Table of Contents

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, DC 20549

FORM 10-K

☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended December 31, 2023

OR

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from                     to                    

Commission file number 001-34034

REGIONS FINANCIAL CORPORATION

(Exact name of registrant as specified in its charter)

Delaware	63-0589368
(State or other jurisdiction of incorporation or organization)	(I.R.S. Employer Identification No.)

1900 Fifth Avenue North, Birmingham, Alabama 35203

(Address of principal executive offices)

Registrant’s telephone number, including area code: (800) 734-4667

Securities registered pursuant to Section 12(b) of the Act:

Title of each class	Trading Symbol(s)	Name of each exchange on which registered
Common Stock, $.01 par value	RF	New York Stock Exchange
Depositary Shares, each representing a 1/40th Interest in a Share of
6.375% Fixed-to-Floating Rate Non-Cumulative Perpetual Preferred Stock, Series B	RF PRB	New York Stock Exchange
Depositary Shares, each representing a 1/40th Interest in a Share of
5.700% Fixed-to-Floating Rate Non-Cumulative Perpetual Preferred Stock, Series C	RF PRC	New York Stock Exchange
Depositary Shares, each representing a 1/40th Interest in a Share of
4.45% Non-Cumulative Perpetual Preferred Stock, Series E	RF PRE	New York Stock Exchange

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.    Yes ý   No  ¨

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.    Yes  ¨    No  ý

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes  ý    No  ¨

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes  ý   No  ¨ 

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act. (Check one): Large Accelerated Filer ý Accelerated filer ☐ Non-accelerated filer ☐ Smaller reporting company  ☐  Emerging growth company  ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ¨

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C.7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ¨

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ¨

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes  ☐    No  ý

State the aggregate market value of the voting and non-voting common equity held by non-affiliates computed by reference to the price at which the common equity was last sold, or the average bid and asked price of such common equity, as of the last business day of the registrant’s most recently completed second fiscal quarter.

Common Stock, $.01 par value—$16,319,687,553 as of June 30, 2023.

Indicate the number of shares outstanding of each of the registrant’s classes of common stock, as of the latest practicable date.

Common Stock, $.01 par value—918,864,048 shares issued and outstanding as of February 21, 2024.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the proxy statement for the registrant's 2024 Annual Meeting of Shareholders are incorporated by reference into Part III to the extent described therein.

1

Table of Contents

REGIONS FINANCIAL CORPORATION

FORM 10-K

INDEX

		Page
PART I
Cautionary Note Regarding Forward-Looking Statements and Risk Factor Summary		7
Item 1.	Business	10
Item 1A.	Risk Factors	22
Item 1B.	Unresolved Staff Comments	42
Item 1C.	Cybersecurity	42
Item 2.	Properties	43
Item 3.	Legal Proceedings	43
Item 4.	Mine Safety Disclosures	43
PART II
Item 5.	Market for Registrant's Common Equity, Related shareholder Matters and Issuer Purchases of Equity Securities	45
Item 6.	[Reserved]	46
Item 7.	Management's Discussion and Analysis of Financial Condition and Results of Operations	47
Item 7A.	Quantitative and Qualitative Disclosures about Market Risk	87
Item 8.	Financial Statements and Supplementary Data	88
Item 9.	Changes in and Disagreements with Accountants on Accounting and Financial Disclosure	165
Item 9A.	Controls and Procedures	165
Item 9B.	Other Information	165
Item 9C.	Disclosure Regarding Foreign Jurisdictions that Prevent Inspections	165
PART III
Item 10.	Directors, Executive Officers and Corporate Governance	166
Item 11.	Executive Compensation	166
Item 12.	Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters	166
Item 13.	Certain Relationships and Related Transactions, and Director Independence	166
Item 14.	Principal Accountant Fees and Services	166
PART IV
Item 15.	Exhibits and Financial Statement Schedules	167
Item 16.	Form 10-K Summary	172
SIGNATURES		173

Table of Contents

Glossary of Defined Terms

Agencies - collectively, FNMA, FHLMC, and GNMA.

ACL - Allowance for credit losses.

ALCO - Asset/Liability Management Committee.

Allowance - Allowance for credit losses.

AMLA - Anti-Money Laundering Act of 2020.

AOCI - Accumulated other comprehensive income.

ASU - Accounting Standards Update.

ATM - Automated teller machine.

Bank - Regions Bank.

Basel III - Basel Committee's 2010 Regulatory Capital Framework (Third Accord).

Basel III Endgame - New rules for capital requirements that include broad-based changes to the risk-weighting framework      that were proposed by U.S. federal regulators in 2023.

Basel III Rules - Final capital rules adopting the Basel III capital framework approved by U.S. federal regulators in 2013.

Basel Committee - Basel Committee on Banking Supervision.

BHC - Bank Holding Company.

BHC Act - Bank Holding Company Act of 1956, as amended.

BITS - Technology policy division of the Bank Policy Institute.

Board - The Company’s Board of Directors.

BSBY - Bloomberg Short-Term Bank Yield index.

BTFP - Bank Term Funding Program.

Call Report - Regions Bank's FFIEC 031 filing.

CAP - Customer Assistance Program.

CCAR - Comprehensive Capital Analysis and Review.

CCPA - California Privacy Rights Act of 2018, as amended by the California Privacy Rights Act of 2020.

CECL - Accounting Standards Update 2016-13, Measurement of Credit Losses on Financial Instruments ("Current Expected Credit Losses").

CEO - Chief Executive Officer.

CET1 - Common Equity Tier 1.

CFO - Chief Financial Officer.

CFPB - Consumer Financial Protection Bureau.

CFTC - Commodity Futures Trading Commission

CHR - Compensation and Human Resources.

Company - Regions Financial Corporation and its subsidiaries.

COSO - Committee of Sponsoring Organizations of the Treadway Commission.

COVID-19 - Coronavirus Disease 2019.

CPI- Consumer Price Index.

CPR - Constant (or Conditional) prepayment rate.

CRA - Community Reinvestment Act of 1977.

DEI - Diversity, Equity & Inclusion.

DIF - Deposit Insurance Fund.

Dodd-Frank Act - The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010.

DPD - Days past due.

3

Table of Contents

DUS - Fannie Mae Delegated Underwriting & Servicing.

EAD - Exposure-at-default.

EEO-1 - Equal employment opportunity commission's Standard Form 100 report.

ERMC - Enterprise Risk Management Committee.

ESG - Environmental, Social and Governance.

FASB - Financial Accounting Standards Board.

FCA - Financial Conduct Authority.

FDIA - Federal Deposit Insurance Act, as amended.

FDIC - The Federal Deposit Insurance Corporation.

Federal Reserve - The Board of Governors of the Federal Reserve System.

FFIEC - Federal Financial Institutions Examination Council.

FHA - Federal Housing Administration.

FHC - Financial Holding Company.

FHLB - Federal Home Loan Bank.

FICO - The Financing Corporation, established by the Competitive Equality Banking Act of 1987.

FICO scores - Personal credit scores based on the model introduced by the Fair Isaac Corporation.

FinCEN - the Financial Crimes Enforcement Network.

FINRA - Financial Industry Regulatory Authority.

Fintechs - Financial Technology Companies.

FOMC - Federal Open Market Committee.

FS-ISAC - Financial Services - Information Sharing & Analysis Center.

FTP - Funds Transfer Pricing.

GAAP - Generally Accepted Accounting Principles in the United States.

GDP - Gross domestic product.

GLBA - Gramm-Leach-Bliley Act.

GSE - Government-Sponsored Enterprise.

G-SIB - Globally Systemically Important Bank Holding Company.

HPI - Housing price index.

HUD - U.S. Department of Housing and Urban Development.

HCM - Human Capital Management.

IDI - Insured Depository Institution.

IPO - Initial public offering.

IRA - Individual Retirement Account.

IRS - Internal Revenue Service.

IS Program - Information Security Program.

LCR - Liquidity coverage ratio.

LGD - Loss given default.

LIBOR - London InterBank Offered Rate.

LLC - Limited Liability Company.

LROC - Liquidity Risk Oversight Committee.

LTIP - Long-term incentive plan.

LTV - Loan to value.

4

Table of Contents

MBS - Mortgage-backed securities.

MD&A - Management’s Discussion and Analysis of Financial Condition and Results of Operations.

MSAs - Metropolitan Statistical Areas.

MSR - Mortgage servicing right.

NAV - Net Asset Value.

NIST - National Institute of Standards and Technology.

NSFR - Net stable funding ratio.

NYSE - New York Stock Exchange.

OAS - Option-adjusted spread.

OCC - Office of the Comptroller of the Currency.

OCI - Other comprehensive income.

OFAC - U.S. Treasury Department - Office of Foreign Assets Control.

ORC - Operational Risk Committee.

PCAOB - Public Company Accounting Oversight Board.

PCD - Purchased credit deteriorated.

PD - Probability of default.

R&S - Reasonable and supportable.

REIT - Real estate investment trust.

Regions Securities - Regions Securities LLC.

RETDR - Reasonable expectation of a troubled debt restructuring.

RWAs - Risk-weighted assets.

S&P 500 - a stock market index that measures the stock performance of 500 large companies listed on stock exchanges in the United States.     

SBA - Small Business Administration.

SBIC - Small Business Investment Company.

SCB - Stress Capital Buffer.

SEC - U.S. Securities and Exchange Commission.

SERP - Supplemental Executive Retirement Plan.

SOFR - Secured Overnight Financing Rate.

TAL - Total trading assets and liabilities.

TBA - To Be Announced.

TDR - Troubled debt restructuring.

TOROC - Technology Operations Risk Oversight Committee.

TPRM - Third-Party Risk Management.

TRACE - Trade Reporting and Compliance Engine.

TTC - Through-the-cycle.

U.S. - United States.

USA PATRIOT Act - Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001.                 

U.S. Treasury - The United States Department of the Treasury.

USD - United States dollar.

UTB - Unrecognized tax benefits.

VIE - Variable interest entity.

5

Table of Contents

Visa - The Visa, U.S.A. Inc. card association or its affiliates, collectively.

wSTWF - Weighted short-term wholesale funding.

6

Table of Contents

PART I

Cautionary Note Regarding Forward-Looking Statements and Risk Factor Summary

This Annual Report on Form 10-K, other periodic reports filed by Regions Financial Corporation under the Securities Exchange Act of 1934, as amended, and any other written or oral statements made by us or on our behalf to analysts, investors, the media and others, may include forward-looking statements as defined in the Private Securities Litigation Reform Act of 1995. The terms “Regions,” the “Company,” “we,” “us” and “our” as used herein mean collectively Regions Financial Corporation, a Delaware corporation, together with its subsidiaries when or where appropriate.The words “future,” “anticipates,” “assumes,” “intends,” “plans,” “seeks,” “believes,” “predicts,” “potential,” “objectives,” “estimates,” “expects,” “targets,” “projects,” “outlook,” “forecast,” “would,” “will,” “may,” “might,” “could,” “should,” “can,” and similar terms and expressions often signify forward-looking statements. Forward-looking statements are subject to the risk that the actual effects may differ, possibly materially, from what is reflected in those forward-looking statements due to factors and future developments that are uncertain, unpredictable and in many cases beyond our control. Forward-looking statements are not based on historical information, but rather are related to future operations, strategies, financial results or other developments. Forward-looking statements are based on management’s current expectations as well as certain assumptions and estimates made by, and information available to, management at the time the statements are made. Those statements are based on general assumptions and are subject to various risks, and because they also relate to the future they are likewise subject to inherent uncertainties and other factors that may cause actual results to differ materially from the views, beliefs and projections expressed in such statements. Therefore, we caution you against relying on any of these forward-looking statements. These risks, uncertainties and other factors include, but are not limited to, those described below:

•Current and future economic and market conditions in the United States generally or in the communities we serve (in particular the Southeastern United States), including the effects of possible declines in property values, increases in interest rates and unemployment rates, inflation, financial market disruptions and potential reductions of economic growth, which may adversely affect our lending and other businesses and our financial results and conditions.

•Possible changes in trade, monetary and fiscal policies of, and other activities undertaken by, governments, agencies, central banks and similar organizations, which could have a material adverse effect on our businesses and our financial results and conditions.

•Changes in market interest rates or capital markets could adversely affect our revenue and expense, the value of assets (such as our portfolio of investment securities) and obligations, as well as the availability and cost of capital and liquidity.

•Volatility and uncertainty related to inflation and the effects of inflation, which may lead to increased costs for businesses and consumers and potentially contribute to poor business and economic conditions generally.

•Possible changes in the creditworthiness of customers and the possible impairment of the collectability of loans and leases, including operating leases.

•Changes in the speed of loan prepayments, loan origination and sale volumes, charge-offs, credit loss provisions or actual credit losses where our allowance for credit losses may not be adequate to cover our eventual losses.

•Possible acceleration of prepayments on mortgage-backed securities due to declining interest rates, and the related acceleration of premium amortization on those securities.

•Possible changes in consumer and business spending and saving habits and the related effect on our ability to increase assets and to attract deposits, which could adversely affect our net income.

•Loss of customer checking and savings account deposits as customers pursue other, higher-yield investments, or the need to price interest-bearing deposits higher due to competitive forces. Either of these activities could increase our funding costs.

•Possible downgrades in our credit ratings or outlook could, among other negative impacts, increase the costs of funding from capital markets.

•The loss of value of our investment portfolio could negatively impact market perceptions of us.

•Our ability to manage fluctuations in the value of assets and liabilities and off-balance sheet exposure so as to maintain sufficient capital and liquidity to support our businesses.

•The effects of social media on market perceptions of us and banks generally.

•Market replacement of LIBOR and the related effect on our LIBOR-based financial products and contracts, including, but not limited to, derivative products, debt obligations, deposits, investments, and loans.

•The effects of problems encountered by other financial institutions that adversely affect us or the banking industry generally could require us to change certain business practices, reduce our revenue, impose additional costs on us, or otherwise negatively affect our businesses.

7

Table of Contents

•Volatility in the financial services industry (including failures or rumors of failures of other depository institutions), along with actions taken by governmental agencies to address such turmoil, could affect the ability of depository institutions, including us, to attract and retain depositors and to borrow or raise capital.

•Our ability to effectively compete with other traditional and non-traditional financial services companies, including fintechs, some of which possess greater financial resources than we do or are subject to different regulatory standards than we are.

•Our inability to develop and gain acceptance from current and prospective customers for new products and services and the enhancement of existing products and services to meet customers’ needs and respond to emerging technological trends in a timely manner could have a negative impact on our revenue.

•Our inability to keep pace with technological changes, including those related to the offering of digital banking and financial services, could result in losing business to competitors.

•Our ability to execute on our strategic and operational plans, including our ability to fully realize the financial and nonfinancial benefits relating to our strategic initiatives.

•The risks and uncertainties related to our acquisition or divestiture of businesses and risks related to such acquisitions, including that the expected synergies, cost savings and other financial or other benefits may not be realized within expected timeframes, or might be less than projected; and difficulties in integrating acquired businesses.

•The success of our marketing efforts in attracting and retaining customers.

•Our ability to achieve our expense management initiatives.

•Changes in commodity market prices and conditions could adversely affect the cash flows of our borrowers operating in industries that are impacted by changes in commodity prices (including businesses indirectly impacted by commodities prices such as businesses that transport commodities or manufacture equipment used in the production of commodities), which could impair the ability of those borrowers to service any loans outstanding to them and/or reduce demand for loans in those industries.

•The effects of geopolitical instability, including wars, conflicts, civil unrest, and terrorist attacks and the potential impact, directly or indirectly, on our businesses.

•Fraud, theft or other misconduct conducted by external parties, including our customers and business partners, or by our employees.

•Any inaccurate or incomplete information provided to us by our customers or counterparties.

•Inability of our framework to manage risks associated with our businesses, such as credit risk and operational risk, including third-party vendors and other service providers, which inability could, among other things, result in a breach of operating or security systems as a result of a cyber-attack or similar act or failure to deliver our services effectively.

•Our ability to identify and address operational risks associated with the introduction of or changes to products, services, or delivery platforms.

•Dependence on key suppliers or vendors to obtain equipment and other supplies for our businesses on acceptable terms.

•The inability of our internal controls and procedures to prevent, detect or mitigate any material errors or fraudulent acts.

•Our ability to identify and address cyber-security risks such as data security breaches, malware, ransomware, “denial of service” attacks, “hacking” and identity theft, including account take-overs, a failure of which could disrupt our businesses and result in the disclosure of and/or misuse or misappropriation of confidential or proprietary information, disruption or damage to our systems, increased costs, losses, or adverse effects to our reputation.

•The effects of the failure of any component of our business infrastructure provided by a third party could disrupt our businesses, result in the disclosure of and/or misuse of confidential information or proprietary information, increase our costs, negatively affect our reputation, and cause losses.

•The effects of any developments, changes or actions relating to any litigation or regulatory proceedings brought against us or any of our subsidiaries.

•The costs, including possibly incurring fines, penalties, or other negative effects (including reputational harm) of any adverse judicial, administrative, or arbitral rulings or proceedings, regulatory enforcement actions or other legal actions to which we or any of our subsidiaries are a party, and which may adversely affect our results.

