FIRST CITIZENS BANCSHARES INC /DE/ (FCNCA) Risk Factors

Item 1A. Risk Factors.

Risk Factor Summary

We are subject to a number of risks and uncertainties that could have a material impact on our business, financial condition and results of operations and cash flows. As a financial services organization, certain elements of risk are inherent in our transactions and operations and are present in the business decisions we make. We encounter risks as part of the normal course of our business, and our success is dependent on our ability to identify, understand and manage the risks presented by our business activities. We categorize risks in this Item 1A. Risk Factors into the following areas, and the principal risks and uncertainties that management believes make an investment in us speculative or risky are summarized within their respective areas:

Strategic Risks

▪We may be adversely affected by risks associated with previous and future acquisitions, and any future acquisitions may be subject to increased regulatory scrutiny.

▪We encounter significant competition that may reduce our market share and profitability and our financial performance depends upon our ability to attract and retain customers for our products and services.

▪Consumers may increasingly decide not to use banks to complete their financial transactions, which could have a material adverse impact on our financial condition and operations.

▪Certain provisions in our Certificate of Incorporation, Bylaws and certain statutes and regulations and the current composition of our stockholders may make it more difficult for a third party to change our management or acquire control of us, even if stockholders might consider the change in management or change in control to be in their best interests.

▪Our Bylaws provide that, unless we consent in writing to the selection of an alternative forum, the Court of Chancery of the State of Delaware, or, if such court lacks jurisdiction, the federal district court of the District of Delaware, will be the sole and exclusive forum for substantially all disputes between us and our stockholders. This could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers, or employees or stockholders.

▪The Parent Company relies on dividends from FCB for returning capital to stockholders, paying dividends on its common and preferred stock and servicing its debt obligations, and FCB’s ability to pay the Parent Company dividends may be restricted.

▪Failure to adopt new technologies that match consumer preferences or to keep pace with or effectively implement technological changes could adversely affect our results of operations and financial condition.

▪We are subject to reputational risks that could harm our business and prospects. If we were subject to reputational harm, it could have a material adverse impact on our business, financial condition and results of operations.

▪The Trump administration has proposed or implemented significant changes to the size and scope of the federal government, including reductions in program or agency funding or workforce, and may continue to do so.

Operational Risks

▪We face significant operational risks in our businesses and may fail to maintain appropriate operational infrastructure and oversight.

▪A cyberattack, information or security breach, or a technology outage of ours or of a third-party could adversely affect our ability to conduct our business, manage our exposure to risk or result in the disclosure or misuse of confidential customer or employee data or proprietary information, and increase our costs to maintain and enhance our operational and security systems and infrastructure. Such an event or resource expenditures could adversely impact our results of operations, liquidity and financial condition.

▪We depend on the effectiveness and integrity of employees, and the systems and controls for which they are responsible, to manage operational risks.

▪We are subject to litigation and other legal liability risks, and our expenses related to such risks may adversely affect our results.

▪We depend on qualified personnel for our success and may not be able to retain or attract such personnel.

▪We are exposed to losses related to fraud.

▪Our business and financial performance could be impacted by natural or man-made disasters, global pandemics, civil unrest, acts of war, terrorist activities, climate change or other adverse external events.

▪We rely on third-parties to provide key components of our business infrastructure, and our third-parties may be responsible for or contribute to failures that adversely affect our operations.

▪Data quality and completeness may not be adequate and could cause financial or reputational harm to FCB.

▪Deposit insurance premiums levied on banks, including FCB, may increase if there is an increase in the number of bank failures, the cost of resolving failed banks, or the FDIC deposit insurance coverage limit.

Credit Risks

▪If we fail to effectively manage credit risk, our business and financial condition will suffer.

▪Our allowance for credit losses and reserve related to off-balance sheet credit exposure may prove to be insufficient to cover actual credit losses in our credit portfolios.

▪Our concentration of loans and leases in certain industries increases the risk of losses and could impair our earnings if these industries experience economic difficulties.

▪Deteriorating collateral values, credit quality, or our reliance on junior liens may adversely impact our business and our results of operations.

▪The financial system is highly interrelated, and the default or threatened default of even a single financial institution could result in significant market-wide liquidity and credit problems, losses or defaults, lead to significant regulatory reform, or result in credit losses through potential counterparty default, any of which may adversely impact our financial condition and results of operations.

18

▪Changes in domestic and foreign trade policies, including the imposition of tariffs and retaliatory tariffs may adversely impact our business, financial condition, and results of operations.

▪We may not be able to realize our entire investment in the equipment that we lease to our customers.

▪Accounting for acquired assets may result in earnings volatility.

Market Risks

▪Failure to effectively manage our interest rate sensitivity within our defined risk appetite could adversely affect our earnings.

▪Unfavorable economic conditions, as considered through a range of metrics, have and could continue to adversely affect our financial condition, results of operations and cash flows.

▪U.S. debt ceiling and budget deficit concerns have and could continue to adversely affect our business.

▪The value of our goodwill may decline in the future.

▪The market price of our common stock may be volatile.

Liquidity Risks

▪If our current level of balance sheet liquidity were to experience significant pressure, it could affect our ability to pay withdrawals by depositors, repay the Purchase Money Note (defined below) and other creditors, and fund our operations.

▪We are subject to enhanced liquidity risk management and other requirements, and failure to meet these requirements could result in regulatory and compliance risks, including possible restrictions on our activities, and inadequate liquidity.

Capital Adequacy Risks

▪Our ability to grow is contingent upon access to capital, which may not be readily available to us as a result of credit rating reductions.

▪If we fail to meet regulatory requirements, including enhanced capital adequacy, liquidity, stress testing, and capital planning requirements, or are subject to certain other legal limitations, our financial condition and ability to pay dividends or make other payments could be adversely affected.

▪Increases to our level of indebtedness could adversely affect our ability to raise additional capital and to meet our obligations.

Compliance Risks

▪We operate in a highly regulated industry, and the laws and regulations that impact our operations, taxes, corporate governance, executive compensation and financial accounting and reporting, including changes in them or our failure to comply with them, may adversely affect us.

▪Failure to meet regulatory requirements related to information security and data privacy may subject us to fines, litigation, or regulatory enforcement actions.

▪We face heightened compliance risks related to certain specialty commercial business lines.

▪We are subject to enhanced prudential standards, and failure to comply with these standards could have a material adverse effect on our business, financial condition or results of operations.

▪We are subject to certain laws and regulations designed to protect consumers in transactions with financial institutions against unfair, deceptive and abusive business practices and compliance with such laws and regulations and related enforcement actions may impact our business operations and profitability.

▪We may be adversely affected by changes in United States and foreign tax laws and other tax laws and regulations.

▪We are subject to environmental, social and governance (“ESG”) risks, which may adversely affect our reputation and ability to retain employees and customers, and failure to comply with applicable regulations could have an adverse affect on our business, financial condition or results of operations.

Financial Reporting Risks

▪Accounting standards may change and increase our operating costs or otherwise adversely affect our results.

▪Our accounting policies and processes require management to make judgments, assumptions or estimates about matters, which may result in us reporting materially different results or amounts than would have been reported using different judgments, assumptions or estimates.

▪Our business is highly quantitative and requires widespread use of financial models for day-to-day operations; these models may produce inaccurate predictions that significantly vary from actual results, and we may rely on them in making decisions that adversely affect our business or the information we provide to our investors and regulators.

▪We may fail to maintain an effective system of internal control over financial reporting, which, among other things, could hinder our ability to prevent fraud and provide reliable financial reports to key stakeholders.

The risks and uncertainties that management believes are material to an investment in us are described below. Additional risks and uncertainties that are not currently known to management or that management does not currently deem material could also have a material adverse impact on our financial condition, the results of our operations or our business. If such risks and uncertainties were to materialize or the likelihoods of the risks were to increase, we could be adversely affected, and the market price of our securities could significantly decline. The below risk factors should be read in conjunction with the information under “Regulatory Considerations” in Item 1. Business, as well as Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations, and the audited consolidated financial statements and Notes to the Consolidated Financial Statements in Item 8. Financial Statements and Supplementary Data.

19

Strategic Risks

We may be adversely affected by risks associated with previous and future acquisitions, and any future acquisitions may be subject to increased regulatory scrutiny.

Although we plan to continue to grow our business organically, we have pursued and expect to continue to pursue acquisition opportunities to support our business strategies and enhance our potential profitability. Consummating an acquisition, including our pending BMO Branch Acquisition, often requires prior federal and state regulatory approval. Changes in policies focused on bank acquisitions may interfere or impede future acquisition opportunities. Refer to Item 1. Business—Regulatory Considerations—Limitations on Mergers & Acquisitions for additional information. Changes made by the federal banking agencies in revamping the bank merger review process have reduced burdens associated with obtaining an approval for bank merger transactions, but larger banking organizations, like us, continue to be subject to enhanced prudential standards and requirements that may be considered as part of the application process, especially in the case of transactions that would result in a banking organization crossing the asset thresholds for a higher category of bank regulation under the Tailoring Rules. Any enhanced regulatory scrutiny of bank mergers and acquisitions or further revisions to the framework for bank merger review could result in future acquisitions being delayed, impeded or subject to material conditions which may impose additional costs or limitations that reduce the anticipated benefits of the proposed transaction.

