FULTON FINANCIAL CORP (FULT) Risk Factors

Item 1A. Risk Factors

An investment in our securities involves certain risks, including, among others, the risks described below. In addition to the other information contained in this Annual Report on Form 10-K, you should carefully consider the following risk factors. Additional risks and uncertainties not presently known to us or that we currently deem immaterial may also impair our business operations. If any of these risks actually occurs, our business, financial condition and results of operations could be materially, adversely affected.

GENERAL ECONOMIC AND MARKET CONDITIONS RISKS

Difficult conditions in the economy and the financial markets may materially adversely affect our business, financial condition and results of operations.

Our financial condition and results of operations are affected by conditions in the economy and the financial markets generally. Our financial performance is highly dependent upon the business environment in the markets where we operate and in the United States as a whole. Unfavorable or uncertain economic and market conditions can be caused by: declines in economic growth, business activity or investor or business confidence; limitations on the availability, or increases in the cost, of credit and capital; changes in the rate of inflation or in interest rates; high unemployment; labor shortages; governmental fiscal and monetary policies; the level of, or changes in, prices of raw materials, goods or commodities; supply chain issues; global economic conditions; immigration policies; trade policies and tariffs affecting other countries as well as retaliatory policies and tariffs by such countries; geopolitical events, including the war between Russia and Ukraine and ongoing tensions in the Middle East; natural disasters; public health crises, such as epidemics and pandemics; acts of war or terrorism; or a combination of these or other factors.

Specifically, the business environment impacts the ability of borrowers to pay interest on and repay principal of outstanding loans and the value of collateral, if any, securing those loans, as well as demand for loans and other products and services we offer. Worsening economic conditions, such as economic downturns, recessions, increases in prevailing interest rates and high unemployment rates, could negatively impact the quality of our loan portfolio. As a result, we may have to increase our provision for credit losses, which would negatively impact our results of operations, and could result in charge-offs of a higher percentage of our loans. Unlike large, national institutions, we are not able to spread the risks of unfavorable local economic conditions across a large number of diversified economies and geographic locations. If the communities in which we operate do not grow, or if prevailing economic conditions locally or nationally are unfavorable, our business could be adversely affected. In addition, increased market competition in a lower demand environment could adversely affect our profit potential.

INTEREST RATE AND CREDIT RISKS

We are subject to interest rate risk.

We cannot predict or control changes in interest rates. We are affected by fiscal and monetary policies of the federal government, including those of the Federal Reserve Board, many of which affect interest rates charged on loans and paid on deposits.

During 2022-2024, the Federal Reserve Board raised the target range for the Fed Funds Rate in a series of actions to combat rising inflation. Beginning in September 2024, as inflation moderated toward the Federal Reserve Board's policy objective, the Federal Reserve Board incrementally reduced the Fed Funds Rate, which is now at a target range of 3.50% to 3.75%. The timing and magnitude of future Fed Funds Rate decreases are uncertain, and increases in Fed Funds Rates are possible.

Changes in monetary policy, including changes in interest rates, influence not only the interest we receive on loans and securities that we invest in and the interest we pay on deposits and borrowings, but such changes could affect our ability to originate loans and obtain deposits, the fair value of financial assets and liabilities, and the average duration of our assets. Net interest income is the difference between interest earned on interest-earning assets and interest paid on interest-bearing liabilities. Net interest income is the most significant component of our net income, accounting for approximately 79% of total revenues in 2025. Changes in market interest rates, in the shape of the yield curve or in spreads between different market interest rates can have a material effect on our NIM. The rates on some interest-earning assets, such as loans and investments, and interest-bearing liabilities, such as deposits and borrowings, adjust concurrently with, or within a brief period after, changes in market interest rates, while others adjust only periodically or not at all during their terms. Thus, changes in market interest rates might, for example, result in a decrease in the interest earned on interest-earning assets that is not accompanied by a corresponding decrease in the interest paid on interest-bearing liabilities, or the decrease in interest paid on interest-bearing liabilities might be at a slower pace, or in a smaller amount, than the decrease in interest earned on interest-earning assets,

21

reducing our net interest income and/or NIM. In addition, we are dependent on lower-cost, core deposits as our primary source of funding and changes in interest rates could increase our cost of funding, reduce our NIM and/or create liquidity challenges.

We have policies and procedures designed to manage the risks associated with changes in interest rates and actively manage these risks through hedging and other risk mitigation strategies. However, if our assumptions are wrong or overall economic conditions are significantly different than anticipated, our hedging and other risk mitigation strategies may be ineffective and may adversely impact our business, financial condition and results of operations.

An increase in interest rates could also have a negative impact on our results of operations by reducing the ability of borrowers to repay current loan obligations. These circumstances could not only result in increased loan defaults, foreclosures and charge-offs, but also reduce collateral values and necessitate further increases in the ACL.

Changes in interest rates may also affect the average life of loans and certain investment securities, including mortgage-backed securities. Increases in interest rates may extend the average life of fixed rate assets potentially restricting our ability to reinvest in higher yielding alternatives, reduce demand for loans and may result in customers withdrawing their certificates of deposit early. Conversely, decreases in interest rates can result in increased prepayments of loans and certain investment securities, as borrowers or issuers refinance to reduce their borrowing costs. Under those circumstances, we would be subject to reinvestment risk to the extent that we are not able to reinvest the money received from such prepayments at rates that are comparable to the rates on the loans and investment securities that are prepaid.

Changes in interest rates also affect the fair value of interest-earning investment securities. Generally, the value of interest-earning investment securities moves inversely with changes in interest rates. Changes in interest rates can affect the fair value of AFS investment securities, with any unrealized gain or loss reflected as a component of AOCI. As a result of elevated interest rates in recent years, the fair value of our AFS investment securities declined resulting in unrealized losses of approximately $206 million as of December 31, 2025 and is reflected in AOCI as a reduction to total shareholders' equity. Further increases in interest rates could result in additional unrealized losses on AFS investment securities we hold. Any sale of investment securities with a fair value below amortized cost will result in actual losses, which will adversely affect our results of operations.

