UNITED STATES SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

(Mark One)

☑	ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934
	For the fiscal year ended	December 31, 2023
or

☐	TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934
	For the transition period from             to

Commission file number: 001-31343

ASSOCIATED BANC-CORP

(Exact name of registrant as specified in its charter)

Wisconsin		39-1098068
(State or other jurisdiction of incorporation or organization)		(I.R.S. Employer Identification No.)
433 Main Street
Green Bay,	Wisconsin	54301
(Address of principal executive offices)		(Zip Code)

Registrant’s telephone number, including area code: (920) 491-7500

SECURITIES REGISTERED PURSUANT TO SECTION 12(b) OF THE ACT:

Title of each class	Trading symbol(s)	Name of each exchange on which registered
Common stock, par value $0.01 per share	ASB	New York Stock Exchange
Depositary Shrs, each representing 1/40th intrst in a shr of 5.875% Non-Cum. Perp Pref Stock, Srs E	ASB PrE	New York Stock Exchange
Depositary Shrs, each representing 1/40th intrst in a shr of 5.625% Non-Cum. Perp Pref Stock, Srs F	ASB PrF	New York Stock Exchange
6.625% Fixed-Rate Reset Subordinated Notes due 2033	ASBA	New York Stock Exchange

SECURITIES REGISTERED PURSUANT TO SECTION 12(g) OF THE ACT:

None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.

Yes  þ        No  ¨

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.

Yes  ¨        No  þ

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.

Yes  þ        No  ¨

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files).

Yes  þ        No  ¨

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer	☑	Accelerated filer	☐
Non-accelerated filer	☐	Smaller reporting company	☐
Emerging growth company	☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act.    ¨

Indicate by check mark whether the registrant has filed a report on and attestation to its management's assessment of the effectiveness of its internal controls over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. þ    

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements.  ¨

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant's executive officers during the relevant recovery period pursuant to §240.10D-1(b). ¨

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act).

Yes  ☐        No  þ

As of June 30, 2023, (the last business day of the registrant’s most recently completed second fiscal quarter) the aggregate market value of the voting stock held by nonaffiliates of the registrant was $2,422,814,728. This excludes $26,594,604 of market value representing the outstanding shares of the registrant owned by all directors and officers who may be deemed affiliates. This includes $44,867,332 of market value representing 1.83% of the outstanding shares of the registrant held in a fiduciary capacity by the trust company subsidiary of the registrant.

As of January 31, 2024, 151,087,726 shares of common stock were outstanding.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the registrant's Proxy Statement for the Annual Meeting of Shareholders to be held on April 30, 2024 are incorporated by reference in this Form 10-K into Part III.

Auditor Name:    KPMG LLP            Auditor Location:    Chicago, Illinois            Auditor Firm ID:    185

ASSOCIATED BANC-CORP

2023 Form 10-K Table of Contents

		Page
PART I
Item 1.	Business	3
Item 1A.	Risk Factors	19
Item 1B.	Unresolved Staff Comments	43
Item 1C.	Cybersecurity	43
Item 2.	Properties	45
Item 3.	Legal Proceedings	45
Item 4.	Mine Safety Disclosures	45
PART II
Item 5.	Market for Registrant’s Common Equity, Related Stockholder Matters And Issuer Purchases of Equity Securities	48
Item 6.	[Reserved]	49
Item 7.	Management’s Discussion and Analysis of Financial Condition and Results of Operations	50
Item 7A.	Quantitative and Qualitative Disclosures About Market Risk	82
Item 8.	Financial Statements and Supplementary Data	83
Item 9.	Changes in and Disagreements With Accountants on Accounting and Financial Disclosure	153
Item 9A.	Controls and Procedures	153
Item 9B.	Other Information	156
Item 9C.	Disclosure Regarding Foreign Jurisdictions that Prevent Inspections	156
PART III
Item 10.	Directors, Executive Officers and Corporate Governance	156
Item 11.	Executive Compensation	156
Item 12.	Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters	156
Item 13.	Certain Relationships and Related Transactions, and Director Independence	156
Item 14.	Principal Accounting Fees and Services	156
PART IV
Item 15.	Exhibits and Financial Statement Schedules	157
Item 16.	Form 10-K Summary	160
Signatures		160

ASSOCIATED BANC-CORP

Commonly Used Terms

The following listing provides a reference of common acronyms, abbreviations, and other defined terms used throughout the document:

2017 Plan	2017 Incentive Compensation Plan
2020 Plan	2020 Incentive Compensation Plan
ABRC	Associated Benefits and Risk Consulting, the Corporation's insurance division which was sold on June 30, 2020
ABL	Asset-Based Lending
ACL	Allowance for Credit Losses on Loans and Investments
ACLL	Allowance for Credit Losses on Loans
ADC	Acquisition, Development, or Construction
AFS	Available for Sale
AI	Artificial Intelligence
ALCO	Asset/Liability Committee
AML	Anti-Money Laundering
APSN	Authorize Positive, Settle Negative
Associated / Corporation / our / us / we	Associated Banc-Corp collectively with all of its subsidiaries and affiliates
Associated Bank / the Bank	Associated Bank, National Association
ASU	Accounting Standards Update
ATR	Ability-to-Repay
Basel III	International framework established by the Basel Committee on Banking Supervision for the regulation of capital and liquidity
BHC Act	Bank Holding Company Act of 1956, as amended
bp	basis point(s)
BSA	Bank Secrecy Act
BTFP	Bank Term Funding Program
CAMELS	Capital adequacy, Asset quality, Management, Earnings, Liquidity, and Sensitivity
CAN-SPAM Act	Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003
CCPA	California Consumer Privacy Act
CDs	Certificates of Deposit
CDIs	Core Deposit Intangibles
CECL	Current Expected Credit Losses
CEO	Chief Executive Officer
CET1	Common Equity Tier 1
CFPB	Consumer Financial Protection Bureau
CGSRC	Corporate Governance and Social Responsibility Committee
CIO	Chief Information Officer
CISO	Chief Information Security Officer
CMO	Collateralized Mortgage Obligation
CPRA	California Privacy Rights Act
CRA	Community Reinvestment Act
CRE	Commercial Real Estate
CRO	Chief Risk Officer
DE&I	Diversity, Equity & Inclusion
DFPI	California Department of Financial Protection and Innovation

DIF	Deposit Insurance Fund
Dodd-Frank Act	Dodd-Frank Wall Street Reform and Consumer Protection Act
DOJ	Department of Justice
DOL	Department of Labor
DTAs	Deferred Tax Assets
DTI	Debt-to-Income
EAR	Earnings at Risk
Economic Growth Act	Economic Growth, Regulatory Relief, and Consumer Protection Act
EMS	Environmental Sustainability Risk Management System
ERC	Enterprise Risk Committee of the Board of Directors
ESG	Environmental, Social, and Governance
Exchange Act	Securities Exchange Act of 1934, as amended
FASB	Financial Accounting Standards Board
FDI Act	Federal Deposit Insurance Act
FDIC	Federal Deposit Insurance Corporation
FDICIA	Federal Deposit Insurance Corporation Improvement Act
Federal Reserve	Board of Governors of the Federal Reserve System
FFELP	Federal Family Education Loan Program
FFIEC	Federal Financial Institutions Examination Council
FHLB	Federal Home Loan Bank
FHLMC	Federal Home Loan Mortgage Corporation
FICO	Financing Corporation, established by the Competitive Equality Banking Act of 1987
FICO Score	Fair Isaac Corporation score, a broad-based risk score to aid in credit decisions
FinCEN	Financial Crimes Enforcement Network
FINRA	Financial Industry Regulatory Authority
First Staunton	First Staunton Bancshares, Incorporated
FNMA	Federal National Mortgage Association
FOMC	Federal Open Market Committee
FTC	Federal Trade Commission
FTEs	Full-time equivalent employees
FTP	Funds Transfer Pricing
GAAP	Generally Accepted Accounting Principles
GHG	Greenhouse Gas
GLBA	Gramm-Leach-Bliley Act of 1999
GNMA	Government National Mortgage Association
GSE	Government-Sponsored Enterprise
HQLA	High-Quality Liquid Assets
HTM	Held to Maturity
HVCRE	High Volatility Commercial Real Estate
IDI	Insured Depository Institution
LGBTQ+	Lesbian, Gay, Bisexual, Transgender, Queer, and Plus
LLC	Limited Liability Company
LMI	Low- to Moderate-Income
LOCOM	Lower of Cost or Market
LTV	Loan-to-Value
MBS	Mortgage-Backed Securities
Moody's	Moody's Investors Service
MSAs	Mortgage Servicing Assets
MSRs	Mortgage Servicing Rights

MVE	Market Value of Equity
NAICS	North American Industry Classification System
NDAA	National Defense Authorization Act
Net Free Funds	Noninterest-bearing sources of funds
NPAs	Nonperforming Assets
NYSE	New York Stock Exchange
OCC	Office of the Comptroller of the Currency
OCI	Other Comprehensive Income
OREO	Other Real Estate Owned
Parent Company	Associated Banc-Corp individually
Patriot Act	Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001
PCD	Purchased Credit Deteriorated
PCI-DSS	Payment Card Industry Data Security Standard
QMs	Qualified Mortgages
RAP	Retirement Account Plan - the Corporation's noncontributory defined benefit retirement plan
REIT	Real Estate Investment Trust
Repurchase Agreements	Securities sold under agreements to repurchase
RESPA	Real Estate Settlement Procedures Act
Restricted Stock Awards	Restricted common stock and restricted common stock units to certain key employees
Retirement Eligible Colleagues	Colleagues whose retirement meets the early retirement or normal retirement definitions under the applicable equity compensation plan
Rockefeller	Rockefeller Capital Management
S&P	Standard & Poor's
SAR	Suspicious Activity Report
SBA	Small Business Administration
SBNY	Signature Bank
SEC	U.S. Securities and Exchange Commission
Securities Act	Securities Act of 1933, as amended
Series C Preferred Stock	The Corporation's 6.125% Non-Cumulative Perpetual Preferred Stock, Series C, liquidation preference $1,000 per share
Series D Preferred Stock	The Corporation's 5.375% Non-Cumulative Perpetual Preferred Stock, Series D, liquidation preference $1,000 per share
Series E Preferred Stock	The Corporation's 5.875% Non-Cumulative Perpetual Preferred Stock, Series E, liquidation preference $1,000 per share
Series F Preferred Stock	The Corporation's 5.625% Non-Cumulative Perpetual Preferred Stock, Series F, liquidation preference $1,000 per share
SMS	Short Message Service
SOFR	Secured Overnight Finance Rate
SVB	Silicon Valley Bank
Tax Act	U.S. Tax Cuts and Jobs Act of 2017
TCPA	Telephone Consumer Protection Act
TDR	Troubled Debt Restructuring
TILA	Truth in Lending Act
Whitnell	Whitnell & Co.

Special Note Regarding Forward-Looking Statements

This document, including the documents that are incorporated by reference, contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended and Section 21E of the Exchange Act. You can identify forward-looking statements by words such as "may," "should," "expect," "plan," "anticipate," "intend," "believe," "estimate," "predict," "potential," "continue," "could," "future," "outlook," or the negative of those terms or other words of similar meaning. You should read statements that contain these words carefully because they discuss our future expectations or state other "forward-looking" information. Such forward-looking statements may relate to our financial condition, results of operations, plans, objectives, future performance, or business and are based upon the beliefs and assumptions of our management and the information available to our management at the time these disclosures are prepared. These forward-looking statements involve risks and uncertainties that we may not be able to accurately predict or control and our actual results may differ materially from those we described in our forward-looking statements. Shareholders should be aware that the occurrence of the events discussed under the heading Risk Factors in this document, and in the information incorporated by reference herein, could have an adverse effect on our business, results of operations, and financial condition. These factors, many of which are beyond our control, include the following.

•Credit risks, including changes in economic conditions and risk relating to our ACL.

•Liquidity and interest rate risks, including the impact of capital market conditions and changes in monetary policy on our borrowings and net interest income.

•Operational risks, including processing, information systems, cybersecurity, vendor problems, business interruption, and fraud risks.

•Strategic and external risks, including economic, political, and competitive forces impacting our business.

•Legal, compliance, and reputational risks, including regulatory and litigation risks.

•The risk that our analyses of these risks and forces could be incorrect and/or that the strategies developed to address them could be unsuccessful.

For a discussion of these and other risks that may cause actual results to differ from expectations, please refer to the Risk Factors Summary and Risk Factors sections of this document. The forward-looking statements contained or incorporated by reference in this document relate only to circumstances as of the date on which the statements are made. We undertake no obligation to update or revise any forward-looking statements, whether as a result of new information, future events, or otherwise.

Risk Factors Summary

Our business is subject to a number of risks, a summary of which is set forth below. These risks are discussed more fully in Part I, Item 1A, Risk Factors herein.

Credit Risks

•Changes and instability in economic conditions, geopolitical matters and financial markets, including a contraction of economic activity, could adversely impact our business, results of operations and financial condition.

•Changes in U.S. trade policies, including the imposition of tariffs and retaliatory tariffs, may adversely impact our business, financial condition, and results of operations.

•Our allowance for credit losses may be insufficient.

•We are subject to lending concentration risks.

•CRE lending may expose us to increased lending risks.

•We depend on the accuracy and completeness of information furnished by and on behalf of our customers and counterparties.

•Lack of system integrity or credit quality related to funds settlement could result in a financial loss.

•We are subject to environmental liability risk associated with lending activities.

Liquidity and Interest Rate Risks

•Impairment of our access to liquidity could affect our ability to meet our obligations.

•The proportion of our deposit account balances that exceed FDIC insurance limits may expose the Bank to enhanced liquidity risk in times of financial distress.

•Adverse changes to our credit ratings could limit our access to funding and increase our borrowing costs.

•We are subject to interest rate risk.

•The impact of interest rates on our mortgage banking business can have a significant impact on revenues.

•Changes in interest rates could reduce the value of our investment securities holdings which would increase our accumulated other comprehensive loss and thereby negatively impact stockholders’ equity.

•Changes in interest rates could also reduce the value of our residential mortgage-related securities and MSRs, which could negatively affect our earnings.

•We rely on dividends from our subsidiaries for most of our cash flow.

1

Operational Risks

•We face significant operational risks due to the high volume and the high dollar value nature of transactions we process.

•Unauthorized disclosure of sensitive or confidential client or customer information, whether through a cyber-attack, other breach of our computer systems or otherwise, could severely harm our business.

•Information security risks for financial institutions like us continue to increase in part because of new technologies, the increased use of the internet and telecommunications technologies (including mobile devices and cloud computing) to conduct financial and other business transactions, political activism, and the increased sophistication and activities of organized crime, perpetrators of fraud, hackers, terrorists and others.

•From time to time, the Corporation engages in acquisitions, including acquisitions of depository institutions. The integration of core systems and processes for such transactions often occurs after the closing, which may create elevated risk of cyber incidents.

•We rely heavily on communications and information systems to conduct our business. We have experienced cybersecurity attacks in the past and our communications and information systems may experience an interruption or breach in security from future attacks.

•We are subject to certain industry standards regarding our credit card-related services. Failure to meet those standards may significantly impact our ability to offer these services.

•Compliance with ever-evolving federal and state laws relating to the handling of information about individuals involves significant expenditure and resources, and any failure by us or our vendors to comply may result in significant liability, negative publicity, and/or an erosion of trust, which could materially adversely affect our business, results of operations, and financial condition.

•Any actual or perceived failure to comply with evolving regulatory frameworks around the development and use of artificial intelligence could adversely affect our business, results of operations, and financial condition.

•We are dependent upon third parties for certain information system, data management and processing services, and to provide key components of our business infrastructure.

•The potential for business interruption exists throughout our organization.

•Changes in the federal, state, or local tax laws may negatively impact our financial performance.

•Impairment of investment securities, goodwill, other intangible assets, or DTAs could require charges to earnings, which could result in a negative impact on our results of operations.

•Revenues from our investment management and asset servicing businesses are significant to our earnings.