Acquisitions of financial institutions, assets of financial institutions or other operating entities involve operational risks and uncertainties, including but not limited to:

•difficulties, inefficiencies, or cost overruns associated with the integration of operations, personnel, technologies, services, and products of acquired companies with ours;

•inability to realize the expected revenue increases, cost savings, increases in geographic or product presence, and/or other projected benefits;

•potential disruption to our business; and

•the possible loss of key executive officers, employees and customers.

Furthermore, acquired companies or assets may have unknown or contingent liabilities, exposure to unexpected asset quality problems that require write downs or write-offs and additional regulatory requirements. Due to these and other issues relating to acquisitions, we may not be able to realize projected cost savings, synergies or other benefits associated with any prior or future acquisition. Failure to efficiently integrate any acquired entities or assets into our existing operations could significantly increase our operating costs and consequently have material adverse effects on our financial condition and results of operations.

In the past, we have acquired, and may in the future continue to acquire, certain assets and assume certain liabilities of failed banks in FDIC-assisted transactions. FDIC-assisted transactions, such as the SVBB Acquisition, present unique risks because of the limited due diligence, expedited timelines, minimal negotiation of terms required by the FDIC and the limited availability of audited financial statements of the assets acquired and liabilities assumed. These transactions often require additional resources to service acquired problem loans, costly integration of personnel and operating systems, and the establishment of processes and internal controls to service acquired assets in accordance with applicable FDIC standards. In addition, although the FDIC provides assistance in the form of loss sharing with respect to losses on certain acquired loans, if the covered loans are not managed in accordance with the commercial shared loss agreement, the FDIC has the right to refuse or delay payment for loan losses, which could have an adverse effect on our business, financial condition, results of operations and prospects.

The SVBB Acquisition added new business lines and expanded our geographic scope to new areas. Our future success depends, in part, upon the continued ability to effectively manage this expanded business while continuing to strengthen our reputation among the venture capital and private equity communities, and other participants in the industries that legacy Silicon Valley Bank served.

We encounter significant competition that may reduce our market share and profitability and our financial performance depends upon our ability to attract and retain customers for our products and services.

We operate in a highly competitive industry, and we expect competition to continue to intensify. Refer to Item 1. Business—Competition for additional information. Our profitability depends on our ability to compete successfully with other banks, nonbank providers of banking products and services, and other specialized financial services providers in our market areas. Our primary competitors include local, regional and national banks; credit unions; commercial finance companies; leasing companies; various wealth management providers; private equity firms; private credit providers; hedge funds; independent and captive insurance agencies; mortgage companies; and other non-bank providers of financial services. Some of our larger competitors have the capacity to offer products and services we do not offer, which may enable them to be more aggressive than us in competing for loans and deposits. Some of our non-bank competitors operate in less stringent regulatory environments, and certain competitors are not subject to federal or state income taxes.

20

The fierce competitive pressures that we face adversely affect pricing and other terms for many of our products and services, and we could lose business to competitors or be forced to price products and services on less advantageous terms to retain or attract clients, either of which would adversely affect our profitability. We compete with banks and other financial services companies for deposits. If competitors raise the rates they pay on deposits, our funding costs may increase, either because we raise rates to avoid losing deposits or because we lose deposits and must rely on more expensive sources of funding. In addition, checking and savings account balances and other forms of customer deposits may decrease when customers perceive alternative investments as providing a better risk/return trade-off. Our bank customers could take their money out of FCB and put it in alternative investments, causing us to lose a lower-cost source of funding. Digital asset service providers have also increasingly applied for state or national trust bank charters, which will allow them to compete for deposits and loans and may result in customer attrition from financial institutions that do not offer digital asset services.

Consumers may increasingly decide not to use banks to complete their financial transactions, which could have a material adverse impact on our financial condition and operations.

Technology and other changes are allowing parties to complete financial transactions that historically have involved banks through alternative methods without involving banks. For example, consumers can now maintain funds that would have historically been held as bank deposits in brokerage accounts, mutual funds or virtual accounts. Consumers can also complete transactions, such as paying bills or transferring funds directly without the assistance of banks. Transactions utilizing digital assets, including cryptocurrencies, stablecoins and other similar assets, have increased substantially. Certain characteristics of digital asset transactions, such as the speed with which such transactions can be conducted, the ability to transact without the involvement of regulated intermediaries, the ability to engage in transactions across multiple jurisdictions, and the anonymous nature of the transactions, are appealing to certain consumers. Accordingly, digital asset service providers, which, at present, are not subject to as extensive regulation as banking organizations and other financial institutions, have become active competitors for our customers’ banking business and may have greater flexibility in competing for business. An Executive Order issued by President Trump in early 2025 stated that his administration will support the responsible growth of digital assets, blockchain technology and related technologies across the U.S. economy. The Executive Order includes a prohibition on the creation of a central bank digital currency and states a policy of promoting the development of dollar denominated stablecoins. Refer to Item 1. Business—Regulatory Considerations—Crypto-Asset Related Activities for additional discussion on these developments.

The process of eliminating banks as intermediaries, known as “disintermediation,” could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits. The loss of these revenue streams and the lower cost deposits as a source of funds could have a material adverse effect on our financial condition and results of operations.

Certain provisions in our Certificate of Incorporation, Bylaws and certain statutes and regulations and the current composition of our stockholders may make it more difficult for a third party to change our management or acquire control of us, even if stockholders might consider the change in management or change in control to be in their best interests.

We are a BHC incorporated in the state of Delaware. Certain anti-takeover provisions under Delaware law and certain provisions contained in our Amended and Restated Certificate of Incorporation (our “Certificate of Incorporation) and Amended and Restated Bylaws (our “Bylaws”) could delay or prevent the removal of our directors and other management. The provisions could also delay or make more difficult a tender offer, merger or proxy contest that a stockholder might consider to be in their best interests. For example, our Certificate of Incorporation and Bylaws:

•allow the Board to issue and set the terms of preferred shares without further stockholder approval, subject to the terms of any class or series of preferred shares;

•limit who can call a special meeting of stockholders to the Board, the Chairman of the Board, the Chief Executive Officer, the President, or the Secretary;

•establish advance notice requirements for nominations for election to the Board and proposals of other business to be considered at annual meetings of stockholders; and

•authorize the issuance of two classes of common stock, one of which, Class B common stock, par value $1 per share (“Class B common stock”), is entitled to cast 16 votes per share. As of December 31, 2025, approximately 60% of the outstanding shares of Class B common stock and over 20% of the outstanding Class A common stock may be deemed to be beneficially owned or controlled by the Holding family members expected to be identified in the 2026 Proxy Statement as principal stockholders of ours.

As of December 31, 2025, members of the Holding family and entities related to them may be deemed to beneficially own or control shares in excess of 50% of our voting power of our common stock. These provisions, together with the voting power of members of the Holding family and entities related to them, may discourage bids for our common stock at a premium over market price, adversely affecting the price that could be received by our stockholders for our common stock and render the removal of our Board and management more difficult.

21

Our Bylaws provide that, unless we consent in writing to the selection of an alternative forum, the Court of Chancery of the State of Delaware, or, if such court lacks jurisdiction, the federal district court of the District of Delaware, will be the sole and exclusive forum for substantially all disputes between us and our stockholders. This could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers, or employees or stockholders.

Our Bylaws provide that, unless we consent in writing to the selection of an alternative forum, the Court of Chancery of the State of Delaware, or, if such court lacks jurisdiction, the federal district court of the District of Delaware, will be the sole and exclusive forum for (i) any derivative action or proceeding brought on our behalf; (ii) any action asserting a claim of breach of a fiduciary duty owed by any of our directors, officers, other employees or stockholder to us or our stockholders; (iii) any action asserting a claim against us arising pursuant to any provision of the General Corporation Law of the State of Delaware or as to which the General Corporation Law of the State of Delaware confers jurisdiction on the Court of Chancery of the State of Delaware; or (iv) any action asserting a claim against us governed by the internal affairs doctrine. Our choice of forum provisions do not preclude or contract the scope of exclusive federal or concurrent jurisdiction for any actions brought under the Securities Act of 1933, as amended, or the Securities Exchange Act of 1934, as amended (the “Exchange Act”). Accordingly, our choice of forum provisions do not provide that they will relieve us of our duties to comply with the federal securities laws and the rules and regulations thereunder, nor do they provide that our stockholders will be deemed to have waived our compliance with these laws, rules and regulations.

