected to remain in effect until the reserve ratio meets or exceeds 2%, absent further action by the FDIC.

In addition, FCB is subject to special assessments to recover the loss to the DIF associated with the bank failures in spring of 2023. The assessment base for an IDI is equal to the institution’s estimated uninsured deposits as of December 31, 2022, adjusted to exclude the first $5 billion in estimated uninsured deposits. Beginning with the first quarter of 2024, the FDIC collected the special assessment at a quarterly rate of 3.36 bps for seven quarterly assessment periods and will collect the special assessment at a reduced quarterly rate of 2.97 bps for the eighth and final quarterly assessment period ended December 31, 2025. The FDIC will further collect a one-time shortfall special assessment if actual losses to the DIF exceed the amount collected through the initial special assessments, or provide an offset to regular FDIC premiums, proportional to the amount each bank paid toward the initial special assessments, if the amount collected exceeds actual losses. We previously accrued an initial FDIC insurance special assessment charge of $64 million in 2023, and an additional charge of approximately $11 million during 2024 due to higher losses than originally estimated to the DIF. During 2025, the FDIC revised its loss estimate, indicating lower losses than previously estimated to the DIF and therefore in the 2025 fourth quarter we reduced the accrual by approximately $11 million.

In November 2025, the bipartisan Main Street Depositor Protection Act was introduced in the U.S. Senate, which would increase FDIC coverage for non-interest-bearing deposit accounts from $250,000 to $10 million, as well as increase the FDIC premiums paid by IDIs. We continue to monitor and evaluate this proposed legislation and other deposit reform proposals.

Requirements for Brokered Deposits and Deposit Brokers; Limited Exception for Reciprocal Deposits

FCB may be limited in its ability to accept deposits made to it with the assistance of a third-party deposit broker if it is not well capitalized. Section 29 of the FDI Act and the FDIC’s implementing regulations limit the ability of an IDI to accept brokered deposits unless the institution is well capitalized, or the IDI is adequately capitalized and obtains a waiver from the FDIC. IDIs that are less than well capitalized generally cannot accept brokered deposits, and are subject to restrictions on the interest rates paid on deposits. IDIs that are well capitalized or adequately capitalized and meet certain other criteria are able to exempt from treatment as “brokered” deposits up to $5 billion or 20% of the institution’s total liabilities in reciprocal deposits (defined generally as deposits received by a depository institution through a deposit placement network with the same maturity and in the same aggregate amount as deposits placed by the depository institution in other network institutions).

Transactions with Insiders and Affiliates

Pursuant to the Federal Reserve Act, Regulation W and Regulation O, the authority of FCB to engage in transactions with or make loans to insiders or “affiliates” is limited. Among other things, loan transactions with an affiliate generally must be collateralized and certain transactions between FCB and its affiliates, including the sale of assets, the payment of money or the provision of services, must be on terms and conditions that are substantially the same, or at least as favorable to FCB, as those prevailing for comparable nonaffiliated transactions. Additionally, FCB is subject to individual and aggregate lending limits with respect to “extensions of credit” to Insiders. Further, FCB generally may not purchase securities issued or underwritten by affiliates. FCB receives management fees from its subsidiaries and the Parent Company for expenses incurred for performing various functions on their behalf. These fees are charged to each company based upon the estimated cost for usage of services by that company. All intercompany transactions are eliminated from the consolidated financial statements.

Crypto-Asset Related Activities

During 2025, the FDIC and the Federal Reserve revised guidance to clarify that supervised institutions may engage in permissible crypto-asset related activities without receiving prior approval or nonobjection or giving prior regulatory notice. In its revised guidance, the FDIC noted that such activities include, but are not limited to, acting as crypto-asset custodians, maintaining stablecoin reserves, issuing crypto and other digital assets, acting as market makers or exchange or redemption agents, participating in blockchain- and distributed ledger-based settlement or payment systems, as well as related activities such as finder activities and lending. In doing so, the FDIC cautioned that its supervised institutions should consider the risks associated with such activities, including market and liquidity risk, operational and cybersecurity risks, consumer protection requirements and AML requirements. In addition, the federal banking agencies issued a joint statement addressing risk management considerations for crypto-asset safekeeping by banking organizations in both a fiduciary or non-fiduciary capacity, including with respect to cryptographic keys used in custody arrangements, cybersecurity programs, and due diligence and oversight of third-party custodians.

