zions-20231231

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended December 31, 2023

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from __________ to __________

COMMISSION FILE NUMBER 001-12307

ZIONS BANCORPORATION, NATIONAL ASSOCIATION

(Exact name of registrant as specified in its charter)


United States of America			87-0189025
(State or other jurisdiction of incorporation or organization)			(IRS Employer Identification Number)
One South Main, Salt Lake City, Utah			84133-1109
(Address of principal executive offices)			(Zip Code)

Registrant’s telephone number, including area code: (801) 844-8208

Securities registered pursuant to Section 12(b) of the Act:


Title of Each Class	Trading Symbols	Name of Each Exchange on Which Registered
Common Stock, par value $0.001	ZION	The NASDAQ Stock Market LLC
Depositary Shares each representing a 1/40th ownership interest in a share of:
Series A Floating-Rate Non-Cumulative Perpetual Preferred Stock	ZIONP	The NASDAQ Stock Market LLC
Series G Fixed/Floating-Rate Non-Cumulative Perpetual Preferred Stock	ZIONO	The NASDAQ Stock Market LLC

6.95% Fixed-to-Floating Rate Subordinated Notes due September 15, 2028	ZIONL	The NASDAQ Stock Market LLC

Securities registered pursuant to Section 12(g) of the Act: None.

•Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒ No ¨

•Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ¨ No ☒

•Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ý No ¨

•Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ý No ¨

•Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer ý Accelerated filer ☐ Non-accelerated filer ☐ Smaller reporting company ☐ Emerging growth company ☐

•If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ¨

•Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ý

•If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

•Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

•Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ¨ No ý

Aggregate Market Value of Common Stock Held by Non-affiliates at June 30, 2023 $3,892,923,377

Number of Common Shares Outstanding at February 5, 2024 148,155,311 shares

Documents Incorporated by Reference:

Part III: Items 10-14 — Proxy Statement for the 2024 Annual Meeting of Shareholders to be held April 26, 2024.

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

TABLE OF CONTENTS



PART I
Item 1.	Business	5
Item 1A.	Risk Factors	14
Item 1B.	Unresolved Staff Comments	24
Item 1C.	Cybersecurity	24
Item 2.	Properties	25
Item 3.	Legal Proceedings	25
Item 4.	Mine Safety Disclosures	25

PART II
Item 5.	Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities	26
Item 6.	Reserved	27
Item 7.	Management’s Discussion and Analysis of Financial Condition and Results of Operations	28
Item 7A.	Quantitative and Qualitative Disclosures About Market Risk	79
Item 8.	Financial Statements and Supplementary Data	79
Item 9.	Changes in and Disagreements with Accountants on Accounting and Financial Disclosure	151
Item 9A.	Controls and Procedures	151
Item 9B.	Other Information	152
Item 9C.	Disclosure Regarding Foreign Jurisdictions that Prevent Inspections	152

PART III
Item 10.	Directors, Executive Officers , and Corporate Governance	152
Item 11.	Executive Compensation	152
Item 12.	Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters	152
Item 13.	Certain Relationships and Related Transactions, and Director Independence	152
Item 14.	Principal Account ant Fees and Services	153

PART IV
Item 15.	Exhibits and Financial Statement Schedules	153
Item 16.	Form 10-K Summary	158
Signatures		159

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

GLOSSARY OF ACRONYMS AND ABBREVIATIONS


ACL	Allowance for Credit Losses	FRB	Federal Reserve Board
AFS	Available-for-Sale	FTP	Funds Transfer Pricing
AI	Artificial Intelligence	GAAP	Generally Accepted Accounting Principles
ALCO	Asset/Liability Committee	GCF	General Collateral Funding
ALLL	Allowance for Loan and Lease Losses	GDP	Gross Domestic Product
Amegy	Amegy Bank, a division of Zions Bancorporation, National Association	HECL	Home Equity Credit Line
AOCI	Accumulated Other Comprehensive Income	HTM	Held-to-Maturity
ASC	Accounting Standards Codification	IPO	Initial Public Offering
ASU	Accounting Standards Update	IRS	Internal Revenue Service
ATM	Automated Teller Machine	ISDA	International Swaps and Derivative Association
BOLI	Bank-Owned Life Insurance	KBW	Keefe, Bruyette & Woods, Inc.
bps	Basis Points	KRX	KBW Regional Bank Index
BTFP	Bank Term Funding Program	LIBOR	London Interbank Offered Rate
CB&T	California Bank & Trust, a division of Zions Bancorporation, National Association	LIHTC	Low-Income Housing Tax Credit
CECL	Current Expected Credit Loss	MD&A	Management’s Discussion and Analysis
CET1	Common Equity Tier 1 (Basel III)	Municipalities	State and Local Governments
CFPB	Consumer Financial Protection Bureau	NAICS	North American Industry Classification System
CISO	Chief Information Security Officer	NASDAQ	National Association of Securities Dealers Automated Quotations
CLTV	Combined Loan-to-Value Ratio	NAV	Net Asset Value
CMBS	Commercial Mortgage-Backed Security	NBAZ	National Bank of Arizona, a division of Zions Bancorporation, National Association
CMC	Capital Management Committee	NIM	Net Interest Margin
CODM	Chief Operating Decision Maker	NM	Not Meaningful
COSO	Committee of Sponsoring Organizations of the Treadway Commission	NSB	Nevada State Bank, a division of Zions Bancorporation, National Association
CRA	Community Reinvestment Act	OCC	Office of the Comptroller of the Currency
CRE	Commercial Real Estate	OCI	Other Comprehensive Income
CSA	Credit Support Annex	OREO	Other Real Estate Owned
CSV	Cash Surrender Value	PAM	Proportional Amortization Method
CTOO	Chief Technology and Operations Officer	PCAOB	Public Company Accounting Oversight Board
CVA	Credit Valuation Adjustment	PEI	Private Equity Investment
Dodd-Frank Act	Dodd-Frank Wall Street Reform and Consumer Protection Act	PPNR	Pre-provision Net Revenue
DTA	Deferred Tax Asset	PPP	Paycheck Protection Program
DTL	Deferred Tax Liability	ROC	Risk Oversight Committee
EaR	Earnings at Risk	ROU	Right-of-Use
EPS	Earnings per Share	RSU	Restricted Stock Unit
ERM	Enterprise Risk Management	RULC	Reserve for Unfunded Lending Commitments
ERMC	Enterprise Risk Management Committee	S&P	Standard and Poor’s
ETO	Enterprise and Technology Operations	SBA	U.S. Small Business Administration
EVE	Economic Value of Equity at Risk	SBIC	Small Business Investment Company
FAMC	Federal Agricultural Mortgage Corporation, or “Farmer Mac”	SEC	Securities and Exchange Commission
FASB	Financial Accounting Standards Board	SOFR	Secured Overnight Financing Rate
FDIC	Federal Deposit Insurance Corporation	TCBW	The Commerce Bank of Washington, a division of Zions Bancorporation, National Association
FDICIA	Federal Deposit Insurance Corporation Improvement Act	TDR	Troubled Debt Restructuring
FHLB	Federal Home Loan Bank	U.S.	United States
FICO	Fair Isaac Corporation	Vectra	Vectra Bank Colorado, a division of Zions Bancorporation, National Association
FINRA	Financial Industry Regulatory Authority	VIE	Variable Interest Entity
Fintech	Financial Technology Company	Zions Bank	Zions Bank, a division of Zions Bancorporation, National Association

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

PART I

FORWARD-LOOKING INFORMATION

This annual report includes “forward-looking statements” as that term is defined in the Private Securities Litigation Reform Act of 1995. These statements are based on management’s current expectations and assumptions regarding future events or determinations, all of which are subject to known and unknown risks, uncertainties, and other factors that may cause our actual results, performance or achievements, industry trends, and results or regulatory outcomes to differ materially from those expressed or implied. Forward-looking statements include, among others:

•Statements with respect to the beliefs, plans, objectives, goals, targets, commitments, designs, guidelines, expectations, anticipations, and future financial condition, results of operations and performance of Zions Bancorporation, National Association and its subsidiaries (collectively “Zions Bancorporation, N.A.,” “the Bank,” “we,” “our,” “us”); and

•Statements preceded or followed by, or that include the words “may,” “might,” “can,” “continue,” “could,” “should,” “would,” “believe,” “anticipate,” “estimate,” “forecasts,” “expect,” “intend,” “target,” “commit,” “design,” “plan,” “projects,” “will,” and the negative thereof and similar words and expressions.

Forward-looking statements are not guarantees, nor should they be relied upon as representing management’s views as of any subsequent date. Actual results and outcomes may differ materially from those presented. Although the following list is not comprehensive, important factors that may cause material differences include:

•The quality and composition of our loan and securities portfolios and the quality and composition of our deposits;

•Changes in general industry, political and economic conditions, including continued elevated inflation, economic slowdown or recession, or other economic challenges; changes in interest and reference rates, which could adversely affect our revenue and expenses, the value of assets and liabilities, and the availability and cost of capital and liquidity; deterioration in economic conditions that may result in increased loan and leases losses;

•The impact of bank closures or adverse developments at other banks on general investor sentiment regarding the stability and liquidity of banks;

•Competitive pressures and other factors that may affect aspects of our business, such as pricing and demand for our products and services, our ability to recruit and retain talent, and the impact of technological advancements, digital commerce, artificial intelligence, and other innovations affecting the banking industry;

•Our ability to complete projects and initiatives and execute on our strategic plans, manage our risks, control compensation and other expenses, and achieve our business objectives;

•Our ability to develop and maintain technology, information security systems and controls designed to guard against fraud, cybersecurity, and privacy risks;

•Our ability to provide adequate oversight of our suppliers or prevent inadequate performance by third parties upon whom we rely for the delivery of various products and services;

•Natural disasters, pandemics, catastrophic events and other emergencies and incidents and their impact on our and our customer’s operations and business and communities, including the increasing difficulty in, and the expense of, obtaining property, auto, business, and other insurance products;

•Governmental and social responses to environmental, social, and governance issues, including those with respect to climate change;

•Securities and capital markets behavior, including volatility and changes in market liquidity and our ability to raise capital;

•The possibility that our recorded goodwill could become impaired, which may have an adverse impact on our earnings and shareholders’ equity, but not on our regulatory capital;

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

•The effects of newly enacted and proposed regulations affecting us and the banking industry, as well as changes and uncertainties in applicable laws, and fiscal, monetary, regulatory, trade, and tax policies, and actions taken by governments, agencies, central banks, and similar organizations, including those that result in decreases in revenue; increases in bank fees, insurance assessments and capital standards; and other regulatory requirements;

•Adverse news and other expressions of negative public opinion whether directed at us, other banks, the banking industry, or otherwise that may adversely affect our reputation and that of the banking industry generally;

•Protracted congressional negotiations and political stalemates regarding government funding and other issues, including those that increase the possibility of government shutdowns, downgrades in United States (“U.S.”) credit ratings, or other economic disruptions; and

•The effects of wars and geopolitical conflicts, such as the ongoing war between Russia and Ukraine and the conflicts in the Middle East, and other local, national, or international disasters, crises, or conflicts that may occur in the future.