These choice of forum provisions may limit a stockholder’s ability to bring a claim in a judicial forum of its choosing for disputes with us or our directors, officers or other employees or agents, which may discourage lawsuits against us and our directors, officers and other employees or agents.

There is some uncertainty as to whether a court would enforce our exclusive forum provisions. If a court were to find the choice of forum provision contained in our Bylaws to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such action in other jurisdictions, which could harm our business, results of operations, and financial condition. Even if we are successful in defending against these claims, litigation could result in substantial costs and be a distraction to management and other employees.

The Parent Company relies on dividends from FCB for returning capital to stockholders, paying dividends on its common and preferred stock and servicing its debt obligations, and FCB’s ability to pay the Parent Company dividends may be restricted.

The Parent Company is a separate legal entity from FCB, but the Parent Company derives most of its revenue and cash flow from dividends paid by FCB. These dividends are the primary source from which the Parent Company returns capital to stockholders, whether through the payment of dividends on its common and preferred stock or the repurchase of shares pursuant to a share repurchase program (“SRP”). In addition, these dividends are the primary source for paying interest and principal on its debt obligations. State and federal laws impose restrictions on the dividends that FCB may pay to the Parent Company. Refer to Item 1. Business—Regulatory Considerations—Limitations on Dividends and Other Payments for additional information. Among other things, we are required to submit an annual capital plan to the Federal Reserve that includes any planned dividends or equity repurchases over a set planning horizon. The Federal Reserve could prohibit or limit the Parent Company’s payment of dividends, redemptions, or stock repurchases if it determines that payment of the dividend or such equity repurchase would constitute an unsafe or unsound practice. In the event FCB is unable to pay dividends to us for an extended period of time, the Parent Company may not be able to service its debt obligations or pay dividends on its common or preferred stock, and the inability to receive dividends from FCB could consequently have a material adverse effect on our business, financial condition and results of operations.

Failure to adopt new technologies that match consumer preferences or to keep pace with or effectively implement technological changes could adversely affect our results of operations and financial condition.

The financial services industry is continually undergoing rapid technological change with frequent introduction of new technology-related products and services, including recent and rapid developments in AI and crypto-assets and related technologies. The effective use of technology increases efficiency and enables financial institutions to better serve customers and to reduce costs. The rapid growth of new technologies related to the digitization of banking services and capabilities, including through internet services and mobile devices, requires us to continuously evaluate our product and service offerings to ensure they remain competitive. Our success depends in part on our ability to adapt and deliver our products and services in a manner responsive to evolving industry standards and consumer preferences. The cost of investing in, implementing and maintaining such technology is high, and there can be no assurance, given the fast pace of change and innovation, that our technology, either purchased or developed internally, will meet our needs or allow us to remain competitive, in a timely, cost-effective manner or at all.

22

The use of AI presents its own unique risks. Third-party development of AI models introduces risks related to how those models are developed, trained, and deployed, including unauthorized material in training data and limited visibility into risk mitigation steps. The legal and regulatory environment for AI is uncertain and rapidly evolving, both in the United States and internationally, potentially increasing compliance costs and risk of non-compliance. We are also exposed to the risk that generative AI models may produce incorrect outputs, release confidential information, reflect biases, infringe intellectual property, or otherwise cause harm. Their complexity makes it challenging to understand outputs and comply with documentation or explanation requirements. Crypto-asset related activities also present unique risks, including market and liquidity risk, operational and cybersecurity risks, consumer protection requirements and AML requirements. Refer to Item 1. Business—Regulatory Considerations—Artificial Intelligence and —Crypto-Asset Related Activities for additional information. Failure to adopt new technologies that match consumer preferences or a failure to keep pace with or effectively implement technological changes could adversely affect our results of operations and financial condition.

We are subject to reputational risks that could harm our business and prospects. If we were subject to reputational harm, it could have a material adverse impact on our business, financial condition and results of operations.

Maintaining our reputation is important to our business and our brand. Sources of reputational risks have included and may in the future include, among others, cyberattacks, legal claims and regulatory action, fraudulent activities aimed at us or parties with whom we do business, inaccurate or incomplete data, insufficient operational infrastructure or oversight, employee misconduct, non-compliance with applicable law or regulatory policies by us or parties with whom we do business, any inability to provide reliable financial reports or maintain effective internal controls, failure of our ESG practices to meet investor or stakeholder expectations, or public perceptions of our business practices, including our deposit pricing and acquisition activity.

Our reputation may also be damaged by adverse publicity or negative information regarding us, whether or not true, that may be published or broadcast by the media or posted on social media, non-mainstream news services or other parts of the internet. This risk can be magnified by the speed and pervasiveness with which information is disseminated through those channels. Because we conduct most of our businesses under the “First Citizens” brand, negative public opinion about one business could affect our other businesses.

Reputational harm may lead to, among other things, a decline in our deposit balances and an increased risk that we become subject to litigation and regulatory action. Such reputational harm could have a material adverse impact on our business, financial condition and results of operations.

The Trump administration has proposed or implemented significant changes to the size and scope of the federal government, including reductions in program or agency funding or workforce, and may continue to do so.

The Trump administration has proposed or implemented significant changes to the size and scope of the federal government and may continue to do so. In addition to changes in policy direction, these have included challenges to agency independence as well as agency reorganizations, alteration of government payment systems, leadership and personnel changes, and reductions in program or agency funding or workforce, including workforce reductions at federal banking agencies and the CFPB. These changes may have differing impacts on the economy as a whole or different regions or segments of the economy or asset classes which are difficult to predict at this time. These changes could also result in increased uncertainty and compliance costs if we become subject to additional state and local laws in absence of comprehensive federal oversight or the changes are reversed or limited by judicial challenge or a later executive administration. Accordingly, it is possible that such changes may be materially adverse to our customers, business, financial condition and results of operation.

23

Operational Risks

We face significant operational risks in our businesses and may fail to maintain appropriate operational infrastructure and oversight.

Safely conducting and growing our business requires that we create and maintain an appropriate operational and organizational control infrastructure. Operational risk can arise in numerous ways, including, but not limited to, employee fraud, customer fraud, control lapses in bank operations and information technology, and pace of change brought about by organizational growth. Our dependence on our employees and internal and third-party automated systems and vendors to record and process transactions may further increase the risk that technical failures or system-tampering will result in losses that are difficult to detect. Our internal controls that are intended to safeguard and maintain our operational and organizational infrastructure and information, as well as oversee and monitor control effectiveness, have inherent limitations and may not be successful. We have been, and may in the future be, subject to disruptions of our operating systems arising from events that are wholly or partially beyond our control. Failure to maintain appropriate operational infrastructure and oversight or to safely operate our business can lead to loss of service to customers, reputational harm, legal actions and noncompliance with various laws and regulations, all of which could have a material adverse impact on our business, financial condition and results of operations.

A cyberattack, information or security breach, or a technology outage of ours or of a third-party could adversely affect our ability to conduct our business, manage our exposure to risk or result in the disclosure or misuse of confidential customer or employee data or proprietary information, and increase our costs to maintain and enhance our operational and security systems and infrastructure. Such an event or resource expenditures could adversely impact our results of operations, liquidity and financial condition.

Our businesses are highly dependent on the security and efficacy of our infrastructure, computer and data management systems, as well as those of third parties with whom we interact or on whom we rely. Our businesses rely on the secure processing, transmission, storage and retrieval of confidential, proprietary and other information in our computer and data management systems and networks, and in the computer and data management systems and networks of third parties. In addition, to access our network, products and services, our customers and other third parties may use personal mobile devices or computing devices that are outside of our network environment and are subject to their own cybersecurity risks, which may provide a point of entry for adverse effects on our own network environment.

We, as well as our customers, regulators, third-party service providers, and other third parties with whom we do business, have been subject to, and are likely to continue to be the target of, cyberattacks and information or security breaches. These cyberattacks and information or security breaches include computer viruses, malicious or destructive code, ransomware, phishing attacks, denial of service or other security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary or personal data. We cannot implement guaranteed preventive measures against all security threats and we may fail to detect breaches when they occur.

Existing and future geopolitical conflicts potentially heighten the risk of cyberattacks and information or security breaches from nation-state actors or others that may be directed at the United States and its critical infrastructure, such as the financial services sector. Due to FCB’s expanded geographic footprint and increased prominence, we may be at higher risk of being targeted and impacted by geopolitical conflicts. If such cyberattacks and information or security breaches occur, it could result in severe costs and disruptions to companies and their operations as well as to governmental entities.