•Changes in laws and regulations affecting our businesses, including legislation and regulations relating to bank products and services, such as changes to debit card interchange fees, special FDIC assessments, any new long-term debt requirements, as well as changes in the enforcement and interpretation of such laws and regulations by applicable governmental and self-regulatory agencies, including as a result of the changes in U.S. presidential administration, control of the U.S. Congress, and

8

Table of Contents

changes in personnel at the bank regulatory agencies, which could require us to change certain business practices, increase compliance risk, reduce our revenue, impose additional costs on us, or otherwise negatively affect our businesses.

•Our capital actions, including dividend payments, common stock repurchases, or redemptions of preferred stock, must not cause us to fall below minimum capital ratio requirements, with applicable buffers taken into account, and must comply with other requirements and restrictions under law or imposed by our regulators, which may impact our ability to return capital to shareholders.

•Our ability to comply with stress testing and capital planning requirements (as part of the CCAR process or otherwise) may continue to require a significant investment of our managerial resources due to the importance of such tests and requirements.

•Our ability to comply with applicable capital and liquidity requirements (including, among other things, the Basel III capital standards), including our ability to generate capital internally or raise capital on favorable terms, and if we fail to meet requirements, our financial condition and market perceptions of us could be negatively impacted.

•Our ability to recruit and retain talented and experienced personnel to assist in the development, management and operation of our products and services may be affected by changes in laws and regulations in effect from time to time.

•Our ability to receive dividends from our subsidiaries, in particular Regions Bank, could affect our liquidity and ability to pay dividends to shareholders.

•Fluctuations in the price of our common stock and inability to complete stock repurchases in the time frame and/or on the terms anticipated.

•The effects of anti-takeover laws and exclusive forum provision in our certificate of incorporation and bylaws.

•The effect of new tax legislation and/or interpretation of existing tax law, which may impact our earnings, capital ratios and our ability to return capital to shareholders.

•Changes in accounting policies or procedures as may be required by the FASB or other regulatory agencies could materially affect our financial statements and how we report those results, and expectations and preliminary analyses relating to how such changes will affect our financial results could prove incorrect.

•Any impairment of our goodwill or other intangibles, any repricing of assets or any adjustment of valuation allowances on our deferred tax assets due to changes in tax law, adverse changes in the economic environment declining operations of the reporting unit or other factors.

•The effects of man-made and natural disasters, including fires, floods, droughts, tornadoes, hurricanes and environmental damage (especially in the Southeastern United States), which may negatively affect our operations and/or our loan portfolios and increase our cost of conducting business. The severity and frequency of future earthquakes, fires, hurricanes, tornadoes, droughts, floods and other weather-related events are difficult to predict and may be exacerbated by global climate change.

•The impact of pandemics on our businesses, operations and financial results and conditions. The duration and severity of any pandemic as well as government actions or other restrictions in connection with such events could disrupt the global economy, adversely affect our capital and liquidity position, impair the ability of borrowers to repay outstanding loans and increase our allowance for credit losses, impair collateral values and result in lost revenue or additional expenses.

•The effects of any damage to our reputation resulting from developments related to any of the items identified above.

•Other risks identified from time to time in reports that we file with the SEC.

You should not place undue reliance on any forward-looking statements, which speak only as of the date made. Factors or events that could cause our actual results to differ may emerge from time to time, and it is not possible to predict all of them. We assume no obligation and do not intend to update or revise any forward-looking statements that are made from time to time, either as a result of future developments, new information or otherwise, except as may be required by law.

9

Table of Contents

Item 1. Business

Regions Financial Corporation is a FHC headquartered in Birmingham, Alabama operating in the South, Midwest and Texas. In addition, Regions operates several offices delivering specialty capabilities in New York, Washington D.C., Chicago and other locations nationwide. Regions provides financial solutions for a wide range of clients including retail and mortgage banking services, commercial banking services and wealth and investment services. Further, Regions and its subsidiaries deliver other financial services capabilities described below. At December 31, 2023, Regions had total consolidated assets of approximately $152.2 billion, total consolidated deposits of approximately $127.8 billion and total consolidated shareholders’ equity of approximately $17.4 billion.

The terms “Regions,” the “Company,” “we,” “us” and “our” as used herein mean collectively Regions Financial Corporation, a Delaware corporation, together with its subsidiaries when or where appropriate. Its principal executive offices are located at 1900 Fifth Avenue North, Birmingham, Alabama 35203, and its telephone number at that address is (800) 734-4667.

Banking Operations

Regions conducts its banking operations through Regions Bank, an Alabama state-chartered commercial bank that is a member of the Federal Reserve System. At December 31, 2023, Regions operated 2,023 ATMs and 1,271 total branch outlets primarily across the South, Midwest and Texas.

The following table reflects the distribution of branch locations in each of the states in which Regions conducts its banking operations.

	Branches
Florida	272
Tennessee	198
Alabama	186
Georgia	117
Mississippi	99
Texas	90
Louisiana	82
Arkansas	57
Missouri	49
Illinois	41
Indiana	40
South Carolina	18
Kentucky	9
North Carolina	7
Iowa	5
Utah	1
Total	1,271

Other Financial Services Operations

In addition to its banking operations, Regions and its subsidiaries deliver specialty capabilities including merger and acquisition advisory services, capital markets solutions, home improvement lending, investment services, equipment financing for commercial clients and small business customers, low income housing tax credit corporate fund syndication and asset management, financing to CRA-qualified customers, investments and insurance products, broker-dealer services to commercial clients, and others.

Supervision and Regulation

We are subject to the extensive regulatory framework applicable to BHCs and their subsidiaries. This framework is intended primarily for the protection of depositors, the FDIC’s DIF and the banking system as a whole, and is not intended for the protection of shareholders or other investors.

Banking and other financial services statutes, regulations and policies are continually under review by United States Congress, state legislatures and federal and state regulatory agencies. In addition to laws and regulations, state and federal bank regulatory agencies may issue policy statements, interpretive letters and similar written guidance applicable to Regions and its subsidiaries. Regions cannot predict future changes in the applicable laws, regulations and regulatory agency policies, including

10

Table of Contents

any changes resulting from changes in the U.S. presidential administration. Yet, such changes may have a material impact on Regions’ business, financial condition or results of operations. We will continue to evaluate the impact of any changes in law and any new regulations promulgated, including changes in regulatory costs and fees, modifications to consumer products or disclosures and the requirements of the enhanced supervision provisions, among others.

The scope of the laws and regulations and the intensity of the supervision to which Regions is subject have increased in recent years, initially in response to the financial crisis, and more recently in light of other factors, including the failure of U.S. depository institutions in the first half of 2023, technological factors, market changes, climate change concerns, as well as increased scrutiny and possible denials of bank mergers and acquisitions by federal banking regulators. Regulatory enforcement and fines have also increased across the banking and financial services sector. Regions expects that its business will remain subject to extensive regulation and supervision.

The descriptions below summarize certain significant federal and state laws to which Regions is subject. These descriptions do not summarize all possible or proposed changes in laws or regulations and are not intended to be a substitute for the related statues or regulatory provisions. Changes in applicable law or regulation, and in their interpretation and application by regulatory agencies and other governmental authorities, cannot be predicted, but may have a material effect on our business, financial condition or results of operations.

Overview

As a BHC, Regions is subject to regulation under the BHC Act and to regulation, examination and supervision by the Federal Reserve. Regions has elected to be treated as an FHC which allows it to engage in a broader range of activities than would otherwise be permissible for a BHC. The BHC Act provides for “umbrella” regulation of FHCs by the Federal Reserve and functional regulation of holding company subsidiaries by applicable regulatory agencies. The BHC Act also requires the Federal Reserve to examine any subsidiary of a BHC, other than a depository institution, engaged in activities permissible for a depository institution. The Federal Reserve is also granted the authority, in certain circumstances, to require reports of, examine and adopt rules applicable to any holding company subsidiary.

Regions Bank is an Alabama state-chartered bank and a member of the Federal Reserve System. Its operations are generally subject to supervision and examination by both the Federal Reserve and the Alabama State Banking Department. Regions Bank is also affected by the actions of the Federal Reserve as it implements monetary policy. As a Federal Reserve System member bank, Regions Bank is required to hold stock in the Federal Reserve Bank of Atlanta in an amount equal to six percent of its capital stock and surplus. Member banks with total assets in excess of $10 billion, including Regions Bank, receive a floating rate dividend tied to 10-year U.S. Treasuries, with the maximum dividend rate capped at six percent.

Regions Bank and its affiliates are also subject to supervision, regulation and examination by the CFPB with respect to consumer protection laws and regulations.

Regions and certain of its subsidiaries and affiliates, including those that engage in derivatives transactions, securities underwriting, market making, brokerage, investment advisory and insurance activities, are subject to other federal and state laws and regulations, as well as supervision and examination by other federal and state regulatory agencies and other regulatory authorities, including the SEC, CFTC, FINRA and the NYSE. Regions Bank is also subject to additional state and federal laws, as well as various compliance regulations, that govern its activities, the investments it makes and the aggregate amount of loans that may be granted to one borrower.

Examinations by Regions’ regulators consider not only compliance with applicable laws, regulations and supervisory policies of the agency, but also capital levels, asset quality, risk management effectiveness, the ability and performance of management and the board of directors, the effectiveness of internal controls, earnings, liquidity, interest rate risk management and various other factors. Following those examinations, Regions and Regions Bank are assigned supervisory ratings. This supervisory framework, including the examination reports and supervisory ratings, which are considered confidential supervisory information, could materially impact the conduct, growth and profitability of Regions’ operations.

Under the Federal Reserve’s Large Financial Institution Rating System, component ratings are assigned for capital planning, liquidity risk management, and governance and controls. To be considered “well managed” under this rating system, a firm must be rated “broadly meets expectations” or “conditionally meets expectations” for each of its three component ratings.

The results of examinations by any of Regions’ federal bank regulators potentially can result in the imposition of significant limitations on Regions’ activities and growth. These regulatory agencies generally have broad enforcement authority and discretion to impose restrictions and limitations on the operations of a regulated entity, including the imposition of substantial monetary penalties and non-monetary requirements against a regulated entity where the relevant agency determines that the operations of the regulated entity or any of its subsidiaries fail to comply with applicable laws or regulations, are conducted in an unsafe or unsound manner or represent an unfair or deceptive act or practice.

Enhanced Prudential Standards and Regulatory Tailoring Rules

As a BHC with over $100 billion in total consolidated assets, we are subject to enhanced prudential standards and capital rules (the “Tailoring Rules”). The Tailoring Rules assign each U.S. BHC with $100 billion or more in total consolidated assets,

11

Table of Contents

as well as its bank subsidiaries, to one of four categories based on its size and five other risk-based indicators: (1) cross-jurisdictional activity, (2) wSTWF, (3) non-bank assets, (4) off-balance sheet exposure and (5) status as a U.S. G-SIB.

Under the Tailoring Rules, Regions and Regions Bank are each subject to Category IV standards, which apply to banking organizations with at least $100 billion in total consolidated assets that do not meet any of the thresholds specified for Categories I through III. Firms subject to Category IV standards are generally subject to the same capital and liquidity requirements as firms with less than $100 billion in total consolidated assets, but are, among other things, subject to certain enhanced prudential standards and also required to monitor and report certain risk-based indicators. Accordingly, under the Tailoring Rules, Category IV firms are, among other things, (1) not subject to LCR or NSFR requirements (or, in certain cases, subject to reduced requirements), (2) remain eligible to opt-out of the requirement to recognize most elements of AOCI in regulatory capital, (3) not subject to company-run capital stress testing requirements, (4) subject to supervisory capital stress testing on a biennial instead of annual basis, (5) subject to requirements to develop and maintain a capital plan on an annual basis and (6) subject to certain liquidity risk management and risk committee requirements.

Permissible Activities under the BHC Act

The BHC Act limits the activities permissible for BHCs to the business of banking, managing or controlling banks and such other activities as the Federal Reserve has determined to be so closely related to banking as to be properly incidental thereto. A BHC electing to be treated as a FHC, like Regions, may also engage in a range of activities that are (i) financial in nature or incidental to such financial activity or (ii) complementary to a financial activity and that do not pose a substantial risk to the safety and soundness of a depository institution or to the financial system generally. These activities include securities dealing, underwriting and market making, insurance underwriting and agency activities, merchant banking and insurance company portfolio investments.

The Federal Reserve has the authority to limit an FHC’s ability to conduct otherwise permissible activities if the FHC or any of its depository institution subsidiaries ceases to meet applicable eligibility requirements. The Federal Reserve may also impose corrective capital and/or managerial requirements on the FHC, and if deficiencies are persistent, may require the company to divest its subsidiary banks or the company may be required to discontinue or divest investments in companies engaged in activities permissible only for a BHC electing to be treated as an FHC. Furthermore, if the Federal Reserve determines that an FHC has not maintained a CRA rating of at least “satisfactory,” the FHC would not be able to commence any new financial activities or acquire a company that engages in such activities, although the FHC would still be allowed to engage in activities closely related to banking and make investments in the ordinary course of conducting banking activities.

The Federal Reserve has the power to order any BHC or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the Federal Reserve has reasonable grounds to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the BHC.

Regulatory Capital Requirements

Regions and Regions Bank are each required to comply with applicable capital adequacy standards established by the Federal Reserve, which are based on the Basel III framework.

The Basel III-based U.S. capital rules, among other things, include both risk-based requirements, which compare three measures of capital to RWAs, as well as leverage requirements, which in the case of Category IV banking organizations such as Regions, consist of the Tier 1 leverage ratio described below.

The capital rules also require firms to maintain a buffer (referred to as the SCB) consisting of solely CET1 capital, in addition to the minimum risk-based requirements. Failure to satisfy the buffer requirement in full results in graduated constraints on capital distributions, including dividends and share repurchases, and discretionary executive compensation. The extent to which capital distributions will be constrained depends on the amount of the shortfall and the institution’s “eligible retained income,” which is defined as the greater of (1) a banking institution’s net income for the four preceding calendar quarters, net of any distributions to shareholders and associated tax effects not already reflected in net income, and (2) the average of a banking institution’s net income over the preceding four quarters. As a Category IV banking organization, Regions’ SCB is determined through the Federal Reserve’s CCAR supervisory stress tests which include analyses using baseline and severely adverse economic and financial scenarios. Regions’ SCB requirement is determined by adding the Federal Reserve’s modeled capital degradation, in the supervisory severely adverse scenario, plus four quarters of planned common stock dividends. As a Category IV banking organization, the capital degradation component of the SCB is calculated every other year, in even-numbered years. During a year in which a Category IV banking organization does not undergo a supervisory stress test, it will receive an updated SCB requirement that reflects its updated planned common stock dividends. A Category IV banking organization is also able to elect to participate in the supervisory stress test in a year in which it would not normally be subject to the supervisory stress test and consequently receive an updated SCB requirement. The SCB is subject to a 2.5 percent floor.

While Regions was not required to participate in 2023 supervisory stress testing, the Company did receive its SCB reflecting planned capital changes including plans to increase its common stock dividend. For the fourth quarter of 2023

12

Table of Contents

through the third quarter of 2024, the SCB continues to be floored at 2.5 percent, the regulatory minimum. For Regions Bank, the buffer requirement is the 2.5 percent SCB.

See Note 12 "Regulatory Capital Requirements and Restrictions" in Item 8. “Financial Statements and Supplementary Data” of this Annual Report on Form 10-K for details on minimum capital ratios and those needed to be well capitalized.

Regions is also subject to rules that provide for simplified capital requirements relating to the threshold deductions for mortgage servicing assets, deferred tax assets arising from temporary differences that a banking organization could not realize through net operating loss carry backs and investments in the capital of unconsolidated financial institutions, as well as the inclusion of minority interests in regulatory capital.

As a Category IV banking organization, Regions must also develop and maintain a capital plan, and must submit the capital plan to the Federal Reserve as part of the CCAR process. The CCAR process is intended to help ensure that BHCs have robust, forward-looking capital planning processes that account for each company’s unique risks and that permit continued operations during times of economic and financial stress. In addition, the Federal Reserve’s capital plan rule relating to the CCAR process provides that a BHC must receive prior approval for any dividend, stock repurchase or other capital distribution if the BHC is required to resubmit its capital plan, subject to an exception for distributions on newly issued capital instruments. Among other circumstances, a BHC may be required to resubmit its capital plan in connection with certain acquisitions or dispositions.

In 2020, the U.S. federal banking agencies published a final rule to delay the estimated impact on regulatory capital stemming from the implementation of CECL. The final rule provides banks the option to delay for two years an estimate of CECL’s effect on regulatory capital, relative to the incurred loss methodology’s effect on regulatory capital, followed by a three-year transition period (five-year transition option). Regions adopted the capital transition relief over the permissible five-year period.

In July 2023, the U.S. banking regulators issued a proposal to revise the risk-based capital standards applicable to Regions, which generally aligns with the global Basel Accord. The proposal would introduce a new measure of risk-weighted assets, which would reflect the proposed new standardized approaches for credit risk, operational risk and credit valuation adjustment risk, as well as a proposed new measure for market risk that would be based on both internal models and standardized supervisory models of market risk. For Category III and IV institutions, this includes removing the AOCI opt-out in calculating regulatory capital. The proposed effective date is July 1, 2025, subject to a three-year transition period ending July 1, 2028, over which the expanded total risk-weighted assets would be phased in. The Company will continue to evaluate this proposal, as well as any potential future changes to the proposal, and the potential impacts on Regions.