•Climate change and related legislative and regulatory initiatives may result in operational changes and expenditures that could significantly impact our business.

•Severe weather, natural disasters, public health issues, civil unrest, acts of war or terrorism, and other external events could significantly impact our ability to conduct business.

•Increasing, complex and evolving regulatory, stakeholder, and other third party expectations on ESG matters could adversely affect our reputation, our access to capital and the market price of our securities.

Strategic and External Risks

•Our earnings are significantly affected by the fiscal and monetary policies of the federal government and its agencies.

•Our financial condition and results of operations could be negatively affected if we fail to grow or fail to manage our growth effectively.

•We operate in a highly competitive industry and market area.

•Fiscal challenges facing the U.S. government could negatively impact financial markets which in turn could have an adverse effect on our financial position or results of operations.

•Consumers may decide not to use banks to complete their financial transactions.

•Our profitability depends significantly on economic conditions in the states within which we do business.

•The earnings of financial services companies are significantly affected by general business and economic conditions.

•New lines of business or new products and services may subject us to additional risk.

•Failure to keep pace with technological change could adversely affect our business.

•We may be adversely affected by risks associated with potential and completed acquisitions.

•Acquisitions may be delayed, impeded, or prohibited due to regulatory issues.

Legal, Regulatory, Compliance and Reputational Risks

•We are subject to extensive government regulation and supervision.

•The Bank faces risks related to the adoption of future legislation and potential changes in federal regulatory agency leadership, policies, and priorities.

•Recent volatility in the banking sector, triggered by the failures of Silicon Valley Bank, Signature Bank and First Republic Bank, may result in legislative initiatives, agency rulemaking activities, or changes in agency policies and priorities that could subject the Corporation and the Bank to enhanced government regulation and supervision.

•We will experience increases in FDIC insurance assessments due to the bank failures that occurred in 2023.

•Changes in requirements relating to the standard of conduct for broker-dealers under applicable federal and state law may adversely affect our business.

2

•The CFPB has reshaped the consumer financial laws through rulemaking and enforcement of the prohibitions against unfair, deceptive and abusive business practices. Compliance with any such change may impact the business operations of depository institutions offering consumer financial products or services, including the Bank.

•The Bank is periodically examined for mortgage-related issues, including mortgage loan and default services, fair lending, and mortgage banking.

•We may experience unanticipated losses as a result of residential mortgage loan repurchase or reimbursement obligations under agreements with secondary market purchasers.

•Fee revenues from overdraft protection programs constitute a significant portion of our noninterest income and may be subject to increased supervisory scrutiny.

•We are subject to examinations and challenges by tax authorities.

•We are subject to claims and litigation pertaining to fiduciary responsibility.

•We are a defendant in a variety of litigation and other actions, which may have a material adverse effect on our financial condition and results of operation.

•Negative publicity could damage our reputation.

•Ethics or conflict of interest issues could damage our reputation.

Risks Related to an Investment in Our Securities

•The price of our securities can be volatile.

•There may be future sales or other dilution of our equity, which may adversely affect the market price of our securities.

•We may reduce or eliminate dividends on our common stock.

•Common stock is equity and is subordinate to our existing and future indebtedness and preferred stock and effectively subordinated to all the indebtedness and other non-common equity claims against our subsidiaries.

•Our articles of incorporation, bylaws, and certain banking laws may have an anti-takeover effect.

•An investment in our common stock is not an insured deposit.

•An entity holding as little as a 5% interest in our outstanding common stock could, under certain circumstances, be subject to regulation as a "bank holding company."

•Our ability to originate residential mortgage loans for portfolio has been adversely affected by the increased competition

resulting from the unprecedented involvement of the U.S. government and GSEs in the residential mortgage market.

General Risk Factors

•Changes in our accounting policies or in accounting standards could materially affect how we report our financial results.

•Our internal controls may be ineffective.

•We may not be able to attract and retain skilled people.

•Loss of key employees may disrupt relationships with certain customers.

PART I

ITEM 1. Business

General

Associated Banc-Corp is a bank holding company registered pursuant to the BHC Act. Our bank subsidiary, Associated Bank, traces its history back to the founding of the Bank of Neenah in 1861. We were incorporated in Wisconsin in 1964 and were inactive until 1969 when permission was received from the Federal Reserve to acquire three banks. At December 31, 2023, we owned one nationally chartered commercial bank headquartered in Green Bay, Wisconsin, which serves local communities across the upper Midwest, one nationally chartered trust company headquartered in Milwaukee, Wisconsin, and 12 limited purpose banking and nonbanking subsidiaries either located in or conducting business primarily in our three state branch footprint (Wisconsin, Illinois, and Minnesota) that are closely related or incidental to the business of banking or financial in nature. Measured by total assets reported at December 31, 2023, we are the largest bank holding company headquartered in Wisconsin.

Services

Through Associated Bank and various nonbanking subsidiaries, we provide a broad array of banking and nonbanking products and services to individuals and businesses through 196 banking branches at December 31, 2023, serving more than 100 communities, primarily within our three-state branch footprint. Our business is primarily relationship-driven and is organized into three reportable segments: Corporate and Commercial Specialty; Community, Consumer, and Business; and Risk Management and Shared Services.

See Note 21 Segment Reporting of the notes to consolidated financial statements in Part II, Item 8, Financial Statements and Supplementary Data, for additional information concerning our reportable segments.

We are not dependent upon a single or a few customers, the loss of which would have a material adverse effect on us.

3

Human Capital Matters

We are very fortunate to have a diverse, committed team of approximately 4,100 colleagues at December 31, 2023 who are capable, determined and empowered to drive our company forward. None of our colleagues are represented by unions.

Talent Acquisition, Development, and Retention: We believe attracting and retaining diverse talent in a highly competitive candidate market fuels our ability to serve our customers and support our communities. We are focused on sourcing talent from all backgrounds through engagement with workforce development programs, partnerships with diverse organizations, and active campus recruitment. As a result, we were able to hire nearly 750 external candidates in 2023. At the same time, in 2023, we had low voluntary turnover of 12% while 20% of colleagues advanced their careers at the Corporation through nearly 850 internal promotions or lateral moves. At December 31, 2023, the average tenure of our workforce was 8.5 years while the average tenure of our executive leadership team was 11.0 years.

Through internal and external training and development programs, we aim to help our colleagues improve their skills so they can achieve their career goals and transition to more challenging roles.

•Beginning in 2023, the Corporation initiated individual development plans for all colleagues designed to enhance colleague development, growth and career pathing through identification of career interests, and detailed action plans focused on development areas.

•In 2023, we introduced significant training and resources for development and career planning to include workshops for both leaders and colleagues. During the last six months of the year, we completed nearly 110 individual career coaching sessions and offered 30 hours of workshops to assist people in creating meaningful development plans.

•Since inception of the mentorship program in 2022, the program has logged nearly 1,950 self-reported hours as of January 31, 2024. In 2023, we added a third program aimed at successfully onboarding new leaders.

Colleague Engagement: By strengthening our workforce and providing opportunities for all colleagues to apply their talent and grow as professionals, we strive to foster pride in working for Associated and to be recognized as the employer of choice among Midwestern financial services firms. During 2023, many of our colleagues and community members responded to and recognized our efforts:

•Colleague engagement is a focus for our company. During 2023, 92% of our colleagues provided feedback through an annual workplace survey conducted by a third-party on key topics related to the overall health and culture of the organization. The survey respondent percentage is well above the average response rate for commercial banks. For the seventh year in a row, we received more than 8,000 colleague comments, including more than 9,000 in 2023, which we believe demonstrates that colleagues are interested in, and comfortable with, sharing candid feedback.

•Associated Bank continues to be recognized as a Top Workplace. In 2023, we earned the Top Workplaces USA Award for the fourth consecutive year. Regionally, Associated Bank was named a Top Workplaces 2023 award winner in Chicago, Milwaukee and Southeast Wisconsin, and the Greater Madison area. Associated Bank also received Top Workplaces 2023 for Professional Development, Employee Appreciation, Employee Well-Being, Leadership, Innovation, Compensation & Benefits, Work-Life Flexibility, and Financial Services. The Top Workplace awards are issued by Energage.

Health and Well-being: We are pleased to support total health and well-being through a variety of benefits, programs, activities, and educational opportunities throughout the year. Our dedicated Total Well-being team provides free and confidential health coaching while a 24/7/365 Employee Assistance Program (EAP) provides access to complimentary counseling services, financial coaching, and a variety of additional resources to support the unique needs of our colleagues and their families (e.g. elder, adult, child, family support and legal services). Additionally, our comprehensive Total Well-being platform provides all colleagues with an opportunity to earn incentives throughout the year for participating in activities, challenges, and educational opportunities. As of December 31, 2023:

•Nearly 3,000 colleagues and spouses participated in an annual wellness visit with a primary care provider.

•Nearly 1,725 colleagues received a well-being reimbursement for the purchase of items such as gym memberships, home fitness equipment, and/or fitness tracking devices. The total value for well-being reimbursements was nearly $320,000.

•Nearly 1,200 colleagues earned an incentive through our Total Well-being platform totaling over $130,000.

Market-based Pay and Rewards: We regularly review our pay and benefits programs so that we are offering a total compensation package, including salary, incentive opportunities, and benefits that we believe is fair, equitable, and competitive in our marketplace.

4

Culture: We believe our success begins and ends with people. For this reason, fostering a culture where people feel valued, respected, and comfortable sharing ideas and perspectives is a core focus of the Corporation. Our culture is anchored in the belief that we are better together, and great ideas can come from anywhere in the Corporation. During 2021, the Corporation launched our Associated Culture Team, with the intent to have approximately 12 colleagues representing diverse business lines, positions, and geographies across the Corporation. The team's purpose is to provide a voice for colleague feedback regarding current and desired states of our corporate culture.

Diversity, Equity and Inclusion: Our DE&I efforts focus on shared commitment and action across business lines to foster a culture of belonging and inclusion among our colleagues. Our efforts extend to our markets by strengthening our DE&I efforts in our relationships with customers and the communities that we live in and serve. These efforts are supported by the work of our seven Colleague Resource Groups and the members that drive actions and events. These groups, which are open to all employees, help to drive greater organizational awareness and work to address the unique needs of people of different cultures and underrepresented groups not limited to, but including, people of color, young professionals, women, veterans, LGBTQ+, and people with disabilities.

Further, we feel a critical component of our success is our ability to recognize and value diversity while promoting inclusion, both internally and in the communities we serve.

As of December 31, 2023, as a result of these efforts, our colleague representation is as follows:

•People of color represented 18%, protected veterans represented 2%, people with disabilities represented 11%, and women represented 62% of our total workforce.

•We continue to advance representation from all backgrounds at all levels across our organization. At year end, women and people of color represented 65% of all Assistant Vice President roles and women represented 31% of all Senior Vice President roles.

•In addition, 40% of both our Executive Leadership Team and Board of Directors are represented by women and people of color.

We continue to develop and implement programs to support DE&I:

•All colleagues participate in annual DE&I training and have the opportunity to attend a multitude of educational speaker events, workshops, and webinars on various DE&I related topics. Topics include, but are not limited to, educating on different lived experiences, determining factors that promote inclusion, benefits of having a diverse workforce, and the importance of having an intentional focus on hiring and retaining groups from different backgrounds. Additionally, sessions are offered specifically to leaders on topics such as cultural competency and interrupting bias to further promote inclusive leadership.

•We have an Associated Bank Honors Program that includes a wide range of veteran-focused initiatives in an effort to reach and recruit military veterans while helping support our military connected customers, colleagues, and communities.

In 2023, we used our expertise to provide loans and investments as well as financial support to:

•Promote affordable housing,

•Provide small business lending, and

•Advance neighborhood development through philanthropic support.

These initiatives and investments create opportunities for individuals, families, and businesses to fully participate in and share the rewards of building economic stability in our communities. Our work with Community Advisory Councils based in Illinois, Wisconsin, and Minnesota focuses on identifying and addressing systemic economic development and equity issues.

Our DE&I efforts have been recognized in 2023 by our communities as follows:

•Associated Bank was recognized with a top score of 100 on the Human Rights Campaign Foundation's 2023 Corporate Equality Index and recognized as a Leader in LGBTQ+ Workplace Inclusion.

•Recognized as a 2023 Best Places to Work for Disability Inclusion from Disability:IN Disability Equality Index®.

•Associated Bank continues to be recognized as a Best for Vets employer from Military Times for the seventh consecutive year.

5

Competition

The financial services industry is highly competitive. We compete for loans, deposits, and financial services in all of our principal markets. We compete directly with other bank and nonbank institutions located within our markets, internet-based banks, out-of-market banks and bank holding companies that advertise or otherwise serve our markets, money market funds and other mutual funds, brokerage houses, and various other financial institutions. Additionally, we compete with insurance companies, leasing companies, regulated small loan companies, credit unions, governmental agencies, and commercial entities offering financial services products, including nonbank lenders and financial technology companies. Competition involves, among other things, efforts to retain current customers and to obtain new loans and deposits, the scope and types of services offered, interest rates paid on deposits and charged on loans, as well as other aspects of banking. We also face direct competition from subsidiaries of bank holding companies that have far greater assets and resources than ours.

Supervision and Regulation

Overview

The Corporation and its banking and nonbanking subsidiaries are subject to extensive regulation and oversight both at the federal and state levels. The following is an overview of the statutory and regulatory framework that affects the business of the Corporation and our subsidiaries.

BHC Act Requirements

As a registered bank holding company under the BHC Act, we are regulated, supervised, and examined by the Federal Reserve. In connection with applicable requirements, bank holding companies file periodic reports and other information with the Federal Reserve. The BHC Act also governs the activities that are permissible for bank holding companies and their affiliates and permits the Federal Reserve, in certain circumstances, to issue cease and desist orders and other enforcement actions against bank holding companies and their nonbanking affiliates to correct and curtail unsafe or unsound banking practices. Under the Dodd-Frank Act and longstanding Federal Reserve policy, bank holding companies are required to act as a source of financial strength to each of their banking subsidiaries pursuant to which such holding company may be required to commit financial resources to support such subsidiaries in circumstances when, absent such requirements, they might not otherwise do so. The BHC Act further regulates holding company activities, including requirements and limitations relating to capital, transactions with officers, directors and affiliates, securities issuances, dividend payments, inter-affiliate liabilities, extensions of credit, and expansion through mergers and acquisitions.

The BHC Act allows certain qualifying bank holding companies that elect treatment as “financial holding companies” to engage in activities that are financial in nature and that explicitly include the underwriting and sale of insurance. The Parent Company thus far has not elected to be treated as a financial holding company. Bank holding companies that have not elected such treatment generally must limit their activities to banking activities and activities that are closely related to banking.

Regulation of Associated Bank and Trust Company Subsidiaries

Associated Bank and our nationally-chartered trust company subsidiary are regulated, supervised and examined by the OCC. The OCC has primary supervisory and regulatory authority over the operations of Associated Bank and the Corporation's trust company subsidiary. As part of this authority, Associated Bank and our trust company subsidiary are required to file periodic reports with the OCC and are subject to regulation, supervision and examination by the OCC. To support its supervisory function, the OCC has the authority to assess and charge fees on all national banks according to a set fee schedule. On December 1, 2023, the OCC published its assessment rates for the 2024 calendar year. The OCC elected to maintain its general assessment schedule from 2023 with no adjustments for inflation.

Associated Bank, our only subsidiary that accepts insured deposits, is also subject to examination by the FDIC. We are subject to the enforcement and rule-making authority of the CFPB regarding consumer financial products. The CFPB has the authority to create and enforce consumer protection rules and regulations and has the power to examine us for compliance with such rules and regulations. The CFPB also has the authority to prohibit “unfair, deceptive or abusive” acts and practices. The CFPB has examination and enforcement authority over all banks with more than $10 billion in assets, such as the Bank.