We caution against the undue reliance on forward-looking statements, which reflect our views only as of the date they are made. Except to the extent required by law, we specifically disclaim any obligation to update any factors or to publicly announce the revisions to any forward-looking statements to reflect future events or developments.

ITEM 1. BUSINESS

DESCRIPTION OF BUSINESS

Zions Bancorporation, National Association (“Zions Bancorporation, N.A.,” “the Bank,” “we,” “our,” “us”) is a bank headquartered in Salt Lake City, Utah with annual net revenue (net interest income and noninterest income) of $3.1 billion in 2023, and total assets of approximately $87 billion at December 31, 2023. We provide a wide range of banking products and related services, primarily in the states of Arizona, California, Colorado, Idaho, Nevada, New Mexico, Oregon, Texas, Utah, Washington, and Wyoming. We had more than one million customers at year-end 2023, served by 407 branches and various online, mobile, and digital offerings. We had 9,679 full-time equivalent employees at December 31, 2023.

We conduct our operations primarily through seven separately managed and geographically defined bank divisions, which we refer to as “affiliates,” or “affiliate banks,” each with its own local branding and management team. These affiliate banks comprise our primary business segments as referred to throughout this document. We emphasize local authority, responsibility, pricing, and customization of certain products that are designed to maximize customer satisfaction and strengthen community relations. Our affiliate banks are supported by an enterprise operating segment (referred to as the “Other” segment) that provides governance and risk management, allocates capital, establishes strategic objectives, and includes centralized technology, back-office functions, and certain lines of business not operated through our affiliate banks. For more information about our segments, see “Business Segment Results” in Management’s Discussion and Analysis (“MD&A”) on page 42 and Note 22 of the Notes to Consolidated Financial Statements.

PRODUCTS AND SERVICES

We focus on serving customers in the communities in which we operate. Our experienced bankers strive to develop long-lasting relationships with our customers by providing competitive products and award-winning service. Building and sustaining these relationships is essential to understanding and meeting our customers’ needs. Some of the products and services we provide, whether delivered digitally or by other means, include:

•Commercial and small business banking. We serve a wide range of commercial customers, generally small- and medium-sized businesses. Products and services we provide to our commercial and small business banking customers include:

◦Commercial and industrial and owner-occupied lending and leasing;

◦Municipal and public finance services;

◦Depository account and cash management services;

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

◦Commercial and small business cards, as well as merchant processing services;

◦Corporate trust services; and

◦Correspondent banking and international lending services.

•Capital markets and investment banking. We provide customized financing solutions to help our customers raise capital efficiently, execute strategic transactions, and manage exposure to financial markets. Capital markets products and services include:

◦Loan syndications;

◦Foreign exchange services and interest rate derivatives;

◦Fixed income securities underwriting;

◦Advisory and capital raising;

◦Commercial mortgage-backed security (“CMBS”) conduit lending; and

◦Power and project financing.

•Commercial real estate lending. We provide lending products secured by commercial real estate to borrowers that include:

◦Term and construction/land development financing, including the following collateral types:

▪Commercial multi-family, industrial, and office; and

▪Residential single-family, community development, and affordable housing.

•Retail banking. We provide quality retail banking products and services to our customers that include:

◦Residential mortgages;

◦Home equity lines of credit;

◦Personal lines of credit and installment consumer loans;

◦Depository account services;

◦Consumer cards; and

◦Personal trust services.

•Wealth management. We offer various wealth management products and services to customers. Our planning-driven offerings, combined with high-touch service and sophisticated asset management capabilities, have resulted in continued growth in assets under management. Additional offerings to our wealth management customers include:

◦Investment management services;

◦Fiduciary and estate services; and

◦Advanced business succession and estate planning services.

COMPETITION

We operate in a highly competitive environment. Our most direct competition for loans, deposits, and other banking services generally comes from other commercial banks, credit unions, financial technology companies (“fintechs”), and private credit or debt funds. Some of these financial institutions do not have a physical presence in our market footprint, but solicit business via the internet and other means. We also compete with finance companies, mutual fund companies, insurance companies, brokerage firms, securities dealers, investment banking companies, other nontraditional lending and banking companies, and a variety of other types of companies. Some of our competitors may have fewer regulatory constraints, greater ability to develop, implement, and offer technologies and other innovative financial services, and lower-cost structures, taxes, and regulatory burdens.

Our key differentiators include the quality of service delivered, our local community knowledge, convenience of branch and office locations, a wide range of products and services offered, and the overall relationships with our customers. We strive to compete effectively in all of these areas to remain successful.

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

SUPERVISION AND REGULATION

The banking and financial services business in which we engage is highly regulated. Such regulation is intended to promote the stability of banking and financial companies and to protect the interests of customers, depositors, and communities. Although banks and their customers benefit from many of these regulations, in some cases, they may not be aligned with, or intended to protect, the interests of our shareholders or creditors. Banking laws and regulations have given financial regulators expanded powers over many aspects of the financial services industry, which have reduced, and may continue to reduce, returns earned by shareholders. Furthermore, changes in applicable laws or regulations, and in their application by regulatory agencies cannot be predicted and may have a material effect on our business and results.

General

We are subject to the provisions of the National Bank Act and other statutes governing national banks, as well as the rules and regulations of the Office of the Comptroller of the Currency (“OCC”), the Consumer Financial Protection Bureau (“CFPB”), and the Federal Deposit Insurance Corporation (“FDIC”). We, as well as some of our subsidiaries, are also subject to regulation by other federal and state agencies. These regulatory agencies may exert considerable influence over our activities through their supervisory and examination roles. Our brokerage and investment advisory subsidiaries are regulated by the Securities and Exchange Commission (“SEC”), Financial Industry Regulatory Authority (“FINRA”), and state securities regulators.

The National Bank Act

Our corporate affairs are governed by the National Bank Act, and related regulations are administered by the OCC. With respect to securities matters, we are not subject to the Securities Act of 1933 (“Securities Act”), but are subject to OCC regulations governing securities offerings. Our common stock and certain other securities are registered under the Securities and Exchange Act of 1934 (“Exchange Act”), which vests the OCC with the power to administer and enforce certain sections of the Exchange Act applicable to national banks, though we continue to make filings required by the Exchange Act with the SEC as a voluntary filer. These statutory and regulatory frameworks are not as well-developed as the corporate and securities law frameworks applicable to many other publicly held companies.

The National Bank Act provides that under certain circumstances the common stock of a national bank is assessable, i.e., holders may be subject to a levy for more funds if so determined by the OCC. The OCC has confirmed that under the applicable provisions of the National Bank Act, assessability is limited to the par value of a national bank’s stock. Our common stock has a par value of $0.001. In addition, according to the OCC, it has not exercised its authority to levy assessments since 1933 and views the assessability authority as a mechanism for addressing capital deficiency that has long been overtaken by developments in statute and regulation, including supervisory and enforcement authorities requiring an institution to maintain capital at a particular level.

Capital Standards – Basel Framework

At December 31, 2023, we exceeded all capital adequacy requirements under the Basel III capital rules, which include certain risk-based capital and leverage ratio requirements prescribed by the OCC. The Basel III capital rules define the components of capital and other factors, such as risk weights, affecting banking institutions’ regulatory capital ratios.

The Basel III capital rules require us to maintain certain minimum capital ratios, as well as a 2.5% “capital conservation buffer,” which is designed to absorb losses during periods of economic stress, composed entirely of common equity Tier 1 (“CET1”). Financial institutions with a ratio of CET1 to risk-weighted assets above the minimum, but below the capital conservation buffer, face constraints on dividends, equity repurchases, and compensation based on the amount of the shortfall. The severity of the constraint depends on the amount of the shortfall and the institution’s “eligible retained income,” which is defined as four quarters of trailing net income, net of distributions and associated tax effects not already reflected in net income. For more information about our capital ratios, see “Capital Management” in MD&A on page 72.

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

Prompt Corrective Action

The Federal Deposit Insurance Corporation Improvement Act (“FDICIA”) requires each federal banking agency to take prompt corrective action to resolve identified problems of insured depository institutions, including, but not limited to, those that fall below one or more prescribed minimum capital ratios. Pursuant to FDICIA, the FDIC promulgated regulations defining the following five categories in which an insured depository institution will be placed, based on the level of its capital ratios: well-capitalized, adequately capitalized, under-capitalized, significantly under-capitalized, and critically under-capitalized.

Under the prompt corrective action provisions of FDICIA as modified by the Basel III capital rules, an insured depository institution will generally be classified as well-capitalized if it has a CET1 ratio of at least 6.5%, a Tier 1 risk-based capital ratio of at least 8%, a total risk-based capital ratio of at least 10%, and a Tier 1 leverage ratio of at least 5%. An insured depository institution will generally be classified as under-capitalized if it has a CET1 ratio less than 4.5%, a Tier 1 risk-based capital ratio less than 6%, a total risk-based capital ratio less than 8%, and a Tier 1 leverage ratio less than 4%.

An institution that is classified as well-capitalized, adequately capitalized, or under-capitalized, may be treated as though it were in the next lower capital category if the appropriate federal banking agency, after notice and opportunity for hearing, determines that an unsafe or unsound condition or an unsafe or unsound practice warrants such treatment. At each successive lower capital category, an insured depository institution is subject to more restrictions and prohibitions, including restrictions on growth, interest rates paid on deposits, the acceptance of brokered deposits, and restrictions or prohibitions on the payment of dividends. Furthermore, if a bank is classified in one of the under-capitalized categories, it is required to submit a capital restoration plan to the federal banking regulator.