We cannot predict the nature or timing of any future changes in fiscal and monetary policies or of changes in interest rates; however, policy or interest rate changes could have a material adverse effect on our business, financial condition and results of operations.

Changes in interest rates can affect demand for our products and services.

Movements in interest rates can cause demand for some of our products and services to be cyclical. For example, demand for residential mortgage loans historically has increased during periods when interest rates were declining and historically has decreased during periods when interest rates were rising. As a result, we may need to periodically increase or decrease the size of certain of our product and service offerings, including our personnel, to match increases and decreases in demand and volume. The need to change the scale of our product and service offerings is challenging, and there is often a lag between changes in the interest rate environment and our ability to react to these changes.

Price fluctuations in securities markets, as well as other market events, such as a disruption in credit and other markets and the abnormal functioning of markets for securities, could have an impact on our results of operations.

The market value of our securities investments, which include mortgage-backed securities, state and municipal securities and corporate debt securities, are particularly sensitive to price fluctuations and market events. Declines in the values of our securities holdings, combined with adverse changes in the expected cash flows from these investments, could result in impairment.

Our investment management and trust services revenue, which is partially based on the value of the underlying investment portfolios, can also be impacted by fluctuations in the securities markets. If the values of those investment portfolios decrease, whether due to factors influencing U.S. or international securities markets, in general, or otherwise, our non-interest income could be negatively impacted. In addition, our ability to sell our securities brokerage and wealth management services is dependent, in part, upon consumers' level of confidence in securities markets. Securities market volatility or other market disruptions may adversely affect our ability to sell our securities brokerage and wealth management services, which could negatively affect our fee-based non-interest income, and as a result, our results of operations.

22

Our loan portfolio composition subjects us to credit risk.

At December 31, 2025, approximately 63% of our loan portfolio consisted of commercial loans, commercial mortgage loans, and residential and commercial construction loans. Commercial loans, commercial mortgage loans and residential and commercial construction loans generally involve a greater degree of credit risk than residential mortgage loans and consumer loans because these loans are likely to be more sensitive to broader economic factors and conditions. Because payments on these loans often depend on the successful operation and management of borrowers' businesses and properties, repayment of such loans may be affected by factors outside of the borrower's control, including adverse conditions in the real estate markets, adverse economic conditions or changes in governmental regulation. In addition, commercial loans typically have relatively large balances and the deterioration of one or a few of these loans could cause a significant increase in the percentage of non-performing loans. An increase in non-performing loans could result in a loss of earnings from these loans, an increase in the provision for loan losses and an increase in charge-offs, all of which could have a material adverse effect on our business, financial condition and results of operations.

A significant proportion of our loan portfolio consists of commercial mortgage loans that may pose increased credit risk.

At December 31, 2025, commercial mortgage loans represented approximately 41% of our loan portfolio. These loans are secured by both owner-occupied and non-owner-occupied commercial real estate. The market for commercial real estate is cyclical and a significant change in the real estate market that results in deterioration in the value of collateral or rental or occupancy rates could adversely affect borrowers’ ability to repay loans. For example, the increased prevalence of remote and hybrid working arrangements as a result of COVID-19 has impacted the demand for commercial office space putting pressure on office rental and occupancy rates. Changes in the real estate market could also affect the value of foreclosed assets. Negative developments in the commercial real estate market could result in an increase in non-performing loans, the need for us to increase the provision for loan losses and an increase in charge-offs, all of which could have a material adverse effect on our business, financial condition and results of operations.

LIQUIDITY AND CAPITAL RISKS

Changes in interest rates or disruption in liquidity markets may adversely affect our sources of funding.

We must maintain sufficient sources of liquidity to meet the demands of our depositors and borrowers, support our operations and meet regulatory requirements. Our liquidity management policies and practices emphasize core deposits and repayments and maturities of loans and investments as our primary sources of liquidity. These primary sources of liquidity can be supplemented by FHLB advances, borrowings from the FRB, proceeds from the sales of loans and investment securities and capital raising activities. Secondary sources of liquidity may be more costly to us than funding provided by lower-cost, core deposit account balances having similar maturities. In addition, adverse changes in our financial condition or results of operations, downgrades in our credit ratings, regulatory actions involving us, or changes in regulatory, industry or market conditions could lead to an increase in the cost of these secondary sources of liquidity, the inability to refinance or replace these secondary funding sources as they mature, or the withdrawal of unused borrowing capacity under these secondary funding sources.

We are dependent on customer deposits as our primary source of funding. A substantial majority of our deposits are in non-maturing accounts that customers can withdraw on demand or upon several days' notice. Factors, including competition with bank and non-bank competitors, changes in interest rates, the availability of alternative investment options, customer confidence in the industry and the liquidity needs of deposit customers, can cause fluctuations in both the level and cost of customer deposits. Further, deposits from state and municipal entities, primarily in non-maturing, interest-bearing accounts, are a significant source of deposit funding for us, representing approximately 13% of total deposits at December 31, 2025. State and municipal customers frequently maintain large deposit account balances substantially in excess of the FDIC insurance limit, and these depositors may be more sensitive than other depositors to changes in interest rates. Changes in any of these factors could increase our funding costs, reduce our NIM and/or create liquidity challenges.