Cybersecurity risks for large banking institutions, such as FCB, have significantly increased in recent years in part because of the proliferation of new technologies, the use of the internet and mobile banking to conduct financial transactions, and the increased sophistication of criminal activities. Refer to Item 1. Business—Regulatory Considerations—Artificial Intelligence and —Crypto-Asset Related Activities for additional information. These risks are expected to continue and further intensify in the future. Even the most advanced control environment may be vulnerable to compromise given the possibility of employee error, failures to follow security procedures or malfeasance. Additionally, the increase of supply chain attacks, including potential attacks on third parties with access to our data or those providing critical services to us, remain an operational risk. As cyber threats continue to evolve, we will be required to expend significant additional resources to continue to modify or enhance our layers of defense or to investigate and remediate any information security vulnerabilities. Furthermore, past and future business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies.

24

We also face indirect technology, cybersecurity and operational risks relating to customers and other third parties with whom we do business or upon whom we rely to facilitate or enable our business activities, including financial counterparties; financial intermediaries such as clearing agents, exchanges and clearing houses; vendors and other external dependencies; regulators; and providers of critical infrastructure such as internet access and electrical power. As a result of increasing consolidation, interdependence and complexity of financial entities and technology systems, an event that materially degrades, or disrupts systems of one or more financial entities or related third-parties could have a material impact on counterparties or other market participants, including us. This consolidation, interdependence and complexity also increases the risk of operational failure, on both individual and industry-wide bases, as disparate systems need to be integrated, often on an accelerated basis. Any third-party technology failure, cyberattack or other information or security breach, termination or constraint could, among other things, adversely affect our ability to effect transactions, service our customers, manage our exposure to risk or expand our businesses.

Cyberattacks or other information or security breaches, whether directed at us or third parties, may adversely impact our results of operations, liquidity and financial condition or have other material consequences including loss of customers and business opportunities, disruption to our operations and business, misappropriation, disclosure or destruction of our confidential information and that of our customers, or damage to our customers’ and third parties’ computers or systems. In addition, such penetration or circumvention could result in a violation of applicable data privacy and protection laws and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our security measures, reputational damage, reimbursement or other compensatory costs and additional compliance costs and insurance coverage may not be available for such losses or, where available, such losses may exceed insurance limits.

We depend on the effectiveness and integrity of employees, and the systems and controls for which they are responsible, to manage operational risks.

We depend on our employees and the employees of third-parties to design, manage and operate our systems and controls. We also depend on these individuals and the systems and controls for which they are responsible to identify and mitigate the risks that are inherent in our business, relationships and activities, including compliance, risk management and fraud prevention.

As a result of this dependence, we are subject to human vulnerabilities, which may range from innocent human error to misconduct or malfeasance. Our controls and procedures may not be adequate to prevent problems resulting from such human vulnerabilities. We may fail to adequately maintain a culture of risk management among our employees. These concerns are increased when we introduce new products or services, acquire or invest in a business or implement new technologies or change systems, processes or procedures (including in connection with strategic efforts to streamline the information technology operating environment and improve data infrastructure), as we may fail to adequately identify or manage operational risks resulting from such changes. These concerns may be further exacerbated by employee turnover and labor shortages. While we continue to rely on many manual systems and controls, we are increasingly relying on automation, which presents its own risks, including potential outages or other problems, and does not eliminate the need for effective design, operation and remediation by employees.

Any of the foregoing may lead to customer remediation costs, regulatory fines or penalties, litigation or enforcement actions or limitations on our business activities, as well as reputational harm and an erosion in customer confidence, any of which could impact our financial and competitive position.

We are subject to litigation and other legal liability risks, and our expenses related to such risks may adversely affect our results.

We are subject to litigation and other legal liability risks in the ordinary course of our business. Claims and legal actions, including supervisory actions by our regulators, that have been or may be initiated against us (including against entities that we acquire) or that involve matters for which we have indemnification obligations or other retained liabilities from time to time could involve large monetary sums and significant defense costs. Claims have previously and may in the future include those from third parties alleging infringement of their claimed intellectual property rights, which if resolved in their favor could prevent us from using certain technology or trademarks or providing certain products or services. The number of claims and legal actions we face may vary from time to time and have typically increased during credit crises. The outcomes of such cases are always uncertain until finally adjudicated or resolved.

25

In the course of our business, we may foreclose on and take title to real estate that contains or was used in the manufacture or processing of hazardous materials or that is subject to other environmental risks. In addition, we may lease equipment to our customers that is used to mine, develop, and process hazardous materials, and our railcars may be used to transport hazardous materials. As a result, we could be subject to environmental liabilities or claims for negligence, property damage or personal injury with respect to these properties or equipment, as well as potential impacts to our reputation. We may be held liable to a governmental entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination, accidents or other hazardous risks, or may be required to investigate or clean up hazardous or toxic substances or chemical releases at a property. The costs associated with investigation or remediation activities could be substantial. In addition, if we are the owner or former owner of a contaminated site or equipment involved in a hazardous incident, we may be subject to common law claims by third parties based on damages and costs resulting from environmental contamination, property damage, personal injury or other hazardous risks emanating from the property or related to the equipment.

Although we establish reserves for legal claims when payments associated with the claims become probable and our liability can be reasonably estimated, these reserves may not be adequate and the actual amount paid in resolution of a legal claim may be substantially higher than any amounts reserved for the matter.

Substantial or significant legal claims or regulatory action against us or that involve matters for which we have indemnification obligations or other retained liabilities could have material adverse financial effects or cause significant reputational harm to us, which in turn could seriously harm our business prospects. For additional information, refer to the Notes to the Consolidated Financial Statements contained in Item 8. Financial Statements and Supplementary Data, Note 22—Commitments and Contingencies.

We depend on qualified personnel for our success and may not be able to retain or attract such personnel.

As a human capital-intensive business, our success largely depends on our ability to attract and retain qualified executive officers and management, financial, compliance, technical, operations, risk management, sales, and support employees. Attracting and retaining key employees is of heightened importance due to the significant expansion of the size, geographic reach and operational scope of our business that has occurred in connection with merger and acquisition transactions.

We face significant competition in the recruitment and retainment of qualified executive officers and other employees, and our compensation practices are subject to review and oversight of the Federal Reserve, the FDIC and other regulators. Refer to Item 1. Business—Regulatory Considerations—Compensation for additional information. If we are unable to attract and retain qualified employees due to competition, regulatory limitations or other reasons, or if the compensation costs required to attract and retain employees become more significant, our performance, including our competitive position, could be materially adversely affected. If, for whatever reason, we lost any of our current executive officers or other key employees, it may disrupt our business and growth strategies and could adversely affect our financial condition and results of operations.

We are exposed to losses related to fraud.

As technology continues to evolve, criminals are using increasingly more sophisticated techniques to commit fraud, hide fraudulent activity, and proliferate effective techniques through social media. Fraudulent activity that we have been and are likely to continue to be exposed to can come in many forms, including debit card/credit card fraud, check fraud, wire fraud, electronic scanning devices attached to automated teller machines, use of AI to facilitate the perpetration of social engineering and impersonation schemes and identity theft, peer-to-peer payment fraud, social engineering, digital fraud, malware, and phishing, smishing, or vishing attacks to obtain personal information and fraudulent impersonation of our customers through the use of falsified documents, fake identification, or stolen credentials. We expect that combating fraudulent activities as they evolve will require continued ongoing investments and attention as significant fraud could cause us direct losses for which insurance coverage may not be available, or where available, that exceed insurance limits, result in potential legal actions as a result of operational deficiency or noncompliance with regulatory standards, or impair our customer relationships, among other potential consequences, adversely impacting our reputation or results of operations.

26

Our business and financial performance could be impacted by natural or man-made disasters, global pandemics, civil unrest, acts of war, terrorist activities, climate change or other adverse external events.

Natural or man-made disasters (including, but not limited to, earthquakes, hurricanes, tornadoes, floods, tsunamis, fires, pollution, and explosions), global pandemics, civil unrest, acts of war, terrorist activities, climate change or other adverse external events, including government actions or other restrictions in connection with such events, could hurt our business and financial performance (i) directly through damage to our facilities or other impacts to our ability to conduct business in the ordinary course, and (ii) indirectly through such damage or impacts to our customers, suppliers or other counterparties. These events are largely outside of our control, and our ability to minimize the consequences of such events is limited. In particular, a significant amount of our business is concentrated in North Carolina, South Carolina, California, Texas, New York, Massachusetts and Florida, including areas where our operational facilities and retail and commercial customers have been and, in the future, could be impacted by hurricanes and flooding, earthquakes, wildfires, and rising sea levels. We also do business in Georgia, Virginia, Nebraska, Arizona, New Jersey, Hawaii, Nevada, as well as in Canada and other international locations our clients are domiciled, all of which also include areas significantly exposed to the risks of such events. These events or an increase in their frequency or magnitude may adversely affect our operations or the value of real properties securing our loans, or result in adverse impacts us or our customers, suppliers or other counterparties in connection with reductions in regional and local economic activity.