In August 2023, the U.S. banking regulators proposed a rule that would require banking organizations with $100 billion or more in total assets to comply with long-term debt requirements and clean holding company requirements that currently apply only to global systemically important banking organizations. This proposal would also impose a long-term debt requirement on certain categories of IDIs, including IDIs with $100 billion or more in total assets, such as Regions Bank. If adopted, this proposal would require the Company and Regions Bank to each maintain a minimum outstanding eligible long-term debt amount of no less than the greatest of (i) 6% of risk-weighted assets, (ii) 2.5% of total leverage exposure and (iii) 3.5% of average total consolidated assets. Regions Bank would be required to issue the minimum amount of eligible long-term debt to the Company, and the Company would be required to issue the minimum amount of eligible long-term debt externally. In addition, if adopted as proposed, the clean holding company requirement would limit or prohibit the Company from entering into certain transactions that could impede its orderly resolution, including, for example, prohibiting the Company from entering into transactions that could spread losses to subsidiaries and third parties, as well as limiting the amount of the Company’s liabilities that are not eligible long-term. This proposal is subject to a comment period. The Company will continue to evaluate this proposal and the potential impacts, if adopted as proposed.

For more information, see the “Regulatory Requirements” section of Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations” of this Annual Report on Form 10-K.

Liquidity Requirements

Under the Tailoring Rules, Category IV firms with less than $50 billion in wSTWF, including Regions and Regions Bank, are not subject to a LCR requirement or any NSFR requirement. However, BHCs that are Category IV firms are subject to minimum monthly liquidity buffers and liquidity stress testing requirements under the Federal Reserve’s enhanced prudential standards. Furthermore, as a Category IV firm, Regions is obligated, at a minimum, to: (i) calculate collateral positions monthly; (ii) establish a more limited set of liquidity risk limits; (iii) monitor elements of intraday liquidity risk exposures; and (iv) report liquidity data on the FR 2052a on a monthly basis.

13

Table of Contents

Resolution Planning

Category IV firms such as Regions are not required to submit 165(d) resolution plans. The FDIC separately requires insured depositary institutions with $100 billion or more in total assets, such as Regions Bank, to submit to the FDIC periodic plans for resolution in the event of the bank’s failure. Regions Bank submitted its most recent resolution plan in November 2022.

In August 2023, the FDIC issued a proposal to amend its rules requiring covered IDIs, including Regions Bank, to periodically submit resolution plans to the FDIC. If adopted as proposed, Regions Bank would be required to submit a full resolution plan to the FDIC every two years and submit an interim supplement in each year that it is not required to submit a full resolution plan. In addition, this proposal would increase the content requirements for plan submissions and introduce a new credibility standard for the FDIC’s evaluation of resolution plans, which would be enforceable against the covered IDIs.

Enforcement Authority

The federal banking agencies have broad authority to issue orders to depository institutions and their holding companies prohibiting activities that constitute violations of law, rule, regulation or administrative order, or that represent unsafe or unsound banking practices, as determined by the federal banking agencies. The federal banking agencies also are empowered to require affirmative actions to correct any violation or practice; issue administrative orders that can be judicially enforced; direct increases in capital; limit dividends and distributions; restrict growth; assess civil money penalties against institutions or individuals who violate any laws, regulations, orders or written agreements with the agencies; order termination of certain activities of holding companies or their non-bank subsidiaries; remove officers and directors; order divestiture of ownership or control of a non-banking subsidiary by a holding company; or terminate deposit insurance and appoint a conservator or receiver.

FDIA and Prompt Corrective Action

The FDIA requires the federal banking agencies to take prompt corrective action in respect of depository institutions that do not meet specified capital requirements. The FDIA establishes five capital categories (“well-capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” and “critically undercapitalized”), and the federal banking agencies must take certain mandatory supervisory actions, and are authorized to take other discretionary actions, with respect to institutions that are undercapitalized, significantly undercapitalized or critically undercapitalized. The severity of these mandatory and discretionary supervisory actions depends upon the capital category in which the institution is placed. Subject to a narrow exception, the FDIA requires the banking regulator to appoint a receiver or conservator for an institution that is critically undercapitalized. As of December 31, 2023, both Regions and Regions Bank were well-capitalized.

An institution that is classified as well-capitalized based on its capital levels may be treated as adequately capitalized, and an institution that is adequately capitalized or undercapitalized based upon its capital levels may be treated as though it were undercapitalized or significantly undercapitalized, respectively, if the appropriate federal banking agency, after notice and opportunity for hearing, determines that an unsafe or unsound condition or an unsafe or unsound practice warrants such treatment.

An institution that is categorized as undercapitalized, significantly undercapitalized or critically undercapitalized is required to submit an acceptable capital restoration plan to its appropriate federal banking regulator. Under the FDIA, in order for the capital restoration plan to be accepted by the appropriate federal banking agency, a BHC must guarantee that a subsidiary depository institution will comply with its capital restoration plan, subject to certain limitations. The BHC must also provide appropriate assurances of performance.

The FDIA requires the various regulatory agencies to prescribe certain non-capital standards for safety and soundness relating generally to operations and management, asset quality and executive compensation and permits regulatory action against a financial institution that does not meet such standards. Regulators also must take into consideration: (i) concentrations of credit risk; (ii) interest rate risk (when the interest rate sensitivity of an institution’s assets does not match the sensitivity of its liabilities or its off-balance sheet position); and (iii) risks from non-traditional activities, as well as an institution’s ability to manage those risks, when determining the adequacy of an institution’s capital. Regulators make this evaluation as a part of their regular examination of the institution’s safety and soundness. Additionally, regulators may choose to examine other factors in order to evaluate the safety and soundness of financial institutions.

Safety and Soundness

The federal banking agencies have adopted a set of guidelines prescribing safety and soundness standards relating to internal controls and information systems, informational security, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth and compensation, fees and benefits. The guidelines prohibit excessive compensation as an unsafe and unsound practice, and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal shareholder.

Properly managing risks is critical to the conduct of safe and sound banking activities and has become even more important as new technologies, product innovation and the size and speed of financial transactions have changed the nature of

14

Table of Contents

banking markets. The agencies have identified a spectrum of risks facing banking institutions including, but not limited to, credit, market, liquidity, operational, legal, compliance and reputational risk. Some of the regulatory pronouncements have focused on operational risk, which arises from the potential that inadequate information systems, operational problems, breaches in internal controls, fraud or unforeseen catastrophes will result in unexpected losses. New products and services, third-party risk management and cybersecurity are critical sources of operational risk that financial institutions are expected to address in the current environment. Regions Bank is expected to have active board and senior management oversight; adequate policies, procedures and limits; adequate risk measurement, monitoring and management information systems; and comprehensive and effective internal controls.

Payment of Dividends

Regions is a legal entity separate and distinct from its banking and other subsidiaries. The principal source of cash flow to us, including cash flow to pay dividends to our shareholders and principal and interest on any of our outstanding debt, is dividends from Regions Bank. There are statutory and regulatory limitations on the payment of dividends by Regions Bank to us, as well as by us to our shareholders.

If, in the opinion of a federal bank regulatory agency, an institution under its jurisdiction is engaged in or is about to engage in an unsafe or unsound practice, such agency may require, after notice and hearing, that such institution cease and desist from such practice. The federal bank regulatory agencies have indicated that paying dividends that deplete an institution’s capital base to an inadequate level would be an unsafe and unsound banking practice. Under the FDIA, an insured institution may not pay a dividend if payment would cause it to become undercapitalized or if it already is undercapitalized. See “Safety and Soundness Standards” above. Moreover, the Federal Reserve and the FDIC have issued policy statements stating that BHCs and insured banks should generally pay dividends only out of current operating earnings.

Payment of Dividends by Regions Bank. Under the Federal Reserve’s Regulation H, Regions Bank may not, without approval of the Federal Reserve, declare or pay a dividend to Regions if the total of all dividends declared in a calendar year exceeds the total of (a) Regions Bank’s net income for that year and (b) its retained net income for the preceding two calendar years, less any required transfers to additional paid-in capital or to a fund for the retirement of preferred stock.

Under Alabama law, Regions Bank may not pay a dividend in excess of 90% of its net earnings unless its surplus is equal to at least 20% of capital. Regions Bank is also required by Alabama law to seek the approval of the Alabama Superintendent of Banking prior to the payment of dividends if the total of all dividends declared by Regions Bank in any calendar year will exceed the total of (a) Regions Bank’s net earnings for that year, plus (b) its retained net earnings for the preceding two years, less any required transfers to surplus. The statute defines net earnings as the remainder of all earnings from current operations plus actual recoveries on loans and investments and other assets, after deducting from the total thereof all current operating expenses, actual losses, accrued dividends on preferred stock, if any, and all federal, state and local taxes. Regions Bank cannot, without approval from the Federal Reserve and the Alabama Superintendent of Banking, declare or pay a dividend to Regions unless Regions Bank is able to satisfy the criteria discussed above.

Payment of Dividends by Regions. Payment of dividends to our shareholders is subject to the oversight of the Federal Reserve. In particular, the dividend policies and share repurchases of a large BHC, such as Regions, are reviewed by the Federal Reserve based on capital plans submitted as part of the CCAR process and may be constrained in certain scenarios. See “Capital Requirements” above.

Support of Subsidiary Banks

Under the Dodd-Frank Act, Regions is expected to act as a source of financial strength to, and to commit resources to support, its subsidiary bank. This support may be required at times when Regions may not be inclined to provide it.

Limits on Exposure to One Borrower and Exposure to Insiders

Alabama banking law imposes limits on the amount of credit a bank can extend to any one person (or group of related persons). For Regions Bank, this limit includes credit exposures arising from loan and equivalent exposure and investment and trading exposure.

Applicable banking laws and regulations also place restrictions on loans by FDIC-insured banks and their affiliates to their directors, executive officers and principal shareholders.

Lending Standards and Guidance

The federal banking agencies have adopted uniform regulations prescribing standards for extensions of credit that are secured by liens or interests in real estate or made for the purpose of financing permanent improvements to real estate. Under these regulations, all IDIs, such as Regions Bank, must adopt and maintain written policies establishing appropriate limits and standards for extensions of credit that are secured by liens or interests in real estate or are made for the purpose of financing permanent improvements to real estate. These policies must establish loan portfolio diversification standards, prudent underwriting standards (including loan-to-value limits) that are clear and measurable, loan administration procedures and

15

Table of Contents

documentation, approval and reporting requirements. The real estate lending policies must reflect consideration of the federal bank regulators’ Interagency Guidelines for Real Estate Lending Policies.

De Novo Branching and De Novo Banks

With the approval of applicable regulators, state banks may establish de novo branches in states other than their home state as if such state was the bank’s home state.

Anti-Tying Provisions

Regions Bank is prohibited from conditioning the availability of any product or service, or varying the price for any product or service, on the requirement that the customer obtain some additional product or service from the bank or any of its affiliates, other than loans, deposits and trust services.

Transactions with Affiliates

Sections 23A and 23B of the Federal Reserve Act and the Federal Reserve’s Regulation W restrict transactions between a bank and its affiliates, including a parent BHC. Regions Bank is subject to these restrictions, which include quantitative and qualitative limits on the amounts and types of transactions that may take place, including extensions of credit to affiliates, investments in the stock or securities of affiliates, purchases of assets from affiliates and certain other transactions with affiliates. These restrictions also require that credit transactions with affiliates be collateralized and that transactions with affiliates be on market terms or better for the bank. Generally, a bank’s covered transactions with any affiliate are limited to 10% of the bank’s capital stock and surplus and covered transactions with all affiliates are limited to 20% of the bank’s capital stock and surplus.

Deposit Insurance

Regions Bank’s deposits are insured by the FDIC up to the applicable limits, which is currently $250,000 per account ownership type. The FDIC imposes a risk-based deposit premium assessment system that determines assessment rates for an IDI based on an assessment rate calculator, which is based on a number of elements to measure the risk each IDI poses to the DIF. The assessment rate is applied to total average assets less tangible equity, as defined under the Dodd-Frank Act. The assessment rate schedule can change from time to time at the discretion of the FDIC, subject to certain limits. Under the current system, premiums are assessed quarterly.

The FDIC, as required under the FDIA, established a plan in September 2020 to restore the DIF reserve ratio to meet or exceed the statutory minimum of 1.35 percent within eight years. This plan did not include an increase in the deposit insurance assessment rate. Based on the FDIC’s recent projections, however, the FDIC determined that the DIF reserve ratio is at risk of not reaching the statutory minimum by the statutory deadline of September 30, 2028 without increasing the deposit insurance assessment rates.

During 2022, the FDIC adopted a final rule to increase initial base deposit insurance assessment rate schedules by 2 basis points, beginning with the first quarterly assessment period of 2023. This rule, combined with other factors influenced by Regions’ financial performance, increased regulatory premiums in 2023. The FDIC also concurrently maintained the Designated Reserve Ratio for the DIF at 2 percent.

In November 2023, the FDIC issued a final rule to implement a special assessment to recoup losses to the DIF associated with bank failures in the first half of 2023. Under the rule, the assessment base for the special assessment is equal to an IDI’s estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion of uninsured deposits. The special assessment for Regions is estimated at approximately $119 million, was recorded in the fourth quarter of 2023 and will be paid in eight quarterly installments beginning in the first quarter of 2024. For more details on the special assessment, see the “Non-Interest Expense” section of Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations” of this Annual Report on Form 10-K.

FDIC Recordkeeping Requirements

As a part of the FDIC Part 370 recordkeeping requirements, Regions is subject to facilitate rapid and accurate payment of FDIC-insured deposits to customers when large IDIs fail. FDIC rules require IDIs with two million or more deposit accounts to maintain complete and accurate data on each depositor's ownership interest by right and capacity and to develop the capability to calculate the insured and uninsured amounts for each deposit owner by ownership right and capacity.

Acquisitions

The BHC Act requires every BHC to obtain the prior approval of the Federal Reserve before: (i) it may acquire direct or indirect ownership or control of any voting shares of any bank or savings and loan association, if after such acquisition, the BHC will directly or indirectly own or control 5% or more of the voting shares of the institution; (ii) it or any of its subsidiaries, other than a bank, may acquire all or substantially all of the assets of any bank or savings and loan association; or (iii) it may merge or consolidate with any other BHC. FHCs must obtain prior approval from the Federal Reserve before acquiring certain

16

Table of Contents

non-bank financial companies with assets exceeding $10 billion. FHCs seeking approval to complete an acquisition must be well-capitalized and well-managed.

The BHC Act further provides that the Federal Reserve may not approve any transaction that would result in a monopoly or would be in furtherance of any combination or conspiracy to monopolize or attempt to monopolize the business of banking in any section of the U.S., or the effect of which may be substantially to lessen competition or to tend to create a monopoly in any section of the country, or that in any other manner would be in restraint of trade, unless the anticompetitive effects of the proposed transaction are clearly outweighed by the public interest in meeting the convenience and needs of the community to be served. The Federal Reserve is also required to consider the financial and managerial resources and future prospects of the BHCs and banks impacted and the convenience and needs of the community to be served. Consideration of financial resources generally focuses on capital adequacy, and the consideration of convenience and needs of the community to be served includes the parties’ performance under the CRA. The Federal Reserve must also take into account the institutions’ effectiveness in combating money laundering. In addition, pursuant to the Dodd-Frank Act, the BHC Act was amended to require the Federal Reserve to, when evaluating a proposed transaction, consider the extent to which the transaction would result in greater or more concentrated risks to the stability of the U.S. banking or financial system.

In July 2021, the Biden Administration issued an executive order on competition, which included provisions relating to bank mergers. These provisions “encourage” the Department of Justice and the federal banking regulators to update guidelines on banking mergers and to provide more scrutiny of bank mergers.

Depositor Preference

Under federal law, claims of depositors and certain claims for both administrative expenses and employee compensation against an insured depository institution would be afforded a priority over other general unsecured claims against such an institution in the “liquidation or other resolution” of such an institution by any receiver.

Volcker Rule

The Dodd-Frank Act prohibits banks and their affiliates from engaging in proprietary trading and investing in, sponsoring and having certain relationships with private funds such as hedge funds or private equity funds that would be considered an investment company for purposes of the Volcker Rule. The compliance requirements under regulations implementing the Volcker Rule are tailored based on the size and scope of trading activities. Because TAL are maintained under $1 billion, Regions is categorized with "limited" TAL and benefits from a presumption of compliance with the Volcker Rule. Regions has put in place the compliance programs required by the Volcker Rule and has either divested or received extensions for any holdings in illiquid funds.

Consumer Protection Laws

We are subject to a number of federal and state consumer protection laws, including laws designed to protect customers and promote lending to various sectors of the economy and population. These laws include, but are not limited to, the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, the Truth in Savings Act, the Electronic Funds Transfer Act, the Consumer Financial Protection Act and their respective state law counterparts.