13

Also during 2025, the Guiding and Establishing National Innovation for U.S. Stablecoins Act (the “GENIUS Act”) was passed by the U.S. Congress and signed into law creating a regime for the issuance and regulation of payment stablecoins, which are privately-issued digital assets designed to maintain a stable value relative to a peg specified by a reference asset such as Treasury securities with relatively short maturities and bank deposits. The GENIUS Act will allow payment stablecoins to be issued by subsidiaries of IDIs, along with other entities approved by the OCC and entities authorized to issue stablecoins under qualifying state regimes, and sets forth standards for reserving practices, supervision and enforcement, Bank Secrecy Act of 1970 (“BSA”) and AML compliance, and insolvency. The GENIUS Act is expected to become effective in late 2026 or early 2027. On December 16, 2025, the FDIC issued the first NPR under the GENIUS Act that would implement the application requirements and related procedures for any state nonmember bank or state savings association that seeks to issue payment stablecoins through a subsidiary. Additional NPRs are anticipated from the FDIC and the other federal banking agencies.

These statutory and regulatory actions follow the issuance of an Executive Order early in 2025 which aimed to support the responsible growth of digital assets, blockchain technology, and related technologies across the U.S. economy.

If the stablecoin market significantly expands and matures, it could pose a disintermediation risk to banks by attracting deposits away from traditional checking and savings accounts into digital assets, and/or reduce fee income for banks. We will continue to monitor the development of the stablecoin market and the related regulatory landscape and evaluate engaging in such activities.

Anti-Money Laundering & Economic Sanctions

FCB and certain of our other subsidiaries are subject to the BSA and subsequent laws and regulations, including USA PATRIOT Act of 2001 (the “Patriot Act”), that require financial institutions to take steps to prevent the use of their systems to facilitate the flow of illegal or illicit money or terrorist funds, including AML compliance programs, and to report certain activity to the government. The BSA, which is administered by the U.S. Financial Crimes Enforcement Network, also requires covered financial institutions to provide AML training to employees, designate an AML compliance officer and annually audit the AML program to assess its effectiveness, and imposes compliance and due diligence obligations, including standards for verifying customer identification at account opening and maintaining expanded records, as well as beneficial ownership requirements. The United States has also imposed economic sanctions on transactions with certain designated foreign countries, nationals and others, which are enforced by the U.S. Treasury’s Office of Foreign Asset Control (“OFAC”). Failure of a financial institution to maintain and implement adequate compliance programs for the foregoing, or to comply with all the relevant laws and regulations, could have serious legal and reputational consequences, including material fines and sanctions. FCB has implemented a program designed to facilitate compliance with the full extent of the applicable BSA, OFAC and Patriot Act related laws, regulations and related sanctions.

Consumer Laws and Regulations

FCB is subject to certain laws and regulations designed to protect consumers in transactions with banks. These laws include the Truth in Lending Act (“TILA”), the Truth in Savings Act, the Electronic Funds Transfer Act, the Expedited Funds Availability Act, the Equal Credit Opportunity Act, Real Estate Settlement Procedures Act, Home Mortgage Disclosure Act, the Fair Credit Reporting Act, the Fair Debt Collection Practices Act, the Fair Housing Act and the Servicemembers Civil Relief Act, many of which are enforced by the CFPB. Under TILA in particular, residential mortgage lenders are required to make a reasonable and good faith determination based on verified and documented information that a consumer applying for a mortgage loan has a reasonable ability to repay the loan according to its terms, based on certain prescribed evaluation alternatives. The foregoing laws and related regulations mandate certain disclosures and regulate the manner in which financial institutions transact business with certain customers. Additionally, in February 2025, a bill was introduced in the U.S. Congress that proposes to amend TILA and would, among other things, temporarily limit the annual percentage rate applicable to an extension of credit obtained by use of a credit card to 10 percentage points, inclusive of all finance charges. We are monitoring the status of the proposal and the impact of support by the President for such a cap.