Standards for Safety and Soundness

The federal banking agencies have adopted the Interagency Guidelines for Establishing Standards for Safety and Soundness (the “Guidelines”). The Guidelines establish certain safety and soundness standards for all depository institutions. The operational and managerial standards in the Guidelines relate to the following: (1) internal controls and information systems; (2) internal audit systems; (3) loan documentation; (4) credit underwriting; (5) interest rate exposure; (6) asset growth; (7)

6

compensation, fees and benefits; (8) asset quality; and (9) earnings. Rather than providing specific rules, the Guidelines set forth basic compliance considerations and guidance with respect to a depository institution. Failure to meet the standards in the Guidelines, however, could result in a request by the OCC for a written compliance plan to demonstrate efforts to come into compliance with such Guidelines. Failure to provide and implement a plan requires the appropriate federal banking agency to issue an order to the institution requiring compliance.

Corporate and Risk Governance

We are required as a supervisory matter to implement an effective corporate and risk governance framework commensurate with our size, complexity and risk profile. Fundamental components of this framework include the authorities and responsibilities of directors and senior managers to govern the operations and structure of the Corporation and the Bank, as well as the implementation and management of systems and processes designed to identify, measure, monitor and control the risks to the organization, specifically including strategic, reputation, compliance and operational risks.

Corporate and risk governance oversight is a core supervisory function of the federal banking agencies, including the OCC. National banks with at least $50 billion in total assets are subject to prescribed standards for the implementation of risk governance frameworks addressing credit risk, interest rate risk, liquidity risk, price risk, operational risk, compliance risk, strategic risk, and reputation risks. Additionally, on October 11, 2023, the FDIC issued a proposed rule and guidelines that would require all FDIC-supervised IDIs with total assets of $10 billion or more to adopt heightened corporate governance and risk management standards pursuant to which covered institutions would be required to develop and implement a comprehensive and independent risk management function and effective programs for internal controls, risk management, and audits. The prospects and timing for the adoption by the FDIC of a final rule are not certain at this time.

Although the Bank presently is not subject to the existing OCC risk governance standards for larger banks based on its current asset size, and the Bank, as a national bank supervised by the OCC, is not within the scope of the FDIC’s proposed rule, certain expectations set forth in existing and proposed regulatory guidelines may be imposed upon the Bank in the ordinary course of supervision and examination.

Further, the federal banking agencies have in recent years increased their focus on banks’ third-party risk management controls and practices. On June 6, 2023, the federal banking agencies, including the OCC, adopted interagency guidance on risk management of third-party relationships. The guidance applies broadly to any business agreement between a banking organization and another entity, by contract or otherwise (including affiliated entities), and it requires banking organizations to analyze the risks associated with each third-party relationship and establish effective governance and risk management processes for all stages of a third-party relationship, including planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination. See Item 1A, Risk Factors — Operational Risks for additional discussion of this topic.

Banking Acquisitions

We are required to obtain prior Federal Reserve approval before acquiring more than 5 percent of the voting shares, or substantially all of the assets, of a bank holding company, bank or savings association. In addition, the prior approval of the OCC is required for a national bank to merge with another bank or purchase the assets or assume the deposits of another bank. In determining whether to approve a proposed bank acquisition, federal bank regulators will consider, among other factors, the effect of the acquisition on competition, the public benefits expected to be received from the acquisition, the projected capital ratios and levels on a post-acquisition basis, and the acquiring institution’s record of addressing the credit needs of the communities it serves, including the needs of LMI neighborhoods, consistent with the safe and sound operation of the bank, under the CRA.

In July of 2021, President Biden issued an Executive Order on Promoting Competition in the American Economy. Among other initiatives, the Executive Order encouraged the federal banking agencies to review their current merger oversight practices under the BHC Act and the Bank Merger Act and adopt a plan for revitalization of such practices. In response, on March 25, 2022, the FDIC issued a request for information on the effectiveness of the existing framework for evaluating bank mergers and acquisitions under the FDI Act with particular focus on the increase in asset concentration among banking organizations with more than $100 billion in total assets. Further, the FTC and DOJ jointly released the 2023 Draft Merger Guidelines for public comment to strengthen the agencies’ oversight over mergers that would violate the federal antitrust laws. If adopted as proposed in draft form, the Merger Guidelines would substantially modify the existing regulatory framework for merger enforcement. It is not yet clear what effect, if any, the draft Merger Guidelines will have on the federal banking agencies as they consider revising the requirements for mergers involving banks and bank holding companies. The timing and prospects for the formal adoption by the federal banking agencies of modified regulatory standards for the evaluation of bank mergers and acquisitions is uncertain at this time. See Item 1A, Risk Factors — Operational Risks for additional discussion of this topic.

7

Banking Subsidiary Dividends

The Parent Company is a legal entity separate and distinct from the Bank and other nonbanking subsidiaries. A substantial portion of our cash flow comes from dividends paid to us by Associated Bank. The OCC’s prior approval of the payment of dividends by Associated Bank to the Parent Company is required only if the total of all dividends declared by the Bank in any calendar year exceeds the sum of the Bank’s retained net income for that year and its retained net income for the preceding two calendar years, less any required transfers to surplus. Federal law also prohibits national banks from paying dividends that would be greater than the bank’s undivided profits after deducting statutory bad debt in excess of the bank’s allowance for loan losses. In addition, under the FDICIA, an IDI, such as the Bank, is prohibited from making capital distributions, including the payment of dividends, if, after making such distribution, the institution would become “undercapitalized” (as such term is used in the FDICIA).

Holding Company Dividends

In addition, we and the Bank are subject to various general regulatory policies and requirements relating to the payment of dividends, including requirements to maintain adequate capital above regulatory minimums. The appropriate federal regulatory authority is authorized to determine under certain circumstances relating to the financial condition of a bank or bank holding company that the payment of dividends would be an unsafe or unsound practice and to prohibit payment thereof. Under the Dodd-Frank Act and the requirements of the Federal Reserve, the Parent Company, as a bank holding company, is required to serve as a source of financial strength to the Bank and to commit resources to support the Bank. In addition, consistent with its “source of strength” policy, the Federal Reserve has stated that, as a matter of prudent banking, a bank holding company should not maintain a level of cash dividends to its shareholders that places undue pressure on the capital of its bank subsidiaries, or that can be funded only through additional borrowings or other arrangements that may undermine the bank holding company’s ability to serve as a source of strength. The appropriate federal regulatory authorities have indicated that paying dividends that deplete a bank’s capital base to an inadequate level would be an unsafe and unsound banking practice and that banking organizations should generally pay dividends only out of current operating earnings.

Capital Requirements

We are subject to various regulatory capital requirements both at the Parent Company and at the Bank level administered by the Federal Reserve and the OCC, respectively. Failure to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators that, if undertaken, could have an adverse material effect on our financial condition and results of operations. Under capital adequacy guidelines and the regulatory framework for prompt corrective action (described below), we must meet specific capital guidelines that involve quantitative measures of our assets, liabilities, and certain off-balance sheet items as calculated under regulatory accounting policies. Our capital amounts and classification are also subject to judgments by the regulators regarding qualitative components, risk weightings, and other factors. We have consistently maintained regulatory capital ratios at or above the well capitalized standards.

The Federal Reserve, the OCC and the FDIC have adopted risk-based capital regulations implementing certain provisions of the Dodd-Frank Act and Basel III. The agencies’ previous capital regulations were amended in 2013 following the enactment of the Dodd-Frank Act to strengthen the components of regulatory capital, increase risk-based capital requirements, and make selected changes to the calculation of risk-weighted assets. In general, subject to certain exceptions as discussed further below, minimum capital standards established under the risk-based capital regulations include a CET1 capital to risk-weighted assets ratio of 4.5 percent, a Tier 1 capital to risk-weighted assets ratio of 6.0 percent, a total capital to risk-weighted assets ratio of 8.0 percent, and a Tier 1 capital to adjusted average total assets leverage ratio of 4.0 percent. In determining the amount of risk-weighted assets for purposes of calculating risk-based capital ratios, all assets, including certain off-balance sheet assets (for example, recourse obligations, direct credit substitutes and residual interests) are multiplied by a risk-weight factor assigned by the regulations based on the risks believed inherent in the type of asset. Higher levels of capital are required for asset categories believed to present greater risk. CET1 capital is generally defined as common shareholders’ equity and retained earnings. Tier 1 capital is generally defined as CET1 and additional Tier 1 capital. Additional Tier 1 capital includes certain noncumulative perpetual preferred stock and related surplus and minority interests in equity accounts of consolidated subsidiaries. Total capital includes Tier 1 capital (CET1 capital plus additional Tier 1 capital) and Tier 2 capital. Tier 2 capital is comprised of capital instruments and related surplus, meeting specified requirements, and may include cumulative preferred stock and long-term perpetual preferred stock, mandatory convertible securities, intermediate preferred stock and subordinated debt. Also included in Tier 2 capital is the allowance for credit losses limited to a maximum of 1.25 percent of risk-weighted assets. Calculation of all types of regulatory capital is subject to deductions and adjustments specified in the regulations. In assessing an institution’s capital adequacy, the OCC takes into consideration not only these numeric factors, but qualitative factors as well, and has the authority to establish higher capital requirements for individual institutions where deemed necessary.

8

In addition to establishing the minimum regulatory capital requirements, the capital regulations limit capital distributions and certain discretionary bonus payments to management if the institution does not hold a capital conservation buffer consisting of 2.5 percent of CET1 capital to risk-weighted assets above the amount necessary to meet its minimum risk-based capital requirements.

Through subsequent rulemaking, the federal banking agencies provided certain forms of relief to banking organizations that are not subject to the capital regulation's advanced approaches, such as the Corporation. For instance, non-advanced approaches institutions are subject to simpler regulatory capital requirements for MSAs, certain DTAs arising from temporary differences, investments in the capital of unconsolidated financial institutions, and requirements for the amount of capital issued by a consolidated subsidiary of a banking organization and held by third parties (sometimes referred to as a minority interest) that is includable in regulatory capital.

Specifically, such institutions may deduct from CET1 capital any amount of MSAs, temporary difference DTAs, and investments in the capital of unconsolidated financial institutions that individually exceeds 25 percent of CET1 capital.

On July 27, 2023, the federal banking agencies issued a proposed rule to implement the final components of the Basel III standards set by the Basel Committee on Banking Supervision in 2017. The proposed rule, which would not apply to the Corporation and the Bank as proposed, would substantially revise the existing regulatory capital framework for institutions with $100 billion or more of assets. See Item 1A, Risk Factors — Legal, Regulatory, Compliance and Reputational Risks for additional discussion of this topic.

We continue to exceed all capital requirements necessary to be deemed “well-capitalized” for all regulatory purposes under the capital regulations. For further detail on capital and capital ratios, see discussion under the Liquidity and Capital sections under Part II, Item 7, Management's Discussion and Analysis of Financial Condition and Results of Operations, and under Part II, Item 8, Financial Statements and Supplementary Data, Note 19 Regulatory Matters of the notes to consolidated financial statements.

Current Expected Credit Loss Treatment

In June 2016, the FASB issued an accounting standard update, “Financial Instruments-Credit Losses (Topic 326), Measurement of Credit Losses on Financial Instruments,” which replaced the “incurred loss” model for recognizing credit losses with an “expected loss” model referred to as the CECL model. Under the CECL model, we are required to present certain financial assets carried at amortized cost, such as loans held for investment and HTM securities, at the net amount expected to be collected. The measurement of expected credit losses is to be based on information about past events, including historical experience, current conditions, and reasonable and supportable forecasts that affect the collectability of the reported amount. On December 21, 2018, the federal banking agencies approved a final rule modifying their regulatory capital rules and providing an option to phase in over a period of three years the day-one regulatory capital effects of the CECL model. The final rule also revises the agencies’ other rules to reflect the update to the accounting standards. The final rule took effect April 1, 2019. However, on August 26, 2020, the federal bank regulatory agencies issued a final rule that provided institutions that had adopted the CECL accounting standard in 2020 with the option to mitigate the estimated capital effects of CECL for two years, followed by a three-year transition period. Taken together, these measures offer institutions a transition period of up to five years. The Corporation elected to utilize the 2020 Capital Transition Relief as permitted under applicable regulations. As a result, the three-year phase-out period described above commenced in 2022.

Capital Planning and Stress Testing Requirements

As part of the regulatory relief provided by the Economic Growth Act, the asset threshold requiring IDIs to conduct and report to their primary federal bank regulators annual company-run stress tests, as well as to comply with leverage limits, liquidity requirements, and resolution planning requirements, was raised from $10 billion to $250 billion in total consolidated assets and the stress testing requirement was made “periodic” rather than annual. As a result of the legislation and related OCC rulemaking thereunder, the Bank is no longer subject to Dodd-Frank Act stress testing requirements. The Economic Growth Act also provided that bank holding companies under $100 billion in assets were no longer subject to stress testing requirements. The amended regulations also provide the Federal Reserve with discretion to subject bank holding companies with more than $100 billion in total assets to enhanced supervision. In addition, Section 214 of the Economic Growth Act and its implementing regulation prohibit the federal banking agencies from requiring the Bank to assign a heightened risk weight to certain HVCRE ADC loans as previously required under the Basel III Capital Rules. Notwithstanding these regulatory amendments, the federal banking agencies indicated through interagency guidance that the capital planning and risk management practices of institutions with total assets less than $100 billion would continue to be reviewed through the regular supervisory process. Although the Corporation will continue to monitor and stress test its capital consistent with the safety and soundness expectations of the

9

federal regulators, the Corporation no longer publishes stress testing results as a result of the legislative and regulatory amendments.

Enforcement Powers of the Federal Banking Agencies; Prompt Corrective Action

The Federal Reserve, the OCC, and the CFPB have extensive supervisory authority over their regulated institutions, including, among other things, the power to compel higher reserves, the ability to assess civil money penalties, the ability to issue cease-and-desist or removal orders and the ability to initiate injunctive actions. In general, these enforcement actions may be initiated for violations of laws and regulations or for unsafe or unsound banking practices. Other actions or inactions by the Parent Company may provide the basis for enforcement action, including misleading or untimely reports.

Federal banking regulators are authorized and, under certain circumstances, required to take certain actions against banks that fail to meet their capital requirements. The federal banking agencies have additional enforcement authority with respect to undercapitalized depository institutions.

“Well capitalized” institutions may generally operate without supervisory restriction. “Adequately capitalized” institutions cannot normally pay dividends or make any capital contributions that would leave them undercapitalized; they cannot pay a management fee to a controlling person if, after paying the fee, they would be undercapitalized; and they cannot accept, renew or roll over any brokered deposit unless the bank has applied for and been granted a waiver by the FDIC.

The federal banking agencies are required to take action to restrict the activities of an “undercapitalized,” “significantly undercapitalized,” or “critically undercapitalized” IDI. Any such bank must submit a capital restoration plan that is guaranteed by the parent holding company. Until such plan is approved, it may not increase its assets, acquire another institution, establish a branch or engage in any new activities, and generally may not make capital distributions. In certain situations, a federal banking agency may reclassify a well-capitalized institution as adequately capitalized and may require an adequately capitalized or undercapitalized institution to comply with supervisory actions as if the institution were in the next lower category.

Institutions must file a capital restoration plan with the OCC within 45 days of the date it receives a notice from the OCC that it is “undercapitalized,” “significantly undercapitalized,” or “critically undercapitalized.” Compliance with a capital restoration plan must be guaranteed by a parent holding company. In addition, the OCC is permitted to take any one of a number of discretionary supervisory actions, including but not limited to the issuance of a capital directive and the replacement of senior executive officers and directors.

Finally, bank regulatory agencies have the ability to impose higher than normal capital requirements known as individual minimum capital requirements for institutions with a high-risk profile.

At December 31, 2023, the Bank satisfied the capital requirements necessary to be deemed “well-capitalized.” In the event of a change to this status, the imposition of any of the measures described above could have a material adverse effect on the Corporation and on its profitability and operations. The Corporation’s shareholders do not have preemptive rights and, therefore, if the Corporation is directed by the OCC or the FDIC to issue additional shares of common stock, such issuance may result in dilution in shareholders’ percentage of ownership of the Corporation.