The CFPB has broad rulemaking, supervisory and enforcement powers under various federal consumer financial protection laws, including the laws referenced above, other fair lending laws and certain other statutes. The CFPB also has examination and primary enforcement authority with respect to consumer financial laws for depository institutions with $10 billion or more in assets, including the authority to prevent unfair, deceptive or abusive practices in connection with the offering of consumer financial products. The CFPB may issue regulations that impact products and services offered by Regions or Regions Bank. The regulations could reduce the fees that Regions receives, alter the way Regions provides its products and services or expose Regions to greater risk of private litigation or regulatory enforcement action.

Privacy and Cybersecurity

We are, or may in the future become, subject to a variety of complex and evolving laws, regulations, rules and standards at the federal, state and local level regarding privacy and cybersecurity. Privacy and cybersecurity are currently areas of considerable legislative and regulatory attention, with new or modified laws, regulations, rules and standards being frequently adopted and potentially subject to divergent interpretation or application in a manner that may create inconsistent or conflicting requirements for businesses. Privacy and cybersecurity laws and regulations often impose strict requirements regarding the collection, storage, handling, use, disclosure, transfer, protection and other processing of personal information, which may have adverse consequences on our business, including incurring significant compliance costs, requiring changes to our business or operations and imposing severe penalties for non-compliance.

For example, at the federal level, the federal banking regulators have adopted certain rules, including pursuant to the GLBA, that limit the ability of banks and other financial institutions to disclose non-public personal information about consumers to third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain non-public personal information to non-affiliated third parties. In addition,

17

Table of Contents

consumers may also prevent disclosure among affiliated companies of certain non-public personal information that is assembled or used to determine eligibility for a product or service, such as that shown on consumer credit reports and application information. Consumers also have the option to direct banks and other financial institutions not to share certain information about transactions and experiences with affiliated companies for the purpose of marketing products or services.

Federal law also requires financial institutions to implement a written information security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the institution and the nature and scope of its activities. The program should be designed to ensure the security and confidentiality of customer information, protect against unanticipated threats or hazards to the security or integrity of such information, and protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. Financial institutions must also conduct ongoing oversight of third-party service providers to ensure they are maintaining appropriate security controls. Financial institutions must report on the institution’s cybersecurity program annually to the board of directors or a committee of the board of directors. The federal banking regulators regularly issue guidance regarding cybersecurity intended to enhance cyber risk management standards among financial institutions. A financial institution is expected to establish multiple lines of defense against security threats and to ensure their risk management processes appropriately address the risk posed by potential threats to the institution. A financial institution’s management is expected to maintain sufficient processes to effectively identify, prevent and detect a cyber-attack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations if a critical service provider of the institution falls victim to cyber-attack. The Regions Information Security Program is designed to reflect the requirements of these regulatory requirements and guidance.

In addition, in the spring of 2022, federal banking regulators have imposed a new cybersecurity-related notification rule that requires banking organizations, including Regions and Regions Bank to notify their primary federal regulator as soon as possible and within 36 hours of incidents that, among other things, have materially disrupted or degraded, or are reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization or impact the stability of the financial sector. The rule also imposes requirements on bank service providers to notify their affected banking organization customers of certain computer-security incidents. Further, in 2023, the SEC issued regulations requiring public companies to disclose certain information regarding material cybersecurity incidents impacting those companies, as well as descriptions about how they manage material cybersecurity risks.

State regulators have also been increasingly active in implementing privacy and cybersecurity laws, regulations, rules and standards. Several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and have provided detailed requirements with respect to these programs, including data encryption requirements. Many states have also implemented or are considering implementing, comprehensive data privacy and cybersecurity laws and regulations, such as the CCPA. In addition, laws in all 50 U.S. states generally require businesses to provide notice under certain circumstances to individuals whose personal information has been disclosed as a result of a data breach. We expect this trend of state-level activity to persist and we are continually monitoring developments in the states in which our customers are located. Moreover, the United States Congress has considered, and is currently considering, various proposals for more comprehensive data privacy and cybersecurity legislation, to which Regions and/or Regions Bank may be subject to if passed.

In October 2023, the CFPB proposed a rule to implement Section 1033 of the Dodd-Frank Act, sometimes referred to as the Dodd-Frank Act's "open banking" provision, which would require certain entities, including Regions and Regions Bank, to comply with an established framework to govern consumer access to electronic financial data. The Company continues to monitor this proposal and evaluate the potential impacts, if adopted as proposed or otherwise, on Regions and Regions Bank.

Community Reinvestment Act

The CRA requires Regions Bank’s primary federal bank regulatory agency, the Federal Reserve, to assess the bank’s record in meeting the credit needs of the communities served by the bank, including low- and moderate-income neighborhoods and persons. Institutions are assigned one of four ratings: “Outstanding,” “Satisfactory,” “Needs to Improve” or “Substantial Noncompliance.” This assessment is considered for any bank that applies to merge or consolidate with or acquire the assets or assume the liabilities of an IDI, or to open or relocate a branch office. The CRA record of each subsidiary bank of a FHC also is assessed by the Federal Reserve in connection with reviewing any proposed acquisition or merger application. Regions Bank’s most recent CRA rating from the Federal Reserve was “Satisfactory.”

In October 2023, the Federal Reserve, FDIC and OCC issued a final rule to amend their regulations implementing the CRA. The rule materially revises the current CRA framework, including the assessments areas in which a bank is evaluated to include activities associated with online and mobile banking, the tests used to evaluate the bank in its assessment areas, new methods of calculating credit for lending, investment and service activities and additional data collection and reporting requirements. The rule is expected to result in a significant increase in the thresholds for large banks to receive “Outstanding” ratings in the future. The rule is expected to take effect on April 1, 2024, with most of the provisions becoming applicable on January 1, 2026. Reporting of the collected data will not be required until 2027.

18

Table of Contents

Compensation Practices

Our compensation practices are subject to oversight by the Federal Reserve. The federal banking regulators have provided guidance designed to ensure that incentive compensation arrangements at banking organizations take into account risk and are consistent with safe and sound practices. The guidance sets forth the following three key principles with respect to incentive compensation arrangements: (i) the arrangements should provide employees with incentives that appropriately balance risk and financial results in a manner that does not encourage employees to expose their organizations to imprudent risk; (ii) the arrangements should be compatible with effective controls and risk management; and (iii) the arrangements should be supported by strong corporate governance. The guidance provides that supervisory findings with respect to incentive compensation will be incorporated, as appropriate, into the organization’s supervisory ratings, which can affect its ability to make acquisitions or perform other actions. The guidance also provides that enforcement actions may be taken against a banking organization if its incentive compensation arrangements or related risk management, control or governance processes pose a risk to the organization’s safety and soundness.

Anti-Money Laundering

A continued focus of governmental policy relating to financial institutions in recent years has been combating money laundering and terrorist financing. Regions Bank is subject to the reporting and recordkeeping requirements of the BSA. The BSA requires financial institutions to, among other things, establish and maintain procedures reasonably designed to assure and monitor compliance with BSA regulatory requirements. The USA PATRIOT Act, which amended the BSA, broadened the application of anti-money laundering regulations to apply to additional types of financial institutions such as broker-dealers and insurance companies, and strengthened the ability of the U.S. Government to help prevent, detect and prosecute international money laundering and the financing of terrorism. The principal provisions of Title III of the USA PATRIOT Act require that regulated financial institutions, including state member banks: (i) establish an anti-money laundering program that includes internal policies, procedures and internal controls, the designation of a chief compliance officer, as well as training and audit components; (ii) comply with regulations regarding the verification of the identity of any person seeking to open an account; (iii) take additional required precautions with non-U.S. owned accounts; and (iv) perform certain due diligence on private bank accounts and due diligence on and verification and certification of money laundering risk for their foreign correspondent banking relationships. The USA PATRIOT Act also requires federal banking regulators to evaluate the effectiveness of an applicant in combating money laundering in determining whether to approve a proposed bank acquisition. A financial institution's failure to comply with the BSA could have serious legal and reputational consequences for the institution. Regions Bank has continued to augment its anti-money laundering compliance program to comply with the BSA and its implementing regulations and will continue to revise and update its anti-money laundering policies, procedures and controls to reflect future regulatory changes. The AMLA, which amends the BSA, was enacted in January 2021. Among other things, the AMLA codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the development of standards by the U.S. Department of the Treasury for evaluating technology and internal processes for BSA compliance; and expands enforcement- and investigation-related authority, including a significant expansion in the available sanctions for certain BSA violations. Many of the statutory provisions in the AMLA will require additional rulemaking, reports and other measures, and the impact of the AMLA will depend on, among other things, implementation guidance.

As required by AMLA, in June 2021, FinCEN, which promulgates the implementing regulations of the USA PATRIOT Act, BSA, and other anti-money laundering legislation, issued the national anti-money laundering and countering the financing of terrorism priorities. The priorities include: corruption, cybercrime, terrorist financing, fraud, transnational crime, drug trafficking, human trafficking and proliferation financing. Banks are not required to implement any immediate changes related to the national priorities to their anti-money laundering compliance programs until FinCEN issues the implementing regulations related to the national priorities. Bank regulators continue to examine financial institutions for anti-money laundering compliance and Regions Bank will continue to monitor and augment, where necessary, our anti-money laundering compliance framework, including the anti-money laundering program, policies and procedures of Regions Bank to ensure that it is commensurate with our risk profile.

Office of Foreign Assets Control Regulation

The U.S. has imposed economic sanctions that affect transactions with designated foreign countries, nationals, organizations, regimes and other entities. In the United States, economic sanctions are administered by OFAC. OFAC publishes lists of specially designated targets, issues regulations and implements executive orders that restrict dealings with certain countries and territories. Territorial sanctions, which target certain countries, regions and territories, take many different forms. Generally, however, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on U.S. persons engaging in financial transactions relating to, making investments in, or providing investment-related advice or assistance to, a sanctioned country; and (ii) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property within U.S. jurisdiction (including property in the possession or control of U.S. persons). OFAC also administers sanctions lists that have various associated prohibitions, including the Specially Designated Nationals and Blocked Persons List. U.S. persons are prohibited

19

Table of Contents

from dealing with Specially Designated Nationals regardless of location, and all assets of Specially Designated Nationals and Blocked Persons are blocked. Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a general or specific license from OFAC. Failure to comply with these sanctions could have serious legal and reputational consequences.

Regulation of Broker Dealers and Investment Advisers

Our subsidiaries, Regions Securities LLC and BlackArch Securities LLC, are registered broker-dealers with the SEC and FINRA, and Regions Investment Management, Inc. and Highland Associates, Inc. are registered investment advisers with the SEC. These subsidiaries are, as a result, subject to regulation and examination by the SEC, FINRA and other self-regulatory organizations. These regulations cover a broad range of issues, including capital requirements; sales and trading practices; use of client funds and securities; the conduct of directors, officers and employees; record-keeping and recording; supervisory procedures to prevent improper trading on material non-public information; qualification and licensing of sales personnel; and limitations on the extension of credit in securities transactions. In addition to federal registration, state securities commissions require the registration of certain broker-dealers and investment advisers.

Competition

All aspects of our business are highly competitive. Our subsidiaries compete with other financial institutions located in the states in which they operate and other adjoining states, as well as large banks in major financial centers and other financial intermediaries, such as savings and loan associations, credit unions, fintechs, finance companies, mutual funds, insurance companies, brokerage and investment banking firms, mortgage companies and financial service operations of major commercial and retail corporations. We expect competition to remain intense among financial services companies. Our success will depend, in part, on market acceptance and regulatory approval of new products and services. Further, despite delays in obtaining regulatory approvals, we expect consolidation in the financial services industry to continue, which may produce larger, better-capitalized and more geographically diverse companies that are capable of offering a wide array of financial products and services at competitive prices. In addition, technology has lowered barriers to entry and made it possible for non-banks to offer traditional bank or bank-like products and services and therefore compete with financial institutions like us in providing electronic, internet-based and mobile phone-based financial solutions. In particular, the activity of fintechs has grown significantly over recent years and is expected to continue to grow. A number of fintechs have applied for, and in some cases been granted, bank or industrial loan charters, while other fintechs have partnered with existing banks to allow them to offer deposit products to their customers. In addition to fintechs, traditional technology companies have begun to make efforts toward providing financial services directly to their customers. Regions provides an array of digital products and services to our customers and we expect a bank’s digital offerings to be a key competitive differentiator. The continued move toward digital banking and financial services, combined with customer expectations regarding digital offerings, will require us to invest greater resources in technological improvements. Customers for banking services and other financial services offered by our subsidiaries are generally influenced by convenience, quality of service, price of service, personal contacts, the quality of the technology that supports the customer experience and availability of products. Although our position varies in different markets, we believe that our affiliates effectively compete with other financial services companies in their relevant market areas.

Human Capital

One pillar of our strategic priorities at Regions is the commitment to “Build the Best Team”. We believe one of the biggest differentiators of our performance is the people we employ. The need to attract, retain and develop the right talent to accomplish our strategic plan is central to our success. As of December 31, 2023, Regions and its subsidiaries had 20,101 full-time equivalent employees supporting our consumer and commercial banking, wealth management and mortgage product and services primarily across the Southeast and Midwest.

Our associate team reflects the diversity of the communities we serve. As of December 31, 2023, approximately 62 percent of our associates were women and approximately 38 percent self-identified as a part of a minority demographic. Because diversity, equity and inclusion are fundamental to our human capital strategy, we believe it is important for our stakeholders to understand our progress, and therefore, we provided additional transparency into our workforce demographics by disclosing 2022 EEO-1 results on our 2022 Workforce Demographics Report available in our online ESG Resource Center.

A strong and impactful human capital program begins at the top. Our Board oversees our corporate strategy and sets the tone for our culture, values and high ethical standards, and through its Committees, holds management accountable for results. The primary committee responsible for the oversight of human capital is the CHR Committee. The CHR Committee strategically meets with subject matter experts regarding talent management and acquisition, succession planning, associate conduct, associate learning and development, diversity, equity, and inclusion, and associate retention. Additionally, on a quarterly basis the CHR Committee reviews the HCM Dashboard which includes a mixture of trending and point-in-time metrics designed to provide information and analysis of workforce demographics; talent acquisition; workforce stability (retention, turnover, etc.); and associate conduct and engagement.

20

Table of Contents

In order to build the best team, it is necessary for us to fill talent needs with qualified, diverse and engaged associates. Key to our success is our internal talent management program which strives to optimally deploy existing talent across Regions by focusing on where our associates excel and helping them find the best roles that maximize their talents, abilities and interests. For those roles which we fill externally, we continually build talent pipelines with an eye toward not only current needs, but also future demands of our business. Regions uses innovative tools and structured processes to achieve our goals including applications and resources designed to reach larger and more diverse audiences. Our recruiting technology is agile, user friendly and allows us to offer to candidates a robust understanding of our needs, requirements and a view of our culture to support the building of a diverse, engaged workforce.

Diversity, equity and inclusion are fundamental to our corporate strategy. Our commitment to DEI starts at the top of our organization, with oversight of our initiatives provided by the CHR Committee. Launched in late 2022, the DEI Executive Council continues to provide input and guidance over the DEI strategic priorities, build traction and support of DEI programs and help garner leader support. The council is comprised of five business leaders and four leaders of strategic enabling functions. It is chaired by Regions’ CEO and co-chaired by the Head of DEI. Additionally, Regions boasts 20 unique DEI networks across the company, strategically placed in various markets. These ‘all-inclusive’ networks ensure that our DEI priorities are cascaded deeper into the organization giving associates the opportunity to voluntarily engage in the work. We monitor our DEI progress through external benchmarking and internal associate engagement surveys and continually implement programs and practices to elevate our progress and commitment.

We also consider it critical to our success to invest in the professional development of all of our associates. We emphasize our commitment to professional development through opportunities such as technical, skills-based, management, and leadership training programs; formal talent and performance management processes; and sustainable career paths. We also aim to prepare our workforce for a rapidly changing environment and understand that reskilling and upskilling are crucial to staying competitive, meeting the needs of the modern workforce, and retaining associates. We have established a customized learning experience platform that provides the tools to measure, build, and communicate skills inside the Company. This tool provides the ability to inventory the skills our associates have, allowing us to target our development efforts on specific areas where elevated skills are needed. Regions also offers a leader and manager development program created to help people managers understand how to evaluate performance by leveraging the power of a strengths-based and engagement-focused workforce and culture. Our partnership with Guild Education Services, an education, skilling and mobility solution provider has allowed us to transition our tuition reimbursement program for associates to a best-in-class tuition assistance program that targets adult learners and provides coaching support and access to a curated catalog from Guild’s Learning Marketplace. Through the Guild program, associates can now pursue a degree or other educational opportunities tuition free while building their career at the same time. By removing barriers and expanding access to education, we are continuing our commitment to Build the Best Team.

Understanding that automation, cognitive technologies and the open talent economy are reshaping the future of work, Regions makes available to technology associates courses on-demand that offer intensive learning in application development, information technology operations, security and technology architecture. This solution also offers professional development for data and business professionals. In addition, almost all associates may access a full suite of courses regardless of whether the application is needed in their current role.