Additionally, negative news about us or the banking industry in general could negatively impact market and/or customer perceptions of us, which could lead to a loss of depositor confidence and an increase in deposit withdrawals, particularly among those with uninsured deposits. As we and other regional banking organizations experienced in 2023, the failure of other financial institutions may cause deposit outflows as customers spread deposits among several different banks so as to maximize their amount of FDIC insurance, move deposits to banks deemed "too big to fail" or remove deposits from the banking system entirely. At December 31, 2025, approximately 36% of our deposits (excluding Intra-Company deposits) were uninsured and we are dependent on these deposits for liquidity.

23

If we are not able to continue to depend primarily on customer deposits to meet our liquidity and funding needs, access secondary, non-deposit funding sources on favorable terms or otherwise fail to manage our liquidity effectively, our ability to continue to grow may be constrained, and our liquidity, operating margins, business, financial condition and results of operations may be materially adversely affected.

We may need to raise additional capital in the future and such capital may not be available when needed or at all.

We are required by regulatory agencies to maintain adequate levels of capital. We may need to raise additional capital in the future to meet regulatory or other internal requirements. As a publicly traded company, a likely source of additional funds is the capital markets, accomplished generally through the issuance of equity, both common and preferred stock, and the issuance of debt. Our ability to raise additional capital, if needed, will depend on, among other things, conditions in the capital markets at that time, which are outside of our control, and our financial performance.

We cannot provide any assurance that access to such capital will be available to us on acceptable terms or at all. Any occurrence that may limit our access to the capital markets, such as a decline in the confidence of debt purchasers or counterparties participating in the capital markets, may materially and adversely affect our capital costs and our ability to raise capital and, in turn, our liquidity. If we need to raise capital in the future, we may have to do so when many other financial institutions are also seeking to raise capital and would then have to compete with those institutions for investors. The inability to raise additional capital on acceptable terms when needed could have a materially adverse effect on our business, financial condition or results of operations.

We are subject to capital adequacy standards, and a failure to meet these standards could adversely affect our financial condition.

The Corporation and Fulton Bank are each subject to capital adequacy and liquidity rules and other regulatory requirements specifying the minimum amounts and types of capital that must be maintained. From time to time, the regulators implement changes to these regulatory capital adequacy and liquidity guidelines. If we fail to meet these minimum capital and liquidity guidelines and other regulatory requirements, we may be restricted in the types of activities we may conduct and may be prohibited from taking certain capital actions, such as making payments on certain capital instruments, paying executive bonuses or dividends, and repurchasing or redeeming capital securities.

RISKS RELATED TO RISK MANAGEMENT

We are exposed to many types of operational and other risks, and our framework for managing risks may not be effective in mitigating risk.

We are exposed to many types of operational risks, including the risk of human error or fraud by employees and other third parties, intentional and inadvertent misrepresentation by loan applicants, borrowers or guarantors, unsatisfactory performance by employees and vendors, clerical and record-keeping errors, operational errors, computer and telecommunications systems malfunctions or failures and reliance on data that may be faulty or incomplete. In an environment characterized by continual, rapid technological change, when we introduce new products and services, or make changes to our information technology systems and processes as we do from time to time, our operational risks are increased. Any of these operational risks could result in the diminished ability to operate one or more of our businesses, financial loss, potential liability to customers, inability to secure insurance, reputational damage and/or regulatory intervention, any or all of which could materially adversely affect us.

Because the nature of the financial services business involves a high volume of transactions, certain errors may be repeated or compounded before they are discovered and successfully rectified. Our large transaction volume and necessary dependence upon automated systems to record and process these transactions results in the risk that technical flaws, tampering, or manipulation of those automated systems, arising from events wholly or partially beyond our control, and may give rise to disruption of service to customers and to financial loss or liability. We are also exposed to the risk that our business continuity and data security systems prove to be inadequate.

Furthermore, our risk management framework is subject to inherent limitations, and risks may exist, or develop in the future, that we have not identified or anticipated. Management regularly reviews and updates our internal controls, disclosure controls and procedures, and corporate governance policies and procedures. Any system of controls, however well designed and operated, is based in part on certain assumptions and can provide reasonable, but not absolute, assurances that the objectives of the controls are met. Any failure or circumvention of our controls and procedures or failure to comply with regulations related

24

to controls and procedures could have a material adverse effect on our business, financial condition or results of operations. See "Item 9A. Controls and Procedures."

Loss of, or failure to adequately safeguard, confidential or proprietary information may adversely affect our operations, net income or reputation.

Our business is highly dependent on information systems and technology and the ability to collect, process, transmit and store significant amounts of confidential information on a daily basis. While we perform some of the functions required to operate our business directly, we also rely on third parties for significant business functions, such as processing customer transactions, providing cloud-based infrastructure, software and data storage services, maintaining customer-facing websites, including our online and mobile banking functions, and developing software for new products and services. These relationships require us to allow third parties to access, store, process and transmit customer information. As a result, we may be subject to cybersecurity risks directly, as well as indirectly, through the vendors to whom we outsource business functions and the downstream service providers of those vendors. Cyber threats could result in unauthorized access, loss or destruction of confidential information or customer data; unavailability, degradation or denial of service; introduction of computer viruses or ransomware; and other adverse events causing us to incur additional costs repairing systems, restoring data or adding new personnel or protection technologies. Cyber threats may also subject us to regulatory investigations, litigation or enforcement actions, require the payment of fines, penalties or damages, or undertaking costly remediation efforts with respect to third parties affected by a cybersecurity incident, all or any of which could adversely affect our business, financial condition or results of operations and/or damage our reputation.

Critical infrastructure sectors, including the financial services sector, increasingly have been the targets of cyberattacks. Cyberattacks involving large financial institutions, including denial of service attacks, nation-state cyberattacks, ransomware attacks designed to deny access to key internal resources or systems, and targeted social engineering and email and text message attacks designed to allow unauthorized persons to obtain access to an institution's information systems and data or that of its customers, are becoming more common and increasingly sophisticated. Further, threat actors are increasingly seeking to target vulnerabilities in software systems (and third-party vendors providing those systems) used by large numbers of banking organizations in order to conduct malicious cyber activities.