The following schedule presents minimum capital ratio and capital conservation buffer requirements, our capital ratios at December 31, 2023, and the minimum requirements to be well-capitalized:

Schedule 1

MINIMUM CAPITAL RATIO AND CAPITAL CONSERVATION BUFFER REQUIREMENTS


	December 31, 2023						Minimum requirement to be “well-capitalized”
	Minimum capital requirement		Capital conservation buffer		Minimum capital ratio requirement with capital conservation buffer				Current capital ratio

CET1 to risk-weighted assets	4.5	%	2.5	%	7.0	%	10.3	%	6.5	%
Tier 1 capital (i.e., CET1 plus additional Tier 1 capital) to risk-weighted assets	6.0		2.5		8.5		10.9		8.0
Total capital (i.e., Tier 1 capital plus Tier 2 capital) to risk-weighted assets	8.0		2.5		10.5		12.8		10.0
Tier 1 capital to average consolidated assets (known as the “Tier 1 leverage ratio”)	4.0		N/A		4.0		8.3		5.0

Recent Regulatory Developments

Basel III Endgame

On July 27, 2023, bank regulators issued a proposal to implement the Basel Committee on Banking Supervision’s finalization of the post-crisis bank regulatory capital reforms. The proposal, commonly referred to as the “Basel III Endgame,” would significantly revise the capital requirements applicable to large banking organizations, defined as those with total assets of $100 billion or more. The proposal is subject to a three-year phase-in period for certain aspects of the proposal, and would be effective beginning July 1, 2025. At December 31, 2023, we had $87.2 billion in total assets and do not currently qualify as a large banking organization. We are evaluating the potential future impact of the proposal, as we expect it is more likely than not we would become subject to this proposal in the future, were it to be finalized in its current form.

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

Under the proposal, if at such time we were to increase our total assets to $100 billion or more, we would, among other things, be required to (1) include certain components of accumulated other comprehensive income (“AOCI”) in regulatory capital and be subject to increased limitations on deferred tax assets (“DTAs”) as a percent of CET1, (2) hold capital for operational risk and market risk, and (3) calculate risk-based capital ratios under both the standardized approach and the expanded risk-based approach.

Long-term Debt

On August 29, 2023, bank regulators issued a proposal that would expand a long-term debt requirement to all banks with total assets of $100 billion or more. The proposed rule would require these banks to have a minimum outstanding amount of eligible long-term debt that is the greatest of (1) 6% of total risk-weighted assets, (2) 2.5% of total leverage exposure, and (3) 3.5% of average total assets. In the event we were to increase our total assets to $100 billion or more, we would have a three-year implementation period to issue debt and meet the other requirements under the proposal. At December 31, 2023, if enacted as proposed, the estimated amount of incremental debt that would be implied by the proposal (based on our asset size at year end) would be approximately $3.5 billion over the three year phase-in period. We expect that the issuance of incremental debt would replace other sources of funding.

Resolution Planning

Additionally, on August 29, 2023, the FDIC issued a proposal that would revise the requirements for resolution planning (“living wills”) for banks in two asset categories. Under the proposal, banks with total assets of $100 billion or more would be required to submit more detailed living wills, while banks with total assets between $50 billion and $100 billion would submit more limited information filings, in each case filed biennially beginning in 2025.

FDIC Special Assessment

In November 2023, the FDIC issued a final rule to implement a special assessment pursuant to a systemic risk determination to recover the costs associated with protecting uninsured depositors following the closures of Silicon Valley Bank and Signature Bank in early 2023. Using an assessment base equal to the estimated amount of uninsured deposits above $5 billion at December 31, 2022, the FDIC is expected to collect the special assessment from banks at an annual rate of approximately 13.4 basis points (“bps”) for an anticipated eight quarterly assessment periods, beginning with the first quarterly assessment period of 2024. At December 31, 2023, our estimated impact of the special assessment was approximately $90 million, which we recorded in deposit insurance and regulatory expense during the fourth quarter of 2023.

Capital Planning and Stress Testing

We utilize stress testing as an important mechanism to inform our decisions on the appropriate level of capital, based upon actual and hypothetically stressed economic conditions, which are comparable in severity to the scenarios published by the Federal Reserve Board (“FRB”). Our recent internal stress test included hypothetical scenarios that reflected (1) high inflation, (2) increased losses on commercial loans due to inflation and supply chain disruptions, (3) declining commercial property values, (4) increased losses on consumer loans due to falling home prices, (5) rising unemployment, and (6) other current economic, financial, and social disruptions. The results of our stress test indicated that we would maintain capital ratios in excess of regulatory minimum and capital conservation buffer requirements throughout the nine-quarter horizon for the hypothetical stress test.

Liquidity

We utilize internal liquidity stress tests as a primary tool for establishing and managing liquidity guidelines including, but not limited to, holdings of investment securities and other liquid assets, levels of readily available contingency funding, concentrations of funding sources, and the maturity profile of liabilities. At December 31, 2023, we had sources of liquidity that exceeded our uninsured deposits without the need to sell any investment securities. We continue to actively manage our deposit base and associated deposit costs in response to the higher interest rate environment. For more information about our liquidity profile, see “Liquidity Risk Management” in MD&A on page 67.

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

Financial Privacy and Cybersecurity

The federal legislature and federal banking regulators have implemented laws and rules governing the use of consumer information by banks and other financial institutions, including provisions of the Gramm-Leach-Bliley Act. These laws and rules limit the ability of banks and other financial institutions to disclose nonpublic information about consumers to unaffiliated third parties, require financial institutions to disclose privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to an unaffiliated third party. These laws and regulations also affect how consumer information is transmitted through diversified financial companies and conveyed to outside vendors. In addition, consumers may prevent disclosure of certain information among affiliated companies that is assembled or used to determine eligibility for a product or service, such as that shown on consumer credit reports and asset and income information from applications. Consumers also have the option to direct banks and other financial institutions not to share information about transactions and experiences with affiliated companies for the purpose of marketing products or services. Federal law makes it a criminal offense, except in limited circumstances, to obtain or attempt to obtain customer information of a financial nature by fraudulent or deceptive means.

Federal and state regulators have been increasingly active in implementing privacy and cybersecurity standards and regulations. For example, recently effective SEC rules now require timely disclosure of material cybersecurity incidents and description of cybersecurity risk management, strategy, and governance. Additionally, during the past several years, a growing number of states, including those in which we conduct business, have enacted, or are considering enacting, laws and regulations granting consumers enhanced privacy rights and control over personal information, establishing or modifying data breach notification requirements, and requiring certain financial institutions to implement detailed and prescriptive cybersecurity programs. Data and cybersecurity laws and regulations are evolving rapidly and remain a focus of state and federal regulators.

Other Regulations and Proposals

We are subject to a wide range of other requirements and restrictions contained in both federal and state laws. These regulations and other proposals include, but are not limited to, the following:

•Limitations on dividends payable to shareholders. Our ability to pay dividends on both our common and preferred stock is subject to regulatory restrictions. See Note 15 of the Notes to Consolidated Financial Statements for additional information.

•Safety and soundness standards prescribed in the FDICIA, including standards related to internal controls, information systems, internal audit, loan documentation, credit underwriting, interest rate exposure, asset growth and compensation, as well as other operational and management standards deemed appropriate by the federal banking agencies.

•Requirements for approval of acquisitions and restrictions on other activities. The National Bank Act requires regulatory and shareholder approval of all mergers between a national bank and another national or state bank and does not allow for the direct merger into a national bank of an unaffiliated nonbank. See further discussion in “Risk Factors.” Other laws and regulations governing national banks contain similar provisions concerning acquisitions and activities.

•Limits on interchange fees imposed under the Dodd-Frank Act, including a set of rules requiring that interchange transaction fees for electronic debit transactions be reasonable and proportional to certain costs associated with processing the transactions. In addition, the Federal Reserve has proposed revising Regulation II to lower debit interchange fees by almost 30% and institute a biennial review of the cap without accompanying public comment. If this proposal passes, it could reduce our fee income by approximately $10 million or more per year.

•Limitations on the dollar amount of loans made to a borrower and its affiliates.

•Limitations on transactions with affiliates.

•Restrictions on the nature and amount of any investments and ability to underwrite certain types of securities (e.g., common equity).

•Requirements for opening and closing of branches.

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

•A number of federal and state consumer protection laws, including fair lending and truth in lending requirements, to provide equal access to credit and to protect consumers in credit transactions. In addition, as a bank with $10 billion or more in assets, we are subject to examination and primary enforcement authority with respect to consumer financial laws by the CFPB, which has broad rule making, supervisory, and enforcement powers under various federal consumer financial protection laws. These rules and regulations often have the effect of reducing bank revenues and returns earned by shareholders. As an example, the CFPB recently proposed extending certain truth in lending requirements to overdraft fees and placing other restrictions on various fees routinely charged by banks in exchange for providing financial services to customers.

•Community Reinvestment Act (“CRA”) requirements. The CRA requires banks to help serve the credit needs in their communities, including providing credit to low- and moderate-income individuals. If we fail to adequately serve our communities, penalties may be imposed including denials of applications to add branches, relocate, add subsidiaries and affiliates, and merge with or purchase other financial institutions. Banking agencies recently finalized rules that completely overhaul the evaluation framework used by regulators to assess a bank’s performance under and compliance with these requirements, which may make it more difficult for banks to achieve satisfactory ratings. The potential impact of these new rules on the Bank and the industry as a whole is currently under review.

•Requirements regarding the time, manner, and form of compensation given to key executives and other personnel receiving incentive compensation, including requirements related to the SEC’s 2022 rule on pay versus performance disclosures, and recently finalized rules regarding the clawback of executive pay in certain circumstances involving accounting restatements. These restrictions include documentation and governance, deferral, risk-balancing, and the aforementioned clawback requirements. Any deficiencies in compensation practices may be incorporated into supervisory ratings, which can affect our ability to make acquisitions or engage in certain other activities, or could result in regulatory enforcement actions.

•Anti-money laundering regulations. The Bank Secrecy Act, Title III of the Uniting and Strengthening of America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA Patriot Act”), and other federal laws require financial institutions to assist U.S. government agencies in detecting and preventing money laundering and other illegal acts by maintaining policies, procedures and controls designed to detect and report money laundering, terrorist financing, and other suspicious activity.

•Tax laws of the U.S., its states, and other jurisdictions where we conduct business.

We are also subject to the Sarbanes-Oxley Act of 2002, certain provisions of the Dodd-Frank Act, and other federal and state laws and regulations which address, among other matters, corporate governance, auditing and accounting, internal controls over financial reporting, and enhanced and timely disclosure of corporate information.