We aim to offer competitive and fair compensation to our associates. Base salaries are established considering market competitive rates for specific roles; additionally, on an individual basis base salaries reflect the experience and performance levels of our associates. We assess the competitiveness of our ranges on an annual basis by benchmarking our rates against those paid by our peers. In addition to base salaries, we promote a robust pay-for-performance philosophy and incentivize a large majority of our associate population with incentive compensation designed to drive strategies, behaviors and business goals within our unique lines of business. Long-term stock-based incentive compensation is also key to the attraction and retention of key talent and is offered thoughtfully to our executive and leadership ranks. We believe tying the interests of our leaders to those of our shareholders creates a strong link to company performance.

As the success of our business is fundamentally connected to the well-being of our associates, we aim to offer a competitive and comprehensive benefits program to support associates throughout all life stages. Our benefits include comprehensive health, life, and disability coverage that are funded in whole or in part by the Company as well as a 401(k) plan with a dollar-for-dollar company match on employee contributions up to 5 percent of pay and a base contribution of 2 percent of pay for all associates who do not participate in our grandfathered pension program. We also offer our associates programs and tools to support their total well-being including a range of flexible work arrangements, generous time-off policies, physical, mental and financial wellness benefits as well as other programs and practices that support associates and their families throughout the full spectrum of their careers and lives.

Available Information

We maintain a website at ir.regions.com. We make available on our website, free of charge, our annual reports on Form 10-K, quarterly reports on Form 10-Q, Form DEF 14A, and current reports on Form 8-K, including exhibits, and amendments to those reports that are filed with or furnished to the SEC pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of

21

Table of Contents

1934. These documents are made available on our website as soon as reasonably practicable after they are electronically filed with or furnished to the SEC. The SEC also maintains an internet site (www.sec.gov) that contains reports, proxy and information statements and other information regarding issuers that file electronically with the SEC, including Regions. Also available on our website are our (i) Corporate Governance Principles, (ii) Code of Business Conduct and Ethics, (iii) Code of Ethics for Senior Financial Officers, (iv) Fair Disclosure Policy, (v) the charters of our Audit Committee, Compensation and Human Resources Committee, Nominating and Corporate Governance Committee, Risk Committee, Technology Committee, and Executive Committee, and (vi) a number of ESG reports and documents. Information included on our website is not incorporated into, or otherwise made a part of, this Annual Report on Form 10-K.

Item 1A. Risk Factors

An investment in the Company involves risks, some of which, including market, credit, technology, strategic, operational, reputational, legal, regulatory and compliance, liquidity, talent management, estimate and assumption and other external risks, could be substantial and is inherent in our business. These risks also include the possibility that the value of the investment could decrease considerably, and dividends or other distributions concerning the investment could be reduced or eliminated. Discussed below are risk factors that could adversely affect our financial results and condition, as well as the value of, and return on investment in the Company.

Risk Factor Summary

Market Risks

•Our businesses have been, and may continue to be, adversely affected by conditions in the financial markets and economic conditions generally.

•Fluctuations in market interest rates, including the level and shape of the yield curve, may adversely affect our performance.

•Transitions away from and the replacement of benchmark rates could adversely impact our business, financial condition and results of operations.

Credit Risks

•If we experience greater credit losses in our loan portfolios than anticipated, our earnings may be materially adversely affected.

•Any future reductions in our credit ratings may increase our funding costs and place limitations on business activities.

•Changes in the soundness of other financial institutions could adversely affect us.

•We may suffer losses if the value of collateral declines in stressed market conditions.

Liquidity Risks

•Ineffective liquidity management could adversely affect our financial results and condition.

•Loss of deposits or a change in deposit mix could increase our funding costs.

•We rely on the mortgage secondary market to manage various risks.

Technology Risks

•We are at risk of a variety of systems failures or errors and cybersecurity incidents that could adversely affect customer experience and our business and financial performance.

•We are subject to complex and evolving laws, regulations, rules, standards and contractual obligations regarding privacy and cybersecurity, which could increase the cost of doing business, compliance risks and potential liability.

•We will continually encounter technological change and must effectively anticipate, develop and implement new technology.

Strategic Risks

•Industry competition may adversely affect our degree of success.

•Our operations are concentrated primarily in the South, Midwest and Texas, and adverse changes in the economic conditions in this region can adversely affect our financial results and condition.

•Weakness in the residential real estate markets could adversely affect our performance.

•Weakness in the commercial real estate markets could adversely affect our performance.

•Risks associated with home equity products where we are in a second lien position could materially adversely affect our performance.

•Weakness in commodity businesses could adversely affect our performance.

•An outbreak or escalation of hostilities between countries or within a country or region could have a material adverse effect on the U.S. economy and on our businesses.

Operational Risks

•We are subject to a variety of operational risks, including the risk of fraud or theft by internal or external parties, which may adversely affect our business and results of operations.

•We rely on other companies to provide key components of our business infrastructure.

•We depend on the accuracy and completeness of information about clients and counterparties.

22

Table of Contents

•We are exposed to risk of environmental liability when we take title to property.

•We can be negatively affected if we fail to identify and address operational risks associated with the introduction of or changes to products, services and delivery platforms.

•Enhanced regulatory and other standards for the oversight of vendors and other service providers can result in higher costs and other potential exposures.

Reputational Risks

•We are subject to environmental, social and governance risks that could adversely affect our business, reputation and the trading price of our common stock.

•Damage to our reputation could significantly harm our businesses.

Legal, Regulatory and Compliance Risks

•We are, and may in the future be, subject to litigation, investigations and governmental proceedings that may result in liabilities adversely affecting our financial condition, business or results of operations or in reputational harm.

•We are subject to extensive governmental regulation, which could have an adverse impact on our operations.

•We are subject to a variety of risks in connection with any sale of loans we may conduct.

•We may be subject to more stringent capital and liquidity requirements.

•Rulemaking changes and regulatory initiatives implemented by the CFPB may result in higher regulatory and compliance costs that may adversely affect our results of operations.

•We may not be able to complete future acquisitions, may not be successful in realizing the benefits of any future acquisitions that are completed or may choose not to pursue acquisition opportunities we might find beneficial.

•Increases in FDIC insurance assessments may adversely affect our earnings.

•Unfavorable results from ongoing stress analyses may adversely affect our ability to retain customers or compete for new business opportunities.

•We are a holding company and depend on our subsidiaries for dividends, distributions and other payments.

•We may not pay dividends on shares of our capital stock.

•Anti-takeover and banking laws and certain agreements and charter provisions may adversely affect share value.

•Our amended and restated bylaws designate (i) the Court of Chancery of the State of Delaware as the sole and exclusive forum for certain types of actions and proceedings that may be initiated by our shareholders and (ii) the federal district courts of the United States as the sole and exclusive forum for any action asserting a cause of action arising under the Securities Act, which could limit our shareholders’ ability to obtain a favorable judicial forum for disputes with our company or our company’s directors, officers or other employees.

•We face substantial legal and operational risks in safeguarding personal information.

•Differences in regulation can affect our ability to compete effectively.

Talent Management Risks

•Our businesses may be adversely affected if we are unable to hire and retain qualified employees.

•Our operations rely on its ability, and the ability of key external parties, to maintain appropriately-staffed workforces, and on the competence, trustworthiness, health and safety of employees.

Estimates and Assumptions Risks

•Our reported financial results depend on management’s selection of accounting methods and certain assumptions and estimates.

•If the models that we use in our business perform poorly or provide inadequate information, our business or results of operations may be adversely affected.

•Changes in our accounting policies or in accounting standards could materially affect how we report our financial results and condition.

•The value of our goodwill and other intangible assets may decline in the future.

Other External Risks

•Our business and financial performance could be adversely affected by a U.S. government debt default or the threat of such a default.

•Weather-related events, pandemics and other natural or man-made disasters could cause a disruption in our operations or lead to other consequences that could adversely impact our financial results and condition. These impacts could be intensified by climate change. Heightening focus on climate change may also carry transition risks that could negatively impact our results of operations and financial condition.

Market Risks

Our businesses have been, and may continue to be, adversely affected by conditions in the financial markets and economic conditions generally.

We provide traditional commercial, retail and mortgage banking services, as well as other financial services including asset management, wealth management, securities brokerage, merger-and-acquisition advisory services and other specialty

23

Table of Contents

financing. All of our businesses are materially affected by conditions in the financial markets and economic conditions generally or specifically in the South, Midwest and Texas, the principal markets in which we conduct business. A worsening of business and economic conditions generally or specifically in the principal markets in which we conduct business could have adverse effects on our business, including the following:

•A decrease in the demand for, or the availability of, loans and other products and services offered by us, including as a result of changing interest rate conditions;

•A decrease in the value of our loans held for sale or other assets secured by consumer or commercial real estate;

•An impairment of certain intangible assets, such as goodwill;

•A decrease in interest income from variable rate loans, due to declines in interest rates;

•An increase in the number of clients and counterparties who become delinquent, file for protection under bankruptcy laws or default on their loans or other obligations to us, which could result in a higher level of nonperforming assets, net charge-offs, provisions for credit losses and valuation adjustments on loans held for sale;

•A decrease in the supply of deposits or the need to price interest-bearing deposits higher due to competitive forces, which could result in substantial increase in cost to retain and service deposits; and

•A change in the pricing or spread environment could adversely impact the yields received on newly originated loans or securities.

In the event of severely adverse business and economic conditions generally or specifically in the principal markets in which we conduct business, there can be no assurance that the federal government and the Federal Reserve would intervene or make adjustments to fiscal or monetary policy that would cause business and economic conditions to improve. If business and economic conditions worsen or volatility increases, our business, financial condition and results of operations could be materially adversely affected.

Volatility and uncertainty related to inflation and the effects of inflation, which has led to increased costs for businesses and consumers and potentially contribute to poor business and economic conditions generally and may enhance or contribute to some of the risks of our business. For example, higher inflation, or volatility and uncertainty related to inflation, could reduce demand for our products, adversely affect the creditworthiness of the Company’s borrowers or result in lower values for our investment securities and other fixed-rate assets. In response to sustained inflationary pressures, the Federal Reserve has tightened monetary policy, as described below. To the extent these policies do not mitigate the volatility and uncertainty related to inflation and the effects of inflation, or to the extent conditions otherwise worsen, we could experience adverse effects on our business, financial condition and results of operations.

Fluctuations in market interest rates, including the level and shape of the yield curve, may adversely affect our performance.

Our profitability depends to a large extent on our net interest income, which is the difference between the interest income received on interest-earning assets (primarily loans, leases, investment securities and cash balances held at the Federal Reserve Bank) and the interest expense incurred in connection with interest-bearing liabilities (primarily deposits and borrowings). The level of net interest income is mostly a function of the average balance of interest-earning assets, the average balance of interest-bearing liabilities and the spread between the yield on such assets and the cost of such liabilities. These factors are influenced by both the pricing and mix of interest-earning assets and interest-bearing liabilities which, in turn, are impacted by external factors such as the local economy, competition for loans and deposits, the monetary policy of the FOMC and interest rates markets.

The cost of our deposits and short-term wholesale borrowings is heavily impacted by market-based liquidity conditions and interest rates, factors which are influenced directly and indirectly by a mixture of effects including the FOMC’s monetary policy and economic conditions. Moreover, the market’s expectation of the future course of FOMC policy and economic factors interact to influence the path for market interest rates and the shape of the yield curve. Yields generated by our loans and securities and the costs of deposits and wholesale borrowings are driven by both short-term and longer-term interest rates to different degrees, thus impacting net interest income. If the yields on our interest-bearing liabilities increase at a faster pace than the yields on our interest-earning assets, our net interest income may decline. Our net interest income could be similarly affected if the yields on our interest-earning assets decline at a faster pace than the yields on our interest-bearing liabilities. Finally, interest rate volatility and levels directly impact the value of certain fixed-rate assets and liabilities, which may impact unrealized gains or unrealized losses in our portfolios.

The monetary policy tightening cycle observed since 2022 has led to increased volatility in fixed income markets. The Federal Reserve increased the benchmark federal funds interest rate from near zero in early 2022 to a range between 5.25 percent and 5.50 percent with the last increase occurring at its July 26, 2023 meeting. The range of potential rate paths over the coming year is wide and will ultimately be driven by the path of inflation, labor market performance and economic growth. Estimates for net interest income exposure to interest rate changes have been reduced recently. While a persistently elevated, or

24

Table of Contents

increasing, rate environment from current levels would continue to support net interest income, elevated rates also increase the cost of funding and competition for deposits. Additionally, elevated interest rates would increase debt service requirements for some of our borrowers and may adversely affect those borrowers’ ability to pay as contractually obligated, ultimately resulting in additional delinquencies or charge-offs. Conversely, should interest rates move lower, net interest income is well supported by a mostly neutral interest rate risk position aided by the Company’s interest rate hedging program. In this environment, deposit and funding costs will move lower; however, net interest income may be adversely impacted if those costs cannot move lower as fast as expected.

Sustained higher interest rates and continued Federal Reserve asset reductions may adversely affect market stability, market liquidity and the Company’s financial performance and condition. We cannot predict the nature or timing of future changes in monetary policies or the precise effects such changes may have on our activities and financial results.

For a more detailed discussion of these risks and our management strategies for these risks, see the “Executive Overview,” “Net Interest Income, Margin and Interest Rate Risk,” “Net Interest Income and Margin,” “Market Risk-Interest Rate Risk” and “Securities” sections of Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations” of this Annual Report on Form 10-K.

Transitions away from and the replacement of benchmark rates could adversely impact our business, financial condition and results of operations.

Certain securities within the investment portfolio, certain hedging transactions and certain of the products that we offer, such as floating-rate loans and mortgages, determine their applicable interest rate or payment amount by reference to a benchmark rate, an index, or other financial metric. LIBOR and certain other benchmark rates have been or currently are the subject of recent national, international, and other regulatory guidance and proposals for reform. All LIBOR settings ceased to be published as of June 30, 2023. Regions has adopted new products linked to alternative reference rates, such as adjustable-rate mortgages, consistent with guidance provided by U.S. regulators, ARRC and GSEs. Additionally, Regions transitioned LIBOR-based products to alternative rates that are consistent with industry standard conventions.

In the fourth quarter of 2023, Bloomberg Index Services Limited announced the permanent cessation of the BSBY index and all tenors effective November 15, 2024. Regions is in the process of evaluating exposure to BSBY and planning for cessation.

For a more detailed discussion of our management strategies related to the LIBOR cessation and transition, see the “LIBOR Transition and Reference Rate Reform” section of Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations” of this Annual Report on Form 10-K.

Credit Risks

If we experience greater credit losses in our loan portfolios than anticipated, our earnings may be materially adversely affected.

As a lender, we are exposed to the risk that our customers will be unable to repay their loans and leases according to their terms and that any collateral securing the payment of their loans and leases may not be sufficient to assure repayment. Credit losses are inherent in the business of making loans and could have a material adverse effect on our operating results.

We make various assumptions and judgments about the collectability of our loan portfolio and provide an allowance for credit losses based on a number of factors. Our management periodically determines the allowance for credit losses based on available information, including the quality of the loan portfolio, the value of the underlying collateral and the level of non-accrual loans, taking into account relevant information about past events, current conditions and reasonable and supportable forecasts of future economic conditions that affect the collectability of our loan portfolio. If, as a result of general economic conditions, there is a decrease in asset quality or growth in the loan portfolio and management determines that additional increases in the allowance for credit losses are necessary, we may incur additional expenses which will reduce our net income, and our business, results of operations or financial condition may be materially adversely affected.

Although our management will establish an allowance for credit losses it believes is appropriate to absorb expected credit losses over the life of loans in our loan portfolio, this allowance may not be adequate. For example, if a hurricane or other natural disaster were to occur in one of our principal markets or if economic conditions in those markets were to deteriorate unexpectedly, additional credit losses not incorporated in the existing allowance for credit losses may occur. Losses in excess of the existing allowance for credit losses will reduce our net income and could adversely affect our business, results of operations or financial condition, perhaps materially.

In addition, bank regulatory agencies will periodically review our allowance for credit losses and the value attributed to non-accrual loans and to real estate acquired through foreclosure. Such regulatory agencies may require us to adjust our determination of the value for these items. These adjustments could materially adversely affect our business, results of operations or financial condition.

25

Table of Contents

Any future reductions in our credit ratings may increase our funding costs and place limitations on business activities.

The major ratings agencies regularly evaluate us, and their ratings are based on a number of factors, including our financial strength and conditions affecting the financial services industry generally. In general, ratings agencies base their ratings on many quantitative and qualitative factors, including capital adequacy, liquidity, asset quality, business mix and level and quality of earnings, and we may not be able to maintain our current credit ratings. The ratings assigned to Regions and Regions Bank remain subject to change at any time, and it is possible that any ratings agency will take action to downgrade Regions, Regions Bank or both in the future. Additionally, ratings agencies may also make substantial changes to their ratings policies and practices, which may affect our credit ratings. In the future, changes to existing ratings guidelines and new ratings guidelines may, among other things, adversely affect the ratings of our securities or other securities in which we have an economic interest.