A number of regulatory authorities may enforce consumer laws and regulations. The CFPB is generally authorized to prevent any institution under its authority from engaging in an unfair, deceptive, or abusive act or practice in connection with consumer financial products and service, and to take supervisory and enforcement action against financial services companies under the agency’s jurisdiction that fail to comply with federal consumer financial laws. Enforcement actions may include imposition of substantial monetary penalties and nonmonetary requirements. During 2025, the CFPB reduced its staff and delegated much of its enforcement function to the DOJ. The CFPB stated that it intends to focus its enforcement and supervision resources on pressing threats to consumers, particularly service members and veterans. Under the Dodd-Frank Act, while the CFPB has the primary enforcement authority over FCB as an IDI with over $10 billion in total assets, the FDIC retains backup enforcement authority over IDI’s with over $10 billion in total consolidated assets, and the FDIC is authorized to bring back-up enforcement actions against a holding company of an IDI if the conduct or threatened conduct of such holding company poses a foreseeable and material risk of loss to the DIF.

FCB, as a state-chartered bank, is also subject to state consumer protection laws in the states in which it operates, and the Dodd-Frank Act enhanced the ability of state attorneys general to enforce federal consumer protection laws.

14

Privacy, Data Protection, and Cybersecurity

BancShares is subject to a number of federal, state, local and foreign laws and regulations relating to consumer privacy and data protection. These laws include certain portions of the GLBA, the federal banking agencies’ Computer-Security Incident Notification rule, the SEC’s item for cybersecurity incidents Current Report on Form 8-K, the California Consumer Privacy Act of 2018, and the New York Department of Financial Services’ 2017 cybersecurity regulation. These laws govern the collection, sharing, use, disclosure and protection of personal information, the intent of which is to increase transparency related to how personal information is processed, choices individuals have to control how their information is used and to protect the privacy of such information. In addition, on October 22, 2024, the CFPB adopted its final rule for Personal Financial Data Rights, commonly known as the “Open Banking” rule, designed to facilitate the transfer of customer information at the direction of the customer to other financial institutions. Following legal challenge, the CFPB signaled its intent to issue a new final rule revising its open banking framework.

In addition to the foregoing, federal banking agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of the board of directors. These guidelines and related regulatory materials increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services. Under SEC rules, companies also must provide enhanced disclosures in their Annual Reports on Form 10-K with respect to cybersecurity risk assessment and management, strategy and governance, including disclosures regarding management’s role in overseeing the public company’s cybersecurity risk management and compliance program. Refer to Item 1C. Cybersecurity for additional information.

The U.S. Congress, federal and state regulators, as well as regulators outside the United States, have implemented or are considering implementing data protection laws or regulations, which could create new individual privacy rights and impose increased obligations on companies handling personal information, impacting our data security- and privacy-related internal controls and risk profile. For example, regulations were promulgated for the India Digital Personal Data Protection Act where we have operations. In addition, the EU General Data Protection Regulation and the UK General Data Protection Regulation impose extensive obligations on companies that process personal data of individuals in Europe and the United Kingdom, with the potential for significant fines for non-compliance (up to 4% of total annual worldwide revenue). Some of its requirements include prompt notice of data breaches, in certain circumstances, to affected individuals and supervisory authorities.

Climate

BancShares is subject to, and may in the future be subject to additional, state laws relating to climate, including, but not limited to, the California’s Climate Corporate Data Accountability Act (the “California CCDAA”) and Climate-Related Financial Risk Act (the “California CFRA”). The California CCDAA requires annual public disclosure of scope 1, 2, and 3 greenhouse gas emissions, with scope 1 and 2 disclosure required in 2026 and scope 3 in 2027, and the California CRFRA requires biennial public disclosure of climate-related financial risks, with the first disclosure required by January 1, 2026. The California CFRA has been preliminarily enjoined and enforcement paused pending legal challenge. Bills similar to the California laws have been introduced in the New York State Assembly but are still pending.