Sustainability standards and related concerns, including those related to global climate change, continue to evolve and have become more prominent in recent years. We are closely monitoring developments in standards published by sustainability interest groups and organizations, as well as proposed regulatory initiatives and expectations relating to these issues. Although we believe the way we do business has been and is consistent with many of these standards and expectations, we strive to enhance our business practices by incorporating sustainability recommendations that we believe will benefit our investors, customers, employees, and communities.

In addition to proposed and evolving rulemaking by federal regulators, such as the SEC’s proposed rule on climate-related disclosures and the bank regulatory agencies’ recently issued principles designed to provide a framework for large financial institutions to manage exposure to climate-related financial risks, many states have adopted, or are considering, laws that address climate and social issues. For example, the state of California recently passed sweeping climate-related disclosure laws that will require large entities doing business in the state, including the Bank, to measure and disclose greenhouse gas emissions and report on their climate-related risks. These laws will increase our compliance costs and may include provisions that conflict with other state and federal regulations, or limit our ability to conduct business in certain jurisdictions. We publish an annual Corporate Responsibility Report that provides a summary of how we address these issues. The report is available on our website.

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

Corporate Governance

Our Board of Directors (“Board”) has overseen management’s establishment of a comprehensive system of corporate governance and risk management practices. This system includes frameworks, policies, and guidelines such as the following:

•Corporate Governance Guidelines;

•A Code of Business Conduct and Ethics for Employees;

•A Director’s Code of Conduct;

•A Risk Management Framework;

•A Related Party Transaction Policy;

•Incentive Compensation Recoupment and Clawback Policies;

•Stock Ownership and Retention Guidelines;

•An Insider Trading Policy; and

•Charters for our Executive, Audit, Risk Oversight, Compensation, and Nominating and Corporate Governance Committees.

More information on our corporate governance practices is available on our website at zionsbancorporation.com. Our website is not part of this Form 10-K.

HUMAN CAPITAL MANAGEMENT

We are proud of our employees who bring their unique, diverse talents to work each day. We are committed to identifying, recognizing, and creating fulfilling opportunities for our employees, and rewarding them for their contributions to our success.

During 2023, we continued to enhance certain benefits for our employees to adapt to the changing practices of the labor market. Recent changes include more flexibility with paid time off, more health care plan alternatives, and greater access to mental health benefits.

We had 9,679 full-time equivalent employees at December 31, 2023. The following schedule presents certain demographic attributes of our workforce as self-identified by our employees:

Schedule 2


	December 31, 2023
	Women	People of Color	Disabled	Veterans
Employee Roles
Management	52%	29%	9%	2%
Non-management	60%	40%	10%	2%
All employees	58%	38%	10%	2%

The following objectives and initiatives are integral to our human capital management efforts:

Cultivating an environment where people are respected and valued, and where individual and cultural differences are embraced

We believe that (1) our performance is stronger when we are able to draw upon the talents and experience of a diverse team of employees, and (2) in-person exchange of ideas and viewpoints, in both formal and informal settings, improves productivity and supports a strong corporate culture while still offering flexibility to balance personal needs.

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

We endeavor to provide opportunities for growth, development, and leadership to every employee. We are committed to continue this focus on ensuring that we have a workplace where all are treated fairly in accordance with their qualifications and abilities, and that the Bank is a place where everyone counts.

We strive to build a workplace where we embrace differences — in points of view and in national origin, language, race, disability, ethnicity, gender, age, religion, sexual orientation, gender identity, socioeconomic status, veteran status, and family structures. Our Everyone Counts Council coordinates the related efforts of our affiliates and enterprise groups, and advises executive management on goals and recommendations for ongoing improvement. Our efforts include employee business forums, mental health initiatives, and a broad range of employee and regional events. Throughout the organization, the employee business forums foster a sense of community and enable greater connectivity and support among employees through meetings and discussions, which are open to all employees and offer networking and connections to the communities in which we operate.

We use analytics, recruiting outreach efforts, and manager training to reach a diverse, qualified group of potential applicants to secure a high-performing workforce drawn from all segments of society. To identify qualified candidates, our recruiting team partners with community organizations, schools, and governmental entities that support marginalized and underserved communities in our footprint. Our annual Corporate Responsibility Report, which is published on our website, highlights several achievements in this area, such as our Banker Development Program, which attracts and advances undergraduates and early career professionals.

Attracting, developing, and retaining talent for long-term success

We are committed to (1) attracting, developing, and retaining the most qualified individuals who reflect the diversity of the available workforce and markets in which we operate, (2) helping our employees grow in their careers, and (3) actively building a pipeline of talent for future leadership opportunities. As we attract and hire talent, we proactively consider the demand for competencies that will be needed within the workforce of the future.

Consistent with our strategic objectives, we invest in training our employees and providing them the tools and resources to build their capabilities. We offer more than 1,500 virtual, in-person, expert-led, and pre-recorded or self-paced learning options for employees to create custom learning plans for personal and professional development. In 2023, we hosted more than 1,000 training experiences to support employees, build new skills, or to assist in career advancement. We offer new manager programs, tuition reimbursement, education sponsorship opportunities, job shadowing, coaching, and formal mentoring programs. Our talent development program and individual development plans focus on education, experience, and exposure to help create well-rounded, highly skilled, and successful employees.

We are also mindful of the continued competition for talent in the labor market. We continue to analyze relevant metrics related to employee recruiting and turnover, which has and will continue to impact wages and flexible work arrangements.

Recognizing, engaging, and rewarding our employees

Our comprehensive rewards and recognition programs are designed to reward high performance, improve retention, and enhance the employee experience through recognition and growth opportunities. We provide meaningful upside opportunities for those who take accountability for business objectives that help us deliver superior results while reducing risk.

We routinely assess pay equity among employees across our organization by analyzing potential disparities in pay based on gender, minority status, and other factors. These actions help us compensate employees fairly. On a biennial basis, we enlist the services of an independent third party to review our pay equity. Results of the most recent review revealed that after adjusting for relevant variables such as education, experience, performance, and geography, there were no meaningful differences in pay levels among men, women, and people of color. We remain committed to fair and equitable compensation for all our employees.

Our employees provide regular feedback through enterprise outreach and engagement forums, which include quarterly leadership calls, biannual employee opinion surveys, and targeted focus groups. These forums for

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

employee input continue to help strengthen working relationships with managers, improve clarity of organizational purpose and goals, and reinforce our Guiding Principles and Code of Business Conduct and Ethics.

We value work-life balance and strive to create a work environment that supports our employees with mental, physical, social, and financial wellness. Some of our key benefits include the following:

•Corporate match for our 401(k) plan of 4.5% of an employee’s salary and incentive compensation;

•Annual profit-sharing contributions;

•Health care plan options including behavioral health, wellness, and autism spectrum disorder services;

•Expanded mental health coverage, including coaching and clinical therapy sessions;

•Preventive prescription drug coverage not subject to deductibles;

•Paid parental leave program;

•Adoption assistance program; and

•Paid time off for various community service activities and other volunteer opportunities.

ITEM 1A. RISK FACTORS

We generate revenue and grow our businesses by taking prudent and appropriately priced and managed risks. These risks are outlined in our Risk Management Framework. Our Board has established an Audit Committee, a Compensation Committee, a Risk Oversight Committee (“ROC”), and appointed an Enterprise Risk Management Committee (“ERMC”) to oversee and implement the Risk Management Framework. The ERMC is comprised of senior management and is chaired by the Chief Risk Officer. These committees monitor the following risk areas: credit risk, interest rate and market risk; liquidity risk; strategic and business risk; operational risk; technology risk; cybersecurity risk; capital/financial reporting risk; legal/compliance risk (including regulatory risk); and reputational risk, as outlined in our risk taxonomy. We have developed policies, procedures, and controls designed to address these risks, but there can be no certainty that our actions will be effective to prevent or limit the effects of these risks on our business or performance. Although not comprehensive, risk factors that are material to us are described below.

CREDIT RISK

Credit quality has adversely affected us in the past and may adversely affect us in the future.

Credit risk is one of our most significant risks. Rising interest rates, increased market volatility, or a decline in the strength of the U.S. economy in general or the local economies in which we conduct operations could result in, among other things, deterioration in credit quality and reduced demand for credit, including a resultant adverse effect on the income from our loan and investment portfolios, an increase in charge-offs, and an increase in the allowance for credit losses (“ACL”).

We have concentration of risk from counterparties and risk in our loan portfolio, including, but not limited to, loans secured by real estate, oil and gas-related lending, and leveraged and enterprise value lending, which may have unique risk characteristics that may adversely affect our results.

Concentrations of risk from counterparties could adversely affect us, and risk across our loan and investment securities portfolios could pose significant additional credit risk to us due to similar exposures between the two asset types. Concentrations with counterparties on derivative or securities financing transactions could pose additional credit risk.

We engage in commercial real estate (“CRE”) term and construction lending, primarily in our Western states footprint. Certain CRE collateral types, particularly office CRE, continue to experience increased vacancy rates, declining property values, and pressures from rising interest rates, which could result in increased delinquencies and defaults. We also engage in oil and gas-related lending, and we provide leveraged and enterprise value loans across our entire footprint. Certain of these loans may be subject to specific risks, including governmental and social responses to environmental issues and climate change, volatility, and potential significant and prolonged declines in

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

collateral-values and activity levels. Any decline in these portfolios could cause increased credit losses and reduced loan demand, which could adversely affect our business and that of our customers. We may have other unidentified risks in our loan portfolio.

Our business is highly correlated to local economic conditions in a specific geographic region of the U.S.

We provide a wide range of banking products and related services through our local management teams and unique brands in Arizona, California, Colorado, Idaho, Nevada, New Mexico, Oregon, Texas, Utah, Washington, and Wyoming. At December 31, 2023, loan balances associated with our banking operations in Utah, Idaho, Texas, and California comprised 77%, 69%, and 70% of the commercial, CRE, and consumer lending portfolios, respectively. As a result of this geographic concentration, our financial performance depends largely upon economic conditions in these market areas. Accordingly, deterioration in economic conditions, including those caused by climate change or natural disasters, may specifically affect these states, and could result in higher credit losses and significantly affect our consolidated operations and financial results.

For information about our lending exposure to various industries and how we manage credit risk, see “Credit Risk Management” in MD&A on page 54.