Deposit Insurance Premiums

Associated Bank is a member of the FDIC and pays an insurance premium to the FDIC based upon its assessment rates on a quarterly basis. Deposits are insured up to applicable limits by the FDIC and such insurance is backed by the full faith and credit of the United States Government.

Under the Dodd-Frank Act, a permanent increase in deposit insurance was authorized to $250,000 per depositor, per IDI for each account ownership category.

The Dodd-Frank Act also set the minimum DIF reserve ratio at 1.35 percent of estimated insured deposits. The FDIC was required to attain this ratio by September 30, 2020. The Dodd-Frank Act also required the FDIC to define the deposit insurance assessment base for an IDI as an amount equal to the institution’s average consolidated total assets during the assessment period minus average tangible equity. The assessment rate schedule for larger institutions like Associated Bank (i.e., institutions with at least $10 billion in assets) differentiates between such large institutions by use of a “scorecard” that combines an institution’s CAMELS ratings with certain forward-looking financial information to measure the risk to the DIF. Pursuant to this “scorecard” method, two scores (a performance score and a loss severity score) will be combined and converted to an initial base assessment rate. The performance score measures an institution’s financial performance and ability to withstand stress. The loss severity score measures the relative magnitude of potential losses to the DIF in the event of the institution’s failure.

10

Total scores are converted pursuant to a predetermined formula into an initial base assessment rate. Assessment rates range from 2.5 bp to 45 bp for large institutions.

The FDIC has the flexibility to adopt actual rates that are higher or lower than the total base assessment rates adopted without notice and comment, if certain conditions are met.

On October 18, 2022, the FDIC adopted a final rule, applicable to all IDIs, to increase base deposit insurance assessment rate schedules uniformly by 2 bp beginning in the first quarterly assessment period of 2023. The increase was instituted to account for extraordinary growth in insured deposits during the first and second quarters of 2020, which caused a substantial decrease in the DIF reserve ratio. The FDIC indicated that the new assessment rate schedules will remain in effect until the DIF reserve ratio meets or exceeds 2 percent.

Further, on November 16, 2023, the FDIC issued a final rule to implement a special assessment to recover the loss to the DIF associated with protecting uninsured depositors following the closure of SVB and SBNY. Under the final rule, the assessment base for an IDI will be equal to the institution’s estimated uninsured deposits as of December 31, 2022, adjusted to exclude the first $5 billion in estimated uninsured deposits. Under the final rule, the FDIC will collect the special assessment at an annual rate of 13.4 bp beginning with the first quarterly assessment period of 2024 and will continue to collect special assessments for an anticipated total of eight quarterly assessment periods. At December 31, 2023, our estimated level of uninsured deposits is $14.8 billion. See Item 1A, Risk Factors — Legal, Regulatory, Compliance and Reputational Risks for additional discussion of this topic.

DIF-insured institutions pay a FICO assessment in order to fund the interest on bonds issued in the 1980s in connection with the failures in the thrift industry. The FICO assessment was computed on assets as required by the Dodd-Frank Act. These assessments continued until the bonds matured in September 2019. The Corporation’s assessment rate for FDIC was approximately 9 bp for 2023.

The FDIC is authorized to conduct examinations of and require reporting by FDIC-insured institutions. It is also authorized to terminate a depository bank’s deposit insurance upon a finding by the FDIC that the bank’s financial condition is unsafe or unsound or that the institution has engaged in unsafe or unsound practices or has violated any applicable rule, regulation, order or condition enacted or imposed by the bank’s regulatory agency. The termination of deposit insurance for our national bank subsidiary would have a material adverse effect on our earnings, operations and financial condition.

Historically, deposit insurance premiums we have paid to the FDIC have been deductible for federal income tax purposes; however, the Tax Act disallows the deduction of such premium payments for banking organizations with total consolidated assets of $50 billion or more. For banks with less than $50 billion in total consolidated assets, such as ours, the premium deduction is phased out based on the proportion of a bank’s assets exceeding $10 billion.

Brokered Deposits

Section 29 of the FDI Act and FDIC regulations thereunder limit the ability of an IDI, such as the Bank, to accept, renew or roll over brokered deposits unless the institution is well-capitalized under the prompt corrective action framework described above, or unless it is adequately capitalized and obtains a waiver from the FDIC. In addition, less than well-capitalized banks are subject to restrictions on the interest rates they may pay on deposits. The characterization of deposits as "brokered" may result in the imposition of higher deposit assessments on such deposits. As mandated by the Economic Growth Act, the FDIC adopted a final rule in February 2019 to include a limited exception for reciprocal deposits for FDIC-IDIs that are well rated and well capitalized (or adequately capitalized and have obtained a waiver from the FDIC as mentioned above). Under the limited exception, qualified FDIC-IDIs, like the Bank, are able to except from treatment as "brokered" deposits up to $5 billion or 20 percent of the institution's total liabilities in reciprocal deposits (which is defined as deposits received by a financial institution through a deposit placement network with the same maturity (if any) and in the same aggregate amount as deposits placed by the institution in other network member banks).

In December of 2020, the FDIC issued a final rule amending its brokered deposits regulation. The final rule sought to clarify and modernize the FDIC's regulatory framework for brokered deposits. Notable aspects of the rule include (1) the establishment of bright-line standards for determining whether an entity meets the statutory definition of "deposit broker"; (2) the identification of a number of business relationships in which the agent of nominee is automatically not deemed to be a "deposit broker" because their primary purpose is not the placement of funds with depository institutions (the "primary purpose exception"); (3) the establishment of a more transparent application process for entities that seek the "primary purpose exception", but do not qualify as one of the identified business relationships to which the exception is automatically applicable; and (4) the clarification that third parties that have an exclusive deposit-placement arrangement with only one IDI are not considered a "deposit broker." Full compliance with the amended brokered deposits regulation was required by January 1, 2022.

11

The FDIC staff continues to implement the final rule through the issuance of interpretative guidance and other administrative actions.

Transactions with Affiliates and Insiders

Transactions between our national banking subsidiary and its related parties or any affiliate are governed by Sections 23A and 23B of the Federal Reserve Act. An affiliate is any company or entity, which controls, is controlled by or is under common control with the bank. In a holding company context, at a minimum, the parent holding company of a national bank, and any companies that are controlled by such parent holding company, are affiliates of the bank. Generally, Sections 23A and 23B (i) limit the extent to which an institution or its subsidiaries may engage in “covered transactions” with any one affiliate to an amount equal to 10 percent of such institution’s capital stock and surplus, and contain an aggregate limit on all such transactions with all affiliates to an amount equal to 20 percent of such capital stock and surplus, and (ii) require that all such transactions be on terms substantially the same, or at least as favorable, to the institution or subsidiary as those provided to a nonaffiliate. The term “covered transaction” includes the making of loans, purchase of assets, issuance of a guarantee and similar types of transactions. Certain types of covered transactions must be collateralized according to a schedule set forth in the statute based on the type of collateral.

Certain transactions with our directors, officers or controlling persons are also subject to conflicts of interest regulations. Among other things, these regulations require that loans to such persons and their related interests be made on terms substantially the same as for loans to unaffiliated individuals and must not create an abnormal risk of repayment or other unfavorable features for the financial institution. See Note 4 Loans of the notes to consolidated financial statements in Part II, Item 8, Financial Statements and Supplementary Data, for additional information on loans to related parties.

Community Reinvestment Act Requirements

Associated Bank is subject to periodic CRA reviews by the OCC. The CRA does not establish specific lending requirements or programs for financial institutions and does not limit the ability of such institutions to develop products and services believed best-suited for a particular community. An institution’s CRA assessment may be used by its regulators in their evaluation of certain applications, including a merger, acquisition or the establishment of a branch office. An unsatisfactory rating may be used as the basis for denial of such an application. The Bank received a “Satisfactory” CRA rating in its most recent evaluation.

On October 24, 2023, the federal banking agencies jointly issued a final rule to strengthen and modernize the existing CRA regulations. Under the final rule, the agencies will evaluate a bank’s CRA performance based upon the varied activities that it conducts and the communities in which it operates. CRA evaluations and data collection requirements will be tailored based on bank size and type. The Bank would be considered a large bank with assets of greater than $10 billion under the final rule and therefore will be evaluated under new lending, retail services and products, community development financing, and community development services tests. The final rule includes CRA assessment areas associated with mobile and online banking, and new metrics and benchmarks to assess retail lending performance. In addition, the final rule emphasizes smaller loans and investments that can have a high impact and be more responsive to the needs of LMI communities. The final rule will take effect on April 1, 2024; however, compliance with the majority of the final rule's provisions will not be required until January 1, 2026, and the data reporting requirements of the final rule will not take effect until January 1, 2027.

Privacy, Data Protection, and Cybersecurity

We are subject to a number of U.S. federal, state, local and foreign laws and regulations relating to consumer privacy and data protection. Under privacy protection provisions of the GLBA and its implementing regulations and guidance, we are limited in our ability to disclose certain non-public information about consumers to nonaffiliated third parties. Financial institutions, such as the Bank, are required by statute and regulation to notify consumers of their privacy policies and practices and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a nonaffiliated third party. In addition, such financial institutions must appropriately safeguard their customers’ nonpublic, personal information. Consumers and, in some instances, state and federal regulators, must be notified in the event of a data breach under applicable state laws and federal regulations.

The changing privacy laws in the United States, Europe and elsewhere create new individual privacy rights and impose increased obligations on companies handling personal information, including the CCPA, as amended by the CPRA. While GLBA-regulated nonpublic, personal information generally is exempt under the CCPA (as well as the other state consumer privacy laws), the CCPA and certain other state laws apply to the personal information of representatives of any business contacts that the Bank engages with who are California residents, employees who are California residents, and any other personal information that the Bank collects outside of the scope of GLBA, such as with respect to certain data collected from visitors to our website.

12

In addition, multiple states, Congress and regulators within and outside of the United States are considering similar laws or regulations which could create new individual privacy rights and impose increased obligations on companies handling personal information, specifically including financial institutions.

The federal banking agencies, including the OCC, have issued a rule imposing cybersecurity notification requirements for banking organizations and their service providers. Specifically, the rule requires banking organizations to notify their primary federal regulator as soon as possible and no later than 36 hours after the discovery of a "computer-security incident" that rises to the level of a "notification incident," as those terms are defined under the final rule. Banks' service providers are required under the rule to notify any affected bank to or on behalf of which the service provider provides services "as soon as possible" after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for as much as four hours.

The federal banking agencies have also adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of the board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services. Moreover, recent cyberattacks against banks and other financial institutions that resulted in unauthorized access to confidential customer information have prompted the federal banking regulators to issue more extensive guidance on cybersecurity risk management. Among other things, financial institutions are expected to design multiple layers of security controls to establish lines of defense and ensure that their risk management processes address the risks posed by compromised customer credentials, including security measures to authenticate customers accessing internet-based services. A financial institution also should have a robust business continuity program to recover from a cyberattack and procedures for monitoring the security of third-party service providers that may have access to nonpublic data at the institution. See Item 1A, Risk Factors — Operational Risks for additional discussion of this topic.

Additionally, recent and ongoing developments may impact our data security- and privacy-related internal controls and risk profile. On October 19, 2023, the CFPB announced a proposed rule to adopt a regulation regarding personal financial data rights that is designed to promote “open banking.” If enacted as proposed, the regulation would require, among other things, that data providers, including any financial institution, make available to consumers and certain authorized third parties upon request certain covered transaction, account and payment information.

On October 30, 2023, the current Presidential Administration issued an Executive Order on Safe, Secure and Trustworthy Development and Use of AI, emphasizing the need for transparency, accountability and fairness in the development and use of AI. The order seeks to balance innovation with addressing risks associated with AI by providing eight guiding principles and priorities, such as ensuring that consumers are protected from fraud, discrimination and privacy risks related to AI. The Executive Order also requires certain federal agencies, including the CFPB, to address potential discrimination in the housing and consumer financial markets relating to the use by financial institutions of AI technologies. Prior to the issuance of the Executive Order, the CFPB published a report addressing the use by financial institutions of AI chatbots in the provision of financial products and services, which report also highlighted the limitations and various risks posed by such activity. States have also started to regulate the use of AI technologies. For example, the California Privacy Protection Agency is currently in the process of finalizing regulations under the CCPA regarding the use of automated decision making.

Bank Secrecy Act / Anti-Money Laundering

The BSA, which is intended to require financial institutions to develop policies, procedures, and practices to prevent and deter money laundering, mandates that every national bank have a written, board-approved program that is reasonably designed to assure and monitor compliance with the BSA. The program must, at a minimum: (1) provide for a system of internal controls to assure ongoing compliance; (2) provide for independent testing for compliance; (3) designate an individual responsible for coordinating and monitoring day-to-day compliance; and (4) provide training for appropriate personnel. In addition, national banks are required to adopt a customer identification program as part of their BSA compliance program. National banks are also required to file SARs when they detect certain known or suspected violations of federal law or suspicious transactions related to a money laundering activity or a violation of the BSA. The regulations implementing the BSA require financial institutions to establish risk-based procedures for conducting ongoing customer due diligence and procedures for understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile. In addition, FinCEN has promulgated customer due diligence and customer identification rules that require banks to identify and verify the identity of the beneficial owners of all legal entity customers (other than those that are excluded) at the time a new account is opened (other than accounts that are exempted).

In addition to complying with the BSA, the Bank is subject to the Patriot Act. The Patriot Act is designed to deny terrorists and criminals the ability to obtain access to the United States’ financial system and has significant implications for depository institutions, brokers, dealers, and other businesses involved in the transfer of money. The Patriot Act mandates that financial

13

service companies implement additional policies and procedures and take heightened measures designed to address any or all of the following matters: customer identification programs, money laundering, terrorist financing, identifying and reporting suspicious activities and currency transactions, currency crimes, and cooperation between financial institutions and law enforcement authorities.

On December 3, 2019, three federal banking agencies and FinCEN issued a joint statement clarifying the compliance procedures and reporting requirements that banks must file for customers engaged in the growth or cultivation of hemp, including a clear statement that banks need not file a SAR on customers engaged in the growth or cultivation of hemp in accordance with applicable laws and regulations. This statement does not apply to cannabis-related business; thus, the statement only pertains to customers who are lawfully growing or cultivating hemp and are not otherwise engaged in unlawful or suspicious activity.

Further, on January 1, 2021, Congress passed the NDAA, which enacted the most significant overhaul of the BSA and related AML laws since the Patriot Act. Notable amendments include (1) significant changes to the collection of beneficial ownership information and the establishment of a beneficial ownership registry, which requires corporate entities (generally, any corporation, LLC, or other similar entity with 20 or fewer employees and annual gross income of $5 million or less) to report beneficial ownership information to FinCEN (which will be maintained by FinCEN and made available upon request to financial institutions); (2) enhanced whistleblower provisions, which provide that one or more whistleblowers who voluntarily provide original information leading to the successful enforcement of violations of the AML laws in any judicial or administrative action brought by the Secretary of the Treasury or the Attorney General resulting in monetary sanctions exceeding $1 million (including disgorgement and interest but excluding forfeiture, restitution, or compensation to victims) will receive not more than 30 percent of the monetary sanctions collected and will receive increased protections; (3) increased penalties for violations of the BSA; (4) improvements to existing information sharing provisions that permit financial institutions to share information relating to SARs with foreign branches, subsidiaries, and affiliates (except those located in China, Russia, or certain other jurisdictions) for the purpose of combating illicit finance risks; and (5) expanded duties and powers of FinCEN. Many of the amendments require the Department of Treasury and FinCEN to promulgate rules. On September 29, 2022, FinCEN issued a final regulation implementing the BSA amendments included in the NDAA with respect to beneficial ownership.

Interstate Branching

Pursuant to the Dodd-Frank Act, national and state-chartered banks may open an initial branch in a state other than its home state (e.g., a host state) by establishing a de novo branch at any location in such host state at which a bank chartered in such host state could establish a branch. Applications to establish such branches must still be filed with the appropriate primary federal regulator.