In October 2025, the federal banking agencies announced the rescission of the interagency Principles for Climate-Related Financial Risk Management for LFIs that was previously issued jointly by the agencies in October 2023, stating that existing safety and soundness standards require IDIs to have effective risk management processes commensurate with a banking organization’s size, complexity, and activities.

Compensation

Our compensation practices are subject to oversight by the federal banking agencies, Nasdaq, and, with respect to some of our subsidiaries, by other financial regulatory agencies. The federal banking agencies have issued joint guidance on executive compensation designed to ensure that the incentive compensation policies of banking organizations take into account risk factors and are consistent with the safety and soundness of the organization. The guidance also provides that supervisory findings with respect to incentive compensation will be incorporated into the organization’s supervisory ratings, which can affect its ability to make acquisitions or other corporate decisions. The guidance further provides that the agencies may pursue enforcement actions against a banking organization if its incentive compensation and related risk management, control or governance processes pose a risk to the organization’s safe and sound practices. Pursuant to SEC rules and Nasdaq listing standards, Nasdaq listed companies are required to (i) adopt and implement a compliant incentive compensation clawback policy; (ii) file the clawback policy as an exhibit to their annual reports; and (iii) provide certain disclosures relating to any compensation recovery triggered by the clawback policy. Our clawback policy is filed as Exhibit 97 to this Annual Report on Form 10-K. In addition, the Dodd-Frank Act requires the federal banking agencies and the SEC to issue regulations requiring covered financial institutions to prohibit incentive compensation arrangements that encourage inappropriate risks by providing compensation that is excessive or that could lead to material financial loss to the institution. Despite several rulemaking efforts over the years, regulations prohibiting such arrangements have yet to be adopted and the prospects and timing for the adoption of any such rules remain uncertain.

15

Artificial Intelligence

We are subject to regulation of our business and operations, including risk management, with respect to artificial intelligence (“AI”). On June 24, 2024, the CFPB along with the federal banking agencies, the National Credit Union Administration, and the Federal Housing Finance Agency, adopted a final rule on Quality Control Standards for Automated Valuation Models to address the use of algorithms and AI in estimating home values. The final rule implements quality control standards mandated by the Dodd-Frank Act for the use of automated valuation models by mortgage originators and secondary market issuers in determining the collateral worth of a mortgage secured by a consumer’s principal dwelling.

In addition, on March 27, 2024, the U.S. Treasury released a report that cautioned financial institutions like us to be aware of the special vulnerabilities of AI-based tools and the novel capacities that AI grants to threat actors seeking to carry out targeted cyberattacks against financial institutions. On September 23, 2024, the DOJ updated its guidance to federal prosecutors in conducting an investigation of a corporation related to the evaluation of corporate compliance programs, including an expectation that companies will have conducted a risk assessment regarding the use of new technologies like AI and will have taken appropriate steps to mitigate related risk.

Numerous bills have been introduced in the U.S. Congress throughout 2025 regarding the promotion and regulation of AI. In addition, certain U.S. states have recently enacted regulation related to the development and deployment of AI. Some of these laws intersect with existing privacy laws and may present challenges to the use of AI-related technologies, particularly in cases where personal information is processed requiring notice disclosure and, in certain cases, consent for use of AI. On December 11, 2025, an Executive Order titled “Ensuring a National Policy Framework for Artificial Intelligence” (“EO 14365”) was issued that takes aim at state AI regulations by, among other things, establishing a litigation task force to challenge state AI laws inconsistent with a minimally burdensome national policy framework.

We continue to monitor and evaluate statutory and regulatory proposals related to AI regulation and assess their potential impact.