Like other financial institutions, we experience malicious cyber activity on an ongoing basis directed at our websites, computer systems, software, networks and our users. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial of service attacks. We also experience large volumes of phishing and other forms of social engineering attempted for the purpose of perpetuating fraud against us, our employees or our customers. While, to date, malicious cyber activity, cyberattacks and other information security breaches have not had a material adverse impact on us, risk to our systems remains significant.

Cybersecurity risks for financial institutions also have evolved as a result of the use of cloud computing and new technologies, devices and delivery channels to transmit and store data and conduct financial transactions. The adoption of new products, services and delivery channels contribute to a more complex operating environment, which impacts operational risk and presents the potential for additional structural vulnerabilities.

There can be no assurance that the measures we employ to detect and combat direct or indirect cyber threats will be effective. In addition, because the methods of cyberattacks change frequently or, in some cases, are not recognized until launched, we may be unable to implement effective preventive control measures to proactively address these methods. There can be no assurance that any future third-party vendor data breach would not be material, and if we or a third-party vendor were to experience a cyberattack or information security breach, we could suffer damage to our reputation, productivity losses, response costs associated with investigation and resumption of services, and incur substantial additional expenses, including remediation expenses costs associated with client notification and credit monitoring services, increased insurance premiums, regulatory penalties and fines, and costs associated with civil litigation, any of which could have a materially adverse effect on our business, financial condition, results of operations and reputation. Although we maintain insurance coverage that may, subject to policy terms and conditions, cover certain aspects of cyber risks, our insurance coverage may be inapplicable or otherwise insufficient to cover any or all losses.

Additionally, account data compromise, malware and ransomware events affecting a broad spectrum of commercial businesses and governmental entities in recent years have resulted in heightened legislative and regulatory focus on privacy, data protection and information security. Changes in laws and regulations may significantly impact our current and planned privacy, data protection and information security-related practices, the collection, use, sharing, retention and safeguarding of consumer and employee information, and current or planned business activities. Compliance with current or future privacy, data protection and information security laws could result in higher compliance and technology costs and could restrict our ability to provide certain products and services that could materially and adversely affect our profitability.

25

We are subject to a variety of risks in connection with the origination and sale of loans.

We originate residential mortgage loans and other loans, such as loans guaranteed, in part, by the SBA, all or portions of which are later sold in the secondary market to GSEs, such as Fannie Mae and other non-government sponsored investors. In connection with such sales, we make certain representations and warranties with respect to matters such as the underwriting, origination, documentation or other characteristics of the loans sold. We may be required to repurchase a loan, or to reimburse the purchaser of a loan for any related losses, if it is determined that the loan sold was in violation of representations or warranties made at the time of the sale, and, in some cases, if there is evidence of borrower fraud, in the event of early payment default by the borrower on the loan, or for other reasons. We maintain reserves for potential losses on certain loans sold, however, it is possible that losses incurred in connection with loan repurchases and reimbursement payments may be in excess of any applicable reserves, and we may be required to increase reserves and may sustain additional losses associated with such loan repurchases and reimbursement payments in the future, all of which could have a material adverse effect on our business, financial condition and results of operations.

The sale of residential mortgage loans and other loans in the secondary market serves as a source of non-interest income and liquidity for us and can reduce our exposure to interest rate risk. Efforts to reform GSEs, changes in the types of, or standards for, loans purchased by GSEs and other investors, or our failure to maintain our status as an eligible seller of such loans may limit our ability to sell these loans. Our inability to continue to sell these loans could reduce our non-interest income, limit our ability to originate and fund these loans in the future, and make managing interest rate risk more challenging, any of which could have a material adverse effect on our business, financial condition and results of operations.

Our operational risks include risks associated with third-party vendors and other financial institutions.

We rely upon certain third-party vendors to provide products and services necessary to maintain our day-to-day operations, including, notably, responsibility for the core processing system that services Fulton Bank. Accordingly, our operations are exposed to the risk that these vendors might not perform in accordance with applicable contractual arrangements or service level agreements. The failure of an external vendor to perform in accordance with applicable contractual arrangements or service level agreements could be disruptive to our operations and could have a material adverse effect on our business, financial condition or results of operations and/or damage our reputation. Further, third-party vendor risk management continues to be a point of regulatory emphasis. A failure to follow applicable regulatory guidance in this area could expose us to regulatory sanctions.

The commercial soundness of many financial institutions are closely interrelated as a result of credit, trading, execution of transactions or other relationships between the institutions. As a result, concerns about, or a default or threatened default by, one institution could lead to significant market-wide liquidity and credit problems, losses or defaults by other institutions. This risk is sometimes referred to as "systemic risk" and may adversely affect financial intermediaries, such as clearing agencies, clearing houses, banks, securities firms and exchanges with which we interact on a daily basis, and, therefore, could have a material adverse effect on our business, financial condition or results of operations.

Any of these operational or other risks could result in our diminished ability to operate one or more of our businesses, financial loss, potential liability to customers, inability to secure insurance, reputational damage and regulatory intervention and could materially adversely affect our business, financial condition and results of operations.

Climate change may materially adversely affect our business and results of operations.

We operate in areas where our business and the activities of our customers could be impacted by the effects of climate change, including increased frequency or severity of storms, hurricanes, floods, droughts, and rising sea levels. These effects can disrupt business operations, damage property, devalue assets and change consumer and business preferences, which may adversely affect borrowers, increase credit risk and reduce demand for our products and services. At this time, we have not experienced material losses from climate change; however, we are aware that its impact may increase in the future. Climate change, its effects and the resulting, unknown impacts could have a material adverse effect on our business, financial condition and results of operations.