Volcker Rule

The Dodd-Frank Act prohibits IDIs and their holding companies from engaging in proprietary trading except in limited circumstances, and prohibits them from owning equity interests in excess of three percent of Tier 1 Capital in private equity and hedge funds (known as the “Volcker Rule”). Five U.S. financial regulators with jurisdiction over the Volcker Rule, including the Federal Reserve and the OCC, have adopted implementing regulations. Those regulations prohibit banking entities from (1) engaging in short-term proprietary trading for their own accounts, and (2) having certain ownership interests in and relationships with hedge funds or private equity funds, which are referred to as “covered funds.” The regulations also require each regulated entity to establish an internal compliance program that is consistent with the extent to which it engages in activities covered by the Volcker Rule. Historically, this meant that the largest banking entities (i.e., those with $50 billion or more in assets) had higher reporting requirements, but in November 2019, the agencies issued a final rule revising certain aspects of the Volcker Rule. The final rule simplified and streamlined compliance requirements for firms that do not have significant trading activities and enhanced requirements for firms that do. Under the rule, compliance requirements are based on the amount of assets and liabilities that a bank trades. Firms with significant trading activities (i.e., those with $20 billion or more in trading assets and liabilities) have heightened compliance obligations. Although we benefit from significantly reduced compliance obligations due to the level of our trading assets being below the $20 billion threshold as a result of the final rule, we remain subject to the modified rules and requirements related to covered funds.

Further, in June of 2020, the five agencies referenced above issued a final rule that modified the Volcker Rule's prohibition on banking entities' investing in or sponsoring "covered funds." The final rule (1) streamlined the covered funds portion of the rule; (2) addressed the extraterritorial treatment of certain foreign funds; and (3) permits banking entities to offer financial services and engage in other activities that do not raise concerns that the Volcker Rule was intended to address.

14

Incentive Compensation Policies and Restrictions

The federal banking agencies have issued guidance on sound incentive compensation policies that applies to all banking organizations supervised by the agencies (thereby including both the Parent Company and the Bank). Pursuant to the guidance, to be consistent with safety and soundness principles, a banking organization’s incentive compensation arrangements should: (1) provide employees with incentives that appropriately balance risk and reward; (2) be compatible with effective controls and risk management; and (3) be supported by strong corporate governance including active and effective oversight by the banking organization’s board of directors. Monitoring methods and processes used by a banking organization should be commensurate with the size and complexity of the organization and its use of incentive compensation.

The Dodd-Frank Act required the federal banking agencies and the SEC to establish joint regulations or guidelines for specified regulated entities, such as us, having at least $1 billion in total assets, to prohibit incentive-based payment arrangements that encourage inappropriate risk taking by providing an executive officer, employee, director or principal shareholder with excessive compensation, fees, or benefits or that could lead to material financial loss to the entity. In addition, these regulators must establish regulations or guidelines requiring enhanced disclosure to regulators of incentive-based compensation arrangements. Pursuant to SEC regulations and NYSE rules enacted in 2022, we adopted a "clawback" policy with respect to the recovery of incentive-based compensation paid to current or former executive officers in the event of material noncompliance with any financial reporting requirement under the securities laws. A copy of our clawback policy is attached as Exhibit 97 to this 10-K.

The Federal Reserve will review, as part of its standard, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Corporation, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

The scope and content of the U.S. banking regulators’ policies on executive compensation may continue to evolve in the near future. It cannot be determined at this time whether compliance with such policies will adversely affect the Corporation’s ability to hire, retain and motivate its key employees.

Consumer Financial Services Regulations

Federal and applicable state banking laws also require us to take steps to protect consumers. Bank regulatory agencies are increasingly focusing attention on compliance with consumer protection laws and regulations. These laws include disclosures regarding truth in lending, truth in savings, and funds availability.

To promote fairness and transparency for mortgages, credit cards, and other consumer financial products and services, the Dodd-Frank Act established the CFPB. This agency is responsible for interpreting and enforcing federal consumer financial laws, as defined by the Dodd-Frank Act, that, among other things, govern the provision of deposit accounts along with mortgage origination and servicing. Some federal consumer financial laws enforced by the CFPB include the Equal Credit Opportunity Act, TILA, the Truth in Savings Act, the Home Mortgage Disclosure Act, RESPA, the Fair Debt Collection Practices Act, and the Fair Credit Reporting Act. The CFPB is also authorized to prevent any institution under its authority from engaging in an unfair, deceptive, or abusive act or practice in connection with consumer financial products and services.

Under TILA as implemented by Regulation Z, mortgage lenders are required to make a reasonable and good faith determination based on verified and documented information that a consumer applying for a mortgage loan has a reasonable ability to repay the loan according to its terms. Mortgage lenders are required to determine consumers’ ATR in one of two ways. The first alternative requires the mortgage lender to consider the following eight underwriting factors when making the credit decision: (1) current or reasonably expected income or assets; (2) current employment status; (3) the monthly payment on the covered transaction; (4) the monthly payment on any simultaneous loan; (5) the monthly payment for mortgage-related obligations; (6) current debt obligations, alimony, and child support; (7) the monthly DTI ratio or residual income; and (8) credit history. Alternatively, the mortgage lender can originate "qualified mortgages," or QMs, which generally are mortgage loans without negative amortization, interest-only payments, balloon payments, or terms exceeding 30 years. QMs are entitled by rule to a presumption that the creditor making the loan satisfied the ATR requirements provided certain requirements are met. The Corporation is predominantly an originator of compliant QMs. The CFPB also has implemented the TILA-RESPA Integrated

15

Disclosure rules, which harmonize disclosure and certain regulatory compliance requirements required under those two statutes with respect to residential mortgage loans.

Additionally, the CFPB has the authority to take supervisory and enforcement action against banks and other financial services companies under the agency’s jurisdiction that fail to comply with federal consumer financial laws. As an IDI with total assets of more than $10 billion, the Bank is subject to the CFPB’s supervisory and enforcement authorities. The Dodd-Frank Act also permits states to adopt stricter consumer protection laws and state attorneys general to enforce consumer protection rules issued by the CFPB. As a result of these aspects of the Dodd-Frank Act, the Bank operates in a stringent consumer compliance environment. Therefore, the Bank is likely to incur additional costs related to consumer protection compliance, including but not limited to potential costs associated with CFPB examinations, regulatory and enforcement actions and consumer-oriented litigation, which is likely to increase as a result of the consumer protection provisions of the Dodd-Frank Act. The CFPB has been active in bringing enforcement actions against banks and other financial institutions to enforce consumer financial laws. The federal financial regulatory agencies, including the OCC and states attorneys general, also have become increasingly active in this area with respect to institutions over which they have jurisdiction. We have incurred and may in the future incur additional costs in complying with these requirements.

Pursuant to the Dodd-Frank Act, the FDIC has backup enforcement authority over a depository institution holding company, such as the Parent Company, if the conduct or threatened conduct of such holding company poses a risk to the DIF, although such authority may not be used if the holding company is generally in sound condition and does not pose a foreseeable and material risk to the DIF. The Dodd-Frank Act may have a material impact on the Corporation’s and the Bank’s operations, particularly through increased compliance costs resulting from possible future consumer and fair lending regulations. See Item 1A, Risk Factors — Legal, Regulatory, Compliance and Reputational Risks for additional discussion of this topic.

In recent years, the CFPB—with the support of the current Presidential Administration—has launched an initiative aimed at eliminating or restricting a number of fees assessed by financial institutions, including overdraft and non-sufficient funds fees as well as other transaction- and account management-related fees deemed by the CFPB to be “junk fees.” The CFPB has carried out its initiative through a mixture of supervision, examination and enforcement actions. See Item 1A, Risk Factors — Legal, Regulatory, Compliance and Reputational Risks for additional discussion of this topic.

Climate-Related Risk Management and Regulation

In recent years the federal banking agencies have increased their focus on climate-related risks impacting the operations of banks, the communities they serve and the broader financial system. Accordingly, the agencies have begun to enhance their supervisory expectations regarding the climate risk management practices of larger banking organizations, including by encouraging such banks to: ensure that management of climate-related risk exposures has been incorporated into existing governance structures; evaluate the potential impact of climate-related risks on the bank’s financial condition, operations and business objectives as part of its strategic planning process; account for the effects of climate change in stress testing scenarios and systemic risk assessments; revise expectations for credit portfolio concentrations based on climate-related factors; consider investments in climate-related initiatives and lending to communities disproportionately impacted by the effects of climate change; evaluate the impact of climate change on the bank’s borrowers and consider possible changes to underwriting criteria to account for climate-related risks to mortgaged properties; incorporate climate-related financial risk into the bank’s internal reporting, monitoring and escalation processes; and prepare for the transition risks to the bank associated with the adjustment to a low-carbon economy and related changes in laws, regulations, governmental policies, technology, and consumer behavior and expectations.

On October 21, 2021, the Financial Stability Oversight Council published a report identifying climate-related financial risks as an “emerging threat” to financial stability. On October 24, 2023, the OCC, the FDIC and the Federal Reserve jointly finalized principles for climate-related financial risk management for national banks with more than $100 billion in total assets. Although these risk management principles do not apply to the Bank directly based upon our current size, the OCC has indicated that all banks, regardless of their size, may have material exposures to climate-related financial and other risks that require prudent management. As climate-related supervisory guidance is formalized, and relevant risk areas and corresponding control expectations are further refined, we may be required to expend significant capital and incur compliance, operating, maintenance and remediation costs in order to conform to such requirements.

In addition, states are considering taking similar actions on climate-related financial risks, including certain states in which we operate. For example, in January of 2023, the Minnesota Pollution Control Agency released its Greenhouse Gas Emissions Report for years 2005-2020. The Report indicated that Minnesota is on track to meet its GHG reduction goals, including reducing emissions 50% by 2030 and achieving net-zero emissions by 2050. The Report relies on the state’s September 2022 Climate Action Framework as the path forward to a carbon-neutral, resilient, and equitable future. That same month, Illinois Governor JB Pritzker signed legislation preventing counties from enacting preemptive local ordinances that outright ban local

16

wind and solar projects, as such ordinances hinder the state’s climate goals set forth in the Climate and Equitable Jobs Act of 2021. Then, in February 2023, Minnesota Governor Tim Walz signed a bill that will move the state to 100% clean energy by 2040. In October 2023, California Governor Gavin Newsom signed two climate-related disclosure bills into law. The Climate Corporate Data Accountability Act (referred to as SB 253) requires both public and private U.S. businesses with revenues greater than $1 billion doing business in California to report their GHG emissions, including scopes 1, 2, and 3, beginning in 2026 (for 2025 data) and also requires reporting companies to get third-party assurance of their reports. Other states have proposed similar legislation to SB 253. The Climate-Related Financial Risk Act (referred to as SB 261) mandates that U.S. businesses with annual revenues over $500 million doing business in California to bi-annually disclose climate-related financial risks and their mitigation strategies beginning January 1, 2026. Additionally, in November 2023, the Wisconsin legislature introduced 20 draft bills addressing, through a mix of funding and legal requirements, weatherization of public school buildings, green jobs training, climate change scholarships, environmental impacts on vulnerable communities, agricultural waste reduction, climate change consideration in local planning decisions, consideration of carbon when vetting utility projects, and increased funding for Focus on Energy, a state program that supports new energy efficiency and renewable energy projects. State-level initiatives such as these may require us to expend capital to conform to any requirements that apply to us.

Additionally, in March of 2022, the SEC proposed new climate-related disclosure rules, the Proposed Rules for The Enhancement and Standardization of the Climate-Related Disclosure for Investors File No. S7-10-22. If adopted as expected, the rules would require new climate-related disclosures in SEC filings and audited financial statements, including certain climate-related metrics and GHG emissions data, information about climate-related targets and goals, transition plans, if any, and attestation requirements.

The Corporation has established an Environmental Sustainability Risk Policy and Environmental Sustainability Statement focused on environmental risk management; climate change, carbon emissions and natural resources; and environmental and social lending which will serve as the foundation to Associated's Environmental Sustainability Risk Management System, a system for supporting the Environmental Sustainability Risk Policy and environmental sustainability risk reporting. The EMS is intended to help manage environmental and climate risk in a comprehensive, systematic, planned and documented manner, and to help all policy practices integrate into the Corporation's Enterprise Risk Management program and align them with business objectives. Oversight for climate-related risks includes Board-level, senior management and Board and management committee oversight.

The Corporation’s Board of Directors is responsible for overseeing the corporate ESG strategies and risks of Associated, including risks and opportunities related to environmental sustainability. In fulfilling its responsibilities, the Board has delegated responsibilities to the following Board-level committees:

•The Corporate Governance and Social Responsibility Committee has oversight responsibility for the Corporation’s ESG Framework and ESG Disclosures.

•The Enterprise Risk Committee is the approval authority for enterprise risk-related oversight, such as risk-related policies and the Risk Appetite Statement. With regard to environmental sustainability, this includes Environmental Risk Management; Climate Change, Carbon Emissions and Natural Resources; and Environmental and Social Lending.

•The Compensation & Benefits Committee is the approval authority for compensation and benefits related oversight, such as executive compensation, human capital, human rights, DE&I, and workforce practices and policies.

•The Audit Committee has been delegated responsibility to oversee management of financial reporting and audit functions.

The CGSRC has appointed senior management responsibility to the Environmental, Social and Governance Committee (ESGC), an executive level committee chaired by the Corporation’s General Counsel. Additional committee members include the President and Chief Executive Officer; Head of Consumer and Business Banking; Chief Human Resources Officer; Director of ESG and Sustainability; Director of Diversity, Equity and Inclusion; Director of Community Accountability; and Director of Enterprise Risk Management and Corporate Risk Strategy.

The ERC has delegated to senior management responsibility for managing and maintaining enterprise risks through approved policies and within the risk appetite. The Corporation senior management carries out this mandate through the Enterprise Risk Management Committee (ERMC). The Chief Risk Officer oversees all aspects of environmental risk. As such, this role provides indirect strategic guidance into the Environmental Sustainability Risk Policy and gives second level approval for all policy components. The Chief Credit Officer oversees lending aspects of environmental risk.

17

During 2023, the Corporation elevated environmental sustainability as a mainstream corporate initiative and established a management-level Sustainability Committee which reports through ERMC. The Sustainability Committee helps to identify, implement, and effectuate priorities for Associated’s environmental sustainability initiatives. The Committee is led by the Director of ESG and Sustainability. Additional committee members include Director Customer Experience and Journey Mapping; Risk and Compliance Director; Director of Facilities Real Estate and Director of Special Assets.

Digital Asset Regulation

The federal banking agencies have issued interpretive guidance and statements regarding the engagement by banking organizations in certain digital asset activities. In November of 2021, the OCC published an interpretive letter clarifying that the digital asset activities of national banks that have been addressed by the OCC in prior interpretive precedent published in 2020 and 2021 are viewed by the agency as legally permissible provided that banks (i) are able to demonstrate to the OCC that their digital asset activities can be conducted in a safe and sound manner and (ii) notify the OCC’s supervisory staff of their intention to engage in such activities and receive the OCC’s non-objection prior to doing so. On August 16, 2022, the Federal Reserve released supervisory guidance encouraging all banking organizations supervised by the agency to notify its lead supervisory point of contact at the Federal Reserve prior to engaging in any digital asset-related activity. Prior to engaging in any such activities, banking organizations are expected to ensure their proposed activities are legally permissible under relevant state and federal laws, and ensure they have implemented adequate systems, risk management, and internal controls to ensure that the activities are conducted in a safe and sound manner consistent with applicable laws, including consumer protection laws.

On January 3, 2023, the federal banking agencies issued additional guidance in the form of a joint statement addressing digital asset-related risks to banking organizations. That statement noted the recent volatility and exposure of vulnerabilities in the digital asset sector and indicated that the agencies are continuing to assess whether or how the digital asset-related activities of banking organizations can be conducted in a safe and sound manner and in compliance with all applicable laws and regulations. The statement stressed that each agency has developed, and expects banking organizations to follow, supervisory processes for evaluating proposed and existing digital asset activities.