Debanking and Fair Access

On August 7, 2025, an Executive Order titled “Guaranteeing Fair Banking for All Americans” (“EO 14331”) was issued. The order directed federal banking agencies to identify financial institutions engaged in “politicized or unlawful debanking,” including due to a customer’s political or religious beliefs, and seek remedial actions if such debanking violates applicable law. The order also directed federal banking agencies to consider modifying regulations that could result in such debanking and, to the greatest extent permitted by law, remove reputation risk that could result in such debanking from any guidance documents, manuals or other materials. In response, the Small Business Administration (“SBA”) required SBA lending-program participants to provide certain information and certifications, and the FDIC sent requests to the largest FDIC-supervised banks and conducted a review of FDIC-supervised banks’ policies and procedures. The FDIC and Federal Reserve also announced removal of reputation risk from supervisory materials, and the OCC and FDIC have issued a proposed rule to prohibit use of reputation risk by regulators as a basis for supervisory criticisms or adverse actions. In addition to EO 14331, certain states have enacted fair access laws aimed at preventing similar debanking activities, including Florida, Tennessee and Idaho. We continue to monitor and evaluate regulatory proposals related to debanking and assess their potential impact.

Other Regulated Subsidiaries

BancShares’ broker-dealer and registered investment adviser subsidiaries are regulated by the SEC and, with respect to broker-dealers, by the Financial Industry Regulatory Authority (“FINRA”). The broker-dealer and investment adviser subsidiaries also are subject to additional regulation by states and local jurisdictions. The SEC and FINRA have active enforcement functions that oversee broker-dealers and investment advisers and can bring actions that result in fines, restitution, a limitation on permitted activities, disqualification to continue to conduct certain activities and an inability to rely on certain favorable exemptions. Certain types of infractions and violations also can affect the ability to issue new securities expeditiously. In addition, certain changes in the activities of a broker-dealer require approval from FINRA, and FINRA takes into account a variety of considerations in acting upon applications for such approval, including internal controls, capital levels, management experience and quality, prior enforcement and disciplinary history, and supervisory concerns.

BancShares’ insurance activities are subject to licensing and regulation by state insurance regulatory agencies. Insurance regulatory authorities generally have broad administrative powers with respect to, among other things: licensing companies and agents to transact business; establishing statutory capital and reserve requirements and the solvency standards that must be met and maintained; regulating certain premium rates; reviewing and approving policy forms; regulating unfair trade and claims practices, including through the imposition of restrictions on marketing and sales practices, distribution arrangements and payment of inducements; approving changes in control of insurance companies; restricting the payment of dividends and other transactions between affiliates; and regulating the types, amounts and valuation of investments. Our Vermont insurance captive subsidiary is required to file reports, generally including detailed annual financial statements, with the insurance regulatory authority, and its operations and accounts are subject to periodic examination by such authorities.

16

BancShares’ equipment financing and leasing operations are subject to laws, rules, and regulations administered by authorities in jurisdictions where business is conducted. In the United States, equipment financing and leasing operations are subject to rules and regulations relating to health, safety, operations, maintenance, and mechanical standards promulgated by federal and state agencies and industry organizations.

In connection with its Rail segment, BancShares’ maintains a wholly owned subsidiary, FC International, Inc. (“FC International”) which is a corporation chartered by the Federal Reserve pursuant to Section 25A of the Federal Reserve Act (“Edge Act”). Edge Act corporations are banking organizations that are authorized to engage in international banking and foreign financial transactions, and the U.S. activities of such corporations are generally limited to those that are incidental to their foreign operations. FC International holds equity interests in foreign companies that support our Rail segment. FC International is subject to supervision and regulation by the Federal Reserve, including examination, reporting, capital, and the BSA and AML requirements pursuant to the Edge Act and the Federal Reserve’s Regulation K.

Available Information

We make available on our investor relations website (ir.firstcitizens.com) BancShares’ Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to those reports, free of charge, as soon as reasonably practicable after they are electronically filed with or furnished to the SEC. Interested parties may also directly access the SEC’s website (www.sec.gov), which contains reports, proxy and information statements and other information electronically filed by BancShares. Except as specifically incorporated by reference into this Annual Report on Form 10-K, information on those websites is not part of this report.