We are also susceptible to policy and regulatory changes with respect to banks' climate risk management practices. In addition, due to divergent policies and viewpoints regarding climate change, we are at an increased risk of being subject to different and potentially conflicting legal or regulatory requirements and stakeholder expectations, as well as the risk of harm to our business and brand and our ability to attract and retain employees from negative public opinion related to any of our actual or perceived action or inaction in response to climate-related matters. Furthermore, ongoing legislative or regulatory uncertainties and

26

changes regarding climate-related matters and practices may result in higher regulatory, compliance, credit and other risks and costs, and may subject us to different and potentially conflicting requirements.

RISKS FROM ACCOUNTING AND OTHER ESTIMATES

Our Consolidated Financial Statements are based in part on assumptions and estimates which, if incorrect, could cause unexpected losses in the future.

We have made a number of estimates and assumptions relating to the reporting of assets and liabilities, the disclosure of contingent assets and liabilities at the date of the Consolidated Financial Statements, and the reported amounts of revenue and expenses during the reporting period to prepare these Consolidated Financial Statements in conformity with GAAP. Actual results could differ from these estimates. Material estimates subject to change in the near term include, among other items: the allowance for credit losses; the carrying value of goodwill or other intangible assets; the fair value estimates of certain assets and liabilities; and the realization of DTAs and liabilities. These estimates may be adjusted as more current information becomes available and any adjustment may be significant.

There are risks resulting from the extensive use of models in our business.

We rely on quantitative models to measure risks and to estimate certain financial values. We use models in such processes as determining the pricing of various products, measuring interest rate and other market risks, predicting or estimating losses and assessing capital adequacy, as well as to estimate the value of financial instruments and balance sheet items. Our reliance on models continues to increase as rules, guidance, and expectations change. The most recent example of this is the additional models used in the determination of our ACL under CECL. Poorly designed or implemented models present the risk that our business decisions based on information incorporating model output could be adversely affected due to the inaccuracy of that information. Models are often based on historical experience to predict future outcomes, and, as a result, new experiences or events which are not part of historical experience can significantly increase model imprecision and impact model reliability. Model inputs can also include information provided by third parties, such as economic forecasts or macroeconomic variables (unemployment rates, real GDP, etc.) upon which we rely. Some of the decisions that our regulators make, including those related to capital actions, could be affected due to the perception that the quality of the models used to generate the relevant information is insufficient, which could have a negative impact on our ability to take certain actions, including making dividend payments or engaging in share repurchases.

LEGAL AND REGULATORY COMPLIANCE RISKS

We are subject to extensive regulation and supervision and may be adversely affected by changes in, or any failure to comply with, laws and regulations.

Virtually every aspect of our operations is subject to extensive regulation and supervision by federal and state regulatory agencies, including, but not limited to, the Federal Reserve Board, OCC, FDIC, CFPB, DOJ, UST, SEC, HUD, DOL, EEOC, state attorneys general and state banking, financial services, securities and insurance regulators. Under this framework, regulatory agencies have broad authority to carry out their supervisory, examination and enforcement responsibilities to address compliance with applicable laws and regulations, including, but not limited to, laws and regulations relating to capital adequacy, asset quality, earnings, liquidity, risk management and financial accounting and reporting as well as laws and regulations governing consumer protection, fair lending, privacy, information security and cybersecurity risk management, third-party vendor risk management, AML and sanctions and anti-terrorism laws. Failure to comply with these regulatory requirements, including inadvertent or unintentional violations, may result in the assessment of fines and penalties, the commencement of informal or formal regulatory enforcement actions against us, or regulatory restrictions on our activities. Failure to comply may also affect our ability to grow through acquisitions, discourage institutional investment managers to invest in our securities, result in reputational damage, or increase our costs of doing business.

The U.S. Congress, state legislatures and federal and state regulatory agencies periodically review banking and other laws, regulations and policies for possible changes. Changes in applicable federal or state laws, regulations or governmental policies, including as a result of changes in U.S. presidential administrations that have different regulatory agendas, may affect us and our business. The effects of such changes are difficult to predict and may produce unintended consequences, like limiting the types of financial services and products we may offer, limiting the fees we may charge, altering demand for existing products and services, increasing the ability of non-banks to offer competing financial services and products, increasing compliance burdens, or otherwise adversely affecting our business, financial condition or results of operations.

27

The CFPB, established pursuant to the Dodd-Frank Act, has imposed enforcement actions against a variety of bank and non-bank market participants with respect to a number of consumer financial products and services. These enforcement actions have resulted in those participants expending significant time, money and resources to adjust to the initiatives being pursued by the CFPB. These enforcement actions may also serve as precedent for how the CFPB interprets and enforces consumer protection laws, including practices or acts that are deemed to be unfair, deceptive or abusive, with respect to supervised institutions and may result in the imposition of higher standards of compliance with such laws. Other federal financial regulatory agencies, including the OCC, as well as state attorneys general and state banking agencies and other state financial regulators have also been active in this area with respect to institutions over which they have jurisdiction.

Compliance with banking and financial services statutes and regulations also impacts our ability to engage in new activities or to expand existing activities. Federal and state banking agencies possess broad powers to take supervisory actions, as they deem appropriate. These supervisory actions may result in higher capital requirements, higher deposit insurance premiums and limitations on our operations and expansion activities that could have a material adverse effect on our business and profitability. We dedicate significant time, effort, and expense to comply with regulatory and supervisory standards and requirements imposed by our regulators, and we expect that we will continue to do so. If we fail to develop the systems and processes necessary to comply with the standards and requirements imposed by these rules at a reasonable cost, it could have a material adverse effect on our business, financial condition or results of operations.

From time to time we may be the subject of litigation and governmental or administrative proceedings. Adverse outcomes of any such litigation or proceedings may have a material adverse impact on our business, financial condition and results of operations as well as our reputation.