Our credit ratings can have negative consequences that can impact our ability to access the debt and capital markets, as well as reduce our profitability through increased costs on future debt issuances. If we were to be downgraded below investment grade, we may not be able to reliably access the short-term unsecured funding markets, and certain customers could be prohibited from placing deposits with Regions Bank, which could cause us to hold more cash and liquid investments to meet our ongoing liquidity needs. Such actions could reduce our profitability as these liquid investments earn a lower return than other assets, such as loans. See the “Liquidity” section within “Management’s Discussion and Analysis of Financial Condition and Results of Operations” of this Annual Report on Form 10-K for our liquidity policy.

Additionally, if we were to be downgraded to below investment grade, certain counterparty contracts may be required to be renegotiated or require posting of additional collateral. Refer to Note 20 “Derivative Financial Instruments and Hedging Activities” to the consolidated financial statements of this Annual Report on Form 10-K for the fair value of contracts subject to contingent credit features and the collateral postings associated with such contracts. Although the exact amount of additional collateral is unknown, it is reasonable to conclude that we may be required to post additional collateral related to existing contracts with contingent credit features.

Changes in the soundness of other financial institutions could adversely affect us.

Adverse developments affecting the overall strength and soundness of other financial institutions, the financial services industry as a whole and the general economic climate and the U.S. Treasury market could have a negative impact on perceptions about the strength and soundness of our business even if we are not subject to the same adverse developments. In addition, adverse developments with respect to third parties with whom we have important relationships could also negatively impact perceptions about us. These perceptions about us could cause our business to be negatively affected and exacerbate the other risks that we face.

Regions may be impacted by actual or perceived soundness of other financial institutions, including as a result of the financial or operational failure of a major financial institution, or concerns about the creditworthiness of such a financial institution or its ability to fulfill its obligations, which can cause substantial and cascading disruption within the financial markets and increased expenses, including FDIC insurance premiums, and could affect our ability to attract and retain depositors and to borrow or raise capital. For example, during 2023 the FDIC took control and was appointed receiver of Silicon Valley Bank, Signature Bank and First Republic Bank. The failure of other banks and financial institutions and the measures taken by governments, businesses and other organizations in response to these events could adversely impact Regions’ business, financial condition and results of operations.

Regions’ ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services institutions are interrelated as a result of trading, clearing, counterparty and other relationships. Regions has exposure to many different industries and counterparties and routinely executes transactions with counterparties in the financial industry, including brokers and dealers, central counterparties, commercial banks, investment banks, mutual and hedge funds and other institutional investors and clients. As a result, defaults by, or even rumors or questions about, one or more financial services institutions or the financial services industry generally, in the past have led to market-wide liquidity problems and could lead to losses or defaults by Regions or by other institutions. Many of these transactions expose Regions to credit risk in the event of default of Regions’ counterparty or client. In addition, Regions’ credit risk may be exacerbated when the collateral held by Regions cannot be liquidated or is liquidated at prices not sufficient to recover the full amount of Regions’ exposure. Any such losses could materially and adversely affect Regions’ results of operations and financial condition.

We may suffer losses if the value of collateral declines in stressed market conditions.

During periods of market stress or illiquidity, our credit risk may be further increased when we fail to realize the fair value of the collateral we hold; collateral is liquidated at prices that are not sufficient to recover the full amount owed to us; or counterparties are unable to post collateral, whether for operational or other reasons. Furthermore, disputes with counterparties concerning the valuation of collateral may increase in times of significant market stress, volatility or illiquidity, and we could suffer losses during these periods if we are unable to realize the fair value of collateral or to manage declines in the value of collateral.

26

Table of Contents

Liquidity Risks

Ineffective liquidity management could adversely affect our financial results and condition.

Effective liquidity management is essential for the operation of our business. We require sufficient liquidity to meet customer loan requests, customer deposit maturities/withdrawals, payments on our debt obligations as they come due and other cash commitments under both normal operating conditions and unpredictable circumstances causing industry or general financial market stress. A substantial majority of our assets are loans, which cannot necessarily be called or sold on timeframes short enough to meet these liquidity requirements.

In addition, our access to funding sources in amounts adequate to finance our activities on terms that are acceptable to us could be impaired by factors that affect us specifically or the financial services industry or economy generally. Factors that could detrimentally impact our access to liquidity sources include increases in funding costs, a downturn in the geographic markets in which our loans and operations are concentrated, difficult credit markets or unforeseen outflows of cash or collateral, including as a result of unusual effects in the market. Although we have historically been able to meet the liquidity needs of customers as necessary, the ability to do so is not assured, especially if a large number of our depositors seek to withdraw their accounts, regardless of the reason. A failure to maintain adequate liquidity could materially and adversely affect our business, results of operations and financial condition.

Loss of deposits or a change in deposit mix could increase our funding costs.

Deposits are a low cost and stable source of funding. Regions competes with banks and other financial institutions for deposits and as a result, Regions could lose deposits in the future, clients may shift their deposits into higher cost products or Regions may need to raise interest rates to avoid deposit attrition. Funding costs may also increase if deposits lost are replaced with wholesale funding. Higher funding costs reduce Regions’ net interest margin, net interest income and net income. Any of a variety of single or combined factors could contribute to adverse movement in deposits or deposit costs, including but not limited to economic uncertainty, rapid movements in market interest rates or the Federal Reserve's monetary policy, entrance of competitors, disruptive technology, and/or diminishment of confidence in Regions or banks broadly.

We rely on the mortgage secondary market to manage various risks.

In 2023, we sold 35.1% of the mortgage loans we originated to the Agencies. We rely on the Agencies to purchase loans that meet their conforming loan requirements in order to reduce our credit risk and provide funding for additional loans we desire to originate. We cannot provide assurance that the Agencies will not materially limit their purchases of conforming loans due to capital constraints, a change in the criteria for conforming loans or other factors. Additionally, various proposals have been made to reform the U.S. residential mortgage finance market, including the role of the Agencies. The exact effects of any such reforms, if implemented, are not yet known, but they may limit our ability to sell conforming loans to the Agencies. If we are unable to continue to sell conforming loans to the Agencies, our ability to fund, and thus originate, additional mortgage loans may be adversely affected, which would adversely affect our results of operations.

Technology Risks

We are at risk of a variety of systems failures or errors and cyber-attacks or other similar incidents that could adversely affect customer experience and our business and financial performance.

Failure or errors in or breach of our systems or networks, or those of our third-party service providers (or providers to such third-party service providers), including as a result of cybersecurity or other similar incidents, could disrupt our businesses or impact our customers. Examples of incidents include, among other things, denial of service attacks, ransomware, malware, worms, software bugs, hacking, social engineering, phishing attacks, credential stuffing, account takeovers, insider threats, theft, malfeasance or improper access by employees or service providers, human error, fraud or other similar disruptions. These incidents could result in the loss, unauthorized disclosure, misuse or misappropriation of confidential, personal, proprietary or other information, damage to our reputation, increases to our costs and cause customer and financial losses. As a large financial institution, we depend on our ability to process, record and monitor a large number of customer transactions on a continuous basis and otherwise collect, transmit, store and process a significant amount of personal information in connection therewith. As public, regulatory and customers' expectations have increased regarding operational resilience and cybersecurity, our systems, networks and infrastructure must continue to be safeguarded and monitored for potential failures and disruptions, as well as cybersecurity or other similar incidents. Our systems and facilities may stop operating properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control. For example, there could be electrical or telecommunications outages; pandemics; events arising from local or larger scale political or social matters, including terrorist acts and civil unrest; and, as described below, cyber-attacks or other similar incidents. Although we have business continuity plans and other safeguards in place, our business operations may be adversely affected by significant and widespread disruption to our physical infrastructure or operating systems or networks, or those of our third-party service providers, that support our businesses and customers.

Cybersecurity risks for large financial institutions, such as us, have increased significantly in recent years in part because of the proliferation of technology-based products and services and the increased sophistication and activities of organized

27

Table of Contents

crime, hackers, terrorists, nation-states, nation state-supported actors, activists and other external parties. This increase is expected to continue and further intensify. The techniques used by cyber criminals change frequently, may not be recognized until launched (or may evade detection for considerable time), can be initiated from a variety of sources, including terrorist organizations and hostile foreign governments, and may see their frequency increased, and effectiveness enhanced, by the use of artificial intelligence. These criminals may attempt to fraudulently induce employees, customers or other users of our systems and networks to disclose sensitive information (including confidential, personal, proprietary and other information) in order to gain access to data or our systems and networks. Third parties with whom we or our customers do business also present operational and cybersecurity risks to us, including cybersecurity or other similar incidents or failures or disruptions of their own systems and networks. While we have successfully defended similar attacks, we could become the subject of a successful similar style attack through a supply chain compromise. As noted above, our operations rely on the secure collection, transmission, storage and other processing of confidential, personal, proprietary and other information in our operating systems and networks. In addition, to access our products and services, our customers may use personal computers, smartphones, tablets and other mobile devices that are beyond our control environment. Additionally, cybersecurity and other similar incidents or terrorist activities could disrupt our or our customers’ or other third parties’ business operations. Although these past events have not resulted in a breach of our client data or account information, such attacks have adversely affected the performance of Regions Bank’s website, www.regions.com, and, in some instances, prevented customers from accessing Regions Bank’s secure websites for consumer and commercial applications. In all cases, the attacks primarily resulted in inconvenience; however, future cyber-attacks or other similar incidents could be more disruptive and damaging, and we may not be able to anticipate or prevent all such attacks. The United States government has raised concerns about a potential increase in cyber-attacks and other similar incidents generally as a result of the military conflict between Russia and Ukraine and the related sanctions imposed by the United States and other countries or the ongoing Israel-Hamas conflict.

Although we believe that we have appropriate information security procedures and controls designed to prevent or limit the effects of a cybersecurity or other similar incident, our technologies, systems, networks and our customers’ devices may be the target of cybersecurity or other similar incidents that could result in the unauthorized release, accessing, gathering, monitoring, loss, destruction, modification, acquisition, transfer, use or other processing of us or our customers’ confidential, personal, proprietary and other information. We also have insurance coverage, that is reviewed annually, that may, subject to policy terms and conditions, cover certain losses associated with cybersecurity and other similar incidents, but our insurer may deny coverage as to any future claim or our insurance coverage may be insufficient to cover all losses from any such attack, breach or incident, including any related damage to our reputation. In addition, given the proliferation of cyber-events in our industry, the cost of cyber insurance is expected to continue to increase and may not be available at all or on acceptable terms.

As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our layers of defense or to investigate and remediate any information security vulnerabilities. We may also be required to incur significant costs in connection with any regulatory investigation or civil litigation, fines, damages or injunctions resulting from a cybersecurity or other similar incident that impacts us. In addition, our third-party service providers may be unable to identify vulnerabilities in their systems and networks or, once identified, be unable to promptly provide required patches or other remedial measures. Further, even if provided, such patches or remedial measures may not fully address any vulnerability or may be difficult for us to implement. While we perform cybersecurity diligence on our key service providers, because we do not control our service providers and our ability to monitor their cybersecurity is limited, we cannot ensure the cybersecurity measures they take will be sufficient to protect any information we share them. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cybersecurity or other similar incidents attributed to our service providers as they relate to the information we share with them.

Disruptions or failures in the physical infrastructure or operating systems or networks that support our businesses and customers, or cybersecurity or other similar incidents of the networks, systems or devices that our customers use to access our products and services, could result in customer attrition, violation of applicable privacy and cybersecurity laws and regulations, notifications obligations, regulatory fines, civil litigation, damages, injunctions, penalties or intervention, reputational damage, reimbursement or other compensation costs, remediation costs, additional cybersecurity protection costs, increased insurance premiums and/or additional compliance costs, any of which could materially adversely affect our business, results of operations or financial condition. We could also be adversely affected if we lose access to information or services from a third-party service provider as a result of a cybersecurity or similar incident or system, network or operational failure or disruption affecting the third-party service provider. For a more detailed discussion of these risks and specific occurrences, see the “Information Security Risk” section of Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations” of this Annual Report on Form 10-K.

We are subject to complex and evolving laws, regulations, rules, standards and contractual obligations regarding privacy and cybersecurity, which could increase the cost of doing business, compliance risks and potential liability.

We are subject to complex and evolving laws, regulations, rules, standards and contractual obligations relating to the privacy and cybersecurity of the personal information of clients, employees or others, and any failure to comply with these laws, regulations, rules, standards and contractual obligations could expose us to liability and/or reputational damage. As new privacy and cybersecurity-related laws, regulations, rules and standards are implemented, the time and resources needed for us

28

Table of Contents

to comply with such laws, regulations, rules and standards as well as our potential liability for non-compliance and reporting obligations in the case of cybersecurity or other similar incidents, may significantly increase. In addition, our businesses are increasingly subject to laws, regulations, rules and standards relating to privacy, cybersecurity, surveillance, encryption and data use in the jurisdictions in which we operate. Compliance with these laws, regulations, rules and standards may require us to change our policies, procedures and technology for information security and segregation of data, which could, among other things, make us more vulnerable to operational failures and to monetary penalties for breach of such laws, regulations, rules and standards.

At the federal level, we are subject to the GLBA which requires financial institutions to, among other things, periodically disclose their privacy policies and practices relating to sharing personal information and, in some cases, enables retail customers to opt out of the sharing of certain non-public personal information with unaffiliated third parties. We are also subject to the rules and regulations promulgated under the authority of the Federal Trade Commission, which regulates unfair or deceptive acts or practices, including with respect to privacy and cybersecurity. Moreover, the United States Congress has considered, and is currently considering, various proposals for more comprehensive privacy and cybersecurity legislation, to which we may be subject if passed. Additionally, the federal banking regulators, as well as the SEC and related self-regulatory organizations, regularly issue guidance regarding cybersecurity that is intended to enhance cyber risk management among financial institutions.

Privacy and cybersecurity are also areas of increasing state legislative focus and we are, or may in the future become, subject to various state laws and regulations regarding privacy and cybersecurity, such as the CCPA. Other states where we do business, or may in the future do business, or from which we otherwise collect, or may in the future otherwise collect, personal information of residents have implemented, or are considering implementing, comprehensive privacy and cybersecurity laws and regulations sharing similarities with the CCPA. Similar laws already exist in a number of other states, and such legislation continues to expand across the country. In addition, laws in all 50 U.S. states generally require businesses to provide notice under certain circumstances to individuals whose personal information has been disclosed as a result of a data breach. Certain state laws and regulations may be more stringent, broader in scope or offer greater individual rights, with respect to personal information than federal or other state laws and regulations, and such laws and regulations may differ from each other, which may complicate compliance efforts and increase compliance costs. Aspects of the CCPA and other federal and state laws and regulations relating to privacy and cybersecurity, as well as their enforcement, remain unclear, and we may be required to modify our practices in an effort to comply with them.

Further, while we strive to publish and prominently display privacy policies that are accurate, comprehensive and compliant with applicable laws, regulations, rules and industry standards, we cannot ensure that our privacy policies and other statements regarding our practices will be sufficient to protect us from claims, proceedings, liability or adverse publicity relating to privacy or cybersecurity. Although we endeavor to comply with our privacy policies, we may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policies and other documentation that provide promises and assurances about privacy and cybersecurity can subject us to potential federal or state action if they are found to be deceptive, unfair, or misrepresents our actual practices. Additional risks could arise in connection with any failure or perceived failure by us, our service providers or other third parties with which we do business to provide adequate disclosure or transparency to our customers about the personal information collected from them and its use, to receive, document or honor the privacy preferences expressed by our customers, to protect personal information from unauthorized disclosure or to maintain proper training on privacy practices for all employees or third parties who have access to personal information in our possession or control.

Any failure or perceived failure by us to comply with our privacy policies, or applicable privacy and cybersecurity laws, regulations, rules, standards or contractual obligations, or any compromise of security that results in unauthorized access to, or unauthorized loss, destruction, use, modification, acquisition, disclosure, release or transfer of personal information, may result in requirements to modify or cease certain operations or practices, the expenditure of substantial costs, time and other resources, proceedings or actions against us, legal liability, governmental investigations, enforcement actions, claims, fines, judgments, awards, penalties, sanctions and costly litigation (including class actions). Any of the foregoing could harm our reputation, distract our management and technical personnel, increase our costs of doing business, adversely affect the demand for our products and services and ultimately result in the imposition of liability, any of which could have a material adverse effect on our business, financial condition and results of operations. For further discussion of the privacy and cybersecurity laws, regulations, rules and standards we are, or may in the future become, subject to, see the “Supervision and Regulation-Privacy and Cybersecurity” section of Item 1. “Business” of this Annual Report on Form 10-K.

We will continually encounter technological change and must effectively anticipate, develop and implement new technology.

The financial services industry is undergoing rapid technological change with frequent introductions of new technology-driven products and services. We have invested in technology to automate functions previously performed manually, to facilitate the ability of clients to engage in financial transactions and otherwise to enhance the client experience with respect to our products and services. We expect to make additional investments in innovation and technology to address technological

29

Table of Contents

disruption in the industry and improve client offerings and service. These changes allow us to better serve the our clients and to reduce costs.