There has been evolving regulatory, political and social attention to the issue of climate change and related environmental sustainability matters. Refer to Item 1. Business—Regulatory Considerations—Climate for additional information on related regulatory matters. Consumers and businesses in communities that we serve may change their behavior and preferences because of issues related to climate change and new laws and regulations aimed at mitigating negative effects. Monitoring and complying with changing regulatory climate requirements may increase compliance costs and could result in the imposition of taxes and fees, the required purchase of emission credits or the implementation of significant operational changes, each of which may require us to expend significant capital and incur compliance, operating, maintenance and remediation costs.

We rely on third-parties to provide key components of our business infrastructure, and our third-parties may be responsible for or contribute to failures that adversely affect our operations.

Third-parties provide key components of our business infrastructure, including certain data processing and information services. Their services could be difficult to quickly replace in the event of failure or other interruption in service. Failures of certain third-parties to provide services could adversely affect our ability to deliver products and services to our customers leading to non-compliance with regulatory requirements. Third-parties also present information security risks to us, both directly and indirectly through our customers. While we monitor significant third-party risks, including the financial stability of critical vendors, our monitoring may be inadequate and incomplete. The failure of a critical third-party to provide key components of our business infrastructure could substantially disrupt our business and cause us to incur significant expense while harming our relationships with our customers.

Data quality and completeness may not be adequate and could cause financial or reputational harm to FCB.

Our data governance program is reliant on the execution of procedures, process controls, and system functionality, and errors may occur. Incomplete, inconsistent, or inaccurate data could result from, but not limited to, human error, system limitations, new products, changes in reporting requirements, and acquisitions. Incomplete, inconsistent, or inaccurate data could lead to non-compliance with regulatory requirements and result in fines. Additionally, adverse impacts on customers could result in reputational harm and customer attrition. Inaccurate or incomplete data presents the risk that business decisions relying on such data will prove inefficient, ineffective or harmful to us. Data deficiencies could also impair our ability to adequately and timely assess the impacts of and response to incidents. Information we provide to our investors and regulators may also be negatively impacted by inaccurate or incomplete data, which could have a wide range of adverse consequences such as legal liability and reputational harm.

Deposit insurance premiums levied on banks, including FCB, may increase if there is an increase in the number of bank failures, the cost of resolving failed banks, or the FDIC deposit insurance coverage limit.

The FDIC maintains the DIF to protect insured depositors in the event of bank failures. The DIF is funded by insurance premiums assessed on IDIs including FCB. Insurance premiums paid by banks, including FCB, could significantly increase if the FDIC requires higher premiums, including due to an increase in the number and cost of future bank failures or in the FDIC deposit insurance coverage limit. Refer to Item 1. Business—Regulatory Considerations—FDIC Insurance for additional information on insurance premiums, including special assessments.

27

Credit Risks

If we fail to effectively manage credit risk, our business and financial condition will suffer.

Effectively managing credit risks is essential for the operation of our business. There are credit risks inherent in making any loan, including risks relating to repayment, the period of time over which the loan may be repaid, sufficiency of loan underwriting and guidelines, changes in economic and industry conditions, dealing with individual borrowers and uncertainties as to the future value of collateral. Our loan approval procedures and credit risk monitoring may be or become inadequate to appropriately manage the inherent credit risks associated with lending. Our credit administration personnel, policies and procedures may not adequately adapt to changes in economic or other conditions affecting customers and the quality of our loan portfolio. Any failure to manage such credit risks may materially adversely affect our business, results of operations and financial condition because it may lead to loans that we make not being paid back in part or in full on a timely basis or at all.

Our allowance for credit losses and reserve related to off-balance sheet credit exposure may prove to be insufficient to cover actual credit losses in our credit portfolios.

We maintain an allowance for loan and lease losses (“ALLL”) that is designed to cover expected credit losses on loans and leases that borrowers may not repay in their entirety. A reserve is also maintained in other liabilities to cover expected losses for off-balance sheet credit exposures. Accounting measurements related to asset impairment and the ALLL require significant estimates that are subject to uncertainty and revisions due to new information and changing circumstances. The significant uncertainties surrounding our borrowers’ abilities to conduct their businesses successfully through changing economic environments, competitive challenges and other factors complicate our estimates of the risk and amount of loss on any loan. Due to the degree of uncertainty and the susceptibility to change, the actual losses may vary substantially from current estimates. We also expect fluctuations in the ALLL due to economic changes nationally as well as locally within the states in which we conduct business. The ALLL and the reserve related to off-balance sheet credit exposures may not be sufficient to cover actual losses, and future provisions for such losses could also materially and adversely affect our operating results and are also subject to significant uncertainties and fluctuations.

As an integral part of their examination process, our banking regulators periodically review the ALLL and may require us to increase it by recognizing additional provisions for credit losses charged to expense or to decrease the allowance by recognizing loan charge-offs, net of recoveries. Any future provisions for credit losses or required loan charge-offs could materially and adversely affect our financial condition and results of operations and are subject to significant uncertainties and fluctuations.

Our concentration of loans and leases in certain industries increases the risk of losses and could impair our earnings if these industries experience economic difficulties.

Our loans and leases include concentrations in non-depository financial institutions (“NDFIs”) and the healthcare and technology industries. Although we believe our aggregate loan and lease portfolio is diversified, borrowers in certain industries may have a heightened vulnerability to negative economic conditions. For example, NDFIs may be subject to a less stringent regulatory environment than IDIs or BHCs, which could enable NDFIs that make loans to be less risk-sensitive in their lending which could increase the risk of default on loans NDFIs make and, consequently, the loans we make to NDFIs. There has also been recent focus on the private credit regulatory environment. An increase in regulations applicable to NDFIs could have an adverse affect on their profitability or ability to pay financial obligations, including loans payable to FCB.

Loans to NDFIs may include lending to privately held companies, many of which could be in the healthcare and technology industries. Repayment of loans for early-stage and mid-stage privately held companies may depend upon receipt by those borrowers of additional financing from venture capitalists or others, or, in some cases, a successful sale to a third-party, public offering or other form of liquidity event. Decreases in the amount of equity capital available to early-stage and mid-stage companies, including through a decrease in merger and acquisition activity, could adversely impact the ability of certain borrowers to repay their loans to us. Additionally, statutory or regulatory changes relevant to the medical and dental industries could negatively impact these borrowers’ businesses and their ability to repay their loans with us.

If such events occur, our levels of nonperforming assets and charge-offs may increase, and we may be required to increase our ALLL through additional provisions on our income statement, which would reduce reported net income and could have an adverse effect on our business, financial condition, results of operations and prospects.

Refer to Part II, Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations—Risk Management—Credit Risk—Concentration for additional information on NDFIs and loan concentrations.

28

Deteriorating collateral values, credit quality, or our reliance on junior liens may adversely impact our business and our results of operations.

As a lender, we are exposed to the risk that our customers will be unable to repay their loans and other obligations in accordance with the terms of the relevant agreements, and that any collateral securing the payment of their loans and obligations may be insufficient to assure full repayment. Credit losses are inherent in the business of making loans and entering into other financial arrangements. Factors that influence our credit losses include overall economic conditions affecting businesses and consumers, generally, but also residential and commercial real estate (“CRE”) valuations. For example, real property collateral values may be impacted by economic conditions in the real estate market and may result in losses on loans that, while adequately collateralized at the time of origination, become inadequately collateralized over time. CRE loans may involve a higher risk of default compared to our other types of loans as a result of several factors, including, but not limited to, prevailing economic conditions and volatility in real estate markets, the growth of e-commerce, occupancy, rental collections, interest rates, and collateral value. In addition, we rely on certain junior liens which are concentrated in our consumer revolving mortgage loan portfolio. Approximately three-quarters of the consumer revolving mortgage portfolio is secured by junior lien positions, and lower real estate values for collateral underlying these loans may cause the outstanding balance of the senior lien to exceed the value of the collateral, resulting in a junior lien loan becoming effectively unsecured. Inadequate collateral values, rising interest rates and unfavorable economic conditions could result in greater delinquencies, write-downs or charge-offs in future periods, which could have a material adverse impact on our results of operations and capital adequacy.

The financial system is highly interrelated, and the default or threatened default of even a single financial institution could result in significant market-wide liquidity and credit problems, losses or defaults, lead to significant regulatory reform, or result in credit losses through potential counterparty default, any of which may adversely impact our financial condition and results of operations.