Many aspects of our business involve a substantial risk of legal liability. From time to time, we have been named or threatened to be named as a defendant in various lawsuits arising from our business activities and, in some cases, from the activities of companies that we or our subsidiaries acquired. In addition, we are periodically the subject of governmental investigations and other forms of regulatory or governmental inquiry. These lawsuits, investigations, inquiries and other matters could lead to: administrative, civil or criminal proceedings, result in adverse judgments, settlements, fines, penalties, restitution, injunctions or other types of sanctions, the need for us to undertake remedial actions, or otherwise alter our business, financial or accounting practices. Substantial legal liability or significant regulatory actions against us could materially adversely affect our business, financial condition and results of operations and cause significant reputational harm.

Changes in U.S. federal, state or local tax laws may negatively impact our financial performance.

We are subject to changes in tax laws that could increase our effective tax rate. These changes may be retroactive to previous periods and, as a result, could negatively affect our current and future financial performance. The Tax Act reduced our federal corporate income tax rate to 21% beginning in 2018. The Tax Act also imposed limitations on our ability to take certain deductions, such as the deduction for FDIC deposit insurance premiums, which partially offset the increase in net income from the lower tax rate. The Inflation Reduction Act of 2022 imposes a 1% excise tax on the value of our shares we repurchase that exceeds $1 million in the aggregate during any taxable year, subject to certain adjustments. Additionally, on July 4, 2025, H.R. 1 was signed into law, which included a broad range of tax reform provisions affecting businesses, including extending and modifying certain key provisions from the Tax Act and accelerating the phase-out of certain incentives from the Inflation Reduction Act of 2022.

There is uncertainty concerning whether future legislation will further revise the Tax Code. Future changes to the Tax Code may affect our business, financial condition and results of operations.

Regulations relating to privacy, information security, and data protection could increase our costs, affect or limit how we collect and use personal information and adversely affect our business opportunities.

We are subject to various federal and state privacy, information security, and data protection laws, such as the GLBA, that among other things require privacy disclosures and maintenance of a robust security program that are increasingly subject to change which could have a significant impact on our current and planned privacy, data protection, and information security-related practices; our collection, use, sharing, retention, and safeguarding of consumer or employee information; disclosures and notifications during a cyber or information security incident; and certain of our current or planned business activities. Our regulators also hold us responsible for privacy and data protection obligations performed by our third-party service providers while providing services to us, as well as disclosures and notifications during a cyber or information security incident.

28

New or changes to existing laws could increase our costs of compliance and business operations and could reduce income from certain business initiatives, including increased privacy-related enforcement activity and higher compliance and technology costs, and could restrict our ability to provide certain products and services. Our failure to comply with privacy, data protection, and information security laws could result in potentially significant regulatory or governmental investigations or actions, litigation, fines, sanctions, and damage to our reputation, which could have a material adverse effect on our business, financial condition or results of operations.

RISKS RELATED TO THE CONSUMMATION OF THE MERGER AND OUR FUTURE STRATEGIC GROWTH

We expect to incur substantial costs related to the Merger and integration, and these costs may be greater than anticipated due to unexpected events.

We have incurred and expect to incur a number of significant non-recurring costs associated with the Merger. These costs include legal, financial advisory, accounting, consulting and other advisory fees, severance/employee benefit-related costs, public company filing fees and other regulatory fees, financial printing and other printing costs and other related costs. Some of these costs are payable by us regardless of whether or not the Merger is completed.

In addition, we will incur integration costs following the completion of the Merger as we integrate Blue Foundry Bank, including facilities and systems consolidation costs and employment-related costs. We may also incur additional costs to maintain employee morale and to retain key employees. There are a large number of processes, policies, procedures, operations, technologies and systems that may need to be integrated, including purchasing, accounting and finance, payroll, compliance, treasury management, branch operations, vendor management, risk management, lines of business, pricing and benefits. While we have assumed that a certain level of costs will be incurred, there are many factors beyond our control that could affect the total amount or the timing of the integration costs. Moreover, many of the costs that will be incurred are, by their nature, difficult to estimate accurately. These integration costs may result in us taking charges against earnings following the completion of the Merger, and the amount and timing of such charges are uncertain at present. There can be no assurances that the expected benefits and efficiencies related to the integration of the businesses will be realized to offset these transaction and integration costs over time.

Combining the Corporation and Blue Foundry may be more difficult, costly or time-consuming than expected, and we may fail to realize the anticipated benefits and cost savings of the Merger.

The success of the Merger will depend, in part, on the ability to realize the anticipated cost savings from combining the businesses of the Corporation and Blue Foundry. To realize the anticipated benefits and cost savings from the Merger, we must successfully integrate and combine Blue Foundry with our business in a manner that permits those cost savings to be realized without adversely affecting current revenues and future growth. If we are not able to successfully achieve these objectives, the anticipated benefits of the Merger may not be realized fully or at all or may take longer to realize than expected. In addition, the actual cost savings of the Merger could be less than anticipated, and integration may result in additional and unforeseen expenses.

An inability to realize the full extent of the anticipated benefits of the Merger and the other transactions contemplated by the Merger Agreement, as well as any delays encountered in the integration process, could have an adverse effect on the revenues, levels of expenses and operating results of the Corporation following the completion of the Merger, which may adversely affect the value of our common stock.

We and Blue Foundry have operated and, until the effective time of the Merger, must continue to operate, independently. It is possible that the integration process could result in the disruption of each company’s ongoing businesses or inconsistencies in standards, controls, procedures and policies that adversely affect the companies’ ability to maintain relationships with clients, customers, depositors and employees or to achieve the anticipated benefits and cost savings of the Merger. Integration efforts between the companies may also divert management attention and resources. These integration matters could have an adverse effect on each of us and Blue Foundry during this transition period and for an undetermined period after completion of the Merger on us.