Our continued success depends, in part, upon our ability to address clients’ needs by using technology to provide products and services that satisfy client demands, including demands for faster and more secure payment services, to create efficiencies in our operations and to integrate those offerings with legacy platforms or to update those legacy platforms. A failure to maintain or enhance our competitive position with respect to technology, whether because of a failure to anticipate client expectations, a failure in the performance of technological developments or an untimely roll out of developments, may cause us to lose market share or incur additional expense.

Strategic Risks

Industry competition may adversely affect our degree of success.

Our profitability depends on our ability to compete successfully. We operate in a highly competitive industry that could become even more competitive as a result of legislative, regulatory, market and technological changes, as well as continued industry consolidation. This consolidation may produce larger, better-capitalized and more geographically diverse companies that are capable of offering a wider array of financial products and services at more competitive prices. For example, there have been a number of completed mergers of financial institutions within our market areas, and notwithstanding current regulatory approval delays there may in the future be additional consolidation. These and future mergers will, if completed, allow the merged financial institutions to benefit from cost savings and shared resources.

In our market areas, we face competition from other commercial banks, savings and loan associations, credit unions, internet banks, fintechs, finance companies, mutual funds, insurance companies, brokerage and investment banking firms, mortgage companies and other financial intermediaries that offer similar services. Many of our non-bank competitors are not subject to the same extensive regulations we are and, therefore, may have greater flexibility in competing for business.

In addition, technology has lowered barriers to entry and made it possible for non-banks to offer products and services, such as loans and payment services, that traditionally were banking products, and made it possible for technology companies to compete with financial institutions in providing electronic, internet-based, and mobile phone–based financial solutions. Competition with non-banks, including technology companies, to provide financial products and services is intensifying. In particular, the activity of fintechs has grown significantly over recent years and is expected to continue to grow. Fintechs have and may continue to offer bank or bank-like products. For example, a number of fintechs have applied for, and in some cases been granted, bank or industrial loan charters. In addition, other fintechs have partnered with existing banks to allow them to offer deposit products to their customers. Regulatory changes, such as the revisions to the FDIC’s rules on brokered deposits intended to reflect recent technological changes and innovations, may also make it easier for fintechs to partner with banks and offer deposit products. In addition to fintechs, traditional technology companies have begun to make efforts toward providing financial services directly to their customers and are expected to continue to explore new ways to do so. Many of these companies, including our competitors, have fewer regulatory constraints, and some have lower cost structures, in part due to lack of physical locations. Regions provides an array of digital products and services to our customers and we expect a bank’s digital offerings to be a key competitive differentiator. The move toward digital banking and financial services, and customer expectations regarding digital offerings, will require us to invest greater resources in technological improvements and may put us at a disadvantage to banks and non-banks with greater resources to spend on technology.

Our ability to compete successfully depends on a number of additional factors, including customer convenience, quality of service, personal contacts, the quality of the technology that supports the customer experience and pricing and range of products. If we are unable to successfully compete for new customers and to retain our current customers, our business, financial condition or results of operations may be adversely affected, perhaps materially. In particular, if we experience an outflow of deposits as a result of our customers seeking investments with higher yields or greater financial stability, we may be forced to rely more heavily on borrowings and other sources of funding to operate our business and meet withdrawal demands, thereby adversely affecting our net interest margin and financial performance. In addition, we may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers. As a result, our ability to effectively compete to retain or acquire new business may be impaired, and our business, financial condition or results of operations, may be adversely affected.

Our operations are concentrated primarily in the South, Midwest and Texas, and adverse changes in the economic conditions in this region can adversely affect our financial results and condition.

Our operations are concentrated primarily in the South, Midwest and Texas. As a result, local economic conditions in these areas significantly affect the demand for the loans and other products we offer to our customers (including real estate, commercial and construction loans), the ability of borrowers to repay these loans and the value of the collateral securing these loans. Any declines in real estate values in these areas may adversely affect borrowers and the value of the collateral securing many of our loans, which could adversely affect our currently performing loans, leading to future delinquencies or defaults and increases in our provision for credit losses. Adverse changes in the economic conditions in these regions could materially adversely affect our business, results of operations or financial condition.

30

Table of Contents

Weakness in the residential real estate markets could adversely affect our performance.

As of December 31, 2023, consumer residential real estate loans represented approximately 26.3% of our total loan portfolio. A general decline in home values would adversely affect the value of collateral securing the residential real estate that we hold, as well as the volume of loan originations and the amount we realize on the sale of real estate loans. These factors could result in higher delinquencies and greater charge-offs in future periods, which could materially adversely affect our business, financial condition or results of operations.

Weakness in the commercial real estate markets could adversely affect our performance.

As of December 31, 2023, approximately 9.0% of our loan portfolio consisted of investor real estate loans. The properties securing income-producing investor real estate loans are typically not fully leased at the origination of the loan. The borrower’s ability to repay the loan is instead dependent upon additional leasing through the life of the loan or the borrower’s successful operation of a business. Continued uncertainty in economic conditions may impair a borrower's business operations and slow the execution of new leases. Such economic conditions may also lead to existing lease turnover. As a result of these factors, vacancy rates for retail, office and industrial space may increase, and hotel occupancy rates may decline. High vacancy and lower occupancy rates could also result in rents falling. The combination of these factors could result in deterioration in the fundamentals underlying the commercial real estate market and the deterioration in value of some of our loans. Any such deterioration could adversely affect the ability of our borrowers to repay the amounts due under their loans. As a result, our business, results of operations or financial condition may also be adversely affected. Specifically, the office property segment, which represents 1.5 percent of our total loan portfolio, is undergoing a structural shift given the rise of a remote work environment resulting in heightened vacancies and potentially reduced leasing needs. It is anticipated that this heightened risk environment for the office segment may take several years to resolve.

Risks associated with home equity products where we are in a second lien position could materially adversely affect our performance.

Home equity products, particularly those in a second lien position, may carry a higher risk of non-collection than other loans. Home equity lending includes both home equity loans and lines of credit. At December 31, 2023, the Company's home equity portfolio included approximately $3.2 billion of home equity lines of credit and $2.4 billion of closed-end home equity loans (primarily originated as amortizing loans). Real estate market values at the time of origination directly affect the amount of credit extended, and, in addition, past and future changes in these values impact the depth of potential losses. Second lien position lending carries higher credit risk because any decrease in real estate pricing may result in the value of the collateral being insufficient to cover the second lien after the first lien position has been satisfied. As of December 31, 2023, approximately $2.0 billion of our home equity lines and loans were in a second lien position.

Weakness in commodity businesses could adversely affect our performance.

Many of our borrowers operate in industries that are directly or indirectly impacted by changes in commodity prices. This includes agriculture, livestock, metals, timber, textiles and energy businesses (including oil, gas and petrochemical), as well as businesses indirectly impacted by commodities prices such as businesses that transport commodities or manufacture equipment used in production of commodities. Changes in commodity prices depend on local, regional and global events or conditions that affect supply and demand for the relevant commodity. These industries have been, and may in the future be, subject to significant volatility. For example, oil prices have been volatile, both rising and falling, in recent years. Such volatility is expected to continue in the foreseeable future due to an unpredictable geopolitical and economic environment. As a consequence of oil and gas price volatility, our energy-related portfolio may be subject to additional pressure on credit quality metrics including past due, criticized, and non-performing loans, as well as net charge-offs. In addition, legislative changes such as the elimination of certain tax incentives and the transition to a less carbon dependent economy in response to climate change and other factors could have significant impacts on this portfolio.

An outbreak or escalation of hostilities between countries or within a country or region could have a material adverse effect on the U.S. economy and on our businesses.

Aggressive actions by hostile governments or groups, including armed conflict or intensified cyber-attacks, could expand in unpredictable ways by drawing in other countries or escalating into full-scale war with potentially catastrophic consequences, particularly if one or more of the combatants possess nuclear weapons. Depending on the scope of the conflict, the hostilities could result in worldwide economic disruption, heightened volatility in financial markets, severe declines in asset values, disruption of global trade and supply chains and diminished consumer, business and investor confidence.

Instability in geopolitical matters could have a material adverse effect on our results of operations and financial condition. The macroeconomic environment in the United States is susceptible to global events and volatility in financial markets. For example, trade negotiations between the United States and other nations remain uncertain and could adversely impact economic and market conditions for our and our clients and counterparties. The wars in the Ukraine, Israel and the Gaza Strip presents destabilizing forces, including higher and more volatile commodity and food prices, which may cause international and domestic economic deterioration. Financial markets may be adversely affected by the current or anticipated impact of military conflict, including the wars in the Ukraine, Israel and the Gaza Strip, terrorism or other geopolitical events. This could magnify

31

Table of Contents

inflationary pressure resulting from the pandemic and other sources and extend any prolonged period of higher inflation. Any of the above consequences could have significant negative effects on the U.S. economy, and, as a result, our operations and earnings. We could also experience more numerous and aggressive cyber-attacks launched by or under the sponsorship of one or more of the adversaries in such a conflict.

Operational Risks

We are subject to a variety of operational risks, including the risk of fraud or theft by internal or external parties, which may adversely affect our business and results of operations.

We are exposed to many types of operational risks, including business resilience, process, third party, information technology, human resource, model and fraud risks, each of which may be amplified by continued remote work. Our fraud risks include fraud committed by external parties against the Company or its customers and fraud committed internally by our associates. Certain fraud risks, including identity theft and account takeover, may increase as a result of customers’ account or personally identifiable information being obtained through breaches of retailers’ or other third parties’ networks. Examples of external fraud we face include fraudulent checks, stolen checks and other check-related fraud. We have established processes and procedures intended to identify, measure, monitor, mitigate, report and analyze these risks; however, there are inherent limitations to our risk management strategies as there may exist, or develop in the future, risks that we have not appropriately anticipated, monitored or identified. If our risk management framework proves ineffective, we could suffer unexpected losses, we may have to expend resources detecting and correcting the failure in our systems and we may be subject to potential claims from third parties and government agencies. We may also suffer severe reputational damage. Any of these consequences could adversely affect our business, financial condition or results of operations. In particular, the unauthorized disclosure, misappropriation, mishandling or misuse of personal, non-public, confidential or proprietary information of customers could result in significant regulatory consequences, reputational damage and financial loss.

We rely on other companies to provide key components of our business infrastructure.

Third parties provide key components of our business operations such as data processing, recording and monitoring transactions, online banking interfaces and services, Internet connections and network access. While we have selected these third-party vendors carefully, performing upfront due diligence and ongoing monitoring activities, we do not control their actions. Any issues that arise with respect to these third parties, including those resulting from disruptions in services provided by a vendor (including as a result of a cyber-attack, other information security event or a natural disaster), financial or operational difficulties for the vendor, issues at third-party vendors to the vendors, failure of a vendor to handle current or higher volumes, failure of a vendor to provide services for any reason, poor performance of services, failure to comply with applicable laws and regulations or fraud or misconduct on the part of employees of any of our vendors, could trigger regulatory notification obligations on us, adversely affect our ability to deliver products and services to our customers, our reputation and our ability to conduct our business. In certain situations, replacing these third-party vendors could also create significant delay and expense. Accordingly, use of such third parties creates an unavoidable, inherent risk to our business operations. Many of our vendors have also been impacted by remote work, market volatility and other factors that increase their risks of business disruption or that may otherwise affect their ability to perform under the terms of any agreements with us or provide essential services.

We depend on the accuracy and completeness of information about clients and counterparties.

In deciding whether to extend credit or enter into other transactions with clients and counterparties, we may rely on information furnished by or on behalf of clients and counterparties, including financial statements and other financial information. We also may rely on representations of clients and counterparties as to the accuracy and completeness of that information and, with respect to financial statements, on reports of independent auditors if made available. If this information is inaccurate, we may be subject to regulatory action, reputational harm or other adverse effects with respect to the operation of our business, our financial condition and our results of operations.

We are exposed to risk of environmental liability when we take title to property.

In the course of our business, we may foreclose on and take title to real estate. As a result, we could be subject to environmental liabilities with respect to these properties. We may be held liable to a governmental entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination or may be required to investigate or clean up hazardous or toxic substances or chemical releases at a property. The costs associated with investigation or remediation activities could be substantial. In addition, if we are the owner or former owner of a contaminated site, we may be subject to common law claims by third parties based on damages and costs resulting from environmental contamination emanating from the property. If we become subject to significant environmental liabilities, our business, financial condition or results of operations could be adversely affected.

32

Table of Contents

We can be negatively affected if we fail to identify and address operational risks associated with the introduction of or changes to products, services and delivery platforms.

When we launch a new product or service, introduce a new platform for the delivery or distribution of products or services (including mobile connectivity, electronic trading and cloud computing), acquire or invest in a business or make changes to an existing product, service or delivery platform, we may not fully appreciate or identify new operational risks that may arise from those changes, or may fail to implement adequate controls to mitigate the risks associated with those changes. Any significant failure in this regard could diminish our ability to operate one or more of our business or result in potential liability to clients, counterparties and customers, and result in increased operating expenses. We could also experience higher litigation costs, including regulatory fines, penalties and other sanctions, reputational damage, impairment of our liquidity, regulatory intervention or weaker competitive standing. Any of the foregoing consequences could materially and adversely affect our businesses and results of operations.

Enhanced regulatory and other standards for the oversight of vendors and other service providers can result in higher costs and other potential exposures.

We must comply with enhanced regulatory and other standards associated with doing business with vendors and other service providers, including standards relating to the outsourcing of functions as well as the performance of significant banking and other functions by subsidiaries. We incur significant costs and expenses in connection with our initiatives to address the risks associated with oversight of our external service providers. Our failure to appropriately assess and manage these relationships, especially those involving significant banking functions, shared services or other critical activities, could materially adversely affect us. Specifically, any such failure could result in: potential harm to clients and customers, and any liability associated with that harm; regulatory fines, penalties or other sanctions; lower revenues, and the opportunity cost from lost revenues; increased operational costs, or harm to our reputation.

Reputational Risks

We are subject to environmental, social and governance risks that could adversely affect our business, reputation and the trading price of our common stock.

We are subject to a variety of risks, including reputational risk, associated with environmental, social and governance, or ESG, issues. As a large financial institution with a diverse base of customers, vendors and suppliers, we may face negative publicity based on the identity, practices and perceptions of certain entities with whom we choose to do business. The public holds diverse and potentially conflicting views of those entities, and their activities, including the perceived environmental, social or economic impacts of those entities or of financial institutions’ relationships with those entities. Because we have multiple stakeholders, among them shareholders, customers, employees, federal and state regulatory authorities and political entities, often those stakeholders have differing, and sometimes conflicting, priorities and expectations regarding ESG issues. For example, certain federal and state laws and regulations related to ESG issues may include provisions that conflict with other laws and regulations, which may increase our costs or limit our ability to conduct business in certain jurisdictions.

Simultaneous, disparate and divergent sentiments on ESG-related matters from multiple stakeholder groups must be considered. For example, there is an increasing number of state-level anti-ESG initiatives in the U.S. that may conflict with other regulatory requirements or our various stakeholders' expectations. Such divergent, sometimes conflicting views on ESG-related matters increase the risk that any action or lack thereof by us on such matters will be perceived negatively by some stakeholders. Failing to comply with expectations and standards from investors, customers, regulators, policymakers and other stakeholders regarding ESG-related issues, or taking action in conflict with one or another of those stakeholders’ expectations, could also lead to loss of business, adverse publicity, an adverse impact on our reputation, customer complaints or public protests. Negative publicity may be driven by adverse news coverage in traditional media and may also be spread more broadly through the use of social media platforms. If our relationships with our customers, vendors and suppliers were to become the subject of such negative publicity, our ability to attract and retain customers and employees, compete effectively and grow our business may be negatively impacted. Additionally, a growing number of investors (in particular institutional investors who hold and manage substantial equity positions, in some cases in nearly all major U.S. listed companies) are integrating ESG factors into their analysis of the expected risk and return of potential investments. The specific ESG factors considered, as well as the approach to incorporating the factors into a broader investment process, vary by investor and can shift over time. Our failure to align with, or remain aligned with, investors’ ESG-related priorities may negatively impact the trading price of our common stock.

Damage to our reputation could significantly harm our businesses.

Our ability to attract and retain customers and highly-skilled management and employees is impacted by our reputation. A negative public opinion of us and our business can result from any number of activities, including our lending practices, corporate governance and regulatory compliance, acquisitions and actions taken by community organizations in response to these activities. Furthermore, negative publicity regarding us as an employer could have an adverse impact on our reputation, especially with respect to matters of diversity, pay equity and workplace harassment.

33

Table of Contents

Significant harm to our reputation, or the reputation of any company, could also arise as a result of regulatory or governmental actions, litigation and the activities of our customers, other participants in the financial services industry or our contractual counterparties, such as our service providers and vendors.

In addition, a cybersecurity event affecting us or our customers’ data could have a negative impact on our reputation and customer confidence in us and our cybersecurity practices. Damage to our reputation could also adversely affect our credit ratings and access to the capital markets.

Additionally, the widespread use of social media platforms by virtually every segment of society facilitates the rapid dissemination of information or misinformation, which magnifies the potential harm to our reputation.