The financial system, including the soundness and stability of many financial institutions, is highly interrelated as a result of credit, trading, clearing, counterparty and other relationships between the institutions. As a result, concerns about, or a default or threatened default by, one institution could lead to significant market-wide liquidity and credit problems, losses or defaults by us or other institutions. Recent bank failures have caused significant market volatility, regulatory uncertainty, and decreased confidence in the U.S. banking system. In response to these bank failures, the U.S. government has proposed a variety of measures and new regulations designed to strengthen capital levels, liquidity standards, and risk management practices and otherwise restore confidence in financial institutions. While actions of the current presidential administration regarding the U.S. banking system appear to be less restrictive, any reforms, if adopted, could have a significant impact on banks and BHCs, including us. In addition, we have credit exposure to numerous financial institutions. Because of the closely interrelated dependencies between us and other financial institutions in a rapidly changing environment, our financial institutions portfolio management practices may not be able to offset the residual credit risk from a counterparty default and may result in credit losses. The foregoing may adversely impact our financial condition and results of operations.

Changes in domestic and foreign trade policies, including the imposition of tariffs and retaliatory tariffs, may adversely impact our business, financial condition, and results of operations.

The U.S. government announced changes to its trade policies in 2025 and significantly increased tariffs on certain imports under emergency authorities, including the International Emergency Economic Powers Act (“IEEPA”). In February 2026, the Supreme Court of the United States ruled that IEEPA does not authorize the President to impose tariffs. The current tariff environment remains dynamic and uncertain, including regarding potential refunds of tariffs paid under IEEPA, and the U.S. government could respond with replacement measures under other legal authorities. Replacement measures and changes to tariffs and other trade restrictions may lead to continuing uncertainty and volatility in U.S. and global financial markets and economic conditions which could cause adverse changes in the availability, terms and cost of capital. Additionally, potential tariffs or other U.S. trade policy measures have triggered and may trigger additional retaliatory actions by other countries such as China. Increased tariffs and trade restrictions may cause the prices of our customers’ products to increase, which could reduce demand for such products, or reduce our customers’ margins, and adversely impact their revenues, financial results, and ability to service debt, which in turn, could adversely impact our business, financial condition and results of operations.

29

We may not be able to realize our entire investment in the equipment that we lease to our customers.

Our portfolio includes leased equipment, including, but not limited to, railcars and locomotives, technology and office equipment and medical equipment. The realization of equipment values (residual values) during the life and at the end of the term of a lease is an important element in the profitability of our leasing business. At the inception of each lease, we record a residual value for the leased equipment based on our estimate of the future value of the equipment at the end of the lease term or end of the equipment’s estimated useful life. If the market value of leased equipment decreases at a rate greater than we projected, whether due to rapid technological or economic obsolescence, unusual wear and tear on the equipment, excessive use of the equipment, recession or other adverse economic conditions impacting supply and demand, it could adversely affect the current values or the residual values of such equipment.

A significant downturn in shipping by railcars could negatively impact our Rail segment, and volatility in the price of, and demand for, oil and gas may have negative effects on our loan exposures in the exploration and production section, and could also decrease the demand for our railcars.

Accounting for acquired assets may result in earnings volatility.

Fair value discounts that are recorded at the time an asset is acquired are accreted into interest income based on United States Generally Accepted Accounting Principles (“GAAP”). The rate at which those discounts are accreted is unpredictable and the result of various factors including prepayments and estimated credit losses, which may result in earnings volatility. Post-acquisition credit deterioration results in the recognition of provision expense, adversely affecting our financial condition and results of operations.

Market Risks

Failure to effectively manage our interest rate sensitivity within our defined risk appetite could adversely affect our earnings.

Our results of operations and cash flows are highly dependent upon net interest income (“NII”). Interest rates are highly sensitive to many factors that are beyond our control, including general economic and market conditions and policies of various governmental and regulatory agencies, particularly the actions of the Federal Reserve’s Federal Open Market Committee (“FOMC”). Changes in monetary policy, including changes in interest rates, could influence interest income, interest expense, and the fair value of our financial assets and liabilities. If changes in interest rates on our interest-earning assets are not equal to the changes in interest rates on our interest-bearing liabilities, our NII and, therefore, our net income, could be adversely impacted.

Changes in monetary policy by the Federal Reserve resulting in lower interest rates may negatively impact our performance and financial condition due to the composition of our interest rate sensitive assets and liabilities. Our portfolio is generally in a net asset-sensitive position whereby our assets reprice faster than our liabilities, which is generally concentrated at the short end of the yield curve. While our interest expense may decline, the impact on our interest-rate sensitive assets may be greater, resulting in a potential decrease to our NII.

Conversely, if interest rates rise, our interest expense will increase and our net interest margin (“NIM”) may decrease, negatively impacting our performance and our financial condition. To the extent banks and other financial services providers compete for interest-bearing deposit accounts through higher interest rates, our deposit base could be reduced if we are unwilling to pay those higher rates. If we decide to compete with those higher interest rates, our cost of funds could increase and our NIM could be reduced, dependent on the timing and sensitivities of our interest-earning assets and interest-bearing liabilities. Additionally, higher interest rates may impact our ability to originate new loans. Increases in interest rates could adversely affect the ability of our borrowers to meet higher payment obligations. If this occurred, it could cause an increase in nonperforming assets and net charge-offs.

The higher interest rate environment of recent periods, and our offerings of higher rates to attract or maintain deposits, has increased the cost of deposits, and may continue to do so, dependent upon the FOMC’s actions and other factors. We cannot control or predict with certainty changes in interest rates. The forecasts of future NII by our interest rate risk monitoring system are estimates and may be inaccurate. Actual interest rate movements may differ from our forecasts, and unexpected actions by the FOMC may have a direct impact on market interest rates. Any failure on our part to effectively manage our interest rate sensitivity within our defined risk appetite could adversely affect our earnings.

In addition, the high interest rate environment has increased costs on our other funding sources, and may continue to do so, in the event we issue additional debt or utilize other funding sources.

30

Unfavorable economic conditions, as considered through a range of metrics, have and could continue to adversely affect our financial condition, results of operations and cash flows.

Our business is subject to periodic fluctuations based on international, national, regional and local economic conditions. These fluctuations are not predictable, and cannot be controlled. The markets in which we have the greatest physical presence are North Carolina, South Carolina, California, Virginia, Georgia, and Florida, and we are expanding in several states in the Midwest, Great Plains and the West regions in connection with the planned BMO Branch Acquisition. We also do business in Canada, primarily related to our rail portfolio, and we conduct limited business operations in foreign jurisdictions. Unfavorable changes in unemployment, real estate values, inflation, interest rates, foreign currency exchange rate fluctuation or worsening economic conditions within our markets, particularly within those with our greatest presence, have had and could continue to have a material adverse effect on our financial condition, results of operations and cash flows.

U.S. debt ceiling and budget deficit concerns have and could continue to adversely affect our business.

The level of United States debt and global economic conditions can have a destabilizing effect on financial markets. For example, a U.S. government debt default, threatened default, or downgrade of the sovereign credit ratings of the United States by credit rating agencies, could have an adverse impact on the financial markets, interest rates and economic conditions in the United States and worldwide. The U.S. debt ceiling and budget deficit concerns in recent years have increased the possibility of U.S. government shutdowns (like the one experienced in the fourth quarter of 2025), forced federal spending reductions, debt defaults, credit-rating downgrades and an economic slowdown or recession in the United States. Political tensions may make it difficult for the U.S. Congress to agree on any further increases to or suspension of the debt ceiling in a timely manner or at all, which may lead to a default by the U.S. government or downgrades of its credit ratings. A debt default or further downgrade to the U.S. government’s sovereign credit rating or its perceived creditworthiness could also adversely affect the ability of the U.S. government to support the financial stability of the Federal National Mortgage Association and the Federal Home Loan Mortgage Corporation, commonly known as Fannie Mae and Freddie Mac, respectively, as well as the Federal Home Loan Banks (“FHLBs”). Weakness in any of our market areas could have an adverse impact on our earnings, and consequently, our financial condition and capital adequacy.

The value of our goodwill may decline in the future.

Our goodwill could become impaired in the future. We test goodwill for impairment at least annually, comparing the estimated fair value of a reporting unit with its net book value. We also test goodwill for impairment when certain events occur, such as a significant decline in our expected future cash flows, a significant adverse change in the business climate or a sustained decline in the price of our common stock. These tests may result in a write-off of goodwill deemed to be impaired, which could have a significant adverse impact on our financial results.

The market price of our common stock may be volatile.

Although publicly traded, our common stock, particularly our Class B common stock, has less liquidity and public float than many other large, publicly traded financial services companies. Lower liquidity increases the price volatility of our common stock and could make it difficult for our stockholders to sell or buy our common stock at specific prices.

Excluding the impact of liquidity, the market price of our common stock has previously fluctuated and may continue to fluctuate widely in response to other factors, including expectations of financial and operating results, actual operating results, actions of institutional stockholders, speculation in the press or the investment community, market perception of acquisitions, rating agency upgrades or downgrades, the anticipated or actual incurrence of additional debt, stock prices of other banks, general market expectations related to the financial services industry, status of an SRP, and the potential impact of government actions affecting the financial services industry. Refer to Item 5. Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities for additional information with respect to variation in total returns in our Class A common stock in recent years and the volume of our Class A common stock repurchases under our SRP.