On February 23, 2023, the federal banking agencies issued a joint statement addressing liquidity risks to banking organizations resulting from crypto-asset market vulnerabilities. The joint statement noted that deposits placed by a crypto-asset-related entity and deposits that constitute stablecoin-related reserves may pose heightened liquidity risks to banking organizations due to the unpredictability of the scale and timing of deposit inflows and outflows. The statement stressed that banking organizations should establish and maintain effective risk management and controls commensurate with the level of liquidity risks from such funding sources. Further, on August 8, 2023, the Federal Reserve announced the establishment of a Novel Activities Supervision Program, which is designed in part to enhance the Federal Reserve’s supervision processes in respect of banking organizations’ crypto-asset related activities and use of distributed ledger technologies and other novel technologies in the delivery of financial products and services.

Although the federal banking agencies have not developed formal regulations governing the digital asset activities of banking organizations, the supervisory framework summarized above dictates that, in order to effectively identify and manage digital asset-related risks and obtain supervisory non-objection to the proposed engagement in digital asset activities, banking organizations must implement appropriate risk management practices, including with respect to board and management oversight, policies and procedures, risk assessments, internal controls and monitoring.

Other Banking Regulations

The Bank is also subject to a variety of other regulations with respect to the operation of its businesses, including but not limited to the Dodd-Frank Act, which among other restrictions placed limitations on the interchange fees charged for debit card transactions, TILA, Truth in Savings Act, Equal Credit Opportunity Act, Electronic Funds Transfer Act, Fair Housing Act, Home Mortgage Disclosure Act, Fair Debt Collection Practices Act, Fair Credit Reporting Act, Expedited Funds Availability (Regulation CC), Reserve Requirements (Regulation D), Insider Transactions (Regulation O), Privacy of Consumer Information (Regulation P), Margin Stock Loans (Regulation U), Right To Financial Privacy Act, Flood Disaster Protection Act, Homeowners Protection Act, Servicemembers Civil Relief Act, RESPA, TCPA, CAN-SPAM Act, Children’s Online Privacy Protection Act, and the John Warner NDAA. Further, in January of 2021, the OCC issued a notice of proposed rulemaking to amend current rules related to national banks' ownership of real property. The proposal would provide a set of general standards, including an occupancy test and excess capacity standards, that the OCC will use to determine whether the acquisition and holding of real estate is necessary for the transaction of an institution's business. The prospects and timing for the adoption of a final rule are uncertain at this time.

The laws and regulations to which we are subject are constantly under review by Congress, the federal regulatory agencies, and the state authorities. These laws and regulations could be changed drastically in the future, which could affect our profitability, our ability to compete effectively, or the composition of the financial services industry in which we compete.

18

Government Monetary Policies and Economic Controls

Our earnings and growth, as well as the earnings and growth of the banking industry, are affected by the credit policies of monetary authorities, including the Federal Reserve. An important function of the Federal Reserve is to regulate the national supply of bank credit in order to combat recession and curb inflationary pressures. Among the instruments of monetary policy used by the Federal Reserve to implement these objectives are open market operations in U.S. government securities, changes in reserve requirements against member bank deposits, and changes in the Federal Reserve discount rate. These instruments are used in varying combinations to influence overall growth of bank loans, investments, and deposits, and may also affect interest rates charged on loans or paid for deposits. The monetary policies of the Federal Reserve authorities have had a significant effect on the operating results of commercial banks in the past and are expected to continue to have such an effect in the future.

In view of changing conditions in the national economy and in money markets, as well as the effect of credit policies by monetary and fiscal authorities, including the Federal Reserve, it is difficult to predict the impact of possible future changes in interest rates, deposit levels, and loan demand, or their effect on our business and earnings or on the financial condition of our various customers.

Other Regulatory Authorities

In addition to regulation, supervision and examination by federal banking agencies, the Corporation and certain of its subsidiaries, including those that engage in securities brokerage, dealing and investment advisory activities, are subject to other federal and applicable state securities laws and regulations, and to supervision and examination by other regulatory authorities, including the SEC, FINRA, NYSE, DOL and others.

Separately, in June of 2019, pursuant to the Dodd-Frank Act, the SEC adopted Regulation Best Interest, which, among other things, establishes a new standard of conduct for a broker-dealer to act in the best interest of a retail customer when making a recommendation of any securities transaction or investment strategy involving securities to such customer. The new rule requires us to review and possibly modify our compliance activities, which is causing us to incur some additional costs. In addition, state laws that impose a fiduciary duty also may require monitoring, as well as require that we undertake additional compliance measures.

Available Information

We file annual, quarterly, and current reports, proxy statements, and other information with the SEC. These filings are available to the public on the Internet at the SEC’s web site at www.sec.gov.

Our principal internet address is www.associatedbank.com. We make available free of charge on or through our website our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC. In addition, shareholders may request a copy of any of our filings (excluding exhibits) at no cost by writing at Associated Banc-Corp, Attn: Investor Relations, 433 Main Street, Green Bay, WI 54301 or e-mailing us at investor.relations@associatedbank.com.

ITEM 1A. Risk Factors

An investment in our common stock is subject to risks inherent to our business. The material risks and uncertainties that management believes affect us are described below. Before making an investment decision, you should carefully consider the risks and uncertainties described below, together with all of the other information included or incorporated by reference herein. The risks and uncertainties described below are not the only ones facing us. Additional risks and uncertainties that management is not aware of or focused on or that management currently deems immaterial may also impair our business operations. This report is qualified in its entirety by these risk factors. See also, Special Note Regarding Forward-Looking Statements and Risk Factors Summary.

If any of the events described in the risk factors should actually occur, our financial condition and results of operations could be materially and adversely affected. If this were to happen, the value of our securities could decline significantly, and you could lose all or part of your investment.

19

Credit Risks

Changes and instability in economic conditions, geopolitical matters and financial markets, including a contraction of economic activity, could adversely impact our business, results of operations and financial condition.

Our success depends, to a certain extent, upon global, domestic and local economic and political conditions, as well as governmental monetary policies. Conditions such as changes in interest rates, money supply, levels of employment and other factors beyond our control may have a negative impact on economic activity. Any contraction of economic activity, including an economic recession, may adversely affect our asset quality, deposit levels and loan demand and, therefore, our earnings. In particular, interest rates are highly sensitive to many factors that are beyond our control, including global, domestic and local economic conditions and the policies of various governmental and regulatory agencies and, specifically, the Federal Reserve. Throughout 2022 and 2023, the FOMC raised the target range for the federal funds rate on eleven separate occasions, citing factors including the hardships caused by the ongoing Russia-Ukraine conflict, continued global supply chain disruptions and imbalances, and increased inflationary pressure.

The tightening of the Federal Reserve’s monetary policies, including repeated and aggressive increases in target range for the federal funds rate as well as the conclusion of the Federal Reserve’s tapering of asset purchases, together with ongoing economic and geopolitical instability, increases the risk of an economic recession. Although forecasts have varied, many economists are projecting that, while indicators of U.S. economic performance, such as income growth, may be strong and levels of inflation may continue to decrease, the U.S. economy may be flat or experience a modest decrease in gross domestic output in 2024 while inflation is expected to remain elevated relative to historic levels in the coming quarters. Any such downturn in economic output, especially domestically and in the regions in which we operate, may adversely affect our asset quality, deposit levels, loan demand and results of operations.

As a result of the economic and geopolitical factors discussed above, financial institutions also face heightened credit risk, among other forms of risk. Of note, because we have a significant amount of real estate loans, decreases in real estate values could adversely affect the value of property used as collateral, which, in turn, can adversely affect the value of our loan and investment portfolios. Adverse economic developments, specifically including inflation-related impacts, may have a negative effect on the ability of our borrowers to make timely repayments of their loans or to finance future home purchases. According to the Federal Reserve's October 2023 Financial Stability Report, CRE values remained elevated relative to fundamentals, even as prices continued to decline. While CRE values continue to fluctuate, some markets are showing signs of stabilizing prices. However, the outlook for CRE remains dependent on the broader economic environment and, specifically, how major subsectors respond to a rising interest rate environment and higher prices for commodities, goods and services. In any case, credit performance over the medium- and long-term is susceptible to economic and market forces and therefore forecasts remain uncertain; however, some degree of instability in the CRE markets is expected in the coming quarters as loans are refinanced in markets with higher vacancy rates under current economic conditions. Instability and uncertainty in the commercial and residential real estate markets, as well as in the broader commercial and retail credit markets, could have a material adverse effect on our financial condition and results of operations.

Changes in U.S. trade policies, including the imposition of tariffs and retaliatory tariffs, may adversely impact our business, financial condition, and results of operations.

There continues to be discussion and dialogue regarding potential changes to U.S. trade policies, legislation, treaties and tariffs with countries such as China and those within the European Union. The prior Presidential Administration imposed certain tariffs and retaliatory tariffs, as well as other trade restrictions on products and materials that our customers import or export. These restrictions may cause the prices of our customers' products to increase, which could reduce demand for such products, or reduce our customers' margins, and adversely impact their revenues, financial results, and ability to service debt. This in turn could adversely affect our financial condition and results of operations. In addition, to the extent changes in the political environment have a negative impact on us or on the markets in which we operate our business, our results of operations and financial condition could be materially and adversely impacted in the future. Although the current Presidential Administration has expressed interest in improving relations with key transatlantic partners, including by relaxing certain tariffs imposed by the prior Presidential Administration, the trade policies of the current Presidential Administration remain somewhat unsettled. The current Presidential Administration is also conducting a statutorily-required quadrennial review of some of these tariffs, but it remains unclear what may result from the review. Accordingly, it remains unclear what the U.S. government or foreign governments will or will not do with respect to tariffs already imposed, additional tariffs that may be imposed, or international trade agreements and policies.

20

Our allowance for credit losses may be insufficient.

All borrowers have the potential to default, and our remedies in the event of such default (such as seizure and/or sale of collateral, legal actions, and guarantees) may not fully satisfy the debt owed to us. We maintain an allowance for credit losses, which is a reserve established through a provision for credit losses charged to expense, that represents management’s best estimate of probable credit losses over the life of the loan within the existing portfolio of loans. The allowance for credit losses, in the judgment of management, is necessary to reserve for estimated credit losses and risks inherent in the loan portfolio. The level of the allowance for credit losses reflects management’s continuing evaluation of industry concentrations; specific credit risks; loan loss experience; current loan portfolio quality; present economic, political, and regulatory conditions; and unidentified losses inherent in the current loan portfolio. The determination of the appropriate level of the allowance for credit losses inherently involves a high degree of subjectivity and requires us to make significant estimates of current credit risks using existing qualitative and quantitative information, all of which may undergo material changes. Changes in economic conditions affecting borrowers, new information regarding existing loans, identification of additional problem loans, and other factors, both within and outside of our control, may require an increase in the allowance for credit losses. In addition, bank regulatory agencies periodically review our allowance for credit losses and may require an increase in the provision for credit losses or the recognition of additional loan charge offs, based on judgments different than those of management. An increase in the allowance for credit losses would result in a decrease in net income, and possibly risk-based capital, and could have a material adverse effect on our financial condition and results of operations.

We are subject to lending concentration risks.

As of December 31, 2023, approximately 62% of our loan portfolio consisted of commercial and industrial, real estate construction, and CRE loans (collectively, "commercial loans"). Commercial loans are generally viewed as having more inherent risk of default than residential mortgage loans or other consumer loans. Further, the commercial loan balance per borrower is typically larger than that for residential mortgage loans and other consumer loans, implying higher potential losses on an individual loan basis. Because our loan portfolio contains a number of commercial loans with balances over $25 million, the deterioration of one or a few of these loans could cause a significant increase in nonaccrual loans, which could have a material adverse effect on our financial condition and results of operations.

CRE lending may expose us to increased lending risks.

Our policy generally has been to originate CRE loans primarily in the states in which the Bank operates. At December 31, 2023, CRE loans, including owner occupied, investor, and real estate construction loans, totaled $8.5 billion, or 29%, of our total loan portfolio. As a result of our growth in this portfolio over the past several years and planned future growth, these loans require more ongoing evaluation and monitoring and we are implementing enhanced risk management policies, procedures and controls. CRE loans generally involve a greater degree of credit risk than residential mortgage loans because they typically have larger balances and are more affected by adverse conditions in the economy. Because payments on loans secured by CRE often depend upon the successful operation and management of the properties and the businesses which operate from within them, repayment of such loans may be affected by factors outside the borrower’s control, such as adverse conditions in the real estate market or the economy or changes in government regulation. In recent years, CRE markets have been experiencing substantial growth, and increased competitive pressures have contributed significantly to historically low capitalization rates and rising property values. However, CRE markets have been facing downward pressure since 2022 due in large part to increasing interest rates and declining property values. Accordingly, the federal banking agencies have expressed concerns about weaknesses in the current CRE market and have applied increased regulatory scrutiny to institutions with CRE loan portfolios that are fast growing or large relative to the institutions' total capital. To address supervisory expectations with respect to financial institutions' handling of CRE borrowers who are experiencing financial difficulty, in June of 2023, the federal banking agencies, including the OCC, issued an interagency policy statement addressing prudent CRE loan accommodations and workouts. Our failure to adequately implement enhanced risk management policies, procedures and controls could adversely affect our ability to increase this portfolio going forward and could result in an increased rate of delinquencies in, and increased losses from, this portfolio. At December 31, 2023, nonaccrual CRE loans totaled $1 million, or less than 1% of our total portfolio of CRE loans.

We depend on the accuracy and completeness of information furnished by and on behalf of our customers and counterparties.

In deciding whether to extend credit or enter into other transactions, we may rely on information furnished by or on behalf of customers and counterparties, including financial statements, credit reports, and other financial information. We may also rely on representations of those customers, counterparties, or other third parties, such as independent auditors, as to the accuracy and completeness of that information. Reliance on inaccurate or misleading financial statements, credit reports, or other financial

21

information could cause us to enter into unfavorable transactions, which could have a material adverse effect on our financial condition and results of operations.

Lack of system integrity or credit quality related to funds settlement could result in a financial loss.

We settle funds on behalf of financial institutions, other businesses and consumers and receive funds from clients, card issuers, payment networks and consumers on a daily basis for a variety of transaction types. Transactions we facilitate include wire transfers, debit card, credit card and electronic bill payment transactions, supporting consumers, financial institutions and other businesses. These payment activities rely upon the technology infrastructure that facilitates the verification of activity with counterparties and the facilitation of the payment. If the continuity of operations or integrity of processing were compromised, this could result in a financial loss to us due to a failure in payment facilitation. In addition, we may issue credit to consumers, financial institutions or other businesses as part of the funds settlement. A default on this credit by a counterparty could result in a financial loss to us.

We are subject to environmental liability risk associated with lending activities.

A significant portion of our loan portfolio is secured by real property. During the ordinary course of business, we may foreclose on and take title to properties securing certain loans. In doing so, there is a risk that hazardous or toxic substances could be found on these properties. If hazardous or toxic substances are found, we may be liable for remediation costs, as well as for personal injury and property damage. Environmental laws may require us to incur substantial expenses which may materially reduce the affected property’s value or limit our ability to use or sell the affected property. In addition, future laws or more stringent interpretations or enforcement policies with respect to existing laws may increase our exposure to environmental liability. Although we have policies and procedures to perform an environmental review before lending against or initiating any foreclosure action on real property, these reviews may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on our financial condition and results of operations.

Liquidity and Interest Rate Risks

Impairment of our access to liquidity could affect our ability to meet our obligations.

The Corporation requires liquidity to meet its deposit and debt obligations as they come due. Access to liquidity could be impaired by an inability to access the capital markets or unforeseen outflows of deposits. Risk factors that could impair our ability to access capital markets include a downturn in our Midwest markets, difficult credit markets, credit rating downgrades, or regulatory actions against the Corporation. The Corporation’s access to deposits can be impacted by the liquidity needs of our customers as a substantial portion of the Corporation’s liabilities are demand while a substantial portion of the Corporation’s assets are loans that cannot be sold in the same timeframe. Historically, the Corporation has been able to meet its cash flow needs as necessary. If a sufficiently large number of depositors sought to withdraw their deposits for whatever reason, the Corporation may be unable to obtain the necessary funding at favorable terms.