Our future results following the completion of the Merger may suffer if we do not effectively manage our expanded operations.

Following the Merger, the size of our business will increase beyond the current size of either our or Blue Foundry’s business. Our future success will depend, in part, upon our ability to manage this expanded business, which may pose challenges for management, including challenges related to the management and monitoring of new operations and associated increased costs

29

and complexity. We may also face increased scrutiny from governmental entities as a result of the increased size of our business. There can be no assurances that we will be successful or that we will realize the expected operating efficiencies, revenue enhancement or other benefits currently anticipated from the Merger.

We may be unable to retain legacy Blue Foundry personnel successfully after the completion of the Merger.

The success of the Merger will depend in part on our ability to retain the talent and dedication of key employees currently employed by Blue Foundry. It is possible that these employees may decide not to remain with Blue Foundry while the Merger is pending or after its completion. If we and Blue Foundry are unable to retain key employees, including management, who are critical to the successful integration and future operations of the Corporation following the Merger, the Corporation and Blue Foundry could face disruptions in their operations, loss of existing customers, loss of key information, expertise or know-how and unanticipated additional recruitment costs. In addition, following the completion of the Merger, if key employees terminate their employment, our business activities following the Merger may be adversely affected, and management’s attention may be diverted from successfully hiring suitable replacements, all of which may cause our business following the Merger to suffer. We and Blue Foundry also may not be able to locate or retain suitable replacements for key employees who leave either company.

Failure to complete the Merger could negatively affect us.

If the Merger is not completed for any reason, there may be various adverse consequences and we may experience negative reactions from the financial markets and from our respective customers and employees. For example, our business may be adversely impacted by the failure to pursue other beneficial opportunities due to the focus of management on the Merger, without realizing any of the anticipated benefits of completing the Merger. Additionally, if the Merger Agreement is terminated, the market price of our common stock could decline to the extent that current market prices reflect a market assumption that the Merger will be beneficial and will be completed.

Additionally, we have incurred and will incur substantial expenses in connection with the negotiation and completion of the transactions contemplated by the Merger Agreement, as well as the costs and expenses of preparing, filing, printing and mailing the proxy statement/prospectus, and all filing and other fees paid in connection with the Merger. If the Merger is not completed, we would have to pay some of these expenses without realizing the expected benefits of the Merger.

We face a variety of risks in connection with completed and potential future acquisitions.

We may from time to time seek to supplement organic growth through acquisitions of banks, branches or other financial businesses or assets. Potential acquisitions, including the pending Merger, are typically subject to regulatory or other approvals, and there can be no assurance that we would be able to obtain any such approvals in a timely manner, without restrictive conditions or at all. Even if required approvals are obtained, acquisitions involve numerous risks, including lower than expected performance, higher than expected costs, difficulties related to integration, diversion of management's attention from other business activities, the potential loss of key employees, changes in relationships with customers, disruption of the operations of the acquired business and our business, exposure to potential asset quality issues, unknown or contingent liabilities of the acquired business and changes in banking or tax laws or regulations that may affect the acquired business and our business.

The success of any future acquisitions we may consummate will depend on, among other things, our ability to realize the expected revenue increases, cost savings, strategic gains, increases in geographic or product presence, and/or other anticipated benefits. If we are not able to successfully achieve these objectives, the anticipated benefits of the subject acquisition may not be realized fully or at all or may take longer to realize than expected and the subject acquisition could have a material adverse effect on our business, financial condition and results of operations.

Additionally, future mergers or acquisitions, if any, may involve cash, debt or equity securities as transaction consideration. Acquisitions typically involve the payment of a premium over book and market values, and, therefore, some dilution of our stock's tangible book value and net income per common share may occur in connection with any future transaction. We cannot say with any certainty that we will be able to consummate, or if consummated, successfully integrate any future acquisitions, or that we will not incur disruptions or unexpected expenses in integrating such acquisitions. Furthermore, failure to realize the expected revenue increases, cost savings, strategic gains, increases in geographic or product presence, and/or other anticipated benefits from pending or future acquisitions could have a material adverse effect on our business, financial condition and results of operations.

30

If the goodwill that we have recorded or will record in the future in connection with our acquisitions becomes impaired, it could have a negative impact on our results of operations.

We have supplemented our internal growth with strategic acquisitions of banks, branches and other financial services companies. In the future, we may seek to supplement organic growth through additional acquisitions. If the purchase price of an acquired company exceeds the fair value of the company's net assets, the excess is carried on the acquirer's balance sheet as goodwill. As of December 31, 2025, we had $553.3 million of goodwill recorded on our balance sheet. We are required to evaluate goodwill for impairment at least annually. Write-downs of the amount of any impairment, if necessary, are to be charged to earnings in the period in which the impairment occurs. There can be no assurance that future evaluations of goodwill will not result in impairment charges.

We may not be able to achieve our growth plans.

Our business plan includes the pursuit of profitable growth. To achieve profitable growth, we may pursue new lines of business or offer new products or services, all of which can involve significant costs, uncertainties and risks. Any new activity we pursue may require a significant investment of time and resources and may not generate the anticipated return on that investment. In addition, we may not be able to effectively implement and manage any new activities. External factors, such as the need to comply with additional regulations, the availability, or introduction, of competitive alternatives in the market, and changes in customer preferences may also impact the successful implementation of any new activity. Any new activity could have a significant impact on the effectiveness of our system of internal controls. Sustainable growth requires that we manage risks by balancing loan and deposit growth at acceptable levels of risk, maintaining adequate liquidity and capital, hiring and retaining qualified employees, and successfully managing the costs and implementation risks with respect to strategic projects and initiatives. If we are not able to adequately identify and manage the risks associated with new activities, our business, financial condition and results of operations could be materially and adversely impacted.