31

Liquidity Risks

If our current level of balance sheet liquidity were to experience significant pressure, it could affect our ability to pay withdrawals by depositors, repay the Purchase Money Note and other creditors, and fund our operations.

Our deposit base represents our primary source of core funding and balance sheet liquidity. These deposits are subject to fluctuation due to certain factors outside our control, such as increasing competitive pressures for retail or corporate customer deposits, changes in interest rates and returns on other investment classes, or a loss of confidence by customers in us or in the banking sector generally that could result in a significant outflow of deposits within a short period of time, which may have a material adverse effect on our liquidity position. The speed today at which information can be disseminated provides an environment conducive to fast changes in liquidity.

In circumstances where our ability to generate needed liquidity is impaired, we may need to access other sources of funding such as borrowings from the FHLBs and the Federal Reserve, federal funds purchased lines, brokered deposits, or other sources of liquidity including capital market transactions such as securities sold under agreements to repurchase and sale of securities. While we maintain access to these non-core funding sources, many of these sources may be dependent on the availability of collateral as well as the counterparty’s willingness and ability to lend. In addition, our ability to access the capital markets may be impacted by unforeseen market forces or interruptions or a lack of market or customer confidence in us or in the banking sector generally. Inability to access sources of liquidity may affect our ability to pay withdrawals by depositors and fund our operations.

In connection with the SVBB Acquisition, FCB issued a five-year note of approximately $35 billion payable to the FDIC (the “Purchase Money Note”) due March 2028, which was subsequently amended and restated to adjust the principal amount to approximately $36.07 billion. Potential sources that we could use to fund voluntary prepayments of the Purchase Money Note or the amount due at maturity include excess liquidity (primarily comprised of interest-earning deposits at banks and proceeds from maturities and paydowns of investment securities), FHLB advances, deposit growth, loan portfolio sales, and issuance of unsecured debt or other borrowings. Refer to Part II, Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations—Executive Overview—Recent Events for a discussion of recent prepayments of the Purchase Money Note.

We are subject to enhanced liquidity risk management and other requirements, and failure to meet these requirements could result in regulatory and compliance risks, including possible restrictions on our activities, and inadequate liquidity.

As a Category IV banking organization, we are subject to enhanced liquidity risk management requirements applicable to banking organizations with $100 billion or more in total consolidated assets, including reporting, liquidity stress testing, and tailored liquidity risk management requirements. We are also subject to resolution and contingency planning at the bank-level under the CIDI Rule, as well enhanced enterprise risk management requirements. Refer to Item 1. Business—Regulatory Considerations—Enhanced Prudential Standards for additional information. As we grow, we may become subject to additional liquidity requirements including the LCR and NSFR requirements. Refer to Item 1. Business—Regulatory Considerations—Enhanced Prudential Standards—Category III Requirements. Failure to develop and maintain adequate systems and controls designed to comply with all requirements applicable to us under current regulations or as otherwise imposed by our regulators could result in regulatory and compliance risks, including adverse regulatory action (including possible restrictions on our activities), along with inadequate liquidity.

Capital Adequacy Risks

Our ability to grow is contingent upon access to capital, which may not be readily available to us as a result of credit rating reductions.

Our ability to grow is contingent on our ability to generate or otherwise access sufficient capital, including to remain well capitalized under current and future capital adequacy guidelines. Our primary capital sources have been retained earnings and debt issued through both private and public markets. Rating agencies regularly evaluate our creditworthiness and assign credit ratings to us and FCB. The ratings of the agencies are based on a number of factors, some of which are outside our control. In addition to factors specific to our financial strength and performance, the rating agencies also consider conditions generally affecting the financial services industry. There can be no assurance that we maintain our current credit ratings. Rating reductions could adversely affect our access to funding sources and increase the cost of obtaining funding.

32

If we fail to meet regulatory requirements, including enhanced capital adequacy, liquidity, stress testing, and capital planning requirements, or are subject to certain other legal limitations, our financial condition and ability to pay dividends or make other payments could be adversely affected.

We are subject to enhanced capital adequacy, liquidity, stress testing, and capital planning requirements as a banking organization with over $100 billion in total consolidated assets, with our enhanced prudential standards based on our total assets and other risk based factors under the Tailoring Rules. Regulators have implemented and may, from time to time, implement changes to these regulatory capital adequacy and liquidity requirements. The Parent Company and FCB are subject to bank capital rules under the Basel III framework, in addition to other capital adequacy requirements, liquidity requirements, and capital planning and stress testing requirements. The federal banking agencies have announced plans to propose enhanced capital requirements for large banking organizations in connection with the finalization of the implementation of Basel III Endgame. Refer to Item 1. Business—Regulatory Considerations—Enhanced Prudential Standards—Proposed Rule for Basel III Endgame. Failure to meet these requirements or any requirements we may become subject to in the future, or the applicability of certain other legal limitations, could adversely affect our financial condition and ability to declare dividends or make other payments or capital distributions, including equity repurchases. Refer to Item 1. Business—Regulatory Considerations—Enhanced Prudential Standards and —Regulatory Considerations—Limitations on Dividends and Other Payments for additional information.

Increases to our level of indebtedness could adversely affect our ability to raise additional capital and to meet our obligations.

Our level of indebtedness has increased by virtue of the Purchase Money Note, and the debt offerings we consummated in 2025. We also issued perpetual preferred equity in 2025 and 2026. In 2023, the federal banking agencies released an NPR, which would require large banks with total consolidated assets of $100 billion or more to maintain a minimum amount of long-term debt that can be used, in the instance of a bank’s failure, to absorb losses and increase options to resolve the failed bank. However, the proposed rule has not been finalized. Refer to Item 1. Business—Regulatory Considerations—Enhanced Prudential Standards—Proposed Rule for Basel III Endgame. Our existing debt, together with any future incurrence of additional indebtedness, including through agreements with the FRB, debt issuance indentures or otherwise, could have consequences that are materially adverse to our business, financial condition or results of operations. For example, it could: (i) limit our ability to obtain additional financing for working capital, capital expenditures, debt service requirements, acquisitions and general corporate or other purposes; (ii) restrict us from making strategic acquisitions or cause us to make non-strategic divestitures; (iii) restrict us from paying dividends to our stockholders; (iv) increase our vulnerability to general economic and industry conditions; or (v) require a substantial portion of cash flow from operations to be dedicated to the payment of principal and interest on our indebtedness and dividends on the preferred stock, thereby reducing our ability to use cash flows to fund our operations, capital expenditures and future business opportunities.

Compliance Risks

We operate in a highly regulated industry, and the laws and regulations that impact our operations, taxes, corporate governance, executive compensation and financial accounting and reporting, including changes in them or our failure to comply with them, may adversely affect us.

We operate in a highly regulated industry and are subject to many laws, rules, and regulations at both the federal and state levels. These broad-based laws, rules, and regulations impact the products and services we may offer and how we may offer them, the ways we may operate and the risks that we may take, the corporate and financial actions that may be taken, and the information we must publicly disclose. Some examples include enhanced prudential standards, public disclosure and reporting requirements, limitations on dividends and other payments, limitations on mergers and acquisitions, restrictions on our activities as an FHC and requirements for support of FCB, CRA requirements, payment of FDIC insurance premiums, AML and OFAC regulations, various consumer laws and regulations, and privacy, data protection and cybersecurity regulations, as well as laws that apply to our subsidiaries, including laws applicable to broker dealers, investment advisers, insurers and certain specialty businesses. Refer to Item 1. Business—Regulatory Considerations for additional information. These laws and others impact, among other things, our operations, taxes, corporate governance, executive compensation and financial accounting and reporting.

33

Compliance with the extensive laws and regulations applicable to BHCs and banks can be difficult and costly. In addition, changes to statutes, regulations, or regulatory policies, including changes in interpretation or implementation of statutes, regulations, or policies, could affect us in substantial and unpredictable ways, including increased compliance costs that may limit our ability to pursue business opportunities and result in a material adverse impact on our financial condition and results of operations. Such changes could subject us to additional compliance and other costs, limit the types of financial services and products we may offer or business opportunities we may pursue, increase the ability of nonbanks to offer competing financial services and products, among other things, any of which may result in a material adverse impact on our financial condition and results of operations. Failure to comply with laws, regulations, or policies could result in adverse regulatory action (including potential limitations on our future acquisitions or activities, or requirements to forfeit assets), civil money penalties, or reputation damage. In addition to the other limitations described herein, the ability of our bank and its subsidiaries to guarantee our debt may be restricted and certain regulatory requirements may be imposed that may be more restrictive and may result in greater or earlier charges to earnings or reductions in our capital under GAAP.