The proportion of our deposit account balances that exceed FDIC insurance limits may expose the Bank to enhanced liquidity risk in times of financial distress.

In its assessment of the failures of SVB and SBNY in the first quarter of 2023, the FDIC concluded that a significant contributing factor to the failures of the institutions was the proportion of the deposits held by each institution that exceeded FDIC insurance limits. Noting that uninsured deposits accounted for nearly 47 percent of domestic deposits in 2021, the FDIC stated that large concentrations of uninsured deposits increase the potential for bank runs and can threaten financial stability. The FDIC similarly concluded that an overreliance on uninsured deposits contributed to the subsequent failure of First Republic Bank in the second quarter of 2023. In response to the failures of SVB, SBNY, and First Republic Bank, many large depositors across the industry have withdrawn deposits in excess of applicable deposit insurance limits and deposited these funds in other financial institutions and, in many instances, moved these funds into money market mutual funds or other similar securities accounts in an effort to diversify the risk of further bank failure(s).

Uninsured deposits historically have been viewed by the FDIC as less stable than insured deposits. According to statements made by the FDIC staff and the leadership of the federal banking agencies, customers with larger uninsured deposit account balances often are small- and mid-sized businesses that rely upon deposit funds for payment of operational expenses and, as a result, are more likely to closely monitor the financial condition and performance of their depository institutions. As a result, in the event of financial distress, uninsured depositors historically have been more likely to withdraw their deposits. To that end, the federal banking agencies, including the FDIC and OCC, issued an interagency policy statement in July 2023 to underscore the importance of robust liquidity risk management and contingency funding planning. In the policy statement, the regulators noted that banks should maintain actionable contingency funding plans that take into account a range of possible stress

22

scenarios, assess the stability of their funding and maintain a broad range of funding sources, ensure that collateral is available for borrowing, and review and revise contingency funding plans periodically and more frequently as market conditions and strategic initiatives change.

If a significant portion of our deposits were to be withdrawn within a short period of time such that additional sources of funding would be required to meet withdrawal demands, the Corporation may be unable to obtain funding at favorable terms, which may have an adverse effect on our net interest margin. Moreover, obtaining adequate funding to meet our deposit obligations may be more challenging during periods of elevated prevailing interest rates, such as the present period. Our ability to attract depositors during a time of actual or perceived distress or instability in the marketplace may be limited. Further, interest rates paid for borrowings generally exceed the interest rates paid on deposits. This spread may be exacerbated by higher prevailing interest rates. In addition, because our AFS investment securities lose value when interest rates rise, after-tax proceeds resulting from the sale of such assets may be diminished during periods when interest rates are elevated. Under such circumstances, we may be required to access funding from sources such as the Federal Reserve’s discount window or its recently established BTFP in order to manage our liquidity risk. For additional information regarding uninsured deposits and liquidity, see sections Deposits and Customer Funding and Liquidity of Part II, Item 7, Management's Discussion and Analysis of Financial Condition and Results of Operations.

Adverse changes to our credit ratings could limit our access to funding and increase our borrowing costs.

Credit ratings are subject to ongoing review by rating agencies, which consider a number of factors, including our financial strength, performance, prospects and operations as well as factors not under our control. Other factors that influence our credit ratings include changes to the rating agencies’ methodologies for our industry or certain security types; the rating agencies’ assessment of the general operating environment for financial services companies; our relative positions in the markets in which we compete; our various risk exposures and risk management policies and activities; pending litigation and other contingencies; our reputation; our liquidity position, diversity of funding sources and funding costs; the current and expected level and volatility of our earnings; our capital position and capital management practices; our corporate governance; current or future regulatory and legislative initiatives; and the agencies’ views on whether the U.S. government would provide meaningful support to the Corporation or its subsidiaries in a crisis. Rating agencies could make adjustments to our credit ratings at any time, and there can be no assurance that they will maintain our ratings at current levels or that downgrades will not occur.

In August 2023, Moody’s and S&P Global Ratings each downgraded our long-term issuer credit ratings. Any additional downgrade in our credit ratings could potentially adversely affect the cost and other terms upon which we are able to borrow or obtain funding, increase our cost of capital and/or limit our access to capital markets. Credit rating downgrades or negative watch warnings could also negatively impact our reputation and the perception of the Corporation by lenders, investors and other third parties, which could also impair our ability to compete in certain markets or engage in certain transactions. In particular, holders of deposits which exceed FDIC insurance limits may perceive such a downgrade or warning negatively and withdraw all or a portion of such deposits. While certain aspects of a credit rating downgrade are quantifiable, the impact that such a downgrade would have on our liquidity, business and results of operations in future periods is inherently uncertain and would depend on a number of interrelated factors, including, among other things, the magnitude of the downgrade, the rating relative to peers, the rating assigned by the relevant agency pre-downgrade, individual client behavior and future mitigating actions we might take.

We are subject to interest rate risk.

Our earnings and cash flows are largely dependent upon our net interest income. Interest rates are highly sensitive to many factors that are beyond our control, including general economic conditions and policies of various governmental and regulatory agencies and, in particular, the Federal Reserve. Changes in monetary policy, including changes in interest rates, could influence not only the interest we receive on loans and investments and the amount of interest we pay on deposits and borrowings, but such changes could also affect (i) our ability to originate loans and obtain deposits; (ii) the fair value of our financial assets and liabilities; and (iii) the average duration of our mortgage portfolio and other interest-earning assets. In January 2022, due to elevated levels of inflation and corresponding pressure to raise interest rates, the Federal Reserve announced after several periods of historically low federal funds rates and yields on Treasury notes that it would be slowing the pace of its bond purchasing and increasing the target range for the federal funds rate over time. The FOMC since has increased the target range eleven times throughout 2022 and 2023. As of December 31, 2023, the target range for the federal funds rate had been increased to 5.25% to 5.50%. It remains uncertain whether the FOMC will further increase the target range for the federal funds rate to attain a monetary policy sufficiently restrictive to return inflation to more normalized levels, begin to reduce the federal funds rate or leave the rate at its current elevated level for a lengthy period of time. Our interest rate spread, net interest margin and net interest income increased during this period of rising interest rates as our interest earning assets generally reprice more quickly than our interest earning liabilities.

23

If the interest rates paid on deposits and other borrowings increase at a faster rate than the interest rates received on loans and other investments, our net interest income, and therefore earnings, could be adversely affected. Earnings could also be adversely affected if the interest rates received on loans and other investments fall more quickly than the interest rates paid on deposits and other borrowings. The Corporation's interest rate risk profile is such that, generally, a higher yield curve adds to income while a lower yield curve has a negative impact on earnings. Our most significant interest rate risk may result from timing differences in the maturity and re-pricing characteristics of assets and liabilities, changes in the shape of the yield curve, and the potential exercise of explicit or embedded options.

Although management believes it has implemented effective asset and liability management strategies, including the potential use of derivatives as hedging instruments, to reduce the potential effects of changes in interest rates on our results of operations, any substantial, unexpected, prolonged change in market interest rates could have a material adverse effect on our financial condition and results of operations, and any related economic downturn, especially domestically and in the regions in which we operate, may adversely affect our asset quality, deposit levels, loan demand and results of operations. Also, our interest rate risk modeling techniques and assumptions likely may not fully predict or capture the impact of actual interest rate changes on our balance sheet.

The impact of interest rates on our mortgage banking business can have a significant impact on revenues.

Changes in interest rates can impact our mortgage-related revenues and net revenues associated with our mortgage activities. A decline in mortgage rates generally increases the demand for mortgage loans as borrowers refinance, but also generally leads to accelerated payoffs. Conversely, in a constant or increasing rate environment, we would expect fewer loans to be refinanced and a decline in payoffs. Although we use models to assess the impact of interest rates on mortgage-related revenues, the estimates of revenues produced by these models are dependent on estimates and assumptions of future loan demand, prepayment speeds and other factors which may differ from actual subsequent experience.

Changes in interest rates could reduce the value of our investment securities holdings which would increase our accumulated other comprehensive loss and thereby negatively impact stockholders' equity.

The Corporation maintains an investment portfolio consisting of various high quality liquid fixed-income securities. The total carrying value of the securities portfolio, which includes FHLB and Federal Reserve Bank stocks, was $7.7 billion as of December 31, 2023, and the estimated duration of the aggregate portfolio was approximately 5.7 years. The nature of fixed-income securities is such that changes in market interest rates impact the value of these assets.

Changes in interest rates could also reduce the value of our residential mortgage-related securities and MSRs, which could negatively affect our earnings.

The Corporation earns revenue from the fees it receives for originating mortgage loans and for servicing mortgage loans. When rates rise, the demand for mortgage loans tends to fall, reducing the revenue the Corporation receives from loan originations. At the same time, revenue from MSRs can increase through increases in fair value. When rates fall, mortgage originations tend to increase and the value of MSRs tends to decline, also with some offsetting revenue effect. Even though the origination of mortgage loans can act as a “natural hedge,” the hedge is not perfect, either in amount or timing. For example, the negative effect on revenue from a decrease in the fair value of residential MSRs is immediate, but any offsetting revenue benefit from more originations and the MSRs relating to the new loans would accrue over time. It is also possible that even if interest rates were to fall, mortgage originations may also fall or any increase in mortgage originations may not be enough to offset the decrease in the MSRs value caused by the lower rates.

The Corporation typically uses derivatives and other instruments to hedge its mortgage banking interest rate risk. The Corporation generally does not hedge all of its risks and the fact that hedges are used does not mean they will be successful. Hedging is a complex process, requiring sophisticated models and constant monitoring. The Corporation could incur significant losses from its hedging activities. There may be periods where the Corporation elects not to use derivatives and other instruments to hedge mortgage banking interest rate risk.

24

We rely on dividends from our subsidiaries for most of our cash flow.

The Parent Company is a separate and distinct legal entity from its banking and other subsidiaries. A substantial portion of the Parent Company’s cash flow comes from dividends from its subsidiaries. These dividends are the principal source of funds to pay dividends on the Parent Company’s common and preferred stock, and to pay interest and principal on the Parent Company’s debt. Various federal and/or applicable state laws and regulations limit the amount of dividends that the Bank and certain of our nonbanking subsidiaries may pay to us. Also, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors. In the event the Bank subsidiary is unable to pay dividends to us, we may not be able to service debt, pay obligations, or pay dividends on our common and preferred stock. The inability to receive dividends from the Bank could have a material adverse effect on our business, financial condition, and results of operations.

Operational Risks

We face significant operational risks due to the high volume and the high dollar value nature of transactions we process.

We operate in many different businesses in diverse markets and rely on the ability of our employees and systems to process transactions. Operational risk is the risk of loss resulting from our operations, including but not limited to, the risk of fraud by employees or persons outside the Corporation, the execution of unauthorized transactions, errors relating to transaction processing and technology, breaches of our internal control systems or failures of those of our suppliers or counterparties, compliance failures, cyber-attacks, technology failures, or unforeseen problems encountered while implementing new computer systems or upgrades to existing systems, business continuation and disaster recovery issues, and other external events. Insurance coverage may not be available for such losses, or where available, such losses may exceed insurance limits. This risk of loss also includes the potential legal actions that could arise as a result of an operational deficiency or as a result of noncompliance with applicable regulatory standards, adverse business decisions or their implementation, and customer attrition due to potential negative publicity. The occurrence of any of these events could cause us to suffer financial loss, face regulatory action and suffer damage to our reputation.

Unauthorized disclosure of sensitive or confidential client or customer information, whether through a cyber-attack, other breach of our computer systems or otherwise, could severely harm our business.

In the normal course of our business, we collect, process, and retain sensitive and confidential client and customer information on our behalf and on behalf of other third parties. Despite the security measures we have in place, our facilities and systems may be vulnerable to cyber-attacks, security breaches, acts of vandalism, computer viruses, malware, misplaced or lost data, programming and/or human errors, or other similar events.

Information security risks for financial institutions like us continue to increase in part because of new technologies, the increased use of the internet and telecommunications technologies (including mobile devices and cloud computing) to conduct financial and other business transactions, political activism, and the increased sophistication and activities of organized crime, perpetrators of fraud, hackers, terrorists and others.

We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business. Operational risk related to cyber-attacks is increasing as cyber-attacks evolve and have a greater and more pervasive economic impact. In addition to cyber-attacks or other security breaches involving the theft of sensitive and confidential information, hackers have engaged in attacks against large financial institutions, designed to disrupt key business services, such as customer-facing web sites. Critical infrastructure sectors, including financial services, increasingly have been the targets of cyber-attacks, including attacks emanating from foreign countries. Cyber-attacks involving large financial institutions, including distributed denial of service attacks designed to disrupt external customer-facing services, nation state cyberattacks and ransomware attacks designed to deny organizations access to key internal resources or systems or other critical data, as well as targeted social engineering and phishing email and text message attacks designed to allow unauthorized persons to obtain access to an institution’s information systems and data or that of its customers, are becoming more common and increasingly sophisticated. In particular, there has been an observed increase in the number of distributed denial of service attacks against the financial sector, for which the increase is believed to be partially attributable to politically motivated attacks as well as financial demands coupled with extortion. Further, threat actors are increasingly seeking to target vulnerabilities in software systems (including bugs, vulnerabilities in third-party systems or software and technical misconfigurations in hardware and software) and weak authentication controls used by large numbers of banking organizations in order to conduct malicious cyber activities. These types of attacks have resulted in increased supply chain and third-party risk. In addition, on March 21, 2022, the current Presidential Administration issued a warning regarding the potential for Russia to engage in malicious cyber activities, specifically including attacks on critical infrastructure such as the financial sector, in

25

response to the international economic sanctions that have been imposed against the Russian government and organizations and individuals within Russia relating to its invasion of and ongoing conflict with Ukraine.

Because the methods of cyber-attacks change frequently or, in some cases, are not recognized until launch, we are not able to anticipate or implement effective preventive measures against all possible security breaches and the probability of a successful attack cannot be predicted. Although we employ detection and response mechanisms designed to contain and mitigate security incidents, early detection may be thwarted by persistent sophisticated attacks and malware designed to avoid detection.

We also face risks related to cyber-attacks and other security breaches in connection with card transactions that typically involve the transmission of sensitive information regarding our customers through various third parties. Some of these parties have in the past been the target of security breaches and cyber-attacks, and because the transactions involve third parties and environments that we do not control or secure, future security breaches or cyber-attacks affecting any of these third parties could impact us, and in some cases we may have exposure and suffer losses for breaches or attacks relating to them. We also rely on numerous other third-party service providers to conduct other aspects of our business operations and face similar risks relating to them. We cannot be sure that such third-party information security protocols are sufficient to withstand a cyber-attack or other security breach.

Cybersecurity risks for financial institutions also have evolved as a result of the increased interconnectedness of operating environments and the use of new technologies, devices and delivery channels to transmit data and conduct financial transactions. The adoption of new products, services and delivery channels contribute to a more complex operating environment, which enhances operational risk and presents the potential for additional structural vulnerabilities. As such, a single cyber-attack is now able to compromise hundreds of organizations and affect a significant number of consumers. In addition, the adoption of hybrid and remote work environments following the COVID-19 pandemic presents institutions with additional cybersecurity vulnerabilities and risks.

The Corporation regularly evaluates its systems and controls and implements upgrades as necessary. The additional cost to the Corporation of our cyber security monitoring and protection systems and controls includes the cost of hardware and software, third party technology providers, consulting and forensic testing firms, insurance premium costs and legal fees, in addition to the incremental cost of our personnel who focus a substantial portion of their responsibilities on cyber security.