INTEREST RATE AND MARKET RISK

We could be negatively affected by adverse economic conditions.

Adverse economic conditions pose significant risks to our business, including our loan and investment portfolios, capital levels, results of operations, and financial condition. A slowing economy and uncertainty related to inflationary pressures, including related changes in monetary and fiscal policies and actions, rising interest rates, and decreased values of our fixed-rate assets, can increase these risks and lead to lower demand for loans, higher credit losses, and lower fee income, among other negative effects.

Failure to effectively manage our interest rate risk could adversely affect our results.

Net interest income is the largest component of our revenue. Factors beyond our control can significantly influence the interest rate environment and increase our risk. These factors include changes in the prevailing interest rate environment, competitive pricing pressures for our loans and deposits, adverse shifts in the mix of deposits and other funding sources, and volatile market interest rates resulting from general economic conditions and the policies of governmental and regulatory agencies, in particular the FRB. Most components of our balance sheet are sensitive to rising and falling rates, and mismatches in rate sensitivity between assets and liabilities may result in unanticipated changes in both asset and liability values and related income and expense. Additionally, asset and liability values may be significantly impacted by customer behavior, as customers may choose to withdraw certain deposits or prepay certain loans at any time, which may significantly affect our expected cash flows.

For information about how we manage interest rate risk and market risk, see “Interest Rate and Market Risk Management” in MD&A on page 63.

LIQUIDITY RISK

Changes in levels and sources of liquidity and capital, including the resulting effects of recent events in the banking industry, may limit our operations and potential growth.

Our primary source of liquidity is deposits from our customers, which may be impacted by market-related forces such as increased competition for these deposits and a variety of other factors. Deposits across the banking industry have fluctuated in recent quarters in large part due to the increased interest rate environment and prominent bank closures. We, like many other banks, experienced deposit outflows as customers spread deposits among several different banks to maximize their amount of FDIC insurance, moved deposits to institutions offering higher rates or removed deposits from the U.S. financial system entirely. Since the FDIC insurance limit is not inflation-indexed and has not increased since 2008, the percent of our and other regional bank uninsured deposits has steadily increased, and may continue to increase without additional congressional action to increase the FDIC insurance limits.

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

Although our deposit levels have increased during the latter half of 2023, our cost of funds has also increased, primarily as a result of declining noninterest-bearing deposits, growth in interest-bearing deposits, and a higher interest rate environment. The potential for greater volatility and further increased costs remains, particularly if there is negative news surrounding the banking industry or perceived risks regarding bank safety and soundness. In such an environment, some depositors may be more likely to believe that there is greater safety in maintaining large, uninsured deposits at banks deemed “too big to fail,” which may contribute to further deposit runoff and increased deposit costs of community and regional institutions, including the Bank. If we are unable to continue to fund assets through customer bank deposits or access other funding sources on favorable terms, or if we experience continued increases in borrowing costs or FDIC insurance assessments, or otherwise fail to manage liquidity effectively, our liquidity, operating margins, financial condition, and results of operations may be materially and adversely affected.

The Federal Reserve’s tightened monetary policy has contributed to a decline in the value of our fixed-rate loans and investment securities that are pledged as collateral to support short-term borrowings. Other economic conditions may also affect (or continue to affect) our liquidity and efforts to manage associated risks. The Federal Home Loan Bank (“FHLB”) system and Federal Reserve have been, and continue to be, a significant source of additional liquidity and funding. Changes in FHLB or Federal Reserve funding programs could adversely affect our liquidity and management of associated risks.

We and the holders of our securities could be adversely affected by unfavorable rating actions from rating agencies.

We access capital markets to augment our funding. This access is affected by the ratings assigned to us by rating agencies. The rates we pay on our securities are also influenced by, among other things, the credit ratings that we and our securities receive from recognized rating agencies. Ratings downgrades to us or our securities could increase our costs or otherwise have a negative effect on our liquidity position, financial condition, or the market prices of our securities.

For information about how we manage liquidity risk, including rating agency actions, see “Liquidity Risk Management” in MD&A on page 67.

STRATEGIC AND BUSINESS RISK

Problems encountered by other financial institutions could adversely affect financial markets generally and have indirect adverse effects on us.

The soundness and stability of many financial institutions may be closely interrelated as a result of credit, trading, clearing, or other relationships between the institutions. As a result, concerns about, or a default or threatened default by, one institution could lead to significant market-wide liquidity and credit problems, losses, or defaults by other institutions. This is sometimes referred to as “systemic risk” and may adversely affect financial intermediaries, such as clearing agencies, clearing houses, banks, securities firms, and exchanges, with which we interact on a daily basis, and therefore, could adversely affect us. This phenomenon has been evident in the recent events affecting the banking industry (such as the prominent bank closures), as financial institutions like us have been impacted by concerns regarding the soundness or creditworthiness of other financial institutions or reports of the risk of systemic deterioration in asset classes, such as commercial real estate. This has caused substantial and cascading disruptions within the financial markets and deposits environment, increased expenses, reduced bank fees, and adversely impacted the market price and volatility of our common stock.

We may not be able to hire or retain qualified personnel or effectively promote our corporate culture, and recruiting and compensation costs may increase as a result of changes in the workplace, marketplace, economy, and regulatory environment.

Our ability to execute our strategy, provide services, and remain competitive may suffer if we are unable to recruit or retain qualified people, or if the costs of employee compensation and benefits increase substantially. Bank regulatory agencies have published regulations and guidance that limit the manner and amount of compensation that banking organizations provide to employees. These regulations and guidance may adversely affect our ability to attract and retain key personnel. Some of these limitations may not apply to institutions with which we compete for

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

talent, in particular, as we are more frequently competing for personnel with financial technology providers and other entities that may not have the same limitations on compensation as we do. If we were to suffer such adverse effects with respect to our employees, our business, financial condition and results of operations could be adversely or materially affected.

Our ability to retain talent may also be adversely affected by changes in the economy and workforce trends, priorities, migration, modes of delivery and other considerations, such as the increased ability of employees to work from anywhere in many industries. This growth in remote work and other changing priorities and benefits has led to an increase in compensation and related expenses and workplace challenges, such as fewer opportunities for face-to-face interactions, training and mentoring new employees, promoting a cohesive corporate culture, and increased competition for experienced labor, especially in high-demand and highly skilled categories. Inflationary pressures have also increased our compensation costs and are likely to continue to do so in the future.

We have made, and are continuing to make, significant changes that include, among other things, organizational restructurings, efficiency initiatives, and replacement or upgrades of technology systems to improve our operating efficiency and control environment. The ultimate success and completion of these changes, and their effects on us, may vary significantly from intended results, which could materially adversely affect us.

We continue to invest in a variety of strategic projects designed to improve our products and services and to simplify how we do business. These initiatives and other significant changes continue to be implemented and are in various stages of completion. By their very nature, projections of duration, cost, expected savings, expected efficiencies, and related items are subject to change and significant variability. There can be no certainty that we will achieve the expected benefits or other intended results associated with these projects.

We could be adversely affected by our ability to develop, adopt, implement, and deliver technology advancements.

Our ability to remain competitive is increasingly dependent upon our ability to maintain critical technological capabilities, and to identify and develop new, value-added products for existing and future customers. These technological competitive pressures arise from both traditional banking and nontraditional sources. Larger banks may have greater resources and economies of scale attendant to maintaining existing capabilities and developing digital and other technologies. Fintechs and other technology platform companies continue to emerge and compete with traditional financial institutions across a wide variety of products and services. Industry experimentation with, and adoption of, artificial intelligence (“AI”), the expansion of blockchain technologies, and digital currencies, including the potential creation and adoption of central bank digital currencies, present similar risks. Our failure to remain technologically competitive could impede our competitive market position and reduce customer satisfaction, product accessibility, and relevance.

OPERATIONAL RISK

Our operations could be disrupted by the effects of new and ongoing projects and initiatives.

We may encounter significant operational disruptions arising from our numerous projects and initiatives. These may include significant time delays, cost overruns, loss of key people, technological problems, and processing failures. We may also experience operational disruptions due to capacity constraints, service level failures and inadequate performance, and certain replacement costs. Any or all of these issues could result in disruptions to our systems, processes, control environment, procedures, employees, and customers. The ultimate effect of any significant disruption to our business could subject us to additional regulatory scrutiny or expose us to civil litigation and possible financial liability, any of which could materially affect us, including our control environment, operating efficiency, and results of operations.

We could be adversely affected by failure in our internal controls.

Because of their inherent limitations, our internal controls may not prevent or detect the risk of operational failures, misstatements in our financial statements, or capital arising from inadequate or failed internal processes or systems, human errors or misconduct, or other adverse external events. A failure in our internal controls could have a

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

significant negative impact not only on our earnings, but also on the perception that customers, regulators, and investors may have of us and adversely affect our business and our stock price.

We could be adversely affected by internal and external fraud schemes.

Attempts to commit fraud both internally and externally are becoming increasingly more sophisticated and may increase in an adverse economic environment. We have experienced losses in the past as a result of these attempts and schemes and may not be able to identify, prevent, or otherwise mitigate all instances of fraud in the future that have the potential to result in material losses. These attempts may go undetected by the systems and procedures that we have in place to monitor our operations.

Climate-related and other catastrophic events including, but not limited to, hurricanes, tornadoes, earthquakes, fires, floods, prolonged drought, and pandemics may adversely affect us, our customers, and the general economy, financial and capital markets, and specific industries.

The occurrence of pandemics, natural disasters, and other climate-related or catastrophic events could materially and adversely affect our operations and financial results. We have significant operations and customers in Utah, Texas, California, and other regions where natural and other disasters have occurred, and are likely to continue to occur. These regions are known for being vulnerable to natural disasters and other risks, such as hurricanes, tornadoes, earthquakes, fires, floods, prolonged droughts, and other weather-related events, some of which may be exacerbated by climate change and become more frequent and intense. These types of catastrophic events at times have posed physical risks to our property and have disrupted the local economy, our business, and customers, including decreased access to insurance and other services. In addition, catastrophic events occurring in other regions of the world may have an impact on us and our customers.

We use models in the management of the Bank. There is risk that these models are inaccurate in various ways, which may cause us to make suboptimal decisions.