RISKS RELATED TO COMPETITION

Our ability to attract and retain qualified employees is critical to our success.

Our employees are our most important resource. Competition for qualified personnel is intense in many areas of the financial services industry. We endeavor to attract talented new employees and retain and motivate our existing employees to assist in executing our growth, acquisition and business strategies. We also seek to retain proven, experienced senior employees augmented from time to time by external hires, to provide continuity of succession of our executive management team. Losses of, or changes in, our current executive officers or other key personnel, or the inability to recruit and retain qualified personnel in the future, could materially and adversely affect our financial condition and results of operations.

We face strong competition from financial services companies and other companies that offer banking services which could materially and adversely affect our business.

The financial services industry has become even more competitive as a result of legislative, regulatory, and technological changes and continued banking consolidation which may increase in connection with current economic, market, and political conditions. We face substantial competition in all phases of our operations from a variety of competitors, including national banks, regional banks, community banks and FinTechs. Many of our competitors offer the same banking services that we offer and our success depends on our ability to adapt our products and services to evolving industry standards and customer preferences. In addition to product and service offerings, we compete based on a number of other factors, including financial and other terms, underwriting standards, technological capabilities, brand, and reputation. Increased competition in our market may result in reduced new loan production and/or decreased deposit balances or less favorable terms on loans and leases and/or deposit accounts. We also face competition from many other types of financial institutions, including without limitation, non-bank specialty lenders, insurance companies, private investment funds, investment banks and other financial intermediaries, and some of these competitors may not be subject to the same regulatory requirements that we are. Many of our competitors have significantly greater resources, established customer bases, more locations, and longer operating histories. Should competition in the financial services industry intensify, our ability to market our products and services may be adversely affected. If we are unable to attract and retain banking customers, we may be unable to grow or maintain the levels of our loans and deposits, and our financial condition and results of operations may be adversely affected as a result. Ultimately, we may not be able to compete successfully against current and future competitors.

31

Failure to keep pace with technological change could adversely affect our business.

The financial services industry experiences continuous technological change with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions to better serve customers and to reduce costs. Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. The costs of implementing new technology, including personnel, can be high, in both absolute and relative terms, and we may not achieve intended benefits of new technology initiatives. Moreover, the implementation of new technology can expose us to new or increased operational risks. For example, our implementation of certain new technologies, such as those related to artificial intelligence, machine learning and automated decision making, in our business processes may have unintended consequences due to their limitations or our failure to use them effectively. Many of our competitors have substantially greater resources to invest in technological improvements or are technology focused start-ups with internally developed cloud-native systems that offer improved user interfaces and experiences. Due to our size, we may face challenges in allocating sufficient resources to keep pace with technological investments and improvements implemented by our larger competitors. In addition, new payment, credit and investment and wealth management services developed and offered by non-bank or non-traditional competitors pose an increasing threat to the products and services traditionally provided by financial institutions like us. We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers, or effectively deploy new technologies to improve efficiency. In addition, we depend on internal and outsourced technology to support all aspects of our business operations. Interruption or failure of these systems creates a risk of business loss as a result of adverse customer experiences and possible diminishing of our reputation, damage claims or civil fines. Failure to successfully keep pace with technological change affecting the financial services industry or to successfully implement core processing strategies could have a material adverse impact on our business and, in turn, our financial condition and results of operations.

RISKS RELATED TO AN INVESTMENT IN OUR SECURITIES

We are a bank holding company and rely on dividends and other payments from our subsidiaries for substantially all of our revenue and our ability to make dividend payments, distributions and other payments.

We are a bank holding company, a separate and distinct legal entity from our bank and non-bank subsidiaries, and we depend on the payment of dividends and other payments and distributions from our subsidiaries, principally Fulton Bank, for substantially all of our revenues. As a result, our ability to make dividend payments on our common and preferred stock depends primarily on compliance with applicable federal regulatory requirements and the receipt of dividends and other distributions from our subsidiaries. There are various regulatory and prudential supervisory restrictions, which may change from time to time, that impact the ability of Fulton Bank to pay dividends or make other payments to us. There can be no assurance that Fulton Bank will be able to pay dividends at past levels, or at all, in the future. If we do not receive sufficient cash dividends or are unable to borrow from Fulton Bank, then we may not have sufficient funds to pay dividends to our shareholders, repurchase our common stock or service our debt obligations.

We may reduce or discontinue the payment of dividends on, or repurchases of, our common stock.

We have pursued a strategy of capital management under which we have sought to deploy capital through stock repurchases and dividends on our common stock, in a manner that is beneficial to our shareholders. Our shareholders are only entitled to receive such dividends as our Board of Directors may declare out of funds legally available for such payments. We are not required to pay dividends on, or effect repurchases of, our common stock and may reduce or eliminate our common stock dividend and/or share repurchases in the future. Our ability to pay dividends to our stockholders is subject to the restrictions set forth in Pennsylvania law, by the Federal Reserve Board, and by certain covenants contained in our subordinated debentures. Notification to the Federal Reserve Board is also required prior to our declaring and paying a cash dividend to our shareholders during any period in which our quarterly and/or cumulative twelve-month net earnings are insufficient to fund the dividend amount, among other requirements. We may not pay a dividend if the Federal Reserve Board objects or until such time as we receive approval from the Federal Reserve Board or we no longer need to provide notice under applicable regulations. In addition, we may be restricted by applicable law or regulation or actions taken by our regulators, now or in the future, from paying dividends to, or repurchasing shares of our common stock from, our shareholders. We cannot provide assurance that we will continue paying dividends on, or repurchase shares of, our common stock at current levels or at all. A reduction or discontinuance of dividends on our common stock or our share repurchases could have a material adverse effect on the market price of our common stock.

32