Any successful cyber-attack or other security breach involving the misappropriation, loss, leak or other unauthorized disclosure of sensitive or confidential customer information, confidential and proprietary information relating to our bank and operations, unauthorized access to our information systems or that of our third-party service providers, or unauthorized access to other data that compromises our ability to function could severely damage our reputation, erode confidence in the security of our systems, products and services, expose us to the risk of litigation and liability, disrupt our operations and have a material adverse effect on our business. Any successful cyber-attack may also subject the Corporation to regulatory investigations, litigation (including class action litigation) or enforcement, or require the payment of regulatory fines or penalties or undertaking costly remediation efforts with respect to third parties affected by a cyber security incident, all or any of which could adversely affect the Corporation’s business, financial condition or results of operations and damage its reputation. Finally, we cannot guarantee that any costs and liabilities incurred in relation to an attack or incident will be covered by our existing insurance policies or that applicable insurance will be available to us in the future on economically reasonable terms or at all.

From time to time, the Corporation engages in acquisitions, including acquisitions of depository institutions. The integration of core systems and processes for such transactions often occurs after the closing, which may create elevated risk of cyber incidents.

The Corporation may be subject to the data risks and cyber security vulnerabilities of the acquired company until the Corporation has sufficient time to fully integrate the acquiree’s customers and operations. Although the Corporation conducts comprehensive due diligence of cyber-security policies, procedures and controls of our acquisition counterparties, and the Corporation maintains adequate policies, procedures, controls and information security protocols to facilitate a successful integration, there can be no assurance that such measures, controls and protocols are sufficient to withstand a cyber-attack or other security breach with respect to the companies we acquire, particularly during the period of time between closing and final integration.

26

We rely heavily on communications and information systems to conduct our business. We have experienced cybersecurity attacks in the past and our communications and information systems may experience an interruption or breach in security from future attacks.

We have experienced cybersecurity attacks in the past. Any failure, interruption, or breach in security or operational integrity of our or our third-party vendors' communications and information systems, including those caused by a cybersecurity attack, could result in failures or disruptions in our customer relationship management, general ledger, deposit, loan, and other systems. While we have policies and procedures designed to prevent or limit the effect of the failure, interruption, or security breach of our communications and information systems, we cannot completely ensure that any such failures, interruptions, or security breaches will not occur or, if they do occur, that they will be adequately addressed. The occurrence of any failures, interruptions, or security breaches of our or our third-party vendors' communications and information systems, including those caused by a cybersecurity attack, could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our financial condition and results of operations.

We are subject to certain industry standards regarding our credit card-related services. Failure to meet those standards may significantly impact our ability to offer these services.

We are subject to the PCI-DSS, issued by the Payment Card Industry Security Standards Council. PCI-DSS contains compliance guidelines with regard to our security surrounding the physical and electronic storage, processing and transmission of cardholder data. Compliance with PCI-DSS and implementing related procedures, technology and information security measures requires significant resources and ongoing attention. Costs and potential problems and interruptions associated with the implementation of new or upgraded systems and technology, such as those necessary to achieve compliance with PCI-DSS or with maintenance or adequate support of existing systems could also disrupt or reduce the efficiency of our operations. Any material interruptions or failures in our payment-related systems or third parties that we rely upon could have a material adverse effect on our business, results of operations and financial condition. If there are amendments to PCI-DSS, the cost of compliance could increase, and we may suffer loss of critical data and interruptions or delays in our operations as a result. If we or our service providers are unable to comply with the standards imposed by PCI-DSS, we may be subject to fines and restrictions on our ability to offer certain services, which could materially and adversely affect our business.

Compliance with ever-evolving federal and state laws relating to the handling of information about individuals involves significant expenditure and resources, and any failure by us or our vendors to comply may result in significant liability, negative publicity, and/or an erosion of trust, which could materially adversely affect our business, results of operations, and financial condition.

We are subject to a number of U.S. federal, state, local and foreign laws and regulations relating to consumer privacy and data protection. Under privacy protection provisions of the GLBA and its implementing regulations and guidance, we are limited in our ability to disclose certain non-public information about consumers to nonaffiliated third parties. The GLBA regulates, among other things, the use of certain information about individuals (“non-public personal information”) in the context of the provision of financial services, including by banks and other financial institutions. The GLBA includes both a “Privacy Rule,” which imposes obligations on financial institutions relating to the use or disclosure of non-public personal information, and a “Safeguards Rule,” which imposes obligations on financial institutions and, indirectly, their service providers to implement and maintain physical, administrative and technological measures to protect the security of non-public personal financial information. Any failure to comply with the GLBA could result in substantial financial penalties and significant reputational harm.

While GLBA-regulated nonpublic, personal information generally is exempt under the CCPA, the CCPA applies to the personal information of representatives of any business contacts that the Bank engages with who are California residents, California employees, and California consumers whose personal information we may collect outside the scope of the GLBA (e.g., certain personal information collected from visitors to our websites). The CCPA went into effect in 2020 and imposes obligations on businesses that process personal information of California residents. Among other things, the CCPA: requires disclosures to such residents about the data collection, use and disclosure practices of covered businesses; provides such individuals expanded rights to access, delete, and correct their personal information, and opt-out of certain sales or transfers of personal information; and provides such individuals with a private right of action and statutory damages for certain data breaches. The CCPA and CPRA mark the beginning of a trend toward more stringent privacy legislation in the United States, and multiple states have enacted, or are expected to enact, similar laws, including the Oregon Consumer Privacy Law which takes effect on July 1, 2024, not all of which exempt financial institutions categorically. Many other states are currently reviewing or proposing the need for greater regulation of the collection, sharing, use and other processing of information related to individuals for marketing purposes or otherwise, and there remains increased interest at the federal level as well. Further, in order to comply with the

27

varying state laws around data breaches, we must maintain adequate security measures, which require significant investments in resources and ongoing attention.

Additionally, laws, regulations, and standards covering marketing, advertising, and other activities conducted by telephone, email, mobile devices, and the internet are or may become applicable to our business, such as the TCPA, the CAN-SPAM Act, and similar state consumer protection and communication privacy laws, such as California’s Invasion of Privacy Act.

We occasionally make telephone calls and/or send SMS text messages to customers. The actual or perceived improper calling of customer phones and/or sending of text messages may subject us to potential risks, including liabilities or claims relating to consumer protection laws such as the TCPA. Numerous class-action suits under federal and state laws have been filed in recent years against companies who conduct telemarketing and/or SMS texting programs, with many resulting in multi-million-dollar settlements to the plaintiffs. Any future such litigation against us could be costly and time-consuming to defend. In particular, the TCPA imposes significant restrictions on the ability to make telephone calls or send text messages to mobile telephone numbers without the prior consent of the person being contacted. Federal or state regulatory authorities or private litigants may claim that the notices and disclosures we provide, form of consents we obtain or our outreach practices are not adequate or violate applicable law. This may in the future result in civil claims against us. Claims that we have violated the TCPA could be costly to litigate, whether or not they have merit, and could expose us to substantial statutory damages or costly settlements.

We also send marketing messages via email and are subject to the CAN-SPAM Act. The CAN-SPAM Act imposes certain obligations regarding the content of emails and providing opt-outs (with the corresponding requirement to honor such opt-outs promptly). While we strive to ensure that all of our marketing communications comply with the requirements set forth in the CAN-SPAM Act, any violations could result in the FTC seeking civil penalties against us.

Moreover, we are considered a “user” of consumer reports provided by consumer reporting agencies under the Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactions Act (collectively, “FCRA”). FCRA regulates and protects consumer information collected by consumer reporting agencies and imposes specific obligations on “users” of consumer reports. Such obligations may include restricting the sharing of information contained in a consumer report, notifying consumers when such reports are used to make an adverse decision, and, in the context of completing employee background checks, providing a notice containing certain disclosures to the consumer and obtaining their consent.

Any actual or perceived failure to comply with evolving regulatory frameworks around the development and use of artificial intelligence could adversely affect our business, results of operations, and financial condition.

Our business increasingly relies on AI, machine learning and automated decision making to improve our services and our customer’s experience. The regulatory framework around the development and use of these emerging technologies is rapidly evolving, and many federal, state and foreign government bodies and agencies have introduced and/or are currently considering additional laws and regulations. As a result, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on our business.

Any of the foregoing, together with developing guidance and/or decisions in this area, may affect our use of AI and our ability to provide and improve our services, require additional compliance measures and changes to our operations and processes, and result in increased compliance costs and potential increases in civil claims against us. Any actual or perceived failure to comply with evolving regulatory frameworks around the development and use of AI, machine learning and automated decision making could adversely affect our business, results of operations, and financial condition.

We are dependent upon third parties for certain information system, data management and processing services, and to provide key components of our business infrastructure.

We outsource certain information system and data management and processing functions to third-party providers, including, among others, Fiserv, Inc. and its affiliates to compete in a rapidly evolving financial marketplace. These third-party service providers are sources of operational and informational security risk to us, including risks associated with operational errors, information system interruptions or breaches, and unauthorized disclosures of sensitive or confidential client or customer information. Concentration among larger third-party providers servicing large segments of the banking industry can also potentially affect wide segments of the financial industry. If third-party service providers encounter any of these issues, or if we have difficulty communicating with them, we could be exposed to disruption of operations, loss of service or connectivity to customers, reputational damage, and litigation risk that could have a material adverse effect on our results of operations or our business.

Third-party vendors provide key components of our business infrastructure, such as internet connections, network access and core application processing. While we have selected these third-party vendors in accordance with supervisory requirements, we

28

do not control their actions. The actions of these third parties, including as a result of their not providing us their services for any reason or their performing their services poorly, could adversely affect our ability to deliver products and services to our customers and otherwise to conduct our business. Replacing these third-party vendors could also entail significant delay and expense.

The potential for business interruption exists throughout our organization.

Integral to our performance is the continued efficacy of our technical systems, operational infrastructure, relationships with third parties and the vast array of associates and key executives in our day-to-day and ongoing operations. Failure by any or all of these resources subjects us to risks that may vary in size, scale and scope. This includes, but is not limited to, operational or technical failures, ineffectiveness or exposure due to interruption in third party support, problems arising from systems conversions, as well as the loss of key individuals or failure on the part of key individuals to perform properly. Although management has established policies and procedures to address such failures, the occurrence of any such event could have a material adverse effect on our business, which, in turn, could have a material adverse effect on our financial condition and results of operations.

Changes in the federal, state, or local tax laws may negatively impact our financial performance.

We are subject to changes in tax law that could increase our effective tax rates. These law changes may be retroactive to previous periods and as a result could negatively affect our current and future financial performance. For example, legislation enacted in 2017 resulted in a reduction in our federal corporate tax rate from 35% in 2017 to 21% in 2018, which had a favorable impact on our earnings and capital generation abilities. However, this legislation also enacted limitations on certain deductions, such as the deduction of FDIC deposit insurance premiums, which partially offset the anticipated increase in net earnings from the lower tax rate. Any increase in the corporate tax rate or surcharges that may be adopted by Congress would adversely affect our results of operations in future periods.

In addition, the Bank’s customers experienced and likely will continue to experience varying effects from both the individual and business tax provisions of the Tax Act and other future changes in tax law and such effects, whether positive or negative, may have a corresponding impact on our business and the economy as a whole.

Further, on August 16, 2022, the Inflation Reduction Act of 2022 was enacted into law. The legislation imposed a non-deductible 1% excise tax on repurchases of stock by “covered corporations,” including the Corporation. As a result, our results of operations in future periods may be impacted adversely to the extent of any significant stock repurchases by the Corporation.

Impairment of investment securities, goodwill, other intangible assets, or DTAs could require charges to earnings, which could result in a negative impact on our results of operations.

In assessing whether the impairment of investment securities is related to a deterioration in credit factors, management considers the length of time and extent to which the fair value has been less than cost, the financial condition and near-term prospects of the issuer, and the intent and ability to retain our investment in the security for a period of time sufficient to allow for any anticipated recovery in fair value in the near term.

Under current accounting standards, goodwill is not amortized but, instead, is subject to impairment tests on at least an annual basis or more frequently if an event occurs or circumstances change that reduce the fair value of a reporting unit below its carrying amount. A decline in our stock price or occurrence of a triggering event following any of our quarterly earnings releases and prior to the filing of the periodic report for that period could, under certain circumstances, cause us to perform a goodwill impairment test and result in an impairment charge being recorded for that period which was not reflected in such earnings release. During 2023, the annual impairment test conducted in May, using a qualitative assessment, indicated that the estimated fair value of all of the Corporation’s reporting units exceeded the carrying value. In the event that we conclude in a future assessment that all or a portion of our goodwill may be impaired, a non-cash charge for the amount of such impairment would be recorded to earnings. Such a charge would have no impact on tangible capital. At December 31, 2023, we had goodwill of $1.1 billion, which represents approximately 26% of stockholders’ equity.

In assessing the realizability of DTAs, management considers whether it is more likely than not that some portion or all of the DTAs will not be realized. Assessing the need for, or the sufficiency of, a valuation allowance requires management to evaluate all available evidence, both negative and positive, including the recent trend of quarterly earnings. Positive evidence necessary to overcome the negative evidence includes whether future taxable income in sufficient amounts and character within the carryback and carryforward periods is available under the tax law, including the use of tax planning strategies. When negative evidence (e.g., cumulative losses in recent years, history of operating loss or tax credit carryforwards expiring unused) exists, more positive evidence than negative evidence will be necessary.

29

The impact of each of these impairment matters could have a material adverse effect on our business, results of operations, and financial condition.

Revenues from our investment management and asset servicing businesses are significant to our earnings.

Generating returns that satisfy clients in a variety of asset classes is important to maintaining existing business and attracting new business. Administering or managing assets in accordance with the terms of governing documents and applicable laws is also important to client satisfaction. Failure in either of the foregoing areas can expose us to liability, and result in a decrease in our revenues and earnings.

Climate change and related legislative and regulatory initiatives may result in operational changes and expenditures that could significantly impact our business.

The current and anticipated effects of climate change are creating an increasing level of concern for the state of the global environment. As a result, political and social attention to the issue of climate change has increased. In recent years, governments across the world have entered into international agreements or have otherwise acted to attempt to reduce global temperatures, in part by limiting GHG emissions. The Federal Reserve Board became a member of the Network of Central Banks and Supervisors for Greening the Financial System and, in its Financial Stability Report of November 2020, specifically addressed the implications of climate change for markets, financial exposures, financial institutions, and financial stability. The U.S. Congress, state legislatures and federal and state regulatory agencies have continued to propose and advance numerous legislative and regulatory initiatives seeking to mitigate the effects of climate change, including mandatory substantive and/or disclosure requirements regarding climate change. Such initiatives have been pursued with rigor under the current Presidential Administration. The Financial Stability Oversight Council, of which the OCC is a member, published a report in October 2021 identifying climate-related financial risk as an “emerging threat” to financial stability. The leadership of the federal banking agencies, including the Comptroller of the Currency, have emphasized that climate-related risks are faced by banking organizations of all types and sizes, specifically including physical and transition risks, and are in the process of enhancing supervisory expectations regarding banks' risk management practices. To that end, on October 24, 2023, the federal banking agencies, including the OCC, issued interagency guidance on principles for climate-related financial risk management by large financial institutions. The guidance reiterates the agencies’ view that financial institutions are likely to be affected by both the physical risks and transition risks associated with climate change, which can manifest as traditional risks such as credit, market, liquidity, operation, and legal risks. To address these risks, the guidance covers six areas: governance; policies, procedures, and limits; strategic planning; risk management; data, risk management, and reporting; and scenario analysis. The guidance applies only to banking organizations with total consolidated assets of greater than $100 billion and therefore does not apply to the Bank directly. In addition, the OCC stressed in its 2024 Bank Supervision Operating Plan that climate-related financial risk is one of its supervision priorities and objectives; however, the OCC noted that its focus on climate-related financial risks will be limited to financial institutions with total assets of over $100 billion. Additionally, in March 2022, the SEC proposed new climate-related disclosure rules, which if finalized, would require new climate-related disclosures in SEC filings and audited financial statements, including certain climate-related metrics and direct and indirect GHG emissions data, information about climate-related targets and goals, transition plans, if any, and attestation requirements. In October 2023, California Governor Gavin Newsom signed two climate-related disclosure bills into law. The Climate Corporate Data Accountability Act (referred to as SB 253) requires both public and private U.S. businesses with revenues greater than $1 billion doing business in California to report their GHG emissions including scopes 1, 2, and 3, beginning