We rely on models in the management of the Bank. For example, we use models to inform our estimate of the allowance for credit losses, to manage interest rate and liquidity risk, to project stress losses in various segments of our loan and investment portfolios, and to project net revenue under stress. Models are inherently imperfect and cannot perfectly predict outcomes. Management decisions that are largely informed by such models, therefore, may be suboptimal. For example, with the recent prominent bank closures during the first half of 2023, customer deposit behavior deviated from modeled behaviors, and as a result, we redeveloped our deposit models, which are currently used by management. For more information about our deposit models, see “Interest Rate and Market Risk Management” in MD&A on page 63.

We outsource various operations to third-party vendors, which could adversely impact our business and operational performance.

We rely on various vendors to perform operational activities to conduct our business. Although there are benefits in entering into these relationships, there are risks associated with such activities. Our operational controls and third-party management programs may not provide adequate oversight and control. Inadequate performance by third parties can adversely affect our ability to deliver products and services to our customers and conduct our business. Replacing or finding alternatives for vendors who do not perform adequately can be difficult and costly, and may also adversely impact our customers and other operations, particularly when circumstances require us to make changes under tight time constraints. Many of our vendors have experienced adverse effects upon their operations, supply chains, personnel, and businesses arising from inflationary pressures, wars and geopolitical conflicts, cyber vulnerabilities, and other events, all of which can impact our operations as well.

For information about how we manage operational risk, see “Operational, Technology, and Cybersecurity Risk Management” in MD&A on page 70.

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

TECHNOLOGY RISK

We could be adversely impacted by system vulnerabilities, failures, or outages impacting operations and customer services such as online and mobile banking.

We rely on various information technology systems that work together in supporting internal operations and customer services. Vulnerabilities in, or a failure or outage of, one or many of these systems could impact the ability to perform internal operations and provide services to customers, such as online banking, mobile banking, remote deposit capture, treasury and payment services, and other services dependent on system processing. These risks increase as systems and software approach the end of their useful life or require more frequent updates and modifications. We cannot guarantee that such occurrences will not have a significant operational or customer impact.

For information regarding risks associated with the replacement or upgrades of our core technology systems, see “Strategic and Business Risk” in Risk Factors on page 16. For information about how we manage technology risk, see “Operational, Technology, and Cybersecurity Risk Management” in MD&A on page 70.

CYBERSECURITY RISK

We are subject to a variety of information system failure and cybersecurity risks that could adversely affect our business and financial performance.

We rely heavily on communications and information systems to conduct our business. We process and maintain on our systems certain information that is confidential, proprietary, personal, or otherwise sensitive, including financial and other confidential business information. We, our customers, and other financial institutions with which we interact, are subject to ongoing, continuous attempts by threat actors, such as organized cybercrime, hackers, and state-sponsored organizations to penetrate key systems. Information security risks for us and other large financial institutions have increased significantly in recent years, in part because of the proliferation of new technologies, the ubiquity of internet connections, and the increased sophistication and activities of threat actors. The types of attacks these threat actors may use include, but are not limited to: exploiting customer or system vulnerabilities or misconfigurations, deceiving employees through email phishing or social engineering, and compromising any of our suppliers.

Third parties, including our suppliers and their subcontractors, also present operational and information security risks to us, including security incidents or failures of their own systems and downstream systems. In incidents involving third parties, we may not be informed promptly of any effect on our services or our data, or be able to participate in any related investigation, notification, or remediation that occurs. The possibility of third-party or employee error, failure to follow security procedures, or malfeasance also presents these risks.

As cybersecurity threats continue to evolve, we will be required to expend additional resources to continue to modify or enhance our defenses or to investigate or remediate any information security vulnerabilities. We, and our third-party suppliers, have experienced cybersecurity incidents in the past that have not had material impact to our data, customers, or operations, but there can be no assurance that any such failure, interruption, or significant security breach will not occur in the future, or, if any future occurrences will be adequately addressed. It is impossible to determine the severity or potential effects of these incidents with any certainty.

System enhancements and updates may also create risks associated with implementing new systems and integrating them with existing ones. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our defenses itself can create a risk of systems disruptions and security issues. We may face additional risks to the extent our hardware and software providers are unable to deliver patches and updates to mitigate vulnerabilities or we are unable to implement patches in a timely manner, particularly when a vulnerability is being actively exploited by threat actors. We have devoted and will continue to devote significant resources to the security of our computer systems, but they may still be vulnerable to these threats and our efforts may subsequently be deemed to have been inadequate by regulators or courts. The occurrence of any failure, interruption or security incident to our information systems or those of our third-party suppliers could interfere with or disrupt our

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

operations and services, damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny, expose us to civil litigation and financial liability, or otherwise result in material adverse consequences on us.

For information about how we manage cybersecurity risk, see Part I, Item 1C. Cybersecurity on page 24.

CAPITAL/FINANCIAL REPORTING RISK

Internal stress testing and capital management, as well as provisions of the National Bank Act and OCC regulations, may limit our ability to increase dividends, repurchase shares of our stock, and access the capital markets.

We utilize stress testing as an important mechanism to inform our decisions on the appropriate level of capital, based upon actual and hypothetically stressed economic conditions. The stress testing and other applicable regulatory requirements may, among other things, require us to increase our capital levels, limit our dividends or other capital distributions to shareholders, modify our business strategies, or decrease our exposure to various asset classes. Under the National Bank Act and OCC regulations, certain capital transactions, including share repurchases, are subject to the approval of the OCC. These requirements may limit our ability to respond to and take advantage of market developments.

Regulatory requirements, economic and other circumstances may require us to raise capital at times or in amounts that are unfavorable to us.

We maintain certain risk-based and leverage capital ratios, as required by our banking regulators, which can change depending upon general economic conditions, as well as the particular conditions, risk profiles, and our growth plans. Compliance with capital requirements may limit our ability to expand and has required, and may require, us to raise additional capital or retain earnings that could otherwise be distributed to shareholders. These uncertainties and risks, including those created by legislative and regulatory change and uncertainties, such as recent regulatory proposals that would significantly revise the capital requirements and expand long-term debt requirements applicable to large banking organizations, may increase our cost of capital and other financing costs. For more information about these regulatory proposals, see “Recent Regulatory Developments” in Supervision and Regulation on page 8.

We could be adversely affected by accounting, financial reporting, and regulatory compliance risk.

We are exposed to accounting, financial reporting, and regulatory compliance risk. Significant estimates, judgments, and interpretations of complex and changing accounting and regulatory policies are required to properly account for the products and services we provide to our customers. Changes in our accounting policies or accounting standards could materially affect how we report our financial results and conditions. The level of regulatory compliance oversight continues to be heightened. Identification, interpretation, and implementation of complex and changing accounting standards, as well as compliance with regulatory requirements, pose an ongoing risk.

The value of our goodwill may decline in the future.

If the fair value of a reporting unit is determined to be less than its carrying value, we may have to take a charge related to the impairment of our goodwill. Such a charge could result from, among other factors, weakening in the economic environment, a decline in the performance of the reporting unit, or new legislative or regulatory changes not anticipated in management’s expectations.

We may not be able to fully realize our deferred tax assets, which could adversely affect our operating results and financial performance.

At December 31, 2023, we had a net deferred tax asset of $1.0 billion. The accounting treatment for realization of deferred tax assets is complex and requires judgment. Our ability to fully realize our deferred tax asset could be reduced in the future if our estimates of future taxable income from our operations, future reversals of existing deferred tax liabilities (“DTLs”), or tax planning strategies do not support the realization of our deferred tax asset.

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

Changes in applicable tax laws, regulations, macroeconomic conditions, or market conditions may adversely affect our financial results, and there can be no assurance that we will be able to fully realize our deferred tax assets.

For information about how we manage capital, see “Capital Management” in MD&A on page 72.

LEGAL/COMPLIANCE RISK

Laws and regulations applicable to us and the financial services industry impose significant limitations on our business activities and subject us to increased regulation and additional costs.

We, and the entire financial services industry, have incurred, and will continue to incur, substantial costs related to personnel, systems, consulting, and other activities in order to comply with banking regulations. See “Supervision and Regulation” on page 7 for further information about the regulations applicable to us and the financial services industry generally.

Regulators, the U.S. Congress, state legislatures, and other governing or consultative bodies continue to enact rules, laws, and policies to regulate the financial services industry and public companies, including laws that are designed to promote, protect, or penalize certain activities or industries and their access to financial services. We are, and may in the future become, subject to these laws by offering our products and services to certain industries or in certain locations. The nature of these laws and regulations and their effect on our future business and performance cannot be predicted.

There can be no assurance that any or all of these regulatory changes or actions will ultimately be enacted. However, if enacted, some of these proposals could adversely affect us by, among other things: impacting after-tax returns earned by financial services firms in general; limiting our ability to grow; increasing FDIC insurance assessments, taxes or fees on our funding or activities; limiting the range of products and services that we could offer; and requiring us to raise capital at inopportune times.

Political developments may also result in substantial changes in tax, international trade, immigration, and other policies. The extent and timing of any such changes are uncertain, as are the potential direct and indirect impacts, whether beneficial or adverse. Regulations and laws may be modified or repealed, and new legislation may be enacted that will affect us and our subsidiaries. The ultimate impact of these proposals cannot be predicted as it is unclear which, if any, may be enacted.

Tax laws, regulations, and case law may change due to legislative, administrative, and judicial changes that could adversely impact our business and financial performance.

We are subject to the income tax laws of the U.S., its states, and other jurisdictions where we conduct business. These laws are complex and subject to different interpretations by the taxpayer and the various taxing authorities. In determining the provision for income taxes, management makes judgments and estimates about the application of these inherently complex laws, related regulations, and case law. In the process of preparing our tax returns, management attempts to make reasonable interpretations of the tax laws. These interpretations are subject to challenge by the tax authorities upon audit or to reinterpretation based on management’s ongoing assessment of facts and evolving case law. Changes in tax laws, regulations, or case law may result in an adverse impact to our effective tax rate, tax obligations, and financial results. Additionally, challenges made by tax authorities during an audit may result in adjustments to our tax return filings, resulting in similar adverse impacts to our financial position.

We could be adversely affected by legal and governmental proceedings.