Failure to meet regulatory requirements related to information security and data privacy may subject us to fines, litigation, or regulatory enforcement actions.

Data privacy and security risks are areas of heightened legislative and regulatory focus in recent years. We collect, process, maintain, and store personal information of customers, prospects and employees, and employ data security and technology solutions to support adherence to our data protection obligations and risk mitigation efforts. The collection, sharing, use, disclosure, and protection of these types of information are governed by federal and state law. An increasing number of states have actual or proposed privacy and information security regulations. The U.S. Congress and federal regulators have also implemented or are considering implementing similar laws or regulations which could create new individual privacy rights and impose increased obligations on companies handling personal data. Refer to Item 1. Business—Regulatory Considerations—Privacy, Data Protection, and Cybersecurity for additional information.

We continue to monitor developments and changes to applicable privacy and information security regulations and adapt our current practices to changing requirements. Failure to meet regulatory requirements related to information security and data privacy may subject us to fines, litigation, or regulatory enforcement actions. Changes to our business practices, policies, or systems, as a result of changing requirements or otherwise, may also adversely impact our operating results.

We face heightened compliance risks related to certain specialty commercial business lines.

Our Rail segment is subject to various laws, rules and regulations administered by authorities in various jurisdictions. In the United States, our equipment financing and leasing operations, including for our portfolio of railcars, maritime lending and other equipment financing and leasing, are subject to rules and regulations relating to safety, operations, maintenance and mechanical standards promulgated by various federal and state agencies and industry organizations, including the U.S. Department of Transportation, the Federal Railroad Administration, the Association of American Railroads, the Maritime Administration, the U.S. Coast Guard, and the U.S. Environmental Protection Agency. We are also subject to regulation by governmental agencies in foreign countries in which we do business. Our business operations and our equipment financing and leasing portfolios may be adversely impacted by rules and regulations promulgated by governmental and industry agencies, which could require substantial modification, maintenance, or refurbishment of our railcars, ships or other equipment, or could potentially make such equipment inoperable or obsolete. Failure to comply with these laws, rules and regulations could result in sanctions by regulatory agencies (including potential limitations on our future acquisitions or operations, or requirements to forfeit assets), civil money penalties, or reputation damage. Additionally, we may incur significant expenses in our efforts to comply with these laws, rules and regulations.

We are subject to enhanced prudential standards, and failure to comply with these standards could have a material adverse effect on our business, financial condition or results of operations.

Because we have over $100 billion in total consolidated assets, we are subject to certain enhanced prudential standards as a Category IV banking organization. We will be subject to further requirements as we grow if we meet or exceed certain other thresholds for asset size and other risk-based factors, including those under the federal banking agencies’ Tailoring Rules for banking organizations with $250 billion or more in total consolidated assets. Federal banking agencies are also considering further requirements. Refer to Item 1. Business—Regulatory Considerations—Enhanced Prudential Standards.

Along with our growth, expectations are heightened to maintain strong risk management. We expect to incur significant expense in continuing to develop systems and controls designed to comply with all such requirements applicable to us. If we fail to develop and maintain at a reasonable cost the systems and processes necessary to comply with the standards and requirements imposed by these rules, it could have a material adverse effect on our business, financial condition or results of operations.

34

We are subject to certain laws and regulations designed to protect consumers in transactions with financial institutions against unfair, deceptive and abusive business practices and compliance with such laws and regulations and related enforcement actions may impact our business operations and profitability.

We are subject to consumer financial protection laws and regulations that prevent us from engaging in an unfair, deceptive, or abusive act or practice in connection with consumer financial products and services. Refer to Item 1. Business—Regulatory Considerations—Consumer Laws and Regulations for additional information. Compliance with such laws and regulations may be costly and enforcement actions may include imposition of substantial monetary penalties and nonmonetary requirements, which may impact our business operations and profitability.

We may be adversely affected by changes in United States and foreign tax laws and other tax laws and regulations.

Corporate tax rates affect our profitability and capital levels. We are subject to the income tax laws of the United States, its states and their municipalities and to those of the foreign jurisdictions in which we do business. These tax laws are complex and may be subject to different interpretations. We must make judgments and interpretations about the application of these tax laws when determining our provision for income taxes, our deferred tax assets and liabilities and our valuation allowance. Changes to the tax laws, administrative rulings or court decisions could affect our Regulatory Capital Ratios and could have an adverse impact on our financial condition and results of operations.

We are subject to ESG risks, which may adversely affect our reputation and ability to retain employees and customers, and failure to comply with applicable regulations could have an adverse affect on our business, financial condition or results of operations.

We are subject to a variety of risks arising from ESG matters. ESG matters include, but are not limited to, climate risk, hiring practices, the diversity of our work force, and racial and social justice issues involving our personnel, customers and third parties with whom we otherwise do business. ESG, and particularly Diversity, Equity, and Inclusion, initiatives have become increasingly polarized issues, with strong opponents and proponents. The federal government and some states have introduced or passed bills to restrict, regulate, or prohibit ESG initiatives. See Item 1. Business—Regulatory Considerations—Climate and —Debanking and Fair Access for additional information. The ESG landscape is dynamic and constantly evolving, and significant resources are required to monitor the rapidly changing regulatory landscape and to comply with the regulations and expectations. If our ESG practices do not meet (or are viewed as not meeting) investor or other stakeholder expectations and standards, our reputation and employee and customer retention may be adversely affected. In addition, our failure to comply with any applicable regulations could lead to penalties, adversely impact our access to capital and impact third parties on which we rely. The failure to meet ESG expectations or comply with applicable regulations could have an adverse effect on our business, financial condition or results of operations.

35

Financial Reporting Risks

Accounting standards may change and increase our operating costs or otherwise adversely affect our results.

The Financial Accounting Standards Board (“FASB”) and the SEC periodically modify the standards governing the preparation of our financial statements. The nature of these changes is not predictable and has impacted and could further impact how we record transactions in our financial statements, which has led to and could lead to material changes in assets, liabilities, stockholders’ equity, revenues, expenses and net income. Implementation of new accounting rules or standards could additionally require us to implement technology changes which could impact ongoing earnings.

Our accounting policies and processes require management to make judgments, assumptions or estimates about matters, which may result in us reporting materially different results or amounts than would have been reported using different judgments, assumptions or estimates.

Accounting policies and processes are fundamental to how we record and report our financial condition and results of operations. Management must exercise judgment in selecting and applying many of these accounting policies and processes so they comply with GAAP. In some cases, management must select the accounting policy or method to apply from two or more alternatives, any of which may be reasonable under the circumstances, yet may result in us reporting materially different results than would have been reported under a different alternative.

Management has identified certain accounting policies as being critical because they require management to make difficult, subjective or complex conclusions about matters that are uncertain. Materially different amounts could be reported under different conditions or using different assumptions or estimates. Because of the uncertainty surrounding management’s judgments and the estimates pertaining to these matters, we may be required to adjust accounting policies or restate prior period financial statements. Refer to “Critical Accounting Estimates” included in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations.

Our business is highly quantitative and requires widespread use of financial models for day-to-day operations; these models may produce inaccurate predictions that significantly vary from actual results, and we may rely on them in making decisions that adversely affect our business or the information we provide to our investors and regulators.

We rely on qualitative and quantitative models to measure risks and to estimate certain financial values. Such models may be used in many processes including, but not limited to, the pricing of various products and services, classifications and grading of loans, setting interest rates on loans and deposits, quantifying interest rate and other market risks, forecasting losses, measuring capital adequacy and calculating economic and regulatory capital levels. Models may also be used to estimate the value of financial instruments and balance sheet items. Inaccurate or erroneous models present the risk that business decisions relying on the models and their outputs will prove inefficient, ineffective or harmful to us. Additionally, information we provide to our investors and regulators may be negatively impacted by inaccurately designed or implemented models. For further information on risk monitoring, refer to the “Risk Management” section included in Item 7A. Quantitative and Qualitative Disclosure about Market Risk.

We may fail to maintain an effective system of internal control over financial reporting, which, among other things, could hinder our ability to prevent fraud and provide reliable financial reports to key stakeholders.

We must have effective internal controls over financial reporting in order to provide reliable financial reports, to effectively prevent fraud and to operate successfully as a public company. We may discover material weaknesses or significant deficiencies requiring remediation, which would require additional expense and diversion of management attention, among other consequences.

Any failure to maintain effective internal controls or to implement any necessary improvement of our internal controls in a timely manner could, among other things, result in losses from fraud or error, harm our reputation, cause us to violate regulatory requirements or otherwise become subject to legal liability, or cause investors to lose confidence in our reported financial information, each of which could have a material adverse effect on our results of operations, financial condition and the market value of our common stock.

36