Legal, Regulatory and Compliance Risks

We are, and may in the future be, subject to litigation, investigations and governmental proceedings that may result in liabilities adversely affecting our financial condition, business or results of operations or in reputational harm.

We and our subsidiaries are, and may in the future be, named as defendants in various class actions and other litigation, and may be the subject of subpoenas, reviews, requests for information, investigations, and formal and informal proceedings by government and self-regulatory agencies regarding our and their businesses and activities (including subpoenas, requests for information and investigations related to the activities of our customers). Any such matters may result in material adverse consequences to our results of operations, financial condition or ability to conduct our business, including adverse judgments, settlements, fines, penalties (including civil money penalties under applicable banking laws), injunctions, restitution, orders, restrictions on our business activities or other relief. Our involvement in any such matters, even if the matters are ultimately determined in our favor, could also cause significant harm to our reputation and divert management’s attention from the operation of our business. Further, any settlement, consent order or adverse judgment in connection with any formal or informal proceeding or investigation by government or self-regulatory agencies may result in additional litigation, investigations or proceedings as other litigants and government or self-regulatory agencies (including the inquiries mentioned above) begin independent reviews of the same businesses or activities. In general, the amounts paid by financial institutions in settlement of proceedings or investigations, including those relating to anti-money laundering matters or sales practices, have increased substantially and are likely to remain elevated. Regulators and other governmental authorities may also be more likely to pursue enforcement actions, or seek admissions of wrongdoing, in connection with the resolution of an inquiry or investigation to the extent a firm has previously been subject to other governmental investigations or enforcement actions. In some cases, governmental authorities have required criminal pleas or other extraordinary terms as part of such settlements, which could have significant collateral consequences for a financial institution, including loss of customers, restrictions on the ability to access the capital markets and the inability to operate certain businesses or offer certain products for a period of time. In addition, enforcement matters could impact our supervisory and CRA ratings, which may in turn restrict or limit our activities.

Additional information relating to our litigation, investigations and other proceedings is discussed in Note 23 “Commitments, Contingencies and Guarantees” to the consolidated financial statements of this Annual Report on Form 10-K.

We are subject to extensive governmental regulation, which could have an adverse impact on our operations.

We are subject to extensive state and federal regulation, supervision and examination governing almost all aspects of our operations, which limits the businesses in which we may permissibly engage. The laws and regulations governing our business are intended primarily for the protection of our depositors, our customers, the financial system and the FDIC insurance fund, not our shareholders or other creditors. These laws and regulations govern a variety of matters, including certain debt obligations, changes in control, maintenance of adequate capital, consumer protection and general business operations and financial condition (including permissible types, amounts and terms of loans and investments, the amount of reserves against deposits, restrictions on dividends and repurchases of our capital securities, establishment of branch offices and the maximum interest rate that may be charged by law). Further, we must obtain approval from our regulators before engaging in many activities, and our regulators have the ability to compel us to, or restrict us from, taking certain actions entirely. There can be no assurance that any regulatory approvals we may require or otherwise seek will be obtained in a timely manner or at all.

Regulations affecting banks and other financial institutions are undergoing continuous review and frequently change, and the ultimate effect of such changes cannot be predicted. Regulations and laws may be modified or repealed at any time, and new legislation may be enacted that will affect us, including those resulting from any changes to control of branches of the U.S government or leadership of administrative agencies resulting from upcoming elections.

Any changes in any federal and state law, as well as regulations and governmental policies, income tax laws and accounting principles, could affect us in substantial and unpredictable ways, including ways that may adversely affect our business, financial condition or results of operations. Failure to appropriately comply with any such laws, regulations or principles could result in sanctions by regulatory agencies, civil money penalties or damage to our reputation, all of which could adversely affect our business, financial condition or results of operations. Our regulatory capital position is discussed in greater detail in Note 12 "Regulatory Capital Requirements and Restrictions" to the consolidated financial statements of this Annual Report on Form 10-K.

34

Table of Contents

We are subject to a variety of risks in connection with any sale of loans we may conduct.

In connection with our sale of one or more loan portfolios, we may make certain representations and warranties to the purchaser concerning the loans sold and the procedures under which those loans have been originated and serviced. If any of these representations and warranties are incorrect, we may be required to indemnify the purchaser for any related losses, or we may be required to repurchase part or all of the affected loans. We may also be required to repurchase loans as a result of borrower fraud or in the event of early payment default by the borrower on a loan we have sold. If we are required to make any indemnity payments or repurchases and do not have a remedy available to us against a solvent counterparty, we may not be able to recover our losses resulting from these indemnity payments and repurchases. Consequently, our results of operations may be adversely affected.

In addition, we must report as held for sale any loans that we have undertaken to sell, whether or not a purchase agreement for the loans has been executed. We may, therefore, be unable to ultimately complete a sale for part or all of the loans we classify as held for sale. Management must exercise its judgment in determining when loans must be reclassified from held for investment status to held for sale status under applicable accounting guidelines. Any failure to accurately report loans as held for sale could result in regulatory investigations and monetary penalties. Any of these actions could adversely affect our financial condition and results of operations. Reclassifying loans from held for investment to held for sale also requires that the affected loans be marked to the lower of cost or fair value. As a result, any loans classified as held for sale may be adversely affected by changes in interest rates and by changes in the borrower’s creditworthiness. We may be required to reduce the value of any loans we mark held for sale, which could adversely affect our results of operations.

We may be subject to more stringent capital and liquidity requirements.

Regions and Regions Bank are each subject to capital adequacy and liquidity guidelines and other regulatory requirements specifying minimum amounts and types of capital that must be maintained. From time to time, the regulators implement changes to these regulatory capital adequacy and liquidity guidelines. If we fail to meet these minimum capital adequacy and liquidity guidelines and other regulatory requirements, we or our subsidiaries may be restricted in the types of activities we may conduct and may be prohibited from taking certain capital actions, such as paying dividends and repurchasing or redeeming capital securities.

Regions and Regions Bank are each required to comply with applicable capital adequacy standards established by the Federal Reserve, which are based on the Basel III framework. Proposed changes to applicable capital and liquidity requirements, such as the Basel III proposal and the long-term debt proposal, could result in increased expenses or cost of funding, which could negatively affect our financial results or our ability to pay dividends and engage in share repurchases.

For more information concerning our legal and regulatory obligations with respect to Basel III and long-term debt requirements, please see the “Supervision and Regulation-Regulatory Capital Requirements” discussion within Item 1. “Business,” and for more information concerning our compliance with capital and liquidity requirements, see Note 12 “Regulatory Capital Requirements and Restrictions” to the consolidated financial statements of this Annual Report on Form 10-K.

Rulemaking changes and regulatory initiatives implemented by the CFPB may result in higher regulatory and compliance costs that may adversely affect our results of operations.

Since its formation, the CFPB has finalized a number of significant rules and introduced new regulatory initiatives, including, without limitation, by way of its enforcement authority and through public statements, that could have a significant impact on our business and the financial services industry more generally. We may also be required to add additional compliance personnel or incur other significant compliance-related expenses. Our business, results of operations or competitive position may be adversely affected as a result.

In addition, the current U.S. presidential administration has called on all regulatory agencies to reduce or eliminate certain fees relating to a number of services, including banking services. At the same time, the CFPB launched an initiative to reduce the amounts and types of fees financial institutions may charge, including the issuance of a proposed rule that would significantly reduce the permissible amount of credit card late fees. Such changes could affect the Company’s ability or willingness to provide certain products or services, necessitate changes to the Company’s business practices or have an adverse effect on our results of operations.

We may not be able to complete future acquisitions, may not be successful in realizing the benefits of any future acquisitions that are completed or may choose not to pursue acquisition opportunities we might find beneficial.

We may, from time to time, evaluate and engage in the acquisition or divestiture of businesses (including their assets or liabilities, such as loans or deposits). We must generally satisfy a number of meaningful conditions prior to completing any such transaction, including in certain cases, federal and state bank regulatory approvals.

The process for obtaining required regulatory approvals, particularly for large financial institutions, like Regions, can be difficult, time-consuming and unpredictable. We may fail to pursue, evaluate or complete strategic and competitively

35

Table of Contents

significant business opportunities as a result of our inability, or our perceived inability, to obtain required regulatory approvals in a timely manner or at all.

Assuming we are able to successfully complete one or more transactions, we may not be able to successfully integrate and realize the expected synergies from any completed transaction in a timely manner or at all. In particular, we may be held responsible by federal and state regulators for regulatory and compliance failures at an acquired business prior to the date of the acquisition, and these failures by the acquired company may have negative consequences for us, including the imposition of formal or informal enforcement actions. Completion and integration of any transaction may also divert management attention from other matters, result in additional costs and expenses or adversely affect our relationships with our customers and employees, any of which may adversely affect our business or results of operations. Future acquisitions may also result in dilution of our current shareholders’ ownership interests or may require we incur additional indebtedness or use a substantial amount of our available cash and other liquid assets. As a result, our financial condition may be affected, and we may become more susceptible to economic conditions and competitive pressures.

Increases in FDIC insurance assessments may adversely affect our earnings.

Our deposits are insured by the FDIC up to legal limits and, accordingly, we are subject to FDIC deposit insurance assessments. We generally cannot control the amount of assessments we will be required to pay for FDIC insurance. In 2022, the FDIC adopted a final rule to increase initial base deposit insurance assessment rate schedules by 2 basis points, which began with the first quarterly assessment period of 2023. The final rule requires the revised rates to remain in effect until the DIF reserve ratio meets or exceeds 1.35 percent.

To recoup losses to the DIF resulting from the bank failures of 2023, the FDIC also adopted a special assessment that will become effective in 2024 and will be collected over eight quarterly assessment periods. The FDIC may require us to pay higher FDIC assessments than we currently do or may charge additional special assessments or future prepayments if, for example, there are financial institution failures in the future. Any increase in deposit assessments or special assessments may adversely affect our business, financial condition or results of operations. See the “Supervision and Regulation-Deposit Insurance” discussion within Item 1. “Business” and the “Non-Interest Expense” discussion within Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations” of this Annual Report on Form 10-K for additional information related to the FDIC’s deposit insurance assessments applicable to Regions Bank.

Unfavorable results from ongoing stress analyses may adversely affect our ability to retain customers or compete for new business opportunities.

The Federal Reserve conducts supervisory stress testing of us to evaluate our ability to absorb losses in baseline and severely adverse economic and stressed financial scenarios generated by the Federal Reserve. The Federal Reserve also has implemented the SCB framework which created a firm specific risk sensitive buffer that is informed by the results of supervisory stress testing, and is applied to regulatory minimum capital levels to help determine effective minimum ratio requirements. Firm specific SCB requirements, as well as a summary of the results of certain aspects of the Federal Reserve’s supervisory stress testing and firm specific results are released publicly.

Although the theoretical stress tests are not meant to assess our current condition or outlook, our customers may misinterpret and negatively react to the results of these stress tests despite the strength of our financial condition. Any potential misinterpretations and adverse reactions could limit our ability to attract and retain customers or to effectively compete for new business opportunities. The inability to attract and retain customers or effectively compete for new business may have a material and adverse effect on our business, financial condition or results of operations.

Our regulators may also require us to raise additional capital or take other actions, or may impose restrictions on capital distributions, based on the results of the supervisory stress tests, such as requiring revisions or resubmission of our annual capital plan, which could adversely affect our ability to pay dividends and repurchase capital securities. In addition, we may not be able to raise additional capital if required to do so, or may not be able to do so on terms that we believe are advantageous to Regions or its current shareholders. Any such capital raises, if required, may also be dilutive to our existing shareholders. As discussed in the “Supervision and Regulation” section of Item 1. of this Annual Report on Form 10-K, the Company was not required to participate in the 2023 CCAR process. However, the Company did receive its SCB reflecting planned capital changes including plans to increase its common stock dividend. The Federal Reserve communicated that the Company exceeded all minimum capital levels under the supervisory stress test and the Company’s SCB for the fourth quarter of 2023 through the third quarter of 2024 continues to be floored at 2.5 percent. Despite exceeding these minimum capital levels, we may experience unfavorable results from stress test analyses in the future.

We are a holding company and depend on our subsidiaries for dividends, distributions and other payments.

We are a legal entity separate and distinct from our banking and other subsidiaries. Our principal source of cash flow, including cash flow to pay dividends to our shareholders and principal and interest on our outstanding debt, is dividends from Regions Bank. There are statutory and regulatory limitations on the payment of dividends by Regions Bank to us, as well as by us to our shareholders. Regulations of both the Federal Reserve and the State of Alabama affect the ability of Regions Bank to pay dividends and other distributions to us and to make loans to the holding company. If Regions Bank is unable to make

36

Table of Contents

dividend payments to us and sufficient cash or liquidity is not otherwise available, we may not be able to make dividend payments to our common and preferred shareholders or principal and interest payments on our outstanding debt. See the “Shareholders’ Equity” section of Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations” of this Annual Report on Form 10-K. In addition, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of creditors of that subsidiary, except to the extent that any of our claims as a creditor of such subsidiary may be recognized. As a result, shares of our capital stock are effectively subordinated to all existing and future liabilities and obligations of our subsidiaries. At December 31, 2023, our subsidiaries’ total deposits and borrowings were approximately $128.3 billion.

We may not pay dividends on shares of our capital stock.

Holders of shares of our capital stock are only entitled to receive such dividends as our Board may declare out of funds legally available for such payments. Although we have historically declared cash dividends on our common stock, we are not required to do so and may reduce or eliminate our common stock dividend in the future. This could adversely affect the market price of our common stock. Furthermore, the terms of our outstanding preferred stock prohibit us from declaring or paying any dividends on any junior series of our capital stock, including our common stock, or from repurchasing, redeeming or acquiring such junior stock, unless we have declared and paid full dividends on our outstanding preferred stock for the most recently completed dividend period.

We are also subject to statutory and regulatory limitations on our ability to pay dividends on our capital stock. For example, it is the policy of the Federal Reserve that BHCs should generally pay dividends on common stock only out of earnings, and only if prospective earnings retention is consistent with the organization’s expected future needs, asset quality and financial condition. Additionally, we are subject to the Federal Reserve’s SCB requirement whereby supervisory stress testing informs a buffer above regulatory minimum capital levels that must be maintained to avoid restrictions on capital distributions. Lastly, if we are unable to satisfy the capital requirements applicable to us for any reason, we may be limited in our ability to declare and pay dividends on our capital stock.

Anti-takeover and banking laws and certain agreements and charter provisions may adversely affect share value.

Certain provisions of state and federal law and our certificate of incorporation may make it more difficult for someone to acquire control of us without our Board’s approval. Under federal law, subject to certain exemptions, a person, entity or group must notify the federal banking agencies before acquiring control of a BHC. Acquisition of 10% or more of any class of voting stock of a BHC or state member bank, including shares of our common stock, creates a rebuttable presumption that the acquirer “controls” the BHC or state member bank. Also, as noted under the “Supervision and Regulation” section of Item 1. of this Annual Report on Form 10-K, a BHC must obtain the prior approval of the Federal Reserve before, among other things, acquiring direct or indirect ownership or control of more than 5 percent of the voting shares of any bank, including Regions Bank. One factor the federal banking agencies must consider in certain acquisitions is the systemic impact of the transaction. This may make it more difficult for large institutions to acquire other large institutions and may otherwise delay the regulatory approval process, possibly by requiring public hearings. Similarly, under Alabama state law, a person or group of persons must receive approval from the Superintendent of Banks before acquiring “control” of an Alabama bank or any entity having control of an Alabama bank. For the purposes of determining whether approval is required, “control” is defined as the power, directly or indirectly, to vote the lesser of (i) 25% or more of any class of voting securities of an Alabama bank (or any entity having control of an Alabama bank) or (ii) 10% or more of any class of voting securities of an Alabama bank (or any entity having control of an Alabama bank) if no other person will own, control or hold the power to vote a majority of that class of voting securities following the acquisition of such voting securities. Furthermore, there also are provisions in our certificate of incorporation that may be used to delay or block a takeover attempt. For example, holders of our preferred stock have certain voting rights that could adversely affect share value. If and when dividends on the preferred stock have not been declared and paid for at least six quarterly dividend periods or their equivalent (whether or not consecutive), the authorized number of directors then constituting our Board will automatically be increased by two, and the preferred shareholders will be entitled to elect the two additional directors. Also, the affirmative vote or consent of the holders of at least two-thirds of all of the then-outstanding shares of the preferred stock is required to consummate a binding share-exchange or reclassification involving the preferred stock, or a merger or consolidation of Regions with or into another entity, unless certain requirements are met. These statutory provisions and provisions in our certificate of incorporation, including the rights of the holders of our preferred stock, could result in Regions being less attractive to a potential acquirer and thus adversely affect our share value.

37

Table of Contents

Our amended and restated bylaws designate (i) the Court of Chancery of the State of Delaware as the sole and exclusive forum for certain types of actions and proceedings that may be initiated by our shareholders and (ii) the federal district courts of the United States as the sole and exclusive forum for any action asserting a cause of action arising under the Securities Act, which could limit our shareholders’ ability to obtain a favorable judicial forum for disputes with our company or our company’s directors, officers or other employees.