We are subject to risks associated with legal claims, litigation, and regulatory and other government proceedings. Our exposure to these proceedings may increase as a result of stresses on customers, counterparties, and others arising from the past or current economic environments, more frequent claims and actions resulting from fraud schemes perpetrated by or involving our customers, new regulations promulgated under recently enacted statutes, the creation of new examination and enforcement bodies, and enforcement and legal actions against banking organizations. Any such matters may result in material adverse consequences to our results of operations, financial

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

condition or ability to conduct our business, including adverse judgments, settlements, fines, penalties (e.g., civil money penalties under applicable banking laws), injunctions, restrictions on our business activities, or other relief. We maintain insurance coverage to mitigate the financial risk of defense costs, settlements, and awards, but the coverage is subject to deductibles and limits of coverage. Our involvement in any such matters, even if the matters are ultimately determined in our favor, could also cause significant harm to our reputation and divert management attention from the operation of our business. In general, the amounts paid by financial institutions in settlement of proceedings or investigations, have been increasing dramatically. This has affected and will continue to adversely affect (1) our ability to obtain insurance coverage for certain claims, (2) our deductible levels, and (3) the cost of premiums associated with our coverage. Consequently, our financial results are subject to greater risk of adverse outcomes from legal claims.

Due to the difficulty in predicting the timing of, and damages or penalties associated with, the resolution of legal claims, it is possible that adverse financial impacts from litigation could occur sporadically and could be significant. In addition, any enforcement matters could impact our supervisory and CRA ratings, which may restrict or limit our activities.

The corporate and securities laws applicable to us are not as well-developed as those applicable to a state-chartered corporation, which may impact our ability to effect corporate transactions in an efficient and optimal manner.

Our corporate affairs are governed by the National Bank Act, and related regulations are administered by the OCC. As to securities laws, the OCC maintains its own securities offering framework applicable to national banks and their securities offerings, and our compliance with the Exchange Act is governed and enforced by the OCC.

State corporate codes, including that of Utah, are widely recognized, updated by legislative action from time-to-time, and may be based on and influenced by model statutes. The federal securities law regime established by the Securities Act and the Exchange Act and the SEC’s extensive and well-developed framework thereunder are widely used by public companies. The OCC’s statutory and regulatory frameworks have been used by publicly traded banking organizations relatively rarely and are not as well-developed as the corporate and securities law frameworks applicable to other public corporations. While certain specific risks associated with operating under these frameworks are described below, unless and until these frameworks are further developed and established over time, the uncertainty of how these frameworks might apply to any given corporate or securities matters may prevent us from effecting transactions in an efficient and optimal manner or perhaps at all.

Differences between the National Bank Act and state law requirements regarding mergers could hinder our ability to execute acquisitions as efficiently and advantageously as bank holding companies or other financial institutions.

Unlike state corporate law, the National Bank Act requires shareholder approval of all mergers between a national bank and another national or state bank and does not allow for exceptions in the case of various “minor” mergers, such as a parent company’s merger with a subsidiary or an acquirer’s merger with an unaffiliated entity in which the shares issued by the acquirer do not exceed a designated percentage. The National Bank Act and related regulations may also complicate the structuring of certain nonbank acquisitions.

These differences could adversely affect the ability of the Bank and other banks registered under the National Bank Act to efficiently consummate acquisition transactions. In addition, such differences could make us less competitive as a potential acquirer in certain circumstances given that our acquisition proposal may be conditioned on shareholder approval while our competitors’ proposals will not have such a condition.

We are subject to restrictions on permissible activities that would limit the types of business we may conduct and that may make acquisitions of other financial companies more challenging.

Under applicable laws and regulations, bank holding companies and banks are generally limited to business activities and investments that are related to banking or are financial in nature. The range of permissible financial activities is set forth in the Gramm-Leach-Bliley Act and is more limited for banks than for bank holding company organizations. The differences relate mainly to insurance underwriting (but not insurance agency activities) and

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

merchant banking (but not broker-dealer and investment advisory activities). The fact that we do not have a bank holding company could make future acquisitions of financial institutions with such operations more challenging.

REPUTATIONAL RISK

We are presented with various reputational risk issues that could stem from operational, regulatory, compliance, and legal risks.

Any of the aforementioned risks may give rise to adverse publicity and other expressions of negative public opinion, increased regulatory scrutiny, and damaged relationships among other reputational risks.

OTHER RISKS

The Russian invasion of Ukraine, the conflicts in the Middle East, other geopolitical conflicts, and retaliatory measures imposed by the U.S. and other countries, including the responses to such measures, may cause significant disruptions to domestic and foreign economies and markets.

The Russia-Ukraine war and the conflicts in the Middle East, along with other geopolitical conflicts, have created new risks for global markets, trade, economic conditions, cybersecurity, and similar concerns. For example, these conflicts could affect the availability and price of commodities and products, adversely affecting supply chains and increasing inflationary pressures; the value of currencies, interest rates, and other components of financial markets; and lead to increased risks of events such as cyberattacks that could result in severe costs and disruptions to governmental entities and companies and their operations. The impact of these conflicts and retaliatory measures is continually evolving and cannot be predicted with certainty. It is likely that these conflicts will continue to affect the global political order and global and domestic markets for a substantial period of time, regardless of when these conflicts end.

While these events have not materially interrupted our operations, these or future developments resulting from these conflicts, such as cyberattacks on the U.S., the Bank, our customers, or our suppliers, could make it difficult to conduct business.

Sustainability-related risk developments could lead or require us to restrict or modify some of our business activities.

Expectations of investors and regulators could, over time, lead us to restrict or modify some of our business practices. In addition, our business practices could be adversely affected by laws and regulations enacted or promulgated by federal, state, and local governments that relate to environmental and social issues. For example, in 2022 and 2023, certain states passed, or considered passing, laws prohibiting financial institutions from restricting the services that they provide to certain types of businesses if the institutions also conduct business with governmental entities in such states. Depending on how these laws are worded and implemented, they could adversely affect our ability to manage risk. These laws and rules related to environmental and social issues may include provisions that conflict with other state and federal regulations and may increase our costs or limit our ability to conduct business in certain jurisdictions.

Heightened regulatory and social focus on climate change may place additional requirements on public companies, including financial institutions, regarding the measurement, management, and disclosure of climate-related risks and associated lending and investment activities. For example, the state of California recently passed sweeping climate-related disclosure laws that will require large entities doing business in the state, including the Bank, to measure and disclose greenhouse gas emissions and report on their climate-related risks. These new laws, which will require initial disclosures as early as 2026, impose disclosure obligations on companies that in certain respects exceed those previously proposed by the SEC. These new laws may result in higher regulatory, compliance, credit, and reputational risks and costs. In addition, the transition to a lower-carbon economy could subject us to other risks, such as through our customers’ exposure to volatility in commodity prices, increased insurance costs or inability to access insurance, and changes in the market for carbon-related products and services.

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

Protracted congressional negotiations and political stalemates in Washington, D.C. regarding government funding and other issues may introduce additional volatility in the U.S. economy including capital and credit markets and the banking industry in particular.

The U.S. government is currently funded through early March 2024 as a result of a series of continuing resolutions that provide short-term appropriations. Democrat and Republican lawmakers are at a stalemate, and efforts to pass spending bills for long-term government funding have been complicated, increasing the risk of an eventual government shutdown. Any such shutdown may result in further U.S. credit rating downgrades or defaults, and may introduce additional volatility in the U.S. economy, including capital and credit markets and the banking industry in particular; cause disruptions in the financial markets; impact interest rates; and result in other potential unforeseen consequences. In any such event, the Bank’s liquidity, operating margins, financial condition, and results of operations may be materially and adversely affected.

ITEM 1B. UNRESOLVED STAFF COMMENTS

There are no unresolved written comments that were received from SEC or OCC staff 180 days or more before the end of our fiscal year relating to our periodic or current reports filed under the Exchange Act.

ITEM 1C. CYBERSECURITY

Cybersecurity risk is the risk of adverse impacts to the confidentiality, integrity, and availability of data owned, stored, or processed by the Bank or the accompanying information systems. The number and sophistication of attempts to disrupt or penetrate our systems, and those of our suppliers — sometimes referred to as hacking, cybersecurity fraud, cyberattacks, or other similar names — continues to grow.

Cybersecurity risk is overseen by the Board and the Bank’s multiple lines of defense, including front-line bankers and operations teams, Enterprise Risk Management (“ERM”), and internal audit. Information security risk is managed in accordance with an established ERM framework, which includes elements such as key risk indicators, enterprise standards, controls, and self-assessments that comply with established ERM policies. These elements are regularly assessed, measured, and reported to Board-level and Bank senior management-level risk committees, and those committees review such reports.

As set forth in its charter, the ROC has the responsibility to review reports from management relating to enterprise-wide risk management efforts, including cybersecurity risks. As part of that oversight, the ROC performs an annual review and approval of information security policies and programs, and receives regular updates on key risk indicators, threat trends, risk remediation activities, and operational events. The ROC periodically provides reports regarding this oversight to the Board. Management uses multiple real-time and interval-based monitoring and reporting mechanisms to detect and respond to cybersecurity incidents. Documented escalation procedures are tested regularly as part of tabletop exercises and other activities and include notification to executive management during qualifying cybersecurity incidents.

Management positions directly responsible for assessing, measuring, and managing cybersecurity risks include the Chief Information Security Officer (“CISO”) and the Chief Technology and Operations Officer (“CTOO”). The current CISO has more than 20 years of technology leadership experience, including a significant period directly leading cybersecurity efforts, and holds multiple industry certifications. The CTOO has more than 25 years of audit, risk, operations, and technology leadership experience, including prior assignments as the Bank’s Chief Audit Executive and Director of Bank Operations. The CISO and CTOO regularly report information about cybersecurity risks to the Board or a committee of the Board.

We engage multiple independent third parties or cyber experts to assess information security programs and practices, including, but not limited to, framework maturity assessments, blind penetration testing, technology health checks, cyber skill and staffing assessments, externally facilitated tabletop exercises, external cyber legal counsel briefings, and strategic assessments. Findings from these assessments are regularly reviewed with management and the ROC. Additionally, we participate in various cybersecurity industry forums and have access to law enforcement analysis regarding current threats.

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

Our supply chain risk management practices include risk assessments of suppliers, including with respect to cybersecurity. We monitor our suppliers using commercially available services that provide real-time security scoring of supplier technology services, threat intelligence, financial intelligence, geopolitical risk intelligence, and other considerations related to cybersecurity. Reviews are also regularly performed to monitor changes in suppliers’ cybersecurity risk posture. Continuous threat intelligence monitoring is also performed to identify potential cybersecurity incidents involving third parties. We strive to negotiate appropriate provisions with respect to cybersecurity in our contracts with suppliers.

When a cybersecurity incident occurs, whether detected internally or from third-party cybersecurity incidents, we evaluate the incident for criticality and potential materiality and disclosure across a range of contributing indicators, including service availability, impact to operations, reputational impact, regulatory and legal considerations, data sensitivity, and direct financial impact. The potential impact of the incident, individually or in aggregate, is evaluated by the CISO continuously across these criteria. We have escalation procedures to notify members of senior and executive management, the Board (or an applicable subset), and regulators in a timely manner based on the criticality and materiality of the cybersecurity incident.

To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. At December 31, 2023, management has assessed known cybersecurity incidents for potential materiality and disclosure using formal documented processes and has determined that there have been no material cybersecurity incidents, individually or in aggregate. We may nevertheless be unsuccessful in the future in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.

For additional discussion regarding cybersecurity risks, see “Cybersecurity Risk” in Risk Factors on page 19.

ITEM 2. PROPERTIES

At December 31, 2023, we operated 407 branches, of which 278 are owned and 129 are leased. We also lease our headquarters in Salt Lake City, Utah. The annual rentals under long-term leases for leased premises are determined under various formulas and factors, including operating costs, maintenance, and taxes. For additional information regarding leases and rental payments, see Note 8 of the Notes to Consolidated Financial Statements.

ITEM 3. LEGAL PROCEEDINGS

The information contained in Note 16 of the Notes to Consolidated Financial Statements is incorporated by reference herein.

ITEM 4. MINE SAFETY DISCLOSURES

None.

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

PART II

ITEM 5. MARKET FOR REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES

PREFERRED STOCK

We have 4.4 million authorized shares of preferred stock without par value and with a liquidation preference of $1,000 per share. As of December 31, 2023, 66,139, 138,390, 98,555, and 136,368 of preferred shares series A, G, I, and J respectively, are outstanding. See Note 14 of the Notes to Consolidated Financial Statements for further information regarding our preferred stock.

COMMON STOCK

Market Information

Our common stock is traded on the National Association of Securities Dealers Automated Quotations (“NASDAQ”) Global Select Market under the symbol “ZION.” The closing price of our common stock on NASDAQ was $38.87 per share on February 5, 2024.

Equity Capital and Dividends

As of February 5, 2024, there were 3,530 shareholders of record of our common stock. In February 2024, the Board declared a dividend of $0.41 per common share payable on February 22, 2024 to shareholders of record at the close of business on February 15, 2024.

Share Repurchases

During the first quarter of 2023, we repurchased 0.9 million common shares outstanding for $50 million at an average price of $52.82 per share. We did not repurchase common shares during the second, third, or fourth quarters of 2023.

In February 2024, the Board approved a plan to repurchase up to $35 million of common shares outstanding during the fiscal year 2024. In February 2024, we repurchased 0.9 million common shares outstanding for $35 million at an average price of $39.32. For more information regarding our common stock activity, see the Consolidated Statement of Changes in Shareholders’ Equity on page 87.

The following schedule summarizes our share repurchases for the year ended December 31, 2023:

Schedule 3

2023 SHARE REPURCHASES


Period	Total number of shares purchased 1	Average price paid per share		Shares purchased as part of publicly announced plans

First quarter	953,080	$	52.82		946,644
Second quarter	—	—			—
Third quarter	—	—			—
October	—	—			—
November	—	—			—
December	18,851	45.59			—
Fourth quarter total	18,851	45.59			—
Total 2023	971,931	$	52.68		946,644

1 Includes common shares acquired in connection with our stock compensation plan. Shares were acquired from employees to pay for their payroll taxes and stock option exercise cost upon the exercise of stock options.

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

Performance Graph

The following stock performance graph compares the five-year cumulative total return of our common stock with the Standard and Poor’s (“S&P”) 500 Index and the Keefe, Bruyette & Woods, Inc. (“KBW”) Regional Bank Index (“KRX”). The KRX is a modified market capitalization-weighted regional bank and thrift stock index developed and published by KBW, a nationally recognized brokerage and investment banking firm specializing in bank stocks. The index is composed of 50 geographically diverse stocks representing regional banks or thrifts. The stock performance graph is based upon an initial investment of $100 on December 31, 2018 and assumes reinvestment of dividends.

PERFORMANCE GRAPH FOR ZIONS BANCORPORATION, N.A.

INDEXED COMPARISON OF 5-YEAR CUMULATIVE TOTAL RETURN


	2018	2019	2020	2021	2022	2023

Zions Bancorporation, N.A.	100.0	131.1	113.8	169.7	127.2	119.0
KRX Regional Bank Index	100.0	123.9	113.1	154.6	143.9	143.3
S&P 500	100.0	131.5	155.7	200.3	164.0	207.0

SECURITIES AUTHORIZED FOR ISSUANCE UNDER EQUITY COMPENSATION PLANS

The information contained in Item 12 of this Form 10-K is incorporated by reference herein.

ITEM 6. RESERVED

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

ITEM 7. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

Key Corporate Objectives

We conduct our operations primarily through seven separately managed and geographically defined affiliates, each with its own local branding and management team. Our affiliate banks are supported by an enterprise operating segment (referred to as the “Other” segment) that provides governance and risk management, allocates capital, establishes strategic objectives, and includes centralized technology, back-office functions, and certain lines of business not operated through our affiliate banks.

We focus our efforts and resources to achieve our strategic growth and profitability objectives. This includes providing high-quality products and services and deepening relationships with our small business, commercial, and consumer customers. Serving as a trusted advisor for our business customers and supporting their operational needs generally affords us a major source of relatively stable deposits.

We strive to achieve balanced growth of customers, pre-provision net revenue (“PPNR”), profitability, and shareholder returns. We focus on five strategic growth areas: small business, commercial, affluent, capital markets, and consumer.

To facilitate the achievement of our growth and profitability objectives, we invest in the following five key areas, referred to as “strategic enablers”:

•People and Empowerment — we invest in training our employees and providing them the tools and resources to build their capabilities;

•Technology — we invest in innovative technologies that will make us more efficient and enable us to remain competitive;

•Operational Excellence — we invest in and support ongoing improvements in how we safely and securely deliver value to our customers;

•Risk Management — we engage in risk management practices to ensure prudent risk-taking and appropriate oversight; and

•Data and Analytics — we invest in relevant enterprise data and analytic tools to support local execution and prudent decision making.

RESULTS OF OPERATIONS

During 2023, the banking industry experienced significant changes in market conditions, including a higher interest rate environment, significant fluctuations in deposit levels, and broad weakness in bank valuations due in large part to several regional banks being closed and placed into receivership with the FDIC. We employed the following strategic actions during the year as a complement to our existing, well-established risk management practices:

•Generated customer deposit growth through a combination of competitive interest rates, customer outreach, and expanded utilization of reciprocal deposit programs in order to increase the availability of FDIC insurance;

•Actively managed the balance sheet through an earning-asset mix change toward higher-yielding loans, while reducing the size of our lower-yielding securities and money market positions;

•Increased total available liquidity sources, which far exceeded our level of uninsured deposits, and included the expanded use of existing collateralized funding lines;

•Actively managed our interest rate and market risk exposures through a rebalancing of our hedges for both available-for-sale (“AFS”) securities and commercial loans;

•Remained committed to controlling expenses, including active personnel management, while continuing to invest in technology;

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

•Maintained strong credit performance, including low net charge-offs; and

•Further strengthened our regulatory capital position through increased retained earnings and suspended share repurchase programs (beginning the second quarter of 2023 through the end of the year).

Our Financial Performance

This section and other sections provide information about our recent financial performance. For more information about our results of operations for 2022 compared with 2021, see the respective sections in MD&A included in our 2022 Form 10-K.

Net Earnings Applicable to Common Shareholders

(in millions)

Diluted EPS

Adjusted PPNR

(in millions)

Efficiency ratio

Our financial performance for 2023 relative to the prior year reflected an increase in deposits, lower net interest income, stabilization of the net interest margin (“NIM”), loan growth, and strong credit quality, as well as higher noninterest expense and provision for credit losses.

•Net interest income decreased $82 million, or 3%, as higher earning asset yields were offset by rising funding costs. The NIM decreased slightly to 3.02%, compared with 3.06%. Net interest income was also impacted by a reduction in interest-earning assets and an increase in interest-bearing liabilities.

◦Average interest-earning assets decreased $1.7 billion, or 2%, driven by declines in average securities and average money market investments, partially offset by an increase in average loans and leases.

◦Total loans and leases increased $2.1 billion, or 4%, primarily due to growth in the consumer 1-4 family residential mortgage, commercial real estate term, and commercial and industrial loan portfolios.

◦Average interest-bearing liabilities increased $9.7 billion, or 23%, primarily due to increases in average interest-bearing deposits and average borrowed funds. These increases were offset by a decrease of $10.2 billion, or 26%, in average noninterest-bearing deposits, as customers migrated to interest-bearing products in response to the higher interest rate environment.

◦Total deposits increased $3.3 billion, or 5%, primarily due to a $12.8 billion increase in interest-bearing deposits, partially offset by a $9.5 billion decrease in noninterest-bearing demand deposits. Customer deposits (excluding brokered deposits) remained relatively stable at $70.5 billion and included approximately $6.8 billion of reciprocal deposit products. The loan-to-deposit ratio remained flat at 77%.

•The provision for credit losses was $132 million in 2023, compared with $122 million in 2022.

Table of Contents

ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

•Customer-related noninterest income increased $6 million, or 1%, primarily due to increases in commercial account fees and wealth management fees, partially offset by a decrease in retail and business banking fees resulting from a change in our overdraft and non-sufficient funds practices effected during the third quarter of 2022. Increases in noncustomer-related noninterest income were due largely to an increase in dividends on FHLB stock, as well as the gain on sale of a bank-owned property in the second quarter of 2023.

•Noninterest expense increased $219 million, or 12%, primarily due to an increase in deposit insurance and regulatory expense, driven largely by a $90 million accrual associated with the FDIC special assessment in the fourth quarter of 2023. Noninterest expense was also impacted by higher salaries and benefits (including severance) and technology, telecom, and information processing expenses.

•Credit quality remained strong, as net loan and lease charge-offs were $36 million, or 0.06% of average loans in 2023, compared with net charge-offs of $39 million, or 0.07% of average loans, in 2022. Classified loans decreased $104 million, or 11%. Nonperforming assets increased $79 million, or 53%, primarily due to one commercial and industrial loan totaling $31 million, and two suburban office commercial real estate loans totaling